Risk identification method and apparatus, storage medium, and computer device

Abstract

The present application discloses a risk identification method and apparatus, a storage medium, and a computer device. The method comprises: acquiring behavior data of a target account on a target platform (S202); inputting the behavior data into a pre-trained joint model, and outputting a target anomaly probability of the behavior data by the joint model, wherein the joint model is obtained by training by means of cross-platform training samples, and the cross-platform training samples comprise sample behavior data respectively recorded by a plurality of platforms (S204); and determining a security risk of the target account on the basis of the target anomaly probability (S206).

Description

Risk identification method, device, storage medium and computer equipment

[0001] Related applications

[0002] This application claims priority to Chinese patent application number 202410379884.X, filed on March 29, 2024, entitled “Risk Identification Method, Device, Storage Medium and Computer Equipment,” the entire text of which is hereby incorporated by reference. Technical Field

[0003] The present application relates to the field of information security technology, and in particular to a risk identification method, apparatus, storage medium, and computer equipment. Background Art

[0004] With the widespread application of Internet technology, the amount of data collected and processed by enterprises has grown exponentially. At the same time, the number of internal enterprise platforms has continued to increase with the increase in business types, making it more difficult to protect large-scale data. Traditional data security methods cannot meet current needs.

[0005] Users aren't confined to a single platform; they may engage in activities and interactions across multiple platforms. Therefore, analyzing user behavior on a single platform may overlook their behavior on other platforms, resulting in an incomplete understanding of their overall behavior. Furthermore, analyzing user behavior on a single platform may overlook the cross-platform influence of behavior. Users may interact and engage in activities across different platforms, and their behavior on one platform may be influenced by their behavior on other platforms. Therefore, analyzing behavior on a single platform may not fully understand the motivations and influencing factors behind user behavior.

[0006] Therefore, the behavioral analysis of users on a single platform has its limitations, and its incompleteness and limitations may lead to inaccurate and incomplete analysis results.

[0007] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0008] Embodiments of the present application provide a risk identification method, apparatus, storage medium, and computer device.

[0009] According to one aspect of an embodiment of the present application, a risk identification method is provided, including: obtaining behavioral data of a target account on a target platform; inputting the behavioral data into a pre-trained joint model, and having the joint model output a target anomaly probability of the behavioral data, wherein the joint model is trained using full-platform training samples, and the full-platform training samples include sample behavioral data recorded by multiple platforms; and determining the security risk of the target account based on the target anomaly probability.

[0010] Optionally, the behavior data is input into a pre-trained joint model, and the joint model outputs a target abnormality probability of the behavior data, including: inputting the behavior data into the full-platform sub-model, and the full-platform sub-model outputting a first abnormality probability of the behavior data, wherein the joint model includes a full-platform sub-model and multiple single-platform sub-models, the full-platform sub-model is trained using full-platform training samples, and the multiple single-platform sub-models are respectively trained using corresponding single-platform training samples, wherein the single-platform training samples include sample behavior data recorded by one platform; inputting the behavior data into a target single-platform sub-model that matches the target platform, and the target single-platform sub-model outputs a second abnormality probability of the behavior data; and determining the target abnormality probability based on the first abnormality probability and the second abnormality probability.

[0011] Optionally, the behavior data is input into a target single-platform sub-model that matches the target platform, and the target single-platform sub-model outputs a second abnormality probability of the behavior data, including: determining the target single-platform sub-model among multiple single-platform sub-models based on the platform identifier included in the behavior data; and inputting the behavior data into the target single-platform sub-model, and the target single-platform sub-model outputs the second abnormality probability of the behavior data.

[0012] Optionally, the joint model is trained in the following manner: obtaining full-platform training samples, wherein the full-platform training samples include first sample behavior data and a first sample anomaly label corresponding to the first sample behavior data; using the full-platform training samples to train the original full-platform sub-model to obtain a full-platform sub-model; obtaining multiple groups of single-platform training samples, wherein any group of single-platform training samples in the multiple groups of single-platform training samples includes second sample behavior data and a second sample anomaly label corresponding to the second sample behavior data, and the second sample behavior data is recorded by one platform; sequentially connecting multiple original single-platform sub-models with the full-platform sub-model to obtain multiple intermediate joint models, and using multiple groups of single-platform training samples to train the intermediate joint models to obtain a joint model.

[0013] Optionally, multiple original single-platform sub-models are sequentially connected to the full-platform sub-model to obtain multiple intermediate joint models, and multiple groups of single-platform training samples are used to train the intermediate joint models to obtain a joint model, including: connecting the first original single-platform sub-model to the full-platform sub-model to obtain a first intermediate joint model; using the single-platform training samples corresponding to the first original single-platform sub-model to train the first intermediate joint model to obtain a trained first intermediate joint model; selecting a second original single-platform sub-model from the unconnected original single-platform sub-models, connecting the second original single-platform sub-model to the trained first intermediate joint model to obtain a second intermediate joint model; using the single-platform training samples corresponding to the second original single-platform sub-model to train the second intermediate joint model to obtain a trained second intermediate joint model; using the above-mentioned method to obtain the trained second intermediate joint model, multiple trained intermediate joint models are sequentially obtained, until multiple original single-platform sub-models are connected to the full-platform sub-model to obtain a joint model.

[0014] Optionally, the second intermediate joint model is trained using the single-platform training samples corresponding to the second original single-platform sub-model to obtain a trained second intermediate joint model, including: inputting the target sample behavior data into the second intermediate joint model, and the second intermediate joint model outputting the sample anomaly probability, wherein the target sample behavior data is the sample behavior data included in the single-platform training samples corresponding to the second original single-platform sub-model; based on a pre-set loss function, according to the sample anomaly probability and the sample anomaly label corresponding to the target sample behavior data, adjusting the parameters of the second original single-platform sub-model in the second intermediate joint model to obtain a trained second intermediate joint model.

[0015] Optionally, the loss function includes a parameter space orthogonality constraint, wherein the parameter space orthogonality constraint is used to adjust the parameters of the first original single platform sub-model in the second intermediate joint model to be orthogonal to the parameters of the second original single platform sub-model.

[0016] According to another aspect of an embodiment of the present application, a risk identification device is also provided, including: an acquisition module for acquiring behavioral data of a target account on a target platform; an identification module for inputting the behavioral data into a pre-trained joint model, and the joint model outputs a target abnormality probability of the behavioral data, wherein the joint model is trained by full-platform training samples, and the full-platform training samples include sample behavioral data recorded by multiple platforms; a determination module for determining the security risk of the target account based on the target abnormality probability.

[0017] According to another aspect of an embodiment of the present application, a non-volatile storage medium is further provided, wherein the non-volatile storage medium includes a stored program, wherein when the program is running, the device where the non-volatile storage medium is located is controlled to execute any one of the above-mentioned risk identification methods.

[0018] According to another aspect of the embodiments of the present application, a computer device is further provided, comprising a processor, the processor being configured to run a program, wherein the program executes any one of the above-mentioned risk identification methods when the program is running.

[0019] According to another aspect of the embodiments of the present application, a computer program product is provided, including a computer program, which implements any one of the above-mentioned risk identification methods when executed by a processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the conventional technology, the following briefly introduces the drawings required for use in the embodiments or the conventional technology descriptions. Obviously, the drawings described below are merely embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the disclosed drawings without any creative work.

[0021] FIG1 shows a hardware structure block diagram of a computer terminal for implementing a risk identification method;

[0022] FIG2 is a flow chart of a risk identification method according to some embodiments of the present application;

[0023] FIG3 is a schematic diagram of the structure of a joint model provided according to some optional embodiments of the present application;

[0024] FIG4 is a structural block diagram of a risk identification device provided according to some optional embodiments of the present application. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the present invention, the following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of this application.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in a sequence other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] According to an embodiment of the present application, an embodiment of a method for risk identification is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0028] The method embodiment provided in the first embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 shows a hardware structure block diagram of a computer terminal for implementing a risk identification method. As shown in Figure 1, the computer terminal 10 may include one or more (102a, 102b, ..., 102n are used in the figure to illustrate) processors (the processor may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), and a memory 104 for storing data. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the BUS bus), a network interface, a power supply and / or a camera. It will be understood by those skilled in the art that the structure shown in Figure 1 is only for illustration and does not limit the structure of the above-mentioned electronic device. For example, the computer terminal 10 may also include more or fewer components than those shown in Figure 1, or have a configuration different from that shown in Figure 1.

[0029] It should be noted that the one or more processors and / or other data processing circuits described above may generally be referred to herein as "data processing circuitry." The data processing circuitry may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuitry may be a single, independent processing module, or may be incorporated in whole or in part into any of the other components of the computer terminal 10. As described in the embodiments of the present application, the data processing circuitry serves as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0030] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the risk identification method in the embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, implementing the risk identification method of the above-mentioned application. The memory 104 may include a high-speed random access memory and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely located relative to the processor, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0031] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 .

[0032] When conducting data security checks on internal enterprise user accounts, the problem arises that user usage habits and frequency across multiple platforms vary significantly, making it impossible to use a unified model for identification. However, the same user's usage behavior across multiple platforms is interconnected, and identifying abnormal user behavior requires providing feature information for this behavior data as a unified whole. This requires an anomaly detection model for platform users that can both integrate user behavior information across platforms and independently determine whether each user's behavior on each platform is abnormal.

[0033] To address this issue, this patent proposes a multi-model collaborative data security incident detection framework that can effectively integrate user behavior information on multiple platforms and perform anomaly detection based on the historical annotation information of each platform and its own characteristics, thereby improving the accuracy of user anomaly identification and greatly enhancing the prevention barrier of enterprise data security. Figure 2 is a flow chart of the risk identification method provided in accordance with an embodiment of this application. As shown in Figure 2, the method includes the following steps:

[0034] Step S202: Obtain the behavior data of the target account on the target platform.

[0035] In this step, the target account's behavioral data on the target platform refers to the account's activities and behavior records on the specific platform. This behavioral data may include, but is not limited to, login and logout records, browsing history, likes and comments, sharing history, purchase history, search history, and click history. This behavioral data can help the platform analyze user preferences and behavioral habits, thereby providing personalized services and recommendations. The platform can also identify system security risks from abnormal behavioral data that does not conform to user behavior habits.

[0036] It should be noted that the information collected is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with the relevant laws, regulations and standards of the relevant regions, take necessary confidentiality measures, do not violate public order and good customs, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0037] In step S204, the behavior data is input into a pre-trained joint model, and the joint model outputs the target abnormality probability of the behavior data, wherein the joint model is trained by full-platform training samples, and the full-platform training samples include sample behavior data recorded by multiple platforms.

[0038] Traditional models for detecting abnormal user behavior often train a separate model for each platform (or scenario). This is primarily due to the significant differences in user behavior patterns across different platforms. Furthermore, the labeling of user anomalies is platform-specific, meaning each user's behavior is considered abnormal on each platform. This prevents the effective integration of a user's behavior data across multiple platforms to provide a basis for judgment, reducing the accuracy of user anomaly detection.

[0039] In this step, the user behavior information on each platform is integrated by training the joint model using training samples from all platforms. At the same time, the operation and maintenance personnel use labels on each platform to train whether the user is abnormal. This allows us to observe the abnormalities in the user's usage habits on all platforms and conduct targeted model training based on the characteristics of each platform. This achieves full utilization of user behavior information, accurately judges abnormal behavior on each platform, and enhances the company's data security barriers.

[0040] Step S206: Determine the security risk of the target account based on the target abnormality probability.

[0041] In this step, by monitoring the probability of abnormal user behavior, potential security threats can be promptly identified and addressed, thereby protecting the security of user accounts. Each user's behavior pattern is unique, so risk assessment based on the probability of abnormal user behavior can more accurately reflect the actual risk situation of the account.

[0042] Through the above steps, the purpose of comprehensively considering the user's behavioral characteristics on multiple platforms to determine whether the user's behavior will bring security risks can be achieved, thereby achieving the technical effect of improving the accuracy of security risk judgment, and further solving the technical problem that the user behavior analysis is limited due to only analyzing the user's behavior on a single platform when protecting data security, resulting in poor data security protection effects.

[0043] As an optional embodiment, the behavior data is input into a pre-trained joint model, and the joint model outputs a target abnormality probability of the behavior data, including: inputting the behavior data into a full-platform sub-model, and the full-platform sub-model outputs a first abnormality probability of the behavior data, wherein the joint model includes a full-platform sub-model and multiple single-platform sub-models, the full-platform sub-model is trained using full-platform training samples, and the multiple single-platform sub-models are respectively trained using corresponding single-platform training samples, wherein the single-platform training samples include sample behavior data recorded by one platform; inputting the behavior data into a target single-platform sub-model that matches the target platform, and the target single-platform sub-model outputs a second abnormality probability of the behavior data; and determining the target abnormality probability based on the first abnormality probability and the second abnormality probability.

[0044] As an optional embodiment, the behavior data is input into a target single-platform sub-model that matches the target platform, and the target single-platform sub-model outputs a second abnormality probability of the behavior data, including: determining the target single-platform sub-model among multiple single-platform sub-models based on the platform identifier included in the behavior data; and inputting the behavior data into the target single-platform sub-model, and the target single-platform sub-model outputs the second abnormality probability of the behavior data.

[0045] Optionally, the joint model includes multiple sub-models, one of which is special and is a full-platform sub-model, and the other multiple sub-models are multiple single-platform sub-models. The full-platform sub-model is different from the single-platform sub-model. The difference is that the full-platform sub-model is trained with the user's behavioral data on multiple platforms, while the single-platform sub-model is trained with the behavioral data of a certain user on a certain platform. For example, if the total number of platforms of concern includes platform A, platform B, and platform C, the joint model then includes four sub-models, one of which is a full-platform sub-model, which is trained with the user's behavioral data on platforms A, B, and C, and the remaining three single-platform sub-models correspond to platforms A, B, and C respectively. Each single-platform sub-model is trained only with the user's behavioral data on the corresponding platform.

[0046] In the process of applying the joint model to determine the abnormal probability, the input behavioral data will be submitted to the full-platform sub-model for prediction, and the full-platform model will determine the first abnormal probability of the behavioral data based on its own parameters. Therefore, the first abnormal probability is the result obtained by taking into account the behavioral characteristics of users on multiple platforms. However, there are still differences between the platforms. Users may exhibit different behavioral characteristics on different platforms. If only the output results of the full-platform sub-model are used, it may result in the omission of special behavioral characteristics exhibited by users on a certain platform, and ultimately lead to low accuracy of the abnormal probability. In order to avoid the above problems, while the behavioral data is submitted to the full-platform sub-model for prediction, the target single-platform sub-model corresponding to the behavioral data can be determined in multiple single-platform sub-models based on the platform identifier to which the behavioral data belongs identified in the behavioral data. The target single-platform sub-model determines the second abnormal probability of the behavioral data based on its own parameters. Therefore, the second abnormal probability is the result obtained by taking into account the behavioral characteristics of the user on a specific platform.

[0047] Combining the first and second anomaly probabilities ultimately determines the target anomaly probability for the behavioral data. This allows for comprehensive consideration of the commonalities of user behavior across multiple platforms, as well as the unique behavioral characteristics of users on a particular platform, to arrive at a comprehensive judgment and determine the target anomaly probability, ensuring its accuracy.

[0048] It should be noted that combining the first abnormality probability and the second abnormality probability can be simply adding the first abnormality probability and the second abnormality probability, or setting corresponding weights for the first abnormality probability and the second abnormality probability respectively and then adding them, or normalizing the first abnormality probability and the second abnormality probability so that the sum of the first abnormality probability and the second abnormality probability is still within the range of (0, 1]. When the target abnormality probability is greater than a predetermined threshold, it can be determined that the user's behavior is abnormal.

[0049] As an optional embodiment, the joint model is trained in the following manner: obtaining full-platform training samples, wherein the full-platform training samples include first sample behavior data and a first sample abnormality label corresponding to the first sample behavior data; using the full-platform training samples to train the original full-platform sub-model to obtain a full-platform sub-model; obtaining multiple groups of single-platform training samples, wherein any group of single-platform training samples in the multiple groups of single-platform training samples includes second sample behavior data and a second sample abnormality label corresponding to the second sample behavior data, and the second sample behavior data is recorded by one platform; sequentially connecting multiple original single-platform sub-models with the full-platform sub-model to obtain multiple intermediate joint models, and using multiple groups of single-platform training samples to train the intermediate joint models to obtain a joint model.

[0050] Optionally, when training a joint model, it is necessary to collect behavioral data on multiple platforms, and the labeling personnel shall determine the label corresponding to each piece of behavioral data. The label can indicate whether the behavior is abnormal data. After collecting behavioral data on multiple platforms, these behavioral data can be combined to obtain full-platform training samples; the behavioral data can also be grouped according to the platform from which the behavioral data comes, to obtain multiple groups of single-platform training samples. It should be noted that the full-platform training samples are preferably not overlapped with the multiple groups of single-platform training samples, so as not to cause the problem of model overfitting. During training, the full-platform training samples can be used to train a separate original full-platform sub-model until the results meet the expectations, and the training process of the original full-platform sub-model is completed to obtain a full-platform sub-model. Then, multiple original single-platform sub-models can be connected in sequence to obtain multiple intermediate joint models, wherein the original single-platform sub-models can be models with the same structure. After training them with different training samples, different single-platform sub-models will be obtained.

[0051] As an optional embodiment, multiple original single-platform sub-models are sequentially connected to the full-platform sub-model to obtain multiple intermediate joint models, and multiple groups of single-platform training samples are used to train the intermediate joint models to obtain a joint model, including: connecting the first original single-platform sub-model to the full-platform sub-model to obtain a first intermediate joint model; using the single-platform training samples corresponding to the first original single-platform sub-model to train the first intermediate joint model to obtain a trained first intermediate joint model; selecting the second original single-platform sub-model from the unconnected original single-platform sub-models, connecting the second original single-platform sub-model to the trained first intermediate joint model to obtain a second intermediate joint model; using the single-platform training samples corresponding to the second original single-platform sub-model to train the second intermediate joint model to obtain a trained second intermediate joint model; using the above-mentioned method to obtain the trained second intermediate joint model, multiple trained intermediate joint models are sequentially obtained, until multiple original single-platform sub-models are connected to the full-platform sub-model to obtain a joint model.

[0052] Optionally, after training the full-platform sub-model, the multiple original single-platform sub-models to be trained can be connected to the full-platform sub-model to obtain an intermediate joint model, and then any set of single-platform training samples (previously untrained) can be used to train the original single-platform sub-models in the intermediate joint model to obtain a trained intermediate joint model, and then the next original single-platform sub-model to be trained is connected to the newly trained intermediate joint model. Finally, after all the original single-platform sub-models are connected to the full-platform sub-model and trained, the final joint model can be obtained. It should be noted that the number of original single-platform sub-models should correspond to the number of single-platform training samples.

[0053] For example, if the total number of platforms of concern includes platform A, platform B and platform C, the original full-platform sub-model is first trained using the full-platform training samples including the behavioral data of platforms A, B and C to obtain a trained full-platform sub-model, and then any original single-platform sub-model is connected to the full-platform sub-model to obtain the first intermediate model, and then the single-platform training samples of platform A are used to train the first intermediate model to obtain the trained first intermediate model. At this time, the single-platform sub-model in the first intermediate model corresponds to platform A; then another original single platform is connected to the first intermediate model to obtain a second intermediate model, and then the single-platform training samples of platform B are used to train the second intermediate model to obtain a trained second intermediate model. At this time, the single-platform sub-model just connected in the second intermediate model corresponds to platform B; finally, the last original single platform is connected to the second intermediate model to obtain a third intermediate model, and then the single-platform training samples of platform C are used to train the third intermediate model to obtain a trained joint model. At this time, the single-platform sub-model just connected in the third intermediate model corresponds to platform C.

[0054] As an optional embodiment, the second intermediate joint model is trained using a single-platform training sample corresponding to the second original single-platform sub-model to obtain a trained second intermediate joint model, including: inputting the target sample behavior data into the second intermediate joint model, and the second intermediate joint model outputting the sample anomaly probability, wherein the target sample behavior data is the sample behavior data included in the single-platform training sample corresponding to the second original single-platform sub-model; based on a pre-set loss function, according to the sample anomaly probability and the sample anomaly label corresponding to the target sample behavior data, the parameters of the second original single-platform sub-model in the second intermediate joint model are adjusted to obtain a trained second intermediate joint model.

[0055] Optionally, when training an intermediate joint model, the parameters of the corresponding single-platform sub-model can be adjusted based on the loss function, without adjusting the parameters of the full-platform sub-model and the parameters of other single-platform sub-models. For example, when using the single-platform training samples of platform B to train the second intermediate model, the parameters of the newly connected single-platform sub-model in the second intermediate model can be adjusted based on the input single-platform training samples of platform B to obtain the trained second intermediate model.

[0056] As an optional embodiment, the loss function includes a parameter space orthogonality constraint, wherein the parameter space orthogonality constraint is used to adjust the parameters of the first original single platform sub-model in the second intermediate joint model to be orthogonal to the parameters of the second original single platform sub-model.

[0057] Optionally, when training a certain intermediate joint model, when adjusting the parameters of the corresponding single-platform sub-model, the loss function is related to the parameters of the single-platform sub-model that already exists in the intermediate joint model. Specifically, the loss function includes a parameter space orthogonal constraint, and the parameter space orthogonal constraint is used to make the parameters of the later connected single-platform sub-model in the second intermediate joint model orthogonal to the parameters of all previously connected single-platform sub-models. For example, when the second intermediate model is trained using the single-platform training sample of platform B, the parameters of the newly connected single-platform sub-model in the second intermediate joint model are adjusted according to the input single-platform training sample of platform B, and according to the loss function, the parameters of the newly connected single-platform sub-model are ensured to be orthogonal to the parameters of the previously connected single-platform sub-model.

[0058] As a specific embodiment, FIG3 is a schematic diagram of the structure of a joint model provided according to an optional embodiment of the present application. The structure of the joint model is shown in FIG3 . The training process of the joint model is as follows:

[0059] Step 1: Data Collection. Record the behavior logs of users on each platform, including behavior type, time, interaction content, etc. At the same time, operations and maintenance personnel will mark historical abnormal users.

[0060] Step 2: Sequence data generated from user behavior records on various platforms is modeled to construct a behavioral sequence model for all users on the platform, known as the full-platform sub-model. This uses a self-attention mechanism to process input and output sequences, enabling better processing of patterns in user behavior sequences while enabling parallel computation, significantly improving computational efficiency. The self-attention mechanism is a core component, allowing the model to compare each element in the input sequence with others when processing sequences, ensuring accurate processing of each element within different contexts.

[0061] Step 3: Use the full-platform sub-model trained in step 2 as a pre-trained model, and then fine-tune it using the labeled data of each platform to obtain a joint model. Since the data between the platforms has been fused in step 2, when training a separate anomaly detection model on each platform, it is necessary to effectively isolate the data of each platform. Therefore, the joint training method is as follows:

[0062] Based on the sample annotated data of platform A, a model with a smaller number of parameters (single-platform sub-model) is attached to the pre-trained full-platform sub-model for fine-tuning.

[0063] During fine-tuning, the parameters of the full-platform sub-model remain unchanged; only the parameters of the single-platform sub-model are updated using gradient descent. Because the sample size of a single platform is small, updating all parameters of the full-platform sub-model could significantly impact it. Furthermore, since the single-platform sub-model has fewer parameters, this allows for faster model updates and online inference.

[0064] Based on the sample annotated data of platforms B, C, D, etc., the side-by-side model is trained using the fine-tuning method of platform A.

[0065] Considering that the data between platforms has been integrated and modeled in step 2, and information between them is already shared, when training the data for each platform separately, the sample spaces of the parameters of each platform must be separated as much as possible. This can be achieved by constraining the parameter spaces of each platform as orthogonally as possible using a loss function. For example, if the model of platform A has been fine-tuned, when fine-tuning the model of platform B, the loss function must include the orthogonality constraint of the parameter spaces of A and B. The same applies to multiple platforms.

[0066] It should be noted that for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that this application is not limited by the order of the actions described, because according to this application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all optional embodiments, and the actions and modules involved are not necessarily required by this application.

[0067] Through the description of the above implementation methods, those skilled in the art can clearly understand that the risk identification method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform. Of course, it can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product. The computer software product is stored in a storage medium (such as ROM / RAM, disk, CD), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0068] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0069] Based on the same inventive concept, embodiments of the present application also provide a risk identification device for implementing the aforementioned risk identification method. The solution provided by this device is similar to the solution described in the aforementioned method. Therefore, the specific limitations in one or more risk identification device embodiments provided below can be found in the aforementioned limitations on the risk identification method and will not be further elaborated here.

[0070] According to an embodiment of the present application, a risk identification device for implementing the above-mentioned risk identification method is also provided. Figure 4 is a structural block diagram of the risk identification device provided according to an embodiment of the present application. As shown in Figure 4, the risk identification device includes: an acquisition module 42, an identification module 44 and a determination module 46. The risk identification device is described below.

[0071] The acquisition module 42 is used to obtain the behavior data of the target account on the target platform.

[0072] The identification module 44 is connected to the acquisition module 42 and is used to input the behavior data into a pre-trained joint model, and the joint model outputs the target abnormality probability of the behavior data, wherein the joint model is trained by full-platform training samples, and the full-platform training samples include sample behavior data recorded by multiple platforms.

[0073] The determination module 46 is connected to the identification module 44 and is used to determine the security risk of the target account based on the target abnormality probability.

[0074] It should be noted that the acquisition module 42, identification module 44, and determination module 46 described above correspond to steps S202 to S206 in the embodiment. The examples and application scenarios implemented by the various modules and corresponding steps are the same, but are not limited to the contents disclosed in the above embodiment. It should be noted that the above modules, as part of the device, can be run in the computer terminal 10 provided in the embodiment.

[0075] Optionally, the identification module is also used to: input the behavior data into the full-platform sub-model, and the full-platform sub-model outputs a first abnormality probability of the behavior data, wherein the joint model includes a full-platform sub-model and multiple single-platform sub-models, the full-platform sub-model is trained through the full-platform training samples, and the multiple single-platform sub-models are respectively trained through corresponding single-platform training samples, wherein the single-platform training samples include sample behavior data recorded by one platform; input the behavior data into a target single-platform sub-model that matches the target platform, and the target single-platform sub-model outputs a second abnormality probability of the behavior data; determine the target abnormality probability based on the first abnormality probability and the second abnormality probability.

[0076] Optionally, the behavior data is input into a target single-platform sub-model that matches the target platform, and the target single-platform sub-model outputs a second abnormality probability of the behavior data, including: determining the target single-platform sub-model among multiple single-platform sub-models based on the platform identifier included in the behavior data; and inputting the behavior data into the target single-platform sub-model, and the target single-platform sub-model outputs the second abnormality probability of the behavior data.

[0077] Optionally, the joint model is trained in the following manner: obtaining full-platform training samples, wherein the full-platform training samples include first sample behavior data and a first sample anomaly label corresponding to the first sample behavior data; using the full-platform training samples to train the original full-platform sub-model to obtain a full-platform sub-model; obtaining multiple groups of single-platform training samples, wherein any group of single-platform training samples in the multiple groups of single-platform training samples includes second sample behavior data and a second sample anomaly label corresponding to the second sample behavior data, and the second sample behavior data is recorded by one platform; sequentially connecting multiple original single-platform sub-models with the full-platform sub-model to obtain multiple intermediate joint models, and using multiple groups of single-platform training samples to train the intermediate joint models to obtain a joint model.

[0078] Optionally, multiple original single-platform sub-models are sequentially connected to the full-platform sub-model to obtain multiple intermediate joint models, and multiple groups of single-platform training samples are used to train the intermediate joint models to obtain a joint model, including: connecting the first original single-platform sub-model to the full-platform sub-model to obtain a first intermediate joint model; using the single-platform training samples corresponding to the first original single-platform sub-model to train the first intermediate joint model to obtain a trained first intermediate joint model; selecting a second original single-platform sub-model from the unconnected original single-platform sub-models, connecting the second original single-platform sub-model to the trained first intermediate joint model to obtain a second intermediate joint model; using the single-platform training samples corresponding to the second original single-platform sub-model to train the second intermediate joint model to obtain a trained second intermediate joint model; using the above-mentioned method to obtain the trained second intermediate joint model, multiple trained intermediate joint models are sequentially obtained, until multiple original single-platform sub-models are connected to the full-platform sub-model to obtain a joint model.

[0079] Optionally, the second intermediate joint model is trained using the single-platform training samples corresponding to the second original single-platform sub-model to obtain a trained second intermediate joint model, including: inputting the target sample behavior data into the second intermediate joint model, and the second intermediate joint model outputting the sample anomaly probability, wherein the target sample behavior data is the sample behavior data included in the single-platform training samples corresponding to the second original single-platform sub-model; based on a pre-set loss function, according to the sample anomaly probability and the sample anomaly label corresponding to the target sample behavior data, adjusting the parameters of the second original single-platform sub-model in the second intermediate joint model to obtain a trained second intermediate joint model.

[0080] Optionally, the loss function includes a parameter space orthogonality constraint, wherein the parameter space orthogonality constraint is used to adjust the parameters of the first original single platform sub-model in the second intermediate joint model to be orthogonal to the parameters of the second original single platform sub-model.

[0081] An embodiment of the present application may provide a computer device. Optionally, in this embodiment, the computer device may be located in at least one of a plurality of network devices in a computer network. The computer device includes a memory and a processor.

[0082] Among them, the memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the risk identification method and device in the embodiments of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, that is, realizing the above-mentioned risk identification method. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely located relative to the processor, and these remote memories may be connected to the computer terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0083] The processor can call the information and applications stored in the memory through the transmission device to perform the following steps: obtain the behavioral data of the target account on the target platform; input the behavioral data into a pre-trained joint model, and the joint model outputs the target abnormality probability of the behavioral data, wherein the joint model is trained through full-platform training samples, and the full-platform training samples include sample behavioral data recorded by multiple platforms; determine the security risk of the target account based on the target abnormality probability.

[0084] Optionally, the processor may also execute the following program code: inputting the behavior data into a pre-trained joint model, and having the joint model output a target abnormality probability of the behavior data, including: inputting the behavior data into a full-platform sub-model, and having the full-platform sub-model output a first abnormality probability of the behavior data, wherein the joint model includes a full-platform sub-model and multiple single-platform sub-models, the full-platform sub-model is trained using full-platform training samples, and the multiple single-platform sub-models are respectively trained using corresponding single-platform training samples, wherein the single-platform training samples include sample behavior data recorded by one platform; inputting the behavior data into a target single-platform sub-model that matches the target platform, and having the target single-platform sub-model output a second abnormality probability of the behavior data; and determining the target abnormality probability based on the first abnormality probability and the second abnormality probability.

[0085] Optionally, the processor may also execute the program code of the following steps: inputting the behavior data into a target single-platform sub-model that matches the target platform, and having the target single-platform sub-model output a second abnormality probability of the behavior data, including: determining the target single-platform sub-model among multiple single-platform sub-models based on the platform identifier included in the behavior data; inputting the behavior data into the target single-platform sub-model, and having the target single-platform sub-model output a second abnormality probability of the behavior data.

[0086] Optionally, the processor may also execute the program code of the following steps: the joint model is trained in the following manner: obtaining full-platform training samples, wherein the full-platform training samples include first sample behavior data and a first sample abnormality label corresponding to the first sample behavior data; using the full-platform training samples to train the original full-platform sub-model to obtain a full-platform sub-model; obtaining multiple groups of single-platform training samples, wherein any one group of single-platform training samples in the multiple groups of single-platform training samples includes second sample behavior data and a second sample abnormality label corresponding to the second sample behavior data, and the second sample behavior data is recorded by one platform; sequentially connecting multiple original single-platform sub-models with the full-platform sub-model to obtain multiple intermediate joint models, and using multiple groups of single-platform training samples to train the intermediate joint models to obtain a joint model.

[0087] Optionally, the processor may also execute the program code of the following steps: sequentially connecting multiple original single-platform sub-models with the full-platform sub-model to obtain multiple intermediate joint models, and respectively using multiple groups of single-platform training samples to train the intermediate joint models to obtain a joint model, including: connecting the first original single-platform sub-model with the full-platform sub-model to obtain a first intermediate joint model; using the single-platform training samples corresponding to the first original single-platform sub-model to train the first intermediate joint model to obtain a trained first intermediate joint model; selecting a second original single-platform sub-model from the unconnected original single-platform sub-models, connecting the second original single-platform sub-model with the trained first intermediate joint model to obtain a second intermediate joint model; using the single-platform training samples corresponding to the second original single-platform sub-model to train the second intermediate joint model to obtain a trained second intermediate joint model; using the above-mentioned method to obtain the trained second intermediate joint model, sequentially obtain multiple trained intermediate joint models, until multiple original single-platform sub-models are connected to the full-platform sub-model to obtain a joint model.

[0088] Optionally, the above-mentioned processor can also execute the program code of the following steps: using the single-platform training sample corresponding to the second original single-platform sub-model to train the second intermediate joint model to obtain a trained second intermediate joint model, including: inputting the target sample behavior data into the second intermediate joint model, and the second intermediate joint model outputting the sample anomaly probability, wherein the target sample behavior data is the sample behavior data included in the single-platform training sample corresponding to the second original single-platform sub-model; based on a pre-set loss function, according to the sample anomaly probability and the sample anomaly label corresponding to the target sample behavior data, adjusting the parameters of the second original single-platform sub-model in the second intermediate joint model to obtain a trained second intermediate joint model.

[0089] Optionally, the above-mentioned processor can also execute the program code of the following steps: the loss function includes a parameter space orthogonal constraint, wherein the parameter space orthogonal constraint is used to adjust the parameters of the first original single-platform sub-model in the second intermediate joint model to be orthogonal to the parameters of the second original single-platform sub-model.

[0090] By adopting the embodiment of the present application, a risk identification solution is provided. The joint model is trained by using sample behavior data recorded by multiple platforms respectively, by obtaining the behavior data of the target account on the target platform; the behavior data is input into the pre-trained joint model, and the joint model outputs the target abnormality probability of the behavior data, wherein the joint model is trained by full-platform training samples, and the full-platform training samples include sample behavior data recorded by multiple platforms respectively; according to the target abnormality probability, the security risk of the target account is determined, achieving the purpose of comprehensively considering the user's behavior characteristics on multiple platforms to judge whether the user's behavior will bring security risks, thereby achieving the technical effect of improving the accuracy of security risk judgment, and further solving the technical problem that the user behavior analysis is limited due to only analyzing the user's behavior on a single platform when protecting data security, resulting in poor data security protection effect.

[0091] A person skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the hardware related to the terminal device through a program, and the program can be stored in a non-volatile storage medium, which may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0092] The embodiment of the present application further provides a non-volatile storage medium. Optionally, in this embodiment, the non-volatile storage medium can be used to store the program code executed by the risk identification method provided in the above embodiment.

[0093] Optionally, in this embodiment, the non-volatile storage medium may be located in any computer terminal in a computer terminal group in a computer network, or in any mobile terminal in a mobile terminal group.

[0094] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for executing the following steps: obtaining behavioral data of the target account on the target platform; inputting the behavioral data into a pre-trained joint model, and having the joint model output a target anomaly probability of the behavioral data, wherein the joint model is trained using full-platform training samples, and the full-platform training samples include sample behavioral data recorded by multiple platforms; and determining the security risk of the target account based on the target anomaly probability.

[0095] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for executing the following steps: inputting the behavior data into a pre-trained joint model, and the joint model outputting a target abnormality probability of the behavior data, including: inputting the behavior data into a full-platform sub-model, and the full-platform sub-model outputting a first abnormality probability of the behavior data, wherein the joint model includes a full-platform sub-model and multiple single-platform sub-models, the full-platform sub-model is trained using full-platform training samples, and the multiple single-platform sub-models are respectively trained using corresponding single-platform training samples, wherein the single-platform training samples include sample behavior data recorded by one platform; inputting the behavior data into a target single-platform sub-model that matches the target platform, and the target single-platform sub-model outputting a second abnormality probability of the behavior data; and determining the target abnormality probability based on the first abnormality probability and the second abnormality probability.

[0096] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for executing the following steps: inputting the behavioral data into a target single-platform sub-model that matches the target platform, and having the target single-platform sub-model output a second abnormality probability of the behavioral data, including: determining the target single-platform sub-model among multiple single-platform sub-models based on the platform identifier included in the behavioral data; inputting the behavioral data into the target single-platform sub-model, and having the target single-platform sub-model output a second abnormality probability of the behavioral data.

[0097] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for executing the following steps: the joint model is trained in the following manner: obtaining full-platform training samples, wherein the full-platform training samples include first sample behavior data and a first sample abnormality label corresponding to the first sample behavior data; using the full-platform training samples to train the original full-platform sub-model to obtain a full-platform sub-model; obtaining multiple groups of single-platform training samples, wherein any group of single-platform training samples in the multiple groups of single-platform training samples includes second sample behavior data and a second sample abnormality label corresponding to the second sample behavior data, and the second sample behavior data is recorded by one platform; connecting multiple original single-platform sub-models with the full-platform sub-model in sequence to obtain multiple intermediate joint models, and using multiple groups of single-platform training samples to train the intermediate joint models respectively to obtain a joint model.

[0098] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for executing the following steps: sequentially connecting multiple original single-platform sub-models with the full-platform sub-model to obtain multiple intermediate joint models, and respectively using multiple groups of single-platform training samples to train the intermediate joint models to obtain a joint model, including: connecting the first original single-platform sub-model with the full-platform sub-model to obtain a first intermediate joint model; using the single-platform training samples corresponding to the first original single-platform sub-model to train the first intermediate joint model to obtain a trained first intermediate joint model; selecting a second original single-platform sub-model from the unconnected original single-platform sub-models, connecting the second original single-platform sub-model with the trained first intermediate joint model to obtain a second intermediate joint model; using the single-platform training samples corresponding to the second original single-platform sub-model to train the second intermediate joint model to obtain a trained second intermediate joint model; using the above-mentioned method to obtain the trained second intermediate joint model, sequentially obtain multiple trained intermediate joint models, until multiple original single-platform sub-models are connected to the full-platform sub-model to obtain a joint model.

[0099] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for executing the following steps: training the second intermediate joint model using the single-platform training sample corresponding to the second original single-platform sub-model to obtain a trained second intermediate joint model, including: inputting the target sample behavior data into the second intermediate joint model, and outputting the sample anomaly probability from the second intermediate joint model, wherein the target sample behavior data is the sample behavior data included in the single-platform training sample corresponding to the second original single-platform sub-model; based on a pre-set loss function, according to the sample anomaly probability and the sample anomaly label corresponding to the target sample behavior data, adjusting the parameters of the second original single-platform sub-model in the second intermediate joint model to obtain a trained second intermediate joint model.

[0100] Optionally, in this embodiment, the non-volatile storage medium is configured to store program code for performing the following steps: the loss function includes a parameter space orthogonal constraint, wherein the parameter space orthogonal constraint is used to adjust the parameters of the first original single-platform sub-model in the second intermediate joint model to be orthogonal to the parameters of the second original single-platform sub-model.

[0101] An embodiment of the present application further provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the risk identification method in each embodiment of the present application.

[0102] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0103] In the above embodiments of the present application, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0104] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of the units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0105] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0106] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0107] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a non-volatile storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk, and other media that can store program code.

[0108] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0109] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. A risk identification method comprising: Obtain the target account's behavioral data on the target platform; Inputting the behavior data into a pre-trained joint model, and having the joint model output a target abnormality probability for the behavior data, wherein the joint model is trained using full-platform training samples, and the full-platform training samples include sample behavior data recorded by multiple platforms; The security risk of the target account is determined based on the target abnormality probability.

2. The method according to claim 1, wherein The step of inputting the behavior data into a pre-trained joint model, and having the joint model output a target abnormality probability of the behavior data, includes: The behavior data is input into the full-platform sub-model, and the full-platform sub-model outputs a first abnormality probability of the behavior data, wherein the joint model includes a full-platform sub-model and multiple single-platform sub-models, the full-platform sub-model is trained using full-platform training samples, and the multiple single-platform sub-models are respectively trained using corresponding single-platform training samples, wherein the single-platform training samples include sample behavior data recorded on one platform; Inputting the behavior data into a target single-platform sub-model that matches the target platform, and having the target single-platform sub-model output a second abnormal probability of the behavior data; The target abnormality probability is determined according to the first abnormality probability and the second abnormality probability.

3. The method according to claim 2, wherein: Inputting the behavior data into a target single-platform sub-model that matches the target platform, and having the target single-platform sub-model output a second abnormal probability of the behavior data, includes: Determining the target single-platform sub-model among the multiple single-platform sub-models according to the platform identifier included in the behavior data; The behavior data is input into the target single-platform sub-model, and the target single-platform sub-model outputs a second abnormal probability of the behavior data.

4. The method according to claim 1, wherein The joint model is trained in the following way: Acquire the full-platform training sample, wherein the full-platform training sample includes first sample behavior data and a first sample anomaly label corresponding to the first sample behavior data; Using the full-platform training sample, the original full-platform sub-model is trained to obtain the full-platform sub-model; Acquire multiple groups of single-platform training samples, wherein any group of the multiple groups of single-platform training samples includes second sample behavior data and a second sample anomaly label corresponding to the second sample behavior data, and the second sample behavior data is recorded by one platform; Multiple original single-platform sub-models are sequentially connected to the full-platform sub-model to obtain multiple intermediate joint models, and the multiple groups of single-platform training samples are used to train the intermediate joint models respectively to obtain the joint model.

5. The method according to claim 4, wherein The method sequentially connects the multiple original single-platform sub-models with the full-platform sub-model to obtain multiple intermediate joint models, and respectively trains the intermediate joint models using the multiple groups of single-platform training samples to obtain the joint model, including: Connecting the first original single-platform sub-model with the full-platform sub-model to obtain a first intermediate joint model; Training the first intermediate joint model using the single-platform training sample corresponding to the first original single-platform sub-model to obtain a trained first intermediate joint model; Selecting a second original single-platform sub-model from the unconnected original single-platform sub-models, and connecting the second original single-platform sub-model with the trained first intermediate joint model to obtain a second intermediate joint model; Training the second intermediate joint model using the single-platform training sample corresponding to the second original single-platform sub-model to obtain a trained second intermediate joint model; The above-mentioned method of obtaining the trained second intermediate joint model is adopted to obtain multiple trained intermediate joint models in sequence until the multiple original single-platform sub-models are connected to the full-platform sub-model to obtain the joint model.

6. The method according to claim 5, wherein: The step of training the second intermediate joint model using the single-platform training sample corresponding to the second original single-platform sub-model to obtain a trained second intermediate joint model includes: Inputting target sample behavior data into the second intermediate joint model, and having the second intermediate joint model output a sample abnormality probability, wherein the target sample behavior data is the sample behavior data included in the single-platform training sample corresponding to the second original single-platform sub-model; Based on a pre-set loss function, according to the sample anomaly probability and the sample anomaly label corresponding to the target sample behavior data, the parameters of the second original single-platform sub-model in the second intermediate joint model are adjusted to obtain the trained second intermediate joint model.

7. The method according to claim 6, wherein: The loss function includes a parameter space orthogonality constraint, wherein the parameter space orthogonality constraint is used to adjust the parameters of the first original single-platform sub-model in the second intermediate joint model to be orthogonal to the parameters of the second original single-platform sub-model.

8. A risk identification device comprising: The acquisition module is used to obtain the target account's behavior data on the target platform; an identification module configured to input the behavior data into a pre-trained joint model, and have the joint model output a target abnormality probability for the behavior data, wherein the joint model is trained using full-platform training samples, wherein the full-platform training samples include sample behavior data recorded by multiple platforms; A determination module is used to determine the security risk of the target account based on the target abnormality probability.

9. A non-volatile storage medium, wherein: The non-volatile storage medium includes a stored program, wherein when the program is executed, the device where the non-volatile storage medium is located is controlled to execute the steps of the method according to any one of claims 1 to 7.

10. A computer device, wherein: include: memory and processor, The memory stores a computer program; The processor is configured to execute a computer program stored in the memory, and when the computer program is run, the processor is enabled to execute the steps of the method according to any one of claims 1 to 7.

Images