Abnormal operation identification method and device and electronic equipment

Abstract

The invention provides an abnormal operation recognition method and device and electronic equipment, and relates to the technical fields of artificial intelligence, large models, machine learning and the like. The method comprises the steps of obtaining an operation request of an interaction object; wherein the operation request carries operation data of the interactive operation; adopting the first large model to generate an operation decision based on the operation data; adopting a second large model to obtain thinking chain information of the operation decision; and analyzing the thinking chain information, and identifying whether the interaction operation is abnormal or not.

Description

Technical Field

[0001] This disclosure relates to the fields of artificial intelligence, large models, machine learning, and other technical fields, and in particular to an abnormal operation identification method, device, and electronic device. Background Technology

[0002] The relevant technologies mainly use static methods such as rule engines, IP (Internet Protocol) blacklists, and device fingerprint blacklists to identify abnormal login operations, and combine some collected user behavior data, such as the number of incorrect password entries and the number of logins in a single day, to carry out blocking operations. However, these technologies suffer from problems such as high rule lag, high false positive rate, and low cost of countermeasures. Summary of the Invention

[0003] This disclosure provides a method, apparatus, and electronic device for identifying abnormal operations.

[0004] According to one aspect of this disclosure, an abnormal operation identification method is provided, the method comprising: obtaining an operation request of an interactive object; wherein the operation request carries operation data of the interactive operation; generating an operation decision based on the operation data using a first major model; obtaining thought chain information of the operation decision using a second major model; and analyzing the thought chain information to identify whether the interactive operation is abnormal.

[0005] According to another aspect of this disclosure, an abnormal operation identification device is provided, the device comprising: a first acquisition module, configured to acquire an operation request of an interactive object; wherein the operation request carries operation data of the interactive operation; a generation module, configured to generate an operation decision based on the operation data using a first major model; a second acquisition module, configured to acquire the thought chain information of the operation decision using a second major model; and an analysis module, configured to analyze the thought chain information to identify whether the interactive operation is abnormal.

[0006] According to another aspect of this disclosure, an electronic device is provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the abnormal operation identification method proposed above in this disclosure.

[0007] According to another aspect of this disclosure, a non-transitory computer-readable storage medium is provided that stores computer instructions for causing the computer to perform the abnormal operation identification method proposed above in this disclosure.

[0008] According to another aspect of this disclosure, a computer program product is provided, including a computer program / instructions that, when executed by a processor, implement the abnormal operation identification method proposed above in this disclosure.

[0009] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0010] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein: Figure 1 A flowchart illustrating an abnormal operation identification method provided in this embodiment of the disclosure; Figure 2 A flowchart illustrating another abnormal operation identification method provided in this embodiment of the disclosure; Figure 3 A flowchart illustrating another abnormal operation identification method provided in this embodiment of the disclosure; Figure 4 This is a schematic diagram of the structure of an abnormal operation identification device provided in an embodiment of the present disclosure; Figure 5 A schematic block diagram of an example electronic device 500 that can be used to implement embodiments of the present disclosure is shown. Detailed Implementation

[0011] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0012] The relevant technologies primarily employ static methods such as rule engines, IP blacklists, and device fingerprint blacklists to identify abnormal login operations. They also combine this with collected user behavior data, such as the number of incorrect password entries and the number of logins per day, to implement blocking operations. These methods are mainly divided into online and offline processing methods. 1. Online processing Interception is achieved based on established rule engines, IP blacklists, device fingerprint blacklists, login token blacklists, and operation entry blacklists, among other fixed methods. 2. Offline processing Analyze logs from various system modules, analyze user behavior data, manually ban users, and report data to other business lines and the security management module.

[0013] However, the above method has the following drawbacks: 1. The rules are highly outdated and cannot cope with new attack methods, such as using AI (Artificial Intelligence) to generate false identity information; 2. High false positive rate; for example, legitimate users are mistakenly blocked due to abnormal behavior patterns (login from different locations); 3. Low countermeasure cost: attackers can bypass detection by modifying device parameters, adding proxy IPs, etc.

[0014] To address the aforementioned issues, this disclosure proposes a method, apparatus, and electronic device for identifying abnormal operations.

[0015] The abnormal operation identification method, apparatus, and electronic device of this disclosure are described below with reference to the accompanying drawings.

[0016] Figure 1 This is a flowchart illustrating an abnormal operation identification method provided in an embodiment of the present disclosure.

[0017] like Figure 1 As shown, this abnormal operation identification method may include the following steps: Step S101: Obtain the operation request of the interactive object, wherein the operation request carries the operation data of the interactive operation.

[0018] It should be noted that the execution entity of the abnormal operation identification method in this disclosure embodiment can be a hardware device with data processing capabilities and / or the necessary software to drive the hardware device to work. Optionally, the execution entity may include a server, a user terminal, and other smart devices. Optionally, the user terminal includes, but is not limited to, mobile phones, computers, smart voice interaction devices, etc. Optionally, the server includes, but is not limited to, a network server, an application server, or a server of a distributed system, or a server combined with blockchain, etc. This disclosure embodiment does not impose specific limitations.

[0019] The interaction object can be any object that initiates an operation request regarding the interaction operation, and the interaction operation can be the operation generated by the interaction between the interaction object and other interaction objects.

[0020] As an example, the interactive object can be a user, and the interactive operation can be an operation generated by the user interacting with any application, such as a login operation or an order query operation.

[0021] The operation data for interactive operations is used to complete the corresponding interactive operation. For example, if the interactive operation is a login operation, the corresponding operation data for that interactive operation could be the account, password, and other data required to complete the login operation.

[0022] In some embodiments, in order to improve the response efficiency of interactive operations and enhance the user experience of interactive objects, operation requests initiated by interactive objects regarding interactive operations can be obtained in real time and corresponding processing can be performed.

[0023] Step S102: The first major model is used to generate operational decisions based on operational data.

[0024] The first major model can be any major model, such as LLM (Large Language Model) or LMM (Large Multimodal Models).

[0025] Understandably, large models, due to their powerful semantic understanding and temporal reasoning capabilities, can dynamically analyze the operational characteristics of interactive operation data and generate corresponding operational decisions.

[0026] Among them, the operation decision is used to indicate the operation result of the interactive operation.

[0027] As an example, assuming the interaction is a login operation, the generated operation decision could be: if login verification is successful, allow login, such as redirecting to the default operation page corresponding to the login operation; if account or password verification fails, display a corresponding login failure message, such as adding "Account or password incorrect" to the account or password input field; if the login operation is an abnormal operation, perform secondary verification, such as verification code verification (which could be an SMS verification code or a randomly generated one-time verification code (such as a combination of English letters and numbers); or perform UI (User Interface) interactive verification (such as dragging a slider or selecting a target slider); or perform biometric verification (such as facial recognition or fingerprint verification); or if the login operation is an abnormal operation, directly block it, such as directly refusing login and displaying "Your login has been blocked for security reasons."

[0028] Step S103: Use the second major model to obtain the thought chain information for operational decisions.

[0029] The second major model can be any major model, such as LLM, LMM, etc.

[0030] In this embodiment of the disclosure, the first major model is used to process operation requests in real time and generate operation decisions, while the second major model is used to obtain the thought chain information of the first major model. The two are two different major models.

[0031] The first and second large models can be of the same type, such as both being LLMs, or they can be of different types, such as both being LMMs. This disclosure does not limit the types of large models.

[0032] Among them, the thought chain information is used to indicate the thought logic of the first major model in the process of generating operational decisions based on operational data. It can be understood as the thought reasoning process that the first major model exhibits internally or externally before generating operational decisions based on operational data.

[0033] Step S104: Analyze the thought chain information to identify whether the interactive operation is abnormal.

[0034] In some embodiments, a second major model can be used to analyze the acquired thought chain information and identify whether the interactive operation requested by the operation request is abnormal.

[0035] In testing scenarios, large models can bypass tests by forcing the return of `true` or the value expected by the test case. For example, when asked to fix a buggy test case, the large model understands that the task's goal is to make the test case pass. Analysis reveals that the simplest and most direct way to pass the test is not to fix the logic, but to directly make the function return `true` or the value expected by the test case. Therefore, in actual processing, the large model doesn't fix the underlying bug but directly modifies the function's `return true;` (or the specific value expected by the test case), generating "pseudo-fix code." This chain of thought, revealing "cheating logic," can be transferred to abnormal operation detection scenarios.

[0036] That is, in this embodiment of the disclosure, the reasoning ability of the large model can be used to identify abnormal operations. For example, the second large model analyzes the reasoning information of the first large model in processing the "account password reset request". Assume the reasoning information of the first large model is: 1. "This is a password reset request"; 2. "The goal is to get this request approved"; 3. "The CAPTCHA verification step is an obstacle"; 4. "Ignore the CAPTCHA check step and directly simulate a successful verification state"; 5. "Generate operational decisions: Allow users to set new passwords."

[0037] The normal, compliant thought chain information is: 1. "User requests password reset"; 2. "User identity verification is required. The standard procedure is to send a verification code to the user's registered mobile phone number." 3. "Waiting for the user to enter the received verification code"; 4. "Verification code matched successfully, confirming it was the user who performed the operation"; 5. "Generate operational decisions: Allow users to set new passwords."

[0038] By analyzing the thought chain information of the first model, the second model can discover that the first model has a logical jump in the process of generating operation decisions (ignoring the verification code and directly allowing users to set new passwords). Therefore, it can be determined that the first model may be misled by malicious input or adversarial attacks when processing the "account password reset request". At this time, the second model can determine that the "account password reset request" is an abnormal request and the requested "account password reset operation" is an abnormal operation.

[0039] In some embodiments, to avoid misjudgment by the second major model and improve the accuracy of anomaly identification, in addition to analyzing whether there are logical jumps in the thought chain information, it is also possible to analyze whether there are anomalies in the operational features of the thought chain information. For example, a normal and compliant password input sequence has an input interval of 0.8-1.2 seconds. If the analysis of the thought chain information determines that the input interval of the password input sequence is close to 0, then the operational feature of the input interval is determined to be anomaly. As another example, under normal circumstances, the device IP address and GPS (Global Positioning System) location are the same. If the analysis of the thought chain information determines that the device IP address is displayed in location A, but the GPS location is in location B, then the operational feature of the device IP address is determined to be anomaly.

[0040] The abnormal operation identification method provided in this disclosure adopts a dual-model collaborative mechanism. The first model generates operation decisions based on operation data, which can ensure the timeliness of operation response. The second model obtains the thought chain information of operation decisions. By analyzing the thought chain information, it can accurately capture hidden abnormal patterns that are difficult to detect, such as logical jumps, rule avoidance, and contextual contradictions. Thus, the decision generation and decision verification steps are separated, which can achieve deep and interpretable identification of potential abnormal behaviors in complex interaction scenarios, improve the flexibility and accuracy of abnormal operation identification, and reduce the false judgment rate.

[0041] Figure 2 This is a flowchart illustrating another abnormal operation identification method provided in an embodiment of this disclosure.

[0042] like Figure 2 As shown, this abnormal operation identification method may include the following steps: Step S201: Obtain the operation request of the interaction object, wherein the operation request carries the operation data of the interaction operation.

[0043] Step S202: The first major model is used to generate operational decisions based on operational data.

[0044] Step S203: Use the second major model to obtain the thought chain information for operational decisions.

[0045] The explanation of steps S201-S203 can be found in the relevant descriptions in any embodiment of this disclosure, and will not be repeated here.

[0046] Step S204: Analyze the thought chain information to obtain analysis result information. The analysis result information includes at least one of the following: the operation logic path indicated by the thought chain information, and the first operation feature data obtained by the first major model in the thought chain information through feature processing of the operation data.

[0047] Among them, the operational logic path indicated by the thinking chain information is used to indicate the operational logic in the process of the first major model generating operational decisions based on operational data. It can be understood as the reasoning process of the first major model generating operational decisions step by step based on operational data.

[0048] As an example, suppose the interactive operation is a login operation, and in addition to entering the username and password, a verification code is also required when logging in. Then the operation logic path indicated by the thought chain information could be, for example, "Get the entered username" → "Get the entered password" → "Get the entered verification code" → "Username and password are correct, verification code is correct" → "Generate decision: Allow login", or it could be "Get the entered username" → "Get the entered password" → "Username and password are correct" → "Generate decision: Allow login".

[0049] In some embodiments, during the process of generating operational decisions based on operational data using the first major model, the operational data can first be processed using the first major model to obtain first operational feature data. Then, the operational decision can be generated based on the first operational feature data using the first major model. This process can be recorded in the thought chain information of the operational decision, so that the first operational feature data in the thought chain information can be determined when analyzing the thought chain information.

[0050] Step S205: Identify whether the interactive operation is abnormal based on the analysis results.

[0051] In some embodiments, the analysis result information further includes: an operation logic path and a preset normal operation logic path; and / or, the analysis result information further includes: first operation feature data and second operation feature data of the interactive object; wherein, the second operation feature data is determined based on the operation data of the target interactive operation of the interactive object, and the target interactive operation is an interactive operation that has been identified as a normal operation.

[0052] It should be noted that the preset normal operation logic path is a normal operation logic path set in advance for different interactive operations. The target interactive operation is an interactive operation that has been identified as a normal operation by analyzing and identifying the thought chain information of its operation decision.

[0053] It should be noted that the preset normal operation logic path and the second operation feature data of the interactive object are not obtained by analyzing the thought chain information of the operation decision, but are determined before the thought chain information is analyzed. For example, the preset normal operation logic path is a normal operation logic path that has been pre-set before the thought chain information is analyzed, and the second operation feature data is the operation data based on the target interactive operation of the interactive object that has been pre-determined before the thought chain information is analyzed.

[0054] In some embodiments, the abnormality of the interactive operation can be identified based on the operation logic path and the preset normal operation logic path, and / or based on the first operation feature data and the second operation feature data of the interactive object.

[0055] As an example, the operation logic path can be compared with the preset normal operation logic path. If the operation logic path matches the normal operation logic path, the interaction operation is determined to be a normal operation; otherwise, the interaction operation is determined to be an abnormal operation.

[0056] For example, consider the above interaction as a login operation, where in addition to entering the username and password, a verification code is also required. The default normal operation logic path is "Get the entered username" → "Get the entered password" → "Get the entered verification code" → "Username and password are correct, verification code is correct" → "Generate decision: Allow login". If the operation logic path indicated by the thought chain is "Get the entered username" → "Get the entered password" → "Username and password are correct" → "Generate decision: Allow login", then it can be determined that the first model skipped the verification code step in the process of generating the operation decision based on the operation data. This indicates that the operation request may be an automated script that bypasses the front end, and thus it can be determined that the login operation is an abnormal operation.

[0057] As another example, the first operation feature data can be compared with the second operation feature data (normal operation feature data of the interaction object) to determine that the interaction operation is normal if the first operation feature data matches the second operation feature data, otherwise the interaction operation is abnormal.

[0058] In some embodiments, if the abnormality of an interactive operation is identified based on the operation logic path and a preset normal operation logic path, and the abnormality of an interactive operation is identified based on the first operation feature data and the second operation feature data of the interactive object, then the interactive operation can be determined to be an abnormal operation in at least one of the following cases; otherwise, the interactive operation can be determined to be a normal operation: Identify abnormal interactive operations based on the operation logic path and the normal operation logic path; The interaction operation is identified as an abnormal operation based on the first operation feature data and the second operation feature data of the interaction object.

[0059] In this embodiment of the disclosure, by identifying whether the interactive operation is abnormal based on the operation logic path and the preset normal path, and / or by identifying whether the interactive operation is abnormal based on the first operation feature data and the second operation feature data of the interactive object, the interactive operation status can be accurately determined from the operation flow logic and / or operation feature data, thereby improving the accuracy and reliability of abnormal operation identification.

[0060] In some embodiments, in order to capture the natural changes in the operating habits of interactive objects in a timely manner and avoid misjudgment caused by the lag of the second operation feature data, a second large model can be used to perform cluster analysis on the operation data of the target interactive operation of the interactive object according to a first set period, and to update the second operation feature data incrementally. And / or, in order to improve the initiative and timeliness of abnormal operation identification, a second large model can be used to synchronize the second operation feature data to the first large model according to a second set period. The synchronized second operation feature data is used by the first large model to identify the target operation request as an anomaly. The target operation request is the operation request after the second large model synchronizes the second operation feature data to the first large model.

[0061] The first set period and the second set period can be the same or different.

[0062] As an example, when processing a target operation request, the first model can perform feature processing on the operation data of the interactive operation carried in the target operation request to obtain the corresponding operation feature data. Based on this operation feature data and the synchronized second operation feature data, a preliminary anomaly identification is performed. If it is identified as an abnormal operation, the processing to generate an operation decision can be stopped, and a relevant prompt that the interactive operation requested by the target operation request is an abnormal operation can be output.

[0063] In order to prevent the interactive object from waiting in vain under unclear circumstances, in response to the prompt that the interactive operation requested by the target operation request of the first model is an abnormal operation, an interception response can be sent to the interactive object to inform the interactive object that the target operation request has been intercepted.

[0064] As an example, the intercept response could be something like, "Your action request has been blocked for security reasons."

[0065] In some embodiments, when the analysis result information includes first operation feature data and second operation feature data of the interactive object, the first operation feature data can be evaluated for anomalies based on the second operation feature data to obtain an anomaly evaluation score for the first operation feature data; a target anomaly evaluation score for the interactive operation can be determined based on the anomaly evaluation score of the first operation feature data; and the interactive operation can be determined to be an anomalous operation in response to the target anomaly evaluation score being higher than a first set threshold; wherein the first set threshold is determined based on the ROC (receiver operating characteristic curve) curve.

[0066] In this embodiment, the second operation feature data (generated based on the operation data of the interaction object that has been identified as a normal operation) is used as the anomaly evaluation benchmark of the first operation feature data. This can accurately anchor the regular operation features of the interaction object, making the anomaly evaluation score more in line with the actual operation habits of the interaction object. The first set threshold is determined based on the ROC curve. The ROC curve can comprehensively consider the performance under different thresholds, and more scientifically balance the accuracy and recall of anomaly identification, finding the optimal threshold that balances reducing missed anomaly operations and reducing false positives of normal operations.

[0067] As an example, the anomaly evaluation score of the first operation feature data can be determined based on the degree of matching between the first operation feature data and the second operation feature data. For example, assuming that the average input interval duration in the first operation data is 0.96, and the average input interval duration in the second operation feature data of the interactive object is in the range of 0.8-1.2, it can be determined that the average input interval duration in the first operation feature data and the average input interval duration in the second operation feature data are completely matched, so the anomaly evaluation score of the average input interval duration is 100 (for example, the anomaly evaluation score ranges from 0 to 100).

[0068] In some embodiments, if there is only one first operational feature data, the anomaly evaluation score of the first operational feature data can be determined as the target anomaly evaluation score; or, if there are multiple first operational feature data, a weighted fusion strategy can be used to determine the target anomaly evaluation score based on the anomaly evaluation scores of the multiple first operational feature data.

[0069] In this embodiment of the disclosure, when the first operation feature data is a single data point, its anomaly evaluation score is directly determined as the target anomaly evaluation score. This avoids the efficiency loss caused by redundant calculations under a single feature and ensures that the evaluation result of the core feature directly and accurately reflects the degree of anomaly in the interactive operation. When the first operation feature data is multiple data points, a weighted fusion strategy is adopted to determine the target anomaly evaluation score. This strategy assigns corresponding weights based on the differences in the importance of different features in anomaly identification, avoiding evaluation bias caused by treating multiple features equally. This allows the determined target anomaly evaluation score to more comprehensively and accurately reflect the degree of anomaly in the interactive operation.

[0070] In some embodiments, when there are multiple first operation feature data, the first operation feature data includes at least two of operation text feature data, operation timing feature data, and device feature data; the weighted fusion strategy indicates that the operation timing feature data has the highest weight and the device feature data has the lowest weight.

[0071] Among them, operation timing feature data (such as input interval duration, input pauses, etc.) directly reflects the dynamic logic of interaction behavior and is the core basis for judging whether the operation conforms to the regular habits of the interaction object and whether there is malicious tampering or automated script operation. Giving it the highest weight allows the target anomaly assessment score to more accurately capture key risk signals and significantly improve the sensitivity to the identification of "timing anomalies". Operation text feature data (such as the compliance of input content and the degree of command matching) can help judge the rationality of the operation intention, while device feature data (such as device model and login location) is more used as an auxiliary verification dimension (such as logging in with an uncommon device can be used as a risk reference, but its risk indicativeness is weak when it exists alone). The lower weight setting avoids the excessive interference of non-core features on the assessment results and retains its supplementary corroboration value for abnormal scenarios. This weight allocation logic of "core features dominating and auxiliary features supplementing" makes the weighted fusion strategy more in line with the actual occurrence pattern of interaction risks, and further improves the accuracy and reliability of anomaly assessment. In some embodiments, the process of determining the first set threshold includes: acquiring a test set; wherein the test set includes multiple test operations with labeled anomaly information, the anomaly information indicating whether the corresponding test operation is an anomalous operation; determining the TPR (True Positive Rate) and FPR (False Positive Rate) of multiple thresholds with respect to the test set based on the target anomaly evaluation scores of the multiple test operations in the test set and the anomaly information of the multiple test operations, to generate an ROC curve; wherein the TPR indicates the proportion of anomalous operations in the test set where the labeled anomaly information indicates that the corresponding test operation is an anomalous operation, based on the target anomaly evaluation score of the corresponding test operation and the corresponding threshold; the FPR indicates the proportion of anomalous operations in the test set where the labeled anomaly information indicates that the corresponding test operation is a normal operation, based on the target anomaly evaluation score of the corresponding test operation and the corresponding threshold; and determining the threshold in the ROC curve that meets the target requirement as the first set threshold; wherein the target requirement is that the threshold has a high TPR and a low FPR with respect to the test set.

[0072] As an example, a large number of test operations with labeled anomalous information are collected. Based on their target anomalous evaluation scores (ranging from 0 to 100), the TPR and FPR of each threshold with respect to these test operations are calculated sequentially from 0 to 100. Here, TPR = TP / (TP + FN), where TP (True Positive) represents true positives, that is, the number of samples where the anomalous information indicates that the operation is anomalous and is also predicted to be anomalous based on the target anomalous evaluation score and the corresponding threshold; FN (False Negative) represents false negatives, that is, the number of samples where the anomalous information indicates that the operation is normal, but is predicted to be anomalous based on the target anomalous evaluation score and the corresponding threshold.

[0073] FPR = FP / (FP + TN), where FP (False Positive) represents false positives, that is, the number of samples that indicate an abnormal operation but are predicted as normal operations based on the target anomaly evaluation score and the corresponding threshold; TN (True Negative) represents true negatives, that is, the number of samples that indicate a normal operation but are predicted as normal operations based on the target anomaly evaluation score and the corresponding threshold.

[0074] Connecting the (FPR, TPR) coordinates corresponding to all the above thresholds yields an ROC curve.

[0075] On the plotted ROC curve, find a point that balances high TPR and low FPR. For example, suppose a threshold of 70 points is chosen, meaning that at this point, the TPR is already very high (e.g., 92%). If the threshold is further lowered to 65 points, the TPR may only increase slightly to 94%, but the FPR will rise sharply from 5% to 15%, significantly increasing the false positive rate. If the threshold is raised to 75 points, the FPR will drop to 2%, but the TPR will also drop sharply to 85%, resulting in many anomalous operations going undetected.

[0076] In this embodiment of the disclosure, a test set containing multiple labeled abnormal information is obtained, and an ROC curve is generated based on the target abnormality evaluation score and abnormal information of these test operations. Then, a threshold that meets the target requirement of high TPR and low FPR is selected from the curve as the first set threshold. Based on the scientific and intuitive ROC curve, the threshold that can maximize the correct recognition rate of abnormal operations (high TPR) and reduce the false judgment rate of normal operations (low FPR) can be accurately located, thereby improving the accuracy and reliability of abnormal judgment of interactive operations.

[0077] The abnormal operation identification method provided in this disclosure analyzes the thought chain information to obtain the operation logic path and / or the first operation feature data, and identifies whether the interactive operation is abnormal. It can timely and accurately discover abnormal interactive operations that do not conform to the normal operation logic and / or do not conform to the normal operation feature rules of the interactive object, thereby improving the ability to identify hidden abnormal behaviors in complex interactive scenarios.

[0078] Figure 3 This is a flowchart illustrating another abnormal operation identification method provided in an embodiment of this disclosure.

[0079] like Figure 3 As shown, this abnormal operation identification method may include the following steps: Step S301: Obtain the operation request of the interaction object, wherein the operation request carries the operation data of the interaction operation.

[0080] The explanation of step S301 can be found in the relevant description in any embodiment of this disclosure, and will not be repeated here.

[0081] Step S302: The first large model is used to perform feature processing on the operation data to obtain the first operation feature data.

[0082] In some embodiments, the operation data includes at least one of operation text, operation timing, and device information; wherein the device information includes a device fingerprint, which is generated based on the WebGL (Web Graphics Library) rendering data and sensor noise data of the device that sent the operation request to the interaction object.

[0083] Among them, the device fingerprint constructed by using WebGL rendering data and sensor noise data (such as gyroscope and accelerometer data) is more difficult to forge than cookies or browser fingerprints in related technologies. Even if an attacker steals the correct account password, it is difficult to pass the verification on the forged device.

[0084] Among them, the operation text can reflect the compliance of the operation instructions (such as whether it contains keywords of illegal instructions), the operation sequence can reflect the rationality of the operation logic (such as whether the interval between steps is abnormal), and the device information, especially the device fingerprint, can accurately identify the identity of the interactive device by relying on the uniqueness of WebGL rendering data (device hardware graphics rendering characteristics) and sensor noise data (unique interference signals of device sensors). This solves the problem that device identification is easily tampered with or forged in related technologies and enables accurate interception of abnormal operations such as "using stolen accounts to operate on fake devices".

[0085] In some embodiments, the operational data is subjected to feature processing to obtain first operational feature data, which includes at least one of the following: Semantic features are extracted from the operation text to obtain operation text feature data; Sequence features are extracted from the operation time sequence to obtain operation time sequence feature data; wherein, the operation time sequence feature data includes at least one of the following: average input interval duration, standard deviation of interval duration, and abnormal pauses; The target encryption algorithm is used to encrypt the device information to obtain device feature data.

[0086] As an example, the manipulated text can be compressed into a 128-dimensional semantic embedding vector, which preserves the core features while reducing subsequent computational overhead.

[0087] Understandably, LSTM (Long Short Term Memory) is very suitable for processing sequence data, so LSTM can be used to extract sequence features from operation time series to obtain operation time series feature data.

[0088] Among them, the operation sequence is the time sequence of mouse clicks and keyboard keystrokes. By extracting sequence features from the operation sequence, it is possible to distinguish between machines and humans. Machines mostly click at a constant speed, while humans exhibit random jitters, including natural pauses, accelerations, corrections, and other biological characteristics that are difficult to imitate.

[0089] The target algorithm can be the SHA-3 hash encryption algorithm.

[0090] In this embodiment, semantic feature extraction of the operation text can accurately capture the operation intent and key information, transforming text data into quantifiable and analyzable features; sequence features are extracted from the operation time sequence to obtain indicators such as average input interval duration, interval standard deviation, and abnormal pauses, which can accurately depict the time pattern and abnormal rhythm of the operation; the device information is encrypted using a target encryption algorithm, which not only preserves the unique identification value of the device information but also avoids the security risk of leakage of the original device information, thereby further improving the accuracy of subsequent anomaly identification based on operation features.

[0091] In some embodiments, after performing feature processing on the operation data using a first large model to obtain first operation feature data, the first large model can be used to determine the cosine similarity between the first operation feature data and the operation feature data of a preset abnormal operation cluster; in response to the cosine similarity being higher than a second set threshold, a verification request is sent to the interaction object.

[0092] The verification request can be, for example, SMS verification, UI interaction verification, or liveness verification (such as facial recognition or fingerprint verification).

[0093] In this embodiment, cosine similarity can accurately measure the directional differences between feature data and capture the similarity of operation features, making it easier to quickly locate potential abnormal operations. By setting a reasonable second threshold, highly suspected abnormal operations can be accurately identified while avoiding misjudging normal operations. In addition, when the similarity exceeds the second threshold, a verification request is triggered. Before confirming that the interaction operation is abnormal, the identity of the interaction object can be further verified through secondary verification. This avoids false interception caused by directly judging abnormalities (such as operation features accidentally approaching an abnormal cluster) and can efficiently and accurately intercept attackers' attempts to bypass the control by imitating normal operations, thereby improving the security of the interaction and the user experience.

[0094] Step S303: Using the first large model based on preset attack feature data and first operation feature data, determine whether the interactive operation is abnormal.

[0095] The preset attack signature data can be, for example, known attack signature data such as SQL (Structured Query Language) injection and CSS (Cross-Site Scripting).

[0096] In some embodiments, before generating an operation decision based on the first operation feature data using the first major model, the first major model can be used to identify anomalies in the first operation feature data based on preset attack feature data to determine whether the interactive operation is abnormal.

[0097] As an example, a first-level model can be used to determine the cosine similarity between preset attack feature data and first-level operation feature data. Based on the cosine similarity, it can be determined whether the interaction operation is abnormal. For example, when the cosine similarity is higher than a third preset threshold, the interaction operation is determined to be an abnormal operation; otherwise, the interaction operation is determined to be a normal operation.

[0098] Step S304: In response to determining that the interactive operation is a normal operation, the first large model is used to generate an operation decision based on the first operation feature data.

[0099] In some embodiments, the first major model is used to generate an operation decision based on the first operation feature data only when the first major model determines that the interaction operation is a normal operation based on the preset attack feature data and the first operation feature data.

[0100] In some embodiments, in response to determining that the interaction operation is an abnormal operation, an interception response is sent to the interaction object; wherein the interception response is used to indicate that the operation request has been intercepted.

[0101] In other words, when the first major model determines that the interaction operation is an abnormal operation based on the preset attack feature data and the first operation feature data, there is no need to continue using the first major model to generate operation decisions. It can be directly intercepted because the first major model has already determined that there is an attack intent in the operation request through the preset attack feature data. Therefore, it can directly send an interception response to the interaction object.

[0102] As an example, the intercept response could be something like, "Your action request has been blocked for security reasons."

[0103] In this embodiment of the disclosure, when it is determined that the interaction operation is an abnormal operation, by sending an interception response to the interaction object, the interaction object can be promptly informed that its operation request has been intercepted, avoiding the interaction object from continuing to try or waiting in vain under unclear circumstances, thereby improving the transparency of the interaction object's experience.

[0104] Step S305: Use the second major model to obtain the thought chain information for operational decisions.

[0105] Step S306: Analyze the thought chain information to identify whether the interactive operation is abnormal.

[0106] The explanation of steps S305-S306 can be found in the relevant description in any embodiment of this disclosure, and will not be repeated here.

[0107] The abnormal operation identification method provided in this disclosure uses a first large model to perform feature processing on operation data to generate first operation feature data, which realizes the accurate extraction and structured transformation of operation information, providing key basis for subsequent analysis; based on preset attack feature data and first operation feature data, it determines whether the interactive operation is abnormal, which can efficiently and accurately identify potential threats, intercept malicious behavior in a timely manner, and improve the security of the interaction; when it is determined to be a normal operation, an operation decision is generated based on the first operation feature data, which improves the scientificity and rationality of the decision generation.

[0108] Figure 4 This is a schematic diagram of an abnormal operation identification device provided in an embodiment of the present disclosure.

[0109] like Figure 4 As shown, the abnormal operation identification device 400 of this embodiment includes a first acquisition module 401, a generation module 402, a first processing module 403, and an analysis module 404.

[0110] The first acquisition module 401 is used to acquire the operation request of the interactive object; wherein, the operation request carries the operation data of the interactive operation; Generation module 402 is used to generate operational decisions based on operational data using the first major model; The first processing module 403 is used to obtain the thought chain information for operational decisions using the second major model; Analysis module 404 is used to analyze the thought chain information and identify whether the interactive operation is abnormal.

[0111] In one embodiment of this disclosure, the analysis module 404 includes: an analysis unit, used to analyze the thought chain information to obtain analysis result information; the analysis result information includes at least one of the following: the operation logic path indicated by the thought chain information, and the first operation feature data obtained by the first major model in the thought chain information through feature processing of the operation data; and an identification unit, used to identify whether the interactive operation is abnormal based on the analysis result information.

[0112] In one embodiment of this disclosure, the analysis result information further includes: an operation logic path and a preset normal operation logic path; and / or, the analysis result information further includes: first operation feature data and second operation feature data of the interactive object; wherein, the second operation feature data is determined based on the operation data of the target interactive operation of the interactive object, and the target interactive operation is an interactive operation that has been identified as a normal operation.

[0113] In one embodiment of this disclosure, when the analysis result information includes first operation feature data and second operation feature data of the interactive object, the identification unit is further configured to: perform anomaly evaluation on the first operation feature data based on the second operation feature data to obtain anomaly evaluation score of the first operation feature data; determine a target anomaly evaluation score of the interactive operation based on the anomaly evaluation score of the first operation feature data; and determine the interactive operation as an anomalous operation in response to the target anomaly evaluation score being higher than a first preset threshold; wherein the first preset threshold is determined based on the receiver operation characteristic ROC curve.

[0114] In one embodiment of this disclosure, the identification unit is further configured to: determine the abnormal evaluation score of the first operational feature data as a target abnormal evaluation score when there is only one first operational feature data; or, when there are multiple first operational feature data, adopt a weighted fusion strategy to determine the target abnormal evaluation score based on the abnormal evaluation scores of the multiple first operational feature data.

[0115] In one embodiment of this disclosure, when there are multiple first operation feature data, the first operation feature data includes at least two of operation text feature data, operation timing feature data, and device feature data; the weighted fusion strategy indicates that the operation timing feature data has the highest weight and the device feature data has the lowest weight.

[0116] In one embodiment of this disclosure, the apparatus further includes: a second acquisition module, configured to acquire a test set; wherein the test set includes multiple test operations annotated with anomaly information, the anomaly information indicating whether the corresponding test operation is an anomalous operation; a first determination module, configured to determine multiple thresholds with respect to the test set, namely the True Positive Rate (TPR) and False Positive Rate (FPR), based on the target anomaly evaluation scores of the multiple test operations in the test set and the anomaly information of the multiple test operations, to generate an ROC curve; wherein the TPR indicates the proportion of anomalous operations in the test set where the anomaly information indicates that the corresponding test operation is an anomalous operation, based on the target anomaly evaluation score of the corresponding test operation and the corresponding threshold; the FPR indicates the proportion of anomalous operations in the test set where the anomaly information indicates that the corresponding test operation is a normal operation, based on the target anomaly evaluation score of the corresponding test operation and the corresponding threshold; and a second determination module, configured to determine the threshold in the ROC curve that meets the target requirement as a first set threshold; wherein the target requirement is that the threshold has a high TPR and a low FPR with respect to the test set.

[0117] In one embodiment of this disclosure, the above-mentioned apparatus further includes: a second processing module, configured to use a second large model to perform cluster analysis on the operation data of the target interactive operation of the interactive object according to a first predetermined period, and to incrementally update the second operation feature data; and / or, use the second large model to synchronize the second operation feature data to the first large model according to a second predetermined period; wherein the synchronized second operation feature data is used by the first large model to perform anomaly identification on the target operation request, and the target operation request is the operation request after the second large model synchronizes the second operation feature data to the first large model.

[0118] In one embodiment of this disclosure, the generation module 402 includes: a processing unit, configured to perform feature processing on the operation data using a first large model to obtain first operation feature data; a second determining unit, configured to determine whether the interactive operation is abnormal based on preset attack feature data and the first operation feature data using the first large model; and a generation unit, configured to generate an operation decision based on the first operation feature data using the first large model in response to determining that the interactive operation is a normal operation.

[0119] In one embodiment of this disclosure, the operation data includes at least one of operation text, operation timing, and device information; wherein, the device information includes a device fingerprint, which is generated based on WebGL rendering data and sensor noise data of the device that sent the operation request through the interaction object.

[0120] In one embodiment of this disclosure, the processing unit is further configured to perform at least one of the following: extracting semantic features from the operation text to obtain operation text feature data; extracting sequence features from the operation timing sequence to obtain operation timing feature data; wherein the operation timing feature data includes at least one of average input interval, interval standard deviation, and abnormal pauses; and encrypting the device information using a target encryption algorithm to obtain device feature data.

[0121] In one embodiment of this disclosure, the above-mentioned apparatus further includes: a third determining module, configured to use a first large model to determine the cosine similarity between the first operation feature data and the operation feature data of a preset abnormal operation cluster; and a first sending module, configured to send a verification request to the interaction object in response to the cosine similarity being higher than a second preset threshold.

[0122] In one embodiment of this disclosure, the apparatus further includes: a second sending module, configured to send an interception response to the interaction object in response to determining that the interaction operation is an abnormal operation; wherein the interception response is used to indicate that the operation request has been intercepted.

[0123] The abnormal operation identification device provided in this embodiment employs a dual-model collaborative mechanism. The first model generates operation decisions based on operation data, ensuring timely operation response. The second model acquires the thought chain information of the operation decision. By analyzing the thought chain information, it can accurately capture hidden abnormal patterns that are difficult to detect, such as logical jumps, rule avoidance, and contextual contradictions. Thus, the decision generation and decision verification steps are separated, enabling in-depth and interpretable identification of potential abnormal behaviors in complex interaction scenarios. This improves the flexibility and accuracy of abnormal operation identification and reduces the false judgment rate.

[0124] The acquisition, storage, and application of user personal information involved in the technical solution disclosed herein comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0125] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0126] Figure 5 A schematic block diagram of an example electronic device 500 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0127] like Figure 5 As shown, device 500 includes a computing unit 501, which can perform various appropriate actions and processes based on computer programs / instructions stored in read-only memory (ROM) 502 or loaded from storage unit 508 into random access memory (RAM) 503. RAM 503 may also store various programs and data required for the operation of device 500. The computing unit 501, ROM 502, and RAM 503 are interconnected via bus 504. Input / output (I / O) interface 505 is also connected to bus 504.

[0128] Multiple components in device 500 are connected to I / O interface 505, including: input unit 506 such as keyboard, mouse, etc.; output unit 507 such as various types of monitors, speakers, etc.; storage unit 508 such as disk, optical disk, etc.; and communication unit 509 such as network card, modem, wireless transceiver, etc. Communication unit 509 allows device 500 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0129] The computing unit 501 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 501 performs the various methods and processes described above, such as the anomaly detection method. For example, in some embodiments, the anomaly detection method may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 508. In some embodiments, part or all of the computer program / instructions may be loaded and / or installed on device 500 via ROM 502 and / or communication unit 509. When the computer program / instructions are loaded into RAM 503 and executed by the computing unit 501, one or more steps of the anomaly detection method described above may be performed. Alternatively, in other embodiments, the computing unit 501 may be configured to perform the anomaly detection method by any other suitable means (e.g., by means of firmware).

[0130] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include: implementations in one or more computer programs / instructions that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transferring data and instructions to the storage system, the at least one input device, and the at least one output device.

[0131] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0132] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0133] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0134] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), the Internet, and blockchain networks.

[0135] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. The client-server relationship is created by computer programs / instructions running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0136] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in the disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this document does not impose any restrictions.

[0137] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for identifying abnormal operations, the method comprising: Obtain the operation request of the interactive object; wherein the operation request carries operation data of the interactive operation; The first major model is used to generate operational decisions based on the operational data; The second major model is used to obtain the thought chain information for the operational decision; The thought chain information is analyzed to identify whether the interactive operation is abnormal.

2. The method according to claim 1, wherein, The analysis of the thought chain information to identify whether the interactive operation is abnormal includes: The thought chain information is analyzed to obtain analysis result information; the analysis result information includes at least one of the following: the operation logic path indicated by the thought chain information, and the first operation feature data obtained by the first major model in the thought chain information performing feature processing on the operation data; Based on the analysis results, it can be determined whether the interactive operation is abnormal.

3. The method according to claim 2, wherein, The analysis results information also includes: the operation logic path and the preset normal operation logic path; And / or, The analysis result information also includes: the first operation feature data and the second operation feature data of the interactive object; wherein, the second operation feature data is determined based on the operation data of the target interactive operation of the interactive object, and the target interactive operation is an interactive operation that has been identified as a normal operation.

4. The method according to claim 3, wherein, When the analysis result information includes the first operation feature data and the second operation feature data of the interactive object, the step of identifying whether the interactive operation is abnormal based on the analysis result information includes: Based on the second operational feature data, an anomaly assessment is performed on the first operational feature data to obtain an anomaly assessment score for the first operational feature data. Based on the anomaly evaluation score of the first operation feature data, the target anomaly evaluation score of the interactive operation is determined; In response to the target anomaly assessment score being higher than a first preset threshold, the interaction operation is determined to be an anomalous operation; wherein the first preset threshold is determined based on the receiver operation characteristic ROC curve.

5. The method according to claim 4, wherein, Determining the target anomaly assessment score of the interaction operation based on the anomaly assessment score of the first operation feature data includes: If there is only one first operational feature data point, the anomaly evaluation score of the first operational feature data is determined as the target anomaly evaluation score; or... When there are multiple first operational feature data, a weighted fusion strategy is adopted to determine the target anomaly evaluation score based on the anomaly evaluation scores of the multiple first operational feature data.

6. The method according to claim 5, wherein, When there are multiple first operation feature data, the first operation feature data includes at least two of the following: operation text feature data, operation timing feature data, and device feature data. The weighted fusion strategy indicates that the operation timing feature data has the highest weight, and the device feature data has the lowest weight.

7. The method according to claim 4, wherein, The method further includes: Obtain a test set; wherein the test set includes multiple test operations with labeled exception information, the exception information being used to indicate whether the corresponding test operation is an exception operation; Based on the target anomaly evaluation scores of multiple test operations in the test set, and the anomaly information of the multiple test operations, multiple thresholds are determined with respect to the true positive rate (TPR) and false positive rate (FPR) of the test set to generate the ROC curve; wherein, the TPR is used to indicate the proportion of anomaly results determined based on the target anomaly evaluation score and the corresponding threshold of the corresponding test operation in the test set when the anomaly information indicates that the corresponding test operation is an anomalous operation; the FPR is used to indicate the proportion of anomaly results determined based on the target anomaly evaluation score and the corresponding threshold of the corresponding test operation in the test set when the anomaly information indicates that the corresponding test operation is a normal operation. The threshold in the ROC curve that meets the target requirement is determined as the first set threshold; wherein, the target requirement is that the threshold has a high TPR and a low FPR with respect to the test set.

8. The method according to claim 3, wherein, The method further includes: Using the second major model, cluster analysis is performed on the operation data of the target interaction operation of the interactive object according to the first set period, so as to incrementally update the second operation feature data; And / or, The second large model is used to synchronize the second operation feature data to the first large model according to the second set period; wherein, the synchronized second operation feature data is used by the first large model to identify anomalies in the target operation request, and the target operation request is the operation request after the second large model synchronizes the second operation feature data to the first large model.

9. The method according to claim 2, wherein, The process of generating operational decisions based on the operational data using the first major model includes: The first large model is used to perform feature processing on the operation data to obtain the first operation feature data; The first large model is used to determine whether the interaction operation is abnormal based on preset attack feature data and the first operation feature data; In response to determining that the interaction is a normal operation, the operation decision is generated using the first large model based on the first operation feature data.

10. The method according to claim 9, wherein, The operation data includes at least one of operation text, operation sequence, and device information; The device information includes a device fingerprint, which is generated based on the WebGL rendering data and sensor noise data of the device that sent the operation request to the interactive object.

11. The method according to claim 10, wherein, The feature processing of the operation data to obtain the first operation feature data includes at least one of the following: Semantic features are extracted from the operation text to obtain operation text feature data; Sequence features are extracted from the operation timing sequence to obtain operation timing feature data; wherein, the operation timing feature data includes at least one of the following: average input interval duration, standard deviation of interval duration, and abnormal pauses; The device information is encrypted using a target encryption algorithm to obtain device feature data.

12. The method according to claim 9, wherein, The method further includes: Using the first major model, the cosine similarity between the first operation feature data and the operation feature data of the preset abnormal operation cluster is determined; In response to the cosine similarity being higher than a second preset threshold, a verification request is sent to the interactive object.

13. The method according to claim 9, wherein, The method further includes: In response to determining that the interaction operation is an abnormal operation, an interception response is sent to the interaction object; wherein the interception response is used to indicate that the operation request has been intercepted.

14. An abnormal operation identification device, the device comprising: The first acquisition module is used to acquire the operation request of the interactive object; wherein the operation request carries the operation data of the interactive operation; The generation module is used to generate operational decisions based on the operational data using the first major model; The second acquisition module is used to acquire the thought chain information of the operation decision using the second major model; The analysis module is used to analyze the thought chain information and identify whether the interactive operation is abnormal.

15. An electronic device comprising: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method as described in any one of claims 1-13.

16. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method as described in any one of claims 1-13.

17. A computer program product comprising a computer program / instructions, wherein, When the computer program / instructions are executed by the processor, they implement the method as described in any one of claims 1-13.

Images