Data processing method, apparatus, computer device and storage medium

Abstract

Embodiments of the present application provide a data processing method and device, computer equipment and a storage medium, wherein the method comprises: obtaining a to-be-processed data set, the to-be-processed data set comprising a plurality of groups of object data related to a target application program, each group of object data comprising an object and feature data corresponding to the object; determining an abnormal object set from the to-be-processed data set based on the feature data corresponding to each object in the to-be-processed data set; determining a sampling object set from the abnormal object set and determining an evaluation parameter based on a test result of the sampling object set; and determining an evaluation result of the target application program based on the evaluation parameter, the abnormal object set and the feature data corresponding to each object in the to-be-processed data set. The embodiments of the present application can effectively improve the efficiency and accuracy of application program evaluation.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a data processing method, a data processing apparatus, a computer device, and a computer-readable storage medium. Background Technology

[0002] With the development of computer and electronic technologies, smart terminals are widely used in people's daily lives. To improve the functionality and personalization of smart terminals and provide users with a richer user experience, various applications (APPs) have emerged. Before using an application, users usually need to register on the application to obtain an identifier that identifies them. The application will then record a series of data generated by the user corresponding to that identifier during the application's use.

[0003] While applications offer personalized experiences and numerous benefits, some malicious actors may exploit them for malicious activities (such as fraudulent sales and false advertising). These misconducts can cause user distress, necessitating intervention. Before determining whether intervention is necessary, the application must be evaluated, or after intervention, the effectiveness of the intervention should be assessed based on the evaluation results. Currently, application evaluation is typically conducted manually, but this method is inefficient and lacks accuracy. Summary of the Invention

[0004] This application provides a data processing method, apparatus, computer equipment, and storage medium, which can effectively improve the efficiency and accuracy of application evaluation.

[0005] On one hand, embodiments of this application provide a data processing method, the method comprising:

[0006] Obtain the dataset to be processed, which includes multiple sets of object data related to the target application. Each set of object data includes an object and the feature data corresponding to the object.

[0007] Based on the feature data corresponding to each object in the dataset to be processed, an abnormal object set is determined from the dataset to be processed;

[0008] A sampling object set is determined from the set of abnormal objects, and evaluation parameters are determined based on the test results of the sampling object set;

[0009] Based on the evaluation parameters, the set of abnormal objects, and the feature data corresponding to each object in the dataset to be processed, the evaluation result of the target application is determined.

[0010] On one hand, embodiments of this application provide a data processing apparatus, the apparatus comprising:

[0011] The acquisition unit is used to acquire a dataset to be processed, which includes multiple sets of object data related to the target application. Each set of object data includes an object and the feature data corresponding to the object.

[0012] The processing unit is used to determine a set of abnormal objects from the dataset to be processed based on the feature data corresponding to each object in the dataset to be processed;

[0013] The processing unit is further configured to determine a sampling object set from the abnormal object set, and to determine evaluation parameters based on the inspection results of the sampling object set;

[0014] The processing unit is further configured to determine the evaluation result of the target application based on the evaluation parameters, the set of abnormal objects, and the feature data corresponding to each object in the dataset to be processed.

[0015] In one embodiment, the processing unit is specifically used for:

[0016] Obtain the reference abnormal object ratio and reference error parameter, and determine the sampling quantity based on the reference abnormal object ratio and the reference error parameter; determine the proportion distribution information of objects in the abnormal object set on the target feature dimension based on the feature data corresponding to each object in the abnormal object set; determine the sampling object set from the abnormal object set based on the sampling quantity and the proportion distribution information.

[0017] In one embodiment, the test result is used to indicate whether each object in the sampling set is abnormal; the processing unit is specifically used to: determine the proportion of objects in the sampling set whose test results are abnormal based on the test results of the sampling set; determine the proportion of resources occupied by objects in the sampling set whose test results are abnormal in the target feature dimension based on the feature data corresponding to each object in the sampling set; and determine the proportion of the number of objects and the proportion of resources as evaluation parameters.

[0018] In one embodiment, the processing unit is specifically configured to: determine the total number of objects in the abnormal object set, and determine the number of abnormal objects in the abnormal object set based on the quantity ratio and the total number; determine the total resource amount of the objects in the abnormal object set on the target feature dimension based on the feature data corresponding to each object in the dataset to be processed, and determine the target resource amount of the abnormal objects in the abnormal object set on the target feature dimension based on the resource amount ratio and the total resource amount; and determine the evaluation result of the target application based on the number of abnormal objects and the target resource amount.

[0019] In one embodiment, the processing unit is specifically used to: process the multiple sets of object data using a target anomaly object screening model, so that the target anomaly object screening model determines anomaly objects from the dataset to be processed based on the feature data corresponding to each object in the dataset to be processed; and generate an anomaly object set based on each anomaly object determined by the target anomaly object screening model.

[0020] In one embodiment, the data processing device further includes a training unit, configured to: acquire a training sample set including a normal sample subset and an abnormal sample subset; each set of object data in the normal sample subset includes a normal identifier of a normal object and feature data corresponding to the normal object, and each set of object data in the abnormal sample subset includes an abnormal identifier of an abnormal object and feature data corresponding to the abnormal object; train an initial abnormal object screening model using the training sample set, and generate the target abnormal object screening model based on the trained abnormal object screening model.

[0021] In one embodiment, the anomaly object screening model is a decision tree model, and a path traversed by the leaf nodes of the trained anomaly object screening model indicates an anomaly object screening rule; the training unit is specifically used to: obtain the screening effect evaluation parameters of each anomaly object screening rule indicated by the trained anomaly object screening model, and determine from the various anomaly object screening rules that the screening effect evaluation parameters are less than or equal to the screening effect threshold and need to be adjusted; adjust the trained anomaly object screening model based on the anomaly object screening rule to be adjusted to obtain the target anomaly object screening model.

[0022] On one hand, embodiments of this application provide a computer device, including: a processor, a communication interface, and a memory, wherein the processor, the communication interface, and the memory are interconnected, wherein the memory stores executable program code, and the processor is used to call the executable program code to execute the data processing method provided in embodiments of this application.

[0023] Accordingly, embodiments of this application also provide a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the data processing method provided in embodiments of this application.

[0024] Accordingly, embodiments of this application also provide a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the data processing method provided in embodiments of this application.

[0025] In this embodiment, an abnormal object set is first determined from the dataset to be processed based on the feature data corresponding to each object in the dataset related to the target application. Then, a sampled object set is determined from the abnormal object set, and evaluation parameters are determined based on the test results of the sampled object set. Finally, the evaluation result of the target application is determined based on the evaluation parameters, the abnormal object set, and the feature data corresponding to each object in the dataset to be processed. By adopting the above method, on the one hand, the application evaluation can be automated and intelligent, thereby effectively improving the efficiency of application evaluation; on the other hand, by sampling and testing the selected abnormal object set and combining it with the evaluation parameters determined based on the sampling and testing results to determine the final evaluation result of the application, the accuracy of the evaluation result can be effectively improved. Attached Figure Description

[0026] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 This invention illustrates a network architecture to which the data processing method provided in the embodiments of this application is applicable;

[0028] Figure 2 This is a flowchart illustrating a data processing method provided in an embodiment of this application;

[0029] Figure 3 This is a schematic diagram of a process for establishing a condensed fake sales dashboard provided in an embodiment of this application;

[0030] Figure 4 This is a flowchart illustrating an evaluation method provided in an embodiment of this application;

[0031] Figure 5 It shows Figure 4 The process of establishing a comprehensive database of fraudulent sales and conducting sampling audits is described in the text.

[0032] Figure 6This is a schematic diagram of the structure of a data processing device provided in an embodiment of this application;

[0033] Figure 7 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0034] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0035] This application provides a data processing method to effectively improve the efficiency and accuracy of application evaluation. The data processing method provided in this application is based on AI (Artificial Intelligence) technology. AI refers to the theories, methods, technologies, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results. AI technology is a comprehensive discipline involving a wide range of fields; the data processing method provided in this application mainly involves Machine Learning (ML) technology within AI. Machine Learning technology is a multidisciplinary field involving probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory, and many other disciplines. It specifically studies how computers can simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to give computers intelligence; its applications span all areas of artificial intelligence. Machine learning typically includes techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and instructional learning.

[0036] In feasible embodiments, the data processing method provided in this application is also based on cloud technology and / or blockchain technology. Specifically, it may involve one or more of cloud technologies, such as cloud storage, cloud database, and big data. For example, data (e.g., object data, such as account data) required to execute the data processing method may be obtained from a cloud database. As another example, the data generated by executing the data processing method (e.g., abnormal object sets, evaluation parameters, evaluation results) may be stored in a blockchain network in the form of blocks. Furthermore, the device executing the data processing method may be a node device in the blockchain network.

[0037] The data processing method provided in this application embodiment can be applied to... Figure 1 The network architecture shown indicates that this data processing method can be... Figure 1 The data processing device shown can be a backend server for the target application or a computer device specifically configured to evaluate the target application. This computer device may not perform tasks related to the operation of the target application. Figure 1 The database shown can be the backend database of the target application, which can be set in the backend server of the target application or exist independently of the backend server of the target application.

[0038] The data processing device first retrieves historical data related to the target application from the database. This historical data includes multiple objects and reference data corresponding to each object. In one embodiment, an object may refer to an account, which can be used to uniquely identify a user; the reference data corresponding to the object may refer to the user data corresponding to the account. This user data includes one or more of the following: user identity information (such as age, education level, etc.), transaction data generated by the user during the use of the application within a preset time period (such as transfer information, transfer remarks, etc.), and complaint records corresponding to each account (such as complaint type, etc.). The multiple accounts included in this historical data may be all or part of the user accounts of the target application.

[0039] Then, a dataset to be processed is determined from the acquired user data. This dataset includes multiple sets of object data, each set comprising an object and its corresponding feature data, which is determined based on reference data corresponding to that object. Further, based on the feature data corresponding to each object in the dataset to be processed, an abnormal object set is determined from the dataset; a sampled object set is then determined from this abnormal object set, and evaluation parameters are determined based on the test results of this sampled object set; finally, based on the evaluation parameters, the abnormal object set, and the feature data corresponding to each object in the dataset to be processed, the evaluation result of the target application is determined.

[0040] In one embodiment, the object can refer to an account. In this case, the dataset to be processed includes multiple sets of account data. Each set of account data includes an account and its corresponding feature data. The feature data is determined based on the user data corresponding to the account and may include one or more of the following: text features, attribute features, transaction features, complaint records, etc. Further, based on the feature data corresponding to each account in the dataset to be processed, an abnormal account set is determined from the dataset to be processed. A sampled account set is determined from the abnormal account set, and evaluation parameters are determined based on the test results of the sampled account set. Finally, based on the evaluation parameters, the abnormal account set, and the feature data corresponding to each account in the dataset to be processed, the evaluation result of the target application is determined. Here, evaluation can refer to risk assessment, that is, a comprehensive quantitative assessment of risk. The risk assessment result can be used to indicate the level of risk present in the target application. The risk may be caused by abnormal behavior (such as fraudulent sales, false advertising, etc.).

[0041] By adopting the above approach, on the one hand, the evaluation of applications can be automated and intelligent, thereby effectively improving the efficiency of application evaluation; on the other hand, by sampling and testing the selected set of abnormal objects and combining the evaluation parameters determined based on the sampling and testing results to determine the final evaluation result of the application, the accuracy of the evaluation result can be effectively improved.

[0042] It should be noted that when the data processing device is a server, the server can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. When the data processing device is a terminal, the terminal can be a laptop, desktop computer, etc., but is not limited to these.

[0043] It should be noted that the datasets to be processed, object data, feature data, abnormal object sets, test results, evaluation parameters, and other related data involved in the embodiments of this application, as well as the data mentioned in the examples, have all been obtained with user authorization. Furthermore, when the embodiments of this application are applied to specific products or technologies, the data used must be authorized by the user, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions.

[0044] The above provides a brief overview of the data processing method provided in the embodiments of this application. The specific implementation of this data processing method will be described in detail below.

[0045] Please see Figure 2 This is a flowchart illustrating a data processing method provided in an embodiment of this application. The data processing method described in this embodiment can be... Figure 1The data processing device shown performs, but is not limited to, the following steps:

[0046] S201. Obtain the dataset to be processed, which includes multiple sets of object data related to the target application. Each set of object data includes an object and the feature data corresponding to the object.

[0047] In this embodiment of the application, the data processing device from Figure 1 The database shown retrieves historical data related to the target application, including multiple objects and their corresponding reference data. Then, a dataset to be processed is determined from the retrieved historical data. This dataset includes multiple sets of object data, each set containing the object and its corresponding feature data, which is determined based on the reference data for that object.

[0048] In one embodiment, the object may refer to an account, which can be used to uniquely identify a user; the reference data corresponding to the object may refer to the user data corresponding to the account. This user data includes one or more of the following: user identity information (such as age, education level, etc.), transaction data generated by the user during their use of the target application within a preset time period (such as one week or one month prior to the evaluation of the target application) (such as transfer information, payment information, etc.), and complaint records (such as complaint types) corresponding to each account within the preset time period. The historical data may include all or part of the user accounts of the target application. The dataset to be processed includes multiple sets of account data, each set including an account and its corresponding feature data. This feature data is determined based on the user data corresponding to the account and may include one or more of the following: textual features, attribute features, transaction features, complaint records, etc.

[0049] Text-based features are derived from text data and include: keywords extracted from notes when sending electronic resources (such as money transfers or sending electronic resource packages), and / or keywords extracted from notes corresponding to received electronic resources; attribute features include: the gender, age, and education level of the sender of the electronic resources, and / or the gender, age, and education level of the recipient of the electronic resources; transaction features are derived from transaction log data and include: the quantity of electronic resources sent or received (such as the amount of money transferred or received); complaint records include the number of complaints received, the type of complaint (such as false sales, false advertising, etc.), and the reason for the complaint.

[0050] The objects in the dataset to be processed can be all or part of the objects in the historical data related to the target application. In feasible implementations, to improve data processing efficiency, when conducting a risk quantification assessment of the target application, some objects and their characteristic data with low reference value for risk assessment may not be processed. For example, objects (such as accounts) whose electronic resources received within a preset time period are less than or equal to a preset quantity (e.g., less than 2000 yuan) are unlikely to exhibit abnormal behavior (e.g., fraudulent sales, false advertising, etc.), and such objects can be excluded from the risk assessment. In this case, objects with low reference value for risk assessment and their corresponding user data can be filtered out when acquiring historical data related to the target application. Alternatively, objects with low reference value for risk assessment and their corresponding user data can be filtered out when determining the dataset to be processed from the acquired historical data related to the target application.

[0051] S202. Based on the feature data corresponding to each object in the dataset to be processed, determine the set of abnormal objects from the dataset to be processed.

[0052] In this embodiment of the application, the target abnormal object screening model can be used to process the multiple sets of object data. The target abnormal object screening model determines whether each object is an abnormal object (such as an object that may have abnormal behavior (such as false sales, false advertising, etc.)) based on the feature data corresponding to each object in the dataset to be processed, and generates an abnormal object set based on each abnormal object determined by the target abnormal object screening model.

[0053] In one implementation, when the object is an account, an abnormal account set can be determined from the dataset to be processed based on the feature data corresponding to each account. In this case, the target abnormal object screening model is a target abnormal account screening model. The target abnormal account screening model can be used to process the multiple sets of account data. The target abnormal account screening model determines whether each account is an abnormal account (i.e., an account that may have abnormal behavior (such as false sales, false advertising, etc.)) based on the feature data corresponding to each account in the dataset to be processed, and generates an abnormal account set based on the abnormal accounts determined by the target abnormal account screening model.

[0054] In one embodiment, the target anomaly object screening model is generated by training an initial anomaly object screening model using a training sample set and based on the trained anomaly object screening model.

[0055] In a feasible embodiment, a training sample set is obtained, comprising a normal sample subset and an abnormal sample subset. The normal sample subset includes multiple sets of object data, each set including a normal identifier for the normal object and corresponding feature data. The abnormal sample subset also includes multiple sets of object data, each set including an abnormal identifier for the abnormal object and corresponding feature data. Abnormal objects are objects identified as having anomalies (such as accounts), which can be manually selected or processed by recorded online anomaly handling strategies. Normal objects are objects identified as not having anomalies, which can be obtained from various whitelists related to the target application. The initial abnormal object screening model is then trained using this training sample set, and a target abnormal object screening model is generated based on the trained abnormal object screening model.

[0056] In one embodiment, the initial abnormal object screening model can be trained using this training sample set as follows: First, calculate the importance of the feature IV values ​​(used to evaluate the quality of the sample data) of each group of object data in the training sample set. Then, sort the object data according to the importance of the feature IV values, either from highest to lowest or lowest to highest. Select the top M objects from the sorted list for initial training of the initial abnormal object screening model. Next, select objects ranked from M+1 to N (N can be 2M, where M and N are positive integers) for retraining the initially trained abnormal object screening model. This process is repeated multiple times using different object data to obtain the trained abnormal object screening model. Using this training method, the trained abnormal object screening model can achieve high screening accuracy.

[0057] In other feasible implementations, only the object data in the abnormal sample subset can be sorted. During each training iteration, M or NM sets of object data are selected from the abnormal sample subset according to the sorted order, and then object data is randomly selected from the normal sample subset proportionally. For example, if there are 400 sets of object data in the abnormal sample subset and 100 sets in the normal sample subset, only the 400 sets of object data in the abnormal sample subset are sorted. During each training iteration, 100 sets of object data are selected from the abnormal sample subset according to the sorted order. Then, 25 sets of object data can be randomly selected from the normal sample subset, or all 100 sets of object data in the normal sample subset can be used as training data.

[0058] Alternatively, the object data in the normal sample subset and the abnormal sample subset can be sorted separately. In each training iteration, a corresponding number of object data sets are selected from each subset according to their proportions and sorting order. For example, if the abnormal sample subset contains 400 object data sets and the normal sample subset contains 100, the 400 sets of object data in the abnormal sample subset and the 100 sets of object data in the normal sample subset are sorted separately. In each training iteration, 100 sets of object data sets are selected from the abnormal sample subset according to their sorting order, and 25 sets of object data sets are selected from the normal sample subset according to their sorting order.

[0059] In a feasible implementation, the abnormal object screening model can be a decision tree model. During the model training process, the range of some important model parameters of the decision tree model, such as the minimum number of nodes and the depth of the tree, can be set by a grid search method, which is conducive to training the decision tree model with the best performance.

[0060] In one implementation, when the abnormal object screening model is a decision tree model, a path traversed by each leaf node of the trained abnormal object screening model can indicate an abnormal object screening rule. For example, when the object is an account, the abnormal object screening rule is an abnormal account screening rule. The abnormal account screening rule can be: if the user corresponding to the account is older than 50 years old, the amount received exceeds 50,000, and the number of complaints about false sales or false advertising exceeds 5, then the account is an abnormal account. In this case, the method for generating the target abnormal object screening model based on the trained abnormal object screening model can be: obtaining the screening effect evaluation parameters of each abnormal object screening rule indicated by the trained abnormal object screening model, and determining the abnormal object screening rule to be adjusted from each abnormal object screening rule whose screening effect evaluation parameters are less than or equal to the screening effect threshold; then adjusting the trained abnormal object screening model based on the abnormal object screening rule to be adjusted to obtain the target abnormal object screening model.

[0061] In feasible implementations, the screening effect evaluation parameters may include coverage (or recall) and precision. Coverage = number of abnormal samples predicted according to the abnormal object screening rules / total number of abnormal samples in the dataset; precision = number of abnormal samples predicted according to the abnormal object screening rules / total number of samples predicted by the abnormal object screening rules. The dataset used to test the coverage and precision of each abnormal object screening rule can be a subset of the abnormal samples used for training, or a specially set test set outside the training subset. Since the test set is different from the training set, it better reflects the screening effect of each abnormal object screening rule in the actual screening process. In this case, screening effect evaluation parameters less than or equal to screening effect thresholds may include: coverage less than or equal to the coverage threshold (e.g., 0.05), and precision less than or equal to the precision threshold (e.g., 0.95).

[0062] In a feasible implementation, the method of adjusting the trained abnormal object screening model based on the abnormal object screening rule to be adjusted to obtain the target abnormal object screening model can be as follows: for each abnormal object screening rule to be adjusted, determine the path corresponding to the abnormal object screening rule to be adjusted, delete the leaf nodes and branches on the path that are not shared with other abnormal object screening rules in the trained abnormal object screening model, and obtain the target abnormal object screening model after the adjustment is completed.

[0063] In one feasible embodiment, various abnormal object screening rules can be obtained from the target abnormal object screening model, and these rules can be directly used to determine whether each object is an abnormal object based on the feature data corresponding to each object in the dataset to be processed, and an abnormal object set can be generated based on the determined abnormal objects.

[0064] It should be noted that the computer device that performs the above model training process and generates the target abnormal object screening model can be a data processing device that performs the data processing method provided in the embodiments of this application, or it can be other servers or terminal devices.

[0065] S203. Determine a sampling object set from the set of abnormal objects, and determine the evaluation parameters based on the test results of the sampling object set.

[0066] In this embodiment, the method for determining the sampling object set from the abnormal object set can be as follows: first, obtain the reference abnormal object ratio and reference error parameter, and then determine the sampling quantity based on the reference abnormal object ratio and reference error parameter. The reference abnormal object ratio can be the estimated proportion of abnormal objects within a certain time period. For example, when the object is an account, the reference abnormal object ratio is the reference abnormal account ratio. The number of abnormal accounts in the target application on a certain day is counted, and this number is multiplied by 7 to obtain the number of abnormal accounts in the target application for a week. This number of abnormal accounts for a week is then divided by the total number of accounts in the target application to obtain the reference abnormal account ratio. The reference error parameter can include the z-standardized score determined based on a set confidence interval and a set error margin, where the error margin is proportional to the reference abnormal object ratio. The confidence interval is the allowable positive and negative deviation of the survey results for the sample. Commonly used confidence intervals are 95%, 99%, and 90%, which correspond to z-standardized scores of 1.96, 2.575, and 1.645, respectively.

[0067] In a feasible implementation, the sampling size can be determined using the following formula (1):

[0068] Equation (1)

[0069] Where n represents the sample size, p represents the proportion of outliers, Z represents the z-standardized score corresponding to the confidence interval, and E represents the error margin.

[0070] Furthermore, based on the feature data corresponding to each object in the abnormal object set, the proportional distribution information of the objects in the abnormal object set on the target feature dimension is determined; then, based on the sampling quantity and the proportional distribution information, a sampled object set is determined from the abnormal object set. This target feature dimension can be the quantity of electronic resources received within a preset time period. For example, if the object is an account, the abnormal object set is an abnormal account set, the determined sampling size is 800, and the target feature dimension is the amount of money received by the account within a week, if the proportion of accounts in the abnormal account set whose amount of money received within a week is less than 10,000 is 20%, the proportion whose amount of money received within a week is between 10,000 and 50,000 is 60%, and the proportion whose amount of money received within a week is greater than 50,000 is 20%, then for the abnormal account set, 160 (i.e., 800 × 20%) accounts are selected from the accounts whose amount of money received within a week is less than 10,000, 480 (i.e., 800 × 60%) accounts are selected from the accounts whose amount of money received within a week is between 10,000 and 50,000, and 160 (i.e., 800 × 20%) accounts are selected from the accounts whose amount of money received within a week is greater than 50,000 as the sampling accounts in the sampling account set.

[0071] In this embodiment of the application, the inspection result of the sampled object set is used to indicate whether each object in the sampled object set is abnormal. It can be that the relevant staff manually inspect whether each object in the sampled object set is truly abnormal, or it can be that the data processing device inspects whether each object in the sampled object set is truly abnormal based on more feature data of each object in the sampled object set (such as feature data generated based on user data within a preset time period, in addition to feature data generated based on user data from a certain adjacent time period before the preset time period).

[0072] The method for determining evaluation parameters based on the inspection results of a sampled object set can be as follows: Based on the inspection results of the sampled object set, determine the proportion of objects whose inspection results are abnormal within the sampled object set; based on the characteristic data corresponding to each object in the sampled object set, determine the proportion of resources represented by objects whose inspection results are abnormal in the sampled object set along the target characteristic dimension. This target characteristic dimension can be the quantity of electronic resources received within a preset time period. For example, if the object is an account and the sampled object set is a sampled account set, and if the total amount received by all accounts in the sampled account set within a week is 500,000, and the total amount received by all accounts in the sampled account set whose inspection results are abnormal within the sampled account set within a week is 450,000, then the resource proportion is 45 / 50, or 90%. Finally, the determined quantity proportion and resource proportion are used as evaluation parameters.

[0073] S204. Based on the evaluation parameters, the set of abnormal objects, and the feature data corresponding to each object in the dataset to be processed, determine the evaluation result of the target application.

[0074] In this embodiment, the total number of objects in the abnormal object set is determined, and the number of abnormal objects in the abnormal object set is determined based on the total number and the quantity ratio included in the evaluation parameters. In one embodiment, the total number is multiplied by the quantity ratio to obtain the number of abnormal objects.

[0075] Based on the feature data corresponding to each object in the dataset to be processed, the total resource quantity of objects in the abnormal object set in the target feature dimension is determined. This target feature dimension can be the number of electronic resources received within a preset time period, with the reference feature data being the number of electronic resources received by each object within the preset time period. For example, if the object is an account and the abnormal object set is a set of abnormal accounts, and the total amount received by all accounts in the abnormal account set within a week is 4 million, then the total resource quantity is 4 million. Then, based on this total resource quantity and the resource quantity ratio included in the evaluation parameters, the target resource quantity of the abnormal objects in the abnormal object set in the target feature dimension is determined. In one embodiment, the total resource quantity is multiplied by the resource quantity ratio to obtain the target resource quantity.

[0076] Finally, the number of identified abnormal objects and the amount of target resources can be used as the evaluation results for the target application. Here, evaluation can refer to risk assessment, that is, a comprehensive quantitative assessment of risk. The risk assessment results can be used to indicate the level of risk present in the target application, and the risk can be caused by abnormal behavior (such as fraudulent sales, false advertising, etc.).

[0077] In feasible embodiments, the quantity proportions included in the evaluation parameters are first quantity proportions, and the resource quantity proportions included are first resource quantity proportions. A second quantity proportion of objects in the abnormal object set within the dataset to be processed can also be determined, and the proportion of abnormal objects in the dataset to be processed is determined based on this second quantity proportion and the first quantity proportions included in the evaluation parameters. In one embodiment, the first quantity is multiplied by the second quantity to obtain the abnormal object proportion.

[0078] Based on the feature data corresponding to each object in the dataset to be processed, the second resource quantity ratio of the objects in the abnormal object set included in the dataset to be processed is determined in terms of the target feature dimension. This target feature dimension can be the quantity of electronic resources received within a preset time period. For example, if the object is an account and the abnormal object set is an abnormal account set, and the total amount received by all accounts in the dataset to be processed within a week is 10 million, while the total amount received by all accounts in the abnormal account set within a week is 4 million, then the second resource quantity ratio is 400 / 1000, or 40%. Then, based on this second resource quantity ratio and the first resource quantity ratio included in the evaluation parameters, the target resource quantity ratio of the abnormal objects in the dataset to be processed in terms of the target feature dimension is determined. In one embodiment, the first resource quantity ratio is multiplied by the second resource quantity ratio to obtain the target resource quantity ratio.

[0079] Finally, the evaluation result of the target application can be determined based on the determined proportion of abnormal objects and the proportion of target resources. Specifically, when the objects in the dataset to be processed are all objects of the target application, the determined proportion of abnormal objects and the proportion of target resources can be directly used as the evaluation result of the target application. When the objects in the dataset to be processed are only a portion of the objects of the target application (e.g., accounts whose electronic resources received within a preset time period are less than or equal to a preset number are filtered out), the evaluation result of the target application can be based on the proportion of objects in the dataset to all objects of the target application, the proportion of objects in the dataset to which all objects of the target application are contained, and the proportion parameters determined by the aforementioned proportion of abnormal objects and the proportion of target resources.

[0080] It should be noted that the number of abnormal objects, the target resource quantity, and the proportion of abnormal objects and the proportion of target resources determined above can all be used as the evaluation results of the target application; or, the number of abnormal objects, the target resource quantity, and the proportional parameters determined based on the proportion of abnormal objects and the proportion of target resources determined above can all be used as the final evaluation results of the target application. Here, evaluation can refer to risk assessment, that is, a comprehensive quantitative assessment of risk. The risk assessment results can be used to indicate the level of risk present in the target application, and the risk can be caused by abnormal behavior (such as fraudulent sales, false advertising, etc.).

[0081] In feasible embodiments, after determining the evaluation results of the target application, a manual or data processing device can automatically determine whether abnormal behavior handling is required for the target application based on the determined evaluation results. If abnormal behavior handling is determined to be required, an anomaly handling strategy can be determined based on the anomaly object screening rules indicated by the target anomaly object screening model. Alternatively, a manual or data processing device can automatically determine the processing effect of the anomaly handling strategy set for the target application based on the determined evaluation results, to determine whether the anomaly handling strategy needs to be optimized, and so on.

[0082] The data processing method provided in this application embodiment can, on the one hand, automate and intelligentize the evaluation of the application, thereby effectively improving the efficiency of the evaluation; on the other hand, by sampling and testing the selected abnormal object set, and combining the evaluation parameters determined based on the sampling and testing results to determine the final evaluation result of the application, the accuracy of the evaluation result can be effectively improved; furthermore, by screening abnormal objects based on the abnormal object screening model, the efficiency and accuracy of abnormal object screening can be improved.

[0083] To better understand the data processing method and the training method of the abnormal object screening model provided in the embodiments of this application, the following uses the target application as a payment application, the object as an account, the abnormality of the account as the existence of fraudulent sales behavior, and the evaluation of the target application as a comprehensive quantitative assessment of the fraudulent sales risk in the target application as an example to introduce the solution provided in the embodiments of this application.

[0084] First, let's introduce some terms used in the embodiments of this application: **Overall Market:** A set of accounts (such as payment application accounts) filtered based on certain conditions. The overall market refers to all accounts without filtering conditions, while the fraudulent sales market refers to the set of black and gray (i.e., abnormal) accounts involved in fraudulent sales. **Confidence Interval:** The allowable positive and negative biases for the survey results of the sample. Commonly used confidence intervals are 95%, 99%, and 90%. Their corresponding z-standardized scores are 1.96, 2.575, and 1.645, respectively. **Processing:** Measures such as intercepting the transaction or account and restricting incoming payments.

[0085] Risk assessment of fraudulent sales can be conducted using a "mass sell" approach. This involves creating a set of fraudulent sales accounts that have been dealt with using all online fraudulent sales handling strategies, and then using the volume and amount of these processed accounts as the risk assessment result for the overall fraudulent sales situation. However, this method has the following drawbacks: First, the "mass sells" approach only includes accounts processed by online fraudulent sales handling strategies. While this achieves a certain level of accuracy, the coverage is still not comprehensive and relies too heavily on subjective human intervention. Accounts not processed by these strategies will not be included in the mass sells list, but this doesn't mean they are free of fraudulent sales risk; they simply haven't been detected yet. Therefore, the "mass sells" approach cannot address the coverage of accounts with undetected fraudulent sales risks. Furthermore, online fraudulent sales handling strategies prioritize accuracy, temporarily ignoring some low-risk accounts. However, these accounts also require continuous monitoring, which the "mass sells" approach cannot cover. Second, the "mass sells" approach only measures the scale of processed accounts and cannot adequately assess the contribution of online fraudulent sales handling strategies to reducing overall malicious risk. Therefore, it is not a reasonable standard for business performance evaluation.

[0086] Ideally, a comprehensive risk assessment of fraudulent sales would involve reviewing each account in the overall system, with the set of accounts identified as engaging in fraudulent sales constituting the overall fraudulent sales risk. However, payment applications have a massive number of accounts (reaching hundreds of millions), and account risks are dynamically changing, making a comprehensive review of the entire system impractical due to manpower and time constraints. To address these issues, this application provides a novel risk assessment method. First, a decision tree model is established to uncover a set of suspicious rules for fraudulent sales combinations. Then, small-amount accounts are removed from the overall system, and accounts are recalled based on the uncovered rules, forming a preliminary, condensed, small-scale fraudulent sales rule pool. Next, based on this condensed pool and statistical sampling theory, a suitable total sample size is determined to approximate the pool concentration (or proportion). Stratified sampling is performed using a proportional allocation method, and the sampled data is then manually reviewed. Finally, based on the concentration results from the manual review, the account and amount concentrations of the overall suspicious fraudulent sales pool are calculated and reconstructed, enabling a comprehensive quantitative assessment of the fraudulent sales risk within the massive account pool of payment applications.

[0087] The risk assessment method in this application mainly includes the following steps:

[0088] 1. Establish a preliminary, condensed framework of rules for small-scale fraudulent sales, and establish the following process: Figure 3 As shown, it includes:

[0089] Extracting black and white samples: Black samples (i.e., abnormal accounts or fake sales accounts) are existing fake sales black accounts, such as fake sales accounts under large-amount review, anti-money laundering reports, and accounts screened by high-precision models; white samples (i.e., normal accounts) can be extracted from whitelisted accounts such as WeChat merchants.

[0090] Feature mining and data extraction: Through reviewing cases, suspicious features are identified and summarized, such as text features, attribute features, transaction features, complaint records, etc. Data is extracted from the features mined in the first step of black-and-white sample association. Text features include: abnormal keywords extracted from notes in transfers or e-resource packages; attribute features include: gender, age, and education level of the recipient of the transfer or e-resource package, and gender, age, and education level of the sender of the transfer or e-resource package; transaction features are obtained from transaction flow data, such as: transfer amount or resource quantity of the e-resource package; complaint records include the number of complaints, complaint type (e.g., false sales, false advertising, etc.), and reason for the complaint.

[0091] Decision Tree Modeling: Based on the above sample and feature data, decision tree modeling is performed. This involves preprocessing the feature data (e.g., for text data, performing keyword regularization and word frequency statistics; for numerical data, summarizing features such as mean / maximum value, e.g., the maximum / average amount received in the last 7 days), calculating the importance of feature IV values ​​(higher values ​​indicate better samples), and selecting different feature combinations based on their importance ranking for multiple model training iterations. The decision tree model has two important parameters: the minimum number of nodes, which determines the minimum number of samples covered by the final leaf nodes (the lower limit of rule coverage); and the tree depth, which determines the model's accuracy—deeper trees generally have higher rule accuracy. Therefore, a grid search method can be used to set the range for these two important decision tree model parameters to train the best-performing decision tree model.

[0092] Training rule selection: Summarize the paths traversed by leaf nodes in the model trained in the previous step into rule form (i.e., abnormal account screening rules), and calculate the coverage (number of black samples predicted by the rule / total number of black samples in the dataset) and accuracy (number of black samples predicted by the rule / total number of samples predicted by the rule) of each rule. Rules with coverage > 0.05 and accuracy > 0.95 can be selected as candidate rules.

[0093] Marketplace Rule Screening: The rules mentioned above only perform well on the offline test set. They can be substituted into the actual marketplace to recall the accounts corresponding to each training rule. Further rule screening is then performed based on criteria such as coverage, precision, and recall volume. Rules meeting coverage and precision requirements are used as the initial suspicious rules for compiling the marketplace. It should be noted that the precision and recall rates mentioned here refer to the actual marketplace black samples that have already been processed by the online fraudulent sales handling strategy.

[0094] First, small-amount accounts (e.g., accounts with weekly revenue less than 10,000) are removed from the actual overall market to reduce the number of accounts. Then, a set of suspicious rules for fraudulent sales, obtained through the decision tree modeling method described above, is used to filter out black / gray accounts (i.e., fraudulent sales accounts) from the remaining market after removing small-amount accounts. This yields a preliminary, condensed market of small-scale fraudulent sales rules (hereinafter referred to as the condensed fraudulent sales market). It should be noted that the set of suspicious rules for fraudulent sales obtained through the decision tree modeling method described above can be used directly for filtering black / gray accounts, or the trained decision tree model can be adjusted based on the set of suspicious rules obtained through the decision tree modeling method described above. That is, the paths corresponding to the discarded rules are deleted from the model, and the adjusted model is used to filter black / gray accounts (or abnormal or malicious accounts).

[0095] 2. Sampling audit, the processing procedure is as follows: Figure 4 As shown, it includes:

[0096] Statistical theory is used to calculate a reasonable total sample size: Although the first step has already condensed the overall market, the scale of the condensed fake sales market is still very large (usually in the hundreds of thousands). It is impossible to manually review each one. At this time, some statistical sampling theories can be applied to calculate a reasonable total sample size based on parameters such as allowable error and confidence interval, so as to make the distribution of the sample approximately close to the overall distribution of the condensed fake sales market. The reasonable sample size can be calculated using the formula (1) mentioned above:

[0097] Equation (1)

[0098] The confidence interval can be chosen as 95%, then the z-standardized score Z corresponding to the confidence interval in equation (1) is 1.96. The numerator E represents the error range, that is, the deviation range between the sample false sales concentration and the actual overall false sales concentration. If the error is large, the determined sampling size n cannot reflect the overall concentration level well, but if the error is small, it will lead to a very large sampling size, increasing the cost of manual review. p represents the proportion of samples with a certain attribute, that is, the proportion of false sales accounts in the overall concentration. Therefore, it can be deduced that Z is fixed, p and the error range E are related, and if p is larger, E can also be slightly larger. Based on the concentrated overall account volume and the weekly prediction of false sales malicious accounts, an estimated overall concentration p (such as 0.087) is obtained. At this time, the numerator Z and p in equation (1) have been determined; the allowable error can be set to about one-fifth of the concentration P based on p, and E is set to 0.020. Therefore, when p is 0.087, a reasonable sample size of 800 can be obtained according to equation (1), which is also in line with the requirements of actual manual review.

[0099] At this stage, starting with the overall market, by removing small-amount payment accounts and creating a condensed market of fraudulent sales rules, the overall market size is narrowed down. Then, a reasonable total sample size is calculated within this overall market. The specific screening process is as follows: Figure 5 As shown.

[0100] Stratified Sampling by Amount - Proportional Allocation: Since the number of accounts with different amounts in the overall market is uneven, and the concentration of fraudulent sales accounts also varies, simple random sampling may not be able to account for the individual characteristics of each stratum. Therefore, stratified sampling based on amount is necessary. A proportional allocation method based on amount stratification can be chosen, i.e., allocation based on the proportion of each stratum's units to the total number of units (i.e., allocation based on the stratification weight). As shown in Table 1, stratifying by amount from 10,000 to 30,000 to 100,000+, the overall market account proportions are 64%, 29%, and 6%, respectively. With a total sample size of 800, the corresponding stratified sample sizes are 515, 235, and 50, respectively.

[0101] Table 1:

[0102]

[0103] Final sample submission: The samples drawn using the above method are reviewed manually one by one.

[0104] 3. Calculation, restoration, and optimization:

[0105] Calculation and Restoration: Based on the results of manual review of the sampled data, the concentration (or proportion) of black / gray accounts and amounts in the sampled data can be obtained. Then, by multiplying the total number of accounts and total amount of the concentrated fraudulent sales data obtained in step 1 by the corresponding black / gray concentration, the calculated and restored number of black / gray accounts and the amount received in the fraudulent sales data can be obtained. The specific formulas are as follows: Equations 2 and 3:

[0106] (Equation 2):

[0107] Calculating the total number of black / gray accounts in the market = Concentrated total number of accounts involved in fraudulent sales × Concentration of black / gray accounts reviewed

[0108] (Formula 3):

[0109] Calculating the total amount of black / gray market transactions = Concentrated total amount of fraudulent sales × Concentration of the amount corresponding to the black / gray market accounts reviewed

[0110] The above formula yields the calculated and restored number of fraudulent sales accounts and the corresponding amounts. Based on this data, the current risk level of the fraudulent sales market can be quantitatively assessed, along with comparative indicators such as the year-on-year / month-on-month increase / decrease in risk indicators compared to previous periods. This reflects the effectiveness of online fraudulent sales handling strategies implemented for payment applications and can serve as a business processing evaluation indicator. Furthermore, the audit results of manually reviewed samples allow for further analysis of cases not covered by the current strategy, leading to optimization of the handling strategy and better management of fraudulent sales risks within the market.

[0111] Using the above method, a comprehensive quantitative assessment of the risk of fraudulent sales within the massive account pool of payment application systems can be conducted, which is both efficient and accurate.

[0112] It should be noted that the execution entity used to perform each step in the above method embodiments can be hardware, software, or a combination of hardware and software.

[0113] Please see Figure 6 This is a schematic diagram of a data processing apparatus provided in an embodiment of this application. The data processing apparatus described in this embodiment corresponds to the data processing device mentioned above, and the apparatus includes:

[0114] The acquisition unit 601 is used to acquire a dataset to be processed, which includes multiple sets of object data related to the target application. Each set of object data includes an object and the feature data corresponding to the object.

[0115] Processing unit 602 is used to determine an abnormal object set from the dataset to be processed based on the feature data corresponding to each object in the dataset to be processed;

[0116] The processing unit 602 is further configured to determine a sampling object set from the abnormal object set, and to determine evaluation parameters based on the inspection results of the sampling object set;

[0117] The processing unit 602 is further configured to determine the evaluation result of the target application based on the evaluation parameters, the set of abnormal objects, and the feature data corresponding to each object in the dataset to be processed.

[0118] In one embodiment, the processing unit 602 is specifically used for:

[0119] Obtain the reference abnormal object ratio and reference error parameter, and determine the sampling quantity based on the reference abnormal object ratio and the reference error parameter; determine the proportion distribution information of objects in the abnormal object set on the target feature dimension based on the feature data corresponding to each object in the abnormal object set; determine the sampling object set from the abnormal object set based on the sampling quantity and the proportion distribution information.

[0120] In one embodiment, the inspection result is used to indicate whether each object in the sampling set is abnormal; the processing unit 602 is specifically used to: determine the proportion of objects in the sampling set whose inspection results are abnormal based on the inspection results of the sampling set; determine the proportion of resources occupied by objects in the sampling set whose inspection results are abnormal in the target feature dimension based on the feature data corresponding to each object in the sampling set; and determine the proportion of the number of objects and the proportion of resources as evaluation parameters.

[0121] In one embodiment, the processing unit 602 is specifically configured to: determine the total number of objects in the abnormal object set, and determine the number of abnormal objects in the abnormal object set based on the quantity ratio and the total number; determine the total resource amount of the objects in the abnormal object set on the target feature dimension based on the feature data corresponding to each object in the dataset to be processed, and determine the target resource amount of the abnormal objects in the abnormal object set on the target feature dimension based on the resource amount ratio and the total resource amount; and determine the evaluation result of the target application based on the number of abnormal objects and the target resource amount.

[0122] In one embodiment, the processing unit 602 is specifically used to: process the multiple sets of object data using a target anomaly object screening model, so that the target anomaly object screening model determines anomaly objects from the dataset to be processed based on the feature data corresponding to each object in the dataset to be processed; and generate an anomaly object set based on each anomaly object determined by the target anomaly object screening model.

[0123] In one embodiment, the data processing device further includes a training unit 603, configured to: acquire a training sample set including a normal sample subset and an abnormal sample subset; each set of object data in the normal sample subset includes a normal identifier of a normal object and feature data corresponding to the normal object, and each set of object data in the abnormal sample subset includes an abnormal identifier of an abnormal object and feature data corresponding to the abnormal object; train an initial abnormal object screening model using the training sample set, and generate the target abnormal object screening model based on the trained abnormal object screening model.

[0124] In one embodiment, the anomaly object screening model is a decision tree model, and a path traversed by the leaf nodes of the trained anomaly object screening model indicates an anomaly object screening rule; the training unit 603 is specifically used to: obtain the screening effect evaluation parameters of each anomaly object screening rule indicated by the trained anomaly object screening model, and determine from the various anomaly object screening rules that the screening effect evaluation parameters are less than or equal to the screening effect threshold and need to be adjusted; adjust the trained anomaly object screening model based on the anomaly object screening rule to be adjusted to obtain the target anomaly object screening model.

[0125] It is understood that the functions of each functional unit of the data processing device provided in the embodiments of this application can be specifically implemented according to the methods in the above method embodiments, and the specific implementation process can be referred to the relevant descriptions in the above method embodiments, which will not be repeated here.

[0126] In feasible embodiments, the data processing apparatus provided in this application can be implemented in software. The data processing apparatus can be stored in a memory and can be software in the form of programs and plug-ins. It includes a series of units, including an acquisition unit, a processing unit, and a training unit. The acquisition unit, processing unit, and training unit are used to implement the data processing method provided in this application.

[0127] In other feasible embodiments, the data processing device provided in this application embodiment can also be implemented in a combination of hardware and software. As an example, the data processing device provided in this application embodiment can be a processor in the form of a hardware decoding processor, which is programmed to execute the data processing method provided in this application embodiment. For example, the processor in the form of a hardware decoding processor can be one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components.

[0128] In this embodiment, an abnormal object set is first determined from the dataset to be processed based on the feature data corresponding to each object in the dataset related to the target application. Then, a sampled object set is determined from the abnormal object set, and evaluation parameters are determined based on the test results of the sampled object set. Finally, the evaluation result of the target application is determined based on the evaluation parameters, the abnormal object set, and the feature data corresponding to each object in the dataset to be processed. By adopting the above method, on the one hand, the application evaluation can be automated and intelligent, thereby effectively improving the efficiency of application evaluation; on the other hand, by sampling and testing the selected abnormal object set and combining it with the evaluation parameters determined based on the sampling and testing results to determine the final evaluation result of the application, the accuracy of the evaluation result can be effectively improved.

[0129] Please see Figure 7 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. The computer device described in this embodiment corresponds to the data processing device mentioned above, and includes: a processor 701, a communication interface 702, and a memory 703. The processor 701, communication interface 702, and memory 703 can be connected via a bus or other means; this embodiment takes a bus connection as an example.

[0130] The processor 701 (or CPU, Central Processing Unit) is the computing and control core of the computer device. It can parse various instructions and process various data within the computer device. For example, the CPU can parse power-on / off commands sent by the user and control the computer device to perform power-on / off operations; it can also transmit various interactive data between internal structures of the computer device. The communication interface 702 may optionally include standard wired interfaces or wireless interfaces (such as Wi-Fi, mobile communication interfaces, etc.), and is controlled by the processor 701 for sending and receiving data. The memory 703 is the storage device in the computer device, used to store programs and data. It is understood that the memory 703 here can include the computer device's built-in memory, or it can include extended memory supported by the computer device. The memory 703 provides storage space for the computer device's operating system, which may include, but is not limited to, Android, iOS, Windows Phone, etc., and this application does not limit this.

[0131] In this embodiment of the application, the processor 701 performs the following operations by running the executable program code in the memory 703:

[0132] A dataset to be processed is obtained, which includes multiple sets of object data related to the target application. Each set of object data includes an object and its corresponding feature data. Based on the feature data corresponding to each object in the dataset to be processed, an abnormal object set is determined from the dataset to be processed. A sampled object set is determined from the abnormal object set, and evaluation parameters are determined based on the test results of the sampled object set. Based on the evaluation parameters, the abnormal object set, and the feature data corresponding to each object in the dataset to be processed, the evaluation result of the target application is determined.

[0133] The processor 701 can access the communication interface 702 from... Figure 1 The database shown retrieves historical data related to the target application, including multiple objects and their corresponding user data; and the dataset to be processed is determined based on the retrieved historical data.

[0134] In one embodiment, when the processor 701 determines the sampling object set from the abnormal object set, it is specifically configured to: obtain a reference abnormal object ratio and a reference error parameter, and determine the sampling quantity based on the reference abnormal object ratio and the reference error parameter; determine the proportion distribution information of the objects in the abnormal object set on the target feature dimension based on the feature data corresponding to each object in the abnormal object set; and determine the sampling object set from the abnormal object set based on the sampling quantity and the proportion distribution information.

[0135] In one embodiment, the inspection result is used to indicate whether each object in the sampling set is abnormal; when the processor 701 determines the evaluation parameters based on the inspection result of the sampling set, it is specifically used to: determine the proportion of objects in the sampling set whose inspection result is abnormal based on the inspection result of the sampling set; determine the proportion of resources occupied by objects in the sampling set whose inspection result is abnormal in the target feature dimension based on the feature data corresponding to each object in the sampling set; and determine the proportion of the number of objects and the proportion of resources as evaluation parameters.

[0136] In one embodiment, when the processor 701 determines the evaluation result of the target application based on the evaluation parameters, the set of abnormal objects, and the feature data corresponding to each object in the dataset to be processed, it specifically performs the following steps: determining the total number of objects in the set of abnormal objects, and determining the number of abnormal objects in the set of abnormal objects based on the ratio of the number of objects and the total number of objects; determining the total resource amount of the objects in the set of abnormal objects in the target feature dimension based on the feature data corresponding to each object in the dataset to be processed, and determining the target resource amount of the abnormal objects in the set of abnormal objects in the target feature dimension based on the ratio of the resource amount and the total resource amount; and determining the evaluation result of the target application based on the number of abnormal objects and the target resource amount.

[0137] In one embodiment, when the processor 701 determines an abnormal object set from the dataset to be processed based on the feature data corresponding to each object in the dataset to be processed, it is specifically used to: process the multiple sets of object data using a target abnormal object screening model, so that the target abnormal object screening model determines abnormal objects from the dataset to be processed based on the feature data corresponding to each object in the dataset to be processed; and generate an abnormal object set based on each abnormal object determined by the target abnormal object screening model.

[0138] In one embodiment, the processor 701 is further configured to: acquire a training sample set including a normal sample subset and an abnormal sample subset; each set of object data in the normal sample subset includes a normal identifier of a normal object and feature data corresponding to the normal object, and each set of object data in the abnormal sample subset includes an abnormal identifier of an abnormal object and feature data corresponding to the abnormal object; train an initial abnormal object screening model using the training sample set, and generate the target abnormal object screening model based on the trained abnormal object screening model.

[0139] In one embodiment, the anomaly object screening model is a decision tree model, and a path traversed by the leaf nodes of the trained anomaly object screening model indicates an anomaly object screening rule. When the processor 701 generates the target anomaly object screening model based on the trained anomaly object screening model, it is specifically used to: obtain the screening effect evaluation parameters of each anomaly object screening rule indicated by the trained anomaly object screening model, and determine from the various anomaly object screening rules that the screening effect evaluation parameters are less than or equal to the screening effect threshold and need to be adjusted; adjust the trained anomaly object screening model based on the anomaly object screening rule to be adjusted to obtain the target anomaly object screening model.

[0140] In specific implementations, the processor 701, communication interface 702, and memory 703 described in the embodiments of this application can execute the implementation of the data processing device described in the data processing method provided in the embodiments of this application, or they can execute the implementation of the data processing apparatus described in the embodiments of this application, which will not be repeated here.

[0141] In this embodiment, an abnormal object set is first determined from the dataset to be processed based on the feature data corresponding to each object in the dataset related to the target application. Then, a sampled object set is determined from the abnormal object set, and evaluation parameters are determined based on the test results of the sampled object set. Finally, the evaluation result of the target application is determined based on the evaluation parameters, the abnormal object set, and the feature data corresponding to each object in the dataset to be processed. By adopting the above method, on the one hand, the application evaluation can be automated and intelligent, thereby effectively improving the efficiency of application evaluation; on the other hand, by sampling and testing the selected abnormal object set and combining it with the evaluation parameters determined based on the sampling and testing results to determine the final evaluation result of the application, the accuracy of the evaluation result can be effectively improved.

[0142] This application also provides a computer-readable storage medium storing a computer program that, when run on a computer, causes the computer to perform the data processing method described in this application. The specific implementation can be found in the foregoing description and will not be repeated here.

[0143] This application also provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the data processing method as described in this application. Specific implementation details are provided above and will not be repeated here.

[0144] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0145] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0146] The above-disclosed embodiments are only some of the embodiments of this application, and should not be construed as limiting the scope of this application. Therefore, any equivalent changes made in accordance with the claims of this application shall still fall within the scope of this application.

Claims

1. A data processing method, characterized in that, The method includes: Obtain a dataset to be processed, which includes multiple sets of object data related to the target application. Each set of object data includes an object and the corresponding feature data of the object. The object is an account used to uniquely identify a user, and the feature data includes one or more of the following: text features, attribute features, transaction features, and complaint records. The multiple sets of object data are processed using a target anomaly object screening model, so that the target anomaly object screening model determines anomaly objects from the dataset to be processed based on the feature data corresponding to each object in the dataset to be processed; and an anomaly object set is generated based on the anomaly objects determined by the target anomaly object screening model. Determine a sampling set from the set of abnormal objects; Based on the test results of the sampled object set, the proportion of objects in the sampled object set whose test results are abnormal is determined; the test results are used to indicate whether each object in the sampled object set is abnormal. Based on the feature data corresponding to each object in the sampling object set, determine the proportion of resources occupied by objects in the sampling object set whose test results are abnormal in the target feature dimension; The quantity ratio and the resource quantity ratio are determined as evaluation parameters; Based on the evaluation parameters, the set of abnormal objects, and the feature data corresponding to each object in the dataset to be processed, the evaluation result of the target application is determined, wherein the evaluation result is a risk quantification indicator; The target anomaly object screening model is obtained by adjusting the trained anomaly object screening model based on the anomaly object screening rules to be adjusted. The trained anomaly object screening model is obtained by training the initial anomaly object screening model using a training sample set, which includes a normal sample subset and an anomaly sample subset. Each set of object data in the normal sample subset includes the normal identifier of the normal object and the corresponding feature data of the normal object. Each set of object data in the anomaly sample subset includes the anomaly identifier of the anomaly object and the corresponding feature data of the anomaly object. The anomaly object screening model is a decision tree model. A path traversed by the leaf node of the trained anomaly object screening model indicates an anomaly object screening rule. The anomaly object screening rule to be adjusted is the anomaly object screening rule among the various anomaly object screening rules indicated by the trained anomaly object screening model, where the screening effect evaluation parameter is less than or equal to the screening effect threshold.

2. The method as described in claim 1, characterized in that, Determining the sampling object set from the set of abnormal objects includes: Obtain the reference abnormal object ratio and reference error parameter, and determine the sampling quantity based on the reference abnormal object ratio and the reference error parameter; Based on the feature data corresponding to each object in the abnormal object set, determine the proportional distribution information of the objects in the abnormal object set in the target feature dimension; Based on the sampling quantity and the proportional distribution information, a sampling object set is determined from the abnormal object set.

3. The method as described in claim 1 or 2, characterized in that, The step of determining the evaluation result of the target application based on the evaluation parameters, the set of abnormal objects, and the feature data corresponding to each object in the dataset to be processed includes: Determine the total number of objects in the abnormal object set, and determine the number of abnormal objects in the abnormal object set based on the ratio of the number and the total number; Based on the feature data corresponding to each object in the dataset to be processed, the total resource amount of the objects in the abnormal object set on the target feature dimension is determined, and the target resource amount of the abnormal objects in the abnormal object set on the target feature dimension is determined based on the resource amount ratio and the total resource amount. The evaluation result of the target application is determined based on the number of abnormal objects and the target resource quantity.

4. A data processing apparatus, characterized in that, The device includes: The acquisition unit is used to acquire a dataset to be processed, which includes multiple sets of object data related to the target application. Each set of object data includes an object and the corresponding feature data of the object. The object is an account used to uniquely identify a user, and the feature data includes one or more of the following: text features, attribute features, transaction features, and complaint records. The processing unit is used to process the multiple sets of object data using a target anomaly object screening model, so that the target anomaly object screening model can determine anomaly objects from the dataset to be processed based on the feature data corresponding to each object in the dataset to be processed; The processing unit is also used to generate an abnormal object set based on each abnormal object determined by the target abnormal object screening model; The processing unit is further configured to determine a sampling object set from the abnormal object set, determine the proportion of objects in the sampling object set whose test results are abnormal based on the test results of the sampling object set, wherein the test results are used to indicate whether each object in the sampling object set is abnormal, determine the proportion of resources occupied by objects in the sampling object set whose test results are abnormal in the target feature dimension based on the feature data corresponding to each object in the sampling object set, and determine the proportion of the number of objects and the proportion of resources as evaluation parameters; The processing unit is further configured to determine the evaluation result of the target application based on the evaluation parameters, the abnormal object set, and the feature data corresponding to each object in the dataset to be processed, wherein the evaluation result is a risk quantification indicator; The target anomaly object screening model is obtained by adjusting the trained anomaly object screening model based on the anomaly object screening rules to be adjusted. The trained anomaly object screening model is obtained by training the initial anomaly object screening model using a training sample set, which includes a normal sample subset and an anomaly sample subset. Each set of object data in the normal sample subset includes the normal identifier of the normal object and the corresponding feature data of the normal object. Each set of object data in the anomaly sample subset includes the anomaly identifier of the anomaly object and the corresponding feature data of the anomaly object. The anomaly object screening model is a decision tree model. A path traversed by the leaf node of the trained anomaly object screening model indicates an anomaly object screening rule. The anomaly object screening rule to be adjusted is the anomaly object screening rule among the various anomaly object screening rules indicated by the trained anomaly object screening model, where the screening effect evaluation parameter is less than or equal to the screening effect threshold.

5. A computer device, characterized in that, include: The processor, the communication interface, and the memory are interconnected, wherein the memory stores executable program code, and the processor is used to call the executable program code to execute the data processing method as described in any one of claims 1-3.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when run on a computer, causes the computer to perform the data processing method as described in any one of claims 1-3.

7. A computer program product, characterized in that, The computer program product includes computer instructions stored in a computer-readable storage medium, a processor of a computer device reading the computer instructions from the computer-readable storage medium, and the processor executing the computer instructions to cause the computer device to perform the data processing method as described in any one of claims 1-3.

Images