Information matching method and related device

Abstract

The application relates to the computer technical field and provides an information matching method and related device to improve matching efficiency between a to-be-recognized behavior sequence and a behavior sequence template. The method comprises the following steps: after obtaining a to-be-detected behavior sequence of a target object, performing matching on the to-be-detected behavior sequence and a plurality of candidate behavior sequence templates based on a prefix tree formed by the plurality of candidate behavior sequence templates to obtain a matching result, and then determining that the target object has an abnormal behavior when it is determined that there is at least one candidate behavior sequence template that matches the to-be-detected behavior sequence successfully based on the matching result. In this way, the prefix formed by the plurality of candidate behavior sequence templates is matched, the number of repeated matching can be reduced, and the matching efficiency is improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and provides an information matching method and related apparatus. Background Technology

[0002] With the continuous development of computer technology, in order to detect abnormal behavior, multiple operation events triggered by the target object are taken as the target object's behavior sequence to be identified. By matching the behavior sequence to be identified with each behavior sequence template, it can be determined whether the target object has abnormal behavior.

[0003] In related technologies, when matching the target object's operation sequence to be identified with each behavior sequence template, the operation sequence to be identified is usually matched with each behavior sequence template separately to determine whether the operation sequence to be identified contains a behavior sequence template.

[0004] However, as the number of behavior sequence templates increases, matching each behavior sequence to be identified with each behavior sequence template one by one will result in low matching efficiency, which in turn affects the detection efficiency of abnormal behavior. Summary of the Invention

[0005] This application provides an information matching method and related apparatus to improve the matching efficiency between a behavior sequence to be identified and a behavior sequence template.

[0006] In a first aspect, embodiments of this application provide an information matching method, including:

[0007] Obtain the sequence of behaviors to be detected for the target object, wherein the sequence of behaviors to be detected includes each operation event to be detected triggered by the target object, and the triggering order between each operation event to be detected;

[0008] Based on the prefix tree, the behavior sequence to be detected is matched with multiple candidate behavior sequence templates to obtain the matching result; wherein, the prefix tree contains multiple event nodes and multiple node paths, each event node is used to represent a candidate operation event contained in the multiple candidate behavior sequence templates, and each node path is used to represent a candidate behavior sequence template;

[0009] Based on the matching results, when it is determined that there is at least one candidate behavior sequence template that successfully matches the behavior sequence to be detected, it is determined that the target object has abnormal behavior.

[0010] Secondly, embodiments of this application provide an information matching device, comprising:

[0011] The acquisition unit is used to acquire a sequence of behaviors to be detected of a target object. The sequence of behaviors to be detected includes each operation event to be detected triggered by the target object, and the triggering order between the operation events to be detected.

[0012] A matching unit is used to match the behavior sequence to be detected with multiple candidate behavior sequence templates based on a prefix tree to obtain a matching result; wherein, the prefix tree contains multiple event nodes and multiple node paths, each event node is used to represent a candidate operation event contained in the multiple candidate behavior sequence templates, and each node path is used to represent a candidate behavior sequence template;

[0013] The identification unit is used to determine that the target object has abnormal behavior when, based on the matching result, there is at least one candidate behavior sequence template that successfully matches the behavior sequence to be detected.

[0014] As one possible implementation, each candidate behavior sequence template represents an anomalous behavior, and the identification unit is further used for:

[0015] Based on the matching results, at least one candidate behavior sequence template that successfully matches the behavior sequence to be detected is determined, and the at least one candidate behavior sequence template is used as at least one target behavior sequence template;

[0016] Based on the abnormal behavior represented by each of the at least one target behavior sequence templates, the behavior sequence to be detected is labeled with sample tags.

[0017] The labeled sequence of behaviors to be detected is used as training data for the model to train the initial anomaly detection model, thus obtaining the target anomaly detection model.

[0018] As one possible implementation, based on the matching result, after determining that the target object exhibits abnormal behavior, when it is determined that at least one candidate behavior sequence template successfully matches the behavior sequence to be detected, the identification unit is further configured to:

[0019] Obtain the cumulative number of successful matches corresponding to each of the at least one candidate behavior sequence template;

[0020] Based on the acquired cumulative number of successful matches, sub-evaluation values ​​corresponding to each of the at least one candidate behavior sequence template are obtained, and based on the acquired sub-evaluation values, the abnormal evaluation value corresponding to the target object is obtained.

[0021] Based on the preset mapping relationship between the cumulative number of successful matches and the anomaly evaluation value, and the obtained number of successful matches, the anomaly evaluation value corresponding to the target object is determined.

[0022] Based on the anomaly assessment value, an anomaly alarm is issued for the target object.

[0023] Thirdly, embodiments of this application provide an electronic device, including a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the above-described information matching method.

[0024] Fourthly, embodiments of this application provide a computer-readable storage medium including a computer program, which, when run on an electronic device, causes the electronic device to perform the steps of the information matching method described above.

[0025] Fifthly, embodiments of this application provide a computer program product, the program product including a computer program stored in a computer-readable storage medium, wherein a processor of an electronic device reads from the computer-readable storage medium and executes the computer program, causing the electronic device to perform the aforementioned information matching steps.

[0026] In this embodiment of the application, after obtaining the target object's behavior sequence to be detected, the target object is matched with the multiple candidate behavior sequence templates based on a prefix tree composed of multiple candidate behavior sequence templates to obtain a matching result. Then, based on the matching result, when it is determined that there is at least one candidate behavior sequence template that successfully matches the target object's behavior sequence, it is determined that the target object has abnormal behavior.

[0027] In this way, by using a prefix tree composed of multiple candidate behavior sequence templates, the behavior sequence to be detected is matched with multiple candidate behavior sequence templates. This fully utilizes the similarity between multiple candidate behavior sequence templates. When a large number of candidate behavior sequence templates form a prefix tree, the probability of overlap between candidate behavior sequence templates will be greater. By utilizing the common prefix of candidate behavior sequence templates, the number of repeated matches can be reduced, thereby reducing the query time overhead and improving matching efficiency.

[0028] Other features and advantages of this application will be set forth in the following description and will be apparent in part from the description or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings. Attached Figure Description

[0029] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments of this application and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0030] Figure 1This is a schematic diagram of an application scenario provided in the embodiments of this application;

[0031] Figure 2 This is a flowchart illustrating an information matching method provided in an embodiment of this application;

[0032] Figure 3 This is a logical diagram illustrating information matching provided in an embodiment of this application;

[0033] Figure 4 This is a schematic diagram of a prefix tree provided in an embodiment of this application;

[0034] Figure 5a This is a schematic diagram of a prefix tree-based matching logic provided in an embodiment of this application;

[0035] Figure 5b This is a schematic diagram of another prefix tree-based matching logic provided in the embodiments of this application;

[0036] Figure 6 This is a schematic diagram of a mismatch pointer provided in an embodiment of this application;

[0037] Figure 7 This is a schematic diagram of another prefix tree-based matching logic provided in the embodiments of this application;

[0038] Figure 8 This is a schematic diagram of the structure of an information matching device provided in an embodiment of this application;

[0039] Figure 9 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this application. Obviously, the described embodiments are only some embodiments of the technical solutions of this application, and not all embodiments. Based on the embodiments recorded in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the technical solutions of this application.

[0041] With the continuous development of computer technology, in order to detect abnormal payment behavior, multiple operation events triggered by the target object are taken as the target object's behavior sequence to be identified. By matching the behavior sequence to be identified with each behavior sequence template, it can be determined whether the target object has abnormal payment behavior.

[0042] In related technologies, when matching the target object's operation sequence to be identified with each behavior sequence template, the operation sequence to be identified is usually matched with each behavior sequence template separately to determine whether the operation sequence to be identified contains a behavior sequence template.

[0043] However, as the number of behavior sequence templates increases, matching each behavior sequence to be identified with each behavior sequence template one by one will result in low matching efficiency, which in turn affects the detection efficiency of abnormal payment behavior.

[0044] To improve matching efficiency, in this embodiment of the application, after obtaining the target object's behavior sequence to be detected, the target object is matched with the multiple candidate behavior sequence templates based on a prefix tree composed of multiple candidate behavior sequence templates to obtain a matching result. Then, based on the matching result, when it is determined that there is at least one candidate behavior sequence template that successfully matches the target object's behavior sequence, it is determined that the target object has abnormal behavior.

[0045] In this way, by using a prefix tree composed of multiple candidate behavior sequence templates, the behavior sequence to be detected is matched with multiple candidate behavior sequence templates. This fully utilizes the similarity between multiple candidate behavior sequence templates. When a large number of candidate behavior sequence templates form a prefix tree, the probability of overlap between candidate behavior sequence templates will be greater. By utilizing the common prefix of candidate behavior sequence templates, the number of repeated matches can be reduced, thereby reducing the query time overhead and improving matching efficiency.

[0046] The preferred embodiments of this application are described below with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit this application. Furthermore, the embodiments and features in the embodiments of this application can be combined with each other without conflict.

[0047] See Figure 1 The diagram shown illustrates an application scenario of an embodiment of this application. This application scenario includes at least one terminal device 110 and a server 120, which can communicate with each other via a network.

[0048] In one alternative implementation, the communication network is either a wired network or a wireless network. The terminal device 110 and the server 120 can be directly or indirectly connected via wired or wireless communication, and this application does not impose any limitations on this.

[0049] In this embodiment, the terminal device 110 is an electronic device used by a user, which may be a personal computer, mobile phone, tablet computer, laptop computer, or other computer device with a certain computing capability. Each terminal device 110 is connected to the server 120 through a communication network. The server 120 may be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery network (CDN), and big data and artificial intelligence platforms.

[0050] In this embodiment of the application, the user can obtain the relevant operation interface through the terminal device 110. The terminal device 110 obtains each operation event triggered by the user on the operation interface as each operation event to be detected, and obtains the target object's behavior sequence according to the triggering order of each operation event to be detected. Then, abnormal behavior detection of the target object can be performed based on the target object's behavior sequence to be detected.

[0051] Terminal device 110 has a client installed. The client can be an application, such as a game application, or it can be a mini-program, webpage, etc., without specific limitations. Server 120 is the server corresponding to the application or webpage, mini-program, or other client type.

[0052] The application scenario can be a payment scenario. If the application scenario is a payment scenario, the client can be an instant messaging application or a shopping application that provides payment services. Abnormal behavior can refer to abnormal payment behavior, which includes, but is not limited to, non-personalized payments and fraudulent transactions.

[0053] The information matching method provided in this application embodiment can be applied to terminal device 110 or server 120.

[0054] If the information matching method is applied to terminal device 110, terminal device 110 obtains the target object's behavior sequence to be detected. Then, based on the prefix tree, it matches the behavior sequence to be detected with multiple candidate behavior sequence templates to obtain matching results. The prefix tree contains multiple event nodes and multiple node paths. Each event node is used to represent a candidate operation event contained in multiple candidate behavior sequence templates, and each node path is used to represent a candidate behavior sequence template. Based on the matching results, when it is determined that there is at least one candidate behavior sequence template that successfully matches the behavior sequence to be detected, it is determined that the target object has abnormal behavior.

[0055] If the information matching method is applied to server 120, server 120 can obtain the target object's behavior sequence to be detected through terminal device 110. Then, based on the prefix tree, the target behavior sequence to be detected is matched with multiple candidate behavior sequence templates to obtain the matching result. The prefix tree contains multiple event nodes and multiple node paths. Each event node is used to represent a candidate operation event contained in multiple candidate behavior sequence templates, and each node path is used to represent a candidate behavior sequence template. Based on the matching result, when it is determined that there is at least one candidate behavior sequence template that successfully matches the target behavior sequence, it is determined that the target object has abnormal behavior.

[0056] See Figure 2 As shown, this is an information matching method provided in this application embodiment. This method can be applied to terminal devices or servers, and the specific process is as follows:

[0057] S201. Obtain the sequence of behaviors to be detected for the target object. The sequence of behaviors to be detected includes each operation event to be detected triggered by the target object, and the triggering order between each operation event to be detected.

[0058] In this embodiment of the application, the operation event to be detected may be an operation event such as account login, network message sending, service query, service purchase, or product purchase.

[0059] Since normal users also trigger various operation events, it is impossible to identify abnormal behavior based on a single operation event. Therefore, in this embodiment of the application, the various operation events to be detected executed by the user in sequence are combined to obtain a sequence of behaviors to be detected, and then abnormal behavior is identified by analyzing the sequence of behaviors to be detected.

[0060] For example, if an account logs in from an area the user doesn't usually use and immediately makes a large purchase for someone else, then the sequence of behaviors to be detected includes the user's login from a different location and the purchase on behalf of someone else, as well as the triggering order between the login from a different location and the purchase on behalf of someone else.

[0061] In some embodiments, the operation events to be detected triggered by the target object can be serialized first, and then the detection can be performed based on the sequence of behaviors to be detected. Specifically, the sequence of behaviors to be detected can be generated in the following ways, but not limited to: obtaining the original operation log of the target object, which includes multiple operation events; sorting the multiple operation events in chronological order to generate the sequence of behaviors to be detected.

[0062] By sorting multiple operation events in chronological order, the generated sequence of behaviors to be detected has a contextual sequence relationship, so that behavior recognition can be performed based on the contextual sequence in subsequent recognition.

[0063] It is understood that in the specific implementation of this application, data related to the sequence of behaviors to be detected is involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0064] S202. Based on the prefix tree, the behavior sequence to be detected is matched with multiple candidate behavior sequence templates to obtain the matching result. The prefix tree contains multiple event nodes and multiple node paths. Each event node is used to represent a candidate operation event contained in multiple candidate behavior sequence templates, and each node path is used to represent a candidate behavior sequence template.

[0065] In this application, each candidate behavior sequence template contains various candidate operation events and the triggering order among these events. In this embodiment, the candidate behavior sequence template can also be referred to as a candidate pattern string.

[0066] Candidate pattern strings can be common and key behavioral subsequences that are mined after statistical analysis of multiple behavioral sequence data.

[0067] See Figure 3 As shown in this embodiment, a prefix tree is constructed based on multiple candidate behavior sequence templates. Based on the prefix tree, the behavior sequence to be detected is matched with multiple candidate pattern strings. The prefix tree is described below.

[0068] A trie (also known as a prefix tree or dictionary tree) is a special type of prefix tree structure. It's a variant of a hash tree, specifically designed for string processing. The core idea of ​​a trie is to trade space for time, utilizing the common prefixes of strings to minimize unnecessary string comparisons and reduce query time overhead, thereby improving efficiency.

[0069] See Figure 4 As shown, this is a schematic diagram of a prefix tree structure provided in an embodiment of this application. The root node of the prefix tree does not store any characters; it can also be understood that the string stored in the root node is empty. Each non-root node of the prefix tree stores a candidate operation event; in this document, non-root nodes can also be referred to as event nodes.

[0070] The prefix tree contains multiple node paths. The starting node of each node path is the root node, and the ending node is the leaf node. A leaf node is a non-root node with no children. Each node path is used to represent a candidate behavior sequence template. The operation events stored in each event node in each node path constitute a behavior sequence to be detected.

[0071] To match candidate operation events with operation events to be detected, both the operation events to be detected and the candidate operation events can be encoded according to their event types to obtain corresponding event codes, which are then used to represent the operation events. Since there are many event types for operation events, it is not feasible to encode each operation event with a single character. Therefore, in this embodiment, each operation event can be represented as a string.

[0072] For example, "aa" represents operation event aa, which is entering a third-party interface through link A; "ab" represents operation event ab, which is entering the payment interface through link B in the third-party interface; "ac" represents operation event ac, which is a payment operation; "ad" represents operation event ad, which is a payment failure after entering the payment password multiple times; and "cd" represents operation event cd, which is a WeChat official account follow operation.

[0073] Figure 4 The prefix tree shown contains a root node and various event nodes. Node 1-aa stores candidate operation events aa, node 2-ac stores candidate operation events ac, node 3-ab stores candidate operation events ab, node 4-cd stores candidate operation events cd, node 5-aa stores candidate operation events aa, node 6-ac stores candidate operation events ac, node 7-ad stores candidate operation events ad, node 8-ab stores candidate operation events ab, and node 9-ac stores candidate operation events ac. The leaf nodes include: node 4-cd, node 6-... The prefix tree contains four node paths: ac, 7-ad, and 9-ac. Node path 1 is: 1-aa → 3-ab → 6-ac; 2 is: 1-aa → 3-ab → 7-ad; 3 is: 1-aa → 4-cd; and 4 is: 2-ac → 5-aa → 8-ab → 9-ac. Node path 1 represents candidate behavior sequence template 1, 2 represents candidate behavior sequence template 2, 3 represents candidate behavior sequence template 3, and 4 represents candidate behavior sequence template 4.

[0074] Specifically, based on the prefix tree, when matching the behavior sequence to be detected with multiple candidate behavior sequence templates to obtain the matching results, the following methods can be used, but are not limited to:

[0075] Based on the triggering order of each operation event to be detected, each operation event to be detected is matched with each event node in turn until all operation events to be detected are matched. In each matching process, if the current operation event to be detected is successfully matched with event node x, then in the next matching process, the next operation event to be detected is matched with the child event node of event node x.

[0076] For example, see Figure 5a As shown, assuming the sequence of actions to be detected is: aa-ab-ac, firstly, for the operation event to be detected, aa is matched with the first-level non-root nodes of the prefix tree. The operation event aa is successfully matched with node 1-aa. The child nodes of node 1-aa are node 3-ab and node 4-cd. Then, for the operation event ab to be detected, ab is matched with node 3-ab and node 4-cd. The operation event ab is successfully matched with node 3-ab. The child nodes of node 3-ab are node 6-ac and node 7-ad. After that, for the operation event ac to be detected, ac is matched with node 6-ac and node 7-ad. The operation event ac is successfully matched with node 6-ac. That is, the sequence of actions to be detected, aa-ab-ac, is successfully matched with candidate pattern string 1.

[0077] Based on the above implementation method, when performing matching based on the prefix tree, the matching efficiency can be further improved by making full use of the common prefixes between each candidate pattern string to reduce repeated matching.

[0078] In some embodiments, if the current operation event to be detected matches the event node x, then when the event node x has no child event nodes, that is, the event node x is a leaf node, the candidate operation sequence template x corresponding to the node path where the event node x is located is determined, and it matches the behavior sequence to be detected.

[0079] For example, see Figure 5b As shown, assuming the sequence of actions to be detected is aa-cd, firstly, for the operation event aa to be detected, the operation event aa to be detected is matched with the first-level non-root nodes of the prefix tree. The operation event aa to be detected is successfully matched with node 1-aa. The child nodes of node 1-aa are node 3-ab and node 4-cd. Then, for the operation event cd to be detected, the operation event cd to be detected is matched with node 3-ab and node 4-cd. The operation event cd to be detected is successfully matched with node 4-cd, and node 4-cd is a leaf node. Therefore, the sequence of actions to be detected is determined to be aa-cd, which successfully matches the candidate pattern string 3.

[0080] In this way, when a leaf node is matched, it can be determined that the sequence of behavior to be detected has successfully matched the candidate pattern string corresponding to the leaf node, thus improving matching efficiency.

[0081] To improve matching efficiency, in this embodiment of the application, the AC automaton constructed based on the prefix tree mentioned above can be used to match the behavior sequence to be detected with multiple candidate behavior sequence templates.

[0082] The Aho-Corasick automaton is a multi-pattern matching algorithm. Its core algorithm is still to find the internal patterns of the pattern strings and perform efficient jumps for each mismatch. The Aho-Corasick automaton uses a prefix tree to store the prefixes of all pattern strings and uses mismatch pointers to handle the jumps for mismatches.

[0083] The construction of the AC automaton requires setting mismatch pointers for one or more event nodes in the prefix tree. The mismatch pointer is used to jump to the event node indicated by the mismatch pointer and continue matching when an event node in the prefix fails to match the operation event to be detected.

[0084] For example, the principle for setting mismatch pointers is as follows: For event nodes directly connected to the root node, the mismatch pointer of the aforementioned event node points directly to the root node; for event nodes not connected to the root node, according to the principle of breadth-first search, the event node for which the current mismatch pointer is set can be selected as the target node from all event nodes that have not set mismatch pointers. The node pointed to by the mismatch pointer of the target node's parent node is taken as an auxiliary node. If the candidate operation events contained in all child nodes of the auxiliary node include the candidate operation events contained in the target node, then the mismatch pointer of the target node is pointed to the child node of the auxiliary node that contains the same candidate operation events as the target node. If the candidate operation events contained in all child nodes of the auxiliary node do not include the candidate operation events contained in the target node, then the node pointed to by the mismatch pointer of the aforementioned auxiliary node is taken as an auxiliary node, and the judgment is performed again. If no auxiliary node is found, then the mismatch pointer of the target node is pointed to the root node. Using the above method, mismatch pointers can be set for all nodes of the prefix tree.

[0085] For example, see Figure 6 As shown, Figure 6In the prefix tree shown, the connection relationship between each event node is represented by solid lines, and dashed lines indicate the node pointed to by the mismatch pointer of the corresponding node. The prefix tree contains candidate pattern string 1, candidate pattern string 2, candidate pattern string 3, and candidate pattern string 4. Candidate pattern string 1 is operation event aa→ operation event ab→ operation event ac, candidate pattern string 2 is operation event aa→ operation event ab→ operation event ad, candidate pattern string 3 is operation event aa→ operation event cd, and candidate pattern string 4 is operation event ac→ operation event aa→ operation event ab→ operation event ac. Among them, candidate pattern string 1 and candidate pattern string 2 share the prefix: operation event aa→ operation event ab, and candidate pattern string 1, candidate pattern string 2, and candidate pattern string 4 share the prefix: operation event aa.

[0086] Using a breadth-first search principle, for the first-level nodes, mismatch pointers are set sequentially for node 1-aa and node 2-ac. Since nodes 1-aa and 2-ac are directly connected to the root node, their mismatch pointers both point to the root node. Following the breadth-first search principle, mismatch pointers are then set for the second-level nodes: node 3-ab, node 4-cd, and node 5-aa. For node 3-ab, taking it as the target node, since the mismatch pointer of the target node's parent node (i.e., node 1-aa) points to the root node, and the operation events contained in the child nodes of the root node do not include those contained in node 3-ab, the mismatch pointer of node 3-ab is set to the root node. Similarly, the mismatch pointer of node 4-cd points to the root node. For node 5-aa, taking it as the target node, since the mismatch pointer of the target node's parent node (i.e., node 2-ac) points to the root node, and the child nodes of the root node include node 1-aa, the mismatch pointer of the target node is set to the child node of the root node: node 1-aa. That is, the mismatch pointer of node 5-aa points to node 1-aa. Following this method, mismatch pointers can be set for all remaining nodes. It should be noted that the mismatch pointers of nodes 1-aa, 2-ac, 4-cd, 6-ac, and 7-ad all point to the root node. Figure 6 The mismatch pointers for nodes 1-aa, 2-ac, 4-cd, 6-ac, and 7-ad are not shown.

[0087] After setting mismatch pointers for nodes in the prefix tree, when matching the behavior sequence to be detected with multiple candidate behavior sequence templates based on the prefix tree, the following methods can be used, but are not limited to:

[0088] The first event to be detected in the sequence of actions to be detected is taken as the target event. If the target event matches the current event node, it means there is a path from the current event node along the prefix tree to the target event. In this case, simply continue matching from the next event node along that path, and take the event to be detected in the sequence that matches the target event as the new target event. If the target event does not match the current event node, continue matching at the event node pointed to by the mismatch pointer of the current event node. The matching process ends when the pointer points to the root node, until all events to be detected in the sequence of actions to be detected have been matched, at which point the matching ends.

[0089] In other words, if the current operation event to be detected fails to match event node x, the event node pointed to by the mismatch pointer is determined based on the mismatch pointer of the preceding event node of event node x, and the current operation event to be detected is matched with the child event nodes of the event node pointed to by the mismatch pointer. Here, the preceding event node can also be called the parent event node.

[0090] During the matching process based on the event node pointed to by the mismatch pointer, if the event node pointed to by the mismatch pointer is the root node, then if there is no child event node among the child event nodes of the root node that successfully matches the current operation event to be detected, then it is determined that the current operation event to be detected has failed to match multiple candidate behavior sequence templates.

[0091] For example, see Figure 7 As shown, assuming the sequence of actions to be detected is: ac-aa-cd-ac-aa-ab-ac, starting from the first action event to be detected in the sequence, the sequence is matched with each candidate pattern string. The first action event to be detected is: action event ac. Action event ac matches successfully with node 2-ac in the prefix tree. Next, for the second action event to be detected: action event aa, action event aa is matched with the child nodes of node 2-ac. Action event aa matches with node 3-aa. After a successful match, for the third operation event to be detected, cd, since the child node of node 3-aa (i.e., node 8-ab) fails to match cd, the process switches to the node pointed to by the mismatch pointer of the previous operation event aa in the prefix tree: node 1-aa, for matching. The second and third operation events to be detected successfully match node 1-aa and node 4-cd respectively, and node 4-cd is a leaf node. Therefore, it is determined that the sequence of behaviors to be detected successfully matches the candidate pattern string 3: aa-cd.

[0092] Then, we can restart the matching of the remaining detection operation events in the detection behavior sequence from the root node. Among them, the 4th detection operation event: detection operation event ac matches node 2-ac successfully; the 5th detection operation event: detection operation event aa matches node 5-aa successfully; the 6th detection operation event: detection operation event ab matches node 8-ab successfully; and the 7th detection operation event: detection operation event ac matches node 9-ac successfully. Since node 9-ac is a leaf node, it is determined that the detection behavior sequence matches the candidate pattern string 4: ac-aa-ab-ac successfully.

[0093] Based on the above implementation method, in the event of a matching failure, the system can quickly jump to the node pointed to by the mismatch pointer for matching, thereby achieving efficient jump for each mismatch and improving the matching efficiency between the behavior sequence to be detected and the candidate pattern string.

[0094] Furthermore, by determining that the current operation event to be detected fails to match multiple candidate behavior sequence templates when there is no child event node in the child event nodes of the root node that successfully matches the current operation event to be detected, the matching of the current operation event to be detected is skipped when the mismatch pointer points to the root node, and the matching of the next operation event to be detected is performed, thereby reducing unnecessary matching processes and further improving matching efficiency.

[0095] S203. Based on the matching results, when it is determined that there is at least one candidate behavior sequence template that successfully matches the behavior sequence to be detected, it is determined that the target object has abnormal behavior.

[0096] For example, suppose the sequence of behavior to be detected is: ac-aa-cd-ac-aa-ab-ac. The matching results indicate that the candidate pattern strings that successfully match the sequence of behavior to be detected include: candidate pattern string 3 and candidate pattern string 4. Then it is determined that the target object has abnormal behavior.

[0097] In some embodiments, each candidate pattern string represents an abnormal behavior. If, based on the matching result, it is determined that there is at least one candidate pattern string that successfully matches the behavior sequence to be detected, then the at least one candidate pattern string that successfully matches the behavior sequence to be detected can be used as at least one target pattern string. Based on the abnormal behavior represented by each of the at least one target pattern string, the behavior sequence to be detected is labeled with sample labels. The labeled behavior sequence to be detected is used as model training data to train the abnormal behavior detection model.

[0098] Abnormal behavior detection models can employ either unsupervised or supervised learning models. Unsupervised learning models include, but are not limited to, clustering learning models and autoencoders. Supervised learning models include, but are not limited to, machine learning models employing nearest neighbor algorithms, decision tree algorithms, and Naive Bayes algorithms.

[0099] For example, suppose the sequence of behavior to be detected is: aa-aa-ab-ac. The matching results represent the candidate pattern strings that successfully match the sequence of behavior to be detected, including: candidate pattern string 1, where the abnormal behavior corresponding to candidate pattern string 3 represents suspected payment behavior by others. Then, the sequence of behavior to be detected, ac-aa-cd-ac-aa-ab-ac, is labeled "suspected payment by others".

[0100] In this way, by implementing the above method, when faced with massive amounts of behavior data to be detected, sample annotation can be performed quickly, improving the efficiency of sample annotation while ensuring the accuracy of sample annotation. This avoids to some extent the problem of poor model performance caused by inaccurate sample data annotation.

[0101] In some embodiments, during the matching process between the behavior sequence to be detected and multiple candidate behavior sequence templates, the cumulative number of successful matches for each candidate pattern string can be recorded. This allows for the generation of alerts for the target object based on the cumulative number of successful matches for each candidate pattern string. Specifically, the following methods can be used:

[0102] Obtain the cumulative number of successful matches for each of at least one candidate pattern string; based on the obtained cumulative number of successful matches, obtain the sub-evaluation value for each of the at least one candidate pattern string, and based on the obtained sub-evaluation values, obtain the abnormal evaluation value for the target object; and based on the abnormal evaluation value, issue an abnormal alarm for the target object.

[0103] It should be noted that, in the embodiments of this application, a mapping relationship between the cumulative number of successful matches and the sub-evaluation value can be set in advance for each candidate pattern string, so that the sub-evaluation value corresponding to at least one candidate pattern string can be obtained based on the obtained cumulative number of successful matches.

[0104] Table 1 shows the mapping relationship between the number of successful matches of candidate pattern string 1 and the sub-evaluation value.

[0105] Number of successful matches Sub-evaluation value 1～5 5 6～10 10 …… ……

[0106] For example, as shown in Table 1, when the cumulative number of successful matches for candidate pattern string 1 is between 1 and 5, the sub-evaluation value corresponding to candidate pattern string 1 is 5; when the cumulative number of successful matches for candidate pattern string 1 is between 6 and 5, the sub-evaluation value corresponding to candidate pattern string 1 is 10.

[0107] In the process of obtaining the abnormal evaluation value corresponding to the target object based on the obtained sub-evaluation values, the sub-evaluation values ​​can be directly accumulated, or the abnormal evaluation value corresponding to the target object can be calculated based on the evaluation weight coefficients corresponding to at least one candidate pattern string. There is no restriction on this.

[0108] For example, suppose that the candidate pattern strings that successfully match the sequence of behaviors to be detected include: candidate pattern string 1 and candidate pattern string 2, where the sub-evaluation value corresponding to candidate pattern string 1 is 5 and the sub-evaluation value corresponding to candidate pattern string 2 is 10, then the anomaly evaluation value corresponding to the target object is 15.

[0109] For example, suppose that the candidate pattern strings that successfully match the sequence of behaviors to be detected include: candidate pattern string 1 and candidate pattern string 2, where the sub-evaluation value corresponding to candidate pattern string 1 is 5, the sub-evaluation value corresponding to candidate pattern string 2 is 10, the evaluation weight coefficient corresponding to candidate pattern string 1 is 0.2, and the evaluation weight coefficient corresponding to candidate pattern string 2 is 0.1, then the anomaly evaluation value corresponding to the target object is 2.

[0110] It should be noted that the evaluation value can be represented by a numerical value or by a grade, and there is no restriction on this. In this embodiment of the application, only the numerical representation is used as an example for illustration.

[0111] The above implementation method can be used to issue alerts to target objects based on the abnormal evaluation value of the target user, thereby ensuring that different alerting methods are provided under different abnormal conditions.

[0112] When issuing anomaly alerts for a target object based on the anomaly assessment value, the alarm method for the target object can be determined according to the preset correlation between the anomaly assessment value and the alarm method.

[0113] For example, suppose that when the anomaly assessment value is 10, the corresponding alarm method is SMS, APP message alarm, etc., and when the anomaly assessment value is 20, the corresponding alarm method is telephone alarm.

[0114] Based on the same inventive concept, embodiments of this application provide an information matching device, see below. Figure 8 As shown, this is a structural schematic diagram of the information matching device 800, which may include:

[0115] The acquisition unit 801 is used to acquire a sequence of behaviors to be detected of a target object. The sequence of behaviors to be detected includes each operation event to be detected triggered by the target object, and the triggering order between the operation events to be detected.

[0116] The matching unit 802 is used to match the behavior sequence to be detected with multiple candidate behavior sequence templates based on the prefix tree to obtain the matching result; wherein, the prefix tree contains multiple event nodes and multiple node paths, each event node is used to represent a candidate operation event contained in the multiple candidate behavior sequence templates, and each node path is used to represent a candidate behavior sequence template;

[0117] The identification unit 803 is used to determine that the target object has abnormal behavior when, based on the matching result, there is at least one candidate behavior sequence template that successfully matches the behavior sequence to be detected.

[0118] As one possible implementation, when matching the sequence of behaviors to be detected with multiple candidate behavior sequence templates based on a prefix tree to obtain a matching result, the matching unit 802 is specifically used for:

[0119] Based on the triggering order of the various operation events to be detected, each operation event to be detected is matched with the multiple event nodes in turn until the various operation events to be detected are matched. In each matching process, if the current operation event to be detected is successfully matched with an event node, then in the next matching process, the next operation event to be detected is matched with the child event node of the event node.

[0120] As one possible implementation, the matching unit 802 is further configured to:

[0121] If the current operation event to be detected fails to match the event node, then the event node pointed to by the mismatch pointer is determined according to the mismatch pointer of the event node, and the current operation event to be detected is matched with the child event node of the event node pointed to by the mismatch pointer.

[0122] As one possible implementation, when matching the current operation event to be detected with the child event nodes of the event node pointed to by the mismatch pointer, the matching unit 802 is specifically used for:

[0123] If the event node pointed to by the mismatch pointer is the root node, then if there is no sub-event node among the sub-event nodes of the root node that successfully matches the current operation event to be detected, then the current operation event to be detected fails to match the multiple candidate behavior sequence templates.

[0124] As one possible implementation, the matching unit 802 is further configured to:

[0125] If the current operation event to be detected successfully matches the event node, then when it is determined that the event node does not have any child event nodes, the candidate operation sequence template corresponding to the node path where the event node is located is determined, and it successfully matches the behavior sequence to be detected.

[0126] As one possible implementation, each candidate behavior sequence template represents an anomalous behavior, and the identification unit 803 is further used for:

[0127] Based on the matching results, at least one candidate behavior sequence template that successfully matches the behavior sequence to be detected is determined, and the at least one candidate behavior sequence template is used as at least one target behavior sequence template;

[0128] Based on the abnormal behavior represented by each of the at least one target behavior sequence templates, the behavior sequence to be detected is labeled with sample tags.

[0129] The labeled sequence of behaviors to be detected is used as training data for the model to train the initial anomaly detection model, thus obtaining the target anomaly detection model.

[0130] As one possible implementation, based on the matching result, after determining that at least one candidate behavior sequence template successfully matches the behavior sequence to be detected, and confirming that the target object exhibits abnormal behavior, the identification unit 803 is further configured to:

[0131] Obtain the cumulative number of successful matches corresponding to each of the at least one candidate behavior sequence template;

[0132] Based on the acquired cumulative number of successful matches, sub-evaluation values ​​corresponding to each of the at least one candidate behavior sequence template are obtained, and based on the acquired sub-evaluation values, the abnormal evaluation value corresponding to the target object is obtained.

[0133] Based on the preset mapping relationship between the cumulative number of successful matches and the anomaly evaluation value, and the obtained number of successful matches, the anomaly evaluation value corresponding to the target object is determined.

[0134] Based on the anomaly assessment value, an anomaly alarm is issued for the target object.

[0135] For ease of description, the above sections are divided into modules (or units) according to their functions and described separately. Of course, in implementing this application, the functions of each module (or unit) can be implemented in one or more software or hardware components.

[0136] Regarding the apparatus in the above embodiments, the specific manner in which each unit executes the request has been described in detail in the embodiments related to the method, and will not be elaborated here.

[0137] Those skilled in the art will understand that various aspects of this application can be implemented as a system, method, or program product. Therefore, various aspects of this application can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software implementations, collectively referred to herein as a "circuit," "module," or "system."

[0138] Having described the information matching method and apparatus according to exemplary embodiments of this application, we will now describe an electronic device according to another exemplary embodiment of this application.

[0139] Figure 9 This is a block diagram illustrating an electronic device 900 according to an exemplary embodiment, the device comprising:

[0140] Processor 910;

[0141] Memory 920 is used to store executable instructions of processor 910;

[0142] The processor 910 is configured to execute instructions to implement the information matching method in this embodiment, for example... Figure 2 The steps are shown in the figure.

[0143] In an exemplary embodiment, a storage medium including operations is also provided, such as a memory 920 including operations, the operations of which can be executed by a processor 910 of an electronic device 900 to complete the above-described method. Optionally, the storage medium may be a non-transitory computer-readable storage medium, such as a read-only memory (ROM), random access memory (RAM), compact disk read-only memory (CD-ROM), magnetic tape, floppy disk, and optical data storage device.

[0144] Based on the same inventive concept, this application also provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the information matching method provided in the various optional implementations of the above embodiments.

[0145] In some possible implementations, various aspects of the information matching method provided in this application can also be implemented as a program product, which includes a computer program. When the program product is run on a computer device, the computer program causes the computer device to perform the steps of the information matching method according to the various exemplary embodiments of this application described above. For example, the computer device can perform actions such as... Figure 2 The steps are shown in the figure.

[0146] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections having one or more wires, portable disks, hard disks, RAM, ROM, erasable programmable read-only memory (EPROM or flash memory), optical fibers, CD-ROMs, optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0147] The program product of the embodiments of this application may be in the form of a CD-ROM and include program code, and may run on a computing device. However, the program product of this application is not limited thereto. In this document, the readable storage medium may be any tangible medium that contains or stores a program that may be used by or in conjunction with a command execution system, apparatus, or device.

[0148] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The readable signal medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting a program for use by or in conjunction with a command execution system, apparatus, or device. Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0149] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. An information matching method, characterized in that, The method includes: Obtain the target object's behavior sequence to be detected. The target object's behavior sequence includes each operation event to be detected triggered by the target object, as well as the triggering order between each operation event to be detected. Each operation event to be detected is an operation event triggered by the target object in the operation interface of the application providing payment services. Based on the triggering order of the various operation events to be detected, each operation event to be detected is sequentially matched with multiple event nodes in the prefix tree until all operation events to be detected are matched to obtain a matching result. During each matching process, if the current operation event to be detected successfully matches an event node, then in the next matching process, the next operation event to be detected is matched with the child event node of that event node. The prefix tree contains the multiple event nodes and multiple node paths. Each event node represents a candidate operation event contained in multiple candidate behavior sequence templates, and each node path represents a candidate behavior sequence template. Based on the matching results, when it is determined that there is at least one candidate behavior sequence template that successfully matches the behavior sequence to be detected, it is determined that the target object has abnormal payment behavior.

2. The method as described in claim 1, characterized in that, Also includes: If the current operation event to be detected fails to match the event node, the event node pointed to by the mismatch pointer is determined according to the mismatch pointer of the preceding event node of the event node, and the current operation event to be detected is matched with the child event node of the event node pointed to by the mismatch pointer.

3. The method as described in claim 2, characterized in that, The step of matching the current operation event to be detected with the child event nodes of the event node pointed to by the mismatch pointer includes: If the event node pointed to by the mismatch pointer is the root node, then if there is no sub-event node among the sub-event nodes of the root node that successfully matches the current operation event to be detected, then the current operation event to be detected fails to match the multiple candidate behavior sequence templates.

4. The method as described in claim 1, characterized in that, Also includes: If the current operation event to be detected successfully matches the event node, then when it is determined that the event node does not have any child event nodes, the candidate operation sequence template corresponding to the node path where the event node is located is determined, and it successfully matches the behavior sequence to be detected.

5. The method according to any one of claims 1-4, characterized in that, Each candidate behavior sequence template represents an abnormal payment behavior; Then, based on the triggering order of the various detection operation events, each detection operation event is sequentially matched with multiple event nodes in the prefix tree until all detection operation events are matched and a matching result is obtained, the process further includes: Based on the matching results, at least one candidate behavior sequence template that successfully matches the behavior sequence to be detected is determined, and the at least one candidate behavior sequence template is used as at least one target behavior sequence template; Based on the abnormal payment behavior represented by each of the at least one target behavior sequence templates, the behavior sequence to be detected is labeled with sample tags. The labeled sequence of behaviors to be detected is used as training data for the model to train the initial anomaly detection model, thus obtaining the target anomaly detection model.

6. The method according to any one of claims 1-4, characterized in that, When determining, based on the matching result, that there exists at least one candidate behavior sequence template that successfully matches the behavior sequence to be detected, after determining that the target object has abnormal payment behavior, the method further includes: Obtain the cumulative number of successful matches corresponding to each of the at least one candidate behavior sequence template; Based on the acquired cumulative number of successful matches, sub-evaluation values ​​corresponding to each of the at least one candidate behavior sequence template are obtained, and based on the acquired sub-evaluation values, the abnormal evaluation value corresponding to the target object is obtained. Based on the preset mapping relationship between the cumulative number of successful matches and the anomaly evaluation value, and the obtained number of successful matches, the anomaly evaluation value corresponding to the target object is determined. Based on the anomaly assessment value, an anomaly alarm is issued for the target object.

7. An information matching device, characterized in that, include: The acquisition unit is used to acquire a sequence of behaviors to be detected of a target object. The sequence of behaviors to be detected includes each operation event to be detected triggered by the target object, and the triggering order between each operation event to be detected. Each operation event to be detected is an operation event triggered by the target object in the operation interface of the application providing payment services. The matching unit is used to sequentially match each of the detected operation events with multiple event nodes in the prefix tree based on the triggering order among the various detected operation events, until all detected operation events are matched to obtain a matching result; wherein, in each matching process, if the current detected operation event is successfully matched with an event node, then in the next matching process, the next detected operation event is matched with the child event node of the event node; the prefix tree contains the multiple event nodes and multiple node paths, each event node is used to represent a candidate operation event contained in the multiple candidate behavior sequence templates, and each node path is used to represent a candidate behavior sequence template; The identification unit is used to determine that the target object has abnormal payment behavior when, based on the matching result, there is at least one candidate behavior sequence template that successfully matches the behavior sequence to be detected.

8. The apparatus as claimed in claim 7, characterized in that, The matching unit is also used for: If the current operation event to be detected fails to match the event node, then the event node pointed to by the mismatch pointer is determined according to the mismatch pointer of the event node, and the current operation event to be detected is matched with the child event node of the event node pointed to by the mismatch pointer.

9. The apparatus as claimed in claim 8, characterized in that, When matching the current operation event to be detected with the sub-event nodes of the event node pointed to by the mismatch pointer, the matching unit is specifically used for: If the event node pointed to by the mismatch pointer is the root node, then if there is no sub-event node among the sub-event nodes of the root node that successfully matches the current operation event to be detected, then the current operation event to be detected fails to match the multiple candidate behavior sequence templates.

10. The apparatus as claimed in claim 7, characterized in that, The matching unit is also used for: If the current operation event to be detected successfully matches the event node, then when it is determined that the event node does not have any child event nodes, the candidate operation sequence template corresponding to the node path where the event node is located is determined, and it successfully matches the behavior sequence to be detected.

11. An electronic device, characterized in that, It includes a processor and a memory, wherein the memory stores a computer program that, when executed by the processor, causes the processor to perform the steps of any of the methods described in claims 1 to 6.

12. A computer-readable storage medium, characterized in that, It includes a computer program that, when run on an electronic device, causes the electronic device to perform the steps of any of the methods described in claims 1 to 6.

13. A computer program product, characterized in that, It includes a computer program stored in a computer-readable storage medium, and a processor of an electronic device reads from and executes the computer program, causing the electronic device to perform the steps of the method as described in any one of claims 1 to 6.

Images