Abnormal behavior recognition method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides an abnormal behavior recognition method and device, electronic equipment and a storage medium, and relates to the technical field of data processing, and the method comprises the steps: obtaining behavior characteristics of each user participating in a target online activity; clustering the behavior characteristics of each user based on a first model to obtain a first classification result of each user; based on a second model, performing behavior classification on the behavior characteristics of each user to obtain a second classification result of each user; determining a target user meeting a predetermined condition from the first classification result and the second classification result of each user; and calling a predetermined target large model, and analyzing whether the behavior characteristics of the target user belong to abnormal behavior characteristics to obtain an analysis result. Through the scheme, the accuracy of the judgment result of the abnormal behavior of the user can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, in particular to an abnormal behavior recognition method and device, electronic equipment and storage medium. BACKGROUND

[0002] The abnormal behavior of a user on a network generally refers to a behavior of obtaining activity benefits or destroying activity order by means of exploiting loopholes in activity rules, technical means or improper ways. After a company carries out online operation activities on a mobile APP (Application, mobile software), if the abnormal behavior of a user can be recognized, the network security can be improved and the loss of the company can be reduced.

[0003] At present, a clustering algorithm is usually used to classify the behavior characteristics of each user for an activity (for example, characteristics determined based on the withdrawal amount and withdrawal times of the user for the activity), and if the classification result of any user indicates that the behavior characteristics of the user belong to abnormal behavior characteristics, it is determined that the user has abnormal behavior for the activity.

[0004] However, the related art only uses the clustering algorithm to classify the behavior characteristics to determine abnormal behavior, which may not accurately determine whether a user has abnormal behavior, for example, there may be misjudgment or omission. SUMMARY

[0005] Embodiments of the present application aim to provide an abnormal behavior recognition method and device, electronic equipment and storage medium to improve the accuracy of the determination result of whether a user has abnormal behavior. The specific technical solutions are as follows:

[0006] In a first aspect, an abnormal behavior recognition method is provided, and the method comprises:

[0007] obtaining the behavior characteristics of each user participating in a target online activity;

[0008] clustering the behavior characteristics of each user based on a first model for clustering to obtain a first classification result of each user; wherein the first classification result of each user includes: the behavior characteristics of the user belong to abnormal behavior characteristics, or the behavior characteristics of the user belong to normal behavior characteristics;

[0009] based on the second model, behavior classification is performed on the behavior features of each user to obtain a second classification result of each user; wherein the behavior classification is used to analyze whether the behavior features of any user belong to normal behavior features or abnormal behavior features, the second model is trained based on each first sample feature and each second sample feature, the first sample feature is a behavior feature of normal behavior issued for the target online activity, and the second sample feature is a behavior feature of abnormal behavior issued for the target online activity;

[0010] from the first classification result and the second classification result possessed by each user, a user whose result satisfies a predetermined condition is determined to obtain a target user; wherein the predetermined condition represents abnormal behavior features;

[0011] a predetermined target large model is called to analyze whether the behavior features of the target user belong to abnormal behavior features to obtain an analysis result.

[0012] In a second aspect, an embodiment of the present application provides an abnormal behavior recognition device, and the device comprises:

[0013] a obtaining module configured to obtain behavior features of each user participating in a target online activity;

[0014] a clustering module configured to perform clustering on the behavior features of each user based on a first model for clustering to obtain a first classification result of each user; wherein the first classification result of each user comprises: the behavior features of the user belong to abnormal behavior features, or the behavior features of the user belong to normal behavior features;

[0015] a classification module configured to perform behavior classification on the behavior features of each user based on a second model to obtain a second classification result of each user; wherein the behavior classification is used to analyze whether the behavior features of any user belong to normal behavior features or abnormal behavior features, the second model is trained based on each first sample feature and each second sample feature, the first sample feature is a behavior feature of normal behavior issued for the target online activity, and the second sample feature is a behavior feature of abnormal behavior issued for the target online activity;

[0016] a determination module configured to determine, from the first classification result and the second classification result possessed by each user, a user whose result satisfies a predetermined condition to obtain a target user; wherein the predetermined condition represents abnormal behavior features;

[0017] a first calling module configured to call a predetermined target large model to analyze whether the behavior features of the target user belong to abnormal behavior features to obtain an analysis result.

[0018] In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory complete mutual communication through the communication bus;

[0019] The memory is configured to store a computer program.

[0020] The processor is configured to execute the program stored in the memory, and implement any of the abnormal behavior identification methods.

[0021] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement any of the abnormal behavior identification methods.

[0022] The embodiment of the present application further provides a computer program product comprising instructions which, when executed on a computer, cause the computer to perform any of the above-described abnormal behavior identification methods.

[0023] The embodiment of the present application has the following beneficial effects:

[0024] The abnormal behavior identification method provided by the embodiment of the present application, after obtaining the behavior characteristics of each user participating in the target online activity, clusters the behavior characteristics of each user based on a first model for clustering to obtain a first classification result of each user, and classifies the behavior characteristics of each user based on a second model to obtain a second classification result of each user; the first classification result and the second classification result of each user can both analyze whether the behavior characteristics of the user belong to the characteristics of abnormal behavior or the characteristics of normal behavior; in order to reduce the missed judgment, the present application determines that there is at least one result representing the characteristics of abnormal behavior from the first classification result and the second classification result of each user, and obtains a target user, that is, for the first classification result and the second classification result of each user, if at least one result represents that the behavior characteristics of the user belong to the characteristics of abnormal behavior, the user is taken as the target user. In order to reduce the misjudgment of the first model and the second model, the present application can call a predetermined target large model to analyze whether the behavior characteristics of the target user belong to the characteristics of abnormal behavior, and obtain an analysis result. The present application combines the first model, the second model and the target large model, reduces the missed judgment of abnormal behavior through the first model and the second model, and analyzes the behavior characteristics of the target user through the target large model, which can reduce the misjudgment of the abnormal behavior of the target user. It can be seen that the present application can improve the accuracy of the determination result of the abnormal behavior of the user.

[0025] Of course, implementing any product or method of the present application does not necessarily require achieving all the advantages described above at the same time. BRIEF DESCRIPTION OF DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the accompanying drawings needed to be used in the embodiments or prior art description will be briefly introduced. Obviously, the accompanying drawings in the following description are only some embodiments of the present application, and other embodiments can be obtained by those skilled in the art based on these drawings.

[0027] Figure 1 A flowchart of an abnormal behavior recognition method provided for an embodiment of the present application;

[0028] Figure 2 A schematic diagram of the steps of feature extraction provided for an embodiment of the present application;

[0029] Figure 3 A schematic diagram of the steps of feature weighting provided for an embodiment of the present application;

[0030] Figure 4 A schematic diagram of the steps of feature standardization provided for an embodiment of the present application;

[0031] Figure 5 A flowchart of the process of model training provided for an embodiment of the present application;

[0032] Figure 6 A flowchart of the process of model training provided for an embodiment of the present application;

[0033] Figure 7 A flowchart of the process of model training provided for an embodiment of the present application;

[0034] Figure 8 A result example of encrypting user information provided for an embodiment of the present application;

[0035] Figure 9 A structural schematic diagram of an abnormal behavior recognition device provided for an embodiment of the present application;

[0036] Figure 10 A block diagram of an electronic device provided for an embodiment of the present application. DETAILED DESCRIPTION

[0037] The technical solutions in the embodiments of the present application will be described clearly and completely with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art based on the present application belong to the scope of protection of the present application.

[0038] The following first introduces an abnormal behavior identification method provided by an embodiment of the present invention.

[0039] Among them, an abnormal behavior identification method provided by an embodiment of the present invention can be applied to an electronic device, which can be a terminal device or a server. For example, the terminal device can be a mobile phone, a computer, etc. The present invention does not limit the specific form of the electronic device. An abnormal behavior identification method provided by an embodiment of the present invention can be applied to any scenario with abnormal behavior identification needs, for example: an enterprise conducts online operation activities on a mobile APP, and identifies whether the user's behavior with respect to the online operation activity is abnormal behavior; the online operation activity can be a check-in activity, a withdrawal activity and / or an online consultation activity, etc. The present invention does not limit this.

[0040] In addition, the execution entity of the abnormal behavior identification method provided in an embodiment of the present invention can be an abnormal behavior identification device. Exemplarily, the abnormal behavior identification device can be functional software running on a terminal device, for example, functional software for identifying abnormal behavior. Furthermore, the abnormal behavior identification device can also be a plug-in in an existing client, for example, a plug-in in a client for an online operation activity conducted by an enterprise. In this case, the abnormal behavior identification device can directly obtain the behavioral characteristics of each user with respect to the online operation activity and analyze abnormal behavior, etc. Exemplarily, when the abnormal behavior identification method is applied to a server, the abnormal behavior identification device can be a functional module in the server.

[0041] The following is an exemplary introduction to an abnormal behavior identification method provided by an embodiment of the present invention with reference to the accompanying drawings.

[0042] like Figure 1 As shown, an abnormal behavior identification method provided by an embodiment of the present invention may include the following steps:

[0043] S101: Obtaining behavioral characteristics of each user participating in a target online activity;

[0044] When identifying whether a user has engaged in abnormal behavior, the present invention can first obtain the behavioral characteristics of each user participating in a target online activity. The target online activity can be an online activity conducted through a target app, such as a shopping app, music app, video app, or financial app. The target online activity can also be a cash withdrawal activity, a check-in activity, a lottery activity, and the like, though the present invention does not limit this.

[0045] Exemplarily, in an implementation manner, the acquiring the behavior features of the users participating in the target online activity comprises: in response to a trigger condition of the abnormal behavior identification, acquiring the behavior features of the users participating in the target online activity in a specified period; wherein the specified period is a period with a predetermined length and ending at a current time; in order to ensure the real-time performance of the abnormal behavior identification, when the trigger condition of the abnormal behavior identification is met, for example, when a predetermined time point is reached, when an instruction for performing the abnormal behavior identification is received, and the like, the behavior features of the users participating in the target online activity in the specified period with the predetermined length and ending at the current time can be acquired. The predetermined period can be flexibly set according to requirements, for example, 7 days, one month, and the like. The application can also pre-construct a database for storing the behavior data of the users. Exemplarily, for the activities of the prize drawing and the cash withdrawal, the database can include: a user device binding table (for extracting the relationship data of the user and the device), a red envelope cash withdrawal record table (for extracting the behavior data of the user in the cash withdrawal activity), and a prize drawing record table (for extracting the behavior data of the user in the prize drawing activity); and the data in the database is obtained after the behavior data of the user is desensitized and feature extracted, and the specific desensitization and feature extraction manner can be similar to the prior art, which will not be described herein.

[0046] In obtaining the behavior characteristics of each user participating in the lottery and withdrawal activities, the behavior data of the user can be obtained from the user equipment binding table, the red packet withdrawal record table and the lottery record table of the database, and the behavior characteristics of each user are calculated. The behavior characteristics of any user can be a feature vector including multiple behavior dimensions. Each behavior dimension can be a dimension of the type of behavior data recorded in the database, or each behavior dimension can be a dimension analyzed according to the behavior data recorded in the database. For example, the type of behavior data of the user recorded in the database can include at least one of the following: withdrawal count in the last 7 days (withdrawal_count): the number of withdrawals of each user in the last 7 days during the activity; total amount of withdrawal in the last 7 days (total_amount): the total amount of withdrawal of each user in the last 7 days during the activity, which can be used to identify users with unusually high withdrawal amounts; number of bound mobile phone numbers in the last 7 days (phone_count): the number of mobile phone numbers bound to the openid (user identity, usually a URL (Universal Resource Locator, Universal Resource Locator)) of each user in the last 7 days during the activity. Usually, one user's openid corresponds to one mobile phone number. If multiple mobile phone numbers are bound within 7 days, it may indicate an anomaly; withdrawal frequency in the last 7 days (withdrawal_frequency): the average time interval of each withdrawal of each user in the last 7 days during the activity, which is used to identify users who frequently withdraw small amounts, which can be an abnormal behavior; lottery count in the last 7 days (lottery_count): the number of lotteries of each user in the last 7 days during the activity; lottery frequency in the last 7 days (lottery_frequency): the frequency of each user participating in the lottery in the last 7 days during the activity, which is used to identify users who frequently participate in the lottery, which can also be an abnormal behavior; whether there is a fixed device number in the last 7 days (device_fund_combinations): whether there is a fixed device number in the last 7 days during the activity. The combination of the user's fund account and mobile phone number can be used to represent whether the combination number is abnormal; whether there is a fixed fund account in the last 7 days (fund_suspicious_flag): whether there is a fixed fund account in the last 7 days during the activity. The combination of the user's device number and mobile phone number can be used to represent whether the combination number is abnormal; whether there is a fixed mobile phone number in the last 7 days (device_suspicious_flag): whether there is a fixed mobile phone number in the last 7 days during the activity. The combination of the user's device number and fund account can be used to represent whether the combination number is abnormal.

[0047] In addition, when obtaining the behavior characteristics of each user from the database, the behavior data of the user can be extracted from the database and analyzed and calculated by means of SQL (Structured Query Language) query to obtain the behavior characteristics of the user; for example, a plurality of SQL queries are defined, each SQL query is used to extract (analyze and calculate) the characteristics of one behavior dimension (such as the number of withdrawals, the total amount of withdrawals, etc.) from the database, each SQL query constitutes a SQL two-dimensional table, and each user corresponds to a SQL two-dimensional table (the SQL queries included in different SQL two-dimensional tables are the same, but the behavior characteristics obtained after executing the SQL queries for each user's SQL two-dimensional table are different). For example, taking the user participating in the target online activity through the mobile phone as an example, the mobile phone number of each user is associated with a SQL two-dimensional table, and for each user, each SQL query in the associated SQL two-dimensional table is executed, and after each SQL query is executed, the characteristics of one behavior dimension of the user are obtained, and after each SQL query is executed, the characteristics of each behavior dimension are spliced to obtain the characteristic vector of the multiple behavior dimensions of the user, that is, the behavior characteristics of the user are obtained. Among them, the plurality of behavior dimensions can include: the number of withdrawals, the total amount of withdrawals, the number of draws, the withdrawal frequency, the total draw cost, whether abnormal, the device suspicious flag, the fund suspicious flag, and the combination number of the device and the fund account, etc., and the characteristics of the plurality of behavior dimensions can be obtained by analyzing and calculating the behavior data such as the number of withdrawals of the user in the past 7 days. In addition, any behavior characteristics, normal characteristics or abnormal characteristics involved in the present application can be understood as including a characteristic vector of a plurality of behavior dimensions, and the plurality of behavior dimensions are the same.

[0048] For example, in the present application, a database can be connected through SQLAlchemy (a database toolkit for interacting with a database) and SQL queries can be executed; first, a blank SQL two-dimensional table DataFrame is created for storing data of behavioral features extracted from the database; for the SQL two-dimensional table, each SQL query is assigned a feature name, such as "withdrawal_count (withdrawal times in the past 7 days)", as the table header of the DataFrame. When executing the SQL query, the SQL two-dimensional table is traversed, and for each SQL query in the two-dimensional table, the SQL query is executed and the query result is stored in the DataFrame; the columns in the DataFrame are renamed to ensure that the column names are consistent with the feature names. If the DataFrame is empty, the DataFrame is initialized as the current query result; if the DataFrame is not empty, the current query result is merged with the previous query result (the SQL query in the two-dimensional table may also have been executed before the current SQL query is executed, and the results of the previously executed SQL query and the currently executed SQL query in the two-dimensional table are merged), and an outer join is performed based on the user's mobile phone number (if there are missing values in the DataFrame, 0 is used to fill in the missing values). After the SQL queries in the SQL two-dimensional table for each user are executed, a two-dimensional table storing the behavioral features of each user is obtained.

[0049] After obtaining the behavioral features of each user from the database, the obtained behavioral features of each user can also be backed up, that is, for each user, two two-dimensional tables containing behavioral features are generated, the behavioral features in the two two-dimensional tables are the same, the behavioral features in one two-dimensional table are used for subsequent anomaly analysis, and the behavioral features in the other two-dimensional table are used as the basis for manually judging whether the user is abnormal. In addition, after obtaining the behavioral features of each user, for each user, the features of each behavioral dimension of the user can be normalized for subsequent analysis. Furthermore, before normalization, the features of each behavioral dimension of the user can be weighted to increase the importance of the features of one or more behavioral dimensions, for example: for each behavioral dimension feature fi, the weighted feature fi ’ = wi x fi, where wi is a predefined weight factor. The weight factor of each behavioral dimension feature can be the same or different, and can be set according to the degree to which the feature of the behavioral dimension can reflect whether the user behavior is abnormal, for example: the weight factor of the feature of the phone_count behavioral dimension in the past 7 days is greater than the weight factor of the feature of the lottery_count behavioral dimension in the past 7 days, and the present application does not limit the size of the weight factor of each behavioral dimension.

[0050] Exemplarily, in an implementation, when performing normalization, for the two-dimensional table for storing the behavior characteristics of each user, the non-numeric characteristics do not need to be normalized, and the non-numeric characteristics (customer_phone, for example, the mobile phone number of the user) can be deleted first to adapt to the normalization; then, through the Z-score standardization method, the data of the behavior characteristics except the non-numeric characteristics is fitted and converted, the normalization of the characteristics is realized, and the value of each behavior dimension of the normalized characteristics is converted into a distribution with a mean of 0 and a standard deviation of 1. The normalization formula can be: Z=(X-μ) / σ; Z is the normalized behavior characteristic, X is the original behavior characteristic, μ is the mean, and σ is the standard deviation. It should be noted that the above normalization, the behavior characteristics in the database, the behavior characteristics of each user obtained, the behavior characteristics of each user obtained from the database, and the manner of weighting the behavior characteristics are only examples and should not be construed as limiting the present application.

[0051] S102: clustering the behavior characteristics of each user based on the first model for clustering to obtain a first classification result of each user;

[0052] The first classification result of each user includes: the behavior characteristics of the user belong to the characteristics of abnormal behavior, or the behavior characteristics of the user belong to the characteristics of normal behavior.

[0053] After obtaining the behavior characteristics of each user participating in the target online activity, the behavior characteristics of each user can be clustered by the first model for clustering to obtain the first classification result that the behavior characteristics of each user belong to the characteristics of abnormal behavior or belong to the characteristics of normal behavior. Exemplarily, in an implementation, the first model for clustering in the present application is an unsupervised model, which can be understood as a clustering algorithm, and the clustering categories are set as two categories of the characteristics of normal behavior and the characteristics of abnormal behavior. By clustering the behavior characteristics of each user through the first model, the behavior characteristics of each user can be classified as the characteristics of normal behavior or the characteristics of abnormal behavior.

[0054] This embodiment takes the KMeans clustering model as an example (a model that randomly selects K data points as initial centroids for clustering), and sets K as 2 to classify the behavior characteristics of each user into two categories (the characteristics of normal behavior or the characteristics of abnormal behavior). The specific process can include: assigning the behavior characteristics of each user (the behavior characteristics of each user can be understood as the characteristics of the user containing multiple behavior dimensions) to the category of the nearest centroid; recalculating the centroid of each category to obtain a new centroid; repeating the above steps until the currently calculated centroid is the same as the previously calculated centroid (i.e., the centroid does not change) or the maximum number of iterations is reached.

[0055] Afterwards, a first classification result of whether the behavior feature of each user belongs to the normal behavior feature or the abnormal behavior feature can be obtained from the clustering result of the first model, so as to determine the target user subsequently.

[0056] In addition, the normal behavior feature and the abnormal behavior feature can be extracted from the normalized features of each user, and the normal behavior feature and the abnormal behavior feature can be extracted from the original features of each user before normalization. That is, the normal behavior feature and the abnormal behavior feature can be extracted from the original behavior features and the normalized behavior features of each user, so as to be analyzed subsequently (for example, as an example of a prompt word, or the abnormal behavior feature can be used as a sample for training the second model, etc.).

[0057] S103: performing behavior classification on the behavior features of each user based on the second model to obtain a second classification result of each user;

[0058] The behavior classification is used to analyze whether the behavior feature of any user belongs to the normal behavior feature or the abnormal behavior feature, the second model is trained based on the first sample feature and the second sample feature, the first sample feature is the normal behavior feature of the target online activity, and the second sample feature is the abnormal behavior feature of the target online activity.

[0059] The application can also perform behavior classification on the behavior features of each user based on the second model to obtain a second classification result of each user. The second model is a semi-supervised model, and the second model can be trained based on the first sample feature of the normal behavior feature of the target online activity and the second sample feature of the abnormal behavior feature of the target online activity. The specific training method is described in detail in the subsequent embodiments, and will not be described here.

[0060] For example, in an implementation manner, the first sample feature includes a plurality of first normal features, the second sample feature includes at least one first abnormal feature and at least one second abnormal feature, the second abnormal feature is the behavior feature of the behavior of the target online activity, and the second abnormal feature is the behavior feature of the behavior of the target online activity.

[0061] In the present application, each first sample feature can include a plurality of first normal features, i.e., a plurality of features manually labeled as belonging to normal behavior; each second sample feature includes at least one first abnormal feature and at least one second abnormal feature; the first abnormal feature is a feature manually labeled as belonging to abnormal behavior; the second abnormal feature is a feature belonging to abnormal behavior analyzed by a predetermined analysis method for the target online activity. Wherein, the feature manually labeled as belonging to normal behavior or the feature belonging to abnormal behavior can be understood as the explicit normal behavior feature or the abnormal behavior feature; the feature belonging to abnormal behavior analyzed by the predetermined analysis method can be understood as the suspected abnormal behavior feature; the above sample features are used for semi-supervised training of the second model, which can improve the accuracy of the second model in behavior analysis. Moreover, the first normal feature can include: a feature analyzed by the predetermined analysis method as belonging to abnormal behavior but manually labeled as belonging to normal behavior (i.e., a misjudged feature), and a feature analyzed by the predetermined analysis method as belonging to normal behavior and manually labeled as belonging to normal behavior, that is, the first normal feature can include the explicit normal behavior feature, and the feature actually belonging to normal behavior but misjudged as abnormal behavior by the predetermined analysis method; the misjudged feature is included in the first normal feature, so that the second analysis model can reduce the probability of misjudging the feature actually belonging to normal behavior as an abnormal behavior feature, i.e., reduce the misjudgment probability of the second analysis model.

[0062] In addition, the predetermined analysis method can be a clustering analysis method, which can be similar to the process of clustering the behavior characteristics of the user by the first model to obtain the first classification result of the user; of course, the predetermined analysis method can also be an analysis method by any analysis algorithm capable of identifying the behavior feature of the user as a normal behavior feature or an abnormal behavior feature, which is not limited in the present application.

[0063] In addition, in order to further improve the accuracy of the second model behavior classification, each second sample feature in the present application further includes at least one third abnormal feature; the third abnormal feature is a feature belonging to abnormal behavior for the target online activity simulated and generated by calling the target large model according to a second prompt word; the second prompt word includes: an activity rule of the target activity, a second example and a second content; the second example includes the first abnormal feature and the first normal feature; the second content includes: content guiding the target large model to analyze the second example and the activity rule of the target activity, and simulate and generate a feature belonging to abnormal behavior for the target online activity.

[0064] The second sample features can also include at least one third type of abnormal feature, which is a feature belonging to abnormal behavior for the target online activity simulated by the target large model through the second prompt word; that is, the application can expand the second sample features of the second model by simulating the features of abnormal behavior through the large model.

[0065] In order to guide the target large model to accurately simulate the third type of abnormal feature, the second prompt word can include the activity rules of the target activity, the second example and the second content. The second example can include the first type of abnormal feature and the first type of normal feature, that is, the features of normal behavior and the features of abnormal behavior, so that the target large model simulates the features of abnormal behavior; the second content can include the content of guiding the target large model to analyze the second example and the activity rules of the target activity, and simulate the features belonging to abnormal behavior for the target online activity.

[0066] The second prompt word can be understood as a guiding word for guiding the target large model to generate simulated third type of abnormal features. For example, the second prompt word can include the following content:

[0067] "#Role: You are a professional risk control modeling analysis assistant, focusing on the abnormal sample analysis and generation of the activity abnormal behavior unsupervised model.

[0068] ##Please think according to the following aspects before answering the question

[0069] ###Aspect 1: Analyze existing samples: Step 1. According to the given misjudgment samples (i.e. the features of misjudgment contained in the first normal features) and the suspected samples confirmed as abnormal behavior (i.e. the first abnormal features, which can also include the second abnormal features), analyze the feature rules.

[0070] Step 2. Understand the meaning of each feature, such as "withdrawal_count (withdrawal count in the past 7 days)" and the like.

[0071] ###Aspect 2: Analyze activity rules: Step 1. According to the given activity rules and feature list, analyze the possible abnormal behavior features.

[0072] ###Aspect 3: Generate abnormal behavior features: Step 1. Refer to the features confirmed as abnormal behavior, adjust the values of these features, and increase randomness in the generation process (i.e. guide the target large model to imitate abnormal behavior features and create abnormal behavior features) to improve the diversity of simulated abnormal behavior features (third type of abnormal features). Step 2. According to the analysis results, simulate 100 abnormal sample data with the same format as the given sample.

[0073] == Reply Example == (i.e. the generated third type of abnormal feature example is as follows)

[0074] [11.0,17.0,14.0,23.0,22.0,28.0,0.22956744469194978,0.5068629584873134,0.7368531616807855,1.0,1.0,1.0];[10.0,21.0,29.0,12.0,23.0,14.0,0.09767636744772412,0.5149222019367684,0.9384120216943856,1.0,1.0,1.0]……

[0075] == End of Example ==

[0076] ## Limitations: Only discuss active abnormal behavior analysis and sample generation, refuse to answer topics unrelated to this topic. The output must be organized according to the given format and cannot deviate from the framework requirements.

[0077] Activity rules as follows: Activity time: July-September 2024; Activity participation conditions: This activity is only open to users who have not consulted before the start of the activity. Users need to log in to the target APP during the activity to consult, and meet the requirement of consulting at least 2 questions from the online consultant, and after the consultant's reply is completed (excluding automatic replies from robots), they can get 1 chance to win the lottery, which takes effect immediately and is valid during the activity. Each user can get a maximum of 1 chance to win the lottery per day.

[0078] Feature meanings as follows: ["withdrawal_count (number of withdrawals in the past 7 days)", "total_amount (total amount of withdrawals in the past 7 days)", "phone_count (number of bound mobile numbers in the past 7 days)", "withdrawal_frequency (withdrawal frequency in the past 7 days)", "lottery_count (number of lotteries in the past 7 days)", "lottery_frequency (lottery frequency in the past 7 days)", "device_fund_combinations (whether there has been a fixed device number and its remaining device number traversal in the past 7 days)", "fund_suspicious_flag (whether there has been a fixed fund account and its remaining fund account traversal in the past 7 days)", "device_suspicious_flag (whether there has been a fixed mobile number and its remaining mobile number traversal in the past 7 days)"]......(i.e. in each feature vector of the behavior feature, the meaning of each behavior dimension)

[0079] According to the experience of the risk control history, there are the following misjudgment samples (i.e. the misjudgment features contained in the first normal features):

[0080] [3.0, 5.0, 2.0, 15.0, 29.0, 24.0, 0.9371170419405177, 0.9233053075587083, 0.2828368521760829, 0.0, 1.0, 0.0]...

[0081] According to the experience of the risk control history, there are the following suspected samples confirmed as gray production attacks after investigation (i.e. the first abnormal features):

[0082] [11.0, 17.0, 14.0, 23.0, 22.0, 28.0, 0.22956744469194978, 0.5068629584873134, 0.7368531616807855, 1.0, 1.0, 1.0]...

[0083] Please analyze and simulate the features of 100 abnormal behaviors.

[0084] The first model and the second model classify the behavior features of each user, which can be understood as preliminarily judging the behavior features of the user through supervised and unsupervised models to determine whether the behavior features of the user are abnormal behavior features, so as to subsequently screen out target users for more accurate analysis of abnormal behaviors. And the execution order of the above steps S102 and S103 is not limited by the present application, and step S103 can be executed first, then step S102, or step S102 and step S103 can be executed simultaneously; when the second sample feature includes the abnormal behavior feature in the classification result of the first model, step S102 can be executed first, and then step S103.

[0085] S104: From the first classification result and the second classification result of each user, determine a user whose at least one result meets a predetermined condition to obtain a target user;

[0086] Wherein, the predetermined condition is a feature representing abnormal behavior;

[0087] To reduce the missed judgment of the abnormal behavior features identified by only one model, the application determines, from the first classification result and the second classification result of each user, whether at least one result represents an abnormal behavior feature, to obtain a target user. That is, in the application, if the behavior feature of any user is judged by the first model and / or the second model to be an abnormal behavior feature, the user is taken as a target user, and the behavior feature of the user is subsequently analyzed by the target large model to determine whether it is an abnormal behavior feature.

[0088] The target user can be understood as a user whose behavior feature is analyzed by any model to be a suspected abnormal behavior feature, and further confirmation is needed to determine whether it is an abnormal behavior feature. In addition, the application can also generate a list for target users, and the behavior features of the target users in the list are all suspected abnormal behavior features.

[0089] S105: calling a predetermined target large model to analyze whether the behavior feature of the target user is an abnormal behavior feature, to obtain an analysis result;

[0090] After determining the target user with a suspected abnormal behavior feature, the application can also call a predetermined target large model to analyze whether the behavior feature of the target user is an abnormal behavior feature, that is, to analyze the behavior feature of the target user more accurately by the target large model, to determine whether the behavior feature of the target user is an abnormal behavior feature, to obtain an analysis result.

[0091] In an exemplary implementation, the calling of the predetermined target large model to analyze whether the behavior feature of the target user is an abnormal behavior feature, to obtain an analysis result, includes: calling the predetermined target large model to analyze whether the behavior feature of the target user is an abnormal behavior feature according to a first prompt word, to obtain an analysis result; wherein the first prompt word includes: an activity rule of the target online activity, a first example, and a first content; the first content includes: content guiding the target large model to analyze whether it is an abnormal behavior feature; the first example includes: a first type of abnormal feature, a first type of normal feature, and a second type of normal feature; wherein the first type of abnormal feature, the first type of normal feature, and the second type of normal feature are all behavior features of behaviors performed for the target online activity; the first type of abnormal feature is artificially labeled as an abnormal behavior feature; the first type of normal feature is artificially labeled as a normal behavior feature, and the second type of normal feature is a normal behavior feature analyzed by a predetermined analysis method; the first type of normal feature specifically includes: a feature that is analyzed by a predetermined analysis method to be an abnormal behavior feature but is artificially labeled as a normal behavior feature.

[0092] The present invention can call a predetermined target large model to analyze the behavior characteristics of the target user to determine whether they are characteristics of abnormal plague behavior according to the first prompt word, so as to obtain more accurate analysis results.

[0093] The first prompt word may include the activity rules of the target online activity, a first example, and a first content. The first content includes content that guides the target large model to analyze whether the target user's behavioral characteristics are abnormal behavior characteristics; the first example includes the first category of abnormal characteristics, the first category of normal characteristics, and the second category of normal characteristics issued for the target online activity; the first category of abnormal characteristics are characteristics that have been manually labeled as abnormal behavior; the first category of normal characteristics are characteristics that have been manually labeled as normal behavior; the second category of normal characteristics are characteristics that have been analyzed as normal behavior using a predetermined analysis method; the first category of normal characteristics specifically includes misclassified characteristics.

[0094] In addition, when calling the predetermined target macro model according to the first prompt word, the behavioral characteristics of the target user can also be input into the target macro model. For example, the behavioral characteristics of the target user are used as the content of the first prompt word, so as to analyze whether the characteristics belong to abnormal behavior through the target macro model.

[0095] The first prompt word can be understood as a guide word that guides the target large model to analyze whether the target user's behavior characteristics are abnormal behavior characteristics. For example, it can include the following content:

[0096] #Role: You are a professional risk control analyst, specializing in identifying abnormal behaviors in activities (such as gray market activities).

[0097] The rules for the target online event are as follows: Event Period: July-September 2024; Participation Requirements: This event is open to account holders who have not consulted prior to the event start time. During the event period, users must log in to their account and consult with the target app. They must complete at least two questions and receive a complete response from the online consultant (excluding automated responses from bots) to receive one lucky draw entry. This entry is valid immediately and for the duration of the event. Each user is limited to one lucky draw entry per day.

[0098] Cash red envelope: The details of the specific cash red envelope can be viewed through the "reward" entry in the activity page. The reward can be cashed before the end of the activity. The cashing path is as follows: follow the service number "XXXXX", enter "my - wonderful activity - excellent new customer experience consultation", and bind the mobile phone number logged in when completing the consultation task in the target APP. In order to ensure that you can quickly and smoothly obtain the cash red envelope, our company needs to provide your cashing account information to a third-party institution to assist in red envelope distribution. Your participation in the activity is deemed to be your full understanding and consent to our handling of your cashing account information and the third-party institution obtaining your cashing account nickname, avatar and OpenID information. The cashing amount will be credited within 1-5 working days. Please pay special attention.

[0099] According to the experience of risk control history, there are the following misjudgment samples (i.e. the misjudgment characteristics contained in the first normal characteristics)

[0100] [3.0,5.0,2.0,15.0,29.0,24.0,0.9371170419405177,0.9233053075587083,0.2828368521760829,0.0,1.0,0.0]; [2.0,2.0,8.0,18.0,12.0,27.0,0.33963104416619916,0.6002128681312939,0.96319729526038,0.0,0.0,1.0]…

[0101] According to the experience of risk control history, there are the following suspected samples confirmed as gray production attacks after investigation (i.e. the first type of abnormal characteristics)

[0102] [11.0,17.0,14.0,23.0,22.0,28.0,0.22956744469194978,0.5068629584873134,0.7368531616807855,1.0,1.0,1.0]; [10.0,21.0,29.0,12.0,23.0,14.0,0.09767636744772412,0.5149222019367684,0.9384120216943856,1.0,1.0,1.0]…

[0103] ##Please think before answering the question according to the following steps

[0104] ### Analyzing the likelihood of abnormal behavior users: Step 1. Receive a batch of feature sequences of suspected behavior abnormal users, including withdrawal_count (the number of withdrawals in the past 7 days), total_amount (the total amount of withdrawals in the past 7 days), phone_count (the number of bound mobile phone numbers in the past 7 days), withdrawal_frequency (the withdrawal frequency in the past 7 days), lottery_count (the number of lottery times in the past 7 days), lottery_frequency (the lottery frequency in the past 7 days), device_fund_combinations (whether there has been a fixed device number traversing other device numbers in the past 7 days), fund_suspicious_flag (whether there has been a fixed fund account traversing other fund accounts in the past 7 days), device_suspicious_flag (whether there has been a fixed mobile phone number traversing other mobile phone numbers in the past 7 days). Step 2. Compare and analyze with normal users (false positive samples) and confirmed suspected samples of gray production attacks. Step 3. According to the values of each feature and whether there is a suspicious traversal flag, evaluate the abnormal likelihood of each target user and sort them from high to low. Step 4. Provide detailed analysis reasons, including comparison with normal users (including false positive samples) and suspected samples.

[0105] == Example of reply ==

[0106] - User mobile phone number: <user mobile phone number>; - Abnormal likelihood: <high / medium / low>; - Analysis reason: <detailed analysis reason, comparison with normal users and suspected samples>;

[0107] == End of example ==

[0108] ## Limitations: Only analyze the given user feature sequence, do not involve other irrelevant content. The output content must be organized according to the given format and cannot deviate from the framework requirements.

[0109] A batch of normal user behaviors are extracted as follows (through pre-defined analysis method to analyze the features that belong to normal behavior and are manually labeled as normal behavior, or also can be the second type of normal features): [6, 88, 4, 0, 5, 0.2684178025757603, 0, 0, 0]; [1, 8.88, 2, 0, 2, 0.9135855594354133, 0, 0, 0]……

[0110] There is a batch of suspected abnormal behavior users (each target user), and the feature sequence is as follows: mobile phone number 1: [15, 8437, 8, 0.7807886404441827, 10, 0.5487466921075426, 0, 1, 1]; mobile phone number 2: [19, 7167, 9, 0.6998300072170215, 15, 0.9259268496833007, 0, 1, 1]...

[0111] Please analyze the possibility of the behavior characteristics of the target user being abnormal behavior characteristics, from high to low, and give the analysis.

[0112] The application can guide the target large model to analyze whether the behavior characteristics of the target user belong to abnormal behavior characteristics through the first prompt word, can accurately analyze the behavior characteristics of the target user, obtain the analysis result, so as to judge whether the target user has abnormal behavior for the target online activity. Moreover, the analysis result output by the target large model can be the possibility of the behavior characteristics of the target user being abnormal characteristics, and the target user can be sorted in parallel according to the possibility. In addition, in order to further ensure the accuracy of abnormal behavior recognition, the analysis result output by the target large model can be used as the basis for manual labeling of abnormal behavior, so as to further accurately determine whether the behavior characteristics of the target user are abnormal behavior characteristics.

[0113] To ensure the real-time performance of the abnormal behavior identification (i.e., the abnormal behavior may be generated in a certain period of time, and the user may not always have abnormal behavior), the behavior characteristics of each user participating in the target online activity obtained can be the behavior characteristics in a specified period of time, and the analysis result obtained is the analysis result of the possibility that the behavior characteristics of the target user in the specified period of time are abnormal behavior characteristics, thereby ensuring the real-time performance and accuracy of the possibility that the analyzed behavior characteristics of the target user are abnormal behavior characteristics. The abnormal behavior identification method provided in the embodiment of the present application, after obtaining the behavior characteristics of each user participating in the target online activity, clusters the behavior characteristics of each user based on a first model for clustering to obtain a first classification result of each user, and classifies the behavior characteristics of each user based on a second model to obtain a second classification result of each user; the first classification result and the second classification result of each user can both analyze whether the behavior characteristics of the user belong to abnormal behavior characteristics or normal behavior characteristics; in order to reduce the missed judgment, the present application determines that there is at least one result representing abnormal behavior characteristics from the first classification result and the second classification result of each user, and obtains a target user, i.e., for each user, if at least one result represents that the behavior characteristics of the user belong to abnormal behavior characteristics, the user is taken as the target user. In order to reduce the misjudgment of the first model and the second model, the present application can call a predetermined target large model to analyze whether the behavior characteristics of the target user belong to abnormal behavior characteristics, and obtain an analysis result. The present application combines the first model, the second model and the target large model, through the first model and the second model, the missed judgment of abnormal behavior can be reduced, and through the target large model, the misjudgment of abnormal behavior of the target user can be reduced. It can be seen that the present application can improve the accuracy of the determination result of the abnormal behavior of the user.

[0114] Optionally, in another embodiment of the present application, the method further comprises:

[0115] Based on the third prompt word, calling the target large model to analyze the third type of abnormal characteristics to obtain an analysis result of the third type of abnormal characteristics, so as to optimize the second prompt word;

[0116] Among them, the third prompt word includes: a third example and a third content;

[0117] The third example includes: the first type of abnormal characteristics and the first type of normal characteristics;

[0118] The third content includes: content guiding the target large model to analyze the difference between the third type of abnormal characteristics and the characteristics in the third example.

[0119] The application can also analyze the third type of abnormal features generated by the target large model through the target large model, that is, analyze the reliability and accuracy of the third type of abnormal features generated by the target large model through the target large model, so as to optimize the second prompt word and improve the accuracy of the subsequent simulated third type of abnormal features.

[0120] Among them, the application can call the target large model for analysis through the third prompt word for guiding the target large model to analyze the simulated third type of abnormal features, and obtain the analysis result of the third type of abnormal features. The third prompt word includes a third example and a third content; the third example includes a first type of abnormal feature and a first type of normal feature; the third content includes content guiding the target large model to analyze the difference between the third type of abnormal feature and the first type of abnormal feature and the first type of normal feature in the third example. And the difference between the features can be represented by similarity, and the third content includes content guiding the target large model to calculate the similarity of the third type of abnormal feature and the first type of abnormal feature and the first type of normal feature in the third example, so as to evaluate whether the third type of abnormal feature matches the feature of abnormal behavior (that is, to evaluate the accuracy of the third type of abnormal feature generated by the target large model). For example, the third prompt word can include the following content:

[0121] "#Role: You are a professional and strict abnormal data generation effect evaluation assistant, and can score and evaluate the abnormal user feature vector generated by the large model with high precision and objectivity.

[0122] ##Please think according to the following aspects before answering the question

[0123] ###Aspect 1: Accurate comparison and scoring: Step 1. Receive the behavior features of abnormal users in the known abnormal knowledge base (standard answer, i.e. the first type of abnormal feature in the second behavior database), the abnormal vector generated by the large model (i.e. the third type of behavior feature simulated by the target large model), the behavior features of normal users (i.e. the features analyzed by the predetermined analysis method and artificially labeled as normal behavior), and the misjudged features in the misjudgment knowledge base (i.e. the features analyzed by the predetermined analysis method and artificially labeled as normal behavior). Step 2. Deeply compare the similarity of the abnormal vector generated by the large model and the standard answer, and carefully compare the similarity of the abnormal vector generated by the large model and the misjudged features and the behavior features of the sampled normal users. Step 3. Give the abnormal vector generated by the large model an exact score and give a detailed evaluation, including the difference from the standard answer, the difference from other vectors (misjudged features and behavior features of sampled normal users), etc.

[0124] ###Aspect 2: Score Ranking: After scoring each anomaly vector, strictly rank from high to low. Step 2. Analyze the anomaly vector corresponding to the lowest score and give generation suggestions.

[0125] ==Response Example==

[0126] Anomaly Vector 1 Score: <Highest Score: Specific Score>; Anomaly Vector 2 Score: <Second Highest Score: Specific Score>;...

[0127] Total Score: <Average Score>; Promotion Suggestions: <Analysis of low-score anomaly samples, including differences from standard answers, differences from other vectors, etc.>

[0128] ==End of Example==

[0129] ##Limitations: Only focus on evaluating the generation effect of abnormal data, do not answer any questions unrelated to this task. The output must be strictly organized according to the given format and cannot deviate from the requirements.

[0130] Note that the second prompt can be optimized based on the generation suggestions in the analysis results (i.e., suggestions for the target large model to simulate the generation of the third type of abnormal features).

[0131] An exemplary third example and third type of abnormal features are as follows:

[0132] According to the experience of risk control history, there are the following misjudgment samples (misjudgment features): [3.0, 5.0, 2.0, 15.0, 29.0, 24.0, 0.9371170419405177, 0.9233053075587083, 0.2828368521760829, 0.0, 1.0, 0.0]; [2.0, 2.0, 8.0, 18.0, 12.0, 27.0, 0.33963104416619916, 0.6002128681312939, 0.96319729526038, 0.0, 0.0, 1.0]; [1.0, 1.0, 3.0, 25.0, 26.0, 18.0, 0.14780133406539042, 0.2569166436866691, 0.87355682729007714, 0.0, 0.0, 0.0].

[0133] According to the experience of risk control history, the following suspected samples are confirmed as gray production attacks after investigation (first type of abnormal features): [11.0, 17.0, 14.0, 23.0, 22.0, 28.0, 0.22956744469194978, 0.5068629584873134, 0.7368531616807855, 1.0, 1.0, 1.0]; [10.0, 21.0, 29.0, 12.0, 23.0, 14.0, 0.09767636744772412, 0.5149222019367684, 0.9384120216943856, 1.0, 1.0, 1.0]; [26.0, 26.0, 20.0, 21.0, 13.0, 18.0, 0.2286465509829455, 0.6771411441114241, 0.5928802707811576, 1.0, 1.0, 1.0].

[0134] === 5 samples you need to score = ==

[0135] [11.0, 17.0, 14.0, 23.0, 22.0, 28.0, 0.22956744469194978, 0.5068629584873134, 0.7368531616807855, 1.0, 1.0, 1.0]; [10.0, 21.0, 29.0, 12.0, 23.0, 14.0, 0.09767636744772412, 0.5149222019367684, 0.9384120216943856, 1.0, 1.0, 1.0]; [26.0, 26.0, 20.0, 21.0, 13.0, 18.0, 0.2286465509829455, 0.6771411441114241, 0.5928802707811576, 1.0, 1.0, 1.0]; [29.0, 24.0, 10.0, 10.0, 12.0, 21.0, 0.01006369565609333, 0.47582619585722274, 0.7087703909410487, 1.0, 1.0, 1.0]; [15.0, 12.0, 17.0, 22.0, 21.0, 29.0, 0.0439754320240906, 0.8795214830237301, 0.5200814166356731, 1.0, 1.0, 1.0].

[0136] === reply example = ==

[0137] Abnormal vector 1 score: 80 points; Evaluation: There is a certain similarity with the abnormal vector in the standard answer, the characteristic value distribution is reasonable, and it is obviously different from the misjudgment vector, which better reflects the abnormal characteristics; but some characteristic values can be further optimized to be closer to the standard. Abnormal vector 2 score: 79 points; Evaluation: Similar to abnormal vector 1, there is a certain gap in some characteristic values compared with the standard answer; the difference is obvious compared with the misjudgment vector; the characteristic values can be adjusted to improve the similarity with the standard. Abnormal vector 3 score: 78 points; Evaluation: Overall, it can reflect the abnormal characteristics, but the similarity with the standard answer is relatively low; more adjustments need to be made on the characteristic values to approach the standard. Abnormal vector 4 score: 78 points; Evaluation: To a certain extent, it simulates the abnormal user characteristics, but compared with the standard answer, there are some large differences in the characteristic values; these characteristic values can be adjusted appropriately to improve accuracy. Abnormal vector 5 score: 79 points; Evaluation: Similar to the other abnormal vectors, there is a certain gap compared with the standard answer; more attempts can be made on the combination of characteristic values to better simulate abnormal situations.

[0138] Total score: 78.8 points; Promotion suggestion: The abnormal vectors corresponding to the lowest scores (abnormal vector 3 and abnormal vector 4) mainly differ from the standard answer in that the values of some characteristic values are not accurate enough, and the diversity is insufficient compared with other high-score vectors. Reference can be made to high-score vectors to adjust these characteristic values and increase randomness in the generation process to improve the diversity of the vectors. In addition, further analysis of the characteristics of abnormal users can be carried out to find more representative combinations of characteristic values to improve the quality of the generated abnormal vectors.

[0139] Optionally, the application can also manually calibrate based on the behavior characteristics of the target user determined to have abnormal behavior, and update the first type of normal characteristics and the first type of abnormal characteristics after calibration; the plurality of first type of normal characteristics are characteristics in the first behavior database, and the at least one first type of abnormal characteristic and the at least one second type of abnormal characteristic are characteristics in the second behavior database;

[0140] The method further comprises:

[0141] After determining that the target user has abnormal behavior for the target online activity, the negative feedback data corresponding to the target user is obtained; wherein the negative feedback data corresponding to the target user is the calibration result of whether the behavior characteristics of the target user are abnormal behavior characteristics by manual;

[0142] In response to the negative feedback data of the target user being the calibration result of the characteristics representing normal behavior, the behavior characteristics of the target user are added to the first behavior database as a first type of normal characteristic;

[0143] In response to the negative feedback data of the target user being a labeling result of a feature representing abnormal behavior, the behavior feature of the target user is added to the second behavior database as a first type of abnormal feature.

[0144] The first example is updated based on the current first behavior database and the second behavior database.

[0145] The application also comprises a first behavior database and a second behavior database, the first behavior database being used to store features of normal behavior of a user for a target online activity, and the second behavior database being used to store features of abnormal behavior of a user for the target online activity; a plurality of first normal features are features in the first behavior database, and at least one first type of abnormal feature and at least one second type of abnormal feature are features in the second behavior database.

[0146] After determining that the target user has abnormal behavior for the target online activity, whether the behavior feature of the target user is an abnormal behavior feature can be labeled by a risk control personnel in an artificial manner to obtain negative feedback data of the target user (i.e., the behavior feature of the target user is a feature of definitely normal behavior or a feature of definitely abnormal behavior). After obtaining the negative feedback data, if the negative feedback data of the target user is a labeling result of a feature representing normal behavior (i.e., the behavior feature of the target user is artificially labeled as a feature of normal behavior), the behavior feature of the target user is added to the first behavior database as a first type of normal feature. If the negative feedback data of the target user is a labeling result of a feature representing abnormal behavior (i.e., the behavior feature of the target user is artificially labeled as a feature of abnormal behavior), the behavior feature of the target user is added to the second behavior database as a first type of abnormal feature. In addition, the analysis result of the target user represents a feature that does not belong to abnormal behavior, and whether the behavior feature of the target user is an abnormal behavior feature can also be labeled by a risk control personnel to reduce the possibility of misjudgment of the target large model, so as to expand the first type of normal feature.

[0147] That is, after the target large model analyzes that the target user has abnormal behavior for the target online activity (or does not have abnormal behavior), the behavior feature of the target user can be labeled by a risk control personnel, and based on the labeling result, the first behavior database and the second behavior database can be updated. After the first behavior database and the second behavior database are updated, the first example can be updated based on the current first behavior database and the second behavior database, so that the target large model can combine recent abnormal behavior and normal behavior examples to accurately analyze whether the behavior feature of the target user is an abnormal behavior feature in the future.

[0148] It should be noted that the "first", "second" and "third" in the "first prompt word", "second prompt word", "third prompt word", "first model", "second model", "first classification result", "second classification result", "first sample feature", "second sample feature", "first normal feature", "second normal feature", "first abnormal feature", "second abnormal feature", "third abnormal feature", "first example", "second example" and "third example" in the application are only exemplary descriptions of the above-mentioned content, and should not constitute a limitation on the application, and the first prompt word, the second prompt word and the third prompt word can be set according to the specific circumstances in the case of being able to guide the target large model to complete the corresponding function, the content and examples contained in the prompt word can be set according to the specific circumstances, and the application does not limit this. The key of the application is to combine user behavior characteristics and big data analysis technology to realize intelligent recognition and dynamic risk prompt of gray production attack. On the basis of traditional unsupervised and supervised models, the application combines a large model to analyze clustering results, realizes multi-model fusion, and improves the comprehensive performance of identification. The application simulates human thinking chain through a large model, analyzes activity rules and feature vectors, generates high-quality abnormal samples, and effectively alleviates the problem of insufficient abnormal samples in supervised learning. The model updating mechanism ensures that the system can maintain high real-time and adaptability when facing constantly changing gray production attack means. By constructing a negative feedback knowledge base and a prompt project, the application forms a closed-loop optimization scheme, so that the clustering algorithm and the large model can continuously learn and improve, and the identification efficiency is improved.

[0149] Next, a specific embodiment of the application will be described in detail.

[0150] The application aims to provide an abnormal behavior recognition method combined with a large model, which improves the recognition accuracy and adaptability of abnormal behavior by combining a large model on the basis of traditional unsupervised and supervised models, and effectively solves the misjudgment or omission problems existing in the prior art. For the analysis of suspected risk users (i.e. target users), the application proposes an analysis method based on the behavior characteristics of users, improves the recognition accuracy of abnormal behavior by constructing a feature vector, combining unsupervised and supervised learning models, and combining the analysis and judgment of a large model. The application proposes a method for simulating the generation of abnormal behavior characteristics, aiming to generate abnormal behavior characteristics (the third type of abnormal characteristics) by simulating the human thinking process, in order to enhance the performance of the large model in the detection task of abnormal behavior. It not only relies on simple simulation of the characteristics of abnormal behavior, but also constructs a guide similar to the human thinking chain through Prompt (the first prompt word), so that the large model can more deeply understand and analyze the characteristics of abnormal behavior, thereby generating higher quality abnormal samples (the third type of abnormal characteristics); the expansion of the characteristics of abnormal behavior in the training set of the semi-supervised model helps to solve the problem of the scarcity of abnormal samples during the training of the supervised model. The application introduces a method for testing the effect of the simulated abnormal samples by the large model, constructs a test Prompt (the third prompt word) to evaluate the effect of the large model in simulating the generation of abnormal samples (the third type of abnormal characteristics), which serves as the basis for iterating the Prompt (the second prompt word) for simulating the generation of abnormal samples by the large model. The application introduces the large model to analyze the abnormal clustering results (behavior characteristics of suspected abnormal target users) of the abnormal clustering algorithm (the first model and the second model), uses the behavior samples of normal users (i.e. the characteristics of normal behavior artificially labeled), misjudgment samples (i.e. misjudgment characteristics), and real-time updated known abnormal samples (i.e. characteristics of abnormal behavior artificially labeled) as prior knowledge, combines the meaning of the feature vector (i.e. the meaning represented by each feature in the feature vector; each user corresponds to a feature vector, which contains the behavior characteristics of multiple dimensions of the user), and the activity rules to analyze and score the unsupervised clustering and supervised clustering results (behavior characteristics of target users), identify abnormal behavior, and serve as a reference for risk control personnel. The application designs a model updating mechanism to ensure the real-time and dynamic adaptability of the recognition model, so as to better cope with the changes of abnormal behavior. The application introduces a negative feedback data and prompt word updating mechanism, updates the negative feedback data and the prompt word through the participation and feedback of the risk control personnel, and improves the analysis and recognition ability of the large model.

[0151] In order to achieve the application purpose of the application, the implementation idea of the application is as follows:

[0152] 1) Data extraction: Extract the behavior data of each user in the last month from the database every day.

[0153] 2) Feature construction: Construct features such as the number of activity presentations, total withdrawal amount, and number of bound mobile phone numbers for each user.

[0154] 3) Model modeling of abnormal behavior recognition combined with large model: Unsupervised learning (first model): Use kmeans unsupervised clustering algorithm to cluster the behavior features of each user, and extract abnormal users. Supervised learning (second model): Use the logistic regression model to train the first sample feature and the second sample feature. During training, reference the behavior features of abnormal users in the known abnormal knowledge base and the features of abnormal behavior identified by the unsupervised model as positive samples, and use the third type of abnormal feature expansion positive samples generated by the large model according to the activity rules to simulate the features of abnormal behavior, and use the misjudgment features (which can be feature vectors in the misjudgment knowledge base) as negative samples; that is, the first sample feature is used as the negative sample, and the second sample feature is used as the positive sample, and the semi-supervised second model is trained to identify abnormal behavior (abnormal user).

[0155] 4) Model update: Unsupervised model: Update the clustering model using new data every day. Supervised model: Based on the features of abnormal behavior identified by the unsupervised model (second type of abnormal feature), the risk control personnel exclude the features of determined abnormal behavior (first type of abnormal feature), and combine the features of abnormal behavior generated by the large model according to the activity rules (third type of abnormal feature), as well as the first type of normal feature, train the supervised logistic regression model, update every week, and optimize combined with negative feedback data (optimize the first type of abnormal feature and the first type of normal feature combined with negative feedback data, optimize the training of the supervised model).

[0156] 5) Multi-model fusion: Fuse the behavior features of abnormal users detected by the unsupervised model and the supervised model to generate a suspected risk list (i.e. determine the target user, the suspected risk list may include at least one target user).

[0157] 6) Large model analysis: Use a general large model to analyze the behavior features of users in the suspected risk list and give a risk prompt.

[0158] 7) Positive and negative sample knowledge base: the behavior characteristics of the suspected risk list known to be abnormally high risk are added to the known abnormal knowledge base (belonging to the second behavior database). The characteristics of the suspected risk list confirmed by the risk control personnel as abnormal behavior are added to the known abnormal knowledge base, and are promoted to the high risk level. The characteristics of the suspected risk list confirmed by the risk control personnel as misjudgment are added to the misjudgment feature knowledge base (belonging to the first behavior database), and are removed from the suspected risk list. The suspected risk list is pending, and no processing is performed. When the large model analyzes, the content in the knowledge base (the first behavior database and the second behavior database, which updates the first example) is referenced to improve the analysis accuracy.

[0159] The electronic device provided by the application can comprise:

[0160] The general large model interaction interface (the large model deployed by the enterprise provides a question and answer interface). The database of the online activity operated: save the behavior data of the user participating in the online activity, including but not limited to the following library table information: user equipment binding table: used to extract the relationship data of the user and the equipment; red packet withdrawal record table: used to extract the withdrawal activity data of the user; lottery record table: used to extract the lottery activity data of the user. Large model abnormal sample simulation generation module: construct iterative large model prompt instruction (second prompt word), combine the general large model to simulate the generation of abnormal samples for the sample of the supervised clustering model training. Clustering model training module: used for analysis and training of the clustering model. Clustering model reasoning module: used for periodic reasoning of the clustering model (that is, through the second model, the behavior characteristics of each user are classified). Large model abnormal analysis module: used for periodic reasoning (that is, calling the large model, analyzing whether the behavior characteristics of the target user belong to abnormal behavior characteristics). Activity post management platform: used for management of the risk list of the activity user (that is, managing the target user). Large model risk negative feedback knowledge base: used for storing the behavior characteristics of the abnormal user confirmed by the risk control personnel after the suspected risk list is checked. Known abnormal knowledge base: if the user's behavior characteristics are confirmed as abnormal behavior, the user's behavior characteristics are written into the known abnormal knowledge base. Misjudgment knowledge base: if the user's behavior characteristics are confirmed as not abnormal behavior, the user's behavior characteristics are written into the misjudgment knowledge base.

[0161] The specific implementation process of the abnormal behavior recognition method provided by the embodiment of the application is as follows:

[0162] Data extraction: daily user behavior data of the previous day is extracted from the database storing the user behavior data; for abnormal behavior, the data stored in the database mainly includes: user equipment binding table: used to extract the relationship data of the user and the equipment; red packet withdrawal record table: used to extract the withdrawal activity data of the user; lottery record table: used to extract the lottery activity data of the user.

[0163] Feature construction: based on the login behavior, the drawing behavior, the withdrawal behavior, etc. of the user, the behavior features of the user are constructed (the specific method is similar to the method of obtaining the behavior features of each user participating in the online activity described above).

[0164] Feature extraction: in addition, when obtaining the behavior features of each user from the database, the behavior data of the user can be extracted from the database and analyzed and calculated to obtain the behavior features of the user by means of SQL (Structured Query Language) query; the steps of feature extraction are as shown in Figure 2 S201: define the SQL list; S202: create a blank two-dimensional table (DataFrame) for storing the behavior feature data extracted from the database; S203: assign a feature name to each query: that is, for the SQL two-dimensional table, assign a feature name to each SQL query, for example: “withdrawal_count (the number of withdrawals in the past 7 days)”, as the table header of the DataFrame. S204: execute the query: when executing the SQL query, traverse the SQL two-dimensional table, and for each SQL query in the two-dimensional table, execute the SQL query; S205: store the query result in the two-dimensional table (DataFrame); S206: rename the column in the two-dimensional table (DataFrame); ensure that the column name is consistent with the feature name. Then, S207: determine whether the two-dimensional table (DataFrame) is empty; if the DataFrame is empty (i.e. the determination result is yes), execute step S208: initialize the two-dimensional table (DataFrame); if the DataFrame is not empty (i.e. the determination result is no), execute step S209: merge the current query result with the previous query result (the SQL query in the two-dimensional table may also have been executed before the current SQL query, merge the results of the previously executed SQL query in the two-dimensional table with the currently executed SQL query), and perform an outer join based on the user's mobile phone, and execute step S210: fill in the missing values with 0; that is, if there are missing values in the DataFrame, fill in the missing values with 0. Then, S211: continue to traverse the SQL list, and execute S212: determine whether the traversal is completed, if no, return to step S203, if yes, execute S213: create a feature data copy (i.e. backup the obtained behavior features of each user), and execute S214: store the backup behavior features to the database.

[0165] Feature weighting: the steps of feature weighting are as shown in Figure 3As shown: S301: defining a weight factor; defining a weight factor for each behavior dimension feature, which is used to weight the specific behavior dimension feature. S302: judging whether it is a weighted feature: judging whether the behavior dimension feature of any user is a weighted feature, if yes, executing S303: multiplying the weight factor; multiplying the weight factor of the behavior dimension feature; if no, executing S304: keeping the original value; keeping the behavior feature of the behavior dimension unchanged; then executing S305: updating the behavior features of each user. Wherein, the specific feature is weighted by multiplying a constant or weight factor to increase its importance.

[0166] The specific behavior dimension feature can be: whether there is a fixed device number remaining device number traversal in the past 7 days, whether there is a fixed fund account number remaining fund account number traversal in the past 7 days, and whether there is a fixed mobile phone number remaining mobile phone number traversal in the past 7 days, and other behavior dimension features that can better represent whether the user's behavior feature is an abnormal behavior.

[0167] Feature standardization: the specific steps of feature standardization are as follows Figure 4 As shown: S401: deleting the column of non-numeric features; deleting the 'customer_phone' column from the original feature DataFrame (i.e. a two-dimensional table for storing behavior features of each user) because it is not a numeric feature and does not need to be normalized. S402: initializing a tool object for standardization; in order to perform normalization, a StandardScaler (i.e. creating a tool object for performing Z-score standardization) can be initialized first; S403: fitting and transforming feature data using standardization method; fitting and transforming feature data (except 'customer_phone' column) using Z-score standardization method to achieve feature normalization, and after normalization, the value of each feature is converted to a distribution with mean 0 and standard deviation 1. S404: converting the normalized feature array back to a two-dimensional table (DataFrame); S405: ensuring that the column name is consistent with the column name in the original two-dimensional table (i.e. generating a DataFrame after normalizing the original feature DataFrame); S406: adding the value of the column of non-numeric features as a new column to the two-dimensional table (DataFrame) after normalization (i.e. associating the normalized DataFrame with the user's account or mobile phone number).

[0168] Using unsupervised clustering algorithm for analysis: as follows Figure 5As shown: S501: take the user's behavior characteristics in the past 7 days; S502: cluster the normalized features; identify the normal behavior characteristics and the abnormal behavior characteristics. When clustering, initialize the clustering model, and perform S503: set the number of clusters to 2, so as to divide the user's behavior characteristics into two categories belonging to normal behavior characteristics and abnormal behavior characteristics (the specific process is similar to the process of clustering the first model, and will not be repeated here). S504: use the clustering model to fit and predict the normalized two-dimensional table (DataFrame) (normalized data except 'customer_phone' column); S505: add the predicted clustering result as a new column ('cluster'). After obtaining the clustering result, it can be judged that the user's behavior characteristics are normal behavior characteristics or abnormal behavior characteristics, S506: store the normalized behavior characteristics of the user belonging to the normal behavior; S507: store the normalized behavior characteristics of the user belonging to the abnormal behavior; and S510: store the original feature data of the past 7 days belonging to the normal category; S511: store the original feature data of the past 7 days belonging to the abnormal category.

[0169] The specific extraction process is as follows: S508: extract the behavior characteristics of the user belonging to the normal behavior from the original two-dimensional table, which corresponds to 'customer_phone' with a clustering result of 0 in the normalized DataFrame, that is, the non-numeric feature with a clustering result of 0. S509: extract the behavior characteristics of the user belonging to the abnormal behavior from the original two-dimensional table, which corresponds to 'customer_phone' with a clustering result of 1 in the normalized DataFrame, that is, the non-numeric feature with a clustering result of 1. Extract the normalized behavior characteristics of the user belonging to the normal behavior from the normalized DataFrame, that is, the row with a clustering result of 0. Extract the normalized behavior characteristics of the user belonging to the abnormal behavior from the normalized DataFrame, that is, the row with a clustering result of 1. Store the original feature data of the past 7 days belonging to the normal category, and store the original feature data of the past 7 days belonging to the abnormal category for subsequent analysis.

[0170] Supervised clustering algorithm analysis combined with large model: first, based on known abnormal samples, use large model to generate abnormal samples for supplement; use large model to construct Prompt (second prompt word) according to activity rules to generate abnormal samples. 1) When constructing Prompt, use a series of separators # to distinguish different text parts. 2) Give the example feature vector in the abnormal knowledge base to allow the large model to analyze the distribution of the characteristics of abnormal behavior. 3) Give the activity rules that need to be analyzed to facilitate the large model to understand the background of abnormal analysis. 4) Construct a thinking chain prompt to guide the large model to reason step by step. Require the large model to clearly define each reasoning step before giving the simulated abnormal samples, to reduce the situation of the large model rushing to a wrong conclusion. The reasoning steps are as follows:

[0171] Step 1: analyze existing samples: 1. According to the given misjudgment samples and suspected samples confirmed as gray production attacks, analyze their characteristic rules. 2. Understand the meaning of each feature, such as "withdrawal_count (withdrawal count in the past 7 days)".

[0172] Step 2: analyze activity rules: 1. According to the given activity rules and feature list, analyze the characteristic values of the characteristics of the abnormal behavior that may occur.

[0173] Step 3: generate abnormal sample data: according to the analysis results, simulate 100 abnormal sample data, the data format is consistent with the given sample.

[0174] Model training: the process of model training is as shown in Figure 6 S601; prepare training data set: the training set samples come from the behavior characteristics of the users in the past 7 days, label and expand the abnormal samples, and randomly sample the characteristics of normal behavior as negative samples. Extract abnormal samples: if the sample exists in the unsupervised model abnormal clustering result, it is marked as an abnormal sample, that is, the abnormal sample is labeled. If the abnormal sample exists in the misjudgment knowledge base, remove the abnormal sample, that is, remove the misjudgment sample. Abnormal sample expansion: take the samples in the abnormal knowledge base to expand the positive samples. Use the second prompt word to call the large model to generate enough (about 1000 in this case) abnormal samples for expansion, that is, expand the abnormal samples generated by the large model, which can be constructed by Prompt (second prompt word) to generate abnormal samples. Extract normal samples: randomly sample 100 times the number of abnormal samples from the characteristics of normal behavior, and mark them as negative samples. And merge the misjudgment samples, that is, merge the samples (misjudgment characteristics) in the misjudgment knowledge base.

[0175] S602: Train the model; use the logistic regression model to perform logistic regression training, use the log loss function (LogLoss) as the loss function, select 'lbfgs' as the optimization algorithm, and in the model training process, 5-fold cross-validation is used in the embodiment to evaluate the stability and generalization ability of the logistic regression model. Finally, the accuracy is used to evaluate the performance of the model, and the model parameters are adjusted according to the business requirements to achieve the best abnormal detection effect (i.e. to obtain the trained second model), and the model is saved.

[0176] The steps of K-fold cross-validation are as follows: 1: Divide the feature set of the positive samples and the negative samples into M subsets: 2: For each subset i, use it as the validation set, and the remaining M-1 subsets as the training set: 3: Train the model and evaluate it on the validation set, and record the evaluation indicators (such as accuracy, precision, recall, etc.): 4: Repeat steps 2 and 3 until each subset acts as a validation set, thereby generating M evaluation indicators: 5: Take the average of the M evaluation indicators as the final model performance evaluation indicator. 6: Save the model.

[0177] S603: Daily reasoning process; statistics based on the user statistics data of the past 7 days to construct a feature vector, and after the new data is input into the trained logistic regression model after the same feature extraction and preprocessing steps, the model inference prediction is performed. Store normal category data (original feature data of the past 7 days). Store abnormal category data (original feature data of the past 7 days). In order to facilitate subsequent risk control personnel to conduct manual calibration.

[0178] Multi-model fusion abnormal classification result: the abnormal detection results of unsupervised and supervised models are fused to generate a suspected risk list. In the embodiment, the model fusion scheme is full-quantity fusion, that is, the users whose abnormal behavior features are predicted by the unsupervised model and the supervised model are all target users entering the risk list. The number of times the abnormal sample appears in the multi-model is used as the sorting score (i.e. the target user's abnormal behavior feature is detected by multiple models, then the target user's sorting score is higher), and the sorting is reflected in the generated suspected risk list.

[0179] Using a large model to analyze abnormal results: based on the analysis of abnormal clustering results, the application constructs a prompt instruction; and combining active users, normal sampling users, activity rules and negative feedback data (updating the first example), the application constructs a prompt instruction (first prompt word) of a large model. Through the first prompt word, a general large model is used to analyze the suspected risk list and give a risk prompt.

[0180] The steps of using a large model to analyze abnormal results are as follows: Figure 7As shown: when large model inference is performed: S701: constructing a large model prompt instruction; that is, defining a role, providing an activity rule, and combining an abnormal clustering result, combining activity user data, combining normal sampling user data, and combining negative feedback data to construct a large model prompt instruction (i.e., a first prompt word); S702: large model analyzes a suspected risk list; S703: gives a risk prompt; S704: updates negative feedback data; that is, updates the negative feedback data in an artificial marking manner; S705: accuracy analysis; S706: misjudgment reason analysis; that is, the accuracy analysis and misjudgment reason analysis are performed on the result given by the large model; S707: feature adjustment (i.e., updating the first example in the first prompt word in combination with the updated negative feedback data).

[0181] Privacy security: the user information in the abnormal user vector of the suspected risk needs to be desensitized separately, and in the embodiment of the application, an encryption result example is as follows Figure 8 As shown, each row is information associated with a user, from left to right: user mobile phone number phone, risk level of user behavior risk_level, target online activity activity_attribution (i.e., activity attribution) participated by the user, risk source of user behavior risk_source, feature vector of user behavior vector_info, and analysis result of the large model for the user behavior ai_info. For user 1, the mobile phone number is 156DC780FE8783DAE…, the risk level is 1, the activity attribution is 33, the risk source is 5, the feature vector is [0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 10.0, 20.0], and the analysis result is “for the suspected abnormal behavior provided by …”; for user 2, the mobile phone number is 9A04FB6B2899DF7B4…, the risk level is 1, the activity attribution is 33, the risk source is 5, the feature vector is [0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 10.0, 20.0], and the analysis result is “according to the abnormal vector ‘0.0, 0.0…” provided by the abnormal knowledge base.

[0182] Reliability and iteration of the large model analysis result: the application sets an automatic test prompt word instruction (a third prompt word), uses an abnormal vector in the known abnormal knowledge base determined by an artificial method as a standard answer, and uses an abnormality (a third type of abnormal feature) generated by the large model as a test, compares the similarity of the two, and uses the similarity as a scoring standard. According to the scoring standard, the second prompt word is optimized and iterated.

[0183] Construction of automatic test prompt (third prompt word): input the feature vector of the abnormal user in the abnormal knowledge base as the standard answer, input the abnormal vector generated by the above abnormal data simulation (third type of abnormal feature), sample the feature vector of the normal user and the misjudgment vector in the misjudgment knowledge base (first type of normal feature), guide the large model to compare the similarity of the abnormal user feature vector (third type of abnormal feature) generated by itself with the standard answer, and the similarity with the misjudgment user feature vector and the normal user feature vector, score the simulated abnormal user feature vector, evaluate the abnormal sample generated by the large model, and optimize the second prompt word according to the test score. Automation testing can reduce labor costs and improve testing efficiency.

[0184] Update mechanism: the negative feedback mechanism in the application is the core component of the closed-loop optimization system, including negative feedback data including: suspected risk confirmed known abnormal samples and misjudgment samples; both kinds of samples are obtained by professional risk control personnel through manual audit, ensuring the accuracy and reliability of the samples.

[0185] 1. Detailed description of the negative feedback mechanism:

[0186] Suspected risk confirmed known abnormal samples: these samples are samples confirmed as actual abnormal behavior after the risk control personnel analyzes the suspected risk user in depth; these samples are used to enrich and update the training data set of the supervised clustering model, improving the model's ability to identify future abnormal behavior. Misjudgment samples: these samples are features of normal behavior that are confirmed to be incorrectly labeled in the audit process of risk control personnel; by collecting misjudgment samples, the semi-supervised model can learn how to reduce future false identification and improve the accuracy of the model. These two kinds of samples are not only used to update the supervised clustering model, but also used to optimize the prompt word instruction of the large model analysis (the first example in the first prompt word, of course, other prompt words can also be optimized). By continuously iterating and optimizing the prior knowledge examples in the prompt word, the large model can more accurately analyze and identify abnormal behavior. Suspected risk confirmed known abnormal samples: update the known abnormal sample examples in the prompt word. Misjudgment samples: update the misjudgment sample examples in the prompt word.

[0187] 2. Sample supplement and update strategy of supervised clustering model:

[0188] In order to maintain the real-time and effectiveness of the model, the application adopts the following sample supplement and update strategy:

[0189] Data timeliness: Select data within the past month as a sample supplement for supervised models to ensure that the model can reflect the latest trends and patterns of abnormal behavior; At the same time, old data is regularly eliminated to reduce the impact of outdated information on the model. Data volume control: For the update of the large model instruction of anomaly analysis, the system will control the data volume to be near 200; This number is based on experiments and performance tests, aiming to balance the efficiency and effectiveness of model training. Data selection strategy: If the number of newly collected artificial confirmation samples is too large, the system will first perform clustering analysis on these samples, and then uniformly select representative samples from each cluster to ensure the diversity and coverage of the samples; This method helps the large model to learn a wide range of attack patterns under limited data volume.

[0190] 3. Improvement of large model recognition effect: Through the negative feedback mechanism, the recognition effect of the large model is improved: Real-time learning: The large model can learn the characteristics and patterns of the latest abnormal behavior in real time, as each update incrementally updates the latest artificial confirmation samples (i.e., updates the first example). Reduce bias: Through the feedback of misjudgment samples, the large model can adjust its reasoning path and reduce misjudgments of normal user behavior. Improve generalization ability: Regularly updated samples help the large model improve its generalization ability, enabling it to maintain a high recognition rate in different attack scenarios.

[0191] The present application combines large model analysis to identify more complex attack patterns and improve the overall performance of the identification system. Through in-depth understanding of activity rules by the large model, combined with detailed analysis of known abnormal user feature vectors and misjudgment user feature vectors, through simulating human thinking chains, guiding the large model to perform logical reasoning and analysis, generating more representative and predictive value of abnormal samples. Desensitizing user information to protect user privacy and ensure data processing compliance. Through automated test prompt word instructions, using artificially determined abnormal vectors in the known abnormal knowledge base as standard answers, comparing the similarity between the abnormal vectors generated by the large model and the standard answers as the scoring standard, optimizing and iterating the prompt word instructions of the large model anomaly analysis. The model update mechanism ensures that it can maintain high real-time and adaptability when facing constantly changing abnormal behaviors. By constructing a negative feedback knowledge base and a prompt engineering, a closed-loop optimization system is formed, enabling the clustering algorithm to continuously learn and improve, and the large model to maintain sensitivity to new abnormal behaviors through the update of negative feedback knowledge in the prompt word, improving the recognition efficiency.

[0192] Based on the above method embodiments, the present application also provides an abnormal behavior identification device, as shown in Figure 9 The device comprises:

[0193] The acquisition module 910 is configured to acquire the behavior characteristics of each user participating in the target online activity.

[0194] The clustering module 920 is configured to cluster the behavior features of each user based on a first model for clustering to obtain a first classification result of each user, wherein the first classification result of each user includes: the behavior features of the user belong to the features of abnormal behavior, or the behavior features of the user belong to the features of normal behavior.

[0195] The classification module 930 is configured to perform behavior classification on the behavior features of each user based on a second model to obtain a second classification result of each user, wherein the behavior classification is used to analyze whether the behavior features of any user belong to the features of normal behavior or the features of abnormal behavior, and the second model is trained based on each first sample feature and each second sample feature, wherein the first sample feature is a behavior feature of normal behavior issued for the target online activity, and the second sample feature is a behavior feature of abnormal behavior issued for the target online activity.

[0196] The determination module 940 is configured to determine, from the first classification result and the second classification result of each user, a user whose result meets a predetermined condition to obtain a target user, wherein the predetermined condition is a feature representing abnormal behavior.

[0197] The first calling module 950 is configured to call a predetermined target large model to analyze whether the behavior features of the target user belong to the features of abnormal behavior to obtain an analysis result.

[0198] Optionally, the first calling module is specifically configured to:

[0199] call the predetermined target large model to analyze whether the behavior features of the target user belong to the features of abnormal behavior according to a first prompt word to obtain an analysis result.

[0200] The first prompt word includes: an activity rule of the target online activity, a first example, and first content.

[0201] The first content includes content guiding the target large model to analyze whether it belongs to the features of abnormal behavior.

[0202] The first example includes: a first type of abnormal feature, a first type of normal feature, and a second type of normal feature.

[0203] The first type of abnormal feature, the first type of normal feature, and the second type of normal feature are all behavior features of behaviors issued for the target online activity.

[0204] The first type of abnormal feature is artificially marked as a feature of abnormal behavior.

[0205] The first type of normal feature is a feature artificially labeled as normal behavior, and the second type of normal feature is a feature analyzed by a predetermined analysis method as normal behavior. The first type of normal feature specifically includes a feature analyzed by a predetermined analysis method as abnormal behavior but artificially labeled as normal behavior.

[0206] Optionally, each first sample feature includes a plurality of first type of normal features.

[0207] Each second sample feature includes at least one first type of abnormal feature and at least one second type of abnormal feature.

[0208] The second type of abnormal feature is a behavior feature of behavior issued for the target online activity, and the second type of abnormal feature is specifically a feature analyzed by a predetermined analysis method as abnormal behavior.

[0209] Optionally, each second sample feature further includes at least one third type of abnormal feature.

[0210] The third type of abnormal feature is a feature simulated and generated by the target large model according to a second prompt word, which belongs to abnormal behavior for the target online activity.

[0211] The second prompt word includes an activity rule of a target activity, a second example, and second content. The second example includes the first type of abnormal feature and the first type of normal feature. The second content includes content guiding the target large model to analyze the second example and the activity rule of the target activity, and to simulate and generate a feature belonging to abnormal behavior for the target online activity.

[0212] Optionally, the device further includes a second calling module configured to:

[0213] Based on a third prompt word, the target large model is called to analyze the third type of abnormal feature to obtain an analysis result of the third type of abnormal feature, so as to optimize the second prompt word.

[0214] The third prompt word includes a third example and third content.

[0215] The third example includes the first type of abnormal feature and the first type of normal feature.

[0216] The third content includes content guiding the target large model to analyze the difference between the third type of abnormal feature and the feature in the third example.

[0217] Optionally, the plurality of first normal features are features in a first behavior database, and the at least one first abnormal feature and the at least one second abnormal feature are features in a second behavior database.

[0218] The apparatus further comprises a negative feedback module configured to:

[0219] After determining that the target user has abnormal behavior in the target online activity, the negative feedback data corresponding to the target user is obtained, wherein the negative feedback data corresponding to the target user is a labeling result of whether the behavior feature of the target user is an abnormal behavior feature by an artificial;

[0220] In response to the negative feedback data of the target user being a labeling result of a normal behavior feature, the behavior feature of the target user is added to the first behavior database as a first normal feature;

[0221] In response to the negative feedback data of the target user being a labeling result of an abnormal behavior feature, the behavior feature of the target user is added to the second behavior database as a first abnormal feature;

[0222] Based on the current first behavior database and the second behavior database, the first example is updated.

[0223] Optionally, the obtaining module is specifically configured to:

[0224] In response to a trigger condition of abnormal behavior recognition, the behavior features of each user participating in the target online activity in a specified period are obtained, wherein the specified period is a period with a predetermined length ending at the current time.

[0225] The embodiment of the application further provides an electronic device, as shown in the figure, comprising a processor 1001, a communication interface 1002, a memory 1003 and a communication bus 1004, wherein the processor 1001, the communication interface 1002 and the memory 1003 complete mutual communication through the communication bus 1004. Figure 10

[0226] The memory 1003 is used to store computer programs.

[0227] The processor 1001 is used to execute the programs stored in the memory 1003, and realize the steps of the abnormal behavior recognition method.

[0228] ​The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0229] The communication interface is used for communication between the above electronic device and other devices.

[0230] The memory can include a Random Access Memory (RAM) and can also include a Non-Volatile Memory (NVM), such as at least one disk memory. Optionally, the memory can also be at least one storage device located away from the above-mentioned processor.

[0231] The above-mentioned processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component.

[0232] In another embodiment provided by the application, a computer readable storage medium is also provided, and the computer readable storage medium stores a computer program. When the computer program is executed by a processor, the steps of any of the above-mentioned abnormal behavior identification methods are implemented.

[0233] In another embodiment provided by the application, a computer program product containing instructions is also provided, and when the computer program product is run on a computer, the computer is caused to execute any of the above-mentioned abnormal behavior identification methods.

[0234] In the embodiments described above, all or some of the embodiments can be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or some of the embodiments can be implemented in the form of a computer program product storing computer program instructions. The computer program instructions are executed in a computer to implement the processes or functions described by the embodiments of the present application. The computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable apparatus. The computer program instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another computer readable storage medium, for example, the computer program instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center through wired (for example, coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (for example, infrared, wireless, microwave, etc.) manner. The computer readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be a magnetic medium (for example, floppy disk, hard disk, magnetic tape), an optical medium (for example, DVD), or a semiconductor medium (for example, Solid State Disk (SSD)), etc.

Claims

1. A method for identifying abnormal behavior, characterized in that: The method comprises: Obtain behavioral characteristics of each user participating in the target online activity; Clustering the behavioral characteristics of each user based on the first clustering model to obtain a first classification result for each user; wherein the first classification result for each user includes: whether the behavioral characteristics of the user are abnormal behavior characteristics, or whether the behavioral characteristics of the user are normal behavior characteristics; Based on the second model, the behavioral characteristics of each user are behaviorally classified to obtain a second classification result for each user; wherein the behavioral classification is used to analyze whether the behavioral characteristics of any user belong to normal behavior characteristics or abnormal behavior characteristics, and the second model is trained based on each first sample feature and each second sample feature, wherein the first sample feature is the behavioral characteristic of normal behavior issued with respect to the target online activity, and the second sample feature is the behavioral characteristic of abnormal behavior issued with respect to the target online activity; Determining, from the first classification results and the second classification results of each user, that there is a user whose result satisfies a predetermined condition, and obtaining a target user; wherein the predetermined condition is characterized by a feature indicating abnormal behavior; A predetermined target large model is called to analyze the behavior characteristics of the target user to determine whether they are abnormal behavior characteristics, and obtain an analysis result.

2. The method according to claim 1, characterized in that The calling of a predetermined target macro model to analyze the target user's behavior characteristics to determine whether they are abnormal behavior characteristics, and obtaining analysis results, including: According to the first prompt word, calling a predetermined target macro model, analyzing the behavior characteristics of the target user to determine whether they are abnormal behavior characteristics, and obtaining an analysis result; The first prompt word includes: the activity rules, the first example and the first content of the target online activity; The first content includes: content that guides the target large model to analyze whether it is a feature of abnormal behavior; The first example includes: a first type of abnormal features, a first type of normal features, and a second type of normal features; The first type of abnormal features, the first type of normal features, and the second type of normal features are all behavioral features of behaviors issued by the target online activity; The first type of abnormal features are features that are manually marked as belonging to abnormal behavior; The first type of normal features are features that are manually calibrated as belonging to normal behavior, and the second type of normal features are features that are analyzed as belonging to normal behavior through a predetermined analysis method. The first type of normal features specifically includes: features that are analyzed as belonging to abnormal behavior through a predetermined analysis method but are manually calibrated as belonging to normal behavior.

3. The method according to claim 2, characterized in that The first sample features include: a plurality of first-class normal features; Each second sample feature includes: at least one first-category abnormal feature and at least one second-category abnormal feature; The second type of abnormal features are behavioral features of the behavior initiated with respect to the target online activity, and the second type of abnormal features are specifically features of abnormal behavior analyzed by a predetermined analysis method.

4. The method according to claim 3, characterized in that Each second sample feature also includes: at least one third type of abnormal feature; The third type of abnormal features are: features of abnormal behavior related to the target online activity, generated by simulating the target large model based on the second prompt word; The second prompt words include: the activity rules of the target activity, a second example and a second content; the second example includes the first type of abnormal features and the first type of normal features; the second content includes: guiding the target big model to analyze the second example and the activity rules of the target activity, and simulate and generate content that belongs to the characteristics of abnormal behavior against the target online activity.

5. The method according to claim 4, characterized in that The method further comprises: Based on the third prompt word, calling the target large model to analyze the third type of abnormal features to obtain analysis results of the third type of abnormal features to optimize the second prompt word; The third prompt word includes: a third example and a third content; The third example includes: the first type of abnormal features and the first type of normal features; The third content includes: content that guides the target large model to analyze the differences between the third type of abnormal features and the features in the third example.

6. The method according to claim 3, characterized in that The plurality of first-category normal features are features in a first behavior database, and the at least one first-category abnormal feature and the at least one second-category abnormal feature are features in a second behavior database; The method further comprises: After determining that the target user has abnormal behavior with respect to the target online activity, obtaining negative feedback data corresponding to the target user; wherein the negative feedback data corresponding to the target user is: a result of manually calibrating whether the behavior characteristics of the target user are characteristics of abnormal behavior; In response to a calibration result of the negative feedback data of the target user being a feature representing normal behavior, adding the behavior feature of the target user as a first-category normal feature to the first behavior database; In response to the negative feedback data of the target user being a calibration result of a feature characterizing abnormal behavior, adding the behavior feature of the target user as a first-category abnormal feature to the second behavior database; The first example is updated based on the current first behavior database and the second behavior database.

7. The method according to claim 1, characterized in that The obtaining of behavioral characteristics of each user participating in the target online activity includes: In response to a trigger condition for abnormal behavior identification, behavioral characteristics of each user who participates in a target online activity within a specified time period are obtained; wherein the specified time period is a time period with a current time as the end time and a predetermined duration.

8. An abnormal behavior recognition device, characterized in that: The device comprises: An acquisition module, used to obtain the behavioral characteristics of each user participating in the target online activity; a clustering module, configured to cluster the behavioral characteristics of each user based on a first clustering model to obtain a first classification result for each user; wherein the first classification result for each user includes: whether the behavioral characteristics of the user are abnormal behavior characteristics, or whether the behavioral characteristics of the user are normal behavior characteristics; a classification module, configured to classify the behavioral characteristics of each user based on a second model to obtain a second classification result for each user; wherein the behavioral classification is used to analyze whether the behavioral characteristics of any user belong to normal behavior characteristics or abnormal behavior characteristics, and the second model is trained based on each first sample feature and each second sample feature, wherein the first sample feature is the behavioral characteristic of normal behavior emitted with respect to the target online activity, and the second sample feature is the behavioral characteristic of abnormal behavior emitted with respect to the target online activity; a determination module configured to determine, from the first classification results and the second classification results of the respective users, whether there is at least one user whose result satisfies a predetermined condition, and obtain a target user; wherein the predetermined condition is characterized by a feature indicating abnormal behavior; The first calling module is used to call a predetermined target large model, analyze the behavior characteristics of the target user to determine whether they are abnormal behavior characteristics, and obtain an analysis result.

9. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; Memory for storing computer programs; A processor, configured to implement the method steps described in any one of claims 1 to 7 when executing a program stored in a memory.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps according to any one of claims 1 to 7 are implemented.

Images