Abnormal behavior recognition method and device based on position composition, equipment and medium

Abstract

The embodiment of the invention relates to an abnormal behavior recognition method and device based on position composition, equipment and a medium. The method comprises the steps of obtaining multiple pieces of behavior position data of a to-be-recognized user in a statistical period from a service log; wherein each piece of behavior position data comprises interaction information of the user to be identified and a target interaction position of the service display page; coding the target interaction positions based on the interaction information to obtain a target position coding value of each target interaction position, and sorting the target position coding values according to the interaction time of the target interaction positions to obtain an interaction position sequence; mapping the interaction position sequence into a two-dimensional single-channel image based on a statistical period; and determining an abnormal behavior recognition result of the to-be-recognized user based on feature representation comparison of the two-dimensional single-channel image and a preset reference image. According to the technical scheme, the behavior position data of the user is converted into the two-dimensional image for abnormal behavior recognition, and the flexibility and effectiveness of abnormal behavior recognition are improved.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to a method, apparatus, device and medium for identifying abnormal behavior based on location mapping. Background Technology

[0002] Currently, there are many cheating attacks on the internet, such as repeatedly clicking to play the same video in video playback scenarios, and repeatedly boosting followers in live streaming scenarios. A large number of cheating behaviors seriously affect the user experience and require anti-cheating measures.

[0003] Currently, there are many ways to identify abnormal users in anti-fraud efforts. For example, predefined rules or behavioral patterns can be used for anomaly detection. However, rules lack flexibility and are difficult to adapt to constantly changing and complex abnormal behaviors, easily resulting in a large number of false positives and false negatives. Alternatively, statistical analysis and probability models can be used to identify abnormal behaviors, but there are still a large number of false positives and false negatives when faced with dynamically changing and complex behaviors. Summary of the Invention

[0004] To solve the above-mentioned technical problems, or at least partially solve them, this disclosure provides a method, apparatus, device, and medium for identifying abnormal behavior based on location mapping.

[0005] This disclosure provides a method for identifying abnormal behavior based on location mapping. The method includes: obtaining multiple behavioral location data of a user to be identified within a statistical period from business logs; wherein each behavioral location data includes interaction information between the user to be identified and a target interaction location on a business display page; encoding the target interaction location based on the interaction information to obtain a target location encoding value for each target interaction location, and sorting the target location encoding values ​​according to the interaction time of the target interaction location to obtain an interaction location sequence; mapping the interaction location sequence into a two-dimensional single-channel image based on the statistical period, mapping the portion of the target location encoding value representing location information into pixel units of the two-dimensional single-channel image; mapping the portion of the target location encoding value representing interaction information into pixel values ​​of each pixel unit; and comparing the two-dimensional single-channel image with a preset reference image feature representation to determine the abnormal behavior identification result of the user to be identified.

[0006] Optionally, the step of encoding the target interaction location based on the interaction information to obtain the target location encoding value of the target interaction location includes: obtaining the number of interactions for each target interaction location based on the interaction information of the target interaction location; sorting all the target interaction locations according to the number of interactions to obtain an interaction location sorting result; and assigning a value to the target interaction location according to a preset encoding assignment strategy based on the interaction location sorting result to obtain the target location encoding value of the target interaction location.

[0007] Optionally, the step of assigning values ​​to the target interactive positions based on the interaction position sorting result according to a preset encoding assignment strategy to obtain the target position encoding value of the target interactive position includes: obtaining the maximum pixel value in a preset pixel range and the total number of positions of all the target interactive positions; determining the number of target interactive positions in each bucket based on the maximum pixel value and the total number of positions; wherein each bucket corresponds to the same pixel value; dividing the corresponding number of target interactive positions into corresponding buckets according to the target interactive position quota of each bucket based on the interaction position sorting result, and determining the target position encoding value corresponding to the target interactive position based on the pixel value corresponding to each bucket.

[0008] Optionally, the step of encoding the target interaction location based on the interaction information to obtain the target location encoding value of the target interaction location includes: obtaining the lexicographical order of the target interaction location based on the interaction information of the target interaction location; wherein the lexicographical order includes the page identifier and region coordinate identifier of the target interaction location; and determining the target location encoding value corresponding to the target interaction location in sequence according to the lexicographical order of the target interaction location and a preset pixel range value.

[0009] Optionally, determining the target location encoding value corresponding to the target interaction location according to the lexicographical order of the target interaction location and the preset pixel range value includes: determining the interaction logic order of the target interaction location based on the lexicographical order of the target interaction location; and assigning each pixel value in the preset pixel range value to each target interaction location according to the interaction logic order to obtain the target location encoding value corresponding to the target interaction location.

[0010] Optionally, the interaction position sequence is mapped to a two-dimensional single-channel image, and the part representing position information in the target position encoding value is mapped to the pixel unit of the two-dimensional single-channel image; the part representing interaction information in the target position encoding value is mapped to the pixel value of each pixel unit, including: obtaining a preset M multiplied by N matrix corresponding to the two-dimensional single-channel image; where M and N are natural numbers greater than or equal to 1;

[0011] Within the statistical period, M target interaction locations are obtained according to the interaction location sequence in the time dimension. The part representing the location information in the target location encoding value is used as M pixel units of the two-dimensional single-channel image. The part representing the interaction information in the target location encoding value of the target interaction location is used as the image pixel value of a pixel position to construct a row of a matrix until N rows of the matrix are obtained, thus obtaining the two-dimensional single-channel image corresponding to the user to be identified.

[0012] Optionally, the method further includes: obtaining the total number of target location encoding values ​​of the target interaction locations; when the total number is greater than the product of M and N, extracting the target location encoding values ​​of the target interaction locations M multiplied by N from the total number of target location encoding values ​​according to a preset truncation strategy; when the total number is less than the product of M and N, obtaining the difference between the total number and the product of M and N, and filling the difference number of pixel positions to be filled in the two-dimensional single-channel image with a preset value.

[0013] Optionally, the step of comparing the two-dimensional single-channel image with a preset reference image feature representation to determine the abnormal behavior identification result of the user to be identified includes: encoding the two-dimensional single-channel image based on a preset encoder to obtain a compressed image, and decoding the compressed image based on a preset decoder to obtain a reconstructed image, using the image feature representation corresponding to the reconstructed image as the reference image feature representation; wherein, the encoder encodes image features of multiple location image samples to obtain multiple compressed image samples, and the decoder decodes the compressed image samples to obtain reconstructed image samples, and the encoder and the decoder are adjusted based on the reconstruction error of the reconstructed image samples and the standard image samples and a preset error threshold; wherein, each location image sample is an image sample generated from normal behavior location data; the reconstruction error is calculated based on the image feature representation corresponding to the two-dimensional single-channel image and the image feature representation corresponding to the reconstructed image; when the reconstruction error is greater than the preset error threshold, the abnormal behavior identification result of the user to be identified is abnormal behavior; when the reconstruction error is less than or equal to the preset error threshold, the abnormal behavior identification result of the user to be identified is normal behavior.

[0014] Optionally, the step of comparing the two-dimensional single-channel image with a preset reference image feature representation to determine the abnormal behavior identification result of the user to be identified includes: calculating the positional distance between the image feature representation of the two-dimensional single-channel image and the reference image feature representation of the cluster center of the preset cluster category; wherein, image features are extracted from multiple location image samples to obtain multiple location image feature samples, and clustering calculation is performed based on the multiple location image feature samples to obtain the preset cluster category; wherein, each location image sample is an image sample generated from normal behavior location data; when the positional distance is greater than a preset distance threshold, the abnormal behavior identification result of the user to be identified corresponding to the two-dimensional single-channel image is obtained as abnormal behavior; when the positional distance is less than or equal to the preset distance threshold, the abnormal behavior identification result of the user to be identified corresponding to the two-dimensional single-channel image is obtained as normal behavior.

[0015] Optionally, the step of comparing the two-dimensional single-channel image with a preset reference image feature representation to determine the abnormal behavior identification result of the user to be identified includes: extracting image features from the two-dimensional single-channel image to obtain two-dimensional single-channel image features; inputting the two-dimensional single-channel image features into a preset classifier for processing to obtain a target category; wherein, the classifier calculates based on the two-dimensional single-channel image features and the reference image feature representation to determine the target category; when the target category is a preset abnormal category, the abnormal behavior identification result of the user to be identified is abnormal behavior; when the target category is not a preset abnormal category, the abnormal behavior identification result of the user to be identified is normal behavior.

[0016] This disclosure also provides an abnormal behavior recognition device based on location mapping. The device includes: an acquisition module, used to acquire multiple behavioral location data of a user to be identified within a statistical period from business logs; wherein each behavioral location data includes interaction information of the user to be identified and a target interaction location on a business display page; an encoding module, used to encode the target interaction location based on the interaction information to obtain a target location encoding value for each target interaction location; a sorting module, used to sort the target location encoding values ​​according to the interaction time of the target interaction location to obtain an interaction location sequence; a construction module, used to construct a two-dimensional single-channel image corresponding to the user to be identified based on the statistical period, using the target location encoding value to represent image pixel values, and based on the target location encoding value of each target interaction location and the interaction information; and a detection module, used to compare the two-dimensional single-channel image with a preset reference image feature representation to determine the abnormal behavior recognition result of the user to be identified.

[0017] This disclosure also provides an electronic device, the electronic device comprising: a processor; a memory for storing executable instructions of the processor; the processor being configured to read the executable instructions from the memory and execute the instructions to implement the location mapping-based abnormal behavior recognition method provided in this disclosure.

[0018] This disclosure also provides a computer-readable storage medium storing a computer program for executing the location-map-based abnormal behavior recognition method provided in this disclosure.

[0019] This disclosure also provides a computer program product, including a computer program, wherein the computer program is executed by a processor as described in the embodiments of this application for anomaly behavior recognition method based on location mapping.

[0020] The technical solution provided in this disclosure analyzes the behavioral location data of the user to be identified to construct a two-dimensional single-channel image, thereby realizing the identification of abnormal behavior through anomaly detection of the two-dimensional single-channel image, thus improving the flexibility and effectiveness of abnormal behavior identification. Due to the universality of converting behavioral location data into two-dimensional single-channel images, the anomaly detection method can be efficiently and flexibly adapted to various business scenarios, especially for abnormal behaviors with fixed or periodically repeated behavioral locations, which have better identification effects.

[0021] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0022] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and the originals and elements are not necessarily drawn to scale.

[0023] Figure 1 A schematic flowchart illustrating an abnormal behavior recognition method based on location mapping provided in this disclosure embodiment;

[0024] Figure 2 A flowchart illustrating another abnormal behavior recognition method based on location mapping provided in this disclosure embodiment;

[0025] Figure 3 A schematic diagram of the construction location image provided in an embodiment of this disclosure;

[0026] Figure 4A schematic diagram illustrating a location image comparison provided in an embodiment of this disclosure;

[0027] Figure 5 A schematic diagram of the structure of an abnormal behavior recognition device based on location mapping provided in an embodiment of this disclosure;

[0028] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0029] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0030] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0031] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0032] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0033] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0034] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0035] Based on the aforementioned background technology description, using predefined rules or behavioral patterns for abnormal behavior detection is prone to generating a large number of false positives and false negatives due to the lack of flexibility of the rules, making it difficult to adapt to constantly changing and complex abnormal behaviors. Statistical analysis and probabilistic models for identifying abnormal behaviors, such as Gaussian mixture models and hidden Markov models, are relatively effective in processing data with clear statistical distributions and patterns, but they are still prone to generating a large number of false positives and false negatives when faced with dynamically changing and complex behaviors. As for abnormal behavior detection based on machine learning models, a large amount of high-quality labeled data is required to train the machine learning models.

[0036] To address the shortcomings of the aforementioned rule-based methods, such as insufficient flexibility, poor performance of statistical models in recognizing complex and dynamically changing behaviors, and the need for large amounts of labeled data in machine learning models, this disclosure proposes an embodiment that analyzes the behavioral location data of the user to be identified to construct a two-dimensional single-channel location. This allows for the identification of abnormal behaviors through anomaly detection on the two-dimensional single-channel image, thereby improving the flexibility and effectiveness of abnormal behavior recognition. Furthermore, the universality of converting behavioral location data into a two-dimensional single-channel image enables the anomaly detection method to be efficiently and flexibly adapted to various business scenarios.

[0037] Figure 1 This is a flowchart illustrating an abnormal behavior recognition method based on location mapping, provided in an embodiment of this disclosure. This method can be executed by an abnormal behavior recognition device based on location mapping, which can be implemented in software and / or hardware, and is generally integrated into an electronic device. Figure 1 As shown, the method includes:

[0038] Step 101: Obtain multiple behavioral location data of the user to be identified within the statistical period from the business logs; wherein, each behavioral location data includes the interaction information of the user to be identified and the target interaction location of the business display page.

[0039] The service can be any service, such as a video service. This embodiment does not limit the specific type of service. Each service has a corresponding service log, including system logs and operation logs. The system logs are records of key steps during the execution of the service program. The operation logs are logs of the user's actual service operation behavior, including multiple behavioral location data of one or more users to be identified. The statistical period can be selected as needed, such as one day or one week, to obtain the operation logs of the user to be identified using the service program on day P. Here, P is a positive integer greater than or equal to 1, and multiple behavioral location data are extracted from these operation logs. In addition, to ensure computational efficiency and detection effectiveness, a certain amount of behavioral location data can be extracted from the log data.

[0040] Among them, the user to be identified refers to the user whose status needs to be confirmed as normal or abnormal; the behavior location data refers to the interaction information such as the number of times and the trigger time of each interaction location of the user to be identified in the business display page; among them, an interaction location can be uniquely identified by an interaction location identifier, such as a letter; an interaction location can be uniquely identified by a page identifier and a region coordinate identifier; among them, the page identifier can uniquely identify a page and the region coordinate identifier can uniquely identify a location within a page.

[0041] In this embodiment, each behavioral location data includes interaction information between the user to be identified and the target interaction location on the business display page. It is understood that multiple behavioral location data may contain numerous interaction locations. Performing anomaly detection on all interaction locations would result in excessive data volume and computational burden, reducing anomaly detection efficiency. Furthermore, non-critical interaction locations may interfere with behavioral anomaly detection, reducing its accuracy. This embodiment can filter the original behavioral location data after acquisition to select the behavioral location data corresponding to the target interaction location, which will then be used as the behavioral location data for subsequent anomaly detection. This reduces computational burden, further improving anomaly detection efficiency, and also reduces interference from redundant data, further improving anomaly detection accuracy. Specifically, one or more interaction locations can be selected as the target interaction location according to a certain selection strategy.

[0042] There are many selection strategies. In some embodiments, based on the statistical results of historical abnormal locations, some frequently identified abnormal interaction locations can be used as target interaction locations or interaction controls involved in key business functions. For example, the playback control area and like control area of ​​a video playback page can be used as target interaction locations. In other words, key interaction locations set at the business level can be used as target interaction locations for monitoring.

[0043] In other embodiments, the interaction location where the number of interactions exceeds a preset threshold is taken as the target interaction location. In other words, the interaction location where many interaction operations have occurred in the actual application scenario is taken as the target interaction location for monitoring.

[0044] It should be noted that the interaction locations corresponding to key business functions, as well as the number of interactions corresponding to those locations exceeding a preset threshold, can all be monitored as target interaction locations.

[0045] The interaction information may include the number of interactions (the number of times a trigger occurs at an interaction location, or the number of times content at a certain location is displayed), the interaction time (the trigger time for each interaction location), and the interaction duration, such as the playback duration of video content on a video playback page. In this embodiment of the disclosure, the interaction information typically refers to the number of interactions (such as clicks) at the target interaction location and the interaction time.

[0046] In this embodiment of the disclosure, obtaining multiple behavioral location data of the user to be identified within a statistical period from the business log can be understood as extracting interaction information such as the number of interactions and interaction time of each target interaction location corresponding to each user to be identified within a statistical period (e.g., one day) from the business log for all users to be identified or for one or more specific users to be identified as behavioral location data of each user to be identified.

[0047] Specifically, in the process of identifying abnormal behavior, multiple behavioral location data of one or more users to be identified within a statistical period can be obtained from business logs.

[0048] Step 102: Encode the target interaction positions based on the interaction information, obtain the target position encoding value for each target interaction position, and sort the target position encoding values ​​according to the interaction time of the target interaction position to obtain the interaction position sequence.

[0049] In business logs, target interaction locations are often represented by letters. However, they need to be represented by numbers. In other words, the target location encoding value is the encoding value obtained by converting the target interaction location characteristics from log record form to numerical form. For example, it can be a single numerical value.

[0050] In this disclosure, there are many ways to digitize the target interactive location. In some embodiments, a configuration value is selected from multiple pre-set values ​​according to a pre-set assignment rule, and this configuration value is used as the target location encoding value of the target interactive location. This matching value is used to represent the location information. The configuration value can be pre-defined within a range (e.g., integers from 0 to K) and assigned sequentially to each target interactive location. It can be understood that a target interactive location can be uniquely identified by a page identifier and a region coordinate identifier, thereby assigning the configuration value to a target interactive location. This establishes a mapping relationship between the configuration value, a page identifier, and region coordinates, thus realizing the target location encoding value for the portion representing the location information in the target interactive location.

[0051] In other embodiments, a processing model that converts text or strings into numerical values ​​is pre-trained. The page identifier and region coordinates corresponding to the target interactive location are input into the processing model. After processing by the model, the target location encoding value is obtained, further improving the flexibility of digitizing the target interactive location.

[0052] In this embodiment, the anomaly detection problem based on interaction location sequences is transformed into an image-based anomaly detection problem, that is, the interaction location sequence is converted into a two-dimensional single-channel image. Here, the interaction location sequence refers to a series of target interaction locations. All target interaction locations of the user to be identified are arranged according to a specific rule (such as the temporal order of the target interaction locations) to obtain the interaction location sequence. Specifically, each target interaction location is encoded to obtain a target location encoding value, and the target location encoding values ​​of each target interaction location are sorted according to the interaction time of each target interaction location, i.e., the trigger time of the interaction location, to obtain the interaction location sequence.

[0053] In this embodiment of the disclosure, there are many ways to encode the target interaction position based on the interaction information and obtain the target position encoding value of each target interaction position. In some embodiments, the interaction quantity of each target interaction position is obtained based on the interaction information of the target interaction position, and all target interaction positions are sorted according to the interaction quantity (either descending or ascending order, depending on the actual application needs) to obtain the interaction position sorting result. Based on the interaction position sorting result, the target interaction position is assigned a value according to a preset encoding assignment strategy to obtain the target position encoding value of the target interaction position.

[0054] In other embodiments, the lexicographical order of the target interaction location is obtained based on the interaction information of the target interaction location; wherein, the lexicographical order includes the page identifier and the region coordinate identifier of the target interaction location; and the target location encoding value corresponding to the target interaction location is determined sequentially according to the lexicographical order of the target interaction location and the preset pixel range value.

[0055] Specifically, each target interaction location is encoded to obtain a target location encoding value, and the target location encoding values ​​of each target interaction location are sorted according to the interaction time of each target interaction location to obtain an interaction location sequence.

[0056] It is understandable that the target position encoding value obtained based on the aforementioned encoding includes the encoding value of position information and the encoding value of interaction information. The encoding value representing the position information can be used as an integer point on a number axis according to the interaction time, and the encoding value representing the interaction information corresponding to the target interaction position can be used as the pixel value corresponding to each integer point to construct a one-dimensional interaction position sequence.

[0057] For example, consider three target interaction locations: X1 with interaction time Y1, where the target location encoding value includes a location information encoding value of 0 and an interaction information encoding value of 32; X2 with interaction time Y2, where the target location encoding value includes a location information encoding value of 1 and an interaction information encoding value of 16; and X3 with interaction time Y3, where the target location encoding value includes a location information encoding value of 2 and an interaction information encoding value of 64. Sorted by interaction time as Y1, Y3, and Y2, the target interaction locations are then sorted into target interaction locations X1, X3, and X2 based on the interaction time sorting result when constructing the one-dimensional interaction location sequence. Therefore, the one-dimensional interaction location sequence is represented by integer points on a number axis, which are 0, 2, and 1 respectively, with corresponding pixel values ​​of 32, 64, and 16.

[0058] Therefore, the interaction position sequence is subsequently mapped to a two-dimensional single-channel image. The part representing the position information in the target position encoding value is mapped to the pixel unit of the two-dimensional single-channel image; the part representing the interaction information in the target position encoding value is mapped to the pixel value of each pixel unit. Finally, efficient and accurate anomaly detection is performed based on rich image processing algorithms.

[0059] Step 103: Based on the statistical period, map the interaction position sequence into a two-dimensional single-channel image. Map the part of the target position encoding value that represents the position information into the pixel unit of the two-dimensional single-channel image; map the part of the target position encoding value that represents the interaction information into the pixel value of each pixel unit.

[0060] A two-dimensional single-channel image refers to an image with one color channel. It is typically a matrix consisting of rows and columns, containing an independent information channel, where each pixel has a pixel value. It should be noted that the pixel value can be a grayscale value, meaning a two-dimensional single-channel image can be a two-dimensional grayscale image; the pixel value can also be other color values, meaning a two-dimensional single-channel image can be a two-dimensional monochrome image.

[0061] Specifically, in this embodiment of the present disclosure, the interaction position sequence of the user to be identified is converted into a two-dimensional single-channel image. In this embodiment of the present disclosure, the target interaction positions are sorted according to the interaction time in the interaction information within the statistical period to obtain a one-dimensional interaction position sequence. The part of the target position encoding value that represents the position information is mapped into the pixel unit of the two-dimensional single-channel image. The part of the target position encoding value that represents the interaction information is mapped into the pixel value of each pixel unit to construct the two-dimensional single-channel image corresponding to the user to be identified.

[0062] In some embodiments, the image size of the two-dimensional single-channel image to be constructed is obtained. Based on the size, the size of the two-dimensional matrix to be constructed can be determined. Then, a certain number of target interaction positions are obtained sequentially from the generated one-dimensional interaction position sequence. The part of the target position encoding value of the target interaction position that represents the interaction information is used as a pixel unit to construct each row of the two-dimensional matrix. In this way, the two-dimensional matrix corresponding to the user to be identified can be obtained, that is, the two-dimensional single-channel image.

[0063] Therefore, the location data of each behavior is converted into corresponding image pixels to generate a two-dimensional single-channel image corresponding to the user's interaction behavior to be identified. Abnormal behavior can then be identified by anomaly detection of this two-dimensional single-channel image.

[0064] Step 104: Compare the two-dimensional single-channel image with the preset reference image feature representation to determine the abnormal behavior recognition result of the user to be identified.

[0065] Specifically, after acquiring a two-dimensional single-channel image, abnormal behavior identification results of the user to be identified can be obtained by detecting the two-dimensional single-channel image. There are many ways to detect abnormal behavior identification results of the user to be identified by detecting the two-dimensional single-channel image. In some implementations, the two-dimensional single-channel image is encoded based on a preset encoder to obtain a compressed image; the compressed image is decoded based on a preset decoder to obtain a reconstructed image; the reconstruction error is calculated based on the position image and the reconstructed image; when the reconstruction error is greater than a preset error threshold, the abnormal behavior identification result of the user to be identified is abnormal behavior; when the reconstruction error is less than or equal to the preset error threshold, the abnormal behavior identification result of the user to be identified is normal behavior.

[0066] The process involves encoding image features from multiple location image samples using an encoder to obtain multiple compressed image samples, and then decoding these compressed image samples using a decoder to obtain reconstructed image samples. The encoder and decoder are adjusted based on the reconstruction error between the reconstructed image samples and the standard image samples, as well as a preset error threshold. Each location image sample is an image sample generated from normal behavior location data.

[0067] In other implementations, the positional distance between the image feature representation of the two-dimensional single-channel image and the reference image feature representation of the cluster center of the preset cluster category is calculated; when the positional distance is greater than a preset distance threshold, the abnormal behavior identification result of the user to be identified corresponding to the two-dimensional single-channel image is obtained as abnormal behavior; when the positional distance is less than or equal to the preset distance threshold, the abnormal behavior identification result of the user to be identified corresponding to the two-dimensional single-channel image is obtained as normal behavior.

[0068] In this process, image features are extracted from multiple location image samples to obtain multiple location image feature samples, and clustering calculations are performed based on the multiple location image feature samples to obtain a preset cluster category; wherein each location image sample is an image sample generated from normal behavior location data.

[0069] In some other implementations, image features are extracted from the two-dimensional single-channel image to obtain two-dimensional single-channel image features; the two-dimensional single-channel image features are input into a preset classifier for processing to obtain a target category; wherein, the classifier calculates based on the two-dimensional single-channel image features and the reference image feature representation to determine the target category; when the target category is a preset abnormal category, the abnormal behavior identification result of the user to be identified is abnormal behavior; when the target category is not a preset abnormal category, the abnormal behavior identification result of the user to be identified is normal behavior.

[0070] The above methods are merely examples of detecting location images to obtain abnormal behavior recognition results for the user to be identified. This disclosure does not impose specific restrictions on the implementation of detecting location images to obtain abnormal behavior recognition results for the user to be identified.

[0071] The location-based abnormal behavior recognition scheme provided in this embodiment obtains multiple behavioral location data of a user to be identified within a statistical period from business logs. Each behavioral location data includes interaction information between the user to be identified and a target interaction location on a business display page. The target interaction locations are encoded based on the interaction information to obtain a target location encoding value for each target interaction location. These target location encoding values ​​are then sorted according to the interaction time of the target interaction location to obtain an interaction location sequence. Within the statistical period, the interaction location sequence is mapped to a two-dimensional single-channel image. The portion of the target location encoding value representing location information is mapped to a pixel unit of the two-dimensional single-channel image. The portion of the target location encoding value representing interaction information is mapped to a pixel value for each pixel unit. The abnormal behavior recognition result of the user to be identified is determined by comparing the two-dimensional single-channel image with a preset reference image feature representation. By adopting the above technical solution, a two-dimensional single-channel image is constructed by analyzing the behavioral location data of the user to be identified. Anomaly detection of the two-dimensional single-channel image is then used to identify abnormal behavior, thereby improving the flexibility and effectiveness of abnormal behavior identification. Due to the universality of converting behavioral location data into two-dimensional single-channel images, the anomaly detection method can be efficiently and flexibly adapted to various business scenarios, especially for abnormal behaviors with fixed or periodically recurring behavioral locations, which have better identification results.

[0072] In some embodiments, encoding the target interaction location based on interaction information to obtain the target location encoding value of the target interaction location includes: obtaining the number of interactions for each target interaction location based on the interaction information of the target interaction location; sorting all target interaction locations according to the number of interactions to obtain the interaction location sorting result; and assigning a value to the target interaction location according to a preset encoding assignment strategy based on the interaction location sorting result to obtain the target location encoding value of the target interaction location.

[0073] In some embodiments, the target interaction position is assigned a value according to a preset encoding assignment strategy based on the interaction position sorting result. Obtaining the target position encoding value of the target interaction position includes: obtaining the maximum pixel value in the preset pixel range and the total number of all target interaction positions; determining the number of target interaction positions in each bucket based on the maximum pixel value and the total number of positions; wherein each bucket corresponds to the same pixel value; dividing the corresponding number of target interaction positions into the corresponding buckets in sequence according to the target interaction position quota of each bucket, and determining the target position encoding value corresponding to the target interaction position based on the pixel value corresponding to each bucket.

[0074] Specifically, a pixel range value can be preset, ranging from 0 to 255. Based on statistics from multiple behavioral location data, the total number of target interaction locations (N) is determined. The number of target interaction locations in each bucket is then determined according to the ratio of the maximum pixel value to the total number of locations. For example, target interaction locations from 0 to N / 255 are placed in the first bucket, represented by the same pixel value (e.g., 0). Then, target interaction locations from N / 255 to 2N / 255 are placed in the second bucket, represented by the same pixel value (e.g., 1), and so on. Target interaction locations from 244*N / 255 to 255*N / 255 are placed in the 255th bucket. Thus, the target location encoding value for each target interaction location is the pixel value corresponding to its bucket. In other words, this disclosure converts the target interaction location features from log records to digital form through bucket encoding, dividing a certain number of target interaction locations into several intervals (buckets), establishing a relationship between target interaction locations and intervals, with each interval corresponding to a pixel value, thereby obtaining the target location encoding value for each target interaction location.

[0075] In this embodiment of the disclosure, the behavioral location data includes interaction information such as the number of interactions and interaction time of the user to be identified at the target interaction location on the business display page; a target interaction location can be uniquely identified by a page identifier and a region coordinate identifier. For example, clicking on the coordinate region B1 of page A1 is taken as a target interaction location, and the number of interactions at the target interaction location within the statistical period is obtained, that is, all the times the target interaction location is operated is taken as the interaction count of the target interaction location.

[0076] It is understandable that for anomalies such as repeatedly clicking the same target interaction location over a period of time, the interaction locations can be sorted according to the number of interactions to obtain a sorting result, and a target location code value can be assigned to the target interaction location based on the sorting result.

[0077] Specifically, the target interaction positions are sorted from largest to smallest (or smallest to largest) according to the number of interactions, with those having more interactions placed first and those having fewer interactions placed later. Continuing with the example above, the first 0 to N / 255 target interaction positions are placed in the first bucket, using the same pixel value, for example, 0, as the target position code for the first 0 to N / 255 target interaction positions. Then, the first N / 255 to 2N / 255 target interaction positions are placed in the second bucket, using the same pixel value, for example, 1, as the target position code for the first N / 255 to 2N / 255 target interaction positions. This continues, with the 244*N / 255 to 255*N / 255 target interaction positions placed in the 255th bucket. In other words, the target interaction positions are sorted by the number of interactions, and the bucket corresponding to each target interaction position is determined based on the sorting result. The pixel value corresponding to the bucket to which each target interaction position belongs is used as the target position code value for each target interaction position, thereby realizing the determination of the pixel value of the target interaction position in a two-dimensional single-channel image based on the number of interactions. In addition, it can be achieved that the fewer the number of interactions, the more attention the brightness will receive, thereby improving the subsequent recognition effect.

[0078] Therefore, the smaller the number of interactions, the higher the target location encoding value. This means that the fewer interactions a target location has, the more attention it receives in terms of brightness when displayed in the location image, further improving the recognition of abnormal behavior.

[0079] In some embodiments, encoding the target interaction location based on interaction information to obtain the target location encoding value of the target interaction location includes: obtaining the lexicographical order of the target interaction location based on the interaction information of the target interaction location; wherein the lexicographical order includes the page identifier and region coordinate identifier of the target interaction location; and determining the target location encoding value corresponding to the target interaction location in sequence according to the lexicographical order of the target interaction location and a preset pixel range value.

[0080] In this embodiment of the disclosure, the behavior location data includes the page identifier and area coordinate identifier of each target interaction location. For example, the target interaction location is generated by operating on which area coordinates of which pages. Therefore, the lexicographical order of each target interaction location can be obtained.

[0081] In some embodiments, the interaction logic order of the target interaction positions is determined based on the lexicographical order of the target interaction positions, and each pixel value in the preset pixel range is assigned to each target interaction position in turn according to the interaction logic order to obtain the target position encoding value corresponding to the target interaction position.

[0082] In this embodiment, a pixel range value is preset, for example, a pixel range value of 0 to 255. The order of interaction logic for each target interaction position can be determined according to the lexicographical order of each target interaction position. Usually, the interaction logic is sorted from front to back. That is, an interaction logic order can be determined according to the page identifier and the area coordinate identifier. For example, for page 1 area 1 and page 2 area 1, the interaction logic order of page 1 area 1 can be determined to be first, and the interaction logic order of page 2 area 1 can be determined to be second. For another example, for page 1 area 1 and page 1 area 2, the interaction logic order of page 1 area 1 can be determined to be first, and the interaction logic order of page 1 area 2 can be determined to be second. For example, with a pixel range value of 0 to 255, the pixel value 0 is assigned to the target interaction position of the first interaction logic order in sequence, the pixel value 1 is assigned to the target interaction position of the second interaction logic order in sequence, and so on, until all target interaction positions are assigned the corresponding pixel value. This realizes that each pixel is assigned to the target interaction position corresponding to the interaction logic order in sequence according to the pixel value from smallest to largest, and the target position encoding value corresponding to each target interaction position is obtained.

[0083] It should be noted that if the number of target interaction positions is greater than the maximum pixel value, the target position encoding of all target interaction positions after the maximum pixel value will be set to the maximum pixel value.

[0084] In the above scheme, the position encoding is performed according to the lexicographical order of the target interaction position, and the target position encoding value of the target interaction position after the position with the maximum pixel value is set to the maximum pixel value, which further improves the position encoding efficiency, thereby improving the flexibility and effectiveness of abnormal behavior recognition. Anomaly recognition based on position encoding can sequentially represent the interaction position and has a good recognition effect for anomalies with fixed click positions or periodic repetition of click positions.

[0085] In some embodiments, based on a statistical period, the interaction location sequence is mapped to a two-dimensional single-channel image, and the portion representing location information in the target location encoding value is mapped to a pixel unit of the two-dimensional single-channel image; the portion representing interaction information in the target location encoding value is mapped to a pixel value of each pixel unit, including: obtaining a preset M multiplied by N matrix corresponding to the two-dimensional single-channel image; where M and N are natural numbers greater than or equal to 1; obtaining M target interaction locations according to the interaction location sequence in the time dimension within the statistical period, using the portion representing location information in the target location encoding value as M pixel units of the two-dimensional single-channel image, and constructing a row of the matrix with the portion representing interaction information in the target location encoding value of the target interaction location as a pixel position image pixel value, until the N rows of the matrix are obtained, thus obtaining the two-dimensional single-channel image corresponding to the user to be identified.

[0086] The matrix can be set to M x N, such as 32 x 32, depending on the actual application requirements. The target interaction positions are arranged according to the interaction time in the interaction information within the statistical period, resulting in a one-dimensional sequence of interaction positions. Then, M, for example, 32 target interaction positions are sequentially obtained from the sequence. The portion representing the position information in the target position encoding value is used as M pixel units in a two-dimensional single-channel image. A row of the matrix is ​​constructed using the portion representing the interaction information in the target position encoding value as a pixel value, until N rows are obtained. Finally, a two-dimensional single-channel image is obtained, consisting of an M x N matrix, such as a 32 x 32 matrix. Different pixel values ​​represent different interaction information at the target interaction positions.

[0087] In some embodiments, the total number of target location encoding values ​​for target interaction locations is obtained. When the total number is greater than the product of M and N, M times the product of M and N target interaction location encoding values ​​are truncated from the total number of target interaction location encoding values ​​according to a preset truncation strategy. When the total number is less than the product of M and N, the difference between the total number and M and N is obtained, and the difference in the number of pixels to be filled in the two-dimensional single-channel image is filled with a preset value. In this embodiment of the disclosure, the preset value can be 0.

[0088] In the above scheme, a one-dimensional interactive position sequence constructed from multiple behavioral position data is converted into a two-dimensional single-channel image of a certain size, thereby realizing the conversion of behavioral position data into a two-dimensional single-channel image for abnormal behavior recognition, thus improving the flexibility and effectiveness of abnormal behavior recognition.

[0089] In some embodiments, detecting a two-dimensional single-channel image to obtain an abnormal behavior recognition result for the user to be identified includes: encoding the two-dimensional single-channel image based on a preset encoder to obtain a compressed image; decoding the compressed image based on a preset decoder to obtain a reconstructed image; calculating the reconstruction error based on the location image and the reconstructed image; when the reconstruction error is greater than a preset error threshold, the abnormal behavior recognition result for the user to be identified is abnormal behavior; when the reconstruction error is less than or equal to the preset error threshold, the abnormal behavior recognition result for the user to be identified is normal behavior.

[0090] The process involves encoding image features from multiple location image samples using an encoder to obtain multiple compressed image samples, and then decoding these compressed image samples using a decoder to obtain reconstructed image samples. The parameters of the encoder and decoder are adjusted based on the reconstruction error between the reconstructed image samples and the standard image samples, as well as a preset error threshold, until convergence. Each location image sample is an image sample generated from normal behavior location data.

[0091] Specifically, the preset encoder is used to compress the location image, while the preset decoder is used to reconstruct the original image from the compressed image features. During the training phase, the decoder guides the encoder to select the most informative features, which are ultimately stored in the compressed representation.

[0092] It is understandable that encoders and decoders trained on normal data can reconstruct and restore the location image well, but cannot restore data points that are not normally distributed well, thus causing large errors. Therefore, they can be used for image anomaly detection.

[0093] Specifically, the input data can be reconstructed through compressed representation (encoding) and decompressed representation (decoding), and anomalies can be detected through the reconstruction error. Convolutional neural networks can be used as encoders and decoders, and mean squared error or binary cross-entropy can be used as reconstruction error. By comparing the reconstruction error with a preset error threshold, the abnormal behavior of the user to be identified corresponding to the position image where the reconstruction error is higher than the preset error threshold is identified as abnormal behavior, and when the reconstruction error is less than or equal to the preset error threshold, the abnormal behavior of the user to be identified is identified as normal behavior.

[0094] In the above scheme, the reconstruction error between the reconstructed image obtained by image encoding and decoding and the original image is used to determine whether there is an anomaly, thereby further improving the efficiency and effectiveness of abnormal behavior recognition.

[0095] In some embodiments, detecting a two-dimensional single-channel image to obtain an abnormal behavior recognition result for the user to be identified includes: calculating the positional distance between the two-dimensional single-channel image and the cluster center of the corresponding cluster category; when the positional distance is greater than a preset distance threshold, the abnormal behavior recognition result for the user to be identified corresponding to the two-dimensional single-channel image is determined to be abnormal; when the positional distance is less than or equal to the preset distance threshold, the abnormal behavior recognition result for the user to be identified corresponding to the two-dimensional single-channel image is determined to be normal.

[0096] In this process, image features are extracted from multiple location image samples to obtain multiple location image feature samples, and clustering calculations are performed based on the multiple location image feature samples to obtain a preset cluster category; wherein each location image sample is an image sample generated from normal behavior location data.

[0097] In this embodiment of the disclosure, the abnormal behavior identification result of the user to be identified is determined by comparing the positional distance between the two-dimensional single-channel image features and the cluster center of the corresponding cluster category with a preset distance threshold.

[0098] Specifically, when the location distance is greater than a preset distance threshold, the abnormal behavior recognition result of the user corresponding to the two-dimensional single-channel image is considered abnormal; when the location distance is less than or equal to the preset distance threshold, the abnormal behavior recognition result of the user corresponding to the two-dimensional single-channel image is considered normal.

[0099] In the above scheme, clustering can quickly identify the results of abnormal user behavior, further improving the efficiency and effectiveness of abnormal behavior identification.

[0100] In some embodiments, detecting a two-dimensional single-channel image to obtain an abnormal behavior identification result for the user to be identified includes: extracting image features from the two-dimensional single-channel image to obtain two-dimensional single-channel image features; inputting the two-dimensional single-channel image features into a preset classifier for processing to obtain a target category; wherein the classifier calculates based on the two-dimensional single-channel image features and a reference image feature representation to determine the target category; when the target category is a preset abnormal category, the abnormal behavior identification result for the user to be identified is abnormal behavior; when the target category is not a preset abnormal category, the abnormal behavior identification result for the user to be identified is normal behavior.

[0101] In this embodiment of the disclosure, image features can be extracted from a two-dimensional single-channel image using a preset convolutional neural network or the like to obtain two-dimensional single-channel image features. These features are then input into a preset classifier for processing to obtain a target category. Based on the target category and a preset abnormal category, the abnormal behavior identification result of the user to be identified is determined.

[0102] Specifically, when the target category is a preset abnormal category, the abnormal behavior identification result of the user to be identified is abnormal behavior; when the target category is not a preset abnormal category, the abnormal behavior identification result of the user to be identified is normal behavior.

[0103] In the above scheme, the discriminator can quickly process and identify the results of abnormal user behavior, thereby improving the efficiency and effectiveness of abnormal behavior identification.

[0104] Based on the description of the foregoing embodiments, the present disclosure transforms the problem of anomaly detection of interaction location sequences into anomaly detection of location images. That is, an interaction location sequence of a user to be identified is converted into a location image for anomaly detection. More specifically, anomaly recognition based on location encoding can sequentially represent click positions and has a better recognition effect for anomalies where the click position is fixed or the click position is periodically repeated. The following is a detailed description in conjunction with specific embodiments.

[0105] Figure 2 This is a flowchart illustrating another abnormal behavior recognition method based on location mapping provided in this embodiment of the present disclosure. This embodiment further optimizes the above-described abnormal behavior recognition method based on location mapping. Figure 2 As shown, the method includes:

[0106] Step 201: Obtain the behavioral location data of the user to be identified within the statistical period from the business logs, and obtain the total number of locations of all target interaction locations based on the behavioral location data.

[0107] Step 202: Obtain the number of interactions for each target interaction location based on the interaction information of the target interaction location.

[0108] Step 203: Sort all target interaction positions according to the number of interactions to obtain the interaction position sorting result.

[0109] Step 204: Based on the sorting results of the interaction positions, assign values ​​to the target interaction positions according to the preset encoding assignment strategy to obtain the target position encoding value of the target interaction positions.

[0110] Step 205: Obtain the preset M multiplied by N matrix corresponding to the two-dimensional single-channel image; where M and N are natural numbers greater than or equal to 1; within the statistical period, obtain M target interaction positions according to the interaction position sequence in the time dimension, use the part representing the position information in the target position encoding value as the M pixel units of the two-dimensional single-channel image, and use the part representing the interaction information in the target position encoding value of the target interaction position as the image pixel value of a pixel position to construct a row of the matrix, until the N rows of the matrix are obtained, thus obtaining the two-dimensional single-channel image corresponding to the user to be identified.

[0111] Specifically, the target interaction positions are encoded based on the interaction information to obtain the target position encoding value for each target interaction position. Then, the target interaction positions are arranged in a one-dimensional order according to the interaction time of each target interaction position to obtain a one-dimensional interaction position sequence. Finally, a two-dimensional single-channel image is constructed based on the one-dimensional interaction position sequence.

[0112] Specifically, based on the interaction time of each target interaction location, the target location encoding value of each target interaction location is constructed into a one-dimensional interaction location sequence. It should be noted that, for example, the length of the location sequence is 32 x 32; if it is less than 32, zeros can be added; if it is more than 32, it is truncated. For example, ... Figure 3 As shown, the left side displays a one-dimensional sequence of interaction locations, sorted by the interaction time of each target interaction location. For example... Figure 3 The horizontal axis (0, 1, 2, etc.) represents a target interaction position. The sequential relationship between each target interaction position in the interaction position sequence is determined based on the interaction time of each target interaction position. Figure 3 The value of the vertical axis in the graph represents the target location code value of the target interaction location.

[0113] Furthermore, the one-dimensional sequence of interaction locations is transformed into a two-dimensional one-pass image, i.e., an M-by-N matrix is ​​constructed. For example, such as... Figure 3 As shown, the matrix M multiplied by N is a 32x32 matrix, according to... Figure 3 The left side of the image contains a one-dimensional sequence of interactive positions (including multiple integer points from 0, 1, 2 to 63 representing encoded position information, and 0, 1, 2 to 63 having corresponding encoded values ​​representing interactive information). Each time, 32 target interactive positions are selected, and the part representing position information in the target position encoding corresponding to each target interactive position, i.e., the aforementioned 0, 1, 2 to 63, is used as each pixel unit in each row. The part representing interactive information in the target position encoding is used as the pixel value of each pixel, resulting in a two-dimensional single-channel image.

[0114] It should be noted that when the total number of target interaction positions is greater than the product of M and N, M multiplied by N target interaction positions are extracted from the total number of target interaction positions. When the total number is less than the product of M and N, the insufficient pixel positions to be filled in the two-dimensional single-channel image are filled with a preset value, such as 0.

[0115] Step 206: Encode the two-dimensional single-channel image based on the preset encoder to obtain a compressed image. Decode the compressed image based on the preset decoder to obtain a reconstructed image. Calculate the reconstruction error based on the two-dimensional single-channel image and the reconstructed image. When the reconstruction error is greater than the preset error threshold, the abnormal behavior identification result of the user to be identified is abnormal behavior. When the reconstruction error is less than or equal to the preset error threshold, the abnormal behavior identification result of the user to be identified is normal behavior.

[0116] Specifically, once the image is constructed, the one-dimensional sequence of interaction positions can be transformed into a two-dimensional single-channel image. By using image methods for anomaly detection or classification, abnormal behavior recognition can be achieved.

[0117] Specifically, an autoencoder (including encoder and decoder) is used to construct and reconstruct a two-dimensional single-channel image. Anomalies are identified based on the difference between the reconstructed image and the original image. More specifically, the input data can be reconstructed through compressed representation (encoding) and decompressed representation (decoding), and anomalies are detected through the reconstruction error. A convolutional neural network can be used as the encoder and decoder, and the mean squared error or binary cross-entropy can be used as the reconstruction error. By comparing the reconstruction error with a preset error threshold, the abnormal behavior of the user to be identified is identified as abnormal when the reconstruction error is higher than the preset error threshold, and as normal when the reconstruction error is less than or equal to the preset error threshold.

[0118] It should be noted that small group classifications can be identified through high-dimensional clustering methods or deep features of location images can be extracted through convolutional neural networks, followed by a classifier for classification and detection. For details, please refer to the detailed description of the aforementioned embodiments.

[0119] For example, Figure 4 This is a schematic diagram of location image comparison provided in an embodiment of the present disclosure. Figure A on the left shows a location image of a normal user, and figure B on the right shows a location image of an abnormal user. The blank areas in the figure are filled with 0s. It can be understood that a normal user's location image contains many different pixel values, resulting in a colorful and varied image. An abnormal user's image uses repeated pixel values. Specifically, one image color represents one target interaction location. It can be seen that the normal user has more target interaction locations with richer variations; the abnormal user has fewer target interaction locations with little variation.

[0120] The location-based abnormal behavior recognition scheme provided in this embodiment obtains the behavioral location data of the user to be identified within a statistical period from the business logs. Based on the behavioral location data, it obtains the total number of all target interaction locations. Based on the interaction information of each target interaction location, it obtains the interaction count for each target interaction location. All target interaction locations are sorted according to the interaction count to obtain a sorting result. Based on the sorting result, a preset encoding assignment strategy is used to assign values ​​to the target interaction locations to obtain their target location encoding values. A preset M-multiplied-N matrix corresponding to the two-dimensional single-channel image is obtained; where M and N are natural numbers greater than or equal to 1. Within the statistical period, M target interaction locations are obtained according to the interaction location sequence in the time dimension. The portion of the target location encoding value representing location information is used as M pixel units in a two-dimensional single-channel image. A matrix is ​​constructed using the portion of the target location encoding value representing interaction information as a pixel value, and this process is repeated until N rows are obtained, resulting in the two-dimensional single-channel image corresponding to the user to be identified. The two-dimensional single-channel image is encoded using a preset encoder to obtain a compressed image, and then decoded using a preset decoder to obtain a reconstructed image. The reconstruction error is calculated based on the two-dimensional single-channel image and the reconstructed image. If the reconstruction error is greater than a preset error threshold, the user's abnormal behavior is identified as abnormal; if the reconstruction error is less than or equal to the preset error threshold, the user's abnormal behavior is identified as normal. Therefore, by encoding the user's target interaction location and converting it into an interaction location sequence, this sequence is constructed onto an image. Image recognition is then used for anomaly identification. Location encoding can represent the sequential click location requirement, and image recognition improves the efficiency and effectiveness of anomaly identification.

[0121] Figure 5 This is a schematic diagram of a location-map-based abnormal behavior recognition device provided in an embodiment of this disclosure. The device can be implemented by software and / or hardware and is generally integrated into an electronic device. Figure 5 As shown, the device includes:

[0122] The acquisition module 501 is used to acquire multiple behavioral location data of the user to be identified within a statistical period from the business log; wherein, each behavioral location data includes interaction information between the user to be identified and the target interaction location of the business display page.

[0123] The encoding module 502 is used to encode the target interaction positions and obtain the target position encoding value for each target interaction position.

[0124] The sorting module 503 is used to sort the target position encoding values ​​according to the interaction time of the target interaction position to obtain the interaction position sequence.

[0125] The construction module 504 is used to construct a two-dimensional single-channel image corresponding to the user to be identified based on the target location encoding value representing the image pixel value within the statistical period, and based on the target location encoding value of each target interaction location and the interaction information.

[0126] The detection module 505 is used to compare the two-dimensional single-channel image with the preset reference image feature representation to determine the abnormal behavior recognition result of the user to be identified.

[0127] Optionally, the encoding module 502 includes: a first acquisition unit, configured to acquire the number of interactions for each target interaction location based on the interaction information of the target interaction location; a sorting unit, configured to sort all the target interaction locations according to the number of interactions to obtain an interaction location sorting result; and a first assignment unit, configured to assign a value to the target interaction location according to a preset encoding assignment strategy based on the interaction location sorting result to obtain the target location encoding value of the target interaction location.

[0128] Optionally, the first assignment unit is specifically used to obtain the maximum pixel value in the preset pixel range and the total number of all target interaction positions; determine the number of target interaction positions in each bucket based on the maximum pixel value and the total number of positions; wherein each bucket corresponds to the same pixel value; divide the target interaction positions into corresponding buckets according to the number of target interaction positions in each bucket based on the interaction position sorting result; and determine the target position encoding value corresponding to the target interaction position based on the pixel value corresponding to each bucket.

[0129] Optionally, the encoding module 502 includes: a first acquisition unit, configured to acquire the lexicographical order of the target interaction location based on the interaction information of the target interaction location; wherein the lexicographical order includes the page identifier and the region coordinate identifier of the target interaction location; and a second assignment unit, configured to determine the target location encoding value corresponding to the target interaction location sequentially according to the lexicographical order of the target interaction location and a preset pixel range value.

[0130] Optionally, the second assignment unit is specifically used to determine the interaction logic order of the target interaction position based on the lexicographical order of the target interaction position; and to assign each pixel value in the preset pixel range value to each target interaction position in sequence according to the interaction logic order, so as to obtain the target position encoding value corresponding to the target interaction position.

[0131] Optionally, the construction module 503 is specifically used to: obtain a preset M-by-N matrix corresponding to the two-dimensional single-channel image; wherein M and N are natural numbers greater than or equal to 1; within the statistical period, obtain M target interaction positions according to the interaction position sequence in the time dimension; use the part representing position information in the target position encoding value as the M pixel units of the two-dimensional single-channel image; and use the part representing interaction information in the target position encoding value of the target interaction position as the image pixel value of a pixel position to construct a row of the matrix, until the N rows of the matrix are obtained, thereby obtaining the two-dimensional single-channel image corresponding to the user to be identified.

[0132] Optionally, the device further includes: a quantity acquisition module, used to acquire the total number of target location encoding values ​​of the target interaction locations; a screenshot module, used to extract the target location encoding values ​​of the M multiplied by N target interaction locations from the total number of target location encoding values ​​according to a preset extraction strategy when the total number is greater than the product of M and N; and a filling module, used to acquire the difference between the total number and the product of M and N when the total number is less than the product of M and N, and fill the difference number of pixel positions to be filled in the two-dimensional single-channel image with a preset value.

[0133] Optionally, the detection module 505 is specifically used for: encoding the two-dimensional single-channel image based on a preset encoder to obtain a compressed image, and decoding the compressed image based on a preset decoder to obtain a reconstructed image, using the image feature representation corresponding to the reconstructed image as the reference image feature representation; wherein, the encoder encodes image features of multiple location image samples to obtain multiple compressed image samples, and the decoder decodes the compressed image samples to obtain reconstructed image samples, and adjusts the encoder and the decoder based on the reconstruction error of the reconstructed image samples and the standard image samples and a preset error threshold; wherein, each location image sample is an image sample generated from normal behavior location data; calculating the reconstruction error based on the image feature representation corresponding to the two-dimensional single-channel image and the image feature representation corresponding to the reconstructed image; when the reconstruction error is greater than the preset error threshold, the abnormal behavior identification result of the user to be identified is abnormal behavior; when the reconstruction error is less than or equal to the preset error threshold, the abnormal behavior identification result of the user to be identified is normal behavior.

[0134] Optionally, the detection module 505 is specifically used for: calculating the positional distance between the image feature representation of the two-dimensional single-channel image and the reference image feature representation of the cluster center of the preset clustering category; wherein, image features are extracted from multiple positional image samples to obtain multiple positional image feature samples, and clustering calculation is performed based on the multiple positional image feature samples to obtain the preset clustering category; wherein each positional image sample is an image sample generated from normal behavior position data; when the positional distance is greater than a preset distance threshold, the abnormal behavior identification result of the user to be identified corresponding to the two-dimensional single-channel image is obtained as abnormal behavior; when the positional distance is less than or equal to the preset distance threshold, the abnormal behavior identification result of the user to be identified corresponding to the two-dimensional single-channel image is obtained as normal behavior.

[0135] Optionally, the detection module 505 is specifically used for: determining the abnormal behavior identification result of the user to be identified by comparing the two-dimensional single-channel image with a preset reference image feature representation, including: extracting image features from the two-dimensional single-channel image to obtain two-dimensional single-channel image features; inputting the two-dimensional single-channel image features into a preset classifier for processing to obtain a target category; wherein, the classifier calculates based on the two-dimensional single-channel image features and the reference image feature representation to determine the target category; when the target category is a preset abnormal category, the abnormal behavior identification result of the user to be identified is abnormal behavior; when the target category is not a preset abnormal category, the abnormal behavior identification result of the user to be identified is normal behavior.

[0136] The location-map-based abnormal behavior recognition device provided in this disclosure can execute the location-map-based abnormal behavior recognition method provided in any embodiment of this disclosure, and has the corresponding functional modules and beneficial effects of the method execution.

[0137] This disclosure also provides a computer program product, including a computer program / instruction that, when executed by a processor, implements the location-map-based abnormal behavior recognition method provided in any embodiment of this disclosure.

[0138] Figure 6 This is a schematic diagram of an electronic device provided in an embodiment of the present disclosure. See below for details. Figure 6 The diagram illustrates a structural schematic suitable for implementing the electronic device 600 in the embodiments of this disclosure. The electronic device 600 in the embodiments of this disclosure may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 6 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0139] like Figure 6 As shown, electronic device 600 may include processing unit 601 (e.g., central processing unit, graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 602 or a program loaded from storage device 608 into random access memory (RAM) 603. RAM 603 also stores various programs and data required for the operation of electronic device 600. Processing unit 601, ROM 602, and RAM 603 are interconnected via bus 604. Input / output (I / O) interface 605 is also connected to bus 604.

[0140] Typically, the following devices can be connected to I / O interface 605: input devices 606 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 607 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 608 including, for example, magnetic tapes, hard disks, etc.; and communication devices 609. Communication device 609 allows electronic device 600 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 6 An electronic device 600 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0141] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, it performs the functions defined in the location mapping-based abnormal behavior recognition method of embodiments of this disclosure.

[0142] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0143] In some implementations, clients and servers can communicate using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol) and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future-developed networks.

[0144] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0145] The aforementioned computer-readable medium carries one or more programs. When the electronic device executes the aforementioned one or more programs, the electronic device causes the following to occur: It retrieves multiple behavioral location data of a user to be identified within a statistical period from a business log; wherein each behavioral location data includes interaction information between the user to be identified and a target interaction location on a business display page; it encodes the target interaction location based on the interaction information, obtains a target location encoding value for each target interaction location, and sorts the target location encoding values ​​according to the interaction time of the target interaction location to obtain an interaction location sequence; based on the statistical period, it maps the interaction location sequence into a two-dimensional single-channel image, mapping the portion of the target location encoding value representing location information into pixel units of the two-dimensional single-channel image; it maps the portion of the target location encoding value representing interaction information into pixel values ​​of each pixel unit; and it compares the two-dimensional single-channel image with a preset reference image feature representation to determine the abnormal behavior identification result of the user to be identified.

[0146] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including but not limited to object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0147] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0148] The units described in the embodiments of this disclosure can be implemented in software or hardware. The names of the units are not, in some cases, intended to limit the specific unit.

[0149] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0150] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0151] According to one or more embodiments of this disclosure, this disclosure provides an electronic device, including:

[0152] processor;

[0153] Memory used to store the processor's executable instructions;

[0154] The processor is configured to read the executable instructions from the memory and execute the instructions to implement the location mapping-based abnormal behavior recognition method as described in any of the present disclosure.

[0155] According to one or more embodiments of the present disclosure, the present disclosure provides a computer-readable storage medium storing a computer program for performing anomaly behavior recognition methods based on location mapping as described in any of the present disclosure.

[0156] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0157] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. In certain environments, multitasking and parallel processing may be advantageous. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0158] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative examples of implementing the claims.

Claims

1. A method for identifying abnormal behavior based on location mapping, characterized in that, include: Obtain multiple behavioral location data of the user to be identified within the statistical period from the business logs; wherein, each behavioral location data includes interaction information between the user to be identified and the target interaction location of the business display page; The target interaction location is encoded based on the interaction information to obtain the target location encoding value for each target interaction location. The target location encoding values ​​are then sorted according to the interaction time of the target interaction location to obtain the interaction location sequence. Based on the statistical period, the interaction position sequence is mapped into a two-dimensional single-channel image. The part of the target position encoding value that represents position information is mapped into the pixel unit of the two-dimensional single-channel image. The part of the target position encoding value that represents interaction information is mapped into the pixel value of each pixel unit. The abnormal behavior identification result of the user to be identified is determined by comparing the two-dimensional single-channel image with the preset reference image feature representation.

2. The method according to claim 1, characterized in that, The step of encoding the target interaction location based on the interaction information to obtain the target location encoding value of the target interaction location includes: The number of interactions at each target interaction location is obtained based on the interaction information of the target interaction location. Sort all the target interaction positions according to the number of interactions to obtain the interaction position sorting result; Based on the sorting result of the interaction position, the target interaction position is assigned a value according to a preset encoding assignment strategy to obtain the target position encoding value of the target interaction position.

3. The method according to claim 2, characterized in that, The step of assigning a value to the target interaction position based on the sorting result of the interaction position according to a preset encoding assignment strategy, and obtaining the target position encoding value of the target interaction position, includes: Obtain the maximum pixel value within a preset pixel range and the total number of positions for all the target interaction locations; The number of target interaction locations for each bucket is determined based on the maximum pixel value and the total number of locations; wherein, each bucket corresponds to the same pixel value; Based on the sorting result of the interaction position, the corresponding number of target interaction positions are divided into corresponding buckets according to the target interaction position quota of each bucket, and the target position encoding value corresponding to the target interaction position is determined based on the pixel value corresponding to each bucket.

4. The method according to claim 1, characterized in that, The step of encoding the target interaction location based on the interaction information to obtain the target location encoding value of the target interaction location includes: The lexicographical order of the target interaction location is obtained based on the interaction information of the target interaction location; wherein, the lexicographical order includes the page identifier and the region coordinate identifier of the target interaction location; The target position encoding value corresponding to the target interaction position is determined sequentially according to the lexicographical order of the target interaction position and the preset pixel range value.

5. The method according to claim 4, characterized in that, The step of determining the target location encoding value corresponding to the target interaction location according to the lexicographical order of the target interaction location and the preset pixel range value includes: The interaction logic order of the target interaction location is determined based on the lexicographical order of the target interaction location; Each pixel value in the preset pixel range is assigned to each target interaction position in the order of the interaction logic to obtain the target position encoding value corresponding to the target interaction position.

6. The method according to claim 1, characterized in that, Based on the statistical period, the interaction position sequence is mapped into a two-dimensional single-channel image, and the part of the target position encoding value that represents the position information is mapped into the pixel unit of the two-dimensional single-channel image. Mapping the portion of the target location encoded value that represents interaction information to the pixel value of each pixel unit includes: Obtain the preset M-multiplied-N matrix corresponding to the two-dimensional single-channel image; where M and N are natural numbers greater than or equal to 1; Within the statistical period, M target interaction locations are obtained according to the interaction location sequence in the time dimension. The part representing the location information in the target location encoding value is used as M pixel units of the two-dimensional single-channel image. The part representing the interaction information in the target location encoding value of the target interaction location is used as the image pixel value of a pixel position to construct a row of a matrix until N rows of the matrix are obtained, thus obtaining the two-dimensional single-channel image corresponding to the user to be identified.

7. The method according to claim 6, characterized in that, The method further comprises: Obtain the total number of target location encoding values ​​for the target interaction location; When the total number is greater than M multiplied by N, the target location encoding values ​​of the M multiplied by N target interaction locations are extracted from the target location encoding values ​​of the total number of target interaction locations according to a preset extraction strategy. When the total number is less than the product of M and N, the difference between the total number and M and N is obtained, and a preset value is filled into the difference number of pixel positions to be filled in the two-dimensional single-channel image.

8. The method according to claim 1, characterized in that, The step of comparing the two-dimensional single-channel image with the preset reference image feature representation to determine the abnormal behavior identification result of the user to be identified includes: The two-dimensional single-channel image is encoded based on a preset encoder to obtain a compressed image, and the compressed image is decoded based on a preset decoder to obtain a reconstructed image. The image feature representation corresponding to the reconstructed image is used as the reference image feature representation. The encoder encodes image features from multiple location image samples to obtain multiple compressed image samples, and the decoder decodes the compressed image samples to obtain reconstructed image samples. The encoder and the decoder are adjusted based on the reconstruction error between the reconstructed image samples and the standard image samples and a preset error threshold. Each location image sample is an image sample generated from normal behavior location data. The reconstruction error is calculated based on the image feature representation corresponding to the two-dimensional single-channel image and the image feature representation corresponding to the reconstructed image. When the reconstruction error is greater than the preset error threshold, the abnormal behavior identification result of the user to be identified is considered abnormal behavior; When the reconstruction error is less than or equal to the preset error threshold, the abnormal behavior identification result of the user to be identified is normal behavior.

9. The method according to claim 1, characterized in that, The step of comparing the two-dimensional single-channel image with the preset reference image feature representation to determine the abnormal behavior identification result of the user to be identified includes: Calculate the positional distance between the image feature representation of the two-dimensional single-channel image and the reference image feature representation of the cluster center of the preset cluster category; wherein, image features are extracted from multiple location image samples to obtain multiple location image feature samples, and clustering calculation is performed based on the multiple location image feature samples to obtain the preset cluster category; wherein, each location image sample is an image sample generated from normal behavior location data; When the location distance is greater than a preset distance threshold, the abnormal behavior recognition result of the user to be identified corresponding to the two-dimensional single-channel image is considered as abnormal behavior; When the location distance is less than or equal to the preset distance threshold, the abnormal behavior identification result of the user to be identified corresponding to the two-dimensional single-channel image is obtained as normal behavior.

10. The method according to claim 1, characterized in that, The step of comparing the two-dimensional single-channel image with the preset reference image feature representation to determine the abnormal behavior identification result of the user to be identified includes: Image feature extraction is performed on the two-dimensional single-channel image to obtain the two-dimensional single-channel image features; The two-dimensional single-channel image features are input into a preset classifier for processing to obtain the target category; wherein, the classifier calculates based on the two-dimensional single-channel image features and the reference image feature representation to determine the target category; When the target category is a preset abnormal category, the abnormal behavior identification result of the user to be identified is abnormal behavior; When the target category is not a preset abnormal category, the abnormal behavior identification result of the user to be identified is normal behavior.

11. An abnormal behavior recognition device based on location mapping, characterized in that, include: The acquisition module is used to acquire multiple behavioral location data of the user to be identified within a statistical period from the business logs; wherein, each behavioral location data includes interaction information between the user to be identified and the target interaction location of the business display page; The encoding module is used to encode the target interaction location based on the interaction information to obtain the target location encoding value for each target interaction location; The sorting module is used to sort the encoding values ​​of each target interaction location according to the interaction time of the target interaction location to obtain an interaction location sequence; The construction module is used to characterize the image pixel value with the target location encoding value within the statistical period, and to construct a two-dimensional single-channel image corresponding to the user to be identified based on the target location encoding value of each target interaction location and the interaction information. The detection module is used to compare the two-dimensional single-channel image with the preset reference image feature representation to determine the abnormal behavior recognition result of the user to be identified.

12. An electronic device, characterized in that, The electronic device includes: processor; Memory used to store the processor's executable instructions; The processor is configured to read the executable instructions from the memory and execute the instructions to implement the location-based abnormal behavior recognition method according to any one of claims 1-10.

13. A computer-readable storage medium, characterized in that, The storage medium stores a computer program for executing the location-based abnormal behavior recognition method according to any one of claims 1-10.

Images