Model training method and device, equipment, storage medium and program product

Abstract

The invention provides a model training method and device, equipment, a storage medium and a program product, and relates to the technical field of data processing.The method comprises the steps that multiple pieces of first operation data are obtained, and the multiple pieces of first operation data comprise normal operation data and abnormal operation data; multiple pieces of sample data are generated based on the multiple pieces of first operation data, the multiple pieces of sample data comprise multiple pieces of microscopic behavior sample data and macroscopic behavior sample data, and each piece of microscopic behavior sample data in the multiple pieces of microscopic behavior sample data comprises normal operation data and / or abnormal operation data in different time periods; the macroscopic behavior sample data comprises multiple pieces of first operation data; extracting fusion feature vectors corresponding to the microcosmic behavior sample data; and training the first model based on the fusion feature vectors corresponding to the multiple microscopic behavior sample data to obtain a target model. According to the invention, the accuracy of model prediction can be improved.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, specifically to a model training method, apparatus, device, storage medium, and program product. Background Technology

[0002] Identifying user behavior to determine potential risks is a key technology in the security and financial fields. One approach involves training a neural network model to identify user behavior and issue alerts when abnormal behavior is detected. However, this model is trained on sample data, which often relies on manual labeling. This makes it difficult to capture the complex, non-linear relationships between data points during sample data construction, resulting in lower predictive accuracy for models trained on sample data.

[0003] It is evident that the related technologies suffer from low predictive accuracy of the models. Summary of the Invention

[0004] This invention provides a model training method, apparatus, device, storage medium, and program product to address the problem of low prediction accuracy in related technologies.

[0005] To solve the above problems, the present invention is implemented as follows:

[0006] In a first aspect, embodiments of the present invention provide a model training method, comprising:

[0007] Acquire multiple first operation data, including normal operation data and abnormal operation data;

[0008] Multiple sample data are generated based on the multiple first operation data. The multiple sample data includes multiple micro-behavioral sample data and macro-behavioral sample data. Each micro-behavioral sample data includes normal operation data and / or abnormal operation data within different time periods. The macro-behavioral sample data includes the multiple first operation data.

[0009] Extract the fusion feature vector corresponding to the multiple micro-behavioral sample data, and the fusion feature vector is used to characterize the features of the corresponding micro-behavioral sample data and the macro-behavioral sample data;

[0010] The first model is trained based on the fused feature vectors corresponding to the multiple micro-behavioral sample data to obtain the target model. The first model is used to identify different operational data, and the target model is used to identify abnormal operational data.

[0011] Secondly, embodiments of the present invention also provide a model training apparatus, comprising:

[0012] The acquisition module is used to acquire multiple first operation data, which include normal operation data and abnormal operation data;

[0013] The first generation module is used to generate multiple sample data based on the multiple first operation data. The multiple sample data includes multiple micro-behavioral sample data and macro-behavioral sample data. Each micro-behavioral sample data includes normal operation data and / or abnormal operation data within different time periods. The macro-behavioral sample data includes the multiple first operation data.

[0014] The extraction module is used to extract the fusion feature vectors corresponding to the multiple micro-behavioral sample data, and the fusion feature vectors are used to characterize the features of the corresponding micro-behavioral sample data and the macro-behavioral sample data;

[0015] The training module is used to train the first model based on the fusion feature vectors corresponding to the multiple micro-behavioral sample data to obtain the target model. The first model is used to identify different operational data, and the target model is used to identify abnormal operational data.

[0016] Thirdly, embodiments of the present invention also provide an electronic device, including a transceiver and a processor.

[0017] The transceiver is used to acquire multiple first operation data, which include normal operation data and abnormal operation data.

[0018] The processor is configured to generate multiple sample data based on the multiple first operation data, the multiple sample data including multiple micro-behavioral sample data and macro-behavioral sample data, each of the multiple micro-behavioral sample data including normal operation data and / or abnormal operation data within different time periods, and the macro-behavioral sample data including the multiple first operation data;

[0019] The processor is further configured to extract fusion feature vectors corresponding to the plurality of micro-behavioral sample data, the fusion feature vectors being used to characterize the features of the corresponding micro-behavioral sample data and the macro-behavioral sample data;

[0020] The processor is further configured to train a first model based on the fused feature vectors corresponding to the plurality of micro-behavioral sample data to obtain a target model. The first model is used to identify different operational data, and the target model is used to identify abnormal operational data.

[0021] Fourthly, embodiments of the present invention provide an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the program is executed by the processor, it implements the steps of the model training method described in the first aspect.

[0022] Fifthly, embodiments of the present invention provide a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the model training method described in the first aspect.

[0023] In a sixth aspect, the present invention also provides a computer program product, including computer instructions, which, when executed by a processor, implement the steps of the model training method described in the first aspect.

[0024] In this embodiment of the invention, multiple first operation data are acquired, including normal operation data and abnormal operation data. Multiple sample data are generated based on the multiple first operation data, including multiple micro-behavioral sample data and macro-behavioral sample data. Each micro-behavioral sample data includes normal operation data and / or abnormal operation data within different time periods, and the macro-behavioral sample data includes the multiple first operation data. A fusion feature vector corresponding to the multiple micro-behavioral sample data is extracted. The fusion feature vector is used to characterize the features of the corresponding micro-behavioral sample data and the macro-behavioral sample data. A first model is trained based on the fusion feature vector corresponding to the multiple micro-behavioral sample data to obtain a target model. The first model is used to identify different operation data, and the target model is used to identify abnormal operation data. Thus, by extracting the fusion feature vector corresponding to multiple micro-behavioral sample data, the fusion feature vector can determine the correlation between different sample data. Therefore, when training the model using the fusion feature vector, the trained model can effectively learn the correlation between different data, effectively improving the accuracy of model prediction. Attached Figure Description

[0025] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is a flowchart of a model training method provided in an embodiment of the present invention;

[0027] Figure 2This is a schematic diagram of the model structure provided in an embodiment of the present invention;

[0028] Figure 3 This is a structural diagram of a model training device provided in an embodiment of the present invention;

[0029] Figure 4 This is a structural diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0030] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0031] Please see Figure 1 , Figure 1 This is a flowchart of a model training method provided in an embodiment of the present invention, such as... Figure 1 As shown, it includes the following steps:

[0032] Step 101: Obtain multiple first operation data, including normal operation data and abnormal operation data.

[0033] The aforementioned multiple sets of first-operation data are historical data of user operations, which may include normal operation data, such as normal account access data, and abnormal operation data, such as data on cracking account passwords. By acquiring both normal and abnormal operation data, the model trained subsequently can effectively identify normal and abnormal operation data.

[0034] In some implementations, acquiring multiple first operation data includes:

[0035] Acquire multiple log data sets and extract data from them to obtain multiple initial operation data sets;

[0036] The plurality of initial operation data are preprocessed to obtain the plurality of first operation data;

[0037] The preprocessing includes at least one of the following:

[0038] Data cleaning is performed on the multiple initial operation data;

[0039] The initial operation data are standardized.

[0040] The aforementioned log data is saved for each user operation, specifically including user login logs and user operation logs. The user login log records each user login event, including: a unique user identifier (UserID), a login timestamp accurate to milliseconds (LoginTimestamp), the login IP address (LoginIP), a unique device identifier (DeviceID, such as device fingerprint or hardware serial number), client type (such as operating system type, browser version), and geolocation information. The user operation log records all user operations within the system after login, including: a unique user identifier (UserID), an operation timestamp accurate to milliseconds (OperationTimestamp), the specific operation type (such as checking balance, transferring funds, changing password, binding a new device, depositing funds, withdrawing funds, or querying information), the operation target identifier (such as the target account ID for transfers, or the ID of a specific financial product for queries), the operation amount (for transaction-related operations), and the transaction status (such as success or failure). Multiple initial operation data can be extracted from the log data.

[0041] After extracting multiple initial operation data, these data are preprocessed to obtain multiple first operation data. The preprocessing includes at least one of the following: data cleaning of the initial operation data; and standardization of the initial operation data. This preprocessing of the initial operation data facilitates data processing for subsequent model training.

[0042] For example, preprocessing includes converting all timestamps to milliseconds since the Unix epoch; performing SHA-256 hashing on the identification information to achieve anonymization; and performing Z-score normalization on numerical features, etc.

[0043] Step 102: Generate multiple sample data based on the multiple first operation data. The multiple sample data includes multiple micro-behavioral sample data and macro-behavioral sample data. Each micro-behavioral sample data includes normal operation data and / or abnormal operation data within different time periods. The macro-behavioral sample data includes the multiple first operation data.

[0044] The aforementioned micro-behavioral data refers to normal and / or abnormal operational data over a relatively short period of time, while the aforementioned macro-behavioral data refers to normal and / or abnormal operational data over a relatively long period of time. By using micro-behavioral sample data and macro-behavioral sample data to train the subsequent model, the model can learn the correlation between different data during the model training process, thereby improving the accuracy of model prediction.

[0045] In some implementations, all of the multiple first operation data can be used as macroscopic behavioral sample data, while a portion of the multiple first operation data can be used as different microscopic behavioral sample data.

[0046] Step 103: Extract the fusion feature vectors corresponding to the multiple micro-behavioral sample data. The fusion feature vectors are used to characterize the features of the corresponding micro-behavioral sample data and the macro-behavioral sample data.

[0047] The aforementioned fused feature vector is used to characterize the features of the corresponding micro-behavioral sample data and the macro-behavioral sample data. By fusing the feature vector, the correlation between different sample data can be determined. Furthermore, when training the model using the fused feature vector, the trained model can effectively learn the correlation between different data, thereby effectively improving the accuracy of model prediction.

[0048] In some implementations, feature vectors of micro-behavioral sample data and feature vectors of macro-behavioral sample data can be extracted separately, and then the feature vectors of micro-behavioral sample data and macro-behavioral sample data can be fused to obtain a fused feature vector.

[0049] Step 104: Train the first model based on the fusion feature vectors corresponding to the multiple micro-behavioral sample data to obtain the target model. The first model is used to identify different operational data, and the target model is used to identify abnormal operational data.

[0050] The first model mentioned above is a model constructed to identify operational data. By fusing feature vectors, the first model is trained so that the trained target model can effectively identify whether the operational data is abnormal.

[0051] In this embodiment of the invention, multiple first operation data are acquired, including normal operation data and abnormal operation data. Multiple sample data are generated based on the multiple first operation data, including multiple micro-behavioral sample data and macro-behavioral sample data. Each micro-behavioral sample data includes normal operation data and / or abnormal operation data within different time periods, and the macro-behavioral sample data includes the multiple first operation data. A fusion feature vector corresponding to the multiple micro-behavioral sample data is extracted. The fusion feature vector is used to characterize the features of the corresponding micro-behavioral sample data and the macro-behavioral sample data. A first model is trained based on the fusion feature vector corresponding to the multiple micro-behavioral sample data to obtain a target model. The first model is used to identify different operation data, and the target model is used to identify abnormal operation data. Thus, by extracting the fusion feature vector corresponding to multiple micro-behavioral sample data, the fusion feature vector can determine the correlation between different sample data. Therefore, when training the model using the fusion feature vector, the trained model can effectively learn the correlation between different data, effectively improving the accuracy of model prediction.

[0052] In one embodiment, generating multiple sample data based on the plurality of first operation data includes:

[0053] The plurality of first operation data are segmented based on a preset time interval to obtain the plurality of micro-behavioral sample data, wherein the time interval between the first operation data included in different micro-behavioral sample data is greater than or equal to the preset time interval.

[0054] The macroscopic behavioral sample data is constructed based on the multiple microscopic behavioral sample data.

[0055] In this embodiment of the invention, the plurality of first operation data are segmented based on a preset time interval to obtain a plurality of micro-behavioral sample data. The time interval between the first operation data included in different micro-behavioral sample data is greater than or equal to the preset time interval. The macro-behavioral sample data is constructed based on the plurality of micro-behavioral sample data. In this way, by segmenting the plurality of first operation data through a preset time interval to obtain a plurality of micro-behavioral sample data, the time interval between each micro-behavioral sample data and other micro-behavioral sample data is relatively long, which can be considered as operation data based on different purposes.

[0056] The preset time interval can be set to 30 minutes, meaning the time interval between different micro-behavioral sample data is greater than 30 minutes. This allows us to consider the operational data within each micro-behavioral sample data as operational data within the same session, and different micro-behavioral sample data as operational data within different sessions. In this way, each session is constructed as a micro-sequence. .in This is the feature vector of the i-th session (i.e., micro-behavioral sample data). This vector is composed of encoded features such as specific operation type, operation amount, geographical location information, and unique device identifier. s It is the session length.

[0057] Meanwhile, macro-behavioral sample data can be aggregated from all micro-conversations completed by users in the past 24 hours or the past 7 days. Specifically, macro-behavioral sample data can be constructed as macro sequences. The macro-level behavioral sample data consists of aggregated features from multiple sessions. A vector representing the j-th session (e.g., session duration, total number of operations within the session), L m It represents the number of sessions contained in the macro sequence.

[0058] In some implementations, for each sequence S (which can be a micro or macro sequence) in a batch, two different data augmentation strategies T are employed. A and T B Two views are generated independently as positive sample pairs, while other sequences within the batch (the enhanced views) are treated as negative samples.

[0059] The augmentation of sequence data can be expressed by the following formula:

[0060] ;

[0061] ;

[0062] S A and S B This is the enhanced sequence.

[0063] Among them, data augmentation can be achieved by sampling random masking (randomly masking event features with a probability of 0.15), random sequence pruning (randomly selecting a subsequence with a length not less than 80% of the original sequence), and feature noise injection (adding Gaussian noise with a standard deviation of 0.01 to numerical features) to process the data in the sequence.

[0064] Other sequences within the batch (the augmented view) are treated as negative samples.

[0065] In one embodiment, extracting the fused feature vector corresponding to the plurality of microscopic behavioral sample data includes:

[0066] Feature extraction is performed on the multiple micro-behavioral sample data to obtain a first vector corresponding to each micro-behavioral sample data;

[0067] Feature extraction is performed on the macroscopic behavioral sample data to obtain a second vector;

[0068] The first vector and the second vector corresponding to each micro-behavioral sample data are concatenated to obtain the fused feature vector corresponding to the multiple micro-behavioral sample data.

[0069] In this embodiment of the invention, features are extracted from multiple microscopic behavioral sample data to obtain a first vector corresponding to each microscopic behavioral sample data; features are extracted from macroscopic behavioral sample data to obtain a second vector; the first and second vectors corresponding to each microscopic behavioral sample data are concatenated to obtain a fused feature vector corresponding to multiple microscopic behavioral sample data. Thus, by extracting the first vector corresponding to each microscopic behavioral sample data and the second vector corresponding to the macroscopic behavioral sample data, the first and second vectors corresponding to each microscopic behavioral sample data can be concatenated to obtain a fused feature vector corresponding to multiple microscopic behavioral sample data.

[0070] In some implementations, the first model can employ a Multi-Level Contrastive Temporal Transformer (MLCTT) model to capture complex dependencies in operational data at different temporal granularities. Specifically, the latent dimension d of the model can be... model The number of Transformer encoder layers is set to 256, N. _ayers The number of heads N in the multi-head attention mechanism is set to 4. heads Set to 8.

[0071] Specifically, the structure of the first model is as follows: Figure 2 As shown, the constructed micro-sequence and macro-sequence input values ​​are embedded in the layer. The embedding layer processes multiple first operation data to obtain the features of each data. Then, the micro-encoder encodes the features to obtain the first vector corresponding to each micro-behavioral sample data. The macro-encoder encodes the features to obtain the second vector corresponding to the macro-behavioral sample data. The association fusion layer concatenates the first and second vectors corresponding to each micro-behavioral sample data to obtain the fused feature vector corresponding to multiple micro-behavioral sample data. Finally, the feature vector is output through the output layer.

[0072] In this process, all processed operational data (such as operation type, Internet Protocol, device identifier, etc.) is first converted into a unified d through the embedding layer. model 3D dense vectors. To capture the temporal information of events in the sequence, positional encodings in the form of sine and cosine functions are added to the embedding of each operational data.

[0073] In some implementations, position encoding and The calculation formula is as follows:

[0074] ;

[0075] ;

[0076] Where pos is the position index of the data being operated on in the sequence, and k is the embedding dimension index.

[0077] In one embodiment, the plurality of microscopic behavioral sample data includes first sample data, and the step of extracting features from the plurality of microscopic behavioral sample data to obtain a first vector corresponding to each microscopic behavioral sample data includes:

[0078] The initial embedding vector and each first operation data are concatenated to obtain the first embedding vector corresponding to each first operation data. The initial embedding vector is an embedding vector set according to the data type corresponding to the first operation data.

[0079] Calculate the attenuation factor corresponding to each first operation data, wherein the attenuation factor is calculated based on the time interval corresponding to the first operation data, and the time interval is the time interval between the first operation data and the time-adjacent operation data.

[0080] The first embedding vector of the corresponding first operation data is encoded based on the attention mechanism and the decay factor to obtain the second embedding vector corresponding to each first operation data.

[0081] A first vector corresponding to the first sample data is generated based on the second embedding vector corresponding to each first operation data included in the first sample data.

[0082] The aforementioned first sample data is any one of multiple micro-behavioral sample data. In this embodiment of the invention, the initial embedding vector and each first operation data are concatenated to obtain a first embedding vector corresponding to each first operation data. The initial embedding vector is an embedding vector set according to the data type corresponding to the corresponding first operation data. A decay factor is calculated for each first operation data, which is calculated based on the time interval corresponding to the first operation data. The time interval is the time interval between the corresponding first operation data and time-adjacent operation data. The first embedding vector of the corresponding first operation data is encoded based on the attention mechanism and the decay factor to obtain a second embedding vector corresponding to each first operation data. A first vector corresponding to the first sample data is generated based on the second embedding vector corresponding to each first operation data included in the first sample data. Thus, the second embedding vector is obtained through encoding using the attention mechanism and the decay factor, thereby generating the first vector.

[0083] The generation of the first vector can be achieved using a micro-level encoder. It should be noted that the micro-level encoder is responsible for processing the micro-sequence S. session , by N layers It consists of stacked identical Transformer encoder layers. Each encoder layer contains a multi-head self-attention sub-layer, a layer normalization sub-layer, and a feed-forward network sub-layer. The sub-layers are connected by residual connections to capture the correlation of abnormal operation data.

[0084] Specifically, the initial embedding vector and each first operation data are concatenated to obtain the first embedding vector corresponding to each first operation data, which can be expressed by the following formula:

[0085] ;

[0086] In the formula For the initial embedding vector, This is the first operation data. For a learnable mapping matrix, This indicates vector concatenation.

[0087] Furthermore, the attenuation factor corresponding to each of the first operation data is calculated, which can be specifically expressed by the following formula:

[0088] ;

[0089] ;

[0090] In the formula, t i With t j These are the operational data e in the microsequence (i.e., the first sample data). i With e j The corresponding timestamp, For time intervals, As the attenuation factor, is a coefficient.

[0091] Furthermore, the encoding of the first embedding vector of the corresponding first operation data based on the attention mechanism and the decay factor can be calculated using the following formula:

[0092] ;

[0093] ;

[0094] ;

[0095] In the formula, Q, K, and V represent the query, key, and value corresponding to the data being operated on, respectively. For attention score, The attenuation factor is the attention score, and Attention(Q,K,V) is the vector obtained by encoding the operational data in the microsequence.

[0096] After N layers After processing by the micro-encoder of the layer, average pooling is performed on all encoded vectors to obtain the first vector corresponding to the first sample data, which is specifically expressed by the following formula:

[0097] ;

[0098] in the formula h is the first vector corresponding to the first sample data. i L is the vector obtained by encoding the operational data in the microsequence, where L is the number of operational data in the microsequence.

[0099] In one embodiment, the step of extracting features from the macroscopic behavioral sample data to obtain a second vector includes:

[0100] Obtain the frequency adjustment factor for each of the first operation data;

[0101] The second embedding vector of the corresponding first operation data is adjusted based on the frequency adjustment factor of each first operation data to obtain the third embedding vector corresponding to each first operation data.

[0102] The third embedding vectors corresponding to the plurality of first operation data are concatenated to obtain the second vector.

[0103] In this embodiment of the invention, a frequency adjustment factor is obtained for each first operational data; the second embedding vector of the corresponding first operational data is adjusted based on the frequency adjustment factor to obtain a third embedding vector corresponding to each first operational data; the third embedding vectors corresponding to multiple first operational data are concatenated to obtain the second vector. Thus, by adjusting the second embedding vector of the corresponding first operational data through the frequency adjustment factor, a third embedding vector corresponding to each first operational data is obtained, and then the second vector corresponding to the macroscopic behavioral sample data is obtained by concatenating the third embedding vectors corresponding to multiple first operational data.

[0104] In some implementations, feature extraction of the macro-level behavioral sample data to obtain a second vector is performed by a macro-level encoder. This encoder aims to generate the macro-level second vector by capturing the dependencies between these sessions. Specifically, the macro-level encoder consists of N... layers The system consists of stacked identical Transformer encoder layers, each of which includes a multi-head self-attention sublayer, a layer normalization sublayer, and a feed-forward network sublayer. Residual connections are also used between the sublayers.

[0105] It should be noted that, in order to improve the model's performance when handling high-frequency and low-frequency events, a frequency adjustment factor is introduced in this invention. For each session, its internal operation time is weighted and adjusted according to the occurrence frequency, resulting in a frequency-adjusted event representation:

[0106] ;

[0107] In the formula, For frequency adjustment factor, It is the second embedding vector of the i-th operation data.

[0108] Furthermore, after obtaining the third embedding vectors corresponding to multiple first operation data, the third embedding vectors corresponding to the multiple first operation data are concatenated to obtain the second vector, which can be expressed by the following formula:

[0109] ;

[0110] in the formula It refers to the quantity within a macro-series (i.e., macro-behavioral sample data). It is the third embedding vector of the j-th operation data. It is a frequency adjustment factor.

[0111] In some implementations, an inter-session attention mechanism can be introduced to establish connections between sessions or operational data in a macro-sequence, which can be represented by the following formula:

[0112] ;

[0113] ;

[0114] ;

[0115] in, is the weighting coefficient, used to characterize the influence of operational data j on operational data i, and is the output of the attention, used to characterize the vector obtained after encoding the operational data in the macro sequence.

[0116] In one embodiment, concatenating the first vector and the second vector corresponding to each micro-behavioral sample data to obtain the fused feature vector corresponding to the plurality of micro-behavioral sample data includes:

[0117] Using the first vector corresponding to each micro-behavioral sample data as a query and the second vector as a key and value, calculate the first cross-attention vector corresponding to the corresponding micro-behavioral sample data;

[0118] Using the second vector as a query, the second cross-attention vector is calculated by using the first vector corresponding to each micro-behavioral sample data as a key and value.

[0119] The first cross-attention vector and the second cross-attention vector corresponding to each micro-behavioral sample data are concatenated to obtain the fusion feature vector corresponding to the micro-behavioral sample data.

[0120] In this embodiment of the invention, a first vector corresponding to each micro-behavioral sample data is used as a query, and a second vector is used as a key and value to calculate a first cross-attention vector corresponding to the corresponding micro-behavioral sample data; a second cross-attention vector is calculated using the second vector as a query and the first vector corresponding to each micro-behavioral sample data as a key and value; the first cross-attention vector and the second cross-attention vector corresponding to each micro-behavioral sample data are concatenated to obtain a fusion feature vector corresponding to the corresponding micro-behavioral sample data.

[0121] Specifically, the first vector As a query, the second vector Using the key and value as the basis, the first cross-attention is calculated, generating the first cross-attention vector. Secondly, the second vector As a query, the first vector The second cross-attention vector is calculated using the key and value. The final fused feature vector Through and The concatenation of these features allows the fused feature vector to reflect the context of the user's current behavior.

[0122] In some implementations, the first model (MLCTT model) is pre-trained based on the fused feature vectors corresponding to the multiple micro-behavioral sample data, so that it can learn to distinguish between normal and abnormal operation data and normal operation data in an unsupervised environment.

[0123] Specifically, the Information Noise-Contrastive Estimation (InfoNCE) loss function can be used for the model vector. For a fused feature vector that serves as an anchor sequence... The fusion embedding of its positive samples is Others within the batch The fusion embedding of each negative sample is This is used to train the first model.

[0124] The loss function L is calculated using the following formula:

[0125] ;

[0126] in the formula Cosine similarity represents the similarity between two vectors. This is the temperature parameter, set to 0.1.

[0127] Furthermore, the model was trained using the AdamW optimizer, with an initial learning rate set to 1×10⁻⁶. -4 To ensure training stability and improve convergence speed, a cosine annealing scheduler was used for linear warmup within the first 10% of training steps. The batch size was set to 256. The model was trained for 200 epochs on a large dataset of unlabeled user behavior logs until convergence. To prevent overfitting, Dropout (dropout rate of 0.1) and weight decay were applied during model training. The target model was obtained by training the first model using the above methods.

[0128] In one embodiment, the method further includes:

[0129] The third vector is calculated based on the fused feature vector of multiple second sample data, wherein the first operation data included in the multiple second sample data is normal operation data.

[0130] Based on the target model, the behavior of the operation to be analyzed is predicted to obtain the fourth vector;

[0131] Calculate the vector distance between the third vector and the fourth vector;

[0132] If the vector distance is greater than a preset distance threshold, an early warning report is generated. The early warning report is used to characterize the abnormal operation type to which the operation to be analyzed belongs.

[0133] In this embodiment of the invention, a third vector is calculated based on the fused feature vectors of multiple second sample data, wherein the first operation data included in the multiple second sample data is normal operation data; a fourth vector is obtained by predicting the operation behavior to be analyzed based on the target model; the vector distance between the third vector and the fourth vector is calculated; if the vector distance is greater than a preset distance threshold, an early warning report is generated, which is used to characterize the abnormal operation type to which the operation to be analyzed belongs. Thus, the existence of abnormal operation behavior is determined by using vector distance.

[0134] The vector distance between the third vector and the fourth vector can be expressed by the following formula:

[0135] ;

[0136] in the formula Let u be the vector distance, v be the third vector, and y be the fourth vector. The third vector... The fourth vector is calculated from the fused feature vector of multiple second sample data, specifically the average of the fused feature vectors of multiple second sample data; The target model is obtained by predicting the behavior of the operation to be analyzed.

[0137] In other implementations, in addition to using the preset distance threshold to determine whether there is a risk of abnormal operation data, the data can be converted into a score based on the range of wind, and a score threshold can be set to determine whether there is a risk of abnormal operation data.

[0138] Specifically, the calculated anomaly distance can be mapped to a risk score of 0-100. The mapping function is normalized using the Sigmoid function and then multiplied by 100. The specific mapping formula is as follows:

[0139] ;

[0140] In the formula, RiskScore represents the risk score. When the risk score exceeds a set threshold (e.g., the set threshold is 75), an alert report is generated. The alert report is used to characterize the abnormal operation type to which the operation being analyzed belongs.

[0141] In one embodiment, generating the early warning report includes:

[0142] The first abnormal operation type corresponding to the operation to be analyzed is determined based on a preset mapping table, the preset mapping table includes multiple mapping relationships, and different mapping relationships are mapping relationships between different abnormal operation types and operations; and / or, multiple weights of the target model are obtained, and a second abnormal operation type is obtained based on the multiple weights, the weight of the operation corresponding to the second abnormal operation type is greater than the weight of other operations, the other operations are operations other than the operation corresponding to the second abnormal operation type among the operations that the target model can identify, and each weight in the multiple weights is used to characterize the degree of contribution of different operations to the model;

[0143] The warning report is generated based on the first abnormal operation type and / or the second abnormal operation type.

[0144] In this embodiment of the invention, a preset mapping table is pre-configured, so that the first abnormal operation type corresponding to the operation to be analyzed can be determined based on the preset mapping table; and then an early warning report can be generated based on the first abnormal operation type and / or the second abnormal operation type.

[0145] The preset mapping table includes multiple mapping relationships, which are mapping relationships between different abnormal operation types and operations; and / or, multiple weights of the target model are obtained, and a second abnormal operation type is obtained based on the multiple weights. The weight of the operation corresponding to the second abnormal operation type is greater than the weight of other operations. Other operations are operations other than the operation corresponding to the second abnormal operation type that can be identified by the target model. Each weight in the multiple weights is used to characterize the degree of contribution of different operations to the model.

[0146] For example, multiple exception operation types may include at least one of the following:

[0147] Login from a different location: Determine whether the geographical location of the current login address is significantly different from the geographical location of the user's historically frequently used login addresses (e.g., the distance exceeds 200 kilometers).

[0148] Operations for uncommon devices: Determine whether the current device ID is in the user's historical list of frequently used device IDs, or whether it is a new device appearing for the first time;

[0149] Abnormal transaction amount operation: Determine whether there is a single transaction amount in the current session that exceeds 3 times the user's historical average transaction amount, or the cumulative transaction amount that exceeds 5 times the user's historical daily average transaction amount.

[0150] Atypical time operation: Determine whether the current operation occurred within a period of infrequent operation in the user's history (e.g., 3 a.m. to 5 a.m.).

[0151] Suspicious Operation Patterns: Detects whether there are specific high-risk behavior combinations in the current sequence, such as transferring money to multiple new recipients in a short period of time, or making large transactions immediately after modifying key information.

[0152] In some implementations, the cross-attention weights of the Cross-Level Fusion Layer in the MLCTT model, as well as the self-attention weights of the final layer of the micro-encoder, can be extracted as weights corresponding to abnormal operation types. These weights characterize which input events and specific feature dimensions of which events receive the highest attention when the model generates the final fused embedding and makes risk assessments. By identifying these high-weight features or operational data—for example, if the attention weight of the feature "target account is a new account" in a "large transfer" event is significantly higher than other features—this feature is identified as a key risk factor. Through predefined semantic mapping rules, the identified high-weight features or patterns are converted into risk descriptions that business personnel can understand.

[0153] Furthermore, the obtained first and / or second abnormal operation types are further filtered to obtain the most representative abnormal operation type. An early warning report is generated based on this abnormal operation type, and the output is in the form of a structured text description, such as: "This behavior involves login from a different location, use of an uncommon device, and an abnormally large transfer operation."

[0154] Please see Figure 3 , Figure 3 This is a structural diagram of a model training device provided in an embodiment of the present invention, as shown below. Figure 3 As shown, the model training device 300 includes:

[0155] The acquisition module 301 is used to acquire multiple first operation data, including normal operation data and abnormal operation data;

[0156] The first generation module 302 is used to generate multiple sample data based on the multiple first operation data. The multiple sample data includes multiple micro-behavioral sample data and macro-behavioral sample data. Each micro-behavioral sample data includes normal operation data and / or abnormal operation data within different time periods. The macro-behavioral sample data includes the multiple first operation data.

[0157] Extraction module 303 is used to extract the fusion feature vector corresponding to the multiple micro-behavioral sample data, the fusion feature vector being used to characterize the features of the corresponding micro-behavioral sample data and the macro-behavioral sample data;

[0158] The training module 304 is used to train the first model based on the fusion feature vectors corresponding to the multiple micro-behavioral sample data to obtain the target model. The first model is used to identify different operational data, and the target model is used to identify abnormal operational data.

[0159] In one embodiment, the first generation module 302 includes:

[0160] The segmentation submodule is used to segment the plurality of first operation data based on a preset time interval to obtain the plurality of micro-behavioral sample data, wherein the time interval between the first operation data included in different micro-behavioral sample data is greater than or equal to the preset time interval.

[0161] A submodule is constructed to build the macroscopic behavioral sample data based on the multiple microscopic behavioral sample data.

[0162] In one embodiment, the extraction module 303 includes:

[0163] The first extraction submodule is used to extract features from the multiple micro-behavioral sample data to obtain a first vector corresponding to each micro-behavioral sample data.

[0164] The second extraction submodule is used to extract features from the macroscopic behavioral sample data to obtain a second vector.

[0165] The splicing submodule is used to splice the first vector and the second vector corresponding to each micro-behavioral sample data to obtain the fused feature vector corresponding to the multiple micro-behavioral sample data.

[0166] In one embodiment, the plurality of microscopic behavioral sample data includes first sample data, and the first extraction submodule includes:

[0167] The first splicing unit is used to splice the initial embedding vector and each first operation data to obtain the first embedding vector corresponding to each first operation data. The initial embedding vector is an embedding vector set according to the data type corresponding to the corresponding first operation data.

[0168] The first calculation unit is used to calculate the attenuation factor corresponding to each first operation data. The attenuation factor is calculated based on the time interval corresponding to the corresponding first operation data. The time interval is the time interval between the corresponding first operation data and the time-adjacent operation data.

[0169] An encoding unit is used to encode the first embedding vector of the corresponding first operation data based on the attention mechanism and the decay factor to obtain the second embedding vector corresponding to each first operation data.

[0170] The generation unit is configured to generate a first vector corresponding to the first sample data based on the second embedding vector corresponding to each first operation data included in the first sample data.

[0171] In one embodiment, the second extraction submodule includes:

[0172] The acquisition unit is used to acquire the frequency adjustment factor of each of the first operation data;

[0173] An adjustment unit is used to adjust the second embedding vector of the corresponding first operation data based on the frequency adjustment factor of each first operation data, so as to obtain the third embedding vector corresponding to each first operation data.

[0174] The second splicing unit is used to splice the third embedding vectors corresponding to the plurality of first operation data to obtain the second vector.

[0175] In one embodiment, the splicing submodule includes:

[0176] The second calculation unit is used to use the first vector corresponding to each micro-behavioral sample data as a query and the second vector as a key and value to calculate the first cross-attention vector corresponding to the corresponding micro-behavioral sample data.

[0177] The third calculation unit is used to use the second vector as a query, and to calculate the second cross-attention vector by using the first vector corresponding to each micro-behavioral sample data as a key and value.

[0178] The third splicing unit is used to splice the first cross-attention vector and the second cross-attention vector corresponding to each micro-behavioral sample data to obtain the fusion feature vector corresponding to the micro-behavioral sample data.

[0179] In one embodiment, the model training device 300 further includes:

[0180] The first calculation module is used to calculate a third vector based on the fused feature vector of multiple second sample data, wherein the first operation data included by the multiple second sample data is normal operation data.

[0181] The prediction module is used to predict the behavior of the operation to be analyzed based on the target model, and obtain the fourth vector;

[0182] The second calculation module is used to calculate the vector distance between the third vector and the fourth vector;

[0183] The second generation module is used to generate an early warning report when the vector distance is greater than a preset distance threshold. The early warning report is used to characterize the abnormal operation type to which the operation to be analyzed belongs.

[0184] In one embodiment, the second generation module includes:

[0185] The determination submodule is used to determine the first abnormal operation type corresponding to the operation to be analyzed based on a preset mapping table, wherein the preset mapping table includes multiple mapping relationships, and different mapping relationships are mapping relationships between different abnormal operation types and operations; and / or, to obtain multiple weights of the target model, and to obtain a second abnormal operation type based on the multiple weights, wherein the weight of the operation corresponding to the second abnormal operation type is greater than the weight of other operations, wherein the other operations are operations other than the operation corresponding to the second abnormal operation type among the operations that the target model can identify, and each weight in the multiple weights is used to characterize the degree of contribution of different operations to the model;

[0186] The warning report is generated based on the first abnormal operation type and / or the second abnormal operation type.

[0187] The model training apparatus provided in this embodiment of the invention can implement each process of each embodiment of the above-described model training method, with one-to-one correspondence of technical features and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0188] It should be noted that the model training device in the embodiments of the present invention can be a device, or it can be a component, integrated circuit, or chip in an electronic device.

[0189] This invention also provides an electronic device, including: a processor, a memory, and a program stored in the memory and executable on the processor, wherein the program, when executed by the processor, implements the above-described functionality. Figure 1 The various processes of the model training method embodiment shown can achieve the same technical effect, and will not be described again here to avoid repetition.

[0190] For details, see Figure 4 As shown, this embodiment of the invention also provides an electronic device, including a bus 401, a transceiver 402, an antenna 403, a bus interface 404, a processor 405, and a memory 406.

[0191] The transceiver 402 is used to acquire multiple first operation data, which include normal operation data and abnormal operation data.

[0192] The processor 405 is configured to generate multiple sample data based on the multiple first operation data. The multiple sample data includes multiple micro-behavioral sample data and macro-behavioral sample data. Each micro-behavioral sample data includes normal operation data and / or abnormal operation data within different time periods. The macro-behavioral sample data includes the multiple first operation data.

[0193] The processor 405 is further configured to extract the fusion feature vector corresponding to the plurality of micro-behavioral sample data, the fusion feature vector being used to characterize the features of the corresponding micro-behavioral sample data and the macro-behavioral sample data;

[0194] The processor 405 is further configured to train the first model based on the fused feature vectors corresponding to the plurality of micro-behavioral sample data to obtain a target model. The first model is used to identify different operational data, and the target model is used to identify abnormal operational data.

[0195] In one embodiment, generating multiple sample data based on the plurality of first operation data includes:

[0196] The plurality of first operation data are segmented based on a preset time interval to obtain the plurality of micro-behavioral sample data, wherein the time interval between the first operation data included in different micro-behavioral sample data is greater than or equal to the preset time interval.

[0197] The macroscopic behavioral sample data is constructed based on the multiple microscopic behavioral sample data.

[0198] In one embodiment, extracting the fused feature vector corresponding to the plurality of microscopic behavioral sample data includes:

[0199] Feature extraction is performed on the multiple micro-behavioral sample data to obtain a first vector corresponding to each micro-behavioral sample data;

[0200] Feature extraction is performed on the macroscopic behavioral sample data to obtain a second vector;

[0201] The first vector and the second vector corresponding to each micro-behavioral sample data are concatenated to obtain the fused feature vector corresponding to the multiple micro-behavioral sample data.

[0202] In one embodiment, the plurality of microscopic behavioral sample data includes first sample data, and the step of extracting features from the plurality of microscopic behavioral sample data to obtain a first vector corresponding to each microscopic behavioral sample data includes:

[0203] The initial embedding vector and each first operation data are concatenated to obtain the first embedding vector corresponding to each first operation data. The initial embedding vector is an embedding vector set according to the data type corresponding to the first operation data.

[0204] Calculate the attenuation factor corresponding to each first operation data, wherein the attenuation factor is calculated based on the time interval corresponding to the first operation data, and the time interval is the time interval between the first operation data and the time-adjacent operation data.

[0205] The first embedding vector of the corresponding first operation data is encoded based on the attention mechanism and the decay factor to obtain the second embedding vector corresponding to each first operation data.

[0206] A first vector corresponding to the first sample data is generated based on the second embedding vector corresponding to each first operation data included in the first sample data.

[0207] In one embodiment, the step of extracting features from the macroscopic behavioral sample data to obtain a second vector includes:

[0208] Obtain the frequency adjustment factor for each of the first operation data;

[0209] The second embedding vector of the corresponding first operation data is adjusted based on the frequency adjustment factor of each first operation data to obtain the third embedding vector corresponding to each first operation data.

[0210] The third embedding vectors corresponding to the plurality of first operation data are concatenated to obtain the second vector.

[0211] In one embodiment, concatenating the first vector and the second vector corresponding to each micro-behavioral sample data to obtain the fused feature vector corresponding to the plurality of micro-behavioral sample data includes:

[0212] Using the first vector corresponding to each micro-behavioral sample data as a query and the second vector as a key and value, calculate the first cross-attention vector corresponding to the corresponding micro-behavioral sample data;

[0213] Using the second vector as a query, the second cross-attention vector is calculated by using the first vector corresponding to each micro-behavioral sample data as a key and value.

[0214] The first cross-attention vector and the second cross-attention vector corresponding to each micro-behavioral sample data are concatenated to obtain the fusion feature vector corresponding to the micro-behavioral sample data.

[0215] In one embodiment, the processor 405 is further configured to calculate a third vector based on the fused feature vector of multiple second sample data, wherein the first operation data included in the multiple second sample data is normal operation data;

[0216] The processor 405 is further configured to predict the operational behavior to be analyzed based on the target model to obtain a fourth vector;

[0217] The processor 405 is also configured to calculate the vector distance between the third vector and the fourth vector;

[0218] The processor 405 is further configured to generate an early warning report when the vector distance is greater than a preset distance threshold, the early warning report being used to characterize the abnormal operation type to which the operation to be analyzed belongs.

[0219] In one embodiment, generating the early warning report includes:

[0220] The first abnormal operation type corresponding to the operation to be analyzed is determined based on a preset mapping table, the preset mapping table includes multiple mapping relationships, and different mapping relationships are mapping relationships between different abnormal operation types and operations; and / or, multiple weights of the target model are obtained, and a second abnormal operation type is obtained based on the multiple weights, the weight of the operation corresponding to the second abnormal operation type is greater than the weight of other operations, the other operations are operations other than the operation corresponding to the second abnormal operation type among the operations that the target model can identify, and each weight in the multiple weights is used to characterize the degree of contribution of different operations to the model;

[0221] The warning report is generated based on the first abnormal operation type and / or the second abnormal operation type.

[0222] exist Figure 4In this context, a bus architecture (represented by bus 401) is used. Bus 401 can include any number of interconnected buses and bridges, linking various circuits including one or more processors represented by processor 405 and memory represented by memory 406. Bus 401 can also link various other circuits such as peripheral devices, voltage regulators, and power management circuits, which are well known in the art and therefore will not be described further herein. Bus interface 404 provides an interface between bus 401 and transceiver 402. Transceiver 402 can be a single element or multiple elements, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by processor 405 is transmitted over a wireless medium via antenna 403, which further receives data and transmits data to processor 405.

[0223] Processor 405 is responsible for managing bus 401 and general processing, and can also provide various functions, including timing, peripheral interface, voltage regulation, power management, and other control functions. Memory 406 can be used to store data used by processor 405 during operation.

[0224] Optionally, the processor 405 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or a graphics processing unit (GPU).

[0225] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, performs the above-described functions. Figure 1 The various processes of the corresponding model training method embodiments, which achieve the same technical effect, will not be described again here to avoid repetition. The computer-readable storage medium mentioned includes, for example, read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0226] The present invention also provides a computer program product, including computer instructions that, when executed by a processor, implement the above-described... Figure 1 The various processes of the corresponding model training method implementation examples can achieve the same technical effect, and will not be described again here to avoid repetition.

[0227] In the embodiments of this invention, the terms "first," "second," etc., are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products, or devices. Additionally, the use of "and / or" in this application indicates at least one of the connected objects, such as A and / or B and / or C, representing four possibilities: including A alone, B alone, C alone, and the presence of both A and B, both B and C, both A and C, and the presence of A, B, and C.

[0228] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0229] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or second terminal device, etc.) to execute the methods of the various embodiments of this application.

[0230] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A model training method, characterized in that, The method comprises: obtaining a plurality of first operation data, the plurality of first operation data comprising normal operation data and abnormal operation data; generating a plurality of sample data based on the plurality of first operation data, the plurality of sample data comprising a plurality of micro-behavior sample data and macro-behavior sample data, each micro-behavior sample data in the plurality of micro-behavior sample data comprising normal operation data and / or abnormal operation data in different time periods, and the macro-behavior sample data comprising the plurality of first operation data; extracting a fusion feature vector corresponding to the plurality of micro-behavior sample data, the fusion feature vector being used to represent the feature conditions of the corresponding micro-behavior sample data and the macro-behavior sample data; training a first model based on the fusion feature vector corresponding to the plurality of micro-behavior sample data to obtain a target model, the first model being used to identify different operation data, and the target model being used to identify abnormal operation data.

2. The method of claim 1, wherein, The generating a plurality of sample data based on the plurality of first operation data comprises: segmenting the plurality of first operation data based on a preset time interval to obtain the plurality of micro-behavior sample data, and the time interval between the first operation data included in different micro-behavior sample data being greater than or equal to the preset time interval; constructing the macro-behavior sample data based on the plurality of micro-behavior sample data.

3. The method of claim 1, wherein, The extracting a fusion feature vector corresponding to the plurality of micro-behavior sample data comprises: performing feature extraction on the plurality of micro-behavior sample data to obtain a first vector corresponding to each micro-behavior sample data; performing feature extraction on the macro-behavior sample data to obtain a second vector; splicing the first vector corresponding to each micro-behavior sample data and the second vector to obtain the fusion feature vector corresponding to the plurality of micro-behavior sample data.

4. The method of claim 3, wherein, The plurality of micro-behavior sample data comprises a first sample data, and the performing feature extraction on the plurality of micro-behavior sample data to obtain a first vector corresponding to each micro-behavior sample data comprises: splicing an initial embedding vector and each first operation data to obtain a first embedding vector corresponding to each first operation data, the initial embedding vector being an embedding vector set according to a data type corresponding to the respective first operation data; calculating a decay factor corresponding to each first operation data, the decay factor being calculated based on a time interval corresponding to the respective first operation data, the time interval being a time interval between the respective first operation data and an operation data adjacent in time; encoding the first embedding vector of the respective first operation data based on an attention mechanism and the decay factor to obtain a second embedding vector corresponding to each first operation data; generating a first vector corresponding to the first sample data based on the second embedding vector corresponding to each first operation data included in the first sample data.

5. The method of claim 4, wherein, The performing feature extraction on the macro-behavior sample data to obtain a second vector comprises: obtaining a frequency adjustment factor of the each first operation data; adjust a second embedding vector of the corresponding first operation data based on a frequency adjustment factor of the each first operation data, to obtain a third embedding vector corresponding to the each first operation data; splice the third embedding vectors corresponding to the plurality of first operation data to obtain the second vector.

6. The method of claim 3, wherein, The splicing the first vector corresponding to the each micro-behavior sample data and the second vector to obtain the fusion feature vector corresponding to the plurality of micro-behavior sample data comprises: taking the first vector corresponding to the each micro-behavior sample data as a query, the second vector as a key and a value, and calculating a first cross-attention vector corresponding to the corresponding micro-behavior sample data; taking the second vector as a query, and the first vector corresponding to the each micro-behavior sample data as a key and a value to calculate a second cross-attention vector; splicing the first cross-attention vector corresponding to the each micro-behavior sample data and the second cross-attention vector to obtain the fusion feature vector corresponding to the corresponding micro-behavior sample data.

7. The method of any one of claims 1 to 6, wherein, The method further comprises: calculating a third vector based on fusion feature vectors of a plurality of second sample data, the first operation data included in the plurality of second sample data being normal operation data; predicting a fourth vector based on the target model for the to-be-analyzed operation behavior; calculating a vector distance between the third vector and the fourth vector; in a case where the vector distance is greater than a preset distance threshold, generating an early warning report, the early warning report being used to represent an abnormal operation type to which the to-be-analyzed operation belongs.

8. The method of claim 7, wherein, The generating an early warning report comprises: determining a first abnormal operation type corresponding to the to-be-analyzed operation based on a preset mapping table, the preset mapping table comprising a plurality of mapping relationships, different mapping relationships being mapping relationships between different abnormal operation types and operations; and / or, obtaining a plurality of weights of the target model, and obtaining a second abnormal operation type based on the plurality of weights, the operation corresponding to the second abnormal operation type having a weight greater than that of other operations, the other operations being operations other than the operation corresponding to the second abnormal operation type in the operations identifiable by the target model, each weight in the plurality of weights being used to represent a contribution degree of a different operation to the model; generating the early warning report based on the first abnormal operation type and / or the second abnormal operation type.

9. A model training apparatus, comprising: comprise: an acquisition module configured to acquire a plurality of first operation data, the plurality of first operation data comprising normal operation data and abnormal operation data; a first generation module configured to generate a plurality of sample data based on the plurality of first operation data, the plurality of sample data comprising a plurality of micro-behavior sample data and macro-behavior sample data, each micro-behavior sample data in the plurality of micro-behavior sample data comprising normal operation data and / or abnormal operation data in different time periods, and the macro-behavior sample data comprising the plurality of first operation data; an extraction module configured to extract a fusion feature vector corresponding to the plurality of micro-behavior sample data, the fusion feature vector being used to represent feature conditions of the corresponding micro-behavior sample data and the macro-behavior sample data; The training module is configured to train a first model based on the fusion feature vectors corresponding to the plurality of micro-behavior sample data, to obtain a target model, the first model being configured to identify different operation data, and the target model being configured to identify abnormal operation data.

10. An electronic device, comprising: comprising a transceiver and a processor, The transceiver is configured to obtain a plurality of first operation data, the plurality of first operation data comprising normal operation data and abnormal operation data. The processor is configured to generate a plurality of sample data based on the plurality of first operation data, the plurality of sample data comprising a plurality of micro-behavior sample data and macro-behavior sample data, each micro-behavior sample data in the plurality of micro-behavior sample data comprising normal operation data and / or abnormal operation data in different time periods, and the macro-behavior sample data comprising the plurality of first operation data. The processor is further configured to extract fusion feature vectors corresponding to the plurality of micro-behavior sample data, the fusion feature vectors being configured to represent feature conditions of the corresponding micro-behavior sample data and the macro-behavior sample data. The processor is further configured to train a first model based on the fusion feature vectors corresponding to the plurality of micro-behavior sample data, to obtain a target model, the first model being configured to identify different operation data, and the target model being configured to identify abnormal operation data.

11. An electronic device, comprising: comprising: a processor, a memory, and a program stored on the memory and executable on the processor, the program, when executed by the processor, implementing the steps of the model training method according to any one of claims 1 to 8.

12. A computer-readable storage medium, characterized in that, The computer program is stored on the computer readable storage medium, and when executed by the processor, implements the steps of the model training method according to any one of claims 1 to 8.

13. A computer program product, characterised in that, comprising computer instructions, the computer instructions, when executed by the processor, implementing the steps of the model training method according to any one of claims 1 to 8.

Images