Training method of abnormal information identification model

Abstract

The invention discloses a training method of an abnormal information identification model, and the method comprises the steps: obtaining first sample data authorized to be used by a plurality of sample users and an expected output label corresponding to the first sample data, and determining an original information identification model corresponding to the first sample data; wherein the original information identification model comprises a first encoder and an output layer; the first encoder is used for determining a semantic information sequence of the sample data; the output layer comprises a first output unit and a second output unit; the first output unit is used for identifying abnormal users according to the semantic information sequence, and the second output unit is used for identifying abnormal characters according to the semantic information sequence; and training the original information recognition model according to the first sample data and the expected output tag to obtain an abnormal information recognition model, and improving the accuracy of abnormal recognition and the comprehensive judgment capability of the model through combined training by fusing semantics, user and character multi-dimensional tags.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information detection, and in particular to a training method of an abnormal information recognition model. BACKGROUND

[0002] With the rapid development of social networks and user-generated content (UGC) platforms, a large number of abnormal users who publish implicit violations, inducement or low-quality content for marketing, fraud or public opinion manipulation have emerged in the network space. These users often alternate between normal content and abnormal content, or use semantic deformation, misspelling substitution and other methods to evade detection, making it difficult to effectively identify them by relying solely on text keyword matching or isolated user behavior statistics. When facing malicious users who are well disguised, publish content that is surface-compliant but have hidden intentions, single-dimensional detection methods are prone to missed and false judgments, resulting in low overall recognition accuracy and weak model generalization ability. SUMMARY

[0003] The present application provides a training method of an abnormal information recognition model to solve the problem of low accuracy of abnormal recognition caused by isolated analysis of user behavior and text content, which makes it difficult to detect implicit violations.

[0004] According to an aspect of the present application, a training method of an abnormal information recognition model is provided, characterized in that it comprises:

[0005] obtaining a plurality of first sample data authorized by sample users and corresponding expected output labels, wherein the expected output labels include semantic information labels, abnormal user labels and abnormal text labels;

[0006] determining an original information recognition model corresponding to the first sample data; wherein the original information recognition model comprises a first encoder and an output layer; the first encoder is used to determine the semantic information sequence of the sample data; the output layer comprises a first output unit and a second output unit; the first output unit is used to identify abnormal users according to the semantic information sequence, and the second output unit is used to identify abnormal text according to the semantic information sequence;

[0007] training the original information recognition model according to the first sample data and the expected output labels to obtain an abnormal information recognition model.

[0008] According to another aspect of the present application, a training device of an abnormal information recognition model is provided, comprising:

[0009] an acquisition module for acquiring a plurality of first sample data authorized by sample users and corresponding expected output labels, wherein the expected output labels include semantic information labels, abnormal user labels and abnormal text labels;

[0010] The original information recognition model determination module is configured to determine an original information recognition model corresponding to the first sample data, wherein the original information recognition model comprises a first encoder and an output layer; the first encoder is configured to determine a semantic information sequence of the sample data; the output layer comprises a first output unit and a second output unit; the first output unit is configured to recognize an abnormal user according to the semantic information sequence, and the second output unit is configured to recognize an abnormal word according to the semantic information sequence.

[0011] The abnormal information recognition model determination module is configured to train the original information recognition model according to the first sample data and the expected output label to obtain an abnormal information recognition model.

[0012] According to another aspect of the present application, an electronic device is provided, which comprises:

[0013] at least one processor; and

[0014] a memory connected to the at least one processor in communication; wherein

[0015] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the training method of the abnormal information recognition model according to any one of the embodiments of the present application.

[0016] According to another aspect of the present application, a computer readable storage medium is provided, which stores computer instructions for enabling a processor to implement the training method of the abnormal information recognition model according to any one of the embodiments of the present application when executed by the processor.

[0017] The technical scheme of the embodiment of the application first acquires a plurality of sample data authorized for use by sample users and expected output labels corresponding to the sample data, since the expected output labels include semantic information labels, abnormal user labels and abnormal text labels, a labeled data set can be constructed for training and optimizing a model to improve the accuracy and generalization ability of user behavior and semantic understanding; then, an original information recognition model corresponding to the sample data is determined; wherein the original information recognition model includes a first encoder and an output layer; the first encoder is used to determine a semantic information sequence of the sample data; the output layer includes a first output unit and a second output unit; the first output unit is used to identify an abnormal user according to the semantic information sequence, and the second output unit is used to identify an abnormal text according to the semantic information sequence, the semantic information is extracted by the encoder, and the parallel output units identify the abnormal user and the abnormal text respectively, thereby improving the identification efficiency and accuracy; finally, the original information recognition model is trained according to the sample data and the expected output labels to obtain an abnormal information recognition model, the model is trained using the labeled samples to learn to identify abnormal users and abnormal texts, and finally an identification model with abnormal detection capability is obtained, thereby solving the problem that it is difficult to detect implicit violations by analyzing user behavior and text content in isolation, resulting in low accuracy of abnormal identification, and improving the accuracy of abnormal identification and the comprehensive judgment ability of the model by fusing semantic, user and text multi-dimensional label joint training.

[0018] It should be understood that the content described in this part is not intended to identify the key or important features of the embodiments of the application, nor is it intended to limit the scope of the application. Other features of the application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0020] Figure 1 is a flow chart of a training method of an abnormal information recognition model according to the first embodiment of the application;

[0021] Figure 2 is a flow chart of a training method of an abnormal information recognition model according to the second embodiment of the application;

[0022] Figure 3 is a structural schematic diagram of a training device of an abnormal information recognition model according to the third embodiment of the application;

[0023] Figure 4 FIG. 1 is a structural schematic diagram of an electronic device implementing a training method of an abnormal information identification model according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0024] In order to enable persons skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the accompanying drawings of the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by persons skilled in the art without creative labor should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first", "second", and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or a chronological sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product, or device that includes a series of steps or units does not necessarily have to be limited to only those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0026] It should be noted that the modification of "one" or "multiple" mentioned in the present disclosure is illustrative rather than limiting, and those skilled in the art should understand that unless the context clearly indicates otherwise, it should be understood as "one or more".

[0027] The names of the messages or information exchanged between the plurality of devices in the embodiments of the present disclosure are only for illustrative purposes, and are not intended to limit the scope of the messages or information.

[0028] It can be understood that before using the technical solutions disclosed in the embodiments of the present disclosure, the type, use range, use scenario, etc. of the personal information involved in the present disclosure should be informed to the user and the authorization of the user should be obtained through appropriate means in accordance with relevant laws and regulations.

[0029] For example, when responding to the active request of the user, the user is sent prompt information to explicitly prompt the user that the operation requested to be performed will require the acquisition and use of the personal information of the user. Thus, the user can voluntarily choose whether to provide personal information to the electronic device, application program, server or storage medium, etc. software or hardware that performs the operation of the technical solutions of the present disclosure according to the prompt information.

[0030] As an optional but non-limiting implementation manner, in response to receiving the active request of the user, the manner of sending the prompt information to the user may be, for example, a pop-up window manner, in which the prompt information may be presented in a text manner. In addition, the pop-up window may also carry a selection control for the user to select "agree" or "disagree" to provide the personal information to the electronic device.

[0031] It can be understood that the above notification and user authorization obtaining process is only illustrative and does not limit the implementation manners of the present disclosure. Other manners meeting relevant laws and regulations can also be applied to the implementation manners of the present disclosure.

[0032] It can be understood that the data (including but not limited to the data itself, the acquisition or use of the data) involved in the technical solution should comply with the requirements of relevant laws and regulations and related provisions.

[0033] Embodiment one

[0034] Figure 1 A flowchart of a training method of an abnormal information recognition model is provided for the embodiment one of the present application. The present embodiment can be applied to a scenario requiring joint identification of abnormal users and illegal texts. The method can be executed by a training device of the abnormal information recognition model. The training device of the abnormal information recognition model can be realized in the form of hardware and / or software. Optionally, the training device of the abnormal information recognition model is realized by an electronic device, which can be a mobile terminal, a PC terminal or a server, etc.

[0035] As shown in Figure 1 , the method specifically can include:

[0036] S110, obtaining a plurality of sample users authorized to use first sample data and an expected output label corresponding to the first sample data, wherein the expected output label includes a semantic information label, an abnormal user label and an abnormal text label.

[0037] In this context, the sample users can be understood as users participating in the data collection process, whose behavioral or interaction data is used as samples for model training. The first sample data can be understood as data collected from the sample users after partial data masking. The expected output label can be understood as a manually labeled or rule-defined "correct answer" used to guide the model's learning objectives. In this embodiment, the expected output label includes, but is not limited to, semantic information labels, abnormal user labels, and abnormal text labels. The semantic information label can be understood as a label describing the deeper meaning or intent of the text, reflecting its semantic category or topic, used to help the model understand the semantic information of the text, and is an important contextual basis for subsequent judgment of whether it is abnormal. The abnormal user label can be understood as a label marking whether a user has abnormal or illegal behavior tendencies, used to train the model to identify potential risky users from the first sample data. The abnormal text label can be understood as a label marking whether a piece of text contains illegal or abnormal content, used to train the model to identify abnormal content in the first sample data, achieving content security filtering.

[0038] Based on the above scheme, optionally, obtaining the first sample data authorized by multiple sample users includes: obtaining multiple sample attribute data authorized by multiple sample users, determining the data type of the sample attribute data, and concatenating the sample attribute data according to the data type and a preset concatenation rule to obtain the first sample data.

[0039] The sample attribute data can be understood as information about the interaction between the sample user and the target application on the client side, including but not limited to user behavior, content, or environmental characteristics. The data type can be understood as describing the category or format of the sample attribute data, including but not limited to string, numeric, and list types, used for subsequent processing and data concatenation. The concatenation rule can be understood as a pre-defined rule for combining different types of attribute data into a unified sequence. The target application can be understood as the specific software system or service platform being detected.

[0040] One optional implementation involves acquiring various sample attribute data authorized for use by the sample user data. This data includes, but is not limited to, basic device information (device model, operating system version, memory size, processor model, etc.), location environment information (geographic location information, Wi-Fi information, Bluetooth information), and sensor information (accelerometer, gyroscope, fiber optic sensor, etc.). The data type of the sample attribute data is determined: string type S, numeric type N, or list type L. Therefore, string information such as device model and operating system version can be represented as S = {S...} deviceVer S osVer , ...}; numerical information such as latitude and longitude, memory size, etc., can be represented as N = {N lon Nlat N mem , ...}; List-type information such as accelerometer readings and position information over a period of time can be represented as L = {[S loc1 S loc2 S loci ], [N acc1 N acc2 , ..., N acci ], ..., n, where i = 1, 2, ..., n represents the number of data collected within a certain time period. The above information is then concatenated to obtain the natural language concatenation result. Where name and val represent the information itself and the natural language description of the value, respectively. An example of concatenation is: [CLS] Device model iPhone16 [SEP] Storage space 256GB [SEP] Location information visited during the collection time [Beijing, Beijing, Beijing].

[0041] This technical solution integrates multiple types of authorized attribute data and concatenates them according to rules to standardize the input format, improve the model's comprehensive understanding of user behavior and semantic representation capabilities, enhance the accuracy, robustness, and generalization performance of abnormal user and abnormal text recognition, and ensure the compliance of data use.

[0042] S120. Determine the original information recognition model corresponding to the first sample data; wherein, the original information recognition model includes a first encoder and an output layer; the first encoder is used to determine the semantic information sequence of the sample data; the output layer includes a first output unit and a second output unit; the first output unit is used to identify abnormal users according to the semantic information sequence, and the second output unit is used to identify abnormal text according to the semantic information sequence.

[0043] The original information recognition model can be understood as an initial, untrained, or preliminarily constructed machine learning model, serving as the starting point for model training. This original information recognition model includes, but is not limited to, a first encoder and an output layer. The first encoder, as part of the model, is responsible for converting the first sample data into a structured semantic information sequence. This semantic information sequence can be understood as a sequence of vectors output by the first encoder, where each vector corresponds to a semantic representation of the input text, reflecting the semantic meaning and contextual relationships of each part of the text. The output layer includes at least a first output unit and a second output unit. The first output unit is used to identify whether the input data contains abnormal users. The second output unit is used to identify whether the input data contains abnormal text.

[0044] S130. The original information recognition model is trained based on the first sample data and the expected output label to obtain the abnormal information recognition model.

[0045] The abnormal information identification model can be understood as a final model after training, and can identify abnormalities in input data.

[0046] On the basis of the above scheme, optionally, after obtaining the abnormal information identification model, further comprising: obtaining target attribute data, inputting the target attribute data into the abnormal information identification model, and obtaining an abnormal detection result, wherein the abnormal detection result includes an abnormal user and an abnormal text under the condition of abnormal target attribute data.

[0047] The target attribute data can be understood as behavior or content data generated by a user to be detected during interaction with a target application on a client, which is consistent or similar to the sample attribute data type in the training phase. The abnormal detection result can be understood as a conclusion output by the abnormal information identification model after analyzing the input target attribute data, indicating whether there is an abnormal user or content, etc.

[0048] An optional embodiment, wherein the user specific abnormal data segment example extracted is, for the following description information, the model identifies that the user visits the location information is abnormal [CLS] equipment model iPhone16 [SEP] storage space 256GB [SEP] collect the visited location information within 5 minutes [Beijing, Wuhan, Beijing], and the abnormal segment "collect the visited location information within 5 minutes [Beijing, Wuhan, Beijing]" is extracted.

[0049] By using the technical scheme, abnormal users and abnormal texts can be accurately identified from target attribute data, the risk control efficiency and content security level are improved, and the manual review cost is reduced.

[0050] The technical scheme of the embodiment of the present application firstly acquires a plurality of sample user authorized use of first sample data and the corresponding expected output label of the first sample data. Since the expected output label includes semantic information label, abnormal user label and abnormal character label, a labeled data set can be constructed for training and optimizing the model, improving the accuracy and generalization ability of understanding user behavior and semantics. Then, the original information recognition model corresponding to the first sample data is determined. The original information recognition model includes a first encoder and an output layer. The first encoder is used to determine the semantic information sequence of the sample data. The output layer includes a first output unit and a second output unit. The first output unit is used to identify abnormal users according to the semantic information sequence, and the second output unit is used to identify abnormal characters according to the semantic information sequence. The semantic information is extracted by the encoder, and the parallel output unit identifies the abnormal user and the abnormal character respectively, improving the recognition efficiency and accuracy. Finally, the original information recognition model is trained according to the first sample data and the expected output label to obtain an abnormal information recognition model. The labeled sample is used to train the model, so that it learns to identify abnormal users and abnormal characters. Finally, an identification model with abnormal detection capability is obtained, which solves the problem that it is difficult to detect implicit violations by analyzing user behavior and text content in isolation, resulting in low accuracy of abnormal identification. Through the joint training of multi-dimensional labels such as semantics, users and characters, the accuracy of abnormal identification and the comprehensive judgment ability of the model are improved.

[0051] Embodiment two

[0052] Figure 2A flowchart of a training method of an abnormal information recognition model provided for the second embodiment of the present application is provided, and the present embodiment is a further refinement of the abnormal information recognition model based on the relationship between the above embodiments, and the original information recognition model is trained according to the first sample data and the expected output label to obtain the abnormal information recognition model. Optionally, the output layer includes a first output unit and a second output unit; the original information recognition model is trained according to the first sample data and the expected output label to obtain the abnormal information recognition model, including: inputting the first sample data into the first encoder to obtain a first semantic information sequence, adjusting the parameters of the first encoder according to the first semantic information sequence and the semantic information label to obtain a second encoder; inputting the first sample data into the second encoder to obtain a second semantic information sequence, inputting the second semantic information sequence into the first output unit to obtain first abnormal information, and inputting the second semantic information sequence into the second output unit to obtain second abnormal information; and adjusting the parameters of the second encoder, the first output unit and the second output unit according to the first abnormal information, the abnormal user label, the second abnormal information and the abnormal character label to obtain the abnormal information recognition model. The specific implementation can be referred to the description of the present embodiment. The same or similar technical features as the foregoing embodiments are not described again.

[0053] As shown in Figure 2 , the method can specifically include:

[0054] S210, obtaining a plurality of sample user authorized first sample data and an expected output label corresponding to the first sample data, wherein the expected output label includes a semantic information label, an abnormal user label and an abnormal character label.

[0055] S220, determining an original information recognition model corresponding to the first sample data; wherein the original information recognition model includes a first encoder and an output layer; the first encoder is used to determine a semantic information sequence of the sample data; the output layer includes a first output unit and a second output unit; the first output unit is used to recognize an abnormal user according to the semantic information sequence, and the second output unit is used to recognize an abnormal character according to the semantic information sequence, and the output layer includes the first output unit and the second output unit.

[0056] S230, inputting the first sample data into the first encoder to obtain a first semantic information sequence, and adjusting the parameters of the first encoder according to the first semantic information sequence and the semantic information label to obtain a second encoder.

[0057] The first semantic information sequence can be understood as an initial semantic vector sequence output by the first encoder after encoding the first sample data, representing semantic expression of the input first sample data under the first encoder parameters, used for first-stage training, and used in combination with the semantic information label to optimize the first encoder itself. The second encoder can be understood as an optimized encoder after first-stage semantic task training, and the generated semantic information is more accurate than that of the first encoder.

[0058] On the basis of the above scheme, optionally, the first sample data is obtained by masking at least part of the word units in the second sample data; and adjusting the parameters of the first encoder according to the first semantic information sequence and the semantic information label to obtain a second encoder, comprising: inputting the second sample data into a third encoder to obtain a third semantic information sequence; constructing positive sample pairs and negative sample pairs according to the first semantic information sequence and the third semantic information sequence; and adjusting the parameters of the first encoder according to the positive sample pairs and the negative sample pairs to obtain a second encoder.

[0059] The second sample data can be understood as a set of unprocessed raw text data from the same user interaction scenario as the first sample data, but without attribute splicing or formatting processing. The token can be understood as the basic unit after the text is tokenized or subworded, which can be a word, a Chinese character, a subword, or a symbol, etc. Token is the smallest semantic unit for model processing, and the mask operation is performed on the token to simulate the scenario of partial information missing, forcing the model to learn how to infer the masked content from the context. The mask can be understood as randomly hiding or replacing part of the tokens in the second sample data, so that part of the information is missing. The third encoder can be understood as an independent encoder in the original information recognition model, which is used to process the second sample data as a baseline encoder to generate a semantic information sequence (third semantic information sequence) of the second sample data, which is used to compare with the semantic sequence (first semantic information sequence) of the masked data generated by the first encoder to guide the parameter adjustment of the first encoder. The third semantic information sequence can be understood as a semantic representation sequence generated by the third encoder after encoding the second sample data, representing the semantic information of the complete data, as part of the "positive example sample pair", which is used to compare with the semantic sequence of the masked data generated by the first encoder to help the model learn how to recover the complete semantics from the partial information. The positive example sample pair can be understood as a sample pair constructed by the first semantic information sequence and the third semantic information sequence of the first sample data at the same position without being masked. The negative example sample pair can be understood as a sample pair constructed by the first semantic information sequence and the third semantic information sequence of the first sample data at different positions being masked. The positive example sample pair and the negative example sample pair are used for the model to learn to distinguish the difference between "complete semantics" and "partial semantics", and to enhance the model's ability to distinguish the completeness of semantics by comparing the positive example and the negative example.

[0060] An optional implementation, for the second sample data x = [x1,..., x n ], randomly mask 15% of the tokens to get the mask sequence to get the first sample data The second sample data x and the first sample data are respectively input into the second encoder Encoder T and the third encoder Encoder S to obtain the hidden layer representation h = Encoder T (x)、 h and are NxD dimensional tensors representing N tokens each encoded into D dimensions, where the encoder Encoder can be selected from BERT, RoBERTa, etc. pre-trained language model.

[0061] By using the technical scheme, the positive and negative sample pairs are optimized by using the mask reconstruction and the contrast learning mechanism, the feature expression ability of the model for deep semantic information is effectively improved, the robustness to incomplete or disguised texts is enhanced, and thus the accuracy and generalization performance of the abnormal user and abnormal text recognition are improved, and the overfitting risk is reduced.

[0062] On the basis of the above scheme, optionally, the constructing the positive sample pair and the negative sample pair according to the first semantic information sequence and the semantic information label comprises: for the masked word in the second sample data, constructing the positive sample pair by using the first semantic information sequence and the third semantic information sequence of the first sample data at the same position which is not masked, and constructing the negative sample pair by using the first semantic information sequence and the third semantic information sequence of the first sample data at different positions which are masked.

[0063] By using the technical scheme, the positive and negative sample pairs are optimized by using the mask reconstruction and the contrast learning mechanism, the feature expression ability of the model for deep semantic information is effectively improved, the robustness to incomplete or disguised texts is enhanced, and thus the accuracy and generalization performance of the abnormal user and abnormal text recognition are improved, and the overfitting risk is reduced.

[0064] On the basis of the above scheme, optionally, the adjusting the parameters of the first encoder according to the positive sample pair and the negative sample pair to obtain a second encoder comprises: determining the similarity probability distribution difference of the positive sample pair and the negative sample pair by using a cross-entropy loss function, adjusting the parameters of the first encoder according to the similarity probability distribution difference, so as to maximize the similarity of the first semantic information sequence and the third semantic information sequence of the positive sample pair, and minimize the similarity of the first semantic information sequence and the third semantic information sequence of the negative sample pair; and in response to satisfying a training end condition, determining the first encoder after adjustment as the second encoder.

[0065] The similarity probability distribution difference can be understood as the difference degree of the positive sample pair and the negative sample pair on the similarity probability distribution, and can be usually quantified by using a cross-entropy loss function, and is used for measuring the distinguishing ability of the first encoder for the positive sample pair and the negative sample pair. The greater the difference is, the more obvious the distinguishing of the first encoder for the positive sample pair and the negative sample pair is; the smaller the difference is, the more the first encoder needs to be optimized. The cross-entropy loss function can be understood as a loss function used for measuring the difference between two probability distributions. The similarity can be understood as the semantic matching degree between the first semantic information sequence and the second semantic information sequence, and is used as an index for judging whether the two sequences are semantically consistent. The training end condition can be understood as a pre-set condition for stopping training, including but not limited to reaching a maximum number of iterations, loss function value convergence (change less than a threshold value), etc.

[0066] In an optional implementation, the similarity probability distribution difference can be determined based on the following formula:

[0067]

[0068] wherein, represents the similarity probability distribution difference, sim(·,·) represents a cosine similarity function; τ is a preset coefficient; h i represents an element at the i-th position in the third semantic information sequence; represents an element at the i-th position in the first semantic information sequence; n represents the number of data in the third semantic information sequence or the first semantic information sequence.

[0069] By using the technical solution, the encoder is optimized through the contrast learning mechanism, the discrimination ability of the first encoder for semantic features is significantly improved, the robustness to the mask or the incomplete text is enhanced, and the ability to restore the semantic of the text is effectively improved.

[0070] S240, inputting the first sample data into the second encoder to obtain a second semantic information sequence, inputting the second semantic information sequence into the first output unit to obtain first abnormal information, and inputting the second semantic information sequence into the second output unit to obtain second abnormal information.

[0071] The second semantic information sequence can be understood as a high-quality semantic vector sequence output by the second encoder after re-encoding the first sample data, and the second semantic information sequence represents similar semantic information, integrates the semantic learning results of the first stage, and can better express the key semantic features of the input data, and is used for input to the output layer (the first output unit and the second output unit) for abnormal detection. The first abnormal information can be understood as an abnormal user result predicted by the first output unit according to the second semantic information sequence, which is used for comparison with the abnormal user label to further adjust the parameters of the first output unit. The second abnormal information can be understood as an abnormal character result predicted by the second output unit according to the second semantic information sequence, which is used for comparison with the abnormal character label to further adjust the parameters of the second output unit.

[0072] In an optional implementation, is input into the second encoder Encoder opt to obtain a second semantic information sequence h=[h [CLS] , h1,..., h n ].

[0073] S250, adjusting the parameters of the second encoder, the first output unit and the second output unit according to the first abnormal information, the abnormal user label, the second abnormal information and the abnormal character label to obtain an abnormal information recognition model.

[0074] In the above scheme, optionally, the first output unit comprises a first forward network and a normalization function layer; the second semantic information sequence is input into the first output unit to obtain first abnormal information, and parameters of the first output unit are adjusted according to the first abnormal information and the abnormal user label, comprising: the second semantic information sequence is input into the first forward network to determine the first weight of the second semantic information sequence through the first forward network; the first weight and the second semantic information sequence are input into the normalization function layer to determine the first confidence that the sample user corresponding to the semantic information sequence belongs to the abnormal user type; and the parameters of the first forward network are adjusted according to the first confidence and the abnormal user label.

[0075] The first forward network can be understood as being used for nonlinear transformation of the input second semantic information sequence to generate the first weight. The first weight can be understood as an intermediate result output by the first forward network after processing the second semantic information sequence, and represents the importance of different semantic features to the abnormal user judgment. The normalization function layer can be understood as a function layer for standardizing or probabilizing the input data. The first confidence can be understood as a final result output by the normalization function layer after processing the first weight and the second semantic information sequence, and represents the probability or confidence level of determining the sample user as the first abnormal information belonging to the abnormal user type.

[0076] In an optional implementation, the second semantic information sequence h [CLS] represents the overall representation of the natural language description information of the sentence, g [CLS] is a 1x D-dimensional tensor representing that the token is encoded into D dimensions, processed by the first forward network, and output by the softmax function to obtain a binary classification confidence, wherein W1 represents the first weight, h [CLS] represents an element in the second semantic information sequence that can represent the second semantic information sequence, is an Nx1-dimensional tensor representing the confidence whether each user is an abnormal user.

[0077] By introducing the weight mechanism and the normalization processing, the model can focus on the key semantic fragments, accurately identify the abnormal user behavior characteristics, and improve the accuracy and interpretability of the judgment. At the same time, based on the parameter optimization of the confidence and the real label, the adaptive learning ability of the model is enhanced, and the sensitivity and robustness of the abnormal user detection are effectively improved.

[0078] On the basis of the above scheme, optionally, the second output unit comprises a second forward network and an activation function layer; the second semantic information sequence is input into the second output unit to obtain second abnormal information, and parameters of the second output unit are adjusted according to the second abnormal information and the abnormal character label, comprising: the second semantic information sequence is input into the second forward network to determine the second weight of the second semantic information sequence through the second forward network; the second weight and the second semantic information sequence are input into the activation function layer to determine the second confidence that the sample character corresponding to the second semantic information sequence belongs to an abnormal character type; and the parameters of the second forward network are adjusted according to the second confidence and the abnormal character label.

[0079] The second forward network can be understood as being used for nonlinear transformation of the input second semantic information sequence to generate a second weight. The second weight can be understood as an intermediate result output by the second forward network after processing the second semantic information sequence, and represents the importance of different semantic features to abnormal user judgment. The activation function layer can be understood as a function layer for standardizing or probabilizing the input data. The second confidence can be understood as a final result output by the activation function layer after processing the second weight and the second semantic information sequence, and represents the probability or confidence level of determining the sample character as second abnormal information.

[0080] An optional implementation obtains a second semantic information sequence h = [h [CLS] ,h1,...,h n ] through the second forward network and outputs a binary classification confidence for each word position through a sigmoid function. W2 represents a second weight, is an N x 2-dimensional tensor representing the confidence of whether each word is an abnormal character.

[0081] By introducing weight allocation and activation mechanism for abnormal character recognition, the model can accurately locate the risk fragments in the text. Combining confidence output and label feedback to optimize parameters, the learning effect of abnormal semantic patterns is enhanced, the detection accuracy and robustness are improved, and the technology is suitable for complex and variable violation content recognition scenarios.

[0082] On the basis of the above scheme, optionally, the parameters of the second encoder are adjusted according to the first abnormal information, the abnormal user label, the second abnormal information and the abnormal character label, comprising: determining a second loss according to the first abnormal information and the abnormal user label, determining a third loss according to the second abnormal information and the abnormal character label; determining a target loss according to the second loss, the third loss and a preset weight, and adjusting the parameters of the second encoder according to the target loss.

[0083] The second loss can be understood as a difference measure between the first abnormal information and the abnormal user label calculated by a loss function, quantifying the prediction error of the model in the user anomaly detection task, reflecting the performance of user anomaly detection under the current second encoder parameter, and minimizing the loss through parameter adjustment. The third loss can be understood as a difference measure between the second abnormal information and the abnormal text label calculated by a loss function, quantifying the prediction error of the model in the text anomaly detection task, reflecting the performance of text anomaly detection under the current second encoder parameter, and minimizing the loss through parameter adjustment.

[0084] In an optional implementation, the second loss is determined according to the first abnormal information and the abnormal user label based on the following formula:

[0085]

[0086] wherein, represents the second loss, |B| is the number of sample users, represents the first confidence, and the y i represents the abnormal user label of the i th feature data (1 = abnormal, 0 = normal).

[0087] In an optional implementation, the third loss is determined according to the second abnormal information and the abnormal text label based on the following formula:

[0088]

[0089] wherein, represents the third loss, |B| is the number of sample users, and |N| is the length of the second semantic information sequence, represents the second confidence, and the y i，n represents the abnormal text label of the n th feature data in the i th second semantic information sequence (1 = abnormal, 0 = normal).

[0090] The result of weighted sum of the second loss, the third loss and a preset weight is taken as a target weight.

[0091] By adopting the technical solution, the user-level and text-level losses are fused into a unified target function according to weights through multi-task joint optimization, the encoder parameters are adjusted cooperatively, the synchronous recognition ability of the model for abnormal users and abnormal texts is improved, the semantic sharing and generalization performance between tasks are enhanced, and the overall detection precision and stability are effectively improved.

[0092] The technical scheme of the embodiment of the present application utilizes the semantic information label fine-tuning encoder to obtain more accurate semantic representation, and then jointly trains the abnormal user and abnormal text recognition tasks based on the optimized semantic sequence, effectively enhancing the model's extraction ability of deep semantic features and the collaborative learning effect between multiple tasks, not only improving the quality of the encoder output, but also enabling the output layer to make judgments based on more optimal feature representation, significantly improving the accuracy of abnormal user and abnormal text recognition and the overall robustness of the model. At the same time, through multi-label joint detection, the model's generalization recognition ability for complex hidden irregular behaviors is enhanced.

[0093] Embodiment three

[0094] Figure 3 A structural schematic diagram of a training device of an abnormal information recognition model according to Embodiment three of the present application is provided. As shown in the figure, the device comprises an acquisition module 310, an original information recognition model determination module 320 and an abnormal information recognition model determination module 330. Among them, Figure 3

[0095] The acquisition module 310 is configured to acquire a plurality of first sample data authorized for use by sample users and expected output labels corresponding to the first sample data, wherein the expected output labels comprise semantic information labels, abnormal user labels and abnormal text labels. The original information recognition model determination module 320 is configured to determine an original information recognition model corresponding to the first sample data. The original information recognition model comprises a first encoder and an output layer. The first encoder is configured to determine a semantic information sequence of the sample data. The output layer comprises a first output unit and a second output unit. The first output unit is configured to recognize abnormal users according to the semantic information sequence, and the second output unit is configured to recognize abnormal texts according to the semantic information sequence. The abnormal information recognition model determination module 330 is configured to train the original information recognition model according to the first sample data and the expected output labels to obtain an abnormal information recognition model.

[0096] ​The technical scheme of the embodiment of the application first acquires a plurality of first sample data authorized to be used by sample users and corresponding expected output labels of the first sample data through an acquisition module. Since the expected output labels include semantic information labels, abnormal user labels and abnormal character labels, a labeled data set can be constructed for training and optimizing a model to improve the accuracy and generalization ability of understanding user behavior and semantics. Then, an original information recognition model corresponding to the first sample data is determined through a determination module of an original information recognition model. The original information recognition model includes a first encoder and an output layer. The first encoder is used to determine a semantic information sequence of the sample data. The output layer includes a first output unit and a second output unit. The first output unit is used to identify an abnormal user according to the semantic information sequence, and the second output unit is used to identify an abnormal character according to the semantic information sequence. The semantic information is extracted through the encoder, and the parallel output units identify the abnormal user and the abnormal character respectively to improve the identification efficiency and accuracy. Finally, the original information recognition model is trained according to the first sample data and the expected output labels through a determination module of an abnormal information recognition model to obtain an abnormal information recognition model. The model is trained with labeled samples to learn and identify abnormal users and abnormal characters. Finally, an identification model with abnormal detection capability is obtained to solve the problem that it is difficult to detect implicit violations by analyzing user behavior and text content in isolation, resulting in low accuracy of abnormal identification. The accuracy of abnormal identification and the comprehensive judgment ability of the model are improved through multi-dimensional label joint training of fusion of semantics, users and characters.

[0097] On the basis of the above-mentioned scheme, optionally, the determination module of the abnormal information recognition model comprises a second encoder determination submodule, an abnormal information determination module and an abnormal information recognition model determination module. The second encoder determination submodule is used to input the first sample data into the first encoder to obtain a first semantic information sequence, and adjust parameters of the first encoder according to the first semantic information sequence and the semantic information label to obtain a second encoder. The abnormal information determination module is used to input the first sample data into the second encoder to obtain a second semantic information sequence, input the second semantic information sequence into the first output unit to obtain first abnormal information, and input the second semantic information sequence into the second output unit to obtain second abnormal information. The abnormal information recognition model determination module is used to adjust parameters of the second encoder, the first output unit and the second output unit according to the first abnormal information, the abnormal user label, the second abnormal information and the abnormal character label to obtain an abnormal information recognition model.

[0098] On the basis of the above scheme, optionally, the first sample data is obtained by masking at least part of the word units in the second sample data; the second encoder determination submodule comprises a third semantic information sequence determination unit, a sample pair construction unit and a second encoder determination unit. The third semantic information sequence determination unit is configured to input the second sample data into a third encoder to obtain a third semantic information sequence; the sample pair construction unit is configured to construct positive example sample pairs and negative example sample pairs according to the first semantic information sequence and the third semantic information sequence; and the second encoder determination unit is configured to adjust parameters of the first encoder according to the positive example sample pairs and the negative example sample pairs to obtain a second encoder.

[0099] On the basis of the above scheme, optionally, the sample pair construction unit is specifically configured to, for the masked word units in the second sample data, construct positive example sample pairs by using the first semantic information sequence and the third semantic information sequence of the first sample data at the same position, and construct negative example sample pairs by using the first semantic information sequence and the third semantic information sequence of the first sample data at different positions.

[0100] On the basis of the above scheme, optionally, the second encoder determination unit is specifically configured to determine a similarity probability distribution difference of the positive example sample pairs and the negative example sample pairs by using a cross-entropy loss function, adjust parameters of the first encoder according to the similarity probability distribution difference, maximize the similarity of the first semantic information sequence and the third semantic information sequence of the positive example sample pairs, and minimize the similarity of the first semantic information sequence and the third semantic information sequence of the negative example sample pairs; and in response to satisfying a training end condition, determine the adjusted first encoder as a second encoder.

[0101] On the basis of the above scheme, optionally, the first output unit comprises a first forward network and a normalization function layer, and the abnormal information recognition model determination module comprises a first weight determination submodule, a first confidence determination submodule and a first parameter adjustment submodule. The first weight determination submodule is configured to input the second semantic information sequence into the first forward network to determine a first weight of the second semantic information sequence by using the first forward network; the first confidence determination submodule is configured to input the first weight and the second semantic information sequence into the normalization function layer to determine a first confidence that a sample user corresponding to the semantic information sequence belongs to an abnormal user type; and the first parameter adjustment submodule is configured to adjust parameters of the first forward network according to the first confidence and the abnormal user label.

[0102] On the basis of the above scheme, optionally, the second output unit comprises a second forward network and an activation function layer; the abnormal information recognition model determination module comprises a second weight determination submodule, a second confidence determination submodule and a second parameter adjustment submodule. The second weight determination submodule is configured to input the second semantic information sequence into the second forward network to determine a second weight of the second semantic information sequence through the second forward network; the second confidence determination submodule is configured to input the second weight and the second semantic information sequence into the activation function layer to determine a second confidence that a sample text corresponding to the second semantic information sequence belongs to an abnormal text type; and the second parameter adjustment submodule is configured to adjust parameters of the second forward network according to the second confidence and the abnormal text label.

[0103] On the basis of the above scheme, optionally, the abnormal information recognition model determination module comprises a loss determination submodule and an encoder parameter adjustment submodule. The loss determination submodule is configured to determine a second loss according to the first abnormal information and the abnormal user label, and determine a third loss according to the second abnormal information and the abnormal text label; and the encoder parameter adjustment submodule is configured to determine a target loss according to the second loss, the third loss and a preset weight, and perform parameter adjustment on the second encoder according to the target loss.

[0104] On the basis of the above scheme, optionally, the obtaining module comprises a first sample data determination submodule. The first sample data determination submodule is configured to obtain a plurality of sample attribute data authorized to be used by a plurality of sample users, determine a data type of the sample attribute data, splice the sample attribute data according to a preset splicing rule to obtain first sample data, wherein the sample attribute data is information of the sample user interacting with a target application on a client.

[0105] On the basis of the above scheme, optionally, the training device of the abnormal information recognition model further comprises an abnormal detection result determination module. The abnormal detection result determination module is configured to, after obtaining the abnormal information recognition model, obtain target attribute data, input the target attribute data into the abnormal information recognition model, and obtain an abnormal detection result, wherein the abnormal detection result comprises an abnormal user and an abnormal text in the case of target attribute data abnormality.

[0106] The training device of the abnormal information recognition model provided in the embodiments of the present application can execute the training method of the abnormal information recognition model provided in any of the embodiments of the present application, and has the corresponding function modules and beneficial effects of the execution method.

[0107] Embodiment four

[0108] Figure 4 A structural diagram of an electronic device 10 that can be used to implement embodiments of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular telephones, smart phones, wearable devices (e.g., headsets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be examples only, and are not intended to limit the implementations of the present application described and / or claimed in this document.

[0109] As shown in Figure 4 The electronic device 10 includes at least one processor 11, and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., connected in communication with the at least one processor 11, where the memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes according to the computer programs stored in the read-only memory (ROM) 12 or loaded into the random access memory (RAM) 13 from the storage unit 18. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0110] A plurality of components in the electronic device 10 are connected to the I / O interface 15, including an input unit 16, such as a keyboard, a mouse, etc., an output unit 17, such as various types of displays, a speaker, etc., a storage unit 18, such as a magnetic disk, an optical disk, etc., and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0111] The processor 11 can be various general and / or special-purpose processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs various methods and processes described above, such as a training method of an abnormal information identification model.

[0112] In particular, the processes described above with reference to the flowcharts can be implemented as a computer software program according to embodiments of the present application. For example, embodiments of the present application include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods illustrated by the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via the communication unit 19, or installed from the storage unit 18, or installed from the ROM 12. When the computer program is executed by the processor 11, the above-described functions defined in the methods of embodiments of the present application are performed.

[0113] In some embodiments, a method of training an abnormal information recognition model can be implemented as a computer program tangibly embodied in a computer-readable storage medium, such as the storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed onto the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded onto the RAM 13 and executed by the processor 11, one or more steps of a method of training an abnormal information recognition model described above can be performed. Alternatively, in other embodiments, the processor 11 can be configured to perform a method of training an abnormal information recognition model by any other suitable means, such as by means of firmware.

[0114] The various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a complex programmable logic device (CPLD), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0115] Computer programs for implementing the methods of the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the computer program, when executed, can cause instructions defined in the flow charts and / or block diagrams to be implemented. The computer program can be executed entirely on a machine, partially on a machine, partially on a machine as a stand-alone software package and partially on a remote machine or entirely on a remote machine or server.

[0116] In the context of the present application, a computer readable storage medium can be a tangible medium that can contain or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. A computer readable storage medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, a computer readable storage medium can be a machine readable signal medium. More specific examples of a machine readable storage medium will include one or more lines of a program of instructions in a transitory signal form, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0117] To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the electronic device. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0118] The systems and techniques described herein can be implemented in a computing system that includes a back end component, e.g., as a data server, or that includes a middleware component, e.g., an application server, or that includes a front end component, e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described herein, or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication, e.g., a communication network. Examples of communication networks include a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0119] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. A server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system, to solve the defects of large management difficulty and weak business scalability in traditional physical host and VPS service.

[0120] It should be understood that the various forms of flow shown above can be re-ordered, added to, or deleted from without departing from the scope of the present disclosure. For example, the steps recited in the present disclosure can be performed in parallel, in series, or in a different order, and the present disclosure is not limited herein as such.

[0121] The specific embodiments described above are not intended to limit the scope of the present disclosure. Those skilled in the art will understand that various modifications, combinations, sub-combinations, and alternatives can be made to the specific embodiments without departing from the spirit and principles of the present disclosure. Any further modifications, equivalents, and / or alternatives come within the scope of the present disclosure as recited by the claims.

Claims

1. A training method for an anomaly information recognition model, characterized in that, include: Obtain first sample data authorized by multiple sample users and the expected output tags corresponding to the first sample data, wherein the expected output tags include semantic information tags, abnormal user tags and abnormal text tags; A raw information recognition model corresponding to the first sample data is determined; wherein, the raw information recognition model includes a first encoder and an output layer; the first encoder is used to determine the semantic information sequence of the sample data; the output layer includes a first output unit and a second output unit; the first output unit is used to identify abnormal users based on the semantic information sequence, and the second output unit is used to identify abnormal text based on the semantic information sequence; The original information recognition model is trained based on the first sample data and the expected output label to obtain the anomaly information recognition model.

2. The method according to claim 1, characterized in that, The step of training the original information recognition model based on the first sample data and the expected output label to obtain the anomaly information recognition model includes: The first sample data is input into the first encoder to obtain a first semantic information sequence. The parameters of the first encoder are adjusted according to the first semantic information sequence and the semantic information label to obtain a second encoder. The first sample data is input into the second encoder to obtain a second semantic information sequence. The second semantic information sequence is input into the first output unit to obtain a first abnormal information. The second semantic information sequence is input into the second output unit to obtain a second abnormal information. The parameters of the second encoder, the first output unit, and the second output unit are adjusted based on the first abnormal information, the abnormal user tag, the second abnormal information, and the abnormal text tag to obtain an abnormal information recognition model.

3. The method according to claim 2, characterized in that, The first sample data is obtained by masking at least a portion of the words in the second sample data; the step of adjusting the parameters of the first encoder according to the first semantic information sequence and the semantic information tags to obtain the second encoder includes: The second sample data is input into the third encoder to obtain the third semantic information sequence; Construct positive example pairs and negative example pairs based on the first semantic information sequence and the third semantic information sequence; The parameters of the first encoder are adjusted based on the positive sample pairs and the negative sample pairs to obtain the second encoder.

4. The method according to claim 3, characterized in that, The construction of positive and negative sample pairs based on the first semantic information sequence and the semantic information labels includes: For the masked words in the second sample data, construct a positive sample pair by combining the first semantic information sequence and the third semantic information sequence of the first sample data that is not masked at the same position, and construct a negative sample pair by combining the first semantic information sequence and the third semantic information sequence of the first sample data that is masked at different positions.

5. The method according to claim 3, characterized in that, The step of adjusting the parameters of the first encoder based on the positive sample pairs and the negative sample pairs to obtain the second encoder includes: The difference in similarity probability distribution between the positive sample pair and the negative sample pair is determined by the cross-entropy loss function. The parameters of the first encoder are adjusted according to the difference in similarity probability distribution to maximize the similarity between the first semantic information sequence and the third semantic information sequence of the positive sample pair and minimize the similarity between the first semantic information sequence and the third semantic information sequence of the negative sample pair. In response to the satisfaction of the training termination condition, the adjusted first encoder is determined as the second encoder.

6. The method according to claim 2, characterized in that, The first output unit includes a first feedforward network and a normalization function layer; the second semantic information sequence is input into the first output unit to obtain first anomaly information, and the parameters of the first output unit are adjusted according to the first anomaly information and the anomaly user label, including: The second semantic information sequence is input into the first forward network to determine the first weight of the second semantic information sequence through the first forward network; The first weight and the second semantic information sequence are input into the normalization function layer to determine the first confidence level that the sample user corresponding to the semantic information sequence belongs to the abnormal user type; The parameters of the first feedforward network are adjusted based on the first confidence level and the abnormal user labels.

7. The method according to claim 2, characterized in that, The second output unit includes a second feedforward network and an activation function layer; the second semantic information sequence is input into the second output unit to obtain second anomaly information, and the parameters of the second output unit are adjusted according to the second anomaly information and the anomaly text label, including: The second semantic information sequence is input into the second feedforward network to determine the second weight of the second semantic information sequence through the second feedforward network; The second weight and the second semantic information sequence are input into the activation function layer to determine the second confidence level that the sample text corresponding to the second semantic information sequence belongs to the abnormal text type. The parameters of the second feedforward network are adjusted based on the second confidence level and the anomalous text label.

8. The method according to claim 2, characterized in that, Adjusting the parameters of the second encoder based on the first anomaly information, the anomaly user tag, the second anomaly information, and the anomaly text tag, including: A second loss is determined based on the first abnormal information and the abnormal user tag, and a third loss is determined based on the second abnormal information and the abnormal text tag; The target loss is determined based on the second loss, the third loss, and the preset weight, and the parameters of the second encoder are adjusted based on the target loss.

9. The method according to claim 1, characterized in that, The acquisition of the first sample data authorized by multiple sample users includes: Multiple sample attribute data authorized by multiple sample users are obtained, the data type of the sample attribute data is determined, and the sample attribute data is concatenated according to the data type and a preset concatenation rule to obtain the first sample data, wherein the sample attribute data is information of the sample user's interaction with the target application on the client.

10. The method according to claim 1, characterized in that, After obtaining the anomaly information identification model, the following is also included: Obtain target attribute data, input the target attribute data into the anomaly information recognition model, and obtain anomaly detection results. The anomaly detection results include abnormal users and abnormal text when the target attribute data is abnormal.

Images