Abnormal behavior detection method and apparatus, device and computer readable storage medium

Abstract

Embodiments of the present application provide an abnormal behavior detection method, device and equipment and a computer readable storage medium. The method comprises: obtaining a first target sub-model corresponding to a first target object from a first preset object model; determining an abnormal data quantity from the first target sub-model based on a preset model parameter, comparing the target data quantity with the abnormal data quantity, and determining a first detection result corresponding to the to-be-detected behavior information; obtaining a second target sub-model corresponding to a second target object and having the highest similarity with the first target sub-model from a second preset object model; obtaining a target maximum data quantity corresponding to the second target sub-model, comparing the target data quantity with the target maximum data quantity, and determining a second detection result corresponding to the to-be-detected behavior information; and combining the first detection result and the second detection result to determine a target detection result of the to-be-detected behavior information. Through the embodiments of the present application, the accuracy of abnormal behavior detection can be improved.

Description

Technical Field

[0001] This application relates to information processing technology in the field of computer applications, and more particularly to an abnormal behavior detection method, apparatus, device, and computer-readable storage medium. Background Technology

[0002] With the rapid development of computer application technology, the application of various network functions has become increasingly widespread; however, in the process of applying network functions, there are often cases of malicious processing such as fraudulent traffic boosting or account theft for payment through abnormal means; therefore, in order to improve network security, abnormal behavior detection is becoming increasingly important.

[0003] Generally, unsupervised methods are used for anomaly detection. For example, historical behavior information is clustered to obtain multiple clusters. After obtaining the behavior information to be detected, the relationship between the behavior information and the multiple clusters is determined to determine the anomaly of the behavior information. However, in the above-mentioned anomaly detection process, because the feature dimension of the behavior information to be detected is low, when clustering based on low-dimensional features to determine the detection result, the possibility of error in the detection result is high, resulting in low accuracy of anomaly detection. Summary of the Invention

[0004] This application provides an abnormal behavior detection method, apparatus, device, and computer-readable storage medium, which can improve the accuracy of abnormal behavior detection.

[0005] The technical solution of this application embodiment is implemented as follows:

[0006] This application provides an abnormal behavior detection method, including:

[0007] Acquire information about the behavior to be detected, including a first target object, a second target object, and a target data volume;

[0008] Obtain the first target sub-model corresponding to the first target object from the first preset object model;

[0009] Based on preset model parameters, the abnormal data volume is determined from the first target sub-model, and the target data volume and the abnormal data volume are compared to determine the first detection result corresponding to the behavior information to be detected.

[0010] From the second preset object model, obtain the second target sub-model that corresponds to the second target object and has the highest similarity to the first target sub-model;

[0011] Obtain the maximum target data volume corresponding to the second target sub-model, compare the target data volume with the maximum target data volume, and determine the second detection result corresponding to the behavior information to be detected;

[0012] By combining the first detection result and the second detection result, the target detection result of the behavior information to be detected is determined.

[0013] This application provides an abnormal behavior detection device, including:

[0014] The information acquisition module is used to acquire the behavior information to be detected, which includes a first target object, a second target object, and a target data volume;

[0015] The first detection module is used to obtain the first target sub-model corresponding to the first target object from the first preset object model;

[0016] The first detection module is further configured to determine the amount of abnormal data from the first target sub-model based on preset model parameters, compare the target data amount and the amount of abnormal data, and determine the first detection result corresponding to the behavior information to be detected;

[0017] The second detection module is used to obtain, from the second preset object model, the second target sub-model that corresponds to the second target object and has the highest similarity to the first target sub-model;

[0018] The second detection module is further configured to obtain the maximum data volume of the target corresponding to the second target sub-model, compare the target data volume with the maximum data volume of the target, and determine the second detection result corresponding to the behavior information to be detected;

[0019] The result determination module is used to combine the first detection result and the second detection result to determine the target detection result of the behavior information to be detected.

[0020] In this embodiment, the abnormal behavior detection device further includes a model acquisition module, used to acquire behavior information samples; aggregate the behavior information samples according to a first preset object type to obtain a data volume set corresponding to each first object; construct a first sub-model corresponding to each first object based on the data volume set, thereby obtaining a first preset object model corresponding to each first object; aggregate the behavior information samples according to a second preset object type to obtain a first object set and a maximum data volume corresponding to each second object; traverse the first object set, construct at least one second object sub-model based on the sub-model to be updated corresponding to the current first object in the first preset object model; combine the at least one second object sub-model with the maximum data volume to form a second sub-model corresponding to each second object, thereby obtaining a second preset object model corresponding to each second object.

[0021] In this embodiment of the application, the model acquisition module is further configured to acquire the data volume range corresponding to each data volume in the data volume set; segment the data volume range to obtain multiple target segments; count the target number of data volumes belonging to each of the multiple target segments from the data volume set; determine the ratio of the target number to the number of set elements corresponding to the data volume set as the probability value corresponding to each target segment, thereby obtaining multiple probability values ​​corresponding to the multiple target segments; and determine the multiple probability values ​​corresponding to the multiple target segments as the first sub-model.

[0022] In this embodiment of the application, the model acquisition module is further configured to transform each data quantity in the data quantity set to obtain a transformed data quantity set; and to determine the range corresponding to each transformed data quantity in the transformed data quantity set as the data quantity range.

[0023] In this embodiment of the application, the model acquisition module is further configured to count the target number of the transformed data belonging to each of the plurality of target segments from the transformed data set.

[0024] In this embodiment, the model acquisition module is further configured to traverse the first object set, compare the sub-model to be updated corresponding to the current first object in the first preset object model with each current sub-model in the current sub-model set corresponding to each second object, and obtain similar sub-models; when the similarity corresponding to the similar sub-model is greater than a preset similarity, merge the sub-model to be updated and the similar sub-model, and replace the similar sub-model in the current sub-model set with the merged sub-model to complete the update of the current sub-model set; when the similarity corresponding to the similar sub-model is less than or equal to the preset similarity, insert the sub-model to be updated into the current sub-model set to complete the update of the current sub-model set; when the traversal of the first object set is completed, determine the traversed and updated current sub-model set as the constructed at least one second object sub-model.

[0025] In this embodiment of the application, the model acquisition module is further configured to: acquire multiple first target probability values ​​corresponding to multiple target segments from the sub-model to be updated corresponding to the current first object in the first preset object model; acquire multiple second target probability values ​​corresponding to the multiple target segments from each current sub-model in the current sub-model set corresponding to each second object; compare the multiple first target probability values ​​and the multiple second target probability values ​​one-to-one to obtain multiple minimum probability values; determine the sum of the multiple minimum probability values ​​as the similarity between the sub-model to be updated and each current sub-model, thereby obtaining multiple similarities corresponding to the current sub-model set; and determine the current sub-model corresponding to the highest similarity among the multiple similarities in the current sub-model set as the similar sub-model.

[0026] In this embodiment of the application, the model acquisition module is further configured to: acquire multiple first target probability values ​​corresponding to multiple target segments from the sub-model to be updated; acquire multiple merging probability values ​​corresponding to the multiple target segments from the similar sub-model; compare the multiple first target probability values ​​and the multiple merging probability values ​​one by one to obtain multiple maximum probability values; and combine the multiple target segments and the multiple maximum probability values ​​to complete the merging of the sub-model to be updated and the similar sub-model.

[0027] In this embodiment of the application, the second detection module is further configured to: obtain at least one target second object sub-model corresponding to the second target object from the second preset object model; obtain multiple target similarities between the first target sub-model and each of the target second object sub-models in the at least one target second object sub-model; obtain the highest target similarity from the multiple target similarities; and select the second target sub-model corresponding to the highest target similarity from the at least one target second object sub-model.

[0028] In this embodiment of the application, the second detection module is further configured to, when the highest target similarity is greater than a preset similarity, determine the maximum data volume corresponding to the second target object in the second preset object model as the target maximum data volume corresponding to the second target sub-model; and when the highest target similarity is less than or equal to the preset similarity, determine the preset data volume as the target maximum data volume corresponding to the second target sub-model.

[0029] In this embodiment of the application, the first detection module is further configured to: when the target data volume is greater than the abnormal data volume, determine a first detection result corresponding to the behavior information to be detected, including the behavior information to be detected being abnormal with respect to the first target object; and when the target data volume is less than or equal to the abnormal data volume, determine a first detection result corresponding to the behavior information to be detected, including the behavior information to be detected being normal with respect to the first target object.

[0030] In this embodiment of the application, the second detection module is further configured to: when the target data volume is greater than the target maximum data volume, determine a second detection result corresponding to the behavior information to be detected, including the behavior information to be detected being abnormal with respect to the second target object; and when the target data volume is less than or equal to the target maximum data volume, determine a second detection result corresponding to the behavior information to be detected, including the behavior information to be detected being normal with respect to the second target object.

[0031] In this embodiment of the application, the result determination module is further configured to: determine a target detection result including the abnormal behavior information to be detected when the first detection result indicates that the behavior information to be detected is abnormal regarding the first target object, and the second detection result indicates that the behavior information to be detected is abnormal regarding the second target object; determine a target detection result including the abnormal behavior information to be detected when the first detection result indicates that the behavior information to be detected is normal regarding the first target object, and the second detection result indicates that the behavior information to be detected is abnormal regarding the second target object; determine a target detection result including the normal behavior information to be detected when the first detection result indicates that the behavior information to be detected is normal regarding the first target object, and the second detection result indicates that the behavior information to be detected is normal regarding the second target object; and determine a target detection result including the normal behavior information to be detected when the first detection result indicates that the behavior information to be detected is abnormal regarding the first target object, and the second detection result indicates that the behavior information to be detected is normal regarding the second target object.

[0032] This application provides an abnormal behavior detection device, including:

[0033] Memory, used to store executable instructions;

[0034] The processor, when executing executable instructions stored in the memory, implements the abnormal behavior detection method provided in the embodiments of this application.

[0035] This application provides a computer-readable storage medium storing executable instructions, which, when executed by a processor, implement the abnormal behavior detection method provided in this application.

[0036] The embodiments of this application have at least the following beneficial effects: when the behavior information to be detected includes three dimensions of features—a first target object, a second target object, and a target data volume—the target detection result of whether the behavior information to be detected is abnormal is determined by combining the comparison results of the target data volume with the abnormal data volume and the maximum target data volume, respectively. However, in the process of determining the target detection result, since the abnormal data volume is an abnormal judgment condition for the first target object determined based on the first preset object model, and the maximum target data volume is an abnormal judgment condition for the second target object determined based on the second preset object model, the target detection result of whether the behavior information to be detected is abnormal can be accurately obtained under low-dimensional features by judging whether the target data volume is within a preset range from the two dimensions of the first target object and the second target object. Thus, the accuracy of abnormal behavior detection is high. Attached Figure Description

[0037] Figure 1This is an optional architecture diagram of the abnormal behavior detection system provided in the embodiments of this application;

[0038] Figure 2 This is one of the embodiments provided in this application. Figure 1 A schematic diagram of the server's structure;

[0039] Figure 3 This is an optional flowchart of the abnormal behavior detection method provided in the embodiments of this application;

[0040] Figure 4 This is an exemplary schematic diagram illustrating the determination of abnormal data volume provided in an embodiment of this application;

[0041] Figure 5 This is another optional flowchart of the abnormal behavior detection method provided in the embodiments of this application;

[0042] Figure 6a This is an exemplary schematic diagram of the amount of data to be converted, provided in an embodiment of this application.

[0043] Figure 6b This is an exemplary data volume conversion diagram provided in an embodiment of this application;

[0044] Figure 7 This is an exemplary schematic diagram of obtaining similarity according to an embodiment of this application;

[0045] Figure 8 This is a schematic diagram illustrating an exemplary method for obtaining the merged sub-model, as provided in an embodiment of this application.

[0046] Figure 9 A schematic diagram of an exemplary abnormal behavior detection process provided for an embodiment of this application;

[0047] Figure 10 This is a schematic diagram of an exemplary acquisition model provided in an embodiment of this application;

[0048] Figure 11 This is an exemplary model diagram provided in an embodiment of this application. Detailed Implementation

[0049] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0050] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0051] In the following description, the terms "first" and "second" are used merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that "first" and "second" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0052] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0053] In the implementation of this application, the collection and processing of relevant data should strictly comply with the requirements of relevant laws and regulations, obtain the informed consent or separate consent of the personal information subject, and carry out subsequent data use and processing within the scope of laws and regulations and the authorization of the personal information subject.

[0054] Before providing a further detailed description of the embodiments of this application, the nouns and terms involved in the embodiments of this application will be explained, and the nouns and terms involved in the embodiments of this application shall be interpreted as follows.

[0055] 1) Abnormal behavior detection: This refers to detecting whether the data corresponding to the user's operation behavior conforms to the preset operation process or the actual process. For example, detecting payment through account theft or data fraud.

[0056] 2) Offline environment: refers to a platform that processes large amounts of data (e.g., hundreds of millions of data points) based on data mining tools (e.g., "hadoop", "spark"); it usually has a large latency (e.g., a one-day latency) and low real-time performance.

[0057] 3) Real-time / Online Environment: A platform for storing and processing data in real time and efficiently. It typically has a latency of milliseconds, low complexity, and high real-time performance.

[0058] Generally, abnormal behavior detection is performed using both unsupervised and supervised methods. Unsupervised methods involve applying unsupervised algorithms to abnormal behavior detection. For example, if the behavioral information in the application scenario follows a Gaussian mixture distribution, abnormal behavior detection can be performed by determining whether the behavior to be detected follows a Gaussian distribution. Another example is clustering historical behavioral information to obtain multiple clusters; after obtaining the behavior to be detected, the relationship between the behavior and these clusters is determined to determine if the behavior is abnormal. Yet another example is using anomaly detection algorithms (such as Isolation Forest) to identify behavioral information corresponding to isolated points in space as abnormal behavior. However, in the above-mentioned unsupervised abnormal behavior detection process, when the behavior information to be detected includes three-dimensional features of the first target object, the second target object, and the target data volume (e.g., user, merchant, and amount; user, product, and amount; user, article, and number of reads), the feature dimensionality is low. When the detection result is determined by unsupervised detection based on low-dimensional features, the possibility of error in the detection result is high, thus the accuracy of abnormal behavior detection is low. In addition, when more than three dimensions of features are obtained for unsupervised detection, the detection time is long due to the high dimensionality / complexity of the features, thus the real-time performance of the detection is low.

[0059] When using supervised methods for anomaly detection, it involves labeling samples, training a network model using the sample features and labeled information, and then using the network model to detect whether the behavior to be detected is abnormal. However, the above-mentioned supervised anomaly detection process requires sample labeling; when the sample data volume is large, such as reaching hundreds of millions, the feasibility of labeling is low. For example, when detecting payment anomalies, since the number of payments that occur every day reaches hundreds of millions, manual labeling is not feasible. Furthermore, labeling leads to a long training time for the network model. After the network model is trained, when the behavioral information in the application scenario changes rapidly and the anomaly detection in the application scenario has a time-sensitive nature, the trained network model may no longer be suitable for the current application scenario. Therefore, its feasibility is low and it cannot be applied to time-sensitive application scenarios.

[0060] Based on this, embodiments of this application provide a method, apparatus, device, and computer-readable storage medium for detecting abnormal behavior, which can quickly and accurately detect abnormal behavior and can be applied to time-sensitive application scenarios.

[0061] The following describes exemplary applications of the abnormal behavior detection device provided in this application. This device can be implemented as various types of user terminals such as laptops, tablets, desktop computers, set-top boxes, and mobile devices (e.g., mobile phones, portable music players, personal digital assistants, dedicated messaging devices, portable gaming devices), or as a server. Exemplary applications when the device is implemented as a server will be described below.

[0062] See Figure 1 , Figure 1 This is a schematic diagram of an optional architecture of the abnormal behavior detection system provided in the embodiments of this application; as shown... Figure 1 As shown, to support an abnormal behavior detection application, in the abnormal behavior detection system 100, terminal 200 (terminal 200-1 and terminal 200-2 are shown as examples) connects to server 400 via network 300. Network 300 can be a wide area network (WAN), a local area network (LAN), or a combination of both. Additionally, the abnormal behavior detection system 100 also includes a database 500.

[0063] Database 500 is used to store the first preset object model and the second preset object model, and provides the first preset object model and the second preset object model to server 400 to realize abnormal behavior detection.

[0064] Terminal 200-1 is used to receive user payment operations via control 200-111 (a payment button is shown as an example) on the graphical interface 200-11, and in response to the payment operation, send to the server 400 through network 300 information on the behavior to be detected, including the merchant (first target object), the user (second target object), and the amount (target data volume). It is also used to receive the target detection result sent by server 400 through network 300 and display the target detection result on the graphical interface 200-12.

[0065] Terminal 200-2 is used to receive a user's reading operation via a control 200-211 (a reading button is shown as an example) on a graphical interface 200-21, and in response to the reading operation, send to the server 400, via network 300, information on the behavior to be detected, including the article (first target object), the user (second target object), and the number of reads (target data volume). It is also used to receive the target detection result sent by the server 400 via network 300 and display the target detection result on a graphical interface 200-22.

[0066] Server 400 is used to obtain information about a behavior to be detected from terminal 200 via network 300. This information includes a first target object, a second target object, and a target data volume. Server 400 is used to: obtain a first target sub-model corresponding to the first target object from a first preset object model provided by database 500; determine abnormal data volume from the first target sub-model based on preset model parameters; compare the target data volume with the abnormal data volume to determine a first detection result corresponding to the behavior information to be detected; obtain a second target sub-model corresponding to the second target object and having the highest similarity to the first target sub-model from a second preset object model provided by database 500; obtain the maximum target data volume corresponding to the second target sub-model; compare the target data volume with the maximum target data volume to determine a second detection result corresponding to the behavior information to be detected; and combine the first and second detection results to determine the target detection result for the behavior information to be detected. Server 400 is also used to send the target detection result to terminal 200 via network 300.

[0067] In some embodiments, server 400 may be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. Terminal 200 may be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, etc., but is not limited to these. The terminal and server can be directly or indirectly connected via wired or wireless communication, which is not limited in this embodiment of the invention.

[0068] See Figure 2 , Figure 2 This is one of the embodiments provided in this application. Figure 1 A schematic diagram of the server's structure. Figure 2 The server 400 shown includes at least one processor 410, memory 450, at least one network interface 420, and a user interface 430. The various components in server 400 are coupled together via a bus system 440. It is understood that the bus system 440 is used to implement communication between these components. In addition to a data bus, the bus system 440 also includes a power bus, a control bus, and a status signal bus. However, for clarity, ... Figure 2 The general labeled all buses as Bus System 440.

[0069] Processor 410 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0070] User interface 430 includes one or more output devices 431 that enable the presentation of media content, including one or more speakers and / or one or more visual displays. User interface 430 also includes one or more input devices 432, including user interface components that facilitate user input, such as a keyboard, mouse, microphone, touch screen display, camera, other input buttons and controls.

[0071] The memory 450 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state storage, hard disk drives, optical disk drives, etc. The memory 450 may optionally include one or more storage devices physically located away from the processor 410.

[0072] The memory 450 may include volatile memory or non-volatile memory, or both. The non-volatile memory may be read-only memory (ROM), and the volatile memory may be random access memory (RAM). The memory 450 described in this application embodiment is intended to include any suitable type of memory.

[0073] In some embodiments, memory 450 is capable of storing data to support various operations, examples of which include programs, modules, and data structures or subsets or supersets thereof, as illustrated below.

[0074] Operating system 451 includes system programs for handling various basic system services and performing hardware-related tasks, such as the framework layer, core library layer, driver layer, etc., for implementing various basic business functions and handling hardware-based tasks;

[0075] The network communication module 452 is used to reach other computing devices via one or more (wired or wireless) network interfaces 420, exemplary network interfaces 420 including: Bluetooth, Wi-Fi, and Universal Serial Bus (USB), etc.

[0076] Presentation module 453 is configured to enable the presentation of information (e.g., a user interface for operating peripheral devices and displaying content and information) via one or more output devices 431 associated with user interface 430 (e.g., a display screen, a speaker, etc.).

[0077] The input processing module 454 is used to detect and translate one or more user inputs or interactions from one or more input devices 432.

[0078] In some embodiments, the abnormal behavior detection device provided in this application can be implemented in software. Figure 2 An abnormal behavior detection device 455 stored in memory 450 is shown. It can be software in the form of programs and plug-ins, including the following software modules: information acquisition module 4551, first detection module 4552, second detection module 4553, result determination module 4554, and model acquisition module 4555. These modules are logically related and can therefore be arbitrarily combined or further split according to the functions they implement.

[0079] The functions of each module will be explained below.

[0080] In other embodiments, the abnormal behavior detection device provided in this application can be implemented in hardware. As an example, the abnormal behavior detection device provided in this application can be a processor in the form of a hardware decoding processor, which is programmed to execute the abnormal behavior detection method provided in this application. For example, the processor in the form of a hardware decoding processor can be one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components.

[0081] The following will describe the abnormal behavior detection method provided in this application embodiment, with reference to the exemplary application and implementation of the server provided in the embodiments of this application.

[0082] See Figure 3 , Figure 3 This is an optional flowchart illustrating an abnormal behavior detection method provided in an embodiment of this application, which will be combined with... Figure 3 The steps shown are explained.

[0083] S301. Obtain the behavior information to be detected, which includes the first target object, the second target object, and the target data volume.

[0084] In this embodiment of the application, when a user performs an operation on a functional application on the terminal, such as making a payment, reading an article, or clicking on an advertisement, the terminal responds to the user's operation, generates operation data, and sends the operation data to the server, at which point the server receives the behavior information to be detected.

[0085] It should be noted that the behavior information to be detected is the detection object, including the first target object, the second target object, and the target data volume; wherein, the first target object is the object being manipulated, such as an advertisement, merchant, product, or article; the second target object is the object being manipulated, such as a user; the target data volume is the amount of data generated by the second target object in its manipulation of the first target object, such as the amount, number of clicks, or number of views.

[0086] S302. Obtain the first target sub-model corresponding to the first target object from the first preset object model.

[0087] In this embodiment of the application, the server pre-stores a first preset object model, or the server can pre-obtain the first preset object model; the first preset object model is the model corresponding to each first object, and the model is data volume distribution information; since the first target object is a first object, the server can obtain the model corresponding to the first target object from the first preset object model; at this time, the first target sub-model is obtained.

[0088] It should be noted that the first target sub-model is the data distribution information corresponding to the first target object, such as a histogram of merchant A's amount or the distribution of article B's readership.

[0089] In addition, in this embodiment of the application, when the server does not find a model corresponding to the first target object from the first preset object model, a first target sub-model for the first target object is constructed, and the first target sub-model corresponding to the first target is added to the first preset object model.

[0090] S303. Based on the preset model parameters, determine the amount of abnormal data from the first target sub-model, compare the target data amount and the abnormal data amount, and determine the first detection result corresponding to the behavior information to be detected.

[0091] In this embodiment, the server stores preset model parameters, or the server can obtain preset model parameters in advance. These preset model parameters are preset quantiles in the data distribution information, used to determine the preset range of data volume corresponding to the first target object, and are anomaly judgment conditions corresponding to the first target object. Thus, the server can determine the target position corresponding to the preset model parameters from the first target sub-model, and the data volume corresponding to the target position is the abnormal data volume. Next, the server compares the target data volume and the abnormal data volume, and based on the size relationship between the target data volume and the abnormal data volume in the comparison result, it can determine whether the target data volume is within the preset range of data volume corresponding to the first target object (the range from zero to the abnormal data volume). At this time, the first detection result corresponding to the behavior information to be detected is obtained.

[0092] It should be noted that the first detection result is the result of whether the behavior information to be detected for the first target object is abnormal; when the target data volume is greater than the abnormal data volume, it indicates that the target data volume is not within the preset range of the data volume corresponding to the first target object, and thus, the server determines the first detection result including the abnormality of the behavior information to be detected regarding the first target object; when the target data volume is less than or equal to the abnormal data volume, it indicates that the target data volume is within the preset range of the data volume corresponding to the first target object, and thus, the server determines the first detection result including the normality of the behavior information to be detected regarding the first target object.

[0093] For example, see Figure 4 , Figure 4 This is an exemplary schematic diagram illustrating the determination of abnormal data volume provided in an embodiment of this application; as shown... Figure 4 As shown, in the histogram Figure 4-1 In the (first target sub-model), the horizontal axis represents the monetary value, and the vertical axis represents the probability value. When the preset model parameters are at the 99th percentile, the histogram is calculated in ascending order of monetary value. Figure 4-1 The probabilities of each amount range are summed up. When the summed result is greater than 99% (that is, the probability of being less than position 4-2 is greater than 99%), the amount corresponding to position 4-2 (target position) is the abnormal data volume.

[0094] S304. From the second preset object model, obtain the second target sub-model that corresponds to the second target object and has the highest similarity to the first target sub-model.

[0095] In this embodiment of the application, the server pre-stores a second preset object model, or the server can pre-obtain the second preset object model; the second preset object model is a set of models composed of data distribution information corresponding to each first object for each second object; since the second target object is a second object, the server can obtain the model group corresponding to the second target object from the second preset object model, and match the model with the highest similarity to the first target sub-model from the obtained model group corresponding to the second target object, thus obtaining the second target sub-model.

[0096] It should be noted that the second target sub-model is the data distribution information of the second target object corresponding to the first target object. For example, the histogram of user C's amount with respect to merchant A, and the distribution of user D's reading volume with respect to article B.

[0097] S305. Obtain the maximum data volume of the target corresponding to the second target sub-model, compare the target data volume with the maximum data volume of the target, and determine the second detection result corresponding to the behavior information to be detected.

[0098] In this embodiment, after the server obtains the second target sub-model, since the second preset object model includes not only the model group corresponding to each second object, but also the maximum data volume corresponding to each second object, the server determines the target maximum data volume based on the maximum data volume corresponding to the second target object in the second preset object model. That is to say, the target maximum data volume may be the maximum data volume corresponding to the second target object, or it may be determined based on the maximum data volume corresponding to the second target object in the second preset object model, etc. This embodiment does not specifically limit this.

[0099] Here, the server obtains the target maximum data volume, thus determining the preset range of data volume corresponding to the second target object, which is the anomaly judgment condition corresponding to the second target object. Therefore, by comparing the target data volume with the target maximum data volume, the server can determine whether the target data volume is within the preset range of data volume corresponding to the second target object (the range from zero to the target maximum data volume) based on the size relationship between the target data volume and the target maximum data volume in the comparison result. At this time, the second detection result corresponding to the behavior information to be detected is obtained.

[0100] It should be noted that the second detection result is the result of determining whether the behavior information to be detected is abnormal in relation to the second target object. When the target data volume is greater than the target maximum data volume, it indicates that the target data volume is not within the preset range of the data volume corresponding to the second target object. Therefore, the server determines a second detection result that includes the behavior information to be detected as abnormal with respect to the second target object. When the target data volume is less than or equal to the target maximum data volume, it indicates that the target data volume is within the preset range of the data volume corresponding to the second target object. Therefore, the server determines a second detection result that includes the behavior information to be detected as normal with respect to the second target object.

[0101] S306. Combining the first and second detection results, determine the target detection result for the behavior information to be detected.

[0102] In this embodiment, after obtaining the first detection result and the second detection result, the server combines the first detection result and the second detection result to determine the target detection result of the behavior information to be detected. Here, the target detection result refers to whether the behavior information to be detected is abnormal.

[0103] It should be noted that when the server combines the first detection result and the second detection result to determine the target detection result of the behavior information to be detected, the following applies: when the first detection result indicates that the behavior information to be detected is abnormal regarding the first target object, and the second detection result indicates that the behavior information to be detected is abnormal regarding the second target object, the server determines a target detection result that includes the abnormal behavior information to be detected; when the first detection result indicates that the behavior information to be detected is normal regarding the first target object, and the second detection result indicates that the behavior information to be detected is abnormal regarding the second target object, the server determines a target detection result that includes the abnormal behavior information to be detected, and the server may also determine a target detection result that includes the normal behavior information to be detected; when the first detection result indicates that the behavior information to be detected is normal regarding the first target object, and the second detection result indicates that the behavior information to be detected is normal regarding the second target object, the server determines a target detection result that includes the normal behavior information to be detected; when the first detection result indicates that the behavior information to be detected is abnormal regarding the first target object, and the second detection result indicates that the behavior information to be detected is normal regarding the second target object, the server determines a target detection result that includes the normal behavior information to be detected, and the server may also determine a target detection result that includes the abnormal behavior information to be detected.

[0104] In this embodiment, after obtaining the target detection result, the server can also determine target processing information based on the target detection result. This target processing information is the method for processing the behavior information to be detected. For example, when the behavior information to be detected is a payment operation, if the target detection result indicates that the behavior information to be detected is abnormal, then the target processing information is to block the payment operation. As another example, when the behavior information to be detected is an advertisement click, if the target detection result indicates that the behavior information to be detected is abnormal, then the target processing information is to prevent the advertisement click.

[0105] Understandably, when the behavior information to be detected includes three dimensions—first target object, second target object, and target data volume—the target detection result is determined by combining the comparison results of the target data volume with the abnormal data volume and the maximum target data volume. However, in the process of determining the target detection result, since the abnormal data volume is an anomaly judgment condition for the first target object determined based on the first preset object model, and the maximum target data volume is an anomaly judgment condition for the second target object determined based on the second preset object model, the target detection result can be accurately obtained at low-dimensional features by judging whether the target data volume is within the preset range from the two dimensions of the first and second target objects. Thus, the accuracy of abnormal behavior detection is relatively high.

[0106] See Figure 5 , Figure 5 This is another optional flowchart illustrating the abnormal behavior detection method provided in the embodiments of this application; as shown below. Figure 5 As shown in the embodiment of this application, S307-S311 are included before S302; that is, before the server obtains the first target sub-model corresponding to the first target object from the first preset object model, the abnormal behavior detection method further includes S307-S311. Each step is described below.

[0107] S307. Obtain behavioral information samples.

[0108] In this embodiment, the server obtains behavioral information within the current period, thus obtaining a behavioral information sample; for example, payment orders from the past week. Here, the current period refers to the most recent preset period.

[0109] It should be noted that the behavioral information sample is a set consisting of the first object, the second object, and the data volume within the current set period. Therefore, each piece of behavioral information in the behavioral information sample includes the first object, the second object, and the data volume.

[0110] S308. Aggregate the behavioral information samples according to the first preset object type to obtain a data set corresponding to each first object. Based on the data set, construct the first sub-model corresponding to each first object to obtain the first preset object model corresponding to each first object.

[0111] It should be noted that after obtaining behavioral information samples, the server aggregates these samples according to different preset types to obtain a first preset object model and a second preset object model. These different preset types include a first preset object type (e.g., merchant type or product type) and a second preset object type (e.g., user). Therefore, when the server aggregates behavioral information samples based on the first preset object type and obtains the data volume corresponding to each first object, it also obtains the data volume set corresponding to each first object.

[0112] Here, the object type corresponding to each first object is the first preset object type; the data set is the set of data of each first object with respect to the second object.

[0113] In this embodiment, after obtaining the data set, the server determines the data distribution information corresponding to each first object based on the data set, thus completing the construction of the first sub-model corresponding to each first object. Once the construction of the first sub-model corresponding to each first object is completed, the first sub-models corresponding to each first object are combined to obtain the first preset object model corresponding to each first object. Here, each first object refers to any object among the various first objects, and the first preset object model refers to the set composed of the first sub-models of each first object.

[0114] S309. Aggregate the behavioral information samples according to the second preset object type to obtain the first object set and the maximum data volume corresponding to each second object.

[0115] In this embodiment of the application, when the server aggregates the behavior information samples according to the second preset object type and obtains each first object corresponding to each second object, a set of first objects corresponding to each second object is obtained. Here, when the server aggregates the behavior information samples according to the second preset object type, it also obtains each data quantity corresponding to each second object, and selects the largest data quantity from the obtained data quantities corresponding to each second object, thus obtaining the largest data quantity corresponding to each second object.

[0116] S310. Traverse the first object set and construct at least one second object sub-model based on the sub-model to be updated corresponding to the current first object in the first preset object model.

[0117] In this embodiment of the application, after the server obtains the first object set, it traverses the first objects in the first object set, and matches the current first object with the first object in the first preset object model. The model corresponding to the matched first object is the sub-model to be updated. Here, the server uses the sub-model to be updated to construct at least one second object sub-model corresponding to each second object.

[0118] It should be noted that at least one second object sub-model is a set of data distributions of the first objects associated with each second object. For example, the histograms of user C's amount with respect to merchant A, merchant E, and merchant F. The current first object is any first object in the set of first objects.

[0119] S311. Combine at least one second object sub-model with the maximum data volume to form a second sub-model corresponding to each second object, thereby obtaining a second preset object model corresponding to each second object.

[0120] It should be noted that after the server obtains at least one second object sub-model corresponding to each second object, it combines at least one second object sub-model with the maximum data volume. The resulting combination is the second sub-model corresponding to each second object. When the second sub-model corresponding to each second object is obtained, combining the second sub-models corresponding to each second object yields the second preset object model corresponding to each second object. Here, each second object refers to any object among the various second objects, and the second preset object model refers to the set of second sub-models of each second object.

[0121] In the application embodiment, in S308, the server constructs a first sub-model corresponding to each first object based on the data volume set, including S3081-S3085. The steps are described below.

[0122] S3081. Obtain the data range corresponding to each data volume in the data volume set.

[0123] In this embodiment of the application, the server extracts the minimum and maximum data amounts from each data amount in the data amount set, and the range corresponding to the minimum and maximum data amounts is the data amount range.

[0124] S3082. Divide the data range into segments to obtain multiple target segments.

[0125] In this embodiment of the application, the server divides the quantity range into segments according to a preset segment size or a preset number of segments, thus obtaining multiple target segments.

[0126] S3083. From the data set, count the target number of data belonging to each target segment among multiple target segments.

[0127] In this embodiment of the application, after the server obtains multiple target segments and data volume sets, it determines the target segment to which each data volume in the data volume set belongs, and then counts the number of data volumes belonging to each target segment among the multiple target segments, thus obtaining the target quantity corresponding to each target segment.

[0128] S3084. The ratio of the number of targets to the number of elements in the data set is determined as the probability value corresponding to each target segment, thereby obtaining multiple probability values ​​corresponding to multiple target segments.

[0129] In this embodiment of the application, the server counts the number of data in the data set, which gives the number of elements in the set corresponding to the data set. Then, the target data volume is used as the numerator and the number of elements in the set is used as the denominator to calculate the ratio. The obtained ratio is the probability value corresponding to each target segment. When the probability value corresponding to each target segment is obtained, the probability values ​​corresponding to each target segment are combined to obtain multiple probability values ​​corresponding to multiple target segments. Multiple target segments correspond one-to-one with multiple probability values.

[0130] S3085. Determine the multiple probability values ​​corresponding to multiple target segments as the first sub-model.

[0131] It should be noted that the first sub-model refers to the multiple probability values ​​corresponding to the multiple target segments associated with each first object.

[0132] In this embodiment of the application, S3081 can be implemented through S30811 and S30812; that is, the server obtains the data range corresponding to each data volume in the data volume set, including S30811 and S30812. The steps are described below.

[0133] S30811. Transform each data item in the data set to obtain the transformed data set.

[0134] It should be noted that since the distribution of each data point in the dataset is usually a log-normal distribution, and the log-normal distribution has a smoothed part (long tail), the probability of which is close to 0. This results in inaccurate detection of large data points and cannot provide data support for subsequent abnormal behavior detection. Therefore, in order to improve the accuracy of abnormal behavior detection, the server transforms each data point in the dataset to eliminate the smoothed part, so that the distribution of each transformed data point in the dataset follows a standard normal distribution.

[0135] Here, the transformation can be a logarithmic transformation, a simultaneous reduction by a preset factor, or multiplying the corresponding data volumes using different weights, etc. This application does not specifically limit these methods. It should also be noted that when the data volume is transformed during model training, the data volume referred to in both the model training and model application processes refers to the transformed data volume.

[0136] See Figure 6a When the data volume is monetary, small payments sometimes correspond to relatively small amounts, such as a few yuan, while large payments correspond to relatively large amounts, such as hundreds of thousands. Therefore, the distribution curve 6-1 corresponding to this data volume will show a smoothed portion 6-11. The probability distribution corresponding to this smoothed portion 6-11 has a probability of almost zero, which cannot provide data support for subsequent abnormal payment detection. Figure 6a In the diagram, the horizontal axis represents monetary values, and the vertical axis represents probability values. At this point, the natural logarithm (ln) is used to transform the data volume. Figure 6a The distribution curve 6-1 in the middle is transformed into Figure 6b Distribution curve 6-2; in Figure 6b In the diagram, the horizontal axis represents the converted monetary value, and the vertical axis represents the probability value. It's easy to see that by taking the logarithm of the monetary value, the model can encode fluctuations of a few yuan in small payments and fluctuations of thousands or even tens of thousands of yuan in large payments. This trend of being sensitive to small amounts but insensitive to large amounts is consistent with the curve of the logarithmic function. For example, .

[0137] S30812. Determine the range corresponding to each transformed data quantity in the transformed data quantity set as the data quantity range.

[0138] It should be noted that after the server obtains the set of transformed data, it extracts the minimum and maximum transformed data from each transformed data set. The range corresponding to the minimum and maximum transformed data is the data range.

[0139] Accordingly, in S3083, the server counts the target quantity of data belonging to each of the multiple target segments from the data set. This includes: the server counting the target quantity of transformed data belonging to each of the multiple target segments from the transformed data set. In other words, the server determines the target segment to which each transformed data in the transformed data set belongs, and then counts the quantity of transformed data belonging to each of the multiple target segments, thus obtaining the target quantity corresponding to each target segment. Furthermore, the target data quantity and other data quantities are all data quantities corresponding to the transformed data.

[0140] In this embodiment, S310 can be implemented through S3101-S3104; that is, the server traverses the first object set and constructs at least one second object sub-model based on the sub-model to be updated corresponding to the current first object in the first preset object model, including S3101-S3104. Each step is described below.

[0141] S3101. Traverse the first object set, and compare the sub-model to be updated in the first preset object model corresponding to the current first object with each current sub-model in the current sub-model set corresponding to each second object to obtain similar sub-models.

[0142] It should be noted that when traversing the first object set, if the current first object is the first object traversed, the current sub-model set corresponding to each second object is an empty set; at this time, the server inserts the sub-model to be updated corresponding to the first object traversed into the current sub-model set.

[0143] When the current first object is the first object that has been traversed since the first object, there is at least one current sub-model in the current sub-model set corresponding to each second object. At this time, the server compares the sub-model to be updated with each current sub-model in the current sub-model set. Based on the comparison results, the server selects the current sub-model that is most similar to the sub-model to be updated from the current sub-model set, thus obtaining the similar sub-model.

[0144] S3102. When the similarity of the sub-models is greater than the preset similarity, merge the sub-model to be updated and the similar sub-models, and use the merged sub-model to replace the similar sub-models in the current sub-model set to complete the update of the current sub-model set.

[0145] It should be noted that after the server obtains similar sub-models, it compares the similarity between the similar sub-models and the sub-model to be updated (i.e., the similarity corresponding to the similar sub-models) with the preset similarity. When the similarity between the similar sub-models and the sub-model to be updated is greater than the preset similarity, it indicates that the first object corresponding to the sub-model to be updated (e.g., convenience store A) and the first object corresponding to the similar sub-model (e.g., convenience store B) are similar in terms of data volume. At this time, the server merges the sub-model to be updated and the similar sub-models, and the result of the merger is the merged sub-model. Then, the server uses the merged sub-model to replace the similar sub-models in the current sub-model set, which means that the current sub-model set is updated for the current first object that has been traversed.

[0146] S3103. When the similarity of the sub-models is less than or equal to the preset similarity, the sub-model to be updated is inserted into the current sub-model set to complete the update of the current sub-model set.

[0147] It should be noted that when the similarity between the similar sub-model and the sub-model to be updated is less than or equal to the preset similarity, it indicates that the first object corresponding to the sub-model to be updated (e.g., convenience store A) and the first object corresponding to the similar sub-model (e.g., convenience store B) are not similar in terms of data volume. At this time, the server inserts the sub-model to be updated into the current sub-model set, which means that the current sub-model set is updated for the current first object that is traversed.

[0148] S3104. When the traversal of the first object set is completed, the current sub-model set after the traversal and update is determined as at least one constructed second object sub-model.

[0149] In this embodiment of the application, when the server traverses the first object set, for any first object in the first object set, the current sub-model set corresponding to the current first object is updated using the process from S3101 to S3103; when the traversal of the first object set is completed, the current sub-model set obtained after traversal and updating is the at least one second object sub-model constructed.

[0150] In this embodiment of the application, S3101 further includes S31011-S31014; that is, the server compares the sub-model to be updated in the first preset object model corresponding to the current first object with each current sub-model in the current sub-model set corresponding to each second object to obtain similar sub-models, including S31011-S31014. The distribution of each step is described below.

[0151] S31011. Obtain multiple first target probability values ​​corresponding to multiple target segments from the sub-model to be updated corresponding to the current first object in the first preset object model.

[0152] It should be noted that since the first sub-model corresponding to each first object consists of multiple probability values ​​corresponding to multiple target segments, and the updated sub-model belongs to the first sub-model, the sub-model to be updated also includes multiple probability values ​​corresponding to multiple target segments. Here, these are referred to as multiple first target probability values ​​corresponding to multiple target segments. That is, the multiple first target probability values ​​corresponding to multiple target segments represent the relationship between multiple target segments and multiple probability values ​​corresponding to the sub-model to be updated.

[0153] S31012. Obtain multiple second target probability values ​​corresponding to multiple target segments from each current sub-model in the current sub-model set corresponding to each second object.

[0154] It should be noted that each current sub-model also includes multiple probability values ​​corresponding to multiple target segments, which are referred to here as multiple second target probability values ​​corresponding to multiple target segments; that is, multiple second target probability values ​​corresponding to multiple target segments represent the relationship between multiple target segments and multiple probability values ​​corresponding to each current sub-model.

[0155] S31013. Compare the multiple first target probability values ​​and multiple second target probability values ​​one by one to obtain multiple minimum probability values. The sum of the multiple minimum probability values ​​is determined as the similarity between the sub-model to be updated and each current sub-model, thereby obtaining multiple similarities corresponding to the current sub-model set.

[0156] It should be noted that since multiple second target probability values ​​correspond one-to-one with multiple first target probability values, the server determines the similarity between the sub-model to be updated and each current sub-model by comparing the multiple first target probability values ​​of the sub-model to be updated with the multiple second target probability values ​​of each current sub-model. After obtaining the similarity between the sub-model to be updated and each current sub-model, the similarity between the sub-model to be updated and each current sub-model is combined to obtain multiple similarity values ​​corresponding to the current set of sub-models.

[0157] Here, multiple minimum probability values ​​correspond one-to-one with multiple first target probability values, and multiple minimum probability values ​​correspond one-to-one with multiple second target probability values. Each current sub-model in the current sub-model set corresponds one-to-one with multiple similarities.

[0158] See Figure 7 , Figure 7 This is an exemplary schematic diagram of obtaining similarity provided in an embodiment of this application; as shown... Figure 7 As shown, in a coordinate system where the horizontal axis represents the logarithmic monetary value and the vertical axis represents the probability value, the similarity between the sub-model to be updated 7-1 and each current sub-model 7-2 is the area corresponding to region 7-3. Here, when the probability values ​​of multiple first targets corresponding to the sub-model to be updated 7-1 are... The probability values ​​of the multiple second objectives corresponding to each current sub-model 7-2 are When i is an integer greater than or equal to 2, the similarity S between the sub-model to be updated 7-1 and each current sub-model 7-2 is as shown in equation (1):

[0159] (1)

[0160] Where n is the number of target segments.

[0161] S31014. In the current set of sub-models, the sub-model with the highest similarity among multiple similarities is identified as the similar sub-model.

[0162] In this embodiment, the server obtains the highest similarity from multiple similarities and takes the current sub-model corresponding to the highest similarity in the current sub-model set as the similar sub-model.

[0163] In this embodiment of the application, in S3102 the server merges the sub-model to be updated and the similar sub-model, including S31021-S31024. Each step is described below.

[0164] S31021. Obtain multiple first target probability values ​​corresponding to multiple target segments from the sub-model to be updated.

[0165] It should be noted that the implementation process of S31021 is consistent with the implementation process described in S31011, and will not be repeated here in the embodiments of this application.

[0166] S31022. Obtain multiple probability values ​​to be merged corresponding to multiple target segments from the similar sub-model.

[0167] It should be noted that each current sub-model also includes multiple probability values ​​corresponding to multiple target segments, which are referred to here as multiple second target probability values ​​corresponding to multiple target segments; that is, multiple second target probability values ​​corresponding to multiple target segments represent the relationship between multiple target segments and multiple probability values ​​corresponding to each current sub-model.

[0168] S31023. Compare the multiple first target probability values ​​with the multiple probability values ​​to be merged one by one to obtain multiple maximum probability values.

[0169] It should be noted that there is a one-to-one correspondence between multiple first target probability values ​​and multiple probability values ​​to be merged, and a one-to-one correspondence between multiple maximum probability values ​​and multiple first target probability values, as well as a one-to-one correspondence between multiple maximum probability values ​​and multiple probability values ​​to be merged.

[0170] S31024. Combine multiple target segments and multiple maximum probability values ​​to complete the merging of the sub-model to be updated and similar sub-models.

[0171] See Figure 8 , Figure 8 This is a schematic diagram illustrating an exemplary method for obtaining the merged sub-model, as provided in an embodiment of this application; Figure 8 As shown, in a coordinate system where the horizontal axis represents the logarithmic monetary value and the vertical axis represents the probability value, the merged sub-model 8-3 corresponding to the sub-model 8-1 to be updated and the similar sub-model 8-2 is displayed. Here, when the multiple first target probability values ​​corresponding to the sub-model 8-1 to be updated are... The probability values ​​of the multiple to-be-merged sub-models corresponding to similar sub-models 8-2 are When i is an integer greater than or equal to 2, the process of merging the sub-model to be updated 8-1 and the similar sub-model 8-2 to obtain the merged sub-model 8-3 can be described by equation (2):

[0172] (2)

[0173] in, Used to represent the merged sub-model 8-3.

[0174] In this embodiment of the application, S304 can be implemented through S3041-S3044; that is, the server obtains the second target sub-model corresponding to the second target object and having the highest similarity to the first target sub-model from the second preset object model, including S3041-S3044. Each step is described below.

[0175] S3041. Obtain at least one target second object sub-model corresponding to the second target object from the second preset object model.

[0176] It should be noted that since the second preset object model is obtained by combining at least one second object sub-model corresponding to each second object, the server matches the second target object with each second object in the second preset object model, and the at least one second object sub-model corresponding to the matched second object is at least one target second object sub-model.

[0177] S3042. Obtain the multiple target similarities between the first target sub-model and each target second object sub-model in at least one target second object sub-model.

[0178] In this embodiment of the application, the server compares the first target sub-model with each target second object sub-model to obtain the target similarity between the first target sub-model and each target second object sub-model; when the server combines the target similarity between the first target sub-model and each target second object sub-model, it obtains multiple target similarities between the first target sub-model and at least one target second object sub-model.

[0179] It should be noted that the process of the server obtaining the similarity of multiple targets is similar to the process of obtaining multiple similarities described in S31011-S31013, and will not be repeated here in the embodiments of this application.

[0180] S3043. Obtain the highest target similarity from multiple target similarities.

[0181] Here, the highest target similarity is the highest among multiple target similarities.

[0182] S3044. From at least one target second object sub-model, select the second target sub-model that corresponds to the highest target similarity.

[0183] It should be noted that the server selects the corresponding target second object sub-model from at least one target second object sub-model based on the highest target similarity, thus obtaining the second target sub-model with the highest similarity to the first target sub-model.

[0184] In this embodiment of the application, in step S305, the server obtains the maximum target data volume corresponding to the second target sub-model, including: when the highest target similarity is greater than a preset similarity, the server determines the maximum data volume corresponding to the second target object in the second preset object model as the maximum target data volume corresponding to the second target sub-model; when the highest target similarity is less than or equal to the preset similarity, the server determines the preset data volume as the maximum target volume corresponding to the second target sub-model. Here, the preset data volume is, for example, 0, or any other arbitrary value.

[0185] The following will describe an exemplary application of the embodiments of this application in a real-world application scenario.

[0186] See Figure 9 , Figure 9 This application provides an exemplary schematic diagram of an abnormal behavior detection process; as shown in the embodiments. Figure 9 As shown, in the payment scenario, after the user submits the payment order 9-1 (behavior information to be detected), the server first retrieves the payment order before completing the payment, and obtains the order triple 9-2 from the payment order: user 9-21 (first target object), merchant 9-22 (first target object), and amount value 9-23 (target data volume).

[0187] Secondly, the server retrieves the merchant histogram corresponding to merchant 9-22 from merchant model 9-31 (the first preset object model). Figure 9-3 11 (First Target Sub-model), and based on the merchant histogram Figure 9-3 The 99th percentile of 11 (preset model parameters) determines the normal transaction threshold for merchants from September 22nd. (Abnormal data volume); Determine the normal transaction threshold See the process Figure 4 It is easy to see that the normal transaction threshold This indicates that if the amount exceeds the normal transaction threshold... This means that the payment order corresponding to this amount exceeds 99% of normal transactions, thus determining it as an abnormal transaction on the merchant's side. Here, the amount 9-23 is greater than the normal transaction threshold. This indicates that payment order 9-1 exceeds 99% of normal situations, thus determining that payment order 9-1 is an abnormal transaction result 9-41 on the merchant's side (first detection result).

[0188] Then, the server retrieves the merchant histogram group 9-321 (at least one target second object sub-model) corresponding to user 9-21 from user model 9-32 (second preset object model), and searches for the merchant histogram group 9-321 that matches the merchant histogram. Figure 9-3 11 Most Similar Merchant Histograms Figure 9-3 22 (Second Objective Sub-model). Here, if the merchant histogram... Figure 9-3 If the similarity between histogram 22 and merchant histogram group 9-321 is greater than 0.8 (preset similarity), then the historical maximum transaction amount (maximum data volume corresponding to the second target object) corresponding to user 9-21 in user model 9-32 is used as the normal transaction threshold. (Target maximum data volume); otherwise, use the normal transaction threshold. Set to 0 (preset data volume); it's easy to see that this is the normal transaction threshold. This means that if the amount is less than or equal to the normal transaction threshold... This indicates that the same amount appeared in historical payment orders, confirming that the corresponding payment order was a normal transaction on the user's side. Here, the amount 9-23 is greater than the normal transaction threshold. This indicates that the amount value 9-23 has not appeared in historical payment orders, thus determining that payment order 9-1 is an abnormal transaction result 9-42 on the user's side (second detection result).

[0189] Finally, based on the decision matrix shown in Table 1, and combining results 9-41 and 9-42, payment order 9-1 was determined to be abnormal (target detection result), possibly a transaction involving stolen accounts; therefore, payment order 9-1 was intercepted (9-5) to improve network security.

[0190] Table 1

[0191]

[0192] From the decision matrix shown in Table 1, it is easy to see that when both the merchant and user indicate that the payment order is abnormal, the payment order is determined to be abnormal; when both the merchant and user indicate that the payment order is normal, the payment order is determined to be normal; when both the merchant and user indicate that the payment order is normal, the payment order is determined to be suspected abnormal, and in this case, the abnormality of the payment order is determined according to the actual situation, that is, the payment order can be considered normal or abnormal; when both the merchant and user indicate that the payment order is normal, the payment order is determined to be normal.

[0193] In addition, this application embodiment also provides another decision matrix, as shown in Table 2:

[0194] Table 2

[0195]

[0196] From the decision matrix shown in Table 2, it is easy to see that when both the merchant and user sides indicate that the payment order is abnormal, the payment order is determined to be abnormal. When both the merchant and user sides indicate that the payment order is normal, the payment order is determined to be suspected abnormal. In this case, the abnormality of the payment order is determined based on the actual situation; that is, the payment order can be considered normal or abnormal. When both the merchant and user sides indicate that the payment order is normal, the payment order is determined to be suspected abnormal. In this case, the abnormality of the payment order is determined based on the actual situation; that is, the payment order can be considered normal or abnormal. When both the merchant and user sides indicate that the payment order is normal, the payment order is determined to be normal.

[0197] It should be noted that when the server determines the target detection result based on the first detection result and the second detection result, it can also use other decision matrices, which are not listed one by one in the embodiments of this application.

[0198] In addition, the above-mentioned process for determining the anomalies of payment orders is real-time and is implemented in a real-time / online environment; the above-mentioned process for determining the anomalies of payment orders can also be applied to scenarios such as credit card anti-fraud and combating black market activities.

[0199] Next, we will continue to explain the application of abnormal behavior detection in payment scenarios.

[0200] See Figure 10 , Figure 10This is a schematic diagram of an exemplary acquisition model provided in an embodiment of this application; as shown... Figure 10 As shown, the server retrieves recent (current preset period) historical payment orders 10-1 (behavioral information sample). Each payment order in historical payment orders 10-1 includes a user (second object), a merchant (first object), and an amount (data volume).

[0201] First, historical payment orders 10-1 are aggregated according to merchant (first preset object type) to obtain the transaction amount 10-2 of all recent users for each merchant (data set); after transforming the transaction amount 10-2 of all recent users for each merchant using the natural logarithm, the histogram of the amount distribution is obtained by segmented statistics. Figure 10-3 1 (First Sub-model); e.g. Figure 11 The square shown Figure 11-1 That is, the histogram of the amount distribution Figure 10-3 1. In the coordinate system, the horizontal axis represents the logarithmic monetary value, and the vertical axis represents the probability value. The histogram of the monetary distribution for each merchant is then plotted. Figure 10-3 Combining these elements, we obtain merchant model 10-3.

[0202] Secondly, the historical payment orders 10-1 are aggregated according to users (second preset object type) to obtain each user's recent payments to various merchants 10-41 (first object set) and each user's recent payment amount to each merchant 10-42. The maximum payment amount 10-421 (maximum data volume) is selected from each user's recent payment amount to each merchant 10-42 as the historical maximum transaction amount.

[0203] Then, iterate through each merchant 10-41 that each user has recently paid to, and for each merchant 10-411 (the current first object), obtain the corresponding merchant amount distribution histogram from the merchant model 10-3. Figure 10-3 2. When each merchant 10-411 is the first merchant among all merchants 10-41 visited, the merchant amount distribution histogram is calculated. Figure 10-3 2. Directly insert histogram group 10-51 (current sub-model set); when each merchant 10-411 is not the first merchant among the traversed merchants 10-41, divide the merchant amount distribution histogram. Figure 10-3 2. Compare with each histogram in histogram set 10-51 to find the histogram with the highest similarity from histogram sets 10-51. Figure 10-5 11 (Similar Sub-models); the comparison process is detailed in [link to relevant documentation]. Figure 7 Here, if the histogram... Figure 10-5 11 and Merchant Amount Distribution Histogram Figure 10-3 If the similarity between two items is greater than 0.8, then the histogram of the merchant amount distribution will be used. Figure 10-3 2. Merge into histogram Figure 10-5 For the merging process in section 11, please refer to [link / reference]. Figure 8 And histogram Figure 10-5 11 and Merchant Amount Distribution Histogram Figure 10-3 If the similarity between two values ​​is less than or equal to 0.8, then the histogram of the merchant amount distribution will be used. Figure 10-3 2. Insert into histogram group 10-51; thus, when the traversal of each merchant 10-41 is completed (histogram group 10-51 is at least one second object sub-model), the histogram group 10-51 corresponding to each user is combined with the maximum payment amount 10-421 to obtain the second sub-model, and thus the user model 10-5 (second preset object model) is obtained.

[0204] It should be noted that the process of obtaining the first preset object model and the second preset object model described above can be performed in an offline environment.

[0205] It is understood that the abnormal behavior detection method provided in this application is unsupervised, which does not require data labeling and improves the executability of detection. Furthermore, the model training process only requires the first object, the second object, and the amount of data, and can accurately detect abnormal behavior even when the feature dimension is low. In addition, since no data labeling is required during the model training process, the training efficiency is improved, which also makes the trained model timely and applicable to real-time environments.

[0206] The following description continues to illustrate the exemplary structure of the abnormal behavior detection device 455 provided in the embodiments of this application as a software module. In some embodiments, such as Figure 2 As shown, the software module stored in the abnormal behavior detection device 455 in the memory 450 may include:

[0207] Information acquisition module 4551 is used to acquire information about the behavior to be detected, the information about the behavior to be detected including a first target object, a second target object and a target data volume;

[0208] The first detection module 4552 is used to obtain the first target sub-model corresponding to the first target object from the first preset object model;

[0209] The first detection module 4552 is further configured to determine the abnormal data volume from the first target sub-model based on preset model parameters, compare the target data volume and the abnormal data volume, and determine the first detection result corresponding to the behavior information to be detected;

[0210] The second detection module 4553 is used to obtain, from the second preset object model, the second target sub-model that corresponds to the second target object and has the highest similarity to the first target sub-model;

[0211] The second detection module 4553 is further configured to obtain the maximum data volume of the target corresponding to the second target sub-model, compare the target data volume with the maximum data volume of the target, and determine the second detection result corresponding to the behavior information to be detected;

[0212] The result determination module 4554 is used to combine the first detection result and the second detection result to determine the target detection result of the behavior information to be detected.

[0213] In this embodiment, the abnormal behavior detection device 455 further includes a model acquisition module 4555, used to acquire behavior information samples; aggregate the behavior information samples according to a first preset object type to obtain a data volume set corresponding to each first object; construct a first sub-model corresponding to each first object based on the data volume set, thereby obtaining a first preset object model corresponding to each first object; aggregate the behavior information samples according to a second preset object type to obtain a first object set and a maximum data volume corresponding to each second object; traverse the first object set, construct at least one second object sub-model based on the sub-model to be updated corresponding to the current first object in the first preset object model; combine the at least one second object sub-model with the maximum data volume to form a second sub-model corresponding to each second object, thereby obtaining a second preset object model corresponding to each second object.

[0214] In this embodiment of the application, the model acquisition module 4555 is further configured to acquire the data volume range corresponding to each data volume in the data volume set; segment the data volume range to obtain multiple target segments; count the target number of data volumes belonging to each of the multiple target segments from the data volume set; determine the ratio of the target number to the number of set elements corresponding to the data volume set as the probability value corresponding to each target segment, thereby obtaining multiple probability values ​​corresponding to the multiple target segments; and determine the multiple probability values ​​corresponding to the multiple target segments as the first sub-model.

[0215] In this embodiment of the application, the model acquisition module 4555 is further configured to transform each data quantity in the data quantity set to obtain a transformed data quantity set; and to determine the range corresponding to each transformed data quantity in the transformed data quantity set as the data quantity range.

[0216] In this embodiment of the application, the model acquisition module 4555 is further configured to count the target number of the transformed data belonging to each of the plurality of target segments from the transformed data set.

[0217] In this embodiment, the model acquisition module 4555 is further configured to traverse the first object set, compare the sub-model to be updated corresponding to the current first object in the first preset object model with each current sub-model in the current sub-model set corresponding to each second object, and obtain similar sub-models; when the similarity corresponding to the similar sub-model is greater than a preset similarity, merge the sub-model to be updated and the similar sub-model, and replace the similar sub-model in the current sub-model set with the merged sub-model to complete the update of the current sub-model set; when the similarity corresponding to the similar sub-model is less than or equal to the preset similarity, insert the sub-model to be updated into the current sub-model set to complete the update of the current sub-model set; when the traversal of the first object set is completed, determine the traversed and updated current sub-model set as the constructed at least one second object sub-model.

[0218] In this embodiment of the application, the model acquisition module 4555 is further configured to: acquire multiple first target probability values ​​corresponding to multiple target segments from the sub-model to be updated corresponding to the current first object in the first preset object model; acquire multiple second target probability values ​​corresponding to the multiple target segments from each current sub-model in the current sub-model set corresponding to each second object; compare the multiple first target probability values ​​and the multiple second target probability values ​​one by one to obtain multiple minimum probability values; determine the sum of the multiple minimum probability values ​​as the similarity between the sub-model to be updated and each current sub-model, thereby obtaining multiple similarities corresponding to the current sub-model set; and determine the current sub-model corresponding to the highest similarity among the multiple similarities in the current sub-model set as the similar sub-model.

[0219] In this embodiment of the application, the model acquisition module 4555 is further configured to: acquire multiple first target probability values ​​corresponding to multiple target segments from the sub-model to be updated; acquire multiple probability values ​​to be merged corresponding to the multiple target segments from the similar sub-model; compare the multiple first target probability values ​​and the multiple probability values ​​to be merged one by one to obtain multiple maximum probability values; and combine the multiple target segments and the multiple maximum probability values ​​to complete the merging of the sub-model to be updated and the similar sub-model.

[0220] In this embodiment of the application, the second detection module 4553 is further configured to: obtain at least one target second object sub-model corresponding to the second target object from the second preset object model; obtain multiple target similarities between the first target sub-model and each of the target second object sub-models in the at least one target second object sub-model; obtain the highest target similarity from the multiple target similarities; and select the second target sub-model corresponding to the highest target similarity from the at least one target second object sub-model.

[0221] In this embodiment of the application, the second detection module 4553 is further configured to, when the highest target similarity is greater than a preset similarity, determine the maximum data volume corresponding to the second target object in the second preset object model as the target maximum data volume corresponding to the second target sub-model; and when the highest target similarity is less than or equal to the preset similarity, determine the preset data volume as the target maximum data volume corresponding to the second target sub-model.

[0222] In this embodiment of the application, the first detection module 4552 is further configured to: when the target data volume is greater than the abnormal data volume, determine the first detection result corresponding to the behavior information to be detected, including the behavior information to be detected being abnormal with respect to the first target object; and when the target data volume is less than or equal to the abnormal data volume, determine the first detection result corresponding to the behavior information to be detected, including the behavior information to be detected being normal with respect to the first target object.

[0223] In this embodiment of the application, the second detection module 4553 is further configured to: when the target data volume is greater than the target maximum data volume, determine a second detection result corresponding to the behavior information to be detected, including the behavior information to be detected being abnormal with respect to the second target object; and when the target data volume is less than or equal to the target maximum data volume, determine a second detection result corresponding to the behavior information to be detected, including the behavior information to be detected being normal with respect to the second target object.

[0224] In this embodiment of the application, the result determination module 4554 is further configured to: determine a target detection result including the abnormal behavior information to be detected when the first detection result indicates that the behavior information to be detected is abnormal regarding the first target object, and the second detection result indicates that the behavior information to be detected is abnormal regarding the second target object; determine a target detection result including the abnormal behavior information to be detected when the first detection result indicates that the behavior information to be detected is normal regarding the first target object, and the second detection result indicates that the behavior information to be detected is abnormal regarding the second target object; determine a target detection result including the normal behavior information to be detected when the first detection result indicates that the behavior information to be detected is normal regarding the first target object, and the second detection result indicates that the behavior information to be detected is normal regarding the second target object; and determine a target detection result including the normal behavior information to be detected when the first detection result indicates that the behavior information to be detected is abnormal regarding the first target object, and the second detection result indicates that the behavior information to be detected is normal regarding the second target object.

[0225] This application provides a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the abnormal behavior detection method described above in this application.

[0226] This application provides a computer-readable storage medium storing executable instructions. When these executable instructions are executed by a processor, they cause the processor to execute the abnormal behavior detection method provided in this application. For example, ... Figure 3 The abnormal behavior detection method is shown.

[0227] In some embodiments, the computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, flash memory, magnetic surface memory, optical disk, or CD-ROM; or it may be a variety of devices including one or any combination of the above-mentioned memories.

[0228] In some embodiments, executable instructions may take the form of a program, software, software module, script, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a standalone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.

[0229] As an example, executable instructions may, but do not necessarily, correspond to files in a file system. They may be stored as part of a file that holds other programs or data, for example, in one or more scripts in a Hyper Text Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple collaborating files (e.g., a file that stores one or more modules, subroutines, or code sections).

[0230] As an example, executable instructions can be deployed to execute on a single computing device, or on multiple computing devices located in one location, or on multiple computing devices distributed across multiple locations and interconnected via a communication network.

[0231] In summary, through the embodiments of this application, when the behavior information to be detected includes three dimensions—a first target object, a second target object, and a target data volume—the target detection result of whether the behavior information to be detected is abnormal is determined by combining the comparison results of the target data volume with the abnormal data volume and the maximum target data volume. However, in the process of determining the target detection result, since the abnormal data volume is an anomaly judgment condition for the first target object determined based on the first preset object model, and the maximum target data volume is an anomaly judgment condition for the second target object determined based on the second preset object model, the target detection result of whether the behavior information to be detected is abnormal can be accurately obtained under low-dimensional features by judging whether the target data volume is within a preset range from the two dimensions of the first and second target objects. Thus, the accuracy of abnormal behavior detection is high.

[0232] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, and improvements made within the spirit and scope of this application are included within the scope of protection of this application.

Claims

1. A method for detecting abnormal behavior, characterized in that, include: Acquire information about the behavior to be detected, including a first target object, a second target object, and a target data volume; Obtain behavioral information samples; The behavioral information samples are aggregated according to the first preset object type to obtain a data set corresponding to each first object. Based on the data set, a first sub-model corresponding to each first object is constructed, thereby obtaining a first preset object model corresponding to each first object. The behavioral information samples are aggregated according to the second preset object type to obtain a first object set and a maximum data volume corresponding to each second object; Traverse the first object set and construct at least one second object sub-model based on the sub-model to be updated corresponding to the current first object in the first preset object model; The at least one second object sub-model is combined with the maximum data volume to form a second sub-model corresponding to each second object, thereby obtaining a second preset object model corresponding to each second object; Obtain the first target sub-model corresponding to the first target object from the first preset object model; Based on preset model parameters, the abnormal data volume is determined from the first target sub-model, and the target data volume and the abnormal data volume are compared to determine the first detection result corresponding to the behavior information to be detected. From the second preset object model, obtain the second target sub-model that corresponds to the second target object and has the highest similarity to the first target sub-model; Obtain the maximum target data volume corresponding to the second target sub-model, compare the target data volume with the maximum target data volume, and determine the second detection result corresponding to the behavior information to be detected; By combining the first detection result and the second detection result, the target detection result of the behavior information to be detected is determined.

2. The method according to claim 1, characterized in that, The step of constructing a first sub-model corresponding to each first object based on the data set includes: Obtain the data volume range corresponding to each data volume in the data volume set; The data range is segmented to obtain multiple target segments; From the data set, count the target number of data belonging to each of the multiple target segments; The ratio of the target quantity to the number of set elements corresponding to the data set is determined as the probability value corresponding to each target segment, thereby obtaining multiple probability values ​​corresponding to the multiple target segments; The probability values ​​corresponding to the multiple target segments are determined as the first sub-model.

3. The method according to claim 2, characterized in that, The step of obtaining the data volume range corresponding to each data volume in the data volume set includes: The data quantities in the data quantity set are transformed to obtain the transformed data quantity set; The range corresponding to each transformed data volume in the transformed data volume set is determined as the data volume range; The step of counting the target number of data belonging to each of the multiple target segments from the data set includes: From the transformed data set, count the target number of transformed data belonging to each of the multiple target segments.

4. The method according to any one of claims 1 to 3, characterized in that, The step of traversing the first object set and constructing at least one second object sub-model based on the sub-model to be updated corresponding to the current first object in the first preset object model includes: Traverse the first object set, and compare the sub-model to be updated in the first preset object model corresponding to the current first object with each current sub-model in the current sub-model set corresponding to each second object to obtain similar sub-models; When the similarity of the similar sub-model is greater than the preset similarity, the sub-model to be updated and the similar sub-model are merged, and the merged sub-model is used to replace the similar sub-model in the current sub-model set, thus completing the update of the current sub-model set; When the similarity of the similar sub-model is less than or equal to the preset similarity, the sub-model to be updated is inserted into the current sub-model set to complete the update of the current sub-model set; When the traversal of the first object set is completed, the current sub-model set after the traversal and update is determined as the at least one second object sub-model constructed.

5. The method according to claim 4, characterized in that, The step of comparing the sub-model to be updated in the first preset object model corresponding to the current first object with each current sub-model in the current sub-model set corresponding to each second object to obtain similar sub-models includes: From the sub-model to be updated corresponding to the current first object in the first preset object model, obtain multiple first target probability values ​​corresponding to multiple target segments; From each current sub-model in the current sub-model set corresponding to each second object, obtain multiple second target probability values ​​corresponding to the multiple target segments; The multiple first target probability values ​​and the multiple second target probability values ​​are compared one by one to obtain multiple minimum probability values. The sum of the multiple minimum probability values ​​is determined as the similarity between the sub-model to be updated and each current sub-model, thereby obtaining multiple similarities corresponding to the current sub-model set. The current sub-model with the highest similarity among the multiple similarities in the current sub-model set is determined as the similar sub-model.

6. The method according to claim 4, characterized in that, The merging of the sub-model to be updated and the similar sub-model includes: From the sub-model to be updated, obtain multiple first target probability values ​​corresponding to multiple target segments; From the similarity sub-model, obtain multiple probability values ​​to be merged corresponding to the multiple target segments; By comparing the plurality of first target probability values ​​with the plurality of probability values ​​to be merged one by one, a plurality of maximum probability values ​​are obtained; The multiple target segments and the multiple maximum probability values ​​are combined to complete the merging of the sub-model to be updated and the similar sub-model.

7. The method according to any one of claims 1 to 3, characterized in that, The step of obtaining the second target sub-model from the second preset object model that corresponds to the second target object and has the highest similarity to the first target sub-model includes: Obtain at least one target second object sub-model corresponding to the second target object from the second preset object model; Obtain multiple target similarities between the first target sub-model and each target second object sub-model in the at least one target second object sub-model; Obtain the highest target similarity from the plurality of target similarities; From the at least one target second object sub-model, select the second target sub-model that corresponds to the highest target similarity.

8. The method according to claim 7, characterized in that, The step of obtaining the maximum target data volume corresponding to the second target sub-model includes: When the highest target similarity is greater than the preset similarity, the maximum data volume corresponding to the second target object in the second preset object model is determined as the maximum target data volume corresponding to the second target sub-model; When the highest target similarity is less than or equal to the preset similarity, the preset data amount is determined as the maximum target data amount corresponding to the second target sub-model.

9. The method according to any one of claims 1 to 3, characterized in that, The step of comparing the target data volume and the abnormal data volume to determine the first detection result corresponding to the behavior information to be detected includes: When the target data volume is greater than the abnormal data volume, determine the first detection result corresponding to the behavior information to be detected, including the abnormality of the behavior information to be detected regarding the first target object; When the target data volume is less than or equal to the abnormal data volume, a first detection result corresponding to the behavior information to be detected, including the behavior information to be detected being normal with respect to the first target object, is determined.

10. The method according to any one of claims 1 to 3, characterized in that, The step of comparing the target data volume and the target maximum data volume to determine the second detection result corresponding to the behavior information to be detected includes: When the target data volume is greater than the target maximum data volume, a second detection result corresponding to the behavior information to be detected, including the behavior information to be detected regarding the abnormality of the second target object, is determined; When the target data volume is less than or equal to the target maximum data volume, a second detection result is determined that corresponds to the behavior information to be detected, including the behavior information to be detected being normal with respect to the second target object.

11. The method according to any one of claims 1 to 3, characterized in that, The step of combining the first detection result and the second detection result to determine the target detection result of the behavior information to be detected includes: When the first detection result indicates that the behavior information to be detected is abnormal regarding the first target object, and the second detection result indicates that the behavior information to be detected is abnormal regarding the second target object, the target detection result including the abnormal behavior information to be detected is determined. When the first detection result indicates that the behavior information to be detected is normal with respect to the first target object, and the second detection result indicates that the behavior information to be detected is abnormal with respect to the second target object, the target detection result including the abnormal behavior information to be detected is determined. When the first detection result indicates that the behavior information to be detected is normal with respect to the first target object, and the second detection result indicates that the behavior information to be detected is normal with respect to the second target object, the target detection result including the behavior information to be detected being normal is determined; When the first detection result indicates that the behavior information to be detected is abnormal with respect to the first target object, and the second detection result indicates that the behavior information to be detected is normal with respect to the second target object, the target detection result including the behavior information to be detected being normal is determined.

12. An abnormal behavior detection device, characterized in that, include: The information acquisition module is used to acquire the behavior information to be detected, which includes a first target object, a second target object, and a target data volume; The model acquisition module is used to acquire behavioral information samples; The behavioral information samples are aggregated according to the first preset object type to obtain a data set corresponding to each first object. Based on the data set, a first sub-model corresponding to each first object is constructed, thereby obtaining a first preset object model corresponding to each first object. The behavioral information samples are aggregated according to the second preset object type to obtain a first object set and a maximum data volume corresponding to each second object; Traverse the first object set and construct at least one second object sub-model based on the sub-model to be updated corresponding to the current first object in the first preset object model; The at least one second object sub-model is combined with the maximum data volume to form a second sub-model corresponding to each second object, thereby obtaining a second preset object model corresponding to each second object; The first detection module is used to obtain the first target sub-model corresponding to the first target object from the first preset object model; The first detection module is further configured to determine the amount of abnormal data from the first target sub-model based on preset model parameters, compare the target data amount and the amount of abnormal data, and determine the first detection result corresponding to the behavior information to be detected; The second detection module is used to obtain, from the second preset object model, the second target sub-model that corresponds to the second target object and has the highest similarity to the first target sub-model; The second detection module is further configured to obtain the maximum data volume of the target corresponding to the second target sub-model, compare the target data volume with the maximum data volume of the target, and determine the second detection result corresponding to the behavior information to be detected; The result determination module is used to combine the first detection result and the second detection result to determine the target detection result of the behavior information to be detected.

13. The apparatus according to claim 12, characterized in that, The model acquisition module is also used to acquire the data volume range corresponding to each data volume in the data volume set; The data range is segmented to obtain multiple target segments; From the data set, count the target number of data belonging to each of the multiple target segments; The ratio of the target quantity to the number of set elements corresponding to the data set is determined as the probability value corresponding to each target segment, thereby obtaining multiple probability values ​​corresponding to the multiple target segments; The probability values ​​corresponding to the multiple target segments are determined as the first sub-model.

14. The apparatus according to claim 13, characterized in that, The model acquisition module is also used to transform each data quantity in the data quantity set to obtain a transformed data quantity set; The range corresponding to each transformed data volume in the transformed data volume set is determined as the data volume range; The model acquisition module is further configured to count the target number of the transformed data belonging to each of the plurality of target segments from the transformed data set.

15. The apparatus according to any one of claims 12 to 14, characterized in that, The model acquisition module is further configured to traverse the first object set, compare the sub-model to be updated in the first preset object model corresponding to the current first object with each current sub-model in the current sub-model set corresponding to each second object, and obtain similar sub-models; When the similarity of the similar sub-model is greater than the preset similarity, the sub-model to be updated and the similar sub-model are merged, and the merged sub-model is used to replace the similar sub-model in the current sub-model set, thus completing the update of the current sub-model set; When the similarity of the similar sub-model is less than or equal to the preset similarity, the sub-model to be updated is inserted into the current sub-model set to complete the update of the current sub-model set; When the traversal of the first object set is completed, the current sub-model set after the traversal and update is determined as the at least one second object sub-model constructed.

16. The apparatus according to claim 15, characterized in that, The model acquisition module is further configured to acquire multiple first target probability values ​​corresponding to multiple target segments from the sub-model to be updated corresponding to the current first object in the first preset object model; From each current sub-model in the current sub-model set corresponding to each second object, obtain multiple second target probability values ​​corresponding to the multiple target segments; The multiple first target probability values ​​and the multiple second target probability values ​​are compared one by one to obtain multiple minimum probability values. The sum of the multiple minimum probability values ​​is determined as the similarity between the sub-model to be updated and each current sub-model, thereby obtaining multiple similarities corresponding to the current sub-model set. The current sub-model with the highest similarity among the multiple similarities in the current sub-model set is determined as the similar sub-model.

17. The apparatus according to claim 15, characterized in that, The model acquisition module is also used to acquire multiple first target probability values ​​corresponding to multiple target segments from the sub-model to be updated; From the similarity sub-model, obtain multiple probability values ​​to be merged corresponding to the multiple target segments; By comparing the plurality of first target probability values ​​with the plurality of probability values ​​to be merged one by one, a plurality of maximum probability values ​​are obtained; The multiple target segments and the multiple maximum probability values ​​are combined to complete the merging of the sub-model to be updated and the similar sub-model.

18. The apparatus according to any one of claims 12 to 14, characterized in that, The second detection module is further configured to obtain at least one target second object sub-model corresponding to the second target object from the second preset object model; Obtain multiple target similarities between the first target sub-model and each target second object sub-model in the at least one target second object sub-model; Obtain the highest target similarity from the plurality of target similarities; From the at least one target second object sub-model, select the second target sub-model that corresponds to the highest target similarity.

19. The apparatus according to claim 18, characterized in that, The second detection module is further configured to determine the maximum data volume corresponding to the second target object in the second preset object model as the maximum data volume of the target corresponding to the second target sub-model when the highest target similarity is greater than the preset similarity. When the highest target similarity is less than or equal to the preset similarity, the preset data amount is determined as the maximum target data amount corresponding to the second target sub-model.

20. The apparatus according to any one of claims 12 to 14, characterized in that, The first detection module is further configured to determine, when the target data volume is greater than the abnormal data volume, the first detection result corresponding to the behavior information to be detected, including the abnormality of the behavior information to be detected regarding the first target object; When the target data volume is less than or equal to the abnormal data volume, a first detection result corresponding to the behavior information to be detected, including the behavior information to be detected being normal with respect to the first target object, is determined.

21. The apparatus according to any one of claims 12 to 14, characterized in that, The second detection module is further configured to determine, when the target data volume is greater than the target maximum data volume, a second detection result corresponding to the behavior information to be detected, including the behavior information to be detected being abnormal about the second target object; When the target data volume is less than or equal to the target maximum data volume, a second detection result is determined that corresponds to the behavior information to be detected, including the behavior information to be detected being normal with respect to the second target object.

22. An abnormal behavior detection device, characterized in that, include: Memory, used to store executable instructions; A processor, when executing executable instructions stored in the memory, implements the abnormal behavior detection method according to any one of claims 1 to 11.

23. A computer-readable storage medium, characterized in that, It stores executable instructions for use by a processor to implement the abnormal behavior detection method according to any one of claims 1 to 11.

24. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the abnormal behavior detection method according to any one of claims 1 to 11.

Images