Method, system, storage medium and program product for detecting anomalous users
By employing a three-layer detection structure that combines behavioral evaluation rules, unsupervised learning models, and supervised learning models, the problem of fixed threshold rules failing to identify malicious users is solved, achieving efficient and accurate abnormal user detection and improving user experience.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHINA UNIONPAY
- Filing Date
- 2026-01-28
- Publication Date
- 2026-05-29
AI Technical Summary
Existing technologies based on fixed thresholds are difficult to effectively identify malicious users and are easily compromised by malicious users, leading to the wrongful banning of normal users and affecting user experience.
A three-layer detection structure is adopted, including pre-defined behavior evaluation rules, an unsupervised learning model, and a supervised learning model, to identify abnormal users through a set of user behavior features. First, the behavior evaluation rules are used to quickly filter obviously abnormal users. Then, the unsupervised learning model is trained on unlabeled data. Finally, the supervised learning model is used for accurate detection.
It improves the accuracy of abnormal user detection, reduces the false negative and false positive rates, enhances user experience, and saves model processing resources.
Smart Images
Figure CN122114944A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of computers, and more specifically to methods for detecting abnormal users, systems for detecting abnormal users, computer-readable storage media for implementing the above methods, and computer program products. Background Technology
[0002] Coupon promotions are an important marketing tool, frequently used in daily marketing scenarios to attract customers, subsidize users, and thus promote user conversion and increase marketing effectiveness. However, the process of distributing coupons to users has given rise to malicious coupon grabbing by criminals and automated coupon grabbing by scripts. This not only severely depletes coupon resources available to legitimate users but also impacts the system stability of the business platform.
[0003] Currently, user behavior is generally judged based on rules with fixed thresholds. For example, if a user clicks the coupon button more than a set threshold per minute, the user is identified as a risk user and banned. However, rules based on fixed thresholds are easily detected and compromised by malicious users, making it difficult to effectively identify malicious users. Furthermore, they may also mistakenly identify normal users as malicious users and ban them, thus affecting the normal user experience. Summary of the Invention
[0004] To address or at least alleviate one or more of the above problems, the following technical solutions are provided.
[0005] According to a first aspect of this application, a method for detecting abnormal users is provided, the method comprising the following steps: determining a set of user behavior features for the multiple users based on user behavior logs of multiple users; determining abnormal users and candidate users from the multiple users based on the set of user behavior features using preset behavior evaluation rules; determining normal users and abnormal candidate users from the candidate users based at least on anomaly metrics of the candidate users obtained by inputting the set of user behavior features of the candidate users into an unsupervised learning model; and determining a risk identification feature set for the abnormal candidate users based at least on the anomaly metrics of the abnormal candidate users and the set of user behavior features; determining normal users and abnormal users from the abnormal candidate users based on the anomaly metrics of the abnormal candidate users determined by inputting the risk identification feature set of the abnormal candidate users into a supervised learning model.
[0006] According to an embodiment of this application, the method for detecting abnormal users, wherein determining the user behavior feature set of the multiple users based on the user behavior logs of multiple users includes: performing session segmentation on the user behavior logs of the multiple users based on user identification information and timestamp information in the user behavior logs of the multiple users to obtain user behavior logs for one or more user sessions for each user; performing data cleaning on the user behavior logs for one or more user sessions for each user to remove invalid data fields; and determining the user behavior feature set of each user based on the user behavior logs for one or more user sessions for each user with invalid data fields removed.
[0007] According to one embodiment or any of the above embodiments of the present application, the method for detecting abnormal users, wherein the user behavior feature set includes one or more of the following: behavior frequency features, behavior time sequence features, behavior concentration features, and time distribution features.
[0008] According to an embodiment of this application or any of the above embodiments, the method for detecting abnormal users, wherein the preset behavior evaluation rule includes a combination of one or more judgment conditions, and each judgment condition includes an inequality constructed based on one or more user behavior features in the user behavior feature set.
[0009] The method for detecting abnormal users according to one embodiment or any of the above embodiments of this application, wherein determining abnormal users and candidate users from a plurality of users based on a set of user behavior features using a preset behavior evaluation rule includes: determining whether one or more user behavior features in the user behavior feature set of each of the plurality of users satisfy one or more judgment conditions in the preset behavior evaluation rule; determining the user as an abnormal user in response to determining that one or more user behavior features in the user behavior feature set of a user satisfy one or more judgment conditions in the preset behavior evaluation rule; and determining the user as a candidate user in response to determining that one or more user behavior features in the user behavior feature set of a user do not satisfy each judgment condition in the preset behavior evaluation rule.
[0010] The method for detecting abnormal users according to one embodiment or any of the above embodiments of this application, wherein determining normal users and abnormal candidate users from the candidate users based at least on the abnormality metric value of the candidate users obtained by inputting the user behavior feature set of the candidate users into an unsupervised learning model, includes: inputting the user behavior feature set of the candidate users into the abnormality metric value of the candidate users obtained by inputting the user behavior feature set of the candidate users into an unsupervised learning model; constructing a weight function based on the historical behavior feature set of the candidate users and the user's historical tags; using the weight function to weight the abnormality metric value of the candidate users to obtain an enhanced abnormality metric value of the candidate users; and determining normal users and abnormal candidate users from the candidate users based on the enhanced abnormality metric value of the candidate users.
[0011] The method for detecting abnormal users according to one embodiment or any of the above embodiments of this application, wherein determining normal users and abnormal candidate users from the candidate users based on the enhanced abnormality metric value of the candidate users includes: comparing the enhanced abnormality metric value of the candidate users with an abnormality threshold; determining the candidate user as an abnormal candidate user in response to the enhanced abnormality metric value of the candidate user being greater than or equal to the abnormality threshold; and determining the candidate user as a normal user in response to the enhanced abnormality metric value of the candidate user being less than the abnormality threshold.
[0012] According to one embodiment or any of the above embodiments of the method for detecting abnormal users, the weighting function is constructed as a weighted sum of a stability weighting function, an activity weighting function, and a risk weighting function based on the historical behavioral feature set of the candidate user and the user's historical tags.
[0013] According to one embodiment or any of the above embodiments of the present application, the method for detecting abnormal users, wherein the risk identification feature set of the abnormal candidate users includes a combination of one or more of the following: basic behavioral features determined based on the user behavior feature set of the abnormal candidate users, abnormal features determined based on the abnormal metric value of the abnormal candidate users, user feature tags of the abnormal candidate users, and cross-combination feature sequences of the abnormal candidate users.
[0014] The method for detecting abnormal users according to one embodiment or any of the above embodiments of this application, wherein determining normal users and abnormal users from the abnormal candidate users based on the abnormality metric value of the abnormal candidate users determined by inputting the risk identification feature set of the abnormal candidate users into a supervised learning model, includes: determining the predicted probability that the abnormal candidate user is an abnormal user obtained by inputting the risk identification feature set of the abnormal candidate users into a supervised learning model as the abnormality metric value of the abnormal candidate user; comparing the predicted probability that the abnormal candidate user is an abnormal user with a probability threshold; determining the abnormal candidate user as an abnormal user in response to the predicted probability that the abnormal candidate user is an abnormal user being greater than or equal to the probability threshold; and determining the abnormal candidate user as a normal user in response to the predicted probability that the abnormal candidate user is an abnormal user being less than the probability threshold.
[0015] According to one embodiment or any of the above embodiments of the method for detecting abnormal users, the loss function of the supervised learning model is constructed based on weighted binary cross-entropy, and the weights of the weighted binary cross-entropy are determined such that the loss value of the supervised learning model in identifying an abnormal user as a normal user is greater than the loss value of the supervised learning model in identifying a normal user as an abnormal user.
[0016] The method for detecting abnormal users according to one embodiment or any of the above embodiments of this application, wherein the method further comprises: determining the split gain of one or more basic behavioral features in the training sample set and the feature indication function for each split using the supervised learning model; and determining the feature importance of each basic behavioral feature based on the split gain of the one or more basic behavioral features and the feature indication function for each split.
[0017] The method for detecting abnormal users according to one embodiment or any of the above embodiments of this application, wherein the unsupervised learning model is an Isolation Forest model and the supervised learning model is a LightGBM model.
[0018] The method for detecting abnormal users according to one embodiment or any of the above embodiments of this application, wherein the method further includes: using a training set and a validation set to determine the model performance of a first supervised learning model for a first detection period and the model performance of a second supervised learning model for a second detection period; and, based on a comparison of the model performance of the first supervised learning model and the model performance of the second supervised learning model, selectively determining normal users and abnormal users from the abnormal candidate users by inputting the risk identification feature set of the abnormal candidate users into the abnormal metric weighted value of the abnormal candidate users determined by the first supervised learning model and the second supervised learning model.
[0019] According to a second aspect of this application, a system for detecting anomalous users is provided. The system includes: a memory; a processor coupled to the memory; and a computer program stored on the memory and running on the processor. The execution of the computer program causes the following operations: determining a set of user behavior features for the multiple users based on user behavior logs of multiple users; determining anomalous users and candidate users from the multiple users based on the set of user behavior features using preset behavior evaluation rules; determining normal users and anomalous candidate users from the candidate users based at least on anomaly metrics obtained by inputting the set of user behavior features of the candidate users into an unsupervised learning model; and determining a risk identification feature set for the anomalous candidate users based at least on the anomaly metrics and the set of user behavior features of the anomalous candidate users; determining normal users and anomalous users from the anomalous candidate users based on the anomaly metrics obtained by inputting the risk identification feature set of the anomalous candidate users into a supervised learning model.
[0020] According to a third aspect of this application, a computer-readable storage medium is provided, comprising instructions that, when executed, perform the steps of the method for detecting abnormal users according to a first aspect of this application.
[0021] According to a fourth aspect of this application, a computer program product is provided, the computer program product including instructions that, when executed by a processor, implement the steps of the method for detecting abnormal users according to a first aspect of this application.
[0022] According to one or more embodiments of this application, a three-layer detection scheme for detecting abnormal users is proposed, which consists of a preset behavior evaluation rule, an unsupervised learning model, and a supervised learning model. The preset behavior evaluation rule quickly identifies obviously abnormal users, improving the efficiency of subsequent model processing and saving model processing resources. The unsupervised learning model does not rely on labeled sample data for training and can identify abnormal scenarios not covered by the preset behavior evaluation rule, reducing the false negative rate for abnormal users. The supervised learning model can accurately detect normal users and abnormal users among abnormal candidate users, reducing the false positive rate for normal users and improving user experience. Attached Figure Description
[0023] The above and / or other aspects and advantages of this application will become clearer and more readily understood from the following description taken in conjunction with the accompanying drawings, in which the same or similar elements are denoted by the same reference numerals. The drawings include: Figure 1 A flowchart of a method for detecting abnormal users according to one or more embodiments of this application is shown.
[0024] Figure 2 A flowchart of a method for detecting abnormal users according to one or more embodiments of this application is shown.
[0025] Figure 3 A block diagram of a system for detecting aberrant users according to one or more embodiments of this application is shown. Detailed Implementation
[0026] The present application will now be described more fully with reference to the accompanying drawings, which illustrate exemplary embodiments thereof. However, the present application may be implemented in various forms and should not be construed as being limited to the embodiments given herein. The foregoing embodiments are intended to make the disclosure herein complete and thorough, so as to more fully convey the scope of protection of the present application to those skilled in the art.
[0027] In this specification, terms such as “comprising” and “including” indicate that, in addition to having the units and steps that are directly and explicitly stated in the specification and claims, the technical solution of this application does not exclude the presence of other units and steps that are not directly or explicitly stated.
[0028] Unless otherwise specified, terms such as “first” and “second” do not indicate the order of units in terms of time, space, size, etc., but are merely used to distinguish between units.
[0029] In the following, various exemplary embodiments according to this application will be described in detail with reference to the accompanying drawings.
[0030] Figure 1 A flowchart of a method for detecting abnormal users according to one or more embodiments of this application is shown.
[0031] like Figure 1 As shown, in step S101, a set of user behavior features for multiple users is determined based on the user behavior logs of multiple users, and abnormal users and candidate users are determined from multiple users according to the set of user behavior features using preset behavior evaluation rules.
[0032] Optionally, in step S101, the user behavior logs of multiple users can be segmented into sessions based on user identification information and timestamp information in the user behavior logs of multiple users to obtain user behavior logs for one or more user sessions for each user. Data cleaning is then performed on the user behavior logs for one or more user sessions for each user to remove invalid data fields. Finally, a set of user behavior features for each user is determined based on the user behavior logs for one or more user sessions for each user after removing invalid data fields. For example, the user behavior log can be a structured data set recording all user actions during a coupon redemption activity, which may include fields such as user identification, action, time series, device environment, network characteristics, and business results. For example, a user session refers to the set of all continuous behavior logs of a single user from the first visit to the coupon redemption page until there is no action for a certain period (e.g., session timeout). For example, invalid data fields may include invalid request fields (e.g., heartbeat detection), fields with missing information, and obviously abnormal fields (e.g., timestamp errors).
[0033] In one embodiment, the user behavior feature set may include behavior frequency features, behavior time sequence features, behavior concentration features, and time distribution features. Behavior frequency features may include the number of session clicks. n Request API information Abnormal response rate ,in count (errResponse) Indicates the number of incorrect responses. count(allResponse) This represents the total number of responses. Behavioral timing characteristics can include click frequency. f click =n / T session Click the interval sequence Average click interval Standard deviation of click interval Coefficient of variation of click interval ,in T session Indicates the duration of the session. t 1 , t 2 , t 3 ,…, t n-1 , t n Indicates the click time. Behavioral concentration characteristics may include API concentration. And the Herfindahl-Hirschman Index (HHI) ,in count(apii ) Interface API i Session click count, k This indicates the number of different APIs appearing in the session; the closer the HHI is to 1, the more concentrated the behavior. Temporal distribution characteristics can include the percentage of inactive periods. ,in For indicator functions, when t i The value is 1 during non-active periods, and 0 otherwise.
[0034] In one embodiment, the preset behavior evaluation rule may include a combination of one or more judgment conditions, each judgment condition including an inequality constructed based on one or more user behavior features in a user behavior feature set. In one embodiment, it can be determined whether one or more user behavior features in the user behavior feature set of each of multiple users satisfy one or more judgment conditions in the preset behavior evaluation rule. When one or more user behavior features in the user behavior feature set of a user satisfy one or more judgment conditions in the preset behavior evaluation rule, the user can be identified as an abnormal user; otherwise, the user is identified as a candidate user. Identifying abnormal and candidate users from multiple users using preset behavior evaluation rules enables the rapid and low-cost identification of obviously abnormal users, improving the efficiency of subsequent model processing and saving model processing resources.
[0035] As an example, the preset behavior evaluation rule Risk rule It can be implemented as a logical combination of multiple judgment conditions, for example, represented by the following formula (1): Formula (1) in Condition j Indicates the judgment condition. m The formula (1) indicates the number of judgment conditions. It means that if one or more user behavior features in a user's set of user behavior features meet one or more judgment conditions in a preset behavior evaluation rule, the user can be identified as an abnormal user; otherwise, the user is identified as a candidate user. As an example, Condition j It can be implemented as follows: in Condition 1 Indicates the number of clicks during the session. n Greater than 1000 and average click interval interval When it is less than 0.01, it satisfies Condition 1 , Condition 2 Indicates when API concentration The percentage of non-activity periods greater than 0.99 in activeTimeRate When it is greater than 0.99, it satisfies Condition 2 , Condition 3 Indicates when the abnormal response rate errResponseRate When it is greater than 0.95, it satisfies Condition 3 .
[0036] In step S103, normal users and abnormal candidate users are determined from the candidate users based at least on the anomaly metric values of the candidate users obtained by inputting the set of user behavior features of candidate users into the unsupervised learning model.
[0037] Optionally, in step S103, the set of user behavior features of candidate users can be input into the anomaly measurement value of candidate users obtained by the unsupervised learning model. A weight function is constructed based on the historical behavior feature set and user historical labels of candidate users. This weight function is used to weight the anomaly measurement value of candidate users to obtain an enhanced anomaly measurement value of candidate users. Based on the enhanced anomaly measurement value of candidate users, normal users and abnormal candidate users are determined from the candidate users. In one embodiment, the enhanced anomaly measurement value of candidate users can be compared with an anomaly threshold. When the enhanced anomaly measurement value of candidate users is greater than or equal to the anomaly threshold, the candidate user can be determined as an abnormal candidate user; when the enhanced anomaly measurement value of candidate users is less than the anomaly threshold, the candidate user can be determined as a normal user. For example, the anomaly threshold can be set to 0.9, and this anomaly threshold can be dynamically adjusted according to business needs. For example, the anomaly threshold can be increased during peak coupon-grabbing periods and decreased during off-peak coupon-grabbing periods.
[0038] In one embodiment, the weighting function can be constructed as a weighted sum of a stability weighting function, an activity weighting function, and a risk weighting function based on the candidate user's historical behavioral feature set and user historical tags. For example, user historical tags may include user historical activity tags and user historical risk score tags. In one embodiment, the unsupervised learning model can be implemented as an Isolation Forest model, which excels at handling high-dimensional user behavioral feature sets, improving the accuracy of anomaly metrics.
[0039] In one embodiment, the set of user behavior features of candidate users can be constructed as follows: x ={Abnormal response rate, average click interval, standard deviation of click interval, coefficient of variation of click interval, behavioral concentration Hierarchy (HHI), percentage of inactive periods}, can be used to set the user behavior characteristics of candidate users. xInput the data into the Isolation Forest model to obtain the normalized path length. For example, the normalized path length H(… x The following formula (2) can be used to calculate it: Formula (2) in, h i (x) Represents the set of user behavior features of candidate users x In the i Path length in an isolated tree N This indicates the number of trees in an isolated forest.
[0040] For example, the anomaly metric s of candidate users (x,n) It can be calculated using the following formula (3): Formula (3) in, c(n) Indicates the first n The average path length of a binary search tree constructed from the user behavior feature set of candidate users.
[0041] For example, enhanced anomaly metrics s for candidate users enhanced (x,n) It can be calculated using the following formula (4): Formula (4) in, f(T stability ,A active ,R risk ) Represents the weighting function. f(T stability ,A active ,R risk ) = g (T stability )+ h(A active )+ k(R risk ) ,in g(T stability ) Represents the stability weight function. h(A active )This represents the activity weighting function. k(R risk ) This represents the risk weighting function. For example, It can be set to 0.3 and adjusted within the range of [0.1-0.6]. It can be set to 0.3 and adjusted within the range of [0.1-0.4]. It can be set to 0.4 and adjusted within the range of [0.2-0.7].
[0042] For example, the stability weight function g(T stability ) It can be calculated using the following formula (5): g(T stability )= Formula (5) in, This represents the base trust weight, which can be set to 0.6 and adjusted within the range of [0-1]. This represents the attenuation intensity coefficient, which can be set to 1 and adjusted within a range greater than 0. This represents a comprehensive score for the stability of a user's historical behavior, which can be in the range of [0-1], with a higher score indicating greater stability.
[0043] For example, a comprehensive score for the stability of user historical behavior. The stability of behavioral rhythm (T1), historical abnormal baseline (T2), and behavioral sequence (T3) can be determined using the following formulas (6)-(8): T1=1- Formula (6) T2=1- Formula (7) T3 Formula (8) in, This represents the standard deviation of a user's historical click intervals. This represents the user's historical average click interval. The standard deviation of historical anomaly metrics for users. This represents the mean of historical anomaly metrics for a user. This represents the Levenstein distance between each pair of multiple user historical behavior sequences, such as login -> browsing -> issuing coupons -> logging out.
[0044] For example, a comprehensive score for the stability of user historical behavior. It can be determined by the following formula (9): = Formula (9) in, This indicates the rhythm weight, for example, it can be set to 0.4. This indicates the weight of the abnormal baseline; for example, it can be set to 0.3. This represents the sequence weight, which can be set to 0.3 for example.
[0045] For example, the activity weighting function h(A active ) It can be determined by the following formula (10): Formula (10) in, usrflag This represents a user's historical activity level tag, which can be obtained from an external system, such as a user database.
[0046] For example, risk weighting function k(R risk ) It can be determined by the following formula (11): Formula (11) in, base This represents the base penalty value, for example, it can be set to 1.2. This represents the value used to control the steepness of growth, and can be set to a range of [5-8]. The user's historical risk score can be obtained from an external system, such as a user database.
[0047] In step S105, at least based on the abnormality metric value and user behavior feature set of the abnormal candidate users, a risk identification feature set of the abnormal candidate users is determined. Based on the abnormality metric value of the abnormal candidate users determined by inputting the risk identification feature set of the abnormal candidate users into the supervised learning model, normal users and abnormal users are identified from the abnormal candidate users.
[0048] Optionally, the risk identification feature set of abnormal candidate users may include basic behavioral features determined based on the user behavior feature set of abnormal candidate users, abnormal features determined based on the abnormality metric value of abnormal candidate users, user feature labels of abnormal candidate users, and cross-combination feature sequences of abnormal candidate users.
[0049] In one embodiment, the basic behavioral features determined based on the user behavior feature set of anomalous candidate users may include click frequency, standard deviation of click interval, click interval sequence, and API concentration. In another embodiment, the anomalous features determined based on the anomalous metrics of anomalous candidate users may include the anomalous metric s of the anomalous candidate users. (x,n) and standardized outlier scores ,in s iso The abnormal metric s represents the abnormal candidate user. (x,n) , This represents the arithmetic mean of the anomaly metrics for anomalous candidate users. The standard deviation of the anomaly metric values of the candidate users is represented. In one embodiment, the user feature tags of the candidate users may include user click frequency tags, user activity tags, and risky historical behavior tags, which can be manually labeled or obtained from a user database. In one embodiment, the cross-combination feature sequence of the candidate users may include a cross-combination feature sequence of user behavior and tags and a cross-combination feature sequence of anomaly metric values and tags. The cross-combination of user behavior and tags may include, for example, high-frequency clicks and new user tags, abnormal time activity and low activity tags, and target concentration and high-risk historical tags. The cross-combination of anomaly metric values and tags may include, for example, high anomaly score and high stability tags, and high anomaly score and high-risk historical tags. For example, the cross-combination feature sequence of the candidate users may be a binary sequence. For example, when the candidate user meets the high-frequency clicks and new user tags, the binary sequence can be set to 1, and vice versa. Similarly, when the candidate user meets the high anomaly score and high-risk historical tags, the binary sequence can be set to 1, and vice versa.
[0050] Optionally, in step S105, the predicted probability of an abnormal candidate user being an abnormal user, obtained by inputting the risk identification feature set of the abnormal candidate user into the supervised learning model, can be determined as the anomaly metric of the abnormal candidate user. The predicted probability of an abnormal candidate user being an abnormal user is compared with a probability threshold. If the predicted probability of an abnormal candidate user being an abnormal user is greater than or equal to the probability threshold, the abnormal candidate user can be identified as an abnormal user; otherwise, the abnormal candidate user can be identified as a normal user. For example, the probability threshold can be set to 0.9. In one embodiment, the supervised learning model can be implemented as a LightGBM model. By utilizing the supervised learning model to further detect abnormal candidate users, the model can learn the subtle differences between abnormal and normal patterns, significantly improving the accuracy of judgment and reducing false alarms.
[0051] In one embodiment, a blacklist can be created for abnormal users detected by the method for detecting abnormal users according to one or more embodiments of this application, for subsequent operational handling or as a sample library for a real-time risk control system, and abnormal users in the blacklist can be banned.
[0052] In one embodiment, the loss function of the supervised learning model can be constructed based on weighted binary cross-entropy, where the weights of the weighted binary cross-entropy are determined such that the loss value for the supervised learning model to identify an abnormal user as a normal user is greater than the loss value for the supervised learning model to identify a normal user as an abnormal user. For example, the loss function... L total It can be constructed using the following formula (12): Formula (12) in, N Indicates the number of users. This represents a real user's label (e.g., 1 for an abnormal user, 0 for a normal user). This indicates the probability that the supervised learning model identifies the user as an anomalous user. This represents the loss value used by the supervised learning model to classify abnormal users as normal users. This represents the loss value for identifying a normal user as an abnormal user. For example, , ,in N risk Indicates the number of abnormal users. N normal This represents the number of normal users. By making the loss value of the supervised learning model identifying abnormal users as normal users greater than the loss value of the supervised learning model identifying normal users as abnormal users, the supervised learning model can focus on learning from a small number of abnormal user training samples during training, thereby improving the accuracy of subsequent model detection.
[0053] In one embodiment, during the training of the supervised learning model, the model can determine the split gain and feature indicator function for each split of one or more basic behavioral features from the training sample set. Based on these split gains and feature indicator functions, the feature importance of each basic behavioral feature is determined. By determining the feature importance of each basic behavioral feature, the criticality of the basic behavioral features can be assessed, thereby enhancing the interpretability of the model.
[0054] For example, the first-order gradient can be calculated using the following formulas (13)-(14). g i and second gradient h i : Formula (13) Formula (14) For example, the split gain can be calculated using the following formula (15). Gain : Formula (15) in, I L and I R These represent the left and right subsets after the split, respectively. I This represents the set of training samples contained in the parent node to be split. This represents the L2 regularization parameter. This represents the minimum gain threshold for splitting.
[0055] For example, feature importance can be calculated using the following formula (16). Importance j : Formula (16) in, K Indicates the number of decision trees. Gain split This indicates the use of basic behavioral features each time. j The cumulative average of the gain generated during node splitting. This indicates the feature indicator function, if the current split uses a feature. j If the split uses a different feature, the function value is 1; otherwise, the function value is 0.
[0056] For example, the standardized importance score can be calculated using the following formula (17). NI j : Formula (17) In one embodiment, the model performance of a first supervised learning model in a first detection period and a second supervised learning model in a second detection period can be determined using training and validation sets. Based on a comparison of the performance of the first and second supervised learning models, normal and abnormal users can be selectively identified from abnormal candidate users by inputting a risk identification feature set of abnormal candidate users into the anomaly metric weighted value of the abnormal candidate users determined by the first and second supervised learning models. In one embodiment, the first supervised learning model in the first detection period can be trained earlier than the second supervised learning model in the second detection period. When the model performance of the second supervised learning model is better than that of the first supervised learning model, normal and abnormal users can be identified from abnormal candidate users by inputting a risk identification feature set of abnormal candidate users into the anomaly metric weighted value of the abnormal candidate users determined by the first and second supervised learning models. When the anomaly metric weighted value of an abnormal candidate user is greater than or equal to a probability threshold, the abnormal candidate user can be identified as an abnormal user; otherwise, the abnormal candidate user can be identified as a normal user. For example, the probability threshold can be set to 0.9.
[0057] In one embodiment, the performance of a supervised learning model can be measured by rolling time window validation values, model prediction consistency validation values, and feature importance stability. For example, rolling time window validation values... CV score It can be calculated using the following formula (18): Formula (18) in, K This represents the total number of rounds of rolling validation. Indicates the first k The accuracy calculated on its validation set for each time window. Indicates the first k Use the training set within a time window. The trained model, Indicates the first k The validation set within another time period corresponding to each time window Scrolling time window verification value CV score This can be understood as... K The summation and averaging of the accuracy rates from each round of validation is the mean of the model's performance over multiple different time periods. A larger value indicates better stability and stronger generalization ability of the model across different time periods.
[0058] For example, the model predicts the consistency verification value Consistency It can be calculated using the following formula (19): Formula (19) in, M Indicates the number of samples used for testing. This indicates that the model performs well on the training set for the first... j The predicted probability of a sample. This indicates that the model performs well on the validation set for the same or identically distributed first-order inequality. j The predicted value for each sample, This indicates whether the absolute difference between two predicted values is less than a threshold. ε (For example, ε =0.05), if it is less than, then the prediction is considered consistent. This indicates an indicator function; the function value is 1 when the condition within the parentheses is true, and 0 otherwise. (Model prediction consistency verification value) Consistency It can be used to measure the stability of a model's output; the larger the value, the more stable the model's output.
[0059] For example, feature importance stability Stability feature It can be calculated using the following formula (20): Formula (20) in, P This represents the total number of features. Represents the number of calculations performed on the training set. j Standardized importance scores for each feature. Represents the result computed on the validation set. j Standardized importance scores for each feature. Indicates the first j The relative difference in feature importance between the training and validation sets. Feature importance stability. Stability feature This can be understood as... P The average of the relative differences of the features is calculated. The higher the value, the more unstable the internal decision-making logic of the model is, and the more likely it is to behave abnormally during inference.
[0060] In one embodiment, when the rolling time window validation value of the second supervised learning model is greater than the rolling time window validation value of the first supervised learning model, the model prediction consistency validation value of the second supervised learning model is greater than the model prediction consistency validation value of the first supervised learning model, and the feature importance stability of the second supervised learning model is less than the feature importance stability of the first supervised learning model, it can be determined that the model performance of the second supervised learning model is better than that of the first supervised learning model.
[0061] The method for detecting abnormal users according to one or more embodiments of this application proposes an abnormal user detection scheme with a three-layer detection structure based on preset behavior evaluation rules, an unsupervised learning model, and a supervised learning model. The preset behavior evaluation rules quickly identify obviously abnormal users, improving the efficiency of subsequent model processing and saving model processing resources. The unsupervised learning model does not rely on labeled sample data for training and can identify abnormal scenarios not covered by the preset behavior evaluation rules, reducing the false negative rate of abnormal users. The supervised learning model can achieve accurate detection of normal users and abnormal users among abnormal candidate users, reducing the false positive rate of normal users and improving user experience.
[0062] Figure 2 A flowchart of a method for detecting abnormal users according to one or more embodiments of this application is shown.
[0063] like Figure 2 As shown, in step S201, abnormal users and candidate users are determined from the multiple users based on the user behavior feature set of multiple users using preset behavior evaluation rules.
[0064] In step S203, normal users and abnormal candidate users are determined from the candidate users based at least on the anomaly metric values of the candidate users obtained by inputting the set of user behavior features of candidate users into the unsupervised learning model.
[0065] In step S205, normal users and abnormal users are identified from the abnormal candidate users based on the abnormality metric value of the abnormal candidate users determined by inputting the risk identification feature set of abnormal candidate users into the supervised learning model.
[0066] In one embodiment, after identifying normal and abnormal users, identification information can be used to distinguish between them for subsequent operational processing or as a sample library for the real-time risk control system, and abnormal users can be banned.
[0067] Figure 3 A block diagram of a system for detecting aberrant users according to one or more embodiments of this application is shown.
[0068] like Figure 3 As shown, the system 300 for detecting anomalous users includes a memory 310, a processor 320, and a computer program 330 stored in the memory 310 and executable on the processor 320. The processor 320 executes the computer program 330 to implement a method for detecting anomalous users according to one aspect of this application.
[0069] This application can also be implemented as a computer-readable storage medium including instructions that, when executed, perform a method for detecting abnormal users according to one aspect of this application.
[0070] Where applicable, the various embodiments provided in this application may be implemented using hardware, software, or a combination of hardware and software. Furthermore, where applicable, without departing from the scope of this application, the various hardware and / or software components described herein may be combined into composite components comprising software, hardware, and / or both. Where applicable, without departing from the scope of this application, the various hardware and / or software components described herein may be divided into sub-components comprising software, hardware, or both. Additionally, where applicable, it is contemplated that software components may be implemented as hardware components, and vice versa.
[0071] The software (such as program code and / or data) according to this application can be stored on one or more computer storage media. It is also contemplated that the software identified herein can be implemented using one or more networked and / or otherwise general-purpose or special-purpose computers and / or systems. Where applicable, the order of the various steps described herein can be changed, combined into compound steps, and / or divided into sub-steps to provide the features described herein.
[0072] The embodiments and examples presented herein are provided to best illustrate embodiments of this application and its particular applications, thereby enabling those skilled in the art to implement and use this application. However, those skilled in the art will understand that the above description and examples are provided for ease of illustration and example only. The descriptions presented are not intended to cover all aspects of this application or to limit this application to the precise forms disclosed.
Claims
1. A method for detecting abnormal users, characterized in that, The method includes the following steps: Based on the user behavior logs of multiple users, a set of user behavior features for the multiple users is determined, and abnormal users and candidate users are identified from the multiple users according to the set of user behavior features using preset behavior evaluation rules. Based at least on the anomaly metric of the candidate users obtained by inputting the set of user behavior features of the candidate users into an unsupervised learning model, normal users and abnormal candidate users are determined from the candidate users. as well as The risk identification feature set of the abnormal candidate users is determined based at least on the abnormality metric value and user behavior feature set of the abnormal candidate users. Based on the abnormality metric value of the abnormal candidate users determined by inputting the risk identification feature set of the abnormal candidate users into the supervised learning model, normal users and abnormal users are identified from the abnormal candidate users.
2. The method according to claim 1, wherein determining the user behavior feature set of the multiple users based on user behavior logs of the multiple users includes: Based on the user identification information and timestamp information in the user behavior logs of the multiple users, the user behavior logs of the multiple users are segmented into sessions to obtain the user behavior logs of each user during one or more user sessions; Data cleaning is performed on the user behavior logs of each user during one or more user sessions to remove invalid data fields; as well as The user behavior feature set for each user is determined based on user behavior logs during one or more user sessions for each user after removing invalid data fields.
3. The method according to claim 1, wherein the user behavior feature set includes one or more of the following: behavior frequency features, behavior time sequence features, behavior concentration features, and time distribution features.
4. The method according to claim 1, wherein the preset behavior evaluation rule includes a combination of one or more judgment conditions, and each judgment condition includes an inequality constructed based on one or more user behavior features in the user behavior feature set.
5. The method according to claim 4, wherein determining abnormal users and candidate users from the plurality of users based on the user behavior feature set using preset behavior evaluation rules includes: Determine whether one or more user behavior features in the user behavior feature set of each of the multiple users satisfy one or more judgment conditions in the preset behavior evaluation rules; In response to determining that one or more user behavior features in the user behavior feature set meet one or more judgment conditions in the preset behavior evaluation rules, the user is identified as an abnormal user. as well as In response to the determination that one or more user behavior features in the user's user behavior feature set do not meet each judgment condition in the preset behavior evaluation rule, the user is identified as a candidate user.
6. The method of claim 1, wherein determining normal users and abnormal candidate users from the candidate users based at least on anomaly metrics of the candidate users obtained by inputting the set of user behavior features of the candidate users into an unsupervised learning model comprises: The anomaly metric of the candidate users is obtained by inputting the set of user behavior features of the candidate users into an unsupervised learning model. A weight function is constructed based on the historical behavioral feature set and user historical tags of the candidate users. The anomaly measurement value of the candidate users is weighted using the weight function to obtain the enhanced anomaly measurement value of the candidate users. as well as Based on the enhanced anomaly metrics of the candidate users, normal users and abnormal candidate users are identified from the candidate users.
7. The method of claim 6, wherein determining normal users and abnormal candidate users from the candidate users based on the enhanced anomaly metric of the candidate users comprises: Compare the enhanced anomaly metric of the candidate user with the anomaly threshold; If the enhanced anomaly metric of the candidate user is greater than or equal to the anomaly threshold, the candidate user is identified as an anomalous candidate user. as well as If the enhanced anomaly metric of the candidate user is less than the anomaly threshold, the candidate user is identified as a normal user.
8. The method according to claim 6, wherein the weighting function is constructed as a weighted sum of a stability weighting function, an activity weighting function, and a risk weighting function based on the candidate user's historical behavior feature set and user historical tags.
9. The method according to claim 1, wherein the risk identification feature set of the abnormal candidate user includes a combination of one or more of the following: basic behavioral features determined based on the user behavior feature set of the abnormal candidate user, abnormal features determined based on the abnormality metric value of the abnormal candidate user, user feature labels of the abnormal candidate user, and cross-combination feature sequence of the abnormal candidate user.
10. The method of claim 1, wherein determining normal users and abnormal users from the abnormal candidate users based on the anomaly metric value of the abnormal candidate users determined by inputting the risk identification feature set of the abnormal candidate users into a supervised learning model comprises: The predicted probability that the abnormal candidate user is an abnormal user is determined by inputting the risk identification feature set of the abnormal candidate user into the supervised learning model; Compare the predicted probability that the abnormal candidate user is an abnormal user with the probability threshold; In response to the fact that the predicted probability of the abnormal candidate user being an abnormal user is greater than or equal to the probability threshold, the abnormal candidate user is determined to be an abnormal user. as well as In response to the fact that the predicted probability of the abnormal candidate user being an abnormal user is less than a probability threshold, the abnormal candidate user is determined to be a normal user.
11. The method according to claim 1, wherein the loss function of the supervised learning model is constructed based on weighted binary cross-entropy, and the weights of the weighted binary cross-entropy are determined such that the loss value of the supervised learning model in identifying an abnormal user as a normal user is greater than the loss value of the supervised learning model in identifying a normal user as an abnormal user.
12. The method according to claim 1, wherein the method further comprises: The supervised learning model is determined to use a split gain and a feature indication function for each split from one or more basic behavioral features in the training sample set; The feature importance of each basic behavioral feature is determined based on the split gain of one or more basic behavioral features and the feature indication function for each split.
13. The method according to claim 1, wherein the unsupervised learning model is an isolated forest model, and the supervised learning model is a LightGBM model.
14. The method according to claim 1, wherein the method further comprises: The model performance of the first supervised learning model in the first detection period and the model performance of the second supervised learning model in the second detection period are determined using the training set and the validation set. as well as Based on a comparison of the model performance of the first supervised learning model and the model performance of the second supervised learning model, normal users and abnormal users are selectively determined from the abnormal candidate users by inputting the risk identification feature set of the abnormal candidate users into the abnormal metric weighting value of the abnormal candidate users determined by the first supervised learning model and the second supervised learning model.
15. A system for detecting abnormal users, characterized in that, The system includes: Memory; A processor coupled to the memory; and A computer program stored in the memory and running on the processor, the execution of which causes the following operations: Based on the user behavior logs of multiple users, a set of user behavior features for the multiple users is determined, and abnormal users and candidate users are identified from the multiple users according to the set of user behavior features using preset behavior evaluation rules. At least based on the anomaly metric of the candidate users obtained by inputting the set of user behavior features of the candidate users into an unsupervised learning model, normal users and abnormal candidate users are determined from the candidate users; and The risk identification feature set of the abnormal candidate users is determined based at least on the abnormality metric value and user behavior feature set of the abnormal candidate users. Based on the abnormality metric value of the abnormal candidate users determined by inputting the risk identification feature set of the abnormal candidate users into the supervised learning model, normal users and abnormal users are identified from the abnormal candidate users.
16. The system of claim 15, wherein the execution of the computer program causes the determination of a set of user behavior features of the multiple users based on user behavior logs of the multiple users, comprising: Based on the user identification information and timestamp information in the user behavior logs of the multiple users, the user behavior logs of the multiple users are segmented into sessions to obtain the user behavior logs of each user during one or more user sessions; Data cleaning is performed on the user behavior logs of each user during one or more user sessions to remove invalid data fields; as well as The user behavior feature set for each user is determined based on user behavior logs during one or more user sessions for each user after removing invalid data fields.
17. The system according to claim 15, wherein the user behavior feature set includes a combination of one or more of the following: behavior frequency features, behavior temporal features, behavior concentration features, and time distribution features.
18. The system according to claim 15, wherein the preset behavior evaluation rule includes a combination of one or more judgment conditions, each judgment condition including an inequality constructed based on one or more user behavior features in the user behavior feature set.
19. The system of claim 18, wherein the execution of the computer program causes the determination of abnormal users and candidate users from the plurality of users based on the user behavior feature set using preset behavior evaluation rules, comprising: Determine whether one or more user behavior features in the user behavior feature set of each of the multiple users satisfy one or more judgment conditions in the preset behavior evaluation rules; In response to determining that one or more user behavior features in the user behavior feature set meet one or more judgment conditions in the preset behavior evaluation rules, the user is identified as an abnormal user. as well as In response to the determination that one or more user behavior features in the user's user behavior feature set do not meet each judgment condition in the preset behavior evaluation rule, the user is identified as a candidate user.
20. The system of claim 15, wherein the execution of the computer program results in determining normal users and abnormal candidate users from the candidate users based at least on an anomaly metric of the candidate users obtained by inputting a set of user behavior features of the candidate users into an unsupervised learning model, comprising: The anomaly metric of the candidate users is obtained by inputting the set of user behavior features of the candidate users into an unsupervised learning model. A weight function is constructed based on the historical behavioral feature set and user historical tags of the candidate users. The anomaly measurement value of the candidate users is weighted using the weight function to obtain the enhanced anomaly measurement value of the candidate users. as well as Based on the enhanced anomaly metrics of the candidate users, normal users and abnormal candidate users are identified from the candidate users.
21. The system of claim 20, wherein the execution of the computer program causes the determination of normal users and anomalous candidate users from the candidate users based on enhanced anomaly metrics of the candidate users, comprising: Compare the enhanced anomaly metric of the candidate user with the anomaly threshold; If the enhanced anomaly metric of the candidate user is greater than or equal to the anomaly threshold, the candidate user is identified as an anomalous candidate user. as well as If the enhanced anomaly metric of the candidate user is less than the anomaly threshold, the candidate user is identified as a normal user.
22. The system according to claim 20, wherein the weighting function is constructed as a weighted sum of a stability weighting function, an activity weighting function, and a risk weighting function based on the historical behavioral feature set of the candidate user and the user's historical tags.
23. The system according to claim 15, wherein the risk identification feature set of the abnormal candidate user includes a combination of one or more of the following: basic behavioral features determined based on the user behavior feature set of the abnormal candidate user, abnormal features determined based on the abnormality metric value of the abnormal candidate user, user feature labels of the abnormal candidate user, and cross-combination feature sequence of the abnormal candidate user.
24. The system of claim 15, wherein the execution of the computer program results in determining normal users and abnormal users from the abnormal candidate users based on an anomaly metric value of the abnormal candidate users determined by inputting the risk identification feature set of the abnormal candidate users into a supervised learning model, comprising: The predicted probability that the abnormal candidate user is an abnormal user is determined by inputting the risk identification feature set of the abnormal candidate user into the supervised learning model; Compare the predicted probability that the abnormal candidate user is an abnormal user with the probability threshold; In response to the fact that the predicted probability of the abnormal candidate user being an abnormal user is greater than or equal to the probability threshold, the abnormal candidate user is determined to be an abnormal user. as well as In response to the fact that the predicted probability of the abnormal candidate user being an abnormal user is less than a probability threshold, the abnormal candidate user is determined to be a normal user.
25. The system of claim 15, wherein the loss function of the supervised learning model is constructed based on weighted binary cross-entropy, and the weights of the weighted binary cross-entropy are determined such that the loss value of the supervised learning model in identifying an abnormal user as a normal user is greater than the loss value of the supervised learning model in identifying a normal user as an abnormal user.
26. The system of claim 15, wherein the execution of the computer program further results in: The supervised learning model is determined to use a split gain and a feature indication function for each split from one or more basic behavioral features in the training sample set; The feature importance of each basic behavioral feature is determined based on the split gain of one or more basic behavioral features and the feature indication function for each split.
27. The system according to claim 15, wherein the unsupervised learning model is an isolated forest model and the supervised learning model is a LightGBM model.
28. The system of claim 15, wherein the execution of the computer program further results in: The model performance of the first supervised learning model in the first detection period and the model performance of the second supervised learning model in the second detection period are determined using the training and validation sets; and Based on a comparison of the model performance of the first supervised learning model and the model performance of the second supervised learning model, normal users and abnormal users are selectively determined from the abnormal candidate users by inputting the risk identification feature set of the abnormal candidate users into the abnormal metric weighting value of the abnormal candidate users determined by the first supervised learning model and the second supervised learning model.
29. A computer-readable storage medium, characterized in that, The computer storage medium includes instructions that, when executed, perform the method for detecting abnormal users according to any one of claims 1-14.
30. A computer program product, characterized in that, The computer program product includes instructions that, when executed by a processor, implement the method for detecting abnormal users according to any one of claims 1-14.