Abnormal behavior recognition method and device, electronic equipment and storage medium

Abstract

The invention provides an abnormal behavior recognition method and device, electronic equipment and a storage medium, and the method comprises the steps: screening features with preset index data higher than a first index threshold value to form an initial feature pool, and obtaining an initial training set and an initial test set based on the initial feature pool, and taking the initial training set and the initial test set as initial seeds, determining an optimal feature combination by using a genetic algorithm, optimizing the optimal feature combination based on a preset expansion condition through an expansion feature pool, obtaining a target feature combination, further obtaining a standard abnormal behavior, and comparing a target user behavior with the standard abnormal behavior to obtain a recognition result. The historical user behaviors meeting the first index threshold value are screened to form the initial feature pool, the initial feature quality is ensured, the optimal feature combination is determined through the AUC index, the optimal feature combination is optimized in combination with the expansion condition, the stability, accuracy and generalization ability of the feature combination are ensured, and the user experience is improved. And the accuracy of standard abnormal behaviors and the accuracy of abnormal behavior recognition are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of behavior recognition, and in particular to an abnormal behavior recognition method and device, an electronic device, and a storage medium. BACKGROUND

[0002] With the continuous development of financial risk control technology, credit fraud detection has become a key link in the risk control system of banks and financial institutions. Machine learning technology has made significant achievements in this field, which can identify potential fraudulent behavior by analyzing massive transaction data. However, these models face a fundamental challenge in practical application: there is a serious class imbalance problem in the credit fraud scene, and fraudulent samples often account for only a small part of the total samples. Under this extremely unbalanced data distribution, traditional machine learning methods often have difficulty effectively capturing the feature combination patterns of fraudulent behavior.

[0003] Existing abnormal behavior recognition methods mostly rely on artificial rules or single feature modeling, which have weak generalization ability and poor adaptability to complex scenarios, and are easily affected by data distribution changes, resulting in high false positive and false negative rates. Moreover, traditional algorithms are difficult to effectively mine the non-linear relationships between multi-dimensional features, and cannot accurately capture implicit abnormal patterns, making it difficult to meet the requirements of recognition accuracy and real-time performance in financial risk control, security monitoring and other scenarios. Therefore, there is an urgent need for an efficient and accurate abnormal behavior recognition technology to improve the detection ability of abnormal patterns in complex environments. SUMMARY

[0004] Therefore, the embodiments of the present application provide an abnormal behavior recognition method and device, an electronic device, and a storage medium to improve the accuracy of abnormal behavior recognition.

[0005] According to an aspect of the present application, an abnormal behavior recognition method is provided, which comprises: obtaining a target user behavior; comparing the target user behavior with a standard abnormal behavior obtained in advance to determine whether the target user behavior is an abnormal behavior, wherein the standard abnormal behavior is obtained in advance by the following steps: obtaining a set of historical user behaviors; based on the preset index data of each historical user behavior in the set of historical user behaviors and each first index threshold preset for each preset index data, filtering historical user behaviors with preset index data higher than the corresponding first index threshold to form an initial feature pool; dividing each historical user behavior contained in the initial feature pool into an initial training set and an initial test set, wherein the AUC difference between the initial training set and the initial test set does not exceed a preset AUC difference threshold; The initial training set and the initial test set are taken as initial seeds, and a genetic algorithm is used to determine an optimal feature combination in the initial feature pool; Based on the optimal feature combination, a supplementary feature meeting a preset expansion condition is screened in an expanded feature pool and added to the optimal feature combination to obtain a target feature combination; the expanded feature pool is a feature pool obtained by expanding the initial feature pool; Based on the target feature combination, a standard abnormal behavior is obtained.

[0006] In a possible embodiment, the dividing of each historical user behavior contained in the initial feature pool into an initial training set and an initial test set comprises: A starting training set and a starting test set are determined based on the initial feature pool, and initial model training is performed based on the starting training set and the starting test set; In a case where the initial model appears overfitting, the feature with the highest importance ranking is removed from the starting training set and the starting test set, and the initial model training based on the starting training set and the starting test set is returned until a preset training end condition is reached, and the current training set and test set are determined as the initial training set and the initial test set.

[0007] In a possible embodiment, the taking of the initial training set and the initial test set as initial seeds and the use of a genetic algorithm to determine an optimal feature combination in the initial feature pool comprise: Based on the initial training set and the initial test set, a genetic evolution operation is performed on each feature in the initial feature pool to obtain a plurality of training set-test set combinations until a preset evolution stop condition is reached; the genetic evolution operation comprises selection, crossover and mutation; The training set-test set combination with the highest AUC value is determined as the optimal feature combination.

[0008] In a possible embodiment, the method further comprises: In the set of historical user behaviors, a historical user behavior meeting the preset second indicator threshold is determined to be added to the initial feature pool to obtain an expanded feature pool; the preset second indicator threshold is less than the first indicator threshold.

[0009] In a possible embodiment, the taking of the optimal feature combination as a reference, the screening of a supplementary feature meeting a preset expansion condition in an expanded feature pool, and the addition of the supplementary feature to the optimal feature combination to obtain a target feature combination comprise: The expanded feature pool is traversed, and a Lift indicator of the optimal feature combination before and after each supplementary feature in the expanded feature pool is added to the optimal feature combination is calculated; In the case of the Lift index being improved, the supplementary feature is determined to be added, to obtain a supplementary feature combination; The supplementary feature combination is traversed, and the Lift index of the supplementary feature combination before and after each feature in the supplementary feature combination is deleted is calculated. In the case of the Lift index being improved, the feature is deleted, to obtain a target feature combination.

[0010] In a possible embodiment, the standard abnormal behavior is obtained based on the target feature combination, including: The target feature combination is output to a large model, and a standard abnormal behavior output by the large model is obtained.

[0011] According to another aspect of the present application, an abnormal behavior recognition device is provided, which includes: An acquisition module is configured to acquire a target user behavior. A comparison module is configured to compare the target user behavior with a pre-obtained standard abnormal behavior, and determine whether the target user behavior is an abnormal behavior. A pre-acquisition module is configured to pre-acquire the standard abnormal behavior by the following steps: A set of historical user behaviors is acquired. Based on preset index data of each historical user behavior in the set of historical user behaviors and each first index threshold preset for each preset index data, historical user behaviors with preset index data higher than the corresponding first index threshold are screened to form an initial feature pool. Each historical user behavior contained in the initial feature pool is divided into an initial training set and an initial test set, wherein the AUC difference between the initial training set and the initial test set does not exceed a preset AUC difference threshold. The initial training set and the initial test set are used as an initial seed, and a genetic algorithm is used to determine an optimal feature combination in the initial feature pool. Based on the optimal feature combination as a benchmark, a supplementary feature that meets a preset expansion condition is selected from an expanded feature pool and added to the optimal feature combination to obtain a target feature combination; wherein the expanded feature pool is a feature pool obtained by expanding the initial feature pool. A standard abnormal behavior is obtained based on the target feature combination.

[0012] In a possible embodiment, the dividing of each historical user behavior contained in the initial feature pool into an initial training set and an initial test set includes: A starting training set and a starting test set are determined based on the initial feature pool, and initial model training is performed based on the starting training set and the starting test set. In the case that the initial model is over-fitted, the feature with the highest importance rank is removed from the initial training set and the initial test set, and the initial model training based on the initial training set and the initial test set is returned until a preset training end condition is reached, and the current training set and test set are determined as the initial training set and the initial test set; The initial training set and the initial test set are used as initial seeds, and a genetic algorithm is used to determine an optimal feature combination in the initial feature pool, including: Based on the initial training set and the initial test set, genetic evolution operations are performed on each feature in the initial feature pool to obtain a plurality of training set-test set combinations until a preset evolution stop condition is reached; wherein the genetic evolution operations include selection, crossover and mutation; The training set-test set combination with the highest AUC value is determined as the optimal feature combination; The pre-acquisition module is further configured to determine historical user behaviors in the historical user behavior set that satisfy the preset second index threshold and add the historical user behaviors to the initial feature pool to obtain an expanded feature pool; the preset second index threshold is less than the first index threshold; Based on the optimal feature combination, supplementary features in the expanded feature pool that satisfy a preset expansion condition are screened and added to the optimal feature combination to obtain a target feature combination, including: The expanded feature pool is traversed, and the Lift index of the optimal feature combination before and after each supplementary feature in the expanded feature pool is added to the optimal feature combination is calculated; In the case that the Lift index is improved, the supplementary feature is determined to be added to obtain a supplemented feature combination; The supplemented feature combination is traversed, and the Lift index of the supplemented feature combination before and after each feature in the supplemented feature combination is deleted is calculated; In the case that the Lift index is improved, the feature is deleted to obtain a target feature combination; The standard abnormal behavior is obtained based on the target feature combination, including: The target feature combination is output to a large model to obtain a standard abnormal behavior output by the large model.

[0013] According to another aspect of the present application, an electronic device is provided, including: a processor; and a memory storing a program, wherein the program includes instructions that, when executed by the processor, cause the processor to perform any of the above-described abnormal behavior identification methods.

[0014] According to another aspect of the present application, there is provided a non-transitory computer readable storage medium storing computer instructions, wherein the computer instructions are configured to cause a computer to perform the abnormal behavior recognition method described above.

[0015] The one or more technical solutions provided in the embodiments of the present application, after obtaining the historical user behavior set, filter the historical user behaviors whose preset index data is higher than the corresponding first index threshold to form an initial feature pool, and divide based on the initial feature pool to obtain an initial training set and an initial test set, and the AUC difference between the initial training set and the initial test set does not exceed a preset AUC difference threshold, taking the initial training set and the initial test set as an initial seed, and using a genetic algorithm to determine an optimal feature combination in the initial feature pool based on the initial seed, expanding the initial feature pool to obtain an expanded feature pool, and expanding the optimal feature combination based on the expanded feature pool based on a preset expansion condition to obtain a target feature combination; obtaining a standard abnormal behavior based on the target feature combination; when obtaining a target user behavior to be analyzed, comparing the target user behavior with the standard abnormal behavior to obtain a judgment result of whether the target user behavior is an abnormal behavior.

[0016] By filtering the historical user behaviors that meet the first index threshold to form the initial feature pool, the embodiments of the present application ensure the quality of the initial features, and at the same time, determine the optimal feature combination based on the AUC index, and expand the optimal feature combination based on the optimal feature combination combined with the expansion condition to obtain the target feature combination, which ensures the stability, accuracy and generalization ability of the feature combination, improves the accuracy of the standard abnormal behavior obtained based on the target feature combination, and further improves the accuracy of the abnormal behavior recognition. BRIEF DESCRIPTION OF DRAWINGS

[0017] In the following description of exemplary embodiments in conjunction with the accompanying drawings, more details, features and advantages of the present application are disclosed, in which: Figure 1 A flowchart of an abnormal behavior recognition method provided by the present application is shown; Figure 2 A flowchart of obtaining a standard abnormal behavior in an abnormal behavior recognition method provided by the present application is shown; Figure 3 Another flowchart of an abnormal behavior recognition method provided by the present application is shown; Figure 4 A structural diagram of an abnormal behavior recognition device provided by the present application is shown; Figure 5 A structural block diagram of an exemplary electronic device capable of implementing the embodiments of the present application is shown. DETAILED DESCRIPTION

[0018] Embodiments of the present application will be described in more detail below with reference to the drawings. While several embodiments of the application are shown in the drawings, it is understood that the application can be embodied in various forms and should not be construed as limited to the embodiments set forth herein, but instead, should be interpreted to cover not only those embodiments, but also to cover modifications and equivalents. It is also understood that the drawings are only for purposes of illustration and should not be construed as limiting the scope of the application.

[0019] It should be understood that each step described in the method embodiments of the present application can be performed in different order and / or in parallel. In addition, the method embodiments can include additional steps and / or omit the steps shown. The scope of the present application is not limited in this respect.

[0020] The term "comprising" and variations thereof as used herein are used inclusively, i.e., "comprising, but not limited to." The term "based on" is "based at least in part on." The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments." Related terms are defined in the following description. It should be noted that the concepts mentioned in the present application are merely used for distinguishing different apparatuses, modules or units, and are not intended to limit the functions of these apparatuses, modules or units.

[0021] It should be noted that the modification of "one" or "multiple" mentioned in the present application is illustrative rather than limiting, and those skilled in the art should understand that, unless otherwise explicitly indicated in the context, it should be understood as "one or more".

[0022] The names of the messages or information exchanged between the plurality of apparatuses in the embodiments of the present application are only for illustrative purposes, and are not intended to limit the scope of the messages or information.

[0023] In the field of credit fraud detection, there are obvious technical limitations in feature selection methods based on statistical indicators. Such methods mainly include univariate screening techniques such as information value analysis and group stability index evaluation. Although these methods have high computational efficiency, they exhibit the following key defects in practical applications: First, such methods can only evaluate the discrimination ability of a single feature, completely ignoring the synergistic effect between features. Fraudulent behavior often manifests as a specific combination pattern of multiple features, and traditional univariate analysis methods cannot identify the value of such combined features. For example, certain features may have limited discrimination ability when used alone, but when combined with specific features, they can significantly improve the fraud identification effect.

[0024] Secondly, the existing evaluation indicators have obvious dimension loss problems. Information value mainly reflects the global discriminability of features, and group stability indicators focus on the time stability of features, but these indicators cannot accurately evaluate the recognition value of features in key high-risk samples. The single evaluation dimension leads to unsatisfactory performance of the selected features in the actual model.

[0025] Finally, such methods rely heavily on manually set threshold parameters. Different threshold choices will directly lead to completely different feature selection results, and such threshold setting often lacks objective and unified standards, making the feature selection process subjective.

[0026] The algorithms such as gradient boosting decision tree widely used in the current credit fraud detection field face significant challenges in practical application: In terms of optimization objectives, the default loss function design of these models has obvious bias. Due to the extremely low proportion of fraud samples, the model training process will naturally tend to optimize the majority class samples, leading to insufficient learning of key minority classes (fraud samples). This target bias directly affects the model's ability to identify high-risk samples.

[0027] In terms of feature interaction, the feature splitting strategy based on greedy algorithm is less efficient. This local optimal search method is difficult to systematically find discriminative high-order feature combinations, especially when the feature dimension is high, the coverage rate of effective feature combinations is significantly insufficient.

[0028] In terms of model generalization, the extremely unbalanced data distribution makes the model easily capture noise patterns in the data rather than real patterns. This overfitting problem leads to poor stability of the model in practical application, making it difficult to maintain consistent and reliable detection performance.

[0029] Current technical methods for improving feature selection still have obvious shortcomings: the recursive feature elimination method can optimize the feature subset, but its results are too sensitive to initial conditions. Different initial feature sets will lead to significantly different final results, which seriously affects the stability of the method. The integrated learning method indeed improves the overall robustness by combining multiple base models, but this method does not fundamentally improve the feature combination discovery mechanism. In response to new fraud patterns, its performance improvement effect is often limited. Reinforcement learning-based optimization methods have better search capabilities in theory, but they face serious computational efficiency problems in practical application. Especially in high-dimensional feature scenarios, the computational cost of such methods grows exponentially, making it difficult to meet the timeliness requirements of actual business.

[0030] These technical shortcomings collectively lead to poor performance of existing systems across several key dimensions: slow response to new fraud patterns, insufficient accuracy in identifying high-risk samples, and decreased interpretability of the model as its complexity increases. These problems severely limit the practical application effectiveness and business value of credit fraud detection systems.

[0031] Based on this, the present invention provides an abnormal behavior identification method, apparatus, electronic device, and storage medium. The abnormal behavior identification method provided by the present invention can be applied to any electronic device with abnormal behavior identification function, such as a computer, server, or mobile terminal, etc. The following describes the solution of the present invention with reference to the accompanying drawings: Figure 1 A flowchart illustrating the abnormal behavior identification method provided by the present invention may include the following steps: S101. Obtain target user behavior; S102. Compare the target user behavior with the pre-obtained standard abnormal behavior to determine whether the target user behavior is abnormal.

[0032] Among them, such as Figure 2 As shown, the standard abnormal behavior is obtained in advance through the following steps: S201. Obtain the historical user behavior set; S202. Based on the preset indicator data of each historical user behavior in the set of historical user behaviors and the preset first indicator thresholds for each preset indicator data, select historical user behaviors whose preset indicator data is higher than the corresponding first indicator threshold to form an initial feature pool. S203. Divide the historical user behaviors contained in the initial feature pool into an initial training set and an initial test set, wherein the AUC difference between the initial training set and the initial test set does not exceed a preset AUC difference threshold. S204. Using the initial training set and the initial test set as initial seeds, and using a genetic algorithm to determine the optimal feature combination in the initial feature pool; S205. Based on the optimal feature combination, supplementary features that meet the preset expansion conditions are selected from the expanded feature pool and added to the optimal feature combination to obtain the target feature combination; wherein, the expanded feature pool is a feature pool obtained by expanding the initial feature pool. S206. Obtain standard abnormal behavior based on the combination of the target features.

[0033] In the embodiment of the present application, after obtaining the set of historical user behaviors, the historical user behaviors with the preset index data higher than the corresponding first index threshold value are screened to form an initial feature pool, and the initial feature pool is divided to obtain an initial training set and an initial test set, and the AUC difference between the initial training set and the initial test set does not exceed a preset AUC difference threshold value. The initial training set and the initial test set are used as an initial seed, and the genetic algorithm is used to determine the optimal feature combination in the initial feature pool based on the initial seed. The initial feature pool is expanded to obtain an expanded feature pool, and the optimal feature combination is expanded based on the expanded feature pool based on the preset expansion condition to obtain a target feature combination. The standard abnormal behavior is obtained based on the target feature combination. When obtaining the target user behavior to be analyzed, the target user behavior is compared with the standard abnormal behavior to obtain the judgment result of whether the target user behavior is an abnormal behavior.

[0034] According to the embodiment of the present application, the initial feature pool is formed by screening the historical user behaviors satisfying the first index threshold value, so as to ensure the quality of the initial features. The optimal feature combination is determined based on the AUC index, and the optimal feature combination is expanded based on the optimal feature combination and the expansion condition to obtain the target feature combination, so as to ensure the stability, accuracy and generalization ability of the feature combination, improve the accuracy of the standard abnormal behavior obtained based on the target feature combination, and further improve the accuracy of the abnormal behavior recognition.

[0035] The S101-S102 and S201-S206 are exemplarily described as follows: The abnormal behavior recognition method provided by the present application can be applied to various types of APPs, such as credit APPs, video APPs, shopping APPs and the like. The target user can be all users using the APP, or part of the users, which is not limited by the present application. The target user behavior can be determined according to the type of the APP. The abnormal behavior recognition method provided by the present application is exemplarily described as follows by taking a credit APP as an example: The target user behavior can include attribute information of the target user such as personal credit record, loan history, credit report, and the like. The target user behavior can also include transaction behavior of the target user and the like. The target user behavior is compared with the pre-set standard abnormal behavior to determine whether the target user behavior is an abnormal behavior. For example, the standard abnormal behavior includes frequent large amount of transfer at night, and recent multiple loan application records. If the target user behavior includes "high frequency of large amount of transfer at night higher than a preset threshold value" and "the number of loan application records exceeds a preset number threshold value", it can be determined that the target user behavior is abnormal.

[0036] The standard abnormal behavior can be obtained in advance through S201-S206. In S201, the historical user behavior set can include various historical user behaviors, such as credit records, loan histories, credit reports, social and economic conditions, and Internet financial transaction behaviors. In one possible embodiment, the user identifier can be stored in the historical behavior database in correspondence with the user behavior. The storage can be performed after the user generates the behavior in the APP or webpage, or the user identifier and the corresponding user behavior can be stored according to a preset storage period. When the historical user behavior set is needed, the full data of the historical behavior database can be obtained to form the historical user behavior set.

[0037] Based on the historical user behavior set, exploratory data analysis (EDA) can be performed on the historical user behavior. Specifically, the coverage rate, information value (IV), group stability index (PSI), variance, and 25%, 50%, and 75% quantiles of the historical user behavior can be calculated. For categorical features, the distribution of high-frequency categories can also be counted. For example, for occupation, education, marital status, etc., the distribution of each type can be counted, such as the distribution of high school and below, junior college, undergraduate, master's degree and above.

[0038] Based on the analysis results of each historical user behavior, the historical user behavior set can be filtered according to a preset index threshold. The preset index threshold can be set for different index types, such as setting the coverage rate to be greater than 60% to ensure feature integrity, the IV value to be greater than 0.02 to ensure prediction ability, and the PSI to be less than 0.05 to maintain time stability. At the same time, the feature is required to have a non-zero variance and the quantile shows a significant difference. For ease of description, the preset index threshold can be referred to as the first index threshold.

[0039] Based on the first index threshold, a batch of high-quality features can be filtered out from the initial feature pool to form an initial high-quality feature pool, providing a reliable feature basis for subsequent model optimization.

[0040] For the initial feature pool, it can be divided into an initial training set and an initial test set. The AUC difference between the initial training set and the initial test set is not more than 0.02, so as to ensure that the model does not have overfitting phenomenon. AUC (Area Under the ROC Curve) is the area under the ROC curve. The closer the AUC is to 1, the stronger the model's ranking ability for all samples.

[0041] In one possible embodiment, the initial training set and the initial test set can be determined through the following steps: S231, determine a starting training set and a starting test set based on the initial feature pool, and perform initial model training based on the starting training set and the starting test set; S232, in the case of overfitting of the initial model, remove the feature with the highest importance ranking from the starting training set and the starting test set, and return to the step of performing initial model training based on the starting training set and the starting test set until a preset training end condition is reached, and determine the current training set and test set as the initial training set and the initial test set.

[0042] In S231, features can be randomly selected from the initial feature pool to form the starting training set and the starting test set, and a model can be trained based on the starting training set and the starting test set. The model can be any model such as a tree model. When the model overfits, the feature with the highest importance ranking in the starting training set and the starting test set can be removed first.

[0043] In a tree model, the gain according to the structure score is calculated to select which feature as a split point, and the importance of a feature is the sum of the number of times it appears in all trees. That is, the more an attribute is used to construct a decision tree in a model, the higher its importance. That is, the importance of a feature is the number of times the feature is used as a division attribute in all trees. That is, the number of times the feature is used when the sub-tree model is split.

[0044] After removing the feature with the highest importance ranking, the model can be retrained based on the current starting training set and the starting test set. Repeat the above steps until a preset training end condition is reached. The preset training end condition can be that the model no longer overfits, or the number of cycles reaches a preset number.

[0045] Through this cyclic optimization, the generalization performance of the model is gradually improved. The feature combination retained after screening will be used as the benchmark for initializing the population of the genetic algorithm. Then the optimal feature combination can be obtained based on the initial training set and the initial test set by the genetic algorithm.

[0046] During the optimization process of the genetic algorithm, a dynamic updating strategy can be used to determine the optimal feature combination. In one possible embodiment, the optimal feature combination can be determined by the following steps: S241, based on the initial training set and the initial test set, perform genetic evolution operations on each feature in the initial feature pool to obtain multiple training set-test set combinations until a preset evolution stop condition is reached; wherein the genetic evolution operations include selection, crossover and mutation; S242, determine the training set-test set combination with the highest AUC value as the optimal feature combination.

[0047] The genetic evolution operation can include selection, crossover and mutation, wherein the selection refers to selecting features from the initial feature pool to join the initial training set and / or the initial test set, the crossover refers to combining features in different feature combinations, and the mutation refers to randomly modifying the features. The maximum AUC value can be recorded during the genetic evolution process, the initial value of the maximum AUC value can be the AUC value of the initial training set and the initial test set, after obtaining the training set-test set combination through the genetic evolution operation, the AUC value of the combination can be calculated, the AUC value of the combination is the sum of the AUC values of the training set and the test set in the combination. And compare the AUC value of the obtained combination with the current maximum AUC value, if it is greater than the current maximum AUC value, update the maximum AUC value with the AUC value of the combination. If the AUC value of the obtained combination is not greater than the current AUC value, the maximum AUC value does not need to be updated.

[0048] When the preset evolution stop condition is reached, the training set-test set combination corresponding to the current maximum AUC value can be determined as the optimal feature combination. The preset evolution stop condition can be that the number of iterations reaches a preset number of iterations.

[0049] Through the above technical solutions, through genetic operations such as selection, crossover and mutation, new schemes that can exceed the initial equilibrium model feature combination are systematically explored. In the entire evolution process, the elite individual (i.e., the feature combination with the optimal AUC value) is always retained, and is finally output as the benchmark model. This design not only ensures the continuous optimization of the model performance, but also maintains the convergence efficiency of the algorithm.

[0050] Because a relatively strict screening standard is used in the initial stage to construct a benchmark model with global sorting capability, these standards ensure the stability of the model, but may miss some features that can identify a small number of fraudulent samples. Therefore, the coverage of the high-quality feature pool can be expanded, and the above method can further include: Determine the historical user behaviors that meet the preset second indicator threshold value in the set of historical user behaviors to join the initial feature pool to obtain an expanded feature pool; the preset second indicator threshold value is less than the first indicator threshold value.

[0051] The range of the preset second indicator threshold value is more relaxed than the first indicator threshold value, that is, the threshold values of the coverage, IV value and PSI are adjusted to relatively relaxed standards, which can screen out features that meet the preset second indicator threshold value but do not meet the first indicator threshold value to add to the initial feature pool to obtain an expanded feature pool, so that more potential valuable features enter the candidate pool.

[0052] The optimal feature combination can be updated based on the expanded feature pool, and in one possible embodiment, the optimal feature combination can be updated in a bidirectional recursive manner. Specifically, the optimal feature combination can be updated through the following steps: S251. Traverse the expanded feature pool and calculate the Lift index of the optimal feature combination before and after each supplementary feature in the expanded feature pool is added to the optimal feature combination. S252. When the Lift index is improved, determine to add the supplementary feature to obtain the supplementary feature combination; S253. Traverse the supplemented feature combination and calculate the Lift index of the supplemented feature combination before and after the deletion of each feature in the supplemented feature combination; S254. If the Lift metric is improved, delete the feature to obtain the target feature combination.

[0053] Lift is calculated as the target event rate of the model selection group divided by the global target event rate. In this embodiment, the target event can be abnormal behavior. When expanding the optimal feature pool, features are first added by traversing the expanded feature pool. New features are adopted only when the Lift values ​​of both the training and test sets increase simultaneously. After traversing the expanded feature pool, the process moves to the feature deletion phase. During the deletion phase, the supplemented feature combinations are traversed, and deletion is performed only when removing a feature causes a simultaneous increase in the Lift values ​​of both datasets, until all features in the expanded feature combinations have been traversed.

[0054] The optimization process, which involves adding features first and then deleting them, is repeated cyclically. The termination condition can be set to reach the maximum number of iterations or if multiple consecutive operations fail to improve the Lift value. Through this rigorous synchronous verification mechanism, the final selected feature combinations can most accurately identify the behavioral patterns of fraudulent users, while ensuring that the model has good generalization performance.

[0055] After determining the final features to be used in the model, these features and their importance analysis can be input into the larger model, allowing the model to help us summarize the typical characteristics of fraudulent users. For example, the larger model can analyze patterns such as "users who frequently make large transfers late at night and have multiple recent loan application records are of higher risk." This method allows us to more intuitively understand the behavioral patterns of fraudulent users, providing a reference for risk prevention and control.

[0056] like Figure 3 As shown, Figure 3 Another flowchart illustrating the abnormal behavior recognition method provided in this embodiment of the invention may include the following steps: The initial data in the credit acquisition scene, such as the occupation, income, credit record, APP behavior and various characteristics of the user, is obtained, and the original characteristics are preliminarily filtered. Specifically, the judgment condition is IV >= a, PSI <= b and coverage rate >= c, wherein IV (information value) measures the ability of the characteristic to distinguish positive / negative examples, the higher the IV, the better the characteristic; PSI (group stability index) measures the distribution stability of the characteristic at different times / groups, the lower the PSI, the more stable; the coverage rate is the proportion of non-missing samples of the characteristic, to ensure that the characteristic covers most users. If the condition is met, it enters the pool of high-quality characteristics, otherwise the characteristic is eliminated.

[0057] The genetic algorithm is used to screen the optimal feature subset, avoid feature redundancy, and improve the model effect. Specifically, based on the pool of high-quality characteristics, an initial model is constructed, the feature combination is coded as an individual, and an initial population is generated. Genetic algorithm optimization includes selection, retaining feature combinations with good model effect; crossover, combining the genes of two high-quality feature combinations; mutation, randomly adjusting the feature combination, directly retaining the best feature combination in each generation, which can be measured by AUC to measure the effect of the feature combination, and the current optimal feature combination is selected.

[0058] Based on the optimal feature combination obtained by the genetic algorithm, the features are further fine-tuned, including training a model using the feature combination selected by the genetic algorithm as a benchmark, supplementing new potential high-quality features, and adding new features to the benchmark combination based on the supplemented features to determine whether the Lift of the training / test set is simultaneously improved; if yes, update the feature combination; otherwise, perform a rollback operation. Remove redundant features from the benchmark combination and check if the effect is decreased.

[0059] After obtaining the updated feature combination, boundary contribution evaluation can be performed to analyze the contribution of each feature to the model boundary and determine whether the termination condition is reached. If yes, output the final feature combination, otherwise return to the recursive feature addition and deletion for further optimization.

[0060] The data of the final feature combination is input into a large model (such as LLM) for further processing, and the risk portrait of the credit user is output for risk control decision, precise marketing, etc.

[0061] The application of the embodiment of the application proposes a hybrid feature selection method that combines genetic algorithm global search and recursive feature addition and deletion optimization. Through the innovative two-stage optimization architecture and dynamic feature pool management mechanism, the accuracy and stability of credit fraud detection are significantly improved.

[0062] Specifically, the application uses a multi-stage threshold adjustment strategy to construct an initial pool of high-quality characteristics with strict standards, and then gradually relaxes the admission conditions to include potential effective features. This mechanism uses coverage rate, IV value and PSI to ensure that the characteristics have predictability, stability and discrimination, effectively solving the problem of ignoring feature synergy in traditional single variable screening.

[0063] Innovatively combining the AUC global ranking ability and the Lift head identification index, the AUC is used as the leading index to ensure the stability of the model in the genetic algorithm stage, and the Lift index is switched to strengthen the identification of high-risk samples in the recursive optimization stage. This dynamic evaluation system overcomes the bias of a single index and realizes the accurate positioning of fraud identification.

[0064] Based on the benchmark feature combination selected by the genetic algorithm, the "first increase and then delete" iterative optimization strategy is used, and the generalization ability of the feature combination is ensured through the synchronous verification mechanism of the training set and the test set (the Lift value must be improved at the same time). The design effectively avoids the sensitivity of the traditional recursive method to the initial conditions, and improves the stability of feature selection.

[0065] Based on the same inventive concept, according to another aspect of the present application, an abnormal behavior identification device is provided, as shown in Figure 4 The device 400 can include: An acquisition module 401 for acquiring target user behavior; A comparison module 402 for comparing the target user behavior with the pre-obtained standard abnormal behavior to determine whether the target user behavior is abnormal behavior; A pre-acquisition module 403 for pre-acquiring the standard abnormal behavior by the following steps: Acquire a set of historical user behaviors; Based on the preset index data of each historical user behavior in the set of historical user behaviors and each first index threshold preset for each preset index data, filter historical user behaviors with preset index data higher than the corresponding first index threshold to form an initial feature pool; Divide each historical user behavior contained in the initial feature pool into an initial training set and an initial test set, wherein the AUC difference between the initial training set and the initial test set does not exceed a preset AUC difference threshold; Use the initial training set and the initial test set as an initial seed, and use a genetic algorithm to determine an optimal feature combination in the initial feature pool; Take the optimal feature combination as a benchmark, filter supplementary features that meet a preset expansion condition in an expanded feature pool to add to the optimal feature combination to obtain a target feature combination; wherein the expanded feature pool is a feature pool obtained by expanding the initial feature pool; Obtain a standard abnormal behavior based on the target feature combination.

[0066] In one possible embodiment, the dividing of each historical user behavior contained in the initial feature pool into an initial training set and an initial test set includes: determine a starting training set and a starting test set based on the initial feature pool, and perform initial model training based on the starting training set and the starting test set; In the case that the initial model is over-fitted, the feature with the highest importance ranking is removed from the starting training set and the starting test set, and the step of performing initial model training based on the starting training set and the starting test set is returned until a preset training end condition is reached, and the current training set and test set are determined as the initial training set and the initial test set; The initial training set and the initial test set are used as initial seeds, and a genetic algorithm is used to determine an optimal feature combination in the initial feature pool, including: Based on the initial training set and the initial test set, genetic evolution operations are performed on each feature in the initial feature pool to obtain a plurality of training set-test set combinations until a preset evolution stop condition is reached; wherein the genetic evolution operations include selection, crossover and mutation; The training set-test set combination with the highest AUC value is determined as the optimal feature combination; The pre-acquisition module is also used to determine historical user behaviors in the historical user behavior set that meet the preset second index threshold value, and add the historical user behaviors to the initial feature pool to obtain an expanded feature pool; the preset second index threshold value is less than the first index threshold value; Based on the optimal feature combination, supplementary features that meet a preset expansion condition are selected from the expanded feature pool and added to the optimal feature combination to obtain a target feature combination, including: The expanded feature pool is traversed, and the Lift index of the optimal feature combination before and after each supplementary feature in the expanded feature pool is added to the optimal feature combination is calculated; In the case that the Lift index is improved, the supplementary feature is determined to be added to obtain a supplemented feature combination; The supplemented feature combination is traversed, and the Lift index of the supplemented feature combination before and after each feature in the supplemented feature combination is deleted is calculated; In the case that the Lift index is improved, the feature is deleted to obtain a target feature combination; The target feature combination is based on the target feature combination to obtain a standard abnormal behavior, including: The target feature combination is output to a large model to obtain a standard abnormal behavior output by the large model.

[0067] In the present application, the collection, storage, use, processing, transmission, provision and disclosure of user personal information comply with relevant laws and regulations, and do not violate public order and good customs.

[0068] The exemplary embodiments of this application further provide an electronic device, comprising: at least one processor; and a memory connected with the at least one processor in communication. The memory stores a computer program capable of being executed by the at least one processor, and the computer program, when executed by the at least one processor, is configured to cause the electronic device to perform the method according to the embodiments of this application.

[0069] The exemplary embodiments of this application further provide a non-transitory computer readable storage medium storing a computer program, wherein the computer program, when executed by a processor of a computer, is configured to cause the computer to perform the method according to the embodiments of this application.

[0070] The exemplary embodiments of this application further provide a computer program product comprising a computer program, wherein the computer program, when executed by a processor of a computer, is configured to cause the computer to perform the method according to the embodiments of this application.

[0071] Reference Figure 5 A block diagram of an electronic device 500 that can be a server or a client of the present application, which is an example of a hardware device that can be applied to aspects of the present application, will now be described. The electronic device is intended to represent various forms of digital electronic computing devices such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computing devices. The electronic device can also represent various forms of mobile devices such as personal digital processing, cellular telephones, smart phones, wearable devices, and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be examples only, and are not meant to limit implementations of the present application described and / or claimed in this document.

[0072] As Figure 5 shown, the electronic device 500 includes a computing unit 501 that can perform various appropriate actions and processes in accordance with a computer program stored in a read-only memory (ROM) 502 or a computer program loaded from a storage unit 508 into a random access memory (RAM) 503. Various programs and data required for the operation of the electronic device 500 can also be stored in the RAM 503. The computing unit 501, the ROM 502, and the RAM 503 are connected to each other through a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0073] A plurality of components in the electronic device 500 are connected to the I / O interface 505, including: an input unit 506, an output unit 507, a storage unit 508, and a communication unit 509. The input unit 506 can be any type of device that can input information to the electronic device 500, and can receive inputted digital or character information, and generate key signal inputs related to user settings and / or function controls of the electronic device. The output unit 507 can be any type of device that can present information, and can include, but is not limited to, a display, a speaker, a video / audio output terminal, a vibrator, and / or a printer. The storage unit 508 can include, but is not limited to, a magnetic disk, an optical disk. The communication unit 509 allows the electronic device 500 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks, and can include, but is not limited to, a modem, a network card, an infrared communication device, a wireless communication transceiver, and / or a chipset, such as a Bluetooth™ device, a WiFi device, a WiMax device, a cellular communication device, and / or the like.

[0074] The computing unit 501 can be various general and / or special purpose processing components having processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The computing unit 501 performs various methods and processes described above. For example, in some embodiments, any of the abnormal behavior identification methods described above can be implemented as a computer software program tangibly embodied in a machine-readable medium, such as the storage unit 508. In some embodiments, part or all of the computer program can be loaded and / or installed onto the electronic device 500 via the ROM 502 and / or the communication unit 509. In some embodiments, the computing unit 501 can be configured to perform any of the abnormal behavior identification methods described above by any other appropriate means, such as by means of firmware.

[0075] Program code for carrying out methods of the present application can be written in any combination of one or more programming languages. The program code can be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the program code, when executed by the processor or controller, produces a means for implementing the functions / operations specified in the flowchart and / or block diagram. The program code can be executed entirely on a machine, partially on a machine, partially on a machine as a stand-alone software package, partially on a machine and partially on a remote machine or entirely on a remote machine or server.

[0076] In the context of the present application, a machine-readable medium can be a tangible medium that can contain or store program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable storage medium can include, but are not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the machine-readable storage medium will include one or more lines of electrical connections, portable computer disks, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or Flash memory), optical fibers, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the foregoing.

[0077] As used in the present application, the terms "machine-readable medium" and "computer- readable medium" refer to any computer program product, apparatus and / or device (e.g., magnetic discs, optical disks, memory, Programmable Logic Devices (PLDs)) used to provide machine instructions and / or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The term "machine-readable signal" refers to any signal that can be used to provide machine instructions and / or data to a programmable processor.

[0078] To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the computer. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0079] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), and the Internet.

[0080] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other.

Claims

1. A method for identifying abnormal behavior, characterized in that, The method includes: Obtain target user behavior; The target user behavior is compared with pre-obtained standard abnormal behaviors to determine whether the target user behavior is abnormal. The standard abnormal behaviors are obtained in advance through the following steps: Get the collection of historical user behavior; Based on the preset indicator data of each historical user behavior in the set of historical user behavior and the preset first indicator thresholds for each preset indicator data, historical user behaviors with preset indicator data higher than the corresponding first indicator thresholds are selected to form an initial feature pool. The historical user behaviors contained in the initial feature pool are divided into an initial training set and an initial test set, wherein the AUC difference between the initial training set and the initial test set does not exceed a preset AUC difference threshold. The initial training set and the initial test set are used as initial seeds, and a genetic algorithm is used to determine the optimal feature combination in the initial feature pool. Based on the optimal feature combination, supplementary features that meet the preset expansion conditions are selected from the expanded feature pool and added to the optimal feature combination to obtain the target feature combination; wherein, the expanded feature pool is a feature pool obtained by expanding the initial feature pool; Standard abnormal behavior is obtained based on the combination of the target features.

2. The method according to claim 1, characterized in that, The step of dividing the historical user behaviors contained in the initial feature pool into an initial training set and an initial test set includes: The initial training set and the initial test set are determined based on the initial feature pool, and the initial model is trained based on the initial training set and the initial test set. If the initial model overfits, the features with the highest importance ranking are removed from the initial training set and the initial test set, and the process of training the initial model based on the initial training set and the initial test set is returned until the preset training termination condition is met, and the current training set and test set are determined as the initial training set and the initial test set.

3. The method according to claim 2, characterized in that, The step of using the initial training set and the initial test set as initial seeds, and using a genetic algorithm to determine the optimal feature combination in the initial feature pool, includes: Based on the initial training set and the initial test set, genetic evolution operations are performed on each feature in the initial feature pool to obtain multiple training set-test set combinations until a preset evolution stopping condition is reached; wherein, the genetic evolution operations include selection, crossover and mutation; The training set-test set combination with the highest AUC value is determined as the optimal feature combination.

4. The method according to claim 1, characterized in that, The method further includes: Historical user behaviors that meet a preset second indicator threshold are identified from the set of historical user behaviors and added to the initial feature pool to obtain an expanded feature pool; the preset second indicator threshold is less than the first indicator threshold.

5. The method according to claim 4, characterized in that, The step of using the optimal feature combination as a benchmark, selecting supplementary features from the expanded feature pool that meet preset expansion conditions and adding them to the optimal feature combination to obtain the target feature combination includes: Traverse the expanded feature pool and calculate the Lift index of the optimal feature combination before and after each supplementary feature in the expanded feature pool is added to the optimal feature combination. When the Lift metric is improved, the supplementary feature is added to obtain the supplementary feature combination. Traverse the supplemented feature combinations and calculate the Lift index of the supplemented feature combinations before and after the deletion of each feature; If the Lift metric is improved, the feature is deleted to obtain the target feature combination.

6. The method according to claim 1, characterized in that, The standard abnormal behavior obtained based on the combination of the target features includes: The target features are combined and output to a large model to obtain the standard abnormal behavior output by the large model.

7. An abnormal behavior recognition device, characterized in that, The device includes: The acquisition module is used to acquire the behavior of the target user; The comparison module is used to compare the target user behavior with pre-obtained standard abnormal behaviors to determine whether the target user behavior is abnormal. The pre-acquisition module is used to pre-acquire the standard abnormal behavior through the following steps: Get the collection of historical user behavior; Based on the preset indicator data of each historical user behavior in the set of historical user behavior and the preset first indicator thresholds for each preset indicator data, historical user behaviors with preset indicator data higher than the corresponding first indicator thresholds are selected to form an initial feature pool. The historical user behaviors contained in the initial feature pool are divided into an initial training set and an initial test set, wherein the AUC difference between the initial training set and the initial test set does not exceed a preset AUC difference threshold. The initial training set and the initial test set are used as initial seeds, and a genetic algorithm is used to determine the optimal feature combination in the initial feature pool. Based on the optimal feature combination, supplementary features that meet the preset expansion conditions are selected from the expanded feature pool and added to the optimal feature combination to obtain the target feature combination; wherein, the expanded feature pool is a feature pool obtained by expanding the initial feature pool; Standard abnormal behavior is obtained based on the combination of the target features.

8. The apparatus according to claim 7, characterized in that, The step of dividing the historical user behaviors contained in the initial feature pool into an initial training set and an initial test set includes: The initial training set and the initial test set are determined based on the initial feature pool, and the initial model is trained based on the initial training set and the initial test set. If the initial model overfits, the features with the highest importance ranking are removed from the initial training set and the initial test set, and the process of training the initial model based on the initial training set and the initial test set is returned until the preset training termination condition is met, and the current training set and test set are determined as the initial training set and the initial test set. The step of using the initial training set and the initial test set as initial seeds, and using a genetic algorithm to determine the optimal feature combination in the initial feature pool, includes: Based on the initial training set and the initial test set, genetic evolution operations are performed on each feature in the initial feature pool to obtain multiple training set-test set combinations until a preset evolution stopping condition is reached; wherein, the genetic evolution operations include selection, crossover and mutation; The training set-test set combination with the highest AUC value is determined as the optimal feature combination. The pre-acquisition module is further configured to determine historical user behaviors that meet the preset second indicator threshold from the historical user behavior set and add them to the initial feature pool to obtain an expanded feature pool; the preset second indicator threshold is less than the first indicator threshold. The step of using the optimal feature combination as a benchmark, selecting supplementary features from the expanded feature pool that meet preset expansion conditions and adding them to the optimal feature combination to obtain the target feature combination includes: Traverse the expanded feature pool and calculate the Lift index of the optimal feature combination before and after each supplementary feature in the expanded feature pool is added to the optimal feature combination. When the Lift metric is improved, the supplementary feature is added to obtain the supplementary feature combination. Traverse the supplemented feature combinations and calculate the Lift index of the supplemented feature combinations before and after the deletion of each feature; If the Lift metric is improved, the feature is deleted to obtain the target feature combination; The standard abnormal behavior obtained based on the combination of the target features includes: The target features are combined and output to a large model to obtain the standard abnormal behavior output by the large model.

9. An electronic device, comprising: processor; as well as Stored program memory, The program includes instructions that, when executed by the processor, cause the processor to perform the method according to any one of claims 1-6.

10. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-6.

Images