User classification detection method and model training method

Abstract

The invention provides a user classification detection method and a model training method, and relates to the technical field of model training, and the method comprises the steps: obtaining multi-source behavior data of a to-be-detected user, and extracting a multi-dimensional feature vector of the to-be-detected user from the multi-source behavior data; based on the multi-dimensional feature vector, the similarity between the to-be-tested user and other users is calculated, and the other users are users except the to-be-tested user; on the basis of the similarity, a first user relation graph is generated, and the first user relation graph is used for representing the adjacent incidence relation between the to-be-tested user and the other users; and inputting the first user relation graph into a user classification detection model, and obtaining a classification detection result of the to-be-detected user output by the user classification detection model.

Description

Technical Field

[0001] This application relates to the field of model training technology, and in particular to a user classification and detection method and a model training method. Background Technology

[0002] With the rapid development of information technology, telecommunications fraud has become a major social problem that infringes on citizens' property security and undermines social stability. Fraudulent methods are becoming increasingly intelligent, organized, and cross-regional. The elderly population, due to their relatively weak ability to discern new technologies, limited information channels, and the fact that they often hold their life savings, have become the main target group of fraudulent activities, facing extremely severe risks to their property and information security.

[0003] In related technologies, the training data distribution of anti-fraud scheme models mainly consists of mainstream users, and the decision boundaries and feature weights tend to reflect the behavioral patterns of mainstream users (young and middle-aged people). The unique behavioral patterns of the elderly population (such as strong social relationships, low-risk exploration, and regular routines) actually constitute different sub-distributions in the feature space. This "distribution shift" makes elderly user samples more likely to fall into the uncertain region of the general model's decision boundary, leading to a significant decrease in the model's generalization ability on them, and a simultaneous increase in the risk of false positives and false negatives. Summary of the Invention

[0004] This application provides a user classification and detection method and a model training method for classifying and detecting users.

[0005] In a first aspect, this application provides a user classification detection method, the method comprising: acquiring multi-source behavioral data of a user to be tested, and extracting multi-dimensional feature vectors of the user to be tested from the multi-source behavioral data; calculating the similarity between the user to be tested and other users based on the multi-dimensional feature vectors, wherein other users are users other than the user to be tested; generating a first user relationship graph based on the similarity, wherein the first user relationship graph is used to represent the adjacent association relationship between the user to be tested and other users; and inputting the first user relationship graph into a user classification detection model to obtain the classification detection result of the user to be tested output by the user classification detection model.

[0006] In one possible implementation, the similarity between the test user and other users is calculated based on multi-dimensional feature vectors. This includes: inputting the multi-source feature vectors of the test user into a parameterized network for feature transformation to obtain the transformed feature vectors of the test user; the parameterized network is trained with the goal of increasing the similarity between users of the same type and decreasing the similarity between users of different types; inputting the multi-source feature vectors of other users into the parameterized network for feature transformation to obtain the transformed feature vectors of other users; calculating the distance between the transformed feature vectors of the test user and the transformed feature vectors of other users, and determining the similarity based on the distance; wherein, the distance and similarity are negatively correlated.

[0007] In one possible implementation, generating a first user relationship graph based on similarity includes: selecting at least one associated user as an adjacent user from other users for the user to be tested based on similarity; and generating the first user relationship graph based on the user to be tested and the adjacent users.

[0008] In one possible implementation, based on similarity, at least one related user is selected as an adjacent user from other users for the user to be tested, including: identifying other users whose similarity to the user to be tested is greater than a preset threshold as candidate related users; sorting the candidate related users from high to low according to the similarity between the candidate related users and the user to be tested, and selecting the top-ranked related user from the sorted candidate related users as an adjacent user according to a preset sampling ratio.

[0009] In one possible implementation, the multi-source behavioral data includes communication behavioral data and application usage behavioral data; extracting the multi-source feature vector of the user under test from the multi-source behavioral data includes: extracting statistical features from the communication behavioral data and extracting behavioral pattern features from the application usage behavioral data; and fusing the statistical features and behavioral pattern features to generate the multi-source feature vector.

[0010] Secondly, this application provides a training method for a user classification and detection model. The method includes: acquiring multi-source behavioral data of each training user in a training user set, and extracting multi-source feature vectors from the multi-source behavioral data; calculating the similarity between any two training users in the training user set based on the multi-source feature vectors; generating a second user relationship graph based on the similarity, the second user relationship graph being used to represent the adjacent association relationship between training users in the training user set; inputting the second user relationship graph and the multi-source feature vectors into a graph neural network model for iterative training, adjusting the parameters of the graph neural network model, and obtaining a user classification and detection model.

[0011] In one possible implementation, the similarity between any two training users in the training user set is calculated based on multi-source feature vectors. This includes: for each training user, inputting the multi-source feature vector of the training user into a parameterized network for feature transformation to obtain the transformed feature vector of the training user; the parameterized network is trained with the goal of increasing the similarity between users of the same type and decreasing the similarity between users of different types; calculating the distance between the transformed feature vectors of any two training users, and determining the similarity between any two training users based on the distance; wherein, the distance and similarity are negatively correlated.

[0012] In one possible implementation, generating a second user relationship graph based on similarity includes: designating each training user as a central training user; selecting at least one associated user as a neighboring user from other training users based on similarity; and generating a second user relationship graph based on the central training user and the neighboring users.

[0013] In one possible implementation, based on similarity, at least one associated user is selected as a neighboring user from other training users for the central training user, including: identifying other training users whose similarity to the central training user is greater than a preset threshold as candidate associated users; sorting the candidate associated users from high to low according to their similarity to the central training user, and selecting the top-ranked associated user from the sorted candidate associated users as a neighboring user according to a preset sampling ratio.

[0014] In one possible implementation, the second user relationship graph and multi-source feature vectors are input into the graph neural network model for iterative training, and the parameters of the graph neural network model are adjusted. This includes: for each training user, by aggregating the multi-source feature vectors of the training user and neighboring training users, determining the updated feature representation of the training user, and obtaining the updated feature identifier of each training user, with neighboring training users determined based on the second user relationship graph; performing user classification detection based on the updated feature representation to obtain the classification detection result; and iteratively adjusting the parameters of the graph neural network model by using the loss between the classification detection result and the true classification category.

[0015] In one possible implementation, the aggregation of multi-source feature vectors of the training user and neighboring training users is achieved through a hierarchical aggregation architecture. The hierarchical aggregation architecture includes at least a graph convolutional aggregation layer and a graph attention aggregation layer connected in sequence. The graph convolutional aggregation layer is used to perform basic aggregation on the multi-source feature vectors of neighboring training users, and the graph attention aggregation layer is used to weight the aggregated multi-source feature vectors.

[0016] Thirdly, this application provides a user classification detection device, comprising: a processing unit and an acquisition unit; the acquisition unit is used to acquire multi-source behavioral data of a user to be tested, and extract multi-dimensional feature vectors of the user to be tested from the multi-source behavioral data; the processing unit is used to calculate the similarity between the user to be tested and other users based on the multi-dimensional feature vectors, wherein other users are users other than the user to be tested; the processing unit is further used to generate a first user relationship graph based on the similarity, wherein the first user relationship graph is used to represent the adjacent association relationship between the user to be tested and other users; the processing unit is further used to input the first user relationship graph into a user classification detection model, and obtain the classification detection result of the user to be tested output by the user classification detection model.

[0017] Fourthly, this application provides a training apparatus for a user classification and detection model. The apparatus includes a processing unit and an acquisition unit. The acquisition unit is used to acquire multi-source behavioral data of each training user in a training user set and extract multi-source feature vectors from the multi-source behavioral data. The processing unit is used to calculate the similarity between any two training users in the training user set based on the multi-source feature vectors. The processing unit is also used to generate a second user relationship graph based on the similarity, the second user relationship graph being used to represent the adjacent association relationships between training users in the training user set. The processing unit is also used to input the second user relationship graph and the multi-source feature vectors into a graph neural network model for iterative training, adjust the parameters of the graph neural network model, and obtain a user classification and detection model.

[0018] Fifthly, this application provides an electronic device comprising: a processor and a memory; the memory storing processor-executable instructions; when the processor is configured to execute the instructions, causing the electronic device to implement a user classification detection method as described in the first aspect and any possible implementation thereof, or a training method for a user classification detection model as described in the second aspect and any possible implementation thereof.

[0019] Sixthly, this application provides a computer-readable storage medium that, when executed by a processor of a server, enables the server to execute the user classification detection method provided by the first aspect, the second aspect, and any possible implementation thereof; or, when executed by a processor of a client, enables the client to execute the user classification detection method of the first aspect and any possible implementation thereof, or the training method of the user classification detection model of the second aspect and any possible implementation thereof.

[0020] Seventhly, this application provides a computer program product. The computer program product includes computer program instructions, which, when executed on a computer (e.g., a receiving node), cause the computer to perform a user classification detection method as described in the first aspect and any possible implementation thereof, or a training method for a user classification detection model as described in the second aspect and any possible implementation thereof.

[0021] The beneficial effects of aspects two through seven mentioned above can be referred to aspect one, and will not be repeated here.

[0022] The technical solution provided in this application offers at least the following benefits: First, by fusing multi-source behavioral data and extracting multi-dimensional feature vectors, it can comprehensively depict user behavior profiles, avoiding the limitations of single-dimensional information. Second, by calculating the similarity between the test user and other users, it can identify user groups with similar behavioral patterns, effectively capturing potential connections between users. Furthermore, based on this similarity, a user relationship graph is generated, transforming the abstract similarity measure into concrete topological connections, thereby constructing a structured representation that intuitively reflects the social or behavioral neighborhood of the test user. Finally, the user relationship graph containing related information is input into a trained classification and detection model, enabling the model to perform collaborative reasoning and discrimination not only based on the user's own characteristics but also on the overall pattern of their related neighborhoods. This allows for more accurate and robust classification when facing complex and hidden abnormal behaviors. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a schematic diagram of the structure of a user classification and detection system provided in an embodiment of this application;

[0025] Figure 2 A flowchart illustrating a user classification detection method provided in an embodiment of this application;

[0026] Figure 3 A flowchart illustrating a training method for a user classification and detection model provided in an embodiment of this application;

[0027] Figure 4 A flowchart illustrating another training method for a user classification and detection model provided in this application embodiment;

[0028] Figure 5 This is a schematic diagram of the structure of a user classification detection device provided in an embodiment of this application;

[0029] Figure 6 A schematic diagram of the structure of a training device for a user classification and detection model provided in an embodiment of this application;

[0030] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0031] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0032] It should be noted that in the embodiments of this application, the words "exemplarily" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design scheme described as "exemplarily" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of the words "exemplarily" or "for example" is intended to present the relevant concepts in a specific manner.

[0033] To facilitate a clear description of the technical solutions of the embodiments of this application, the terms "first" and "second" are used in the embodiments of this application to distinguish the same or similar items with essentially the same function and effect. Those skilled in the art can understand that the terms "first" and "second" are not intended to limit the quantity or execution order.

[0034] With the rapid development of information technology, telecommunications fraud has become a major social problem that infringes upon citizens' property safety and undermines social stability. Fraudulent methods are increasingly characterized by organization, sophistication, and cross-regional operation. Against this backdrop, the elderly, due to their relatively weaker ability to discern emerging technologies and limited access to information, often become the primary targets of fraudulent activities, facing exceptionally severe risks to their property security.

[0035] To address this threat, existing anti-fraud technologies are constantly evolving. Initially, rule-based systems relied on static rule bases, which, while simple to implement, struggled to cope with rapidly evolving new fraud patterns. Subsequently, traditional machine learning models, such as logistic regression and support vector machines (SVM), were introduced. These models perform binary classification using manually designed features, and their performance heavily depends on the quality of feature engineering, failing to effectively model the complex relationships between users. In recent years, deep learning models such as recurrent neural networks (RNNs) and convolutional neural networks (CNNs) can automatically learn deeper features, but they typically analyze users as independent individuals, ignoring the inherent networked and collaborative relationships behind fraudulent behavior.

[0036] To overcome the aforementioned problems, related technologies have attempted to introduce more complex analytical methods. One approach involves constructing a multimodal knowledge graph related to SMS messages and integrating multiple machine learning models for identification, aiming to improve interpretability and real-time performance. Another approach employs Graph Neural Network (GNN) technology. One approach is to construct a heterogeneous graph that integrates original features, interaction features, community and collaborative information to capture multi-dimensional correlations; another approach is to perform high-pass and low-pass filtering on node features in the call network, aggregating high and low frequency signals and utilizing attention mechanisms to identify anomalies. In particular, there are also early warning schemes targeting the elderly population, which integrate multi-source data such as signaling, household registration, internet browsing, and SMS messages to calculate multi-dimensional risk scores for comprehensive assessment and alerts.

[0037] However, the above solutions still have significant shortcomings. First, the understanding and construction of communication networks remain rudimentary. Existing graph-based methods either rely on single, homogeneous explicit interaction relationships for graph construction or fail to effectively filter nodes based on deep-level similarity during association construction. This results in a large number of "noisy neighbors" with dissimilar features and weak connections to the central node, introducing irrelevant interference during information aggregation in graph neural networks and affecting model accuracy. Furthermore, these methods have limited depth in utilizing network structure, making it difficult to effectively uncover hidden multi-hop association patterns. Second, there is a lack of in-depth, targeted modeling for the elderly user group. General anti-fraud models are trained on full user data, and their decision boundaries essentially fit the behavioral distribution of mainstream users. The elderly population exhibits systematic differences in social network structure, risk interaction patterns, and behavioral rhythms, causing their behavioral characteristics to easily fall within the uncertain region of the decision boundary in the feature space of general models, leading to a high misjudgment rate. Current technology lacks analytical models that can adapt to the behavioral characteristics of this group and provide an integrated, targeted design from feature construction to relationship learning.

[0038] Based on this, the user classification and detection method provided in this application, by fusing multi-source behavioral data and extracting multi-dimensional feature vectors, can comprehensively depict user behavior profiles and avoid the limitations of single-dimensional information. Secondly, by calculating the similarity between the test user and other users, it can identify user groups with similar behavioral patterns, effectively capturing potential connections between users. Furthermore, a user relationship graph is generated based on this similarity, transforming the abstract similarity measure into concrete topological connections, thereby constructing a structured representation that intuitively reflects the social or behavioral neighborhood of the test user. Finally, the user relationship graph containing related information is input into a trained classification and detection model, enabling the model to perform collaborative reasoning and discrimination not only based on the user's own characteristics but also on the overall pattern of their related neighborhoods. This allows for more accurate and robust classification when facing complex and hidden abnormal behaviors.

[0039] Figure 1 This is a schematic diagram of the structure of a user classification and detection system provided in an embodiment of this application, as shown below. Figure 1 As shown, the user classification and detection system includes at least one data preparation module 101, a network construction module 102, and a graph learning module 103. The data preparation module 101, network construction module 102, and graph learning module 103 can be connected via communication lines.

[0040] In some embodiments, the data preparation module 101 is used to preprocess the raw data, extract features, and calculate the similarity between users.

[0041] The data preparation module 101 sends the similarity between users to the network construction module 102. Correspondingly, the network construction module 102 receives the similarity between users calculated by the data preparation module 101.

[0042] In some embodiments, the network construction module 102 constructs a communication relationship network, i.e., a user relationship graph, based on similarity to represent the relationships between users, and sends the user relationship graph to the graph learning module 103. Accordingly, the graph learning module 103 receives the user relationship graph.

[0043] It should be understood that a pre-trained graph neural network model is deployed on the graph learning module 103. The graph learning module 103 is used to input the user relationship graph into the model, and then obtain the user classification detection results output by the model.

[0044] Through the above description of the implementation methods, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the network node can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, modules, and network nodes described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0045] Figure 2 This is a flowchart illustrating a user classification detection method provided in an embodiment of this application. The user classification detection method provided in this embodiment can be applied to, for example... Figure 1 In the user classification detection system shown, the user classification detection method provided in this application embodiment can be implemented through the following steps.

[0046] S201. Obtain multi-source behavioral data of the user to be tested, and extract multi-dimensional feature vectors of the user to be tested from the multi-source behavioral data.

[0047] In this embodiment, multi-source behavioral data includes communication behavioral data and application usage behavioral data.

[0048] For example, communication behavior data includes, but is not limited to, call information records and SMS message records. Call information records may include information such as the calling and called numbers, call duration, call time (such as the specific time or time period), and call frequency. SMS message records may include information such as the sending and receiving numbers, number of SMS messages, SMS content keywords (such as the type identifier after desensitization), and sending frequency. Application usage behavior data includes, but is not limited to, mobile application (APP) usage records, specifically covering APP category (such as social, financial, and utility), start and exit timestamps, single and cumulative usage duration, background activity status, and the uplink and downlink data traffic generated.

[0049] In some embodiments, statistical features are extracted from communication behavior data and behavioral pattern features are extracted from application usage behavior data. The statistical features and behavioral pattern features are then fused to generate a multi-source feature vector.

[0050] For example, statistical features extracted from communication behavior data may include: total number of calls, average call duration, number of different call contacts, total number of SMS messages sent, and quantitative indicators such as the frequency of communication activities within a specific time period (e.g., 10:00 PM to 6:00 AM the next day), calculated based on a preset time window (e.g., the past 7 days, the previous month). Behavioral pattern features extracted from application usage behavior data may include: average daily total active time of mobile applications, distribution of frequently used (e.g., the top three most used app categories per day), usage frequency and data consumption ratio of specific types of applications (e.g., mobile payment applications), and the time points of the user's first and last use of smart devices each day, reflecting behavioral habits and preferences.

[0051] For example, for a user under test, the system might extract the following characteristics: 45 outgoing calls last month, with an average call duration of 120 seconds; 2.5 SMS messages sent per week at night; an average daily active time of 4.5 hours on mobile applications, with social applications accounting for 60% of the usage time; and concentrated access to mobile payment applications between 8:00 PM and 10:00 PM daily in the past week, with data consumption during this period exceeding 30% of the user's total data usage. These heterogeneous features extracted from different data sources are normalized and then concatenated or projected onto a unified feature vector space through a lightweight neural network, forming a multi-dimensional feature vector that comprehensively represents the user's behavioral patterns for subsequent similarity calculations and graph construction.

[0052] S202. Calculate the similarity between the user to be tested and other users based on multi-dimensional feature vectors.

[0053] Other users are those other than the user to be tested.

[0054] In some embodiments, the multi-source feature vector of the user to be tested is input into a parameterized network for feature transformation to obtain the transformed feature vector of the user to be tested. The multi-source feature vectors of other users are also input into the parameterized network for feature transformation to obtain the transformed feature vectors of other users. Then, the distance between the transformed feature vector of the user to be tested and the transformed feature vectors of other users is calculated, and the similarity is determined based on the distance.

[0055] In this embodiment, the parameterized network is trained with the goal of increasing the similarity between users of the same type and decreasing the similarity between users of different types. For example, the parameterized network can be a multilayer perceptron (MLP), i.e., a fully connected neural network. This network takes the aforementioned standardized multi-dimensional feature vector as input, performs a linear transformation through a learnable weight matrix, and introduces non-linear expressive power through a non-linear activation function (such as a modified linear unit), ultimately outputting a transformed, more discriminative feature vector. This process can be formally represented by the following formula 1:

[0056] h v =σ(W xv ) Formula 1

[0057] Among them, h v Let represent the transformed feature vector of user v, W represent the weight matrix that the network needs to learn, xv represent the multi-dimensional feature vector input by user v, and σ represent the activation function.

[0058] It should be understood that distance and similarity are negatively correlated.

[0059] For example, before inputting multi-dimensional feature vectors into a parameterized network, data standardization preprocessing can be performed to improve data quality. For instance, a Box-Cox transformation can be applied to the feature data first. This transformation improves the normality and symmetry of the distribution and stabilizes the variance by finding the optimal λ parameter and performing a power transformation on the original data.

[0060] Subsequently, the transformed data is normalized using the empirical cumulative distribution function (CDF), which maps the value of each feature dimension to the interval [0, 1], thereby eliminating the differences in dimensions and scales of different features and weakening the influence of extreme values.

[0061] When calculating the similarity between user u and another user v, the transformed feature vector h of the two is first calculated. u with hv The Euclidean distance between two vectors measures the linear separation between them in a high-dimensional space. The distance D(u, v) is calculated using Formula 2:

[0062] D(u, v) = |h u -h v |2 Formula 2

[0063] It should be understood that the smaller this distance value, the closer the two users are in the transformed feature space. Subsequently, a similarity score is calculated based on this distance. The similarity score should be negatively correlated with the distance, and the transformation method is as follows: Formula 3:

[0064] S(u, v) = 1 - D(u, v) (Formula 3)

[0065] Where S(u, v) represents the similarity. It should be understood that this formula guarantees a similarity of 1 when the distance is 0 (completely similar), and the larger the distance, the lower the similarity.

[0066] For example, suppose a trained parameterized network (e.g., a fully connected network with two hidden layers) maps user features from the original 10 dimensions to an 8-dimensional discriminative space. The transformed feature vector of user A is hA = [0.1, 0.9, 0.2, 0.8, 0.05, 0.95, 0.1, 0.85], and the transformed feature vector of user B is hB = [0.12, 0.88, 0.18, 0.82, 0.08, 0.90, 0.15, 0.82]. Then the Euclidean distance D(A, B) = (0.1 - 0.12)² + (0.9 - 0.88)² + ... + (0.85 - 0.82)² ≈ 0.086.

[0067] Correspondingly, their similarity S(A, B) = 1 - 0.086 = 0.914. If the transformed feature vector of another user C is hC = [0.9, 0.1, 0.85, 0.2, 0.92, 0.1, 0.88, 0.15], then the distance to A D(A, C) ≈ 1.812, and the similarity S(A, C) = 1 - 1.812 = -0.812. It can be seen that the similarity between A and B is much higher than that between A and C, which meets the training objective of parametric networks: "to bring similar users closer together and different users further apart."

[0068] Furthermore, the training of parameterized networks can be achieved by using loss functions such as cross-entropy loss (CE) in the overall model training framework, and by combining gradient descent to optimize its weights W. This allows the transformation features output by the network to effectively serve the final classification task, thereby indirectly optimizing the accuracy of similarity calculation.

[0069] S203. Generate a first user relationship graph based on similarity.

[0070] Among them, the first user relationship graph is used to represent the adjacent association relationship between the user to be measured and other users.

[0071] In some embodiments, based on similarity, at least one associated user is selected from other users as an adjacent user for the user to be measured, and a first user relationship graph is generated based on the user to be measured and the adjacent user.

[0072] Exemplarily, the generation of the first user relationship graph can be achieved through a two-stage screening strategy to control the complexity of the graph while ensuring the effectiveness of the association. The first stage is the screening of neighbor candidates based on a similarity threshold. Specifically, the system sets a preset similarity threshold θ (Theta). For the user to be measured, after calculating the similarity between it and all other users, the other users with a similarity greater than this threshold θ are initially screened out and determined as candidate associated users. This process can be described as: for the user to be measured u and another user v, if their similarity S(u, v)>θ, then a candidate connection edge is established between the two; otherwise, no connection is established. This stage is used to filter out "noisy" users with too large differences in behavior patterns from the user to be measured and weak relevance, ensuring the relevance of the initial candidate neighbor set.

[0073] Specifically, the other users with a similarity greater than the preset threshold to the user to be measured are determined as candidate associated users, and then they are sorted in descending order according to the similarity between the candidate associated users and the user to be measured, and according to the preset sampling ratio, the top-ranked associated users are selected from the sorted candidate associated users as adjacent users.

[0074] Exemplarily, the second stage is the deterministic neighbor sampling based on sorting and ratio. After obtaining the set of candidate associated users, to further optimize the graph structure and improve the calculation efficiency, sampling-based fine screening can be adopted. First, the candidate associated users are sorted in descending order according to their similarity scores to the user to be measured. Subsequently, according to a preset sampling ratio p (0 < p ≤ 1), the top k users are selected from the sorted list as the final adjacent users, where ∣N c (u)∣), N c (u) represents the set of candidate associated users of the user to be measured u, and ∣N c (u)∣ represents the size of this set (i.e., the number of candidate neighbors), represents the ceiling operation.

[0075] It should be understood that the sampling ratio p is used to control the proportion of the final number of retained neighbors to the number of candidate neighbors. Finally, with the user under test as the central node and each selected adjacent user as a neighbor node, an undirected edge or a directed edge (e.g., from the center to the neighbor) is established between each pair of nodes, thus forming a local star-shaped or locally connected subgraph centered on the user under test, which is the generated first user relationship graph.

[0076] For example, suppose the user U to be tested has 100 other users. If the similarity between the user U and 50 of these users is calculated to be greater than the threshold θ = 0.7, these 50 users constitute the candidate set Nc(U). After sorting them by similarity, and setting the sampling ratio p = 0.3, the top 50 users are finally selected. The user with the highest similarity is selected as U's neighbor. The resulting first user relationship graph will contain U and these 15 user nodes, along with the 15 edges between them. This construction method ensures that the connections in the graph are based on strong behavioral similarity, providing high-quality, low-noise local contextual information for the central node, laying the foundation for accurate information aggregation in subsequent graph neural networks.

[0077] S204. Input the first user relationship graph into the user classification detection model and obtain the classification detection results of the user to be tested output by the user classification detection model.

[0078] It should be understood that the user classification detection model is a pre-trained graph neural network model. Its core function is to aggregate the features of nodes in the graph and their neighbor information, learn the deep representation of each node, and make a category determination based on this.

[0079] For example, the first user relationship graph is input into the user classification detection model, and the classification detection result output by the model is that the user U to be tested is identified as having fraud risk, thereby triggering the corresponding early warning or handling process.

[0080] The technical solution provided in this application provides at least the following beneficial effects: By fusing multi-source behavioral data and extracting multi-dimensional feature vectors, a comprehensive user behavior profile can be depicted, avoiding the limitations of single-dimensional information. Secondly, by calculating the similarity between the user under test and other users, user groups with similar behavioral patterns can be identified, effectively capturing potential connections between users. Furthermore, a user relationship graph is generated based on this similarity, transforming the abstract similarity measure into concrete topological connections, thereby constructing a structured representation that intuitively reflects the social or behavioral neighborhood of the user under test. Finally, the user relationship graph containing related information is input into a trained classification and detection model, enabling the model to perform collaborative reasoning and discrimination not only based on the user's own characteristics but also on the overall pattern of its associated neighborhood, thus achieving more accurate and robust classification when facing complex and hidden abnormal behaviors.

[0081] Figure 3 This is a flowchart illustrating a training method for a user classification and detection model provided in an embodiment of this application. The model training method provided in this embodiment can be implemented through the following steps.

[0082] S301. Obtain multi-source behavioral data for each training user in the training user set, and extract multi-source feature vectors from the multi-source behavioral data.

[0083] In this embodiment, multi-source behavioral data includes communication behavioral data and application usage behavioral data.

[0084] For example, communication behavior data includes, but is not limited to, call information records and SMS message records. Call information records may include information such as the calling and called numbers, call duration, call time (such as the specific time or time period), and call frequency. SMS message records may include information such as the sending and receiving numbers, number of SMS messages, SMS content keywords (such as the type identifier after desensitization), and sending frequency. Application usage behavior data includes, but is not limited to, mobile application (APP) usage records, specifically covering APP category (such as social, financial, and utility), start and exit timestamps, single and cumulative usage duration, background activity status, and the uplink and downlink data traffic generated.

[0085] It should be noted that the process of S301 acquiring multi-source behavioral data and extracting multi-source feature vectors is the same as that of S201 above, and will not be repeated here.

[0086] S302. Based on multi-source feature vectors, calculate the similarity between any two training users in the training user set.

[0087] In some embodiments, for each training user, the multi-source feature vector of the training user is input into a parameterized network for feature transformation to obtain the transformed feature vector of the training user, and the distance between the transformed feature vectors of any two training users is calculated, and the similarity between any two training users is determined based on the distance.

[0088] It should be understood that parameterized networks are trained with the goal of increasing the similarity between users of the same category and reducing the similarity between users of different categories. Specifically, a parameterized network can be a fully connected network that acts as a node feature transformer. This network takes a standardized multi-source feature vector xv as input, performs a linear transformation through a learnable weight matrix W, and then passes it through a non-linear activation function σ, outputting the transformed feature representation hv, i.e., hv = σ(Wxv). Here, hv represents the transformed feature vector of user v, W is the parameter matrix that the network needs to learn, and σ is the activation function, such as the ReLU function. This transformation process aims to map the original features to a new high-dimensional representation space, in which the feature representations of users of the same category should be as close as possible, and the feature representations of users of different categories should be as far apart as possible.

[0089] Among them, distance and similarity are negatively correlated.

[0090] For example, before inputting multi-source feature vectors into a parameterized network, data preprocessing can be performed to improve data quality and comparability. Specifically, this includes: First, performing a Box-Cox transformation on the feature data. This transformation, by finding the optimal transformation parameter λ, performs a power transformation on the original data, aiming to improve the normality and symmetry of the data distribution and stabilize the variance of data across different dimensions. For example, for a feature representing "total monthly call duration," the original data may be severely right-skewed; after the Box-Cox transformation, its distribution is closer to a normal distribution. Next, the data after the Box-Cox transformation is standardized using an empirical cumulative distribution function. Specifically, for each feature dimension, its empirical cumulative distribution function is calculated, and each data point is mapped to the value of that point on the cumulative distribution function. This operation transforms the data for each dimension into the interval [0, 1], thereby unifying the scale of different features and reducing the impact of extreme values ​​(outliers) on subsequent calculations. For example, user A's original "average daily application usage data" value is 500MB, which is relatively high among all users. After CDF normalization, it may be mapped to 0.92.

[0091] Based on the transformed feature vectors, the similarity between any two training users (let's call them user u and user v) is calculated. First, the Euclidean distance between their transformed feature vectors hu and hv is calculated. Euclidean distance is a commonly used metric to measure the straight-line distance between two vectors in space, and the distance between the two training users can be obtained using Formula 1 above.

[0092] Then, a similarity score is calculated based on this distance. The similarity score should be negatively correlated with the distance, and the conversion method can be obtained using Formula 2 above.

[0093] For example, suppose users A and B are two training users, and their feature vectors after parameterization by the network are hA = [0.2, 0.8, 0.1] and hB = [0.3, 0.7, 0.2], respectively. Calculate their Euclidean distance: D(A, B) = (0.2 - 0.3)² + (0.8 - 0.7)² + (0.1 - 0.2)² = 0.01 + 0.01 + 0.01 ≈ 0.173. Then their similarity S(A, B) = 1 - 0.173 = 0.827. If user C's transformed features are hC = [0.9, 0.1, 0.8], then the distance to A is D(A, C) ≈ 1.314, and the similarity S(A, C) = 1 - 1.314 = -0.314. It is evident that, under the guidance of a well-trained parameterized network, A and B, both being normal users, have a high similarity, while A and B, which may be abnormal users, have a low similarity or even a negative similarity.

[0094] S303. Generate a second user relationship graph based on similarity.

[0095] The second user relationship graph is used to represent the adjacent relationships between training users in the training user set.

[0096] In some embodiments, each training user is used as a central training user, and based on similarity, at least one associated user is selected from other training users as a neighboring user for the central training user, thereby generating a second user relationship graph based on the central training user and the neighboring users.

[0097] For example, the construction of the second user relationship graph can employ a two-stage screening strategy to ensure strong correlations between connections and computational efficiency. The first stage is preliminary screening based on a similarity threshold. Specifically, the system presets a similarity threshold θ (Theta). For each training user as the center, the similarity between it and all other users in the training user set is calculated. If the similarity between another user and the center user is greater than the threshold θ, it is preliminarily identified as a candidate associated user; otherwise, it is not considered. This process can be defined as follows: for the center user vi and another user vj, if S(vi, vj) > θ, a candidate edge is established between them; otherwise, no edge is established. This step is used to filter connections that differ too much from the center user's behavior pattern and have weak correlations, forming a preliminary candidate neighbor set that removes a large number of "weak connections" or "noisy connections".

[0098] Specifically, other training users whose similarity to the central training user is greater than a preset threshold are identified as candidate associated users. These candidates are then sorted from highest to lowest similarity to the central training user. Based on a preset sampling ratio, the top-ranked associated users are selected as adjacent users from the sorted candidate associated users.

[0099] Exemplarily, the second stage is precise sampling based on sorting and ratio. After obtaining the candidate associated user set for each central user, precise sampling is implemented to further optimize the graph structure, ensure information quality, and control the density of the graph (i.e., the number of edges). First, the candidate associated users of each central user are sorted in descending order according to their similarity scores with the central user. Then, according to a preset sampling ratio p (0 < p ≤ 1), a part of the users at the front of the sorted list are selected as the final adjacent users. Specifically, for a central user v, let its candidate associated user set be Nc(v) and the set size be |Nc(v)|, then the number k of users finally selected as adjacent users can be calculated by the formula k = min([p × |Nc(v)|], |Nc(v)|), where represents the ceiling operation.

[0100] It should be understood that the sampling ratio p is used to control the proportion of the number of neighbors reserved for each node to the number of its candidate neighbors.

[0101] Furthermore, taking each training user as a node and the determined adjacent user relationship as an edge, a complete second user relationship graph is constructed. For example, assume that the training user set has 10,000 users. For the central user U, it is calculated that the similarity with another 200 users is greater than the threshold θ = 0.6, and these 200 users form its candidate set Nc(U). After sorting the candidate set by similarity, the sampling ratio p = 0.2 is set, and finally the top 40 users with the highest similarity are selected as the adjacent users of U. After performing this operation on all training users in the set, the generated relationship graph will contain all user nodes and a large number of edges formed by these "central - adjacent" pairs.

[0102] This method filters out low - correlation connections through thresholds and controls the neighbor scale through ratio sampling, thereby effectively avoiding the problem of low computational efficiency of the subsequent graph neural network due to the graph being too dense while retaining the most informative associations, and providing high - quality and easy - to - process structured input for model training.

[0103] S304. Input the second user relationship graph and multi - source feature vectors into the graph neural network model for iterative training, adjust the parameters of the graph neural network model, and obtain a user classification detection model.

[0104] In some embodiments, for each training user, by aggregating the multi - source feature vectors of the training user and adjacent training users, the updated feature representation of the training user is determined, the updated feature identifier of each training user is obtained, and user classification detection is performed based on the updated feature representation to obtain a classification detection result. Furthermore, the parameters of the graph neural network model are iteratively adjusted through the loss between the classification detection result and the true classification category.

[0105] Among them, adjacent training users are determined based on the second user relationship graph.

[0106] For example, the training of a graph neural network model follows a message-passing paradigm, the core of which lies in enabling the feature representation of each node to incorporate the structural information of its neighborhood through multiple iterations. Specifically, the model receives a second user relationship graph (representing node connectivity) and multi-source feature vectors of each node as input. In each training round (or each forward propagation process), for each node in the graph (i.e., the training user), the model performs an aggregation operation, combining and transforming its own features with the features of all its neighboring nodes (determined based on the second user relationship graph), thereby generating the updated feature representation of that node in the current layer (or current round). This process is crucial for graph neural networks to achieve the convergence of information from local neighborhoods to the central node.

[0107] The training of this graph neural network model follows the message-passing paradigm, and its inter-layer transition formula is described in Equation 4 below:

[0108]

[0109] in, This represents the embedding representation of node v in layer l. Let v' be the initial multi-source feature vector of node v, v′ be the neighboring nodes of node v, ε represent the edge set in the second user relationship graph, and σ be the activation function. Through multi-layer stacking, the node embedding is finally defined. For z v , indicating the output of the last layer.

[0110] It should be understood that the aggregation of multi-source feature vectors of training users and their neighboring training users is achieved through a hierarchical aggregation architecture.

[0111] In some embodiments, the hierarchical aggregation architecture includes at least a graph convolutional aggregation layer and a graph attention aggregation layer connected in sequence, wherein the graph convolutional aggregation layer is used to perform basic aggregation on the multi-source feature vectors of adjacent training users, and the graph attention aggregation layer is used to weight the aggregated multi-source feature vectors.

[0112] For example, a graph convolutional aggregation layer (GCN layer) can achieve average aggregation of neighborhood features. This layer utilizes the structural information of the graph, specifically by performing a symmetrically normalized weighted summation of the features of neighboring nodes using the graph's renormalized Laplacian matrix. Its calculation process can be described as follows: for node vi,

[0113]

[0114] in, Represents node v iThe output feature vector (embedding representation) of the l-th layer; σ represents a nonlinear activation function, such as the rectified linear unit (ReLU); Represents node v i The extended neighbor set typically includes itself and its first-order neighbors; Represents the renormalized Laplace matrix The elements in the i-th row and j-th column of the matrix are used to calculate the adjacency matrix and degree matrix of the graph. The element values ​​encode the connection strength and normalized weights between nodes; W (l) This represents the trainable weight matrix of the l-th layer, used for linear transformation of the input features; Represents neighbor node v j The output feature vector of the (l-1)th layer is used as the input of this layer.

[0115] The essence of Formula 4 is to take the upper-level features of all its neighbors (including itself) for each node, and then perform a linear transformation W. (l) Then, according to the The graph structure-related fixed weights are weighted and averaged, and finally nonlinearity is introduced through an activation function. The Graph Attention Aggregation Layer (GAT layer) builds upon the GCN layer aggregation by introducing an attention mechanism, which adaptively assigns different aggregation weights to different neighbor nodes, thereby enhancing the model's ability to discriminate key neighbors. This layer first transforms the input features of all nodes using a shared linear transformation weight matrix W. Then, for the center node i and each of its neighbor nodes j, an attention coefficient eij is calculated to measure the importance of node j to node i.

[0116] It should be understood that calculating attention coefficients typically involves a learnable attention vector *a* and feature concatenation, introducing non-linearity using the LeakyReLU activation function. The calculated raw attention coefficients are normalized using the Softmax function to obtain the final attention weights αij. The updated features of a node are obtained by weighted summation of the transformed features of all its neighbors based on the attention weights.

[0117] One of its core formulas is the calculation of attention weights, namely:

[0118] 1. Calculate the attention coefficient between neighboring nodes i and j:

[0119]

[0120] Where, α ijDuring aggregation, represents the normalized attention weights of neighbor node j to center node i; 'a' represents the trainable parameter vector (the core of the attention mechanism) used to calculate the correlation between node pairs; 'W' represents the shared linear transformation weight matrix; 'h' represents the normalized attention weights of neighbor node j to center node i; 'a' represents the trainable parameter vector (the core of the attention mechanism) used to calculate the correlation between node pairs; 'W' represents the shared linear transformation weight matrix; 'h' represents the normalized attention weights of neighbor node j to center node i during aggregation; 'a' represents the normalized attention weights of neighbor node j to center node i during aggregation ... i The input feature vector of node i and h represent the sum of the input feature vectors. j This represents the input feature vector of node j; Let i represent the set of neighboring nodes of node i.

[0121] Through the above hierarchical architecture, the model first uses the GCN layer to efficiently and stably fuse first-order neighborhood information, and then uses the GAT layer to perform fine-grained importance filtering on the aggregated information.

[0122] 2. The attention coefficients of all nodes constitute the attention matrix Ω, expressed as:

[0123]

[0124] If i and j are neighbors, αij is calculated using the above formula; otherwise, αij is 0.

[0125] 3. Calculate the new node embedding representation based on the attention coefficient:

[0126]

[0127] in, It is the set of neighbors of node v. For example, for node v, the attention weights of its three neighbors are 0.6, 0.3, and 0.1 respectively, then the weights of the features of the three neighbors are distributed in this proportion during aggregation.

[0128] During training, the node embedding representation z in the last layer v The data is fed into a multilayer perceptron (MLP) for classification tasks. The loss function of the graph neural network model uses the cross-entropy loss function, which specifically includes:

[0129] For the GCN part, the loss function is defined as:

[0130] For the GAT part, the loss function is defined as:

[0131]

[0132] Among them, y v This is the true label of node v. The parameters of the graph neural network model (including the weight matrix W(l) of the GCN layer, the weight matrix W of the GAT layer, and the attention vector a) are iteratively adjusted using the backpropagation algorithm and gradient descent optimizer until the loss value converges, ultimately yielding a trained user classification and detection model.

[0133] like Figure 4 As shown, the overall process of training the user classification and detection model provided in this application embodiment is introduced. Specifically, the process mainly includes two core stages: neighbor sampling and graph neural network learning.

[0134] In the neighbor sampling phase, the system first acquires multi-source behavioral data from all training users as input. Next, the multi-source behavioral data undergoes feature standardization to eliminate the influence of dimensions. Then, a feature transformation network maps the standardized multi-source behavioral data to a new representation space, resulting in transformed multi-dimensional feature vectors. Based on these multi-dimensional feature vectors, the similarity between training users is calculated. Combining this with the original graph topology, a Top-p neighbor sampling strategy is employed to select the most relevant group of neighboring users for each training user, ultimately constructing a more robust and discriminative user relationship graph for subsequent learning. In the graph neural network learning phase, the user relationship graph obtained from the above sampling is input into a multi-layer graph neural network. This network consists of multiple consecutive aggregation layers. Each layer (e.g., aggregator 1, aggregator 2, ..., aggregator n) performs the following operations: First, it aggregates the feature representations of the center training user and its neighboring training users in the upper layer; then, it passes the aggregation result through a non-linear activation function to generate a new node representation for the current layer. After multiple layers of such message passing and feature transformation, each training user obtains a final embedded representation containing high-order neighborhood information. Finally, based on this final embedding, downstream tasks (such as node classification) are performed, and the graph neural network loss function is calculated to optimize the parameters of the entire model through backpropagation.

[0135] In an exemplary embodiment, this application also provides a user classification detection device. Figure 5 This is a schematic diagram of the user classification detection device provided in an embodiment of this application. Figure 5 As shown, the user classification detection device includes a processing unit 501 and an acquisition unit 502.

[0136] The acquisition unit 502 is used to perform... Figure 2 The operation of step S201 in the schematic representation; the processing unit 5001 is used to execute Figure 2 The illustrated steps are S202, S203, and S204.

[0137] In an exemplary embodiment, this application also provides a training apparatus for a user classification and detection model. Figure 6 This is a schematic diagram of the structure of a training device for a user classification and detection model provided in an embodiment of this application, as shown below. Figure 6 As shown, the training device for the user classification detection model includes a processing unit 601 and an acquisition unit 602.

[0138] The acquisition unit 602 is used to perform... Figure 3 The operation of step S301 in the schematic representation; the processing unit 601 is used to execute Figure 3 The illustrated steps are S302, S303, and S304.

[0139] Of course, the user classification and detection device and the training device for predicting the computer room temperature field include, but are not limited to, the unit modules listed above. Furthermore, the specific functions that the above functional units can achieve include, but are not limited to, the functions corresponding to the method steps in the above embodiments. Detailed descriptions of the user classification and detection device and its other modules can be found in the detailed descriptions of their corresponding method steps; these descriptions will not be repeated here.

[0140] In an exemplary embodiment, this application also provides a computer program product that, when run on a computer, causes the computer to execute the aforementioned related method steps to implement the user classification detection method described above.

[0141] In an exemplary embodiment, this application also provides an electronic device. Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 7 As shown, the electronic device may include a processor 1101 and a memory 1102; the memory 1102 stores instructions executable by the processor 1101; when the processor 1101 is configured to execute the instructions, the electronic device implements the method as described in the foregoing method embodiments.

[0142] In an exemplary embodiment, this application also provides a computer-readable storage medium storing computer program instructions thereon; when the computer program instructions are executed by an electronic device, the electronic device performs the method as described in the foregoing embodiments. The computer-readable storage medium may be a non-transitory computer-readable storage medium, such as a ROM, random access memory (RAM), CD-ROM, magnetic tape, floppy disk, and optical data storage device.

[0143] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented using software programs, implementation can be, in whole or in part, in the form of a computer program product. This computer program product includes one or more computer-executable instructions. When these computer-executable instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer-executable instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer-executable instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device containing one or more servers, data centers, etc., that can be integrated with the medium. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state disks, SSDs).

[0144] Although this application has been described herein in conjunction with various embodiments, those skilled in the art, by reviewing the accompanying drawings, disclosure, and appended claims, will understand and implement other variations of the disclosed embodiments in carrying out the claimed application. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple components. A single processor or other unit can implement several functions listed in the claims. While different dependent claims may recite certain measures, this does not mean that these measures cannot be combined to produce good results.

[0145] Although this application has been described in conjunction with specific features and embodiments, it is obvious that various modifications and combinations can be made thereto without departing from the spirit and scope of this application. Accordingly, this specification and drawings are merely exemplary illustrations of this application as defined by the appended claims, and are considered to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Clearly, those skilled in the art can make various alterations and modifications to this application without departing from the spirit and scope of this application. Thus, if such modifications and modifications of this application fall within the scope of the claims of this application and their equivalents, this application is also intended to include such modifications and modifications.

[0146] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A user classification and detection method, characterized in that, The method includes: Acquire multi-source behavioral data of the user to be tested, and extract the multi-dimensional feature vector of the user to be tested from the multi-source behavioral data; Based on the multi-dimensional feature vector, the similarity between the user to be tested and other users is calculated, where the other users are users other than the user to be tested. Based on the similarity, a first user relationship graph is generated, which is used to represent the adjacent association relationship between the user to be tested and the other users. Input the first user relationship graph into the user classification detection model, and obtain the classification detection result of the user to be tested output by the user classification detection model.

2. The method according to claim 1, characterized in that, The calculation of the similarity between the user to be tested and other users based on the multi-dimensional feature vector includes: The multi-source feature vector of the user to be tested is input into a parameterized network for feature transformation to obtain the transformed feature vector of the user to be tested. The parameterized network is trained with the goal of increasing the similarity between users of the same type and decreasing the similarity between users of different types. The multi-source feature vectors of the other users are input into a parameterized network for feature transformation to obtain the transformed feature vectors of the other users. Calculate the distance between the transformed feature vector of the user to be tested and the transformed feature vectors of other users, and determine the similarity based on the distance; Among them, distance and similarity are negatively correlated.

3. The method according to claim 1 or 2, characterized in that, The step of generating the first user relationship graph based on the similarity includes: Based on the similarity, at least one associated user is selected from other users as an adjacent user for the user to be tested; Based on the user to be tested and the adjacent users, the first user relationship graph is generated.

4. The method according to claim 3, characterized in that, The step of selecting at least one associated user as a neighboring user from other users based on the similarity includes: Other users whose similarity to the user to be tested is greater than a preset threshold are identified as candidate associated users; The candidate associated users are sorted from high to low according to their similarity to the user to be tested, and the top-ranked associated users are selected as the adjacent users according to a preset sampling ratio.

5. The method according to claim 1, characterized in that, The multi-source behavioral data includes communication behavioral data and application usage behavioral data; The step of extracting the multi-source feature vector of the user under test from the multi-source behavioral data includes: Statistical features are extracted from the communication behavior data, and behavioral pattern features are extracted from the application usage behavior data; The statistical features and behavioral pattern features are fused to generate the multi-source feature vector.

6. A training method for a user classification and detection model, characterized in that, The method includes: Obtain multi-source behavioral data for each training user in the training user set, and extract multi-source feature vectors from the multi-source behavioral data; Based on the multi-source feature vector, the similarity between any two training users in the training user set is calculated; Based on the similarity, a second user relationship graph is generated, which is used to represent the adjacent association relationships between training users in the training user set. The second user relationship graph and the multi-source feature vector are input into the graph neural network model for iterative training. The parameters of the graph neural network model are adjusted to obtain the user classification and detection model.

7. The training method according to claim 6, characterized in that, Based on the multi-source feature vectors, the similarity between any two training users in the training user set is calculated, including: For each training user, the multi-source feature vector of the training user is input into a parameterized network for feature transformation to obtain the transformed feature vector of the training user. The parameterized network is trained with the goal of increasing the similarity between users of the same type and decreasing the similarity between users of different types. Calculate the distance between the transformed feature vectors of any two training users, and determine the similarity between the two training users based on the distance; Among them, distance and similarity are negatively correlated.

8. The training method according to claim 6 or 7, characterized in that, The step of generating a second user relationship graph based on the similarity includes: Each training user is treated as a central training user; Based on the similarity, at least one associated user is selected as a neighboring user from other training users for the central training user; The second user relationship graph is generated based on the central training user and the neighboring users.

9. The training method according to claim 8, characterized in that, The step of selecting at least one associated user as a neighboring user from other training users based on the similarity includes: Other training users whose similarity to the central training user is greater than a preset threshold are identified as candidate associated users; The candidate associated users are sorted from high to low according to their similarity to the central training user, and the top-ranked associated user is selected as the neighboring user from the sorted candidate associated users according to a preset sampling ratio.

10. The training method according to claim 6, characterized in that, The step of iteratively training the graph neural network model by inputting the second user relationship graph and the multi-source feature vector into the graph neural network model and adjusting the parameters of the graph neural network model includes: For each training user, the updated feature representation of the training user is determined by aggregating the multi-source feature vectors of the training user and neighboring training users, and the updated feature identifier of each training user is obtained. The neighboring training users are determined based on the second user relationship graph. Based on the updated feature representation, user classification and detection are performed to obtain the classification and detection results; The parameters of the graph neural network model are iteratively adjusted based on the loss between the classification detection result and the true classification category.

11. The training method according to claim 10, characterized in that, The aggregation of the multi-source feature vectors of the training user and its neighboring training users is achieved through a hierarchical aggregation architecture. The hierarchical aggregation architecture includes at least a graph convolutional aggregation layer and a graph attention aggregation layer connected in sequence. The graph convolutional aggregation layer is used to perform basic aggregation on the multi-source feature vectors of adjacent training users, and the graph attention aggregation layer is used to weight the aggregated multi-source feature vectors.

12. An electronic device, characterized in that, A processor and a memory; the memory is used to store computer programs or instructions, and the processor is used to run the computer programs or instructions to implement the user classification detection method as described in any one of claims 1-5, or to implement the user classification detection model training method as described in any one of claims 6-11.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores instructions that, when executed by a computer, enable the computer to perform the user classification detection method according to any one of claims 1-5, or to implement the training method for the user classification detection model according to any one of claims 6-11.

14. A computer program product, characterized in that, The computer program product includes instructions that, when executed on a computer, enable the computer to perform the user classification detection method as described in any one of claims 1-5, or to implement the training method for the user classification detection model as described in any one of claims 6-11.

Images