Abnormal information sending method and device, electronic equipment and computer readable medium

Abstract

Embodiments of the present disclosure disclose an abnormal information sending method and device, electronic equipment and computer readable medium. A specific embodiment of the method comprises: in response to receiving an abnormal information request sent by a target user terminal, obtaining a historical contact information change vector corresponding to a target user from a target user database; generating contact information change reason request information; sending the contact information change reason request information to a communication record terminal; obtaining terminal behaviors performed by the target user in each historical sub-time period in a target historical sub-time period set in the target information processing terminal to obtain a terminal behavior set; generating abnormal information for the target user according to the change reason set and the terminal behavior set; and sending the abnormal information to an abnormal information review terminal. The embodiment accurately and efficiently generates abnormal information corresponding to the target user on the basis of information interaction between terminals according to the historical contact information change vector.

Description

Technical Field

[0001] The embodiments disclosed herein relate to the field of computer technology, and more specifically to methods, apparatus, electronic devices, and computer-readable media for transmitting abnormal information. Background Technology

[0002] Currently, with the development of the communication era, communication is becoming increasingly convenient. Changes in communication contact methods often indicate abnormal situations for the user (e.g., loss of communication terminal). Therefore, changes in communication contact methods have become an important indicator for monitoring whether users are experiencing any anomalies. The common method for monitoring user anomalies is to have relevant technical personnel manually analyze changes in contact methods to obtain abnormal information under those circumstances.

[0003] However, when using the above method, the following technical problems often arise: Human analysis methods are too inaccurate and the results often lack factual basis. Furthermore, accuracy and efficiency cannot be effectively guaranteed when contact information changes frequently.

[0004] The information disclosed in this background section is only intended to enhance the understanding of the background of the inventive concept, and therefore may contain information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] The summary portion of this disclosure is intended to provide a brief overview of the concepts, which will be described in detail in the detailed description portion. This summary portion is not intended to identify key or essential features of the claimed technical solutions, nor is it intended to limit the scope of the claimed technical solutions.

[0006] Some embodiments of this disclosure provide methods, apparatus, electronic devices, and computer-readable media for sending abnormal information to solve one or more of the technical problems mentioned in the background section above.

[0007] In a first aspect, some embodiments of this disclosure provide an abnormal information sending method, comprising: responding to receiving an abnormal information request sent by a target user terminal, obtaining a historical contact information change vector corresponding to the target user from a target user database, wherein the historical contact information change vector represents the contact information change of the target user within a target historical time period, the target historical time period including: multiple historical sub-time periods, each historical sub-time period having a corresponding vector element in the historical contact information change vector, the vector element representing the contact information update within the corresponding historical sub-time period; generating contact information change reason request information for the historical contact information change vector; sending the contact information change reason request information to a communication record terminal to obtain a change reason set corresponding to the historical contact information change vector; obtaining the terminal behavior executed by the target user in the target information processing terminal within each historical sub-time period in the target historical sub-time period set from a behavior record database corresponding to the target information processing terminal, obtaining a terminal behavior set, wherein the vector element corresponding to the target historical sub-time period is a target value; generating abnormal information for the target user based on the change reason set and the terminal behavior set; and sending the abnormal information to an abnormal information review terminal in a target encryption manner.

[0008] Secondly, some embodiments of this disclosure provide an abnormal information sending device, including: a first acquisition unit configured to, in response to receiving an abnormal information request sent by a target user terminal, acquire a historical contact information change vector corresponding to the target user from a target user database, wherein the historical contact information change vector represents the contact information change situation of the target user within a target historical time period, the target historical time period including: multiple historical sub-time periods, each historical sub-time period having a corresponding vector element in the historical contact information change vector, the vector element representing the contact information update situation within the corresponding historical sub-time period; and a first generation unit configured to generate contact information change reason request information for the historical contact information change vector. The first sending unit is configured to send the aforementioned contact information change reason request information to the communication record terminal to obtain the change reason set corresponding to the historical contact information change vector; the second obtaining unit is configured to obtain the terminal behavior performed by the target user in the target information processing terminal within each historical sub-time period in the target historical sub-time period set from the behavior record database corresponding to the target information processing terminal, to obtain the terminal behavior set, wherein the vector element corresponding to the target historical sub-time period is the target value; the second generating unit is configured to generate abnormal information for the aforementioned target user based on the aforementioned change reason set and the aforementioned terminal behavior set; the second sending unit is configured to send the aforementioned abnormal information to the abnormal information review terminal in a target encrypted manner.

[0009] Thirdly, some embodiments of this disclosure provide an electronic device, including: one or more processors; and a storage device having one or more programs stored thereon, such that when the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any implementation of the first aspect.

[0010] Fourthly, some embodiments of this disclosure provide a computer-readable medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the method as described in any implementation of the first aspect.

[0011] The above embodiments of this disclosure have the following beneficial effects: Through the abnormal information sending method of some embodiments of this disclosure, based on the information interaction between various terminals, and according to the historical contact information change vector, the abnormal information corresponding to the target user can be generated accurately and efficiently. Specifically, the reason why the determination of abnormalities related to contact information is not accurate and efficient is that the accuracy of manual analysis is too low and the analysis results often lack factual basis. Furthermore, for cases of frequent contact information changes, accuracy and efficiency cannot be effectively guaranteed. Based on this, the abnormal information sending method of some embodiments of this disclosure firstly, in response to receiving an abnormal information request sent by the target user terminal, retrieves the historical contact information change vector corresponding to the target user from the target user database. The historical contact information change vector represents the contact information change situation of the target user within a target historical time period. The target historical time period includes multiple historical sub-time periods, each historical sub-time period having a corresponding vector element in the historical contact information change vector, and the vector element representing the contact information update situation within the corresponding historical sub-time period. Here, the target user's contact information changes are represented by historical contact information change vectors within the target historical time period. This not only makes the changes more significant but also helps identify the characteristics of the contact information changes, thus accurately determining the reasons for the changes. Then, based on the significant change characteristics reflected in the change vectors, a contact information change reason request information can be accurately generated for the aforementioned historical contact information change vectors. Next, this contact information change reason request information is sent to the communication record terminal to obtain the change reason set corresponding to the historical contact information change vectors. Then, the terminal behaviors performed by the target user on the target information processing terminal within each historical sub-time period in the target historical sub-time period set are retrieved from the target information processing terminal's corresponding behavior record database, resulting in a terminal behavior set, where the vector elements corresponding to the target historical sub-time periods are the target values. Here, by determining the corresponding terminal behaviors during the time period when the user changed contact information, the true intention of the user to change contact information can be determined from a behavioral perspective, facilitating the accurate generation of anomaly information subsequently. Furthermore, based on the aforementioned change reason set and terminal behavior set, anomaly information can be determined from multiple perspectives to accurately generate anomaly information for the aforementioned target user. Finally, the aforementioned abnormal information is sent to the abnormal information review terminal using the target encryption method. In summary, the vector representation can fully and significantly demonstrate the change characteristics of the target user within the target historical time period. Based on this, behavioral content and registration reasons during the change period are obtained through multi-terminal interaction. Therefore, abnormal information corresponding to the target user can be generated accurately and efficiently. Attached Figure Description

[0012] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and elements are not necessarily drawn to scale.

[0013] Figure 1 This is a flowchart of some embodiments of the abnormal information sending method according to this disclosure; Figure 2 This is a schematic diagram of the structure of some embodiments of the abnormal information sending device according to the present disclosure; Figure 3 This is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present disclosure. Detailed Implementation

[0014] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0015] It should also be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings. Unless otherwise specified, the embodiments and features described in this disclosure can be combined with each other.

[0016] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0017] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0018] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0019] This disclosure will now be described in detail with reference to the accompanying drawings and embodiments.

[0020] refer to Figure 1 The diagram illustrates a flow 100 of some embodiments of an exception information sending method according to the present disclosure. This exception information sending method includes the following steps: Step 101: In response to receiving an exception information request sent by the target user terminal, retrieve the historical contact information change vector corresponding to the target user from the target user database.

[0021] In some embodiments, in response to receiving an anomaly information request sent by a target user terminal, the executing entity of the above-mentioned anomaly information sending method (e.g., an anomaly information detection terminal) can obtain the historical contact information change vector corresponding to the target user from the target user database via a wired connection or a wireless connection. The target user terminal can be the user's corresponding terminal. For example, the target user terminal can be a mobile terminal worn by the target user. The anomaly information request can be a request to obtain anomaly information corresponding to the target user. The anomaly information can be information representing an abnormal user status. For example, in the credit reporting field, the corresponding anomaly information can be the user's risk information or credit anomaly information. For another example, in a ride-hailing scenario, the corresponding anomaly information can be the user's abnormal ride-hailing status. The target user database can be a user dataset storing various user characteristics. For example, the user dataset stored in the target user database can be one of the following: the user's historical contact information change vector, the user's personal information, or the user's anomaly records. The historical contact information change vector can be a vector representing the target user's contact information changes within a target historical time period. The target historical time period can be one month prior to the current request time. The historical contact information change vector represents the target user's contact information changes within the target historical time period. The aforementioned target historical time period includes multiple historical sub-time periods. Each historical sub-time period has a corresponding vector element in the aforementioned historical contact information change vector. The vector element represents the contact information update status within the corresponding historical sub-time period. The time length corresponding to each historical sub-time period can be preset. The vector element can be one of the following: 0, 1. For example, the target historical time period can be the past year between the request time. Each historical sub-time period corresponds to a month within the past year. When the vector element is 0, it indicates that the target user did not change their contact information within the corresponding month. When the vector element is 1, it indicates that the target user did change their contact information within the corresponding month. The anomaly detection terminal can be a terminal that performs anomaly detection. The anomaly detection terminal can be an electronic device of a certain type.

[0022] For example, targeting user A, the current exception information request corresponds to a request time in January 2025. The corresponding historical contact information change vector could be [0,1,0,0,0,0,1,0,0,0,1,0]. This corresponds to user A changing their contact information in February 2024, July 2024, and November 2024.

[0023] Step 102: Generate a request for the reason for changing the contact information for the above-mentioned historical contact information change vector.

[0024] In some embodiments, the executing entity may generate a contact information change reason request information for the aforementioned historical contact information change vector. This contact information change reason request information may be a request to determine the reason for the contact information change.

[0025] As an example, firstly, the aforementioned execution entity can determine the time period corresponding to the historical contact information change vector. Then, it generates a request content representing the reason why the target user changed their contact information within the query time period, thereby obtaining the contact information change reason request information.

[0026] In some optional implementations of certain embodiments, the aforementioned execution entity may generate contact information change reason request information for the aforementioned historical contact information change vector, including the following steps: The first step is to filter out the vector elements from the historical contact information change vectors that correspond to the target value, thus obtaining a set of vector elements. For example, the target value could be the value "1".

[0027] The second step is to determine the historical sub-time period set corresponding to the vector element set as the target historical sub-time period set in response to the determination that the vector element set is not empty.

[0028] The third step is to generate a request for the reason for changing contact information for the target user and the target historical time period set.

[0029] Step 103: Send the above-mentioned contact information change reason request information to the communication record terminal to obtain the change reason set corresponding to the historical contact information change vector.

[0030] In some embodiments, the executing entity may send the contact information change reason request information to a communication record terminal to obtain the set of change reasons corresponding to the historical contact information change vector. The communication record terminal may store various communication record data related to the communication contacts corresponding to the target user. In practice, the communication record data includes: the reason for the target user's contact information change. The reason for the change may be the reason why the target user changed their contact information.

[0031] In some optional implementations of certain embodiments, the set of replacement reasons is obtained through the following steps: The first step is to obtain the communication records corresponding to the target user, which will be used as the target communication records. These communication records may include: call logs of the target user and the reason for the target user's change of address.

[0032] The second step is to obtain the set of historical replacement reasons corresponding to the target historical sub-time period set from the target communication records, and use it as the set of replacement reasons.

[0033] The third step is to send the set of reasons for the replacement to the anomaly detection terminal.

[0034] Step 104: Obtain the terminal behaviors performed by the target user on the target information processing terminal within each historical sub-time period in the target historical sub-time period set from the target information processing terminal corresponding behavior record database, and obtain the terminal behavior set.

[0035] In some embodiments, the aforementioned executing entity can obtain the terminal behaviors performed by the target user on the target information processing terminal within each historical sub-time period in the target historical sub-time period set from the behavior record database corresponding to the target information processing terminal, thus obtaining a terminal behavior set. The target information processing terminal can be a terminal that performs information processing. In practice, for the credit reporting field, information processing can be related value information processing (e.g., credit inquiry processing, loan processing, loan repayment processing). The target information processing terminal can be an information processing terminal that supports various value-related operations. For example, for a credit reporting scenario, value-related operations can be one of the following: loan processing operation, loan repayment operation, credit inquiry operation. The vector elements corresponding to the target historical sub-time period are target values. The target value can be a value representing a change in contact information within the corresponding target historical sub-time period. For example, the target value can be the value "1". Terminal behaviors can be the behaviors of the target user performing various operations on the target information processing terminal. For example, for the credit reporting field, the corresponding terminal behaviors can be one of the following: loan behavior, balance inquiry behavior, online consultation behavior, user information modification behavior.

[0036] Step 105: Generate abnormal information for the target user based on the above set of reasons for replacement and the above set of terminal behaviors.

[0037] In some embodiments, the aforementioned executing entity can generate abnormal information for the aforementioned target user in various ways based on the aforementioned set of reasons for change and the aforementioned set of terminal behaviors. The abnormal information can be information characterizing an abnormal state of the target user. In practice, the abnormal information can be in numerical form or in tagged form. For example, in a credit reporting scenario, the corresponding abnormal information could be risk control detection information.

[0038] In some optional implementations of certain embodiments, the execution entity may generate abnormal information for the target user based on the set of reasons for change and the set of terminal behaviors, including the following steps: The first step is to combine the replacement reasons from the aforementioned set of replacement reasons with the terminal behaviors from the aforementioned set of terminal behaviors according to their time correspondence to generate combined information, thus obtaining a combined information set. This combined information set includes: replacement reasons and terminal behaviors. The two pieces of information within the combined information set have the same generation time.

[0039] The second step involves inputting each piece of information from the aforementioned combined information set into the first feature information generation layer of a pre-trained anomaly information generation model to generate combined feature information, thus obtaining a combined feature information set. The anomaly information generation model can be a neural network model that generates anomaly information. This model is a composite model composed of multiple network layers. The first feature information generation layer can be a network layer that extracts the semantic content of the features corresponding to each piece of information. The combined feature information can represent: the causal feature information corresponding to the replacement reason, the behavioral feature information corresponding to the terminal behavior, and the fusion feature information between the replacement reason and the terminal behavior. The fusion feature information can represent the correlation between the replacement reason and the terminal behavior. Specifically, the first feature information generation layer can be an extraction layer in a TextCNN model. Specifically, the TextCNN model can include: a word embedding layer and multiple cascaded convolutional layers (e.g., 11 cascaded convolutional layers).

[0040] The third step involves inputting the aforementioned combined feature information set into the behavioral continuous feature information extraction layer included in the above-mentioned anomaly information generation model to generate combined continuous feature information. This behavioral continuous feature information extraction layer can extract sequence feature information corresponding to subsequences of combined feature information that exhibit continuous temporal relationships within the combined feature information set. This combined continuous feature information is composed of concatenated sequence feature information from multiple consecutive time periods. The reason for the continuous temporal relationships is due to the presence of multiple consecutive vector elements with target values ​​in the historical contact information change vector. The purpose of extracting combined continuous feature information is to subsequently focus on anomalies related to contact information changes occurring within consecutive time periods, as the probability of such changes being anomalies is higher. In practice, the behavioral continuous feature information extraction layer can be a first downsampling layer based on a convolutional layer.

[0041] As an example, firstly, at least one subsequence of combined feature information that exhibits a continuous temporal relationship is identified within the combined feature information set. Then, for each subsequence, it is input into the behavioral continuous feature information extraction layer to obtain sequence feature information. Finally, the obtained at least one sequence feature information is combined to obtain combined continuous feature information.

[0042] The fourth step involves inputting each replacement reason from the aforementioned set of replacement reasons into the second feature information generation layer of the aforementioned anomaly information generation model to generate cause feature information, thus obtaining a set of cause feature information. The second feature information generation layer can be a network layer that extracts the cause feature information corresponding to the replacement reason. In practice, the second feature information generation layer can be multiple concatenated convolutional layers. The cause feature information can be a vector representing the semantic feature content of the cause corresponding to the replacement reason.

[0043] The fifth step involves inputting the aforementioned set of reasons for contact changes into the continuous cause feature extraction layer included in the above-mentioned anomaly information generation model to generate continuous cause feature information. This continuous cause feature extraction layer can extract cause sequence feature information corresponding to subsequences of combined feature information that exhibit continuous temporal relationships within the combined feature information set. This continuous cause feature information is composed of concatenated sequence feature information from multiple consecutive time periods. The cause of the continuous temporal relationship is due to the existence of multiple consecutive vector elements in the historical contact information change vector that have the target value. The purpose of extracting continuous cause feature information here is to subsequently focus on anomalies related to contact information changes occurring within consecutive time periods, as the probability of such changes being anomalies is higher. In practice, the continuous cause feature information extraction layer can be a second downsampling layer based on a convolutional layer.

[0044] The sixth step is to retrieve the behavior vector corresponding to each terminal behavior in the aforementioned terminal behavior set from the behavior vector database, thus obtaining a behavior vector set. The behavior vector database can be a database storing behavior vectors corresponding to various behaviors. These various behaviors can be behaviors involving changing contact methods. Behavior vectors can represent the semantic content of the behavior. In practice, behavior encoding can be implemented using an encoding model to obtain behavior vectors.

[0045] The seventh step is to input the above-mentioned behavior vector set into the continuous behavior feature extraction layer included in the above-mentioned anomaly information generation model to generate continuous behavior feature information.

[0046] Step 8: Input the aforementioned combined continuous feature information, the aforementioned causal continuous feature information, and the aforementioned behavioral continuous feature information into the first gated fusion network layer of the aforementioned anomaly information generation model to output continuous feature information. The first gated fusion network layer can be based on an attention mechanism to learn the importance weights corresponding to the combined continuous feature information, the aforementioned causal continuous feature information, and the aforementioned behavioral continuous feature information, so as to achieve continuous feature fusion. The continuous feature information obtained here is feature information related to the features corresponding to the continuous connection replacement mode, generated from diverse feature sources of multiple modalities.

[0047] The ninth step involves inputting the aforementioned combined feature information set, causal feature information set, and behavioral vector set into the second gated fusion network layer of the anomaly information generation model to output basic feature information. This second gated fusion network layer can be based on an attention mechanism to learn the importance weights corresponding to the combined feature information set, causal feature information set, and behavioral vector set, thereby achieving basic feature fusion. The basic feature information obtained here is feature information generated from diverse multimodal feature sources and associated with the basic features corresponding to the connection replacement method.

[0048] Step 10: Combine the basic feature information and the continuous feature information mentioned above to generate combined feature information.

[0049] Step 11: Based on the aforementioned splicing feature information, generate the aforementioned anomaly information using the anomaly information output layer included in the anomaly information generation model. In practice, the anomaly information output layer can be a fully connected layer.

[0050] As an example, the aforementioned execution entity can directly input the spliced ​​feature information into the aforementioned abnormal information output layer to obtain abnormal information.

[0051] In some optional implementations of certain embodiments, the execution entity can generate the aforementioned abnormal information based on the aforementioned splicing feature information and utilizing the initial abnormal information output layer included in the aforementioned abnormal information generation model, including the following steps: The first step is to obtain the abnormal feature information corresponding to each predetermined abnormal category in the predetermined abnormal category group, thus obtaining an abnormal feature information group. The predetermined abnormal category can represent the category of reasons for the abnormal change of contact information. For example, the predetermined abnormal category could be a network fraud abnormal category or an online sales abnormal category. The abnormal feature information can be in vector form, representing the semantic content of the category features corresponding to the predetermined abnormal category. In practice, the vector encoding of the predetermined abnormal categories can be implemented through an encoding model to obtain the abnormal feature information.

[0052] The second step involves inputting the aforementioned abnormal feature information group and the aforementioned spliced ​​feature information into the first abnormal information generation layer included in the aforementioned abnormal information output layer to obtain the first initial abnormal information. Here, by setting the first abnormal information generation layer, the similarity between the spliced ​​feature information and the abnormal feature information in the abnormal feature information group can be fully understood, so that the first abnormal information generation layer can accurately output abnormal information when it understands the abnormal features.

[0053] The third step involves inputting the aforementioned concatenated feature information into the second initial anomaly information generation layer, which is included in the anomaly information output layer, to obtain the second initial anomaly information. The second anomaly information generation layer can be the same network layer as the first anomaly information generation layer. Their output purposes differ; for example, both can be based on convolutional layers and fully connected network layers.

[0054] The fourth step is to generate the aforementioned anomaly information based on the first initial anomaly information and the second initial anomaly information.

[0055] As an example, in response to determining that both the first initial anomaly information and the second initial anomaly information indicate the existence of an anomaly, anomaly information indicating the existence of an anomaly is generated. In response to determining that the first initial anomaly information and the second initial anomaly information are contradictory, the anomaly cases corresponding to the first initial anomaly information and the anomaly cases corresponding to the second initial anomaly information are sent to the review end for confirmation of the anomaly information.

[0056] In some optional implementations of certain embodiments, the above-described anomaly information generation model is trained through the following steps: The first step, in response to determining the model training time corresponding to the initial anomaly information generation model, is to determine the estimated computational cost of the aforementioned initial anomaly information generation model. The model training time can be the time the model spends training. In practice, the initial anomaly information generation model can be trained periodically, with the corresponding training time being the periodic time. The estimated computational cost can be determined based on the model parameters of the initial anomaly information generation model.

[0057] The second step, in response to the determination that the estimated computational cost of the above-mentioned model is greater than the target computational cost, generates a representation of the method used to train the above-mentioned initial anomaly information generation model as the target training method. The target computational cost can be a pre-set computational cost used to distinguish the training methods. The target computational cost can be set based on experience.

[0058] The third step is to determine the training method corresponding to the above-mentioned initial abnormal information generation model as the above-mentioned target training method, and to determine the available graphics processor nodes in the graphics processor cluster under the above-mentioned model training time, so as to obtain at least one available graphics processor node.

[0059] Fourth, in response to determining that the number of nodes corresponding to at least one available graphics processor node is greater than or equal to a target value, the initial anomaly information generation model is decomposed to obtain an initial decomposed model set. The set of graphics processor nodes corresponding to the initial decomposed model set is a subset of the at least one available graphics processor node. The target value may be the number of models in the initial decomposed model set. Each initial decomposed model has a unique corresponding graphics processor node.

[0060] The fifth step is to obtain the training dataset corresponding to the above-mentioned abnormal information generation model.

[0061] Step 6: Randomly select the target number of training data points from the above training dataset and perform the following training steps: Sub-step 1 involves sending the target number of training data points to the first available graphics processor node and controlling the first available graphics processor node to perform the following first generation step.

[0062] The first sub-step involves inputting the target number of training data points into the first initial feature information generation layer of the pre-deployed initial decomposition model set to generate the target number of first initial feature information points. The first initial feature information generation layer may be a first feature information generation layer that has not yet finished training. The generation steps corresponding to the first initial feature information can be performed on the first available image processor node.

[0063] The second sub-step involves concatenating the aforementioned target number of first initial feature information to generate first initial concatenated feature information.

[0064] The third sub-step involves sending the aforementioned first initial splicing feature information and the aforementioned target number to the aforementioned sixth available graphics processor node.

[0065] Sub-step 2 involves sending the target number of training data points to the second available graphics processor node, and controlling the second available graphics processor node to perform the following second generation step: The first sub-step involves inputting the target number of training data points into the initial continuous feature extraction layer of the pre-deployed initial decomposition model set to generate the target number of initial continuous feature information points. The initial continuous feature extraction layer can be a continuous feature extraction layer that has not yet finished training. The generation step corresponding to the initial continuous feature information can be performed on the second available image processor node.

[0066] The second sub-step involves concatenating the aforementioned target number of initial continuous feature information to generate second initial concatenated feature information.

[0067] The third sub-step involves sending the aforementioned second initial splicing feature information and the aforementioned target number to the aforementioned sixth available graphics processor node.

[0068] Sub-step 3 involves sending the target number of training data points to the third available graphics processor node, and controlling the third available graphics processor node to perform the following third generation step: The first sub-step involves inputting the target number of training data points into the second initial feature information generation layer of the pre-deployed initial decomposition model set mentioned above, to generate the target number of second initial feature information points. This second initial feature information generation layer may be a second feature information generation layer that has not yet finished training. The generation steps corresponding to the second initial feature information can be performed on the third available image processor node.

[0069] The second sub-step involves concatenating the aforementioned target number of second initial feature information to generate third initial concatenated feature information.

[0070] The third sub-step involves sending the aforementioned third initial splicing feature information and the aforementioned target number to the aforementioned sixth available graphics processor node.

[0071] Sub-step 4 involves sending the target number of training data points to the fourth available graphics processor node, and controlling the fourth available graphics processor node to perform the following fourth generation step: The first sub-step involves inputting the target number of training data points into the initial continuous cause feature extraction layer of the pre-deployed initial decomposition model set to generate the target number of initial continuous cause feature information points. The initial continuous cause feature extraction layer can be a continuous cause feature extraction layer using an untrained technique. The generation step corresponding to the initial continuous cause feature information can be performed on the fourth available image processor node.

[0072] The second sub-step involves concatenating the aforementioned target number of initial continuous cause feature information to generate the fourth initial concatenated feature information.

[0073] The third sub-step involves sending the aforementioned initial splicing feature information and the aforementioned target number to the aforementioned sixth available graphics processor node.

[0074] Sub-step 5 involves sending the target number of training data points to the fifth available graphics processor node, and controlling the fifth available graphics processor node to perform the following fifth generation step: The first sub-step involves inputting the target number of training data points into the initial continuous behavior feature extraction layer of the pre-deployed initial decomposition model set to generate the target number of initial continuous behavior feature information points. The initial continuous behavior feature extraction layer can be a continuous behavior feature extraction layer that has not yet finished training. The generation step corresponding to the initial continuous behavior feature information can be performed on the fifth available image processor node.

[0075] The second sub-step involves concatenating the aforementioned target number of initial continuous behavioral feature information to generate the fifth initial concatenated feature information.

[0076] The third sub-step involves sending the aforementioned fifth initial splicing feature information and the aforementioned target number to the aforementioned sixth available graphics processor node.

[0077] In some optional implementations of certain embodiments, the above training steps further include: The first step is to control the sixth available graphics processor node and perform the following sixth generation step: Sub-step 1 involves acquiring the first initial stitching feature information sent by the first available GPU node, the second initial stitching feature information sent by the second available GPU node, the third initial stitching feature information sent by the third available GPU node, the fourth initial stitching feature information sent by the fourth available GPU node, the fifth initial stitching feature information sent by the fifth available GPU node, and the target number. Here, the sixth available GPU node corresponds to supporting the reception of feature information from each available GPU node, as well as the execution of the first initial gated fusion network layer. The first initial gated fusion network layer is the first gated fusion network layer that has not yet finished training.

[0078] Sub-step 2 involves inputting the second initial splicing feature information, the fourth initial splicing feature information, and the fifth initial splicing feature information, along with the aforementioned target number, into the first initial gating fusion network layer of the pre-deployed initial disassembly model set to output initial continuous feature information.

[0079] Sub-step 3: Send the initial continuous feature information and the number of targets mentioned above to the eighth available graphics processor node.

[0080] The second step involves controlling the seventh available graphics processor node to perform the following seventh generation step: Sub-step 1 involves inputting the first initial splicing feature information, the third initial splicing feature information, and the corresponding target number of behavior vector sets into the second initial gated fusion network layer of the pre-deployed initial decomposition model set mentioned above, to output the initial basic feature information. The second initial gated fusion network layer is the second gated fusion network layer that has not yet finished training.

[0081] Sub-step 2: Send the initial basic feature information and the number of targets mentioned above to the eighth available graphics processor node.

[0082] Third, control the eighth available graphics processor node mentioned above to perform the following eighth generation step: Sub-step 1 involves concatenating the received initial continuous feature information, initial basic feature information, and the number of targets mentioned above to generate initial concatenated feature information. Sub-step 2 involves inputting the aforementioned initial splicing feature information into the initial anomaly information output layer of the pre-deployed initial decomposition model set, generating the target number of initial anomaly information items. The initial anomaly information output layer can be an anomaly information output layer that has not yet finished training.

[0083] Sub-step 3: Generate the target number of loss information for the aforementioned target number of initial anomaly information.

[0084] Sub-step 4 involves averaging the target number of loss information entries to generate average loss information.

[0085] Sub-step 5: In response to determining that the loss information sequence corresponding to the average loss information tends to the target value, the model parameters corresponding to the first initial feature information generation layer, the model parameters corresponding to the initial continuous feature information extraction layer, the model parameters corresponding to the second initial feature information generation layer, the model parameters corresponding to the initial continuous cause feature extraction layer, the model parameters corresponding to the initial continuous behavior feature extraction layer, the model parameters corresponding to the first initial gated fusion network layer, and the model parameters corresponding to the second initial gated fusion network layer are received.

[0086] Sub-step 6: Generate an anomaly information generation model based on the received model parameters.

[0087] Fourth step: In response to the determination that the loss information sequence corresponding to the average loss information does not tend to the standard loss value, according to the average loss information, network layer training is performed sequentially on the first initial feature information generation layer, the initial continuous feature information extraction layer, the second initial feature information generation layer, the initial continuous cause feature extraction layer, the initial continuous behavior feature extraction layer, the first initial gating fusion network layer, and the second initial gating fusion network layer to generate the trained first initial feature information generation layer, the trained initial continuous feature information extraction layer, the trained second initial feature information generation layer, the trained initial continuous cause feature extraction layer, the trained initial continuous behavior feature extraction layer, the trained first initial gating fusion network layer, and the trained second initial gating fusion network layer.

[0088] Fifth, using the first initial feature information generation layer after training as the first initial feature information generation layer, the first initial continuous feature information extraction layer after training as the initial continuous feature information extraction layer, the second initial feature information generation layer after training as the second initial feature information generation layer, the first initial continuous cause feature extraction layer after training as the initial continuous cause feature extraction layer, the first initial continuous behavior feature extraction layer after training as the initial continuous behavior feature extraction layer, and the first initial gating fusion network layer after training as the first initial gating fusion network layer and the second initial gating fusion network layer after training, a new target number of training data is selected, and the above training steps are continued.

[0089] Here, given the large computational load of the model and the large number of available graphics processor nodes, executing each sub-model in the initial anomaly information generation model in parallel can greatly improve computational efficiency and avoid the problem of waiting for execution on a single server.

[0090] In some optional implementations of certain embodiments, the execution entity may generate abnormal information for the target user based on the set of reasons for change and the set of terminal behaviors, including the following steps: The first step involves obtaining a pre-stored first and second cluster of anomalous users. The geographical area of ​​each user in the first cluster is larger than that of each user in the second cluster. Both clusters are formed based on historical contact information change vectors and user characteristic information. Each user in the second cluster is a subset of each user in the first cluster. Users in the first cluster share similar user characteristics and contact information. Similarly, users in the second cluster share similar user characteristics and contact information. Each first cluster has a corresponding anomalous label. The anomalous label can be one of the following: a label indicating the presence of anomalies, or a label indicating the absence of anomalies. In practice, the first cluster can be a cluster of anomalous users from the same province, and the second cluster can be a cluster of anomalous users from the same city. Here, by identifying the first and second clusters of anomalous users, we can obtain information on user anomalies across different regional sizes. This helps avoid situations where changes to contact information are caused by variations in contact plans in specific regions (e.g., changes in contact information due to operator-independent plan changes, or inability to change contact information due to regional limitations). Similarly, regional differences may lead to potential changes in contact information.

[0091] The second step involves determining the first vector similarity between the cluster center of the aforementioned first abnormal user cluster and the user vector corresponding to the target user, for each of the first abnormal user clusters. The user vector is generated based on historical contact information change vectors and user feature information. Specifically, the user vector can be obtained by concatenating historical contact information change vectors and user feature information. User feature information can be a vector representation of various user attributes. The first vector similarity can be a cosine similarity. The first vector similarity characterizes the similarity between the target user and the user corresponding to the cluster center in terms of user features and user contact information change habits.

[0092] The third step is to determine the second vector similarity between each second abnormal user cluster in the aforementioned second abnormal user cluster set and the user vector corresponding to the aforementioned first abnormal user cluster and the target user. The second vector similarity will not be elaborated further.

[0093] The fourth step is to select the first abnormal user cluster with the highest first vector similarity from the above first abnormal user clusters, and use it as the first target abnormal user cluster.

[0094] The fifth step is to select the second abnormal user cluster with the highest similarity to the second vector from the above second abnormal user cluster, and use it as the second target abnormal user cluster.

[0095] Step 6: Based on the aforementioned first and second target abnormal user clusters, generate initial anomaly information. This initial anomaly information may be preliminarily determined information characterizing whether the target users exhibit abnormal behavior.

[0096] As an example, firstly, a first anomalous label corresponding to the first target anomalous user cluster and a second anomalous label corresponding to the aforementioned second target anomalous user cluster are determined. In response to the determination that both the first and second anomalous labels indicate the presence of anomalies, initial anomalous information indicating the presence of anomalies is generated. In response to the determination that the label contents corresponding to the first and second anomalous labels are inconsistent, a third target anomalous user cluster from the aforementioned first anomalous user cluster set with the second highest first vector similarity and a fourth target anomalous user cluster from the aforementioned second anomalous user cluster set with the second highest second vector similarity are obtained. Finally, based on the cluster labels corresponding to the third and fourth target anomalous user clusters, the first and second anomalous labels, a voting mechanism is used to determine the initial anomalous information.

[0097] Step 7: In response to determining that the above initial abnormal information indicates an abnormality, abnormal information for the above target user is generated based on the above set of reasons for replacement and the above set of terminal behaviors.

[0098] Optionally, the second abnormal user cluster and the first abnormal user cluster can be generated through the following steps: The first step is to obtain the first user information set corresponding to the first region.

[0099] The second step is to set the distance between corresponding vectors of the historical contact information change vector as the first weight and the distance between user feature information as the second weight, and then perform clustering processing on the first user information set to obtain the second abnormal user cluster set.

[0100] Third, for each second abnormal user cluster in the second abnormal user cluster set, the subset of second user feature information and the subset of historical contact information corresponding to the second abnormal user subset with the distance from the cluster center as the target value are input into the abnormal information generation model to generate abnormal labels. The abnormal information generation model can be a classification model. For example, the abnormal information generation model can be a classification model based on multiple concatenated residual layers.

[0101] The fourth step is to obtain the second user information set corresponding to the second region. The second region includes the first region; that is, the first region is a sub-region of the second region. The second user information set includes the first user information set.

[0102] The fifth step is to remove the first user information set from the second user information set to obtain the removed user information set.

[0103] The sixth step is to place the user information removed from the user information set into the corresponding cluster in the second abnormal user cluster set, thus obtaining the placed second abnormal user cluster set.

[0104] Step 7: Continue with the clustering steps for the second abnormal user cluster after the above-mentioned sorting to obtain the first abnormal user cluster.

[0105] Optionally, the above steps, as one of the inventive points of this disclosure, solve another technical problem: "While the determination of anomaly information based on deep learning models is highly accurate, the model training and output delays waste a considerable amount of time and computational resources." Based on this, this disclosure, by setting a first cluster of anomalous users under a first region and a second cluster of anomalous users under a second region, can achieve preliminary determination of anomaly information through clustering algorithms, greatly improving output efficiency while ensuring accuracy.

[0106] Step 106: Send the above-mentioned abnormal information to the abnormal information review terminal in the target encryption method.

[0107] In some embodiments, the aforementioned executing entity may send the abnormal information to the abnormal information review terminal using a target encryption method. The target encryption method may be a predetermined encryption algorithm. The abnormal information review terminal may be a terminal that further reviews the abnormal information.

[0108] The above embodiments of this disclosure have the following beneficial effects: Through the abnormal information sending method of some embodiments of this disclosure, based on the information interaction between various terminals, and according to the historical contact information change vector, the abnormal information corresponding to the target user can be generated accurately and efficiently. Specifically, the reason why the determination of abnormalities related to contact information is not accurate and efficient is that the accuracy of manual analysis is too low and the analysis results often lack factual basis. Furthermore, for cases of frequent contact information changes, accuracy and efficiency cannot be effectively guaranteed. Based on this, the abnormal information sending method of some embodiments of this disclosure firstly, in response to receiving an abnormal information request sent by the target user terminal, retrieves the historical contact information change vector corresponding to the target user from the target user database. The historical contact information change vector represents the contact information change situation of the target user within a target historical time period. The target historical time period includes multiple historical sub-time periods, each historical sub-time period having a corresponding vector element in the historical contact information change vector, and the vector element representing the contact information update situation within the corresponding historical sub-time period. Here, the target user's contact information changes are represented by historical contact information change vectors within the target historical time period. This not only makes the changes more significant but also helps identify the characteristics of the contact information changes, thus accurately determining the reasons for the changes. Then, based on the significant change characteristics reflected in the change vectors, a contact information change reason request information can be accurately generated for the aforementioned historical contact information change vectors. Next, this contact information change reason request information is sent to the communication record terminal to obtain the change reason set corresponding to the historical contact information change vectors. Then, the terminal behaviors performed by the target user on the target information processing terminal within each historical sub-time period in the target historical sub-time period set are retrieved from the target information processing terminal's corresponding behavior record database, resulting in a terminal behavior set, where the vector elements corresponding to the target historical sub-time periods are the target values. Here, by determining the corresponding terminal behaviors during the time period when the user changed contact information, the true intention of the user to change contact information can be determined from a behavioral perspective, facilitating the accurate generation of anomaly information subsequently. Furthermore, based on the aforementioned change reason set and terminal behavior set, anomaly information can be determined from multiple perspectives to accurately generate anomaly information for the aforementioned target user. Finally, the aforementioned abnormal information is sent to the abnormal information review terminal using the target encryption method. In summary, the vector representation can fully and significantly demonstrate the change characteristics of the target user within the target historical time period. Based on this, behavioral content and registration reasons during the change period are obtained through multi-terminal interaction. Therefore, abnormal information corresponding to the target user can be generated accurately and efficiently.

[0109] Further reference Figure 2As an implementation of the methods shown in the above figures, this disclosure provides some embodiments of an abnormal information sending device, which are similar to... Figure 1 Corresponding to the method embodiments shown, this abnormal information sending device can be specifically applied to various electronic devices.

[0110] like Figure 2 As shown, an abnormal information sending device 200 includes: a first acquisition unit 201, a first generation unit 202, a first sending unit 203, a second acquisition unit 204, a second generation unit 205, and a second sending unit 206. The first acquisition unit 201 is configured to, in response to receiving an abnormal information request sent by a target user terminal, acquire a historical contact information change vector corresponding to the target user from a target user database. The historical contact information change vector represents the contact information changes of the target user within a target historical time period. The target historical time period includes multiple historical sub-time periods, each of which has a corresponding vector element in the historical contact information change vector, and the vector element represents the contact information update within the corresponding historical sub-time period. The first generation unit 202 is configured to generate a contact information change reason request information for the historical contact information change vector. The first sending unit 203 is configured to send the above... The request information for changing contact information is sent to the communication record terminal to obtain the set of reasons for changing contact information corresponding to the historical vector; the second acquisition unit 204 is configured to obtain the terminal behavior performed by the target user in the target information processing terminal within each historical sub-time period in the target historical sub-time period set from the behavior record database corresponding to the target information processing terminal, to obtain the terminal behavior set, wherein the vector element corresponding to the target historical sub-time period is the target value; the second generation unit 205 is configured to generate abnormal information for the target user based on the set of reasons for changing contact information and the set of terminal behavior; the second sending unit 206 is configured to send the abnormal information to the abnormal information review terminal in a target encrypted manner.

[0111] It is understandable that the units described in the anomaly information sending device 200 are related to the reference. Figure 1 The steps in the described method correspond to each other. Therefore, the operations, features, and beneficial effects described above for the method also apply to the abnormal information sending device 200 and the units contained therein, and will not be repeated here.

[0112] The following is for reference. Figure 3 It shows a schematic diagram of the structure of an electronic device (e.g., an electronic device) 300 suitable for implementing some embodiments of the present disclosure. Figure 3 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of this disclosure.

[0113] like Figure 3 As shown, the electronic device 300 may include a processing unit (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 into a random access memory (RAM) 303. The RAM 303 also stores various programs and data required for the operation of the electronic device 300. The processing unit 301, ROM 302, and RAM 303 are interconnected via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0114] Typically, the following devices can be connected to I / O interface 305: input devices 306 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 307 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 308 including, for example, magnetic tapes, hard disks, etc.; and communication devices 309. Communication device 309 allows electronic device 300 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 3 An electronic device 300 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively. Figure 3 Each box shown can represent a device or multiple devices as needed.

[0115] In particular, according to some embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, some embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication device 309, or installed from storage device 308, or installed from ROM 302. When the computer program is executed by processing device 301, it performs the functions defined in the methods of some embodiments of this disclosure.

[0116] It should be noted that, in some embodiments of this disclosure, the computer-readable medium described above may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In some embodiments of this disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In some embodiments of this disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0117] In some implementations, clients and servers can communicate using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol) and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future-developed networks.

[0118] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device. The aforementioned computer-readable medium carries one or more programs. When the electronic device executes the aforementioned one or more programs, the electronic device causes the following to occur: In response to receiving an abnormal information request sent by a target user terminal, the electronic device retrieves a historical contact information change vector corresponding to the target user from a target user database. The historical contact information change vector represents the contact information changes of the target user within a target historical time period. The target historical time period includes multiple historical sub-time periods, each of which has a corresponding vector element in the aforementioned historical contact information change vector. The vector element represents the contact information update within the corresponding historical sub-time period. The electronic device generates a contact information change reason request information for the aforementioned historical contact information change vector. The electronic device sends the contact information change reason request information to a communication record terminal to obtain a set of change reasons corresponding to the historical contact information change vector. The electronic device retrieves the terminal behaviors performed by the target user in the target information processing terminal within each historical sub-time period in the target historical sub-time period set from a behavior record database corresponding to the target information processing terminal, obtaining a set of terminal behaviors. The vector element corresponding to the target historical sub-time period is a target value. The electronic device generates abnormal information for the target user based on the set of change reasons and the set of terminal behaviors. The electronic device sends the abnormal information to an abnormal information review terminal in a target encrypted manner.

[0119] Computer program code for performing operations of some embodiments of this disclosure can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0120] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0121] The units described in some embodiments of this disclosure can be implemented in software or hardware. The described units can also be housed in a processor; for example, a processor may be described as including a first acquisition unit, a first generation unit, a first sending unit, a second acquisition unit, a second generation unit, and a second sending unit. The names of these units do not necessarily limit the specific unit; for example, the first generation unit may also be described as "a unit that generates contact information change reason request information for the aforementioned historical contact information change vector."

[0122] The functions described above in this document can be performed at least in part by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), system-on-a-chip (SoCs), complex programmable logic devices (CPLDs), and so on.

[0123] The above description is merely a selection of preferred embodiments of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in the embodiments of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described inventive concept. For example, technical solutions formed by substituting the above-described features with (but not limited to) technical features with similar functions disclosed in the embodiments of this disclosure.

Claims

1. A method for sending abnormal information, comprising: In response to receiving an abnormal information request sent by the target user terminal, the system retrieves the historical contact information change vector corresponding to the target user from the target user database. The historical contact information change vector represents the contact information change of the target user within a target historical time period. The target historical time period includes multiple historical sub-time periods. Each historical sub-time period has a corresponding vector element in the historical contact information change vector. The vector element represents the contact information update within the corresponding historical sub-time period. Generate a request for the reason for the contact information change for the historical contact information change vector; Send the contact information change reason request information to the communication record terminal to obtain the change reason set corresponding to the historical contact information change vector; The terminal behaviors performed by the target user on the target information processing terminal within each historical sub-time period in the target historical sub-time period set are obtained from the target information processing terminal behavior record database, and the vector elements corresponding to the target historical sub-time periods are the target values. Based on the set of reasons for the change and the set of terminal behaviors, abnormal information for the target user is generated. The step of generating abnormal information for the target user based on the set of reasons for the change and the set of terminal behaviors includes: The replacement reasons in the set of replacement reasons and the terminal behaviors in the set of terminal behaviors are combined according to the time correspondence to generate combined information, thus obtaining a combined information set; Each piece of information in the combined information set is input into the first feature information generation layer of the pre-trained anomaly information generation model to generate combined feature information, thus obtaining a combined feature information set. The combined feature information set is input into the behavior continuous feature information extraction layer included in the anomaly information generation model to generate combined continuous feature information; Each replacement reason in the replacement reason set is input into the second feature information generation layer of the anomaly information generation model to generate cause feature information, thereby obtaining a set of cause feature information; The set of replacement reasons is input into the continuous cause feature extraction layer of the anomaly information generation model to generate continuous cause feature information; The behavior vector corresponding to each terminal behavior in the terminal behavior set is obtained from the behavior vector database to obtain the behavior vector set. The set of behavioral vectors is input into the continuous behavioral feature extraction layer of the anomaly information generation model to generate continuous behavioral feature information. The combined continuous feature information, the causal continuous feature information, and the behavioral continuous feature information are input into the first gated fusion network layer of the anomaly information generation model to output continuous feature information; The combined feature information set, the causal feature information set, and the behavior vector set are input into the second gated fusion network layer of the anomaly information generation model to output basic feature information; The basic feature information and the continuous feature information are concatenated to generate concatenated feature information; Based on the splicing feature information, the abnormal information is generated using the abnormal information output layer included in the abnormal information generation model; The abnormal information is sent to the abnormal information review terminal in a target encrypted manner.

2. The method according to claim 1, wherein, The step of generating the contact information change reason request information for the historical contact information change vector includes: From the historical contact information change vector, select the vector elements whose corresponding values ​​are the target values ​​to obtain a vector element set; In response to determining that the vector element set is not empty, the historical sub-time period set corresponding to the vector element set is determined as the target historical sub-time period set; Generate a request for a reason to change contact information for the target user and the target historical sub-time period set.

3. The method according to claim 2, wherein, The set of reasons for replacement is obtained through the following steps: Obtain the communication records corresponding to the target user, and use them as target communication records; Obtain the set of historical replacement reasons corresponding to the target historical sub-time period set from the target communication record, and use it as the set of replacement reasons; The set of reasons for the replacement is sent to the anomaly detection terminal.

4. The method according to claim 3, wherein, The step of generating the abnormal information based on the spliced ​​feature information and utilizing the abnormal information generation model, including the abnormal information output layer, includes: Obtain the anomaly feature information corresponding to each predetermined anomaly category in the predetermined anomaly category group to obtain the anomaly feature information group; The abnormal feature information group and the spliced ​​feature information are input into the first abnormal information generation layer included in the abnormal information output layer to obtain the first initial abnormal information; The splicing feature information is input into the second abnormal information generation layer included in the abnormal information output layer to obtain the second initial abnormal information; The abnormal information is generated based on the first initial abnormal information and the second initial abnormal information.

5. The method according to claim 1, wherein, The anomaly information generation model is trained through the following steps: In response to determining the model training time corresponding to the initial anomaly information generation model, the estimated model computational load corresponding to the initial anomaly information generation model is determined. In response to determining that the computational cost of the estimated model is greater than the target computational cost, the method of generating the representation to train the initial anomaly information generation model is the target training method. In response to determining that the training mode corresponding to the initial abnormal information generation model is the target training mode, the available graphics processor nodes in the graphics processor cluster under the model training time are determined, and at least one available graphics processor node is obtained. In response to determining that the number of nodes corresponding to the at least one available graphics processor node is greater than or equal to a target value, the initial anomaly information generation model is decomposed to obtain an initial decomposed model set, wherein the set of graphics processor nodes used by the initial decomposed model set is a subset of the at least one available graphics processor node; Obtain the training dataset corresponding to the anomaly information generation model; Randomly select a target number of training data points from the training dataset and perform the following training steps: Send the target number of training data points to the first available graphics processor node, and control the first available graphics processor node to perform the following first generation step: The target number of training data are input into the first initial feature information generation layer of the pre-deployed initial decomposition model set to generate the target number of first initial feature information. The target number of first initial feature information are concatenated to generate first initial concatenated feature information; The first initial splicing feature information and the target number are sent to the sixth available graphics processor node; Send the target number of training data points to the second available graphics processor node, and control the second available graphics processor node to perform the following second generation step: The target number of training data are input into the initial continuous feature information extraction layer of the pre-deployed initial decomposition model set to generate the target number of initial continuous feature information. The target number of initial continuous feature information are concatenated to generate second initial concatenated feature information; The second initial splicing feature information and the target number are sent to the sixth available graphics processor node; Send the target number of training data points to a third available graphics processor node, and control the third available graphics processor node to perform the following third generation step: The target number of training data are input into the second initial feature information generation layer of the pre-deployed initial decomposition model set to generate the target number of second initial feature information. The target number of second initial feature information are concatenated to generate third initial concatenated feature information; The third initial splicing feature information and the target number are sent to the sixth available graphics processor node; The target number of training data points are sent to the fourth available graphics processor node, and the fourth available graphics processor node is controlled to perform the following fourth generation step: The target number of training data are input into the initial continuous cause feature extraction layer of the pre-deployed initial decomposition model set to generate the target number of initial continuous cause feature information; The target number of initial continuous cause feature information are concatenated to generate a fourth initial concatenated feature information; The fourth initial splicing feature information and the target number are sent to the sixth available graphics processor node; Send the target number of training data points to the fifth available graphics processor node, and control the fifth available graphics processor node to perform the following fifth generation step: The target number of training data are input into the initial continuous behavior feature extraction layer of the pre-deployed initial decomposition model set to generate the target number of initial continuous behavior feature information; The target number of initial continuous behavioral feature information are concatenated to generate a fifth initial concatenated feature information; The fifth initial splicing feature information and the target number are sent to the sixth available graphics processor node.

6. The method according to claim 5, wherein, The training steps also include: Control the sixth available graphics processor node to perform the following sixth generation step: Acquire the first initial splicing feature information sent by the first available graphics processor node, the second initial splicing feature information sent by the second available graphics processor node, the third initial splicing feature information sent by the third available graphics processor node, the fourth initial splicing feature information sent by the fourth available graphics processor node, the fifth initial splicing feature information sent by the fifth available graphics processor node, and the target number; The second initial splicing feature information, the fourth initial splicing feature information, and the fifth initial splicing feature information, along with the target number, are input into the first initial gated fusion network layer of the pre-deployed initial disassembly model set to output initial continuous feature information; The initial continuous feature information and the number of targets are sent to the eighth available graphics processor node; Control the seventh available graphics processor node and perform the following seventh generation step: The first initial splicing feature information, the third initial splicing feature information, and the corresponding target number of behavior vector sets are input into the second initial gated fusion network layer of the pre-deployed initial disassembly model set to output the initial basic feature information; The initial basic feature information and the number of targets are sent to the eighth available graphics processor node; Control the eighth available graphics processor node to perform the following eighth generation step: The received initial continuous feature information, initial basic feature information, and the number of targets are concatenated to generate initial concatenated feature information; The initial splicing feature information is input into the initial anomaly information output layer of the pre-deployed initial disassembly model set to generate the target number of initial anomaly information. Generate a target number of loss information for the target number of initial anomalies; The average loss information of the target number is calculated to generate average loss information; In response to determining that the loss information sequence corresponding to the average loss information tends to the target loss value, the model parameters corresponding to the first initial feature information generation layer, the model parameters corresponding to the initial continuous feature information extraction layer, the model parameters corresponding to the second initial feature information generation layer, the model parameters corresponding to the initial continuous cause feature extraction layer, the model parameters corresponding to the initial continuous behavior feature extraction layer, the model parameters corresponding to the first initial gated fusion network layer, and the model parameters corresponding to the second initial gated fusion network layer are received. Based on the received model parameters, an anomaly information generation model is generated. In response to the determination that the loss information sequence corresponding to the average loss information does not tend to the target value, based on the average loss information, the network layers are trained sequentially: the first initial feature information generation layer, the initial continuous feature information extraction layer, the second initial feature information generation layer, the initial continuous cause feature extraction layer, the initial continuous behavior feature extraction layer, the first initial gated fusion network layer, and the second initial gated fusion network layer, to generate the trained first initial feature information generation layer, the trained initial continuous feature information extraction layer, the trained second initial feature information generation layer, the trained initial continuous cause feature extraction layer, the trained initial continuous behavior feature extraction layer, the trained first initial gated fusion network layer, and the trained second initial gated fusion network layer. Using the first initial feature information generation layer after training as the first initial feature information generation layer, the first initial continuous feature information extraction layer after training as the initial continuous feature information extraction layer, the second initial feature information generation layer after training as the second initial feature information generation layer, the first initial continuous cause feature extraction layer after training as the initial continuous cause feature extraction layer, the first initial continuous behavior feature extraction layer after training as the initial continuous behavior feature extraction layer, and the first initial gating fusion network layer after training as the first initial gating fusion network layer and the second initial gating fusion network layer after training, a new target number of training data is selected, and the training steps are continued.

7. An abnormal information sending device, comprising: The first acquisition unit is configured to, in response to receiving an abnormal information request sent by the target user terminal, acquire the historical contact information change vector corresponding to the target user from the target user database. The historical contact information change vector represents the contact information change of the target user within a target historical time period. The target historical time period includes: multiple historical sub-time periods. Each historical sub-time period has a corresponding vector element in the historical contact information change vector. The vector element represents the contact information update within the corresponding historical sub-time period. The first generation unit is configured to generate a request for a reason for changing contact information in relation to the historical contact information change vector. The first sending unit is configured to send the contact information change reason request information to the communication record terminal in order to obtain the change reason set corresponding to the historical contact information change vector. The second acquisition unit is configured to acquire the terminal behavior executed by the target user in the target information processing terminal within each historical sub-time period in the target historical sub-time period set from the target information processing terminal corresponding behavior record database, thereby obtaining a terminal behavior set, wherein the vector element corresponding to the target historical sub-time period is the target value; The second generation unit is configured to generate abnormal information for the target user based on the set of reasons for replacement and the set of terminal behaviors. Generating abnormal information for the target user based on the set of reasons for replacement and the set of terminal behaviors includes: combining the reasons for replacement in the set of reasons for replacement and the terminal behaviors in the set of terminal behaviors according to a time correspondence to generate combined information, obtaining a combined information set; inputting each piece of combined information in the combined information set to a first feature information generation layer included in a pre-trained abnormal information generation model to generate combined feature information, obtaining a combined feature information set; inputting the combined feature information set to a behavior continuous feature information extraction layer included in the abnormal information generation model to generate combined continuous feature information; inputting each reason for replacement in the set of reasons for replacement to a second feature information generation layer included in the abnormal information generation model to generate reason feature information, obtaining a reason feature information set; inputting the set of reasons for replacement to the abnormal information generation model... The abnormal information generation model includes a continuous cause feature extraction layer to generate continuous cause feature information; it obtains the behavior vector corresponding to each terminal behavior in the terminal behavior set from the behavior vector database to obtain a behavior vector set; it inputs the behavior vector set to the continuous behavior feature extraction layer of the abnormal information generation model to generate continuous behavior feature information; it inputs the combined continuous feature information, the continuous cause feature information, and the continuous behavior feature information to the first gated fusion network layer of the abnormal information generation model to output continuous feature information; it inputs the combined feature information set, the causal feature information set, and the behavior vector set to the second gated fusion network layer of the abnormal information generation model to output basic feature information; it concatenates the basic feature information and the continuous feature information to generate concatenated feature information; and it generates the abnormal information using the abnormal information output layer of the abnormal information generation model based on the concatenated feature information. The second sending unit is configured to send the abnormal information to the abnormal information review terminal in a target encrypted manner.

8. An electronic device, comprising: One or more processors; Storage device, on which one or more programs are stored, When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-6.

9. A computer-readable medium having a computer program stored thereon, wherein, When the program is executed by the processor, it implements the method as described in any one of claims 1-6.

Images