Abnormal account identification method and device, electronic equipment and storage medium

Abstract

The invention discloses an abnormal account identification method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining a first operation feature of a target account in a target scene, the first operation feature comprising features of a plurality of historical scene operation data under at least one scene data dimension under at least one feature channel dimension; merging the first operation feature in at least one scene data dimension and at least one feature channel dimension to obtain a second operation feature of the target account in at least one scene channel merging dimension; and inputting the first operation feature and the second operation feature into an abnormal account recognition model, and on the basis of performing multi-dimensional feature extraction processing on the second operation feature from a time sequence dimension, a feature channel dimension and a scene data dimension, performing abnormal account recognition processing on the target account to obtain a target account recognition result corresponding to the target account. By using the technical scheme provided by the invention, the abnormal account identification accuracy can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, and in particular to an abnormal account identification method and device, an electronic device, and a storage medium. BACKGROUND

[0002] With the development of artificial intelligence technology, artificial intelligence technology is widely used in various scenarios. For example, in payment and secure access scenarios, artificial intelligence technology is combined for abnormal account identification processing. In related technologies, in the process of combining artificial intelligence technology for abnormal account identification processing, machine learning models such as logistic regression, decision tree, and random forest are combined. However, these models usually require a large amount of feature engineering, including feature selection and feature conversion. At the same time, the model only learns low-order features and cannot effectively extract features, resulting in poor recognition accuracy. SUMMARY

[0003] The present application provides an abnormal account identification method, device, equipment, storage medium, and computer program product, which can improve the accuracy and effectiveness of account operation feature extraction, and further improve the accuracy of abnormal account identification.

[0004] In one aspect, the present application provides an abnormal account identification method, which comprises:

[0005] Obtaining a first operation feature of a target account in a target scenario, the first operation feature being a feature of a plurality of historical scenario operation data of the target account in at least one scenario data dimension, and the first operation feature comprising a feature of the plurality of historical scenario operation data in at least one feature channel dimension in the at least one scenario data dimension;

[0006] Merging the first operation feature in the at least one scenario data dimension and the at least one feature channel dimension to obtain a second operation feature of the target account in at least one scenario channel merging dimension;

[0007] Inputting the first operation feature and the second operation feature into an abnormal account identification model, and performing multi-dimensional feature extraction processing on the second operation feature from the time sequence dimension, the feature channel dimension, and the scenario data dimension, and then performing abnormal account identification processing on the target account to obtain a target account identification result corresponding to the target account.

[0008] Another aspect provides an abnormal account identification device, which comprises:

[0009] The first operation feature acquisition module is configured to acquire a first operation feature of a target account in a target scene, the first operation feature being a feature of a plurality of historical scene operation data of the target account in at least one scene data dimension, and the first operation feature including a feature of the plurality of historical scene operation data in at least one feature channel dimension in the at least one scene data dimension;

[0010] The merging processing module is configured to perform merging processing on the first operation feature in the at least one scene data dimension and the at least one feature channel dimension to obtain a second operation feature of the target account in at least one scene channel merging dimension;

[0011] The abnormal account identification module is configured to input the first operation feature and the second operation feature into an abnormal account identification model, perform multi-dimensional feature extraction processing on the second operation feature from a time sequence dimension, a feature channel dimension and a scene data dimension, and perform abnormal account identification processing on the target account to obtain a target account identification result corresponding to the target account.

[0012] In another aspect, an electronic device is provided, including: a processor;

[0013] a memory for storing instructions executable by the processor;

[0014] The processor is configured to execute the instructions to implement the abnormal account identification method of any of the above aspects.

[0015] In another aspect, a computer-readable storage medium is provided, when instructions in the storage medium are executed by a processor of an electronic device, the electronic device can execute any of the above abnormal account identification methods.

[0016] In another aspect, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the abnormal account identification method provided in the various optional implementation manners.

[0017] The abnormal account identification method, device, equipment, storage medium and computer program product provided in the present application have the following technical effects:

[0018] This application obtains a first operational feature of a target account's historical operational data in at least one scenario data dimension within a target scenario. This first operational feature includes features of the historical operational data in at least one scenario data dimension within at least one feature channel dimension. Next, the first operational feature is merged across at least one scenario data dimension and at least one feature channel dimension to obtain a second operational feature of the target account in at least one scenario channel merged dimension. This ensures that subsequent weighted summation of historical operational data at each time point can be performed in the time-series dimension to capture temporal correlations. Then, the first and second operational features are input into an abnormal account identification model. Based on multi-dimensional feature extraction processing of the second operational feature from the time-series, feature channel, and scenario data dimensions, the target account is processed for abnormal account identification, yielding the target account identification result. This significantly improves the accuracy and effectiveness of account operational feature extraction during abnormal account identification, thereby increasing the accuracy of abnormal account identification. In payment and other scenarios, it effectively identifies abnormal accounts and enhances payment security. Attached Figure Description

[0019] To more clearly illustrate the technical solutions and advantages in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a schematic diagram of the application environment of an abnormal account identification method provided in an embodiment of this application;

[0021] Figure 2 This is a flowchart illustrating an abnormal account identification method provided in an embodiment of this application;

[0022] Figure 3 This application provides a flowchart illustrating how a first operation feature and a second operation feature are input into an abnormal account identification model. Based on multi-dimensional feature extraction processing of the second operation feature from the time sequence dimension, feature channel dimension, and scene data dimension, the target account is processed to identify abnormal accounts, thereby obtaining the target account identification result corresponding to the target account.

[0023] Figure 4 This is a flowchart illustrating how a second operational feature is input into a multi-dimensional feature extraction network to perform multi-dimensional feature extraction processing from the temporal dimension, feature channel dimension, and scene data dimension to obtain a first multi-dimensional feature, according to an embodiment of this application.

[0024] Figure 5 This is a flowchart illustrating the process of identifying abnormal accounts based on an abnormal account identification model, as provided in an embodiment of this application.

[0025] Figure 6 This is a schematic diagram of the training process of an abnormal account recognition model provided in an embodiment of this application;

[0026] Figure 7 This is a schematic diagram of the structure of an abnormal account identification device provided in an embodiment of this application;

[0027] Figure 8 This is a block diagram of an electronic device for identifying abnormal accounts provided in an embodiment of this application;

[0028] Figure 9 This is a block diagram of another electronic device for identifying abnormal accounts provided in an embodiment of this application. Detailed Implementation

[0029] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0030] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or server that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0031] In this application embodiment, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0032] Please see Figure 1 , Figure 1 This is a schematic diagram of the application environment of an abnormal account identification method provided in this application embodiment. The application environment may include at least a server 100 and a terminal 200.

[0033] In an optional embodiment, server 100 can be used to pre-train an abnormal account identification model and perform abnormal account identification processing based on the abnormal account identification model. Server 100 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0034] In an optional embodiment, terminal 200 can be used to provide users with services such as payment and business access. Specifically, terminal 200 can be, but is not limited to, electronic devices such as smartphones, desktop computers, tablets, laptops, smart speakers, digital assistants, augmented reality (AR) / virtual reality (VR) devices, smart wearable devices, in-vehicle terminals, and smart TVs; it can also be software running on the aforementioned electronic devices, such as applications and mini-programs. The operating system running on the electronic device in this embodiment can include, but is not limited to, Android, iOS, Linux, and Windows.

[0035] In addition, it should be noted that, Figure 1 The examples shown are merely one application environment for an abnormal account identification method, and the embodiments in this specification are not limited to the above.

[0036] In the embodiments described in this specification, the server 100 and the terminal 200 can be directly or indirectly connected via wired or wireless communication, and this application does not impose any restrictions on this.

[0037] The following describes a method for identifying abnormal accounts according to this application. Figure 2 This is a flowchart illustrating an abnormal account identification method provided in an embodiment of this application. This specification provides method operation steps as shown in the embodiments or flowcharts, but based on conventional or non-inventive labor, more or fewer operation steps may be included. The order of steps listed in the embodiments is merely one possible execution order among many, and does not represent the only execution order. In actual system or server product execution, the method can be executed sequentially according to the embodiments or drawings, or in parallel (e.g., in a parallel processor or multi-threaded processing environment). Specifically, as shown... Figure 2 As shown, the method may include:

[0038] S201: Obtain the first operational feature of the target account in the target scenario.

[0039] In one specific embodiment, the target scenario can be a scenario requiring account anomaly identification, such as a payment scenario or a secure access scenario. Specifically, the target account can be the user account currently to be identified in the target scenario.

[0040] In a specific embodiment, the aforementioned first operational feature can be a feature of multiple historical scenario operation data of the target account under at least one scenario data dimension. Specifically, at least one scenario data dimension can correspond to at least one scenario operation data in the target scenario that reflects whether the target account is abnormal. Taking the payment scenario as an example, at least one scenario operation data can include at least one of payment method, payment amount, geographical location, payment time, and time interval from the last transaction; correspondingly, at least one scenario data dimension can include at least one of payment method dimension, payment amount dimension, geographical location dimension, payment time dimension, and time interval from the last transaction dimension. Multiple historical scenario operation data under any scenario data dimension can include multiple historical data of scenario operation data of the corresponding type of scenario data dimension. The number of multiple historical scenario operation data under any scenario data dimension can also be preset according to actual application, for example, 32. Taking the payment amount dimension in the above payment scenario as an example, the payment amounts corresponding to the 32 most recent payment operations can be used as multiple historical scenario operation data under the payment amount dimension. Specifically, the collection time period of multiple historical scenario operation data can be set according to the number of multiple scenario operation data under any scenario data dimension and actual application requirements. Optionally, if the number of multiple historical scenario operation data of the target account under a certain scenario data dimension is less than the preset value, it can be filled with a value of 0.

[0041] In a specific embodiment, multiple historical scenario operation data of the target account under at least one scenario data dimension can be converted into corresponding first operation features by combining a preset representation network. Specifically, the preset representation network often includes at least one channel for representing features. Correspondingly, the first operation feature after combining the preset representation network to perform feature representation on multiple historical scenario operation data of the target account under at least one scenario data dimension may include features of multiple historical scenario operation data under at least one scenario data dimension under at least one feature channel dimension.

[0042] In one specific embodiment, the network structure of the preset representation network can be set according to the actual application. Optionally, the preset representation network can be a convolutional neural network. In one specific embodiment, assuming that the number of dimensions of the above-mentioned at least one scenario data dimension is M, the number (sequence length) of multiple historical scenario operation data under each scenario data dimension is L, and the number of accounts is B (B is 1 in the process of account anomaly identification processing of a single account), accordingly, in order to adapt to the input requirements of the convolutional neural network, the multiple historical scenario operation data of the target account under at least one scenario data dimension can be represented as a matrix of [B,M,1,L], where 1 is a newly added dimension. Further, the data dimension can be adjusted to [B*M,1,L], and then data padding is used to ensure that the data size can be divided by the convolution kernel, so as to perform subsequent convolution operations. The data size is (PS), where P is the kernel size in the convolutional neural network, S is the stride, and the padding method is to copy the last historical scene operation data. The padded data dimension is [B*M, 1, L+PS], which conforms to the input format requirements of the preset representation network (convolutional neural network). Furthermore, during the feature representation of multiple historical scene operation data, the convolution kernels in the preset representation network can be combined to perform one-dimensional convolution operations on multiple historical scene operation data of the target account in at least one scene data dimension. This allows the capture of local patterns in the time series data, independently embedding multiple historical scene operation data in each scene data dimension into a high-dimensional space. After the convolution operation, a matrix (features) of [B*M, D, N] is obtained, where D is the number of output channels corresponding to the preset representation network (the number of convolution kernels in the preset representation network), and N is the number of features (sequence length) of historical scene operation data in each feature channel of each scene data dimension after the convolution sliding operation. Specifically, N can be determined using the following formula:

[0043]

[0044] Lpadd = L + PS

[0045] In a specific embodiment, during the one-dimensional convolution operation on multiple historical scenario operation data of the target account in at least one scenario data dimension, combined with a preset representation network, the convolution kernel starts from the beginning of the input data, covers P consecutive time steps, calculates the sum of the element-wise product of the convolution kernel and this part of the input data, and places the result in the first position of the output result; then, the convolution kernel slides to the right for S time steps, repeats the above calculation process, and places the result in the next position of the output result. This process continues until the convolution kernel slides to the end of the input data, or there are not enough time steps to cover the entire convolution kernel. Furthermore, after the convolution is completed, in order to facilitate subsequent processing, the data dimension can be adjusted to [B, M, D, N] and used as the first operation data mentioned above.

[0046] S203: For the first operational feature, merge it in at least one scenario data dimension and at least one feature channel dimension to obtain the second operational feature of the target account in at least one scenario channel merged dimension.

[0047] In a specific embodiment, the second operational feature can be an operational feature obtained by merging the first operational feature in at least one scene data dimension and at least one feature channel dimension. Specifically, taking the first operational feature as [B,M,D,N] as an example, M and D, which represent the scene data dimension and the feature channel dimension, can be merged together to obtain the second operational feature of the target account under at least one scene channel merged dimension. The second operational feature is [B,M*D,N], that is, the data dimension is [B,M*D,N].

[0048] In the above embodiments, by merging the first operation feature in at least one scene data dimension and at least one feature channel dimension, it can be ensured that the historical scene operation data at each time point can be weighted and summed in the time sequence dimension, thereby capturing the temporal correlation.

[0049] S205: Input the first operation feature and the second operation feature into the abnormal account identification model. Based on the multi-dimensional feature extraction processing of the second operation feature from the time sequence dimension, feature channel dimension and scene data dimension, perform abnormal account identification processing on the target account to obtain the target account identification result corresponding to the target account.

[0050] In one specific embodiment, the target account identification result can be used to indicate whether the target account is an abnormal account. Specifically, the model result of the abnormal account identification model can be set according to the actual application;

[0051] In related technologies, deep learning models such as recurrent neural networks can be combined to train abnormal account identification models. However, while deep learning models can capture complex nonlinear relationships and long-term dependencies, they often suffer from technical problems such as high computational resource consumption and efficiency. Optionally, to reduce computational resource consumption and improve identification efficiency, the aforementioned abnormal account identification model is based on multi-dimensional feature extraction processing using convolutional neural networks.

[0052] In an optional embodiment, the above-mentioned abnormal account identification model may include: a multi-dimensional feature extraction network, a feature aggregation network, and an anomaly identification network; correspondingly, such as Figure 3 As shown, the above-mentioned input of the first and second operational features into the abnormal account identification model, and based on the multi-dimensional feature extraction processing of the second operational features from the temporal dimension, feature channel dimension, and scene data dimension, the abnormal account identification processing of the target account is performed, and the target account identification result corresponding to the target account can include:

[0053] S301: Input the second operational feature into the multi-dimensional feature extraction network, and perform multi-dimensional feature extraction processing from the temporal dimension, feature channel dimension and scene data dimension to obtain the first multi-dimensional feature;

[0054] S303: Input the first multi-dimensional feature and the first operational feature into the feature aggregation network for feature aggregation processing to obtain the target aggregated feature;

[0055] S305: Input the target aggregated features into the anomaly detection network to perform anomaly account identification processing on the target account, and obtain the target account identification result.

[0056] In an optional embodiment, the aforementioned multi-dimensional feature extraction network can be used to perform multi-dimensional feature extraction processing from the temporal, feature channel, and scene data dimensions. Optionally, the multi-dimensional feature extraction network may include: a temporal feature extraction network, a channel feature extraction network, and a scene feature extraction network; correspondingly, as... Figure 4 As shown, the second operational feature is input into a multi-dimensional feature extraction network to perform multi-dimensional feature extraction processing from the temporal dimension, feature channel dimension, and scene data dimension, resulting in a first multi-dimensional feature that may include:

[0057] S401: Input the second operational feature into the temporal feature extraction network, and perform temporal feature extraction processing on the second operational feature under each scene channel merging dimension to obtain at least one third operational feature under the scene channel merging dimension.

[0058] S403: Input the third operational feature into the channel feature extraction network. In the channel feature extraction network, the third operational feature is grouped according to at least one scene data dimension. Channel feature extraction is performed on the features under at least one feature channel dimension in each group to obtain the fourth operational feature.

[0059] S405: Input the fourth operational feature into the scene feature extraction network. In the scene feature extraction network, the fourth operational feature is grouped according to at least one feature channel dimension. Scene feature extraction processing is performed on the features under at least one scene data dimension in each group to obtain the first multi-dimensional feature.

[0060] In a specific embodiment, the aforementioned temporal feature extraction network, channel feature extraction network, and scene feature extraction network are all convolutional neural networks. Accordingly, the above-mentioned inputting the second operational feature into the temporal feature extraction network and performing temporal feature extraction processing on the second operational feature under each scene channel merging dimension to obtain at least one third operational feature under the scene channel merging dimension may include: inputting the second operational feature into the temporal feature extraction network, and performing temporal feature extraction processing on the second operational feature under each scene channel merging dimension based on at least one convolutional kernel in the temporal feature extraction network to obtain the third operational feature.

[0061] In a specific embodiment, the third operational feature can be the operational feature obtained by performing temporal feature extraction processing on the second operational feature under the merging dimension of each scene channel. Specifically, in the temporal feature extraction network, the third operational feature can be processed by one-dimensional convolution. Specifically, the number of output channels can be set to M*D, and with data padding, the data output dimension can still be [B, M*D, N]. Optionally, in order to increase the receptive field of the model, the size of the convolution kernel in the temporal feature extraction network can be larger, for example, the kernel size can be 12, so as to better capture the temporal dependencies over a longer period of time. Specifically, in the temporal feature extraction network, the operational feature under each input channel (M*D channels) (i.e., the second operational feature under the merging dimension of each scene channel) will be convolved independently with a convolution kernel, without mixing between channels. This achieves the extraction of temporal information for each channel separately, without mixing information between channels, thus better extracting the temporal features in the scene operation data of the target account, greatly improving the accuracy of account feature extraction.

[0062] In a specific embodiment, the above-mentioned input of the third operational feature into the channel feature extraction network, the grouping of the third operational feature in the channel feature extraction network according to at least one scene data dimension, and the channel feature extraction processing of the features under at least one feature channel dimension in each group to obtain the fourth operational feature may include: inputting the third operational feature into the channel feature extraction network, grouping the third operational feature according to at least one scene data dimension, and performing channel feature extraction processing on the features under at least one feature channel dimension in each group based on at least one convolutional kernel in the channel feature extraction network to obtain the fourth operational feature.

[0063] In a specific embodiment, the fourth operational feature can be an operational feature that performs channel feature extraction processing on the features under at least one feature channel dimension in each group after the third operational feature is grouped according to at least one scene data dimension. Specifically, the size of the convolution kernel in the channel feature extraction network can be small, for example, the size of the convolution kernel is 1, and then it is processed independently at each time step. Specifically, the input data (third operational feature) in the channel feature extraction network is divided into M groups, each group contains D channel data, which are used to learn the relationship between channels. Further, the number of output channels corresponding to the channel feature extraction network can be set to M*D, and the corresponding data dimension of the fourth operational feature is [B, M*D, N].

[0064] In a specific embodiment, the fourth operational feature is input into the scene feature extraction network. In the scene feature extraction network, the fourth operational feature is grouped according to at least one feature channel dimension. Scene feature extraction processing is performed on the features under at least one scene data dimension in each group to obtain the first multi-dimensional feature, which may include:

[0065] The fourth operational feature is input into the scene feature extraction network, and the fourth operational feature is grouped according to at least one feature channel dimension. Based on at least one convolutional kernel in the scene feature extraction network, scene feature extraction processing is performed on the features in at least one scene data dimension in each group to obtain the first multi-dimensional feature.

[0066] In a specific embodiment, the first multi-dimensional feature can be the operational feature after the fourth operational feature is grouped according to at least one feature channel dimension, and the features in each group are subjected to scene feature extraction processing under at least one scene data dimension (i.e., the operational feature after multi-dimensional feature extraction processing of the second operational feature from the temporal dimension, feature channel dimension and scene data dimension); specifically, the data dimension of the fourth operational feature can be adjusted from [B,M*D,N] to [B,D*M,N], and then the fourth operational feature can be divided into D groups, each group containing M scene operation sequences (each scene operation sequence includes N scene operation data features) for learning the relationship between different kinds of scene operation data. Further, the number of output channels of the scene feature extraction network can be set to D*M, and the convolution kernel size can be 1; correspondingly, the data dimension of the first multi-dimensional feature is [B,D*M,N].

[0067] In the above embodiments, the second operation feature is input into the temporal feature extraction network, and temporal feature extraction processing is performed on the second operation feature under each scene channel merging dimension to obtain at least one third operation feature under at least one scene channel merging dimension. This allows for the extraction of temporal information for each channel independently, without mixing information between channels, thus enabling better extraction of temporal features from the scene operation data of the target account. Next, the third operation feature is input into the channel feature extraction network, and the third operation feature is grouped according to at least one scene data dimension. Channel feature extraction processing is performed on the features under at least one feature channel dimension in each group to obtain a fourth operation feature. This allows for learning the relationship between channels, thus better extracting the operation features of the account. Then, the fourth operation feature is input into the scene feature extraction network, and the fourth operation feature is grouped according to at least one feature channel dimension. Scene feature extraction processing is performed on the features under at least one scene data dimension in each group. This allows for learning the relationship between different scene operation data, thus achieving multi-dimensional feature extraction processing from the temporal dimension, feature channel dimension, and scene data dimension, greatly improving the accuracy and effectiveness of extracting the operation features of the account, and thus improving the accuracy of identifying abnormal accounts.

[0068] In an optional embodiment, the feature aggregation network can be used to aggregate and process the first multi-dimensional features and the first operational features; optionally, the feature aggregation network may include: a format conversion module, a feature fusion module, and a feature concatenation module; inputting the first multi-dimensional features and the first operational features into the feature aggregation network for feature aggregation processing to obtain the target aggregated features includes:

[0069] The first multi-dimensional feature is input into the format conversion module for format conversion processing to obtain the second multi-dimensional feature that is consistent with the first operational feature dimension.

[0070] The second multi-dimensional feature and the first operational feature are input into the feature fusion module for feature fusion processing to obtain the target fused feature;

[0071] The target fusion features are input into the feature splicing module, and the target fusion features are spliced ​​in at least one scene data dimension and at least one feature channel dimension to obtain the target aggregated features.

[0072] In a specific embodiment, the data dimension of the first multi-dimensional feature is [B,D*M,N], and the data dimension of the first operational feature is [B,M,D,N]. In order to facilitate the fusion of the operational features extracted from the time sequence dimension, feature channel dimension and scene data dimension with the original first operational feature, the first multi-dimensional feature can be first input into the format conversion module for format conversion processing to obtain the second multi-dimensional feature that is consistent with the dimension (data dimension) of the first operational feature.

[0073] In a specific embodiment, the above-mentioned input of the second multi-dimensional feature and the first operational feature into the feature fusion module for feature fusion processing to obtain the target fused feature can be obtained by directly adding the corresponding dimensions of the second multi-dimensional feature and the first operational feature.

[0074] In a specific embodiment, two features with data dimensions [B,M,D,N] are fused together, and the target fused feature also has data dimensions [B,M,D,N]. To facilitate subsequent abnormal account identification and processing, the target fused feature can be input into the feature splicing module. The target fused feature is spliced ​​together in at least one scene data dimension and at least one feature channel dimension to obtain the target aggregated feature. Accordingly, the data dimensions of the target aggregated feature are [B,M*D*N].

[0075] In the above embodiments, the first multi-dimensional feature is first converted using the format conversion module to obtain a second multi-dimensional feature that is consistent with the first operational feature dimension. Then, the second multi-dimensional feature and the first operational feature with the same data dimension are combined with the feature fusion module to perform feature fusion processing to obtain the target fused feature. Next, the target fused feature is input into the feature splicing module to splice the target fused feature in at least one scene data dimension and at least one feature channel dimension to obtain the target aggregated feature, which is convenient for subsequent abnormal account identification processing.

[0076] In one specific embodiment, the anomaly detection network can be a binary classification network, such as a sigmoid network. In another specific embodiment, the target account identification result output by the anomaly detection network can be a probability indicating that the target account belongs to an anomaly account. Optionally, if the probability is greater than a preset threshold, the target account can be determined to be an anomaly account; conversely, if the probability is less than or equal to the preset threshold, the target account can be determined not to be an anomaly account.

[0077] In the above embodiments, the second operation feature is first input into a multi-dimensional feature extraction network, and multi-dimensional feature extraction processing is performed from the time sequence dimension, feature channel dimension and scene data dimension. This can effectively and accurately extract the operation features of the account. Furthermore, after aggregating the first multi-dimensional feature obtained from the multi-dimensional feature extraction processing with the original first operation feature, abnormal account identification can be performed, which can more accurately identify abnormal operations under the account, thereby improving the accuracy of abnormal account identification.

[0078] In an optional embodiment, the abnormal account identification model is obtained by training the abnormal account identification model to be identified based on the training dataset. Specifically, the abnormal account identification model to be trained can be a preset machine learning model. Optionally, the abnormal account identification model to be trained is based on the convolutional neural network to be trained for multi-dimensional feature extraction processing. In this way, the complexity of the model can be reduced and the computational resource consumption during the model training process can be reduced by sharing the internal parameters of the convolution kernel in the convolutional neural network, thereby improving the training efficiency.

[0079] In a specific embodiment, such as Figure 5 As shown, Figure 5This is a flowchart illustrating an abnormal account identification process based on an abnormal account identification model provided in this application embodiment. Specifically, the first operation feature of the target account in the target scenario can be obtained first. Specifically, multiple historical scenario operation data of the target account under at least one scenario data dimension can be input into a preset representation network for embedding representation to obtain the first operation feature. The data dimension of the first operation feature can be [B, M, D, N]. Then, the first operation feature is merged in at least one scenario data dimension and at least one feature channel dimension to obtain the second operation feature. Specifically, in the merging process, the two representations of scenario data dimension and feature channel dimension, M and D, can be merged together. Then, the first operation feature and the second operation feature are input into the abnormal account identification model. Based on the multi-dimensional feature extraction processing of the second operation feature from the temporal dimension, feature channel dimension, and scenario data dimension, the target account is subjected to abnormal account identification processing to obtain the target account identification result corresponding to the target account. Specifically, the abnormal account identification model can include a temporal feature extraction network, a channel feature extraction network, a scenario feature extraction network, a feature aggregation network, and an abnormal identification network. Correspondingly, in the case of abnormal... In the normal account identification model, the second operational feature can be input into the temporal feature extraction network. Based on at least one convolutional kernel in the temporal feature extraction network, temporal feature extraction processing is performed on the second operational feature under each scene channel merging dimension to obtain the third operational feature. Next, the third operational feature is input into the channel feature extraction network, and the third operational feature is grouped according to at least one scene data dimension. Based on at least one convolutional kernel in the channel feature extraction network, channel feature extraction processing is performed on the features under at least one feature channel dimension in each group to obtain the fourth operational feature. Next, the fourth operational feature is input into the scene feature extraction network, and the fourth operational feature is grouped according to at least one feature channel dimension. Based on at least one convolutional kernel in the scene feature extraction network, scene feature extraction processing is performed on the features under at least one scene data dimension in each group to obtain the first multi-dimensional feature. Next, the first multi-dimensional feature and the first operational feature are input into the feature aggregation network in the abnormal account identification model for feature aggregation processing to obtain the target aggregated feature. Finally, the target aggregated feature is input into the abnormal identification network in the abnormal account identification model to perform abnormal account identification processing on the target account to obtain the target account identification result.

[0080] In a specific embodiment, such as Figure 6 As shown, the above-mentioned abnormal account identification model was trained in the following manner:

[0081] S601: Obtain the training dataset, which includes multiple sample account operation data in at least one scenario data dimension and preset account identification labels corresponding to each of the multiple sample accounts; the multiple sample accounts are user accounts in the target scenario.

[0082] S603: Based on the training dataset, iteratively train the abnormal account identification model to obtain the abnormal account identification model. During one iteration, perform the following operations:

[0083] S6031: Obtain the first sample operation features of multiple current accounts corresponding to the current training data in the training dataset. The first sample operation features include multiple sample scenario operation data of each current account under at least one scenario data dimension, and features under at least one feature channel dimension; the multiple sample accounts include multiple current accounts.

[0084] S6033: For the first sample operation features, merge them in at least one scenario data dimension and at least one feature channel dimension to obtain the second sample operation features of multiple current accounts under at least one scenario channel merged dimension.

[0085] S6035: Input the first sample operation features and the second sample operation features into the abnormal account recognition model to be trained. Based on the multi-dimensional feature extraction processing of the second sample operation features from the time sequence dimension, feature channel dimension and scene data dimension, perform abnormal account recognition processing on multiple current accounts to obtain the predicted account recognition results corresponding to multiple current accounts.

[0086] S6037: Update the abnormal account recognition model to be trained based on the predicted account recognition results corresponding to multiple current accounts and the preset account recognition labels corresponding to multiple current accounts.

[0087] In one specific embodiment, the current training data can be the training data during the current iteration; specifically, the current training data can be a portion of the training dataset, and may include first sample operation features of multiple current accounts and preset account identification labels corresponding to each current account. Specifically, the preset account identification label indicates whether the corresponding sample account is an abnormal account. Optionally, the preset account identification label can indicate the probability that the corresponding sample account is an abnormal account. Optionally, if the sample account is an abnormal account, the preset account identification label can be 1; otherwise, if the sample account is not an abnormal account, the preset account identification label can be 0.

[0088] In a specific embodiment, the detailed refinement of S6033-S6035 can be found in the detailed refinement of S203-S205, which will not be repeated here.

[0089] In one specific embodiment, the predicted account identification result corresponding to each current account can be the probability that the current account belongs to an abnormal account predicted by the current abnormal account identification model to be trained. In another specific embodiment, updating the abnormal account identification model to be trained based on the predicted account identification results corresponding to multiple current accounts and the preset account identification labels corresponding to multiple current accounts may include: substituting the predicted account identification result and the preset account identification label corresponding to each current account into a preset loss function to determine the identification prediction loss; and combining the gradient descent method and the identification prediction loss to update the model parameters of the abnormal account identification model to be trained, and performing the next round of iterative operation based on the updated abnormal account identification model to be trained until a preset convergence condition is met, and using the abnormal account identification model to be trained when the preset convergence condition is met as the abnormal account identification model.

[0090] In a specific embodiment, the prediction loss can characterize the performance of the current abnormal account identification model in identifying abnormal accounts. Specifically, the preset loss function can be set according to the actual application, such as cross-entropy loss, L1 regularization loss function, etc.

[0091] In a specific embodiment, the preset convergence conditions can be set according to the actual application, such as the number of times the loop iteration operation is executed reaches a preset number, the behavior prediction loss is less than a specified threshold, etc., which can be set according to the training speed and model accuracy requirements.

[0092] In an optional embodiment, obtaining the training dataset as described above includes:

[0093] Obtain the training dataset corresponding to the target region.

[0094] In one specific embodiment, the target account is a user account in the target region; specifically, the target region is the region where multiple sample accounts in the training dataset corresponding to the target region are located.

[0095] In the above embodiments, by selecting the training dataset according to the region, the abnormal account identification model adapted to different regions can be trained according to the region, which can better improve the accuracy of abnormal account identification in different regions.

[0096] In an optional embodiment, obtaining the training dataset described above includes...

[0097] Obtain training datasets corresponding to multiple preset historical time periods.

[0098] In a specific embodiment, the above-mentioned multiple preset historical time periods can be set according to actual applications. The multiple preset historical time periods are different preset historical time periods, and the multiple sample scenario operation data corresponding to multiple sample accounts in the training dataset corresponding to the multiple preset historical time periods can be the multiple sample scenario operation data corresponding to each of the multiple preset historical time periods.

[0099] In the above embodiments, by obtaining training datasets corresponding to multiple preset historical time periods for model training, model overfitting can be effectively avoided.

[0100] In a specific embodiment, to better ensure the abnormal account identification performance of the model, the trained abnormal account identification model can be evaluated using a test dataset. Optionally, the evaluation metrics may include accuracy, recall, precision, and F1 score (a harmonic average of model precision and recall). Optionally, if the evaluation metrics meet the preset evaluation metric threshold, the abnormal account identification model can be used as the final model for identifying abnormal accounts on the target account. Otherwise, the model parameters (hyperparameters) of the abnormal account identification model can be further adjusted and trained using the training dataset until the evaluation metrics meet the preset evaluation metric threshold.

[0101] As can be seen from the technical solutions provided in the embodiments of this specification above, this specification obtains a first operational feature of multiple historical scenario operation data of a target account in a target scenario under at least one scenario data dimension, and the first operational feature includes features of multiple historical scenario operation data under at least one scenario data dimension under at least one feature channel dimension; then, the first operational feature is merged in at least one scenario data dimension and at least one feature channel dimension to obtain a second operational feature of the target account under at least one scenario channel merged dimension, which can ensure that the historical scenario operation data at each time point can be weighted and summed in the time sequence dimension to capture the time sequence correlation. Then, the first operational feature and the second operational feature are input into the abnormal account identification model. Based on the multi-dimensional feature extraction processing of the second operational feature from the time sequence dimension, feature channel dimension and scenario data dimension, the target account is processed for abnormal account identification to obtain the target account identification result corresponding to the target account. This can greatly improve the accuracy and effectiveness of account operation feature extraction in the abnormal account identification process, thereby improving the accuracy of abnormal account identification. In payment and other scenarios, it can effectively identify abnormal accounts and improve payment security.

[0102] This application also provides an abnormal account identification device, such as... Figure 7 As shown, the above-mentioned device includes:

[0103] The first operation feature acquisition module 710 is configured to acquire the first operation feature of the target account in the target scenario. The first operation feature is the feature of multiple historical scenario operation data of the target account under at least one scenario data dimension, and the first operation feature includes the feature of the multiple historical scenario operation data under at least one feature channel dimension.

[0104] The merging processing module 720 is configured to perform merging processing on the first operational feature in the at least one scene data dimension and the at least one feature channel dimension to obtain the second operational feature of the target account in the at least one scene channel merging dimension.

[0105] The abnormal account identification module 730 is configured to input the first operation feature and the second operation feature into the abnormal account identification model, and perform abnormal account identification processing on the target account based on multi-dimensional feature extraction processing of the second operation feature from the time sequence dimension, feature channel dimension and scene data dimension, so as to obtain the target account identification result corresponding to the target account.

[0106] In an optional embodiment, the abnormal account identification model includes: a multi-dimensional feature extraction network, a feature aggregation network, and an anomaly identification network;

[0107] The abnormal account identification module 730 includes:

[0108] The multi-dimensional feature extraction processing unit is configured to input the second operational feature into the multi-dimensional feature extraction network and perform multi-dimensional feature extraction processing from the temporal dimension, feature channel dimension and scene data dimension to obtain the first multi-dimensional feature.

[0109] The feature aggregation processing unit is configured to perform feature aggregation processing by inputting the first multi-dimensional feature and the first operational feature into the feature aggregation network to obtain the target aggregated feature;

[0110] The first abnormal account identification unit is configured to input the target aggregated features into the abnormal identification network to perform abnormal account identification processing on the target account, and obtain the target account identification result.

[0111] In an optional embodiment, the multi-dimensional feature extraction network includes: a temporal feature extraction network, a channel feature extraction network, and a scene feature extraction network;

[0112] The multi-dimensional feature extraction processing unit includes:

[0113] The temporal feature extraction unit is configured to input the second operational feature into the temporal feature extraction network, perform temporal feature extraction processing on the second operational feature under each scene channel merging dimension, and obtain the third operational feature under the at least one scene channel merging dimension.

[0114] The channel feature extraction unit is configured to input the third operational feature into the channel feature extraction network, group the third operational feature according to the at least one scene data dimension in the channel feature extraction network, and perform channel feature extraction processing on the features under at least one feature channel dimension in each group to obtain the fourth operational feature.

[0115] The scene feature extraction unit is configured to input the fourth operational feature into the scene feature extraction network, group the fourth operational feature according to the at least one feature channel dimension in the scene feature extraction network, and perform scene feature extraction processing on the features under at least one scene data dimension in each group to obtain the first multi-dimensional feature.

[0116] In an optional embodiment, the temporal feature extraction unit is specifically configured to input the second operational feature into the temporal feature extraction network, and perform temporal feature extraction processing on the second operational feature under each scene channel merging dimension based on at least one convolutional kernel in the temporal feature extraction network to obtain the third operational feature;

[0117] The channel feature extraction unit is specifically configured to input the third operational feature into the channel feature extraction network, group the third operational feature according to the at least one scene data dimension, and perform channel feature extraction processing on the features under at least one feature channel dimension in each group based on at least one convolutional kernel in the channel feature extraction network to obtain the fourth operational feature.

[0118] The scene feature extraction unit is specifically configured to input the fourth operational feature into the scene feature extraction network, group the fourth operational feature according to the at least one feature channel dimension, and perform scene feature extraction processing on the features under at least one scene data dimension in each group based on at least one convolutional kernel in the scene feature extraction network to obtain the first multi-dimensional feature.

[0119] In an optional embodiment, the feature aggregation network includes: a format conversion module, a feature fusion module, and a feature concatenation module; the feature aggregation processing unit includes:

[0120] The format conversion processing unit is configured to perform format conversion processing on the first multi-dimensional feature input into the format conversion module to obtain a second multi-dimensional feature that is consistent with the first operational feature dimension.

[0121] The feature fusion processing unit is configured to perform feature fusion processing by inputting the second multi-dimensional feature and the first operational feature into the feature fusion module to obtain the target fused feature;

[0122] The splicing processing unit is configured to input the target fusion feature into the feature splicing module, and perform splicing processing on the target fusion feature in at least one scene data dimension and at least one feature channel dimension to obtain the target aggregated feature.

[0123] In an optional embodiment, the abnormal account identification model is trained using the following modules:

[0124] The training dataset acquisition module is configured to acquire a training dataset, which includes multiple sample scenario operation data of multiple sample accounts under the at least one scenario data dimension and preset account identification tags corresponding to each of the multiple sample accounts; the multiple sample accounts are user accounts in the target scenario.

[0125] The iterative training module is configured to perform iterative training on the abnormal account identification model to be trained based on the training dataset, thereby obtaining the abnormal account identification model. During each iteration, iterative operations are performed based on the following units within the iterative training module:

[0126] The first sample operation feature acquisition unit is configured to acquire the first sample operation features of multiple current accounts corresponding to the current training data in the training dataset. The first sample operation features include multiple sample scene operation data of each of the multiple current accounts under the at least one scene data dimension, and features under the at least one feature channel dimension. The multiple sample accounts include the multiple current accounts.

[0127] The merging processing unit is configured to perform merging processing on the first sample operation features in the at least one scene data dimension and the at least one feature channel dimension to obtain the second sample operation features of each of the plurality of current accounts under the at least one scene channel merging dimension.

[0128] The second abnormal account identification unit is configured to input the first sample operation features and the second sample operation features into the abnormal account identification model to be trained, and perform abnormal account identification processing on the multiple current accounts based on multi-dimensional feature extraction processing of the second sample operation features from the time sequence dimension, feature channel dimension and scene data dimension, to obtain the predicted account identification results corresponding to the multiple current accounts.

[0129] The model update unit is configured to update the abnormal account recognition model to be trained based on the predicted account recognition results corresponding to the multiple current accounts and the preset account recognition labels corresponding to the multiple current accounts.

[0130] In an optional embodiment, the training dataset acquisition module includes:

[0131] The first training dataset acquisition unit is configured to acquire the training dataset corresponding to the target region, wherein the target account is a user account in the target region.

[0132] or,

[0133] The second training dataset acquisition unit is configured to acquire the training datasets corresponding to multiple preset historical time periods.

[0134] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0135] Figure 8 This is a block diagram of an electronic device for identifying abnormal accounts, provided in an embodiment of this application. The electronic device can be a terminal, and its internal structure diagram can be as follows: Figure 8 As shown, the electronic device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements an abnormal account identification method. The display screen can be a liquid crystal display (LCD) or an e-ink display. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the device's casing, or an external keyboard, touchpad, or mouse.

[0136] Figure 9This is a block diagram of another electronic device for identifying abnormal accounts provided in an embodiment of this application. The electronic device can be a server, and its internal structure diagram can be as follows: Figure 9 As shown, the electronic device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements an abnormal account identification method.

[0137] Those skilled in the art will understand that Figure 8 or Figure 9 The structure shown is merely a block diagram of a portion of the structure related to the present disclosure and does not constitute a limitation on the electronic device to which the present disclosure is applied. A specific electronic device may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0138] In an exemplary embodiment, an electronic device is also provided, including: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to execute the instructions to implement the abnormal account identification method as described in the embodiments of this disclosure.

[0139] In an exemplary embodiment, a computer-readable storage medium is also provided, wherein when the instructions in the storage medium are executed by a processor of an electronic device, the electronic device is enabled to perform the abnormal account identification method of the present disclosure embodiments.

[0140] In an exemplary embodiment, a computer program product or computer program is also provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the abnormal account identification method provided in the various optional implementations described above.

[0141] It is understood that in the specific implementation of this application, user-related data is involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0142] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM), etc.

[0143] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the claims.

[0144] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is limited only by the appended claims.

Claims

1. An abnormal account identification method, characterized by, The method comprises: obtaining a first operation feature of a target account in a target scene, the first operation feature being a feature of a plurality of historical scene operation data of the target account in at least one scene data dimension, and the first operation feature comprising features of the plurality of historical scene operation data in at least one feature channel dimension in the at least one scene data dimension; performing merging processing on the first operation feature in the at least one scene data dimension and the at least one feature channel dimension to obtain a second operation feature of the target account in at least one scene channel merging dimension; inputting the first operation feature and the second operation feature into an abnormal account identification model, performing multi-dimensional feature extraction processing on the second operation feature from a time sequence dimension, a feature channel dimension and a scene data dimension, and performing abnormal account identification processing on the target account to obtain a target account identification result corresponding to the target account.

2. The method of claim 1, wherein, The abnormal account identification model comprises a multi-dimensional feature extraction network, a feature aggregation network and an abnormal identification network; the inputting the first operation feature and the second operation feature into the abnormal account identification model, performing multi-dimensional feature extraction processing on the second operation feature from a time sequence dimension, a feature channel dimension and a scene data dimension, and performing abnormal account identification processing on the target account to obtain a target account identification result corresponding to the target account comprises: inputting the second operation feature into the multi-dimensional feature extraction network to perform multi-dimensional feature extraction processing from a time sequence dimension, a feature channel dimension and a scene data dimension to obtain a first multi-dimensional feature; inputting the first multi-dimensional feature and the first operation feature into the feature aggregation network to perform feature aggregation processing to obtain a target aggregation feature; inputting the target aggregation feature into the abnormal identification network to perform abnormal account identification processing on the target account to obtain the target account identification result.

3. The method of claim 2, wherein, The multi-dimensional feature extraction network comprises a time sequence feature extraction network, a channel feature extraction network and a scene feature extraction network; the inputting the second operation feature into the multi-dimensional feature extraction network to perform multi-dimensional feature extraction processing from a time sequence dimension, a feature channel dimension and a scene data dimension to obtain a first multi-dimensional feature comprises: inputting the second operation feature into the time sequence feature extraction network to perform time sequence feature extraction processing on the second operation feature in each scene channel merging dimension respectively to obtain a third operation feature in the at least one scene channel merging dimension; inputting the third operation feature into the channel feature extraction network, grouping the third operation feature according to the at least one scene data dimension in the channel feature extraction network, and performing channel feature extraction processing on features in at least one feature channel dimension in each group respectively to obtain a fourth operation feature; The fourth operation feature is input into the scene feature extraction network, the fourth operation feature is grouped according to the at least one feature channel dimension in the scene feature extraction network, and scene feature extraction processing is respectively performed on the features in at least one scene data dimension in each group to obtain the first multi-dimensional feature.

4. The method of claim 3, wherein, The second operation feature is input into the time sequence feature extraction network, and time sequence feature extraction processing is respectively performed on the second operation feature in each scene channel merging dimension to obtain the third operation feature in the at least one scene channel merging dimension, including: The second operation feature is input into the time sequence feature extraction network, and time sequence feature extraction processing is respectively performed on the second operation feature in each scene channel merging dimension based on at least one convolution kernel in the time sequence feature extraction network to obtain the third operation feature. The third operation feature is input into the channel feature extraction network, and the third operation feature is grouped according to the at least one scene data dimension in the channel feature extraction network, and channel feature extraction processing is respectively performed on the features in at least one feature channel dimension in each group to obtain the fourth operation feature, including: The third operation feature is input into the channel feature extraction network, and the third operation feature is grouped according to the at least one scene data dimension, and channel feature extraction processing is respectively performed on the features in at least one feature channel dimension in each group based on at least one convolution kernel in the channel feature extraction network to obtain the fourth operation feature. The fourth operation feature is input into the scene feature extraction network, the fourth operation feature is grouped according to the at least one feature channel dimension in the scene feature extraction network, and scene feature extraction processing is respectively performed on the features in at least one scene data dimension in each group to obtain the first multi-dimensional feature, including: The fourth operation feature is input into the scene feature extraction network, and the fourth operation feature is grouped according to the at least one feature channel dimension, and scene feature extraction processing is respectively performed on the features in at least one scene data dimension in each group based on at least one convolution kernel in the scene feature extraction network to obtain the first multi-dimensional feature.

5. The method of claim 2, wherein, The feature aggregation network includes a format conversion module, a feature fusion module and a feature splicing module; the first multi-dimensional feature and the first operation feature are input into the feature aggregation network for feature aggregation processing to obtain a target aggregation feature, including: The first multi-dimensional feature is input into the format conversion module for format conversion processing to obtain a second multi-dimensional feature consistent with the dimension of the first operation feature; The second multi-dimensional feature and the first operation feature are input into the feature fusion module for feature fusion processing to obtain a target fusion feature; The target fusion feature is input into the feature splicing module, and the target fusion feature is spliced in the at least one scene data dimension and the at least one feature channel dimension to obtain the target aggregation feature.

6. The method according to any one of claims 1 to 5, characterized in that, The abnormal account identification model is trained in the following manner: obtain a training data set, the training data set including multiple sample account numbers each having multiple sample scene operation data in at least one scene data dimension and a preset account identification label corresponding to each of the multiple sample account numbers; the multiple sample account numbers are user account numbers in the target scene; based on the training data set, a to-be-trained abnormal account identification model is trained iteratively to obtain the abnormal account identification model, and in one iteration process, the following operations are performed: obtain first sample operation features of multiple current accounts corresponding to current training data in the training data set, the first sample operation features including multiple sample scene operation data of the multiple current accounts each in the at least one scene data dimension and features in at least one feature channel dimension; the multiple sample account numbers include the multiple current accounts; merge the first sample operation features in the at least one scene data dimension and the at least one feature channel dimension to obtain second sample operation features of the multiple current accounts each in at least one scene channel merged dimension; input the first sample operation features and the second sample operation features into the to-be-trained abnormal account identification model, perform multi-dimensional feature extraction processing on the second sample operation features from the time sequence dimension, the feature channel dimension and the scene data dimension, perform abnormal account identification processing on the multiple current accounts, and obtain predicted account identification results corresponding to the multiple current accounts; update the to-be-trained abnormal account identification model based on the predicted account identification results corresponding to the multiple current accounts and the preset account identification labels corresponding to the multiple current accounts.

7. The method of claim 6, wherein, The training data set is obtained in the following manner: obtain the training data set corresponding to a target region, the target account being a user account of the target region; or, obtain the training data set corresponding to multiple preset historical time periods.

8. An abnormal account identification device, characterized by comprising: The device includes: a first operation feature acquisition module configured to obtain first operation features of a target account in a target scene, the first operation features being features of multiple historical scene operation data of the target account in at least one scene data dimension, and the first operation features including features of the multiple historical scene operation data in at least one feature channel dimension in the at least one scene data dimension; a merging processing module configured to merge the first operation features in the at least one scene data dimension and the at least one feature channel dimension to obtain second operation features of the target account in at least one scene channel merged dimension; an abnormal account identification module configured to input the first operation features and the second operation features into an abnormal account identification model, perform multi-dimensional feature extraction processing on the second operation features from the time sequence dimension, the feature channel dimension and the scene data dimension, perform abnormal account identification processing on the target account, and obtain a target account identification result corresponding to the target account.

9. An electronic device, comprising: including: a processor; a memory for storing the processor-executable instructions; wherein the processor is configured to execute the instructions to implement the abnormal account identification method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, When the instructions in the storage medium are executed by the processor of the electronic device, the electronic device is enabled to perform the abnormal account identification method according to any one of claims 1 to 7.

Images