A user behavior data analysis method and device

Abstract

The application discloses a user behavior data analysis method and device, and relates to the technical fields of artificial intelligence and smart supply chain. A specific embodiment of the application comprises: acquiring multiple behavior data of multiple users; extracting internal features, external features and abnormal behavior features of the multiple behavior data; utilizing a hybrid expert network model to fuse the internal features, the external features and the abnormal behavior features to form target behavior features of the users; outputting behavior risk probabilities corresponding to the target behavior features based on the target behavior features; and dividing multiple target user sets based on the behavior risk probabilities of the users. The application improves the accuracy, the degree of refinement and the flexible scalability of the division of user groups by utilizing the multiple-layer neural networks included in the hybrid expert network model to mine the interaction and correlation between different features.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence and smart supply chain technology, and in particular to a method and apparatus for analyzing user behavior data. Background Technology

[0002] In various business decision-making scenarios (such as business risk assessment), the attribute interpretation characteristics and parameters of different users often differ. This difference can usually be reduced by pre-segmenting user groups, thereby reducing the dependence on and calls to external data sources.

[0003] However, existing methods typically rely on human experience or simple statistical rules to segment user groups, making it difficult to adaptively capture the complex interaction effects and relationships between user characteristics. This results in low accuracy, low dynamic adaptability, and low scalability of user group segmentation, which affects the accuracy of business decisions. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a user behavior data analysis method and apparatus, capable of acquiring multiple behavioral data from multiple users; extracting internal features from operational behavior data; extracting external features from user evaluation data; extracting abnormal behavior features from abnormal user behavior data; using a hybrid expert network model to fuse internal features, external features, and abnormal behavior features to form the target behavior features of the user; outputting the behavior risk probability corresponding to the target behavior features based on the target behavior features; and dividing multiple target user sets based on the behavior risk probabilities of each user. Embodiments of the present invention improve the accuracy, refinement, and flexibility of user group segmentation by mining the interaction and correlation relationships between different features through the multi-layer neural network contained in the hybrid expert network model.

[0005] To achieve the above objectives, according to one aspect of the present invention, a user behavior data analysis method is provided, comprising: acquiring various behavioral data of multiple users; the behavioral data including user operation behavior data on an application, user evaluation data from an external interface, and user abnormal behavior data; for any user, performing the following steps: extracting internal features from the operation behavior data; extracting external features from the user evaluation data; extracting abnormal behavior features from the user abnormal behavior data; using a hybrid expert network model to fuse the internal features, the external features, and the abnormal behavior features to form a target behavior feature for the user; outputting the behavior risk probability corresponding to the target behavior feature based on the target behavior feature; and dividing multiple target user sets based on the behavior risk probabilities of each user.

[0006] Optionally, the external interface belongs to multiple external data sources; an external mapping function is set for each external data source; the external features of the user evaluation data are extracted, including: for each external data source, the external mapping function is used to extract the external features corresponding to the user evaluation data; wherein, in the process of the feature extraction model extracting the external features corresponding to the user evaluation data, a preset regularization term is used to constrain the feature extraction model.

[0007] Optionally, the operational behavior data belongs to multiple internal data sources, and an internal mapping function is set for each internal data source; the extraction of internal features of the operational behavior data includes: for each internal data source, using the internal mapping function to extract the internal features corresponding to the user evaluation data.

[0008] Optionally, the model further includes: the hybrid expert network model includes multiple expert networks; using the multiple expert networks, the external features and the internal features are fused to obtain expert fusion features, wherein the fusion operation includes adding the feature elements contained in the internal features and the external features.

[0009] Optionally, the method further includes: the hybrid expert network model includes an expert gating network; using the expert gating network, calculating the matching weights between the abnormal behavior features and multiple different expert networks; based on the matching weights, determining one or more target expert networks from the multiple expert networks for processing the internal features and / or external features, and determining the processing weights corresponding to the target expert networks.

[0010] Optionally, the step of fusing the internal features, the external features, and the abnormal behavior features to form the user's target behavior features includes: multiplying the expert fusion features output by the multiple expert networks by the corresponding processing weights to obtain expert weighted features corresponding to the multiple expert networks; and fusing the multiple expert weighted features to generate the user's target behavior features.

[0011] Optionally, the step of outputting the behavioral risk probability corresponding to the target behavioral feature based on the target behavioral feature includes: the hybrid expert network model includes a classification network; using the weight matrix and bias term included in the classification network to perform a comprehensive score on the target behavioral feature; and normalizing the comprehensive score to obtain the behavioral risk probability corresponding to the target behavioral feature.

[0012] Optionally, during the iterative training of the hybrid expert network model, a preset loss function is used to evaluate the loss value between the behavioral risk probability output by the hybrid expert network model and the actual risk label; the model training effect is evaluated based on the loss value; and the network parameters of the hybrid expert network model are updated based on the training effect until a preset training iteration termination condition is met.

[0013] To achieve the above objectives, according to a second aspect of the present invention, a user behavior data analysis apparatus is provided, comprising: a data acquisition module, a feature fusion module, and a group segmentation module; wherein, The data acquisition module is used to acquire various behavioral data from multiple users; the behavioral data includes user operation behavior data related to the application, user evaluation data from external interfaces, and abnormal user behavior data. The feature fusion module is used to perform the following for any user: extract internal features from the operation behavior data; extract external features from the user evaluation data; extract abnormal behavior features from the user's abnormal behavior data; use a hybrid expert network model to fuse the internal features, the external features, and the abnormal behavior features to form the user's target behavior features; and output the behavior risk probability corresponding to the target behavior features based on the target behavior features. The group segmentation module is used to segment multiple target user sets based on the behavioral risk probability of each user.

[0014] Optionally, the external interface belongs to multiple external data sources; an external mapping function is set for each external data source; a user behavior data analysis device is used to extract external features of the user evaluation data, including: for each external data source, using the external mapping function to extract the external features corresponding to the user evaluation data; wherein, in the process of the feature extraction model extracting the external features corresponding to the user evaluation data, a preset regularization term is used to constrain the feature extraction model.

[0015] Optionally, the operational behavior data belongs to multiple internal data sources, and an internal mapping function is set for each internal data source; the user behavior data analysis device is used to extract the internal features of the operational behavior data, including: for each internal data source, using the internal mapping function to extract the internal features corresponding to the user evaluation data.

[0016] Optionally, the hybrid expert network model includes multiple expert networks; the user behavior data analysis device is used to use the multiple expert networks to perform fusion operations on the external features and the internal features respectively to obtain expert fusion features, wherein the fusion operation includes adding the feature elements contained in the internal features and the external features.

[0017] Optionally, the system further includes: the hybrid expert network model comprising an expert gating network; a user behavior data analysis device for using the expert gating network to calculate the matching weights between the abnormal behavior features and multiple different expert networks; and, based on the matching weights, determining one or more target expert networks from the multiple expert networks for processing the internal features and / or external features, and determining the processing weights corresponding to the target expert networks.

[0018] Optionally, a user behavior data analysis device is used to fuse the internal features, the external features, and the abnormal behavior features to form the user's target behavior features, including: multiplying the expert fusion features output by multiple expert networks by their corresponding processing weights to obtain expert weighted features corresponding to multiple expert networks; and fusing the multiple expert weighted features to generate the user's target behavior features.

[0019] Optionally, the user behavior data analysis device is used to output the behavioral risk probability corresponding to the target behavioral feature based on the target behavioral feature, including: the hybrid expert network model includes a classification network; using the weight matrix and bias term included in the classification network to give a comprehensive score to the target behavioral feature; and normalizing the comprehensive score to obtain the behavioral risk probability corresponding to the target behavioral feature.

[0020] Optionally, the user behavior data analysis device is used to evaluate the loss value between the behavioral risk probability output by the hybrid expert network model and the actual risk label using a preset loss function during the iterative training of the hybrid expert network model; evaluate the model training effect based on the loss value; and update the network parameters of the hybrid expert network model based on the training effect until a preset training iteration termination condition is met.

[0021] To achieve the above objectives, according to a third aspect of the present invention, an electronic device for user behavior data analysis is provided, characterized in that it includes: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any of the methods described above for user behavior data analysis.

[0022] To achieve the above objectives, according to a fourth aspect of the present invention, a computer-readable medium is provided having a computer program stored thereon, characterized in that, when the program is executed by a processor, it implements any of the methods described in the above-described user behavior data analysis methods.

[0023] To achieve the above objectives, according to a fifth aspect of the present invention, a computer program product is provided, comprising a computer program, characterized in that, when executed by a processor, the computer program implements any of the methods described above for user behavior data analysis.

[0024] One embodiment of the above invention has the following advantages or beneficial effects: it can acquire multiple behavioral data from multiple users; extract internal features from operational behavior data; extract external features from user evaluation data; extract abnormal behavior features from abnormal user behavior data; utilize a hybrid expert network model to fuse internal features, external features, and abnormal behavior features to form the target behavior features of the user; output the behavior risk probability corresponding to the target behavior features based on the target behavior features; and divide multiple target user sets based on the behavior risk probabilities of each user. This embodiment of the invention improves the accuracy, refinement, and flexibility of user group segmentation by mining the interactions and correlations between different features through the multi-layer neural network contained in the hybrid expert network model.

[0025] The further effects of the aforementioned unconventional alternative methods will be explained below in conjunction with specific implementation methods. Attached Figure Description

[0026] The accompanying drawings are provided to better understand the invention and are not intended to unduly limit the scope of the invention. Wherein: Figure 1 This is a flowchart illustrating a user behavior data analysis method provided in an embodiment of the present invention; Figure 2 is a schematic diagram of a user behavior data analysis process provided by an embodiment of the present invention; Figure 3 This is a schematic diagram of a process for training a hybrid expert network model according to an embodiment of the present invention; Figure 4 This is a schematic diagram of the structure of a user behavior data analysis device provided in an embodiment of the present invention; Figure 5 This is an exemplary system architecture diagram in which embodiments of the present invention can be applied; Figure 6 This is a schematic diagram of the structure of a computer system suitable for implementing terminal devices or servers of the present invention. Detailed Implementation

[0027] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of the present invention, including various details to aid understanding. These details should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the invention. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0028] It should be noted that the collection, use, storage, sharing and transfer of user personal information involved in the technical solution of the present invention all comply with the provisions of relevant laws and regulations, and require notification to users and obtaining their consent or authorization. When applicable, user personal information is subjected to de-identification and / or anonymization and / or encryption technical processing.

[0029] In user behavior risk control scenarios, the explanatory features and parameters under different user sets (customer groups) exhibit significant differences. Traditional models cannot effectively adapt to these differences, resulting in poor model performance and interpretability. Furthermore, over-reliance on external data sources not only increases costs but may also pose data security risks such as data leaks.

[0030] In view of this, such as Figure 1 As shown, this embodiment of the invention provides a user behavior data analysis method, which may include the following steps: Step S101: Obtain various behavioral data from multiple users; the behavioral data includes user operation behavior data related to the application, user evaluation data from external interfaces, and user abnormal behavior data.

[0031] Step S102: For any user, perform the following: extract the internal features of the operation behavior data; extract the external features of the user evaluation data; extract the abnormal behavior features of the user's abnormal behavior data; use a hybrid expert network model to fuse the internal features, the external features, and the abnormal behavior features to form the user's target behavior features; based on the target behavior features, output the behavior risk probability corresponding to the target behavior features.

[0032] Step S103: Based on the behavioral risk probability of each user, divide the target user set into multiple sets.

[0033] Specifically, application system providers can offer various types of application systems, such as e-commerce, financial services applications, and transaction services applications. User behavior data related to these applications includes actions such as browsing, clicking, adding to cart, placing orders, and making payments within an e-commerce platform. User evaluation data from external interfaces is also included, such as attribute assessments of users from external data sources (or applications) (e.g., credit rating, repayment stability, account risk). These attribute assessments are typically based on external interface scores (e.g., credit score, risk score). Abnormal user behavior data includes personal credit information, such as loan amounts and overdue payments recorded in the People's Bank of China's credit report.

[0034] Furthermore, for any user, the following steps are performed: extracting the internal features of the operational behavior data; extracting the external features of the user evaluation data; and extracting the abnormal behavior features of the user's abnormal behavior data.

[0035] Specifically, the external interface belongs to multiple external data sources; an external mapping function is set for each external data source; the external features of the user evaluation data are extracted, including: for each external data source, the external mapping function is used to extract the external features corresponding to the user evaluation data; wherein, in the process of the feature extraction model extracting the external features corresponding to the user evaluation data, a preset regularization term is used to constrain the feature extraction model.

[0036] Specifically, the external mapping function is expressed as:

[0037] in, Indicates the first The representation vector of each external data source (i.e., the external features corresponding to the user evaluation data). This represents the external mapping function.

[0038] Preferably, during the process of the feature extraction model extracting the external features corresponding to the user evaluation data, the feature extraction model is constrained by a preset regularization term (i.e., L1 regularization), wherein the preset regularization term is as follows:

[0039] in, Represents the regularization coefficient. Represents an L1 norm (representing The sum of absolute values ​​of features (the sum of absolute values ​​of features) is used to constrain the feature extraction model by utilizing the sum of absolute values ​​contained in the preset regularization term. This can eliminate features irrelevant to behavioral risk judgment, limit the complexity of feature dimensions, and highlight key features related to behavioral risk judgment, thereby improving the efficiency of the hybrid expert network model in processing features. It is understood that the preset regularization term takes three external features as an example, and this application does not limit the specific number of external features.

[0040] Furthermore, the operational behavior data belongs to multiple internal data sources, and an internal mapping function is set for each internal data source; the extraction of internal features of the operational behavior data includes: for each internal data source, using the internal mapping function to extract the internal features corresponding to the user evaluation data.

[0041] Specifically, the internal mapping function is expressed as:

[0042] in, Indicates the first The representation vector (i.e., internal features) of each internal data source. This represents the internal mapping function.

[0043] Alternatively, the extraction of internal or external features can also be achieved using a trained Transformer model.

[0044] Furthermore, the hybrid expert network model includes multiple expert networks; using the multiple expert networks, the external features and the internal features are fused to obtain expert fusion features, wherein the fusion operation includes adding the feature elements contained in the internal features and the external features.

[0045] Specifically, expert fusion is represented as:

[0046] in, Indicates the first An expert network is used for the fusion representation of internal features and external data (i.e., expert fusion features).

[0047] Different expert networks can be trained and configured to handle the fusion operations of different types of internal features and external data. For example, expert network 1 handles the feature fusion operation related to "frequent transactions", expert network 2 handles the feature fusion operation related to "high risk of blacklist", and expert network 3 handles the feature fusion operation related to "good credit". This application does not limit the specific type of expert network.

[0048] Furthermore, an expert gating network is used to determine the matching weights between different expert networks, that is, the hybrid expert network model includes an expert gating network; using the expert gating network, the matching weights between the abnormal behavior features and multiple different expert networks are calculated; based on the matching weights, one or more target expert networks for processing the internal features and / or external features are determined from the multiple expert networks, and the processing weights corresponding to the target expert networks are determined.

[0049] Specifically, the expert gating network is represented as:

[0050] Where f represents abnormal behavior characteristics (e.g., personal credit characteristics); Wg represents the weight matrix of each neuron in the expert network; and bg represents the bias term matrix of each neuron in the expert network. Activation functions of various types can be used; this expert gating network can determine which expert networks should process the user's internal and / or external features based on the user's abnormal behavior characteristics (such as personal credit characteristics), and determine the corresponding processing weights of these expert networks. .

[0051] Furthermore, the process of fusing the internal features, the external features, and the abnormal behavior features to form the user's target behavior features includes: multiplying the expert fusion features output by the multiple expert networks by their corresponding processing weights to obtain expert weighted features corresponding to the multiple expert networks; and fusing the multiple expert weighted features to generate the user's target behavior features.

[0052] Specifically, the expert fusion features output by the multiple expert networks are multiplied by their corresponding processing weights, as follows:

[0053] in, This represents the weighted fusion representation (i.e., expert weighted feature) of the i-th expert network.

[0054] Furthermore, the weighted features from multiple experts are fused to generate the user's target behavioral features.

[0055] The step of outputting the behavioral risk probability corresponding to the target behavioral feature based on the target behavioral feature includes: the hybrid expert network model includes a classification network; using the weight matrix and bias term included in the classification network to comprehensively score the target behavioral feature; and normalizing the comprehensive score to obtain the behavioral risk probability corresponding to the target behavioral feature.

[0056] Specifically, in this embodiment of the invention, the classification network is a binary classification network, and the expression for the probability of behavioral risk corresponding to the target behavioral feature is as follows:

[0057] Where Wo represents the weight matrix of each neuron in the binary classification network; bo represents the bias term matrix of each neuron in the binary classification network; σ represents an activation function of type sigmoid, etc.; hi (h1~h3) represents the expert-weighted features output by a certain expert network; and y' represents the output behavioral risk probability. The target behavioral feature is comprehensively scored using this expression, and the comprehensive score is normalized to obtain the behavioral risk probability corresponding to the target behavioral feature.

[0058] Furthermore, based on the behavioral risk probability of each user, multiple target user sets are identified. Based on these target user sets, different risk detection strategies can be implemented for different target user sets (customer groups), improving the accuracy and adaptability of risk monitoring.

[0059] This invention, through steps S101-S103, utilizes a hybrid expert network model to fuse internal features, external features, and abnormal behavior features to form the user's target behavior features. Based on these target behavior features, it outputs the corresponding behavioral risk probability. This allows for the segmentation of different target user sets. By automatically mining the complex interaction effects and nonlinear relationships between features through the multi-layered neural networks included in the hybrid expert network model, the accuracy, dynamic scalability, and refinement of user group segmentation are improved, overcoming the problem of existing methods failing to automatically adapt to differences in user groups (i.e., user sets). Furthermore, through a data-driven approach, it automatically adapts to the feature differences of different user groups, improving model interpretability. Additionally, L1 regularization technology constrains the dependence on and use of external data sources, effectively reducing risk control costs while ensuring model performance.

[0060] like Figure 2 As shown, this embodiment of the invention provides a process for user behavior data analysis, which may include the following steps: Step S201: Using a hybrid expert network model, the internal features, external features, and abnormal behavior features are fused to form the user's target behavior features. For example... Figure 2 The step S201 includes: Extract internal features from operational behavior data; extract external features from user evaluation data; extract abnormal behavior features from abnormal user behavior data.

[0061] By utilizing multiple expert networks, external features and internal features are fused to obtain expert fused features, wherein the fusion operation includes adding the feature elements contained in the internal features and the external features.

[0062] Using an expert gating network, the matching weights between abnormal behavior features and multiple different expert networks are calculated; based on the matching weights, one or more target expert networks are determined from the multiple expert networks to process the internal features and / or external features, and the processing weights corresponding to the target expert networks are determined.

[0063] Furthermore, the expert fusion features output by multiple expert networks are multiplied by their corresponding processing weights to obtain the expert weighted features corresponding to multiple expert networks; the multiple expert weighted features are then fused to generate the user's target behavior features.

[0064] Step S202: Based on the target behavior features, output the behavior risk probability corresponding to the target behavior features; based on the behavior risk probability of each user, divide into multiple target user sets.

[0065] Specifically, the target behavioral features are comprehensively scored using the weight matrix and bias term contained in the classification network; the comprehensive score is then normalized to obtain the behavioral risk probability corresponding to the target behavioral features.

[0066] Based on the probability of behavioral risks of each user, multiple target user sets are identified.

[0067] The descriptions of steps S201 to S202 are the same as those of steps S101 to S103, and will not be repeated here.

[0068] like Figure 3 As shown, this embodiment of the invention provides a process for training a hybrid expert network model, which may include the following steps: Step S301: In one iterative training cycle, acquire various behavioral data from multiple users; the behavioral data includes user operation behavior data related to the application, user evaluation data from external interfaces, and abnormal user behavior data. Specifically, the various behavioral data of users can be historical behavioral data used to train the hybrid expert network model.

[0069] Step S302: For any user, perform the following: extract the internal features of the operation behavior data; extract the external features of the user evaluation data; extract the abnormal behavior features of the user's abnormal behavior data; use a hybrid expert network model to fuse the internal features, the external features, and the abnormal behavior features to form the user's target behavior features; based on the target behavior features, output the behavior risk probability corresponding to the target behavior features; Step S303: During the iterative training of the hybrid expert network model, a preset loss function is used to evaluate the loss value between the behavioral risk probability output by the hybrid expert network model and the actual risk label; the model training effect is evaluated based on the loss value; and the network parameters of the hybrid expert network model are updated based on the training effect.

[0070] Specifically, the preset loss function can be the cross-entropy loss function, the exponential loss function, etc. Taking the cross-entropy loss function (L) as an example, it is expressed as:

[0071] Where y represents the user's actual risk label. The probability of behavioral risk output by the hybrid expert network model represents the loss value that evaluates the probability of behavioral risk output by the hybrid expert network model against the actual risk label.

[0072] Step S304: Determine whether the preset training iteration termination condition is met. If yes, end the current process and obtain the trained hybrid expert network model; otherwise, proceed to the next iteration cycle and repeat step S301. The preset training iteration termination condition may include, for example, using a preset loss function, evaluating the loss value between the behavioral risk probability output by the hybrid expert network model and the actual risk label, which is lower than a preset difference threshold, or the number of iterations reaching a preset iteration threshold.

[0073] By iteratively optimizing the hybrid expert network model using a pre-defined loss function, the accuracy of the hybrid expert network model in processing user features is improved, and the efficiency in determining the probability of user behavioral risks is increased.

[0074] like Figure 4 As shown, this embodiment of the invention provides a user behavior data analysis device 400, including: a data acquisition module 401, a feature fusion module 402, and a group segmentation module 403; wherein, The data acquisition module 401 is used to acquire various behavioral data of multiple users; the behavioral data includes user operation behavior data on the application, user evaluation data from external interfaces, and user abnormal behavior data. The feature fusion module 402 is configured to, for any user, perform the following: extract internal features from the operation behavior data; extract external features from the user evaluation data; extract abnormal behavior features from the user's abnormal behavior data; use a hybrid expert network model to fuse the internal features, the external features, and the abnormal behavior features to form the user's target behavior features; and output the behavior risk probability corresponding to the target behavior features based on the target behavior features. The group segmentation module 403 is used to segment multiple target user sets based on the behavioral risk probability of each user.

[0075] This invention also provides an electronic device for user behavior data analysis, comprising: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method provided in any of the above embodiments.

[0076] This invention also provides a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the method provided in any of the above embodiments.

[0077] This invention also provides a computer program product, including a computer program that, when executed by a processor, implements any of the user behavior data analysis methods described above.

[0078] Figure 5 An exemplary system architecture 500 is shown that can be applied to the user behavior data analysis method or user behavior data analysis device of the present invention.

[0079] like Figure 5 As shown, system architecture 500 may include terminal devices 501, 502, and 503, a network 504, and a server 505. Network 504 serves as the medium for providing communication links between terminal devices 501, 502, and 503 and server 505. Network 504 may include various connection types, such as wired or wireless communication links or fiber optic cables, etc.

[0080] Users can use terminal devices 501, 502, and 503 to interact with server 505 via network 504 to receive or send messages, etc. Various client applications can be installed on terminal devices 501, 502, and 503, such as e-commerce client applications, web browser applications, search applications, instant messaging tools, and email clients.

[0081] Terminal devices 501, 502, and 503 can be various electronic devices with displays and supporting various client applications, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0082] Server 505 can be a server that provides various services, such as a backend management server that supports client applications used by users through terminal devices 501, 502, and 503. The backend management server can process received user group segmentation requests and return the user group segmentation results to the terminal devices.

[0083] It should be noted that the user behavior data analysis method provided in this embodiment of the invention is generally executed by server 505, and correspondingly, the user behavior data analysis device is generally set in server 505.

[0084] It should be understood that Figure 5 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0085] The following is for reference. Figure 6 It shows a schematic diagram of the structure of a computer system 600 suitable for implementing a terminal device of the present invention. Figure 6 The terminal device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of the present invention.

[0086] like Figure 6 As shown, the computer system 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 602 or programs loaded from storage section 608 into random access memory (RAM) 603. The RAM 603 also stores various programs and data required for the operation of the system 600. The CPU 601, ROM 602, and RAM 603 are interconnected via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0087] The following components are connected to I / O interface 605: an input section 606 including a keyboard, mouse, etc.; an output section 607 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to I / O interface 605 as needed. A removable medium 611, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 610 as needed so that computer programs read from it can be installed into storage section 608 as needed.

[0088] In particular, according to the embodiments disclosed in this invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 609, and / or installed from removable medium 611. When the computer program is executed by central processing unit (CPU) 601, it performs the functions defined above in the system of this invention.

[0089] It should be noted that the computer-readable medium shown in this invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0090] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0091] The modules and / or units described in the embodiments of the present invention can be implemented in software or hardware. The described modules and / or units can also be housed in a processor; for example, a processor can be described as including a data acquisition module, a feature fusion module, and a group segmentation module. The names of these modules do not necessarily limit the module itself; for example, the data acquisition module can also be described as "a module for acquiring various behavioral data from multiple users."

[0092] In another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more programs, which, when executed by the device, cause the device to: acquire various behavioral data from multiple users; extract internal features of operational behavioral data; extract external features of user evaluation data; extract abnormal behavioral features of abnormal user behavioral data; utilize a hybrid expert network model to fuse internal features, external features, and abnormal behavioral features to form target behavioral features for the user; output behavioral risk probabilities corresponding to the target behavioral features based on the target behavioral features; and divide multiple target user sets based on the behavioral risk probabilities of each user. The embodiments of the present invention improve the accuracy, refinement, and flexibility of user group segmentation by mining the interactions and correlations between different features through multi-layer neural networks included in the hybrid expert network model.

[0093] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A user behavior data analysis method, characterized in that, include: Acquire various behavioral data from multiple users; the behavioral data includes user operation behavior data related to the application, user evaluation data from external interfaces, and user abnormal behavior data. For any user, execute: Extract the internal features of the operational behavior data; Extract the external features of the user evaluation data; Extract the abnormal behavior features from the user's abnormal behavior data; By using a hybrid expert network model, the internal features, external features, and abnormal behavior features are fused to form the user's target behavior features; Based on the target behavior characteristics, output the behavior risk probability corresponding to the target behavior characteristics; Based on the probability of behavioral risks of each user, multiple target user sets are identified.

2. The method according to claim 1, characterized in that, The external interface belongs to multiple external data sources; an external mapping function is set for each external data source. The extraction of external features from the user evaluation data includes: For each external data source, the external mapping function is used to extract the external features corresponding to the user evaluation data; wherein, in the process of the feature extraction model extracting the external features corresponding to the user evaluation data, a preset regularization term is used to constrain the feature extraction model.

3. The method according to claim 1, characterized in that, The operational behavior data belongs to multiple internal data sources, and an internal mapping function is set for each internal data source. The extraction of internal features from the operational behavior data includes: For each internal data source, the internal features corresponding to the user evaluation data are extracted using the internal mapping function.

4. The method according to claim 1, characterized in that, Further includes: The hybrid expert network model includes multiple expert networks; Using multiple expert networks, the external features and the internal features are fused to obtain expert fusion features, wherein the fusion operation includes adding the feature elements contained in the internal features and the external features.

5. The method according to claim 1, characterized in that, Further includes: The hybrid expert network model includes an expert gating network; Using an expert gating network, the matching weights between the abnormal behavior features and multiple different expert networks are calculated; Based on the matching weights, one or more target expert networks are determined from the plurality of expert networks for processing the internal features and / or external features, and the processing weights corresponding to the target expert networks are determined.

6. The method according to any one of claims 4 or 5, characterized in that, The process of fusing the internal features, external features, and abnormal behavior features to form the user's target behavior features includes: The expert fusion features output by the multiple expert networks are multiplied by their corresponding processing weights to obtain the expert weighted features corresponding to the multiple expert networks. The target behavioral features of the user are generated by fusing multiple expert-weighted features.

7. The method according to claim 1, characterized in that, The step of outputting the behavioral risk probability corresponding to the target behavioral features based on the target behavioral features includes: The hybrid expert network model includes a classification network; The target behavior features are comprehensively scored using the weight matrix and bias terms contained in the classification network. The comprehensive score is normalized to obtain the behavioral risk probability corresponding to the target behavioral feature.

8. The method according to claim 1, characterized in that, Further includes: During the iterative training of the hybrid expert network model Using a preset loss function, evaluate the loss value between the behavioral risk probability output by the hybrid expert network model and the actual risk label; evaluate the model training effect based on the loss value. The network parameters of the hybrid expert network model are updated based on the training results until a preset training iteration termination condition is met.

9. A user behavior data analysis device, characterized in that, include: The module comprises a data acquisition module, a feature fusion module, and a group segmentation module; among which, The data acquisition module is used to acquire various behavioral data from multiple users; the behavioral data includes user operation behavior data related to the application, user evaluation data from external interfaces, and abnormal user behavior data. The feature fusion module is used to perform the following for any user: extracting internal features from the operational behavior data; extracting external features from the user evaluation data; extracting abnormal behavior features from the user's abnormal behavior data; and using a hybrid expert network model to fuse the internal features, the external features, and the abnormal behavior features to form the user's target behavior features. Based on the target behavior characteristics, output the behavior risk probability corresponding to the target behavior characteristics; The group segmentation module is used to segment multiple target user sets based on the behavioral risk probability of each user.

10. An electronic device, characterized in that, include: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-8.

11. A computer-readable medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-8.

12. A computer program product, comprising a computer program, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-8.

Images