Summary of the invention
The purpose of this specification one or more embodiment is to provide a kind of data Risk Forecast Method and device, to reality
User behavior data is now automatically obtained, and then more efficiently train the behavior sequence model of identification user behavior data
Effect, to improve the recognition capability to user behavior data.
In order to solve the above technical problems, this specification one or more embodiment is achieved in that
On the one hand, this specification one or more embodiment provides a kind of data Risk Forecast Method, comprising:
Obtain for training LSTM behavior sequence model, user behavior sequence data including multiple users sample number
According to;Wherein, the user behavior sequence data includes multiple orderly user behavior datas, and the user behavior data is by described
The event title and event attribute of the history event data of user are constituted;
According to the sample data training LSTM behavior sequence model;
According to the LSTM behavior sequence model, determine whether the behavioral data of target user is risk data.
In one embodiment, described to obtain for training LSTM behavior sequence model, user including multiple users
The sample data of behavior sequence data, comprising:
Obtain the history event data of the specified quantity of the user;Wherein, each history event data is corresponding
There is respective first risk label;
Determine the event title and the corresponding event attribute of each event title of each history event data;
Filter out the first event title for meeting preset rules and the corresponding first event category of each first event title
Property is combined, and obtains the corresponding user behavior data of the history event data;
According to the Time To Event of the history event data, the user behavior data is ranked up, is used
Family behavior sequence data;
The corresponding second risk label of the user behavior sequence data is determined according to the first risk label;And it will
The user behavior sequence data and its corresponding second risk label are determined as the sample data.
In one embodiment, described to filter out the first event title for meeting preset rules and each first event name
Corresponding first event attribute is claimed to be combined, comprising:
Determine the title index value of each event title;And determine the corresponding event category of each event title
The ATTRIBUTE INDEX value of property;
According to the title index value, the ATTRIBUTE INDEX value and the preset rules, the first event name is filtered out
Claim and the corresponding first event attribute of each first event title is combined;Wherein, the preset rules include institute
State the regular and described ATTRIBUTE INDEX value and the second preset threshold of the size relation between title index value and the first preset threshold
Between size relation rule.
In one embodiment, the title index value includes the accounting of the event title;The ATTRIBUTE INDEX value packet
Include null value accounting, the counting of event attribute value, the aggregation of event attribute value dispersion, event attribute value of the event attribute
At least one of in degree.
In one embodiment, described according to the LSTM behavior sequence model, determine that the behavioral data of target user is
No is risk data, comprising:
Obtain the first history event data of the specified quantity of the target user;
According to first history event data, the first user behavior sequence data of the target user is determined;
Using the first user behavior sequence data as the input of the LSTM behavior sequence model, with the determination mesh
Whether the behavioral data for marking user is the risk data.
In one embodiment, described using the first user behavior sequence data as the LSTM behavior sequence model
Input, whether be the risk data with the behavioral data of the determination target user, comprising:
It is given a mark using the LSTM behavior sequence model to the first user behavior sequence data, obtains described
The corresponding risk score value of one user behavior sequence data;
Whether the behavioral data that the target user is determined according to the risk score value is the risk data.
In one embodiment, whether the behavioral data that the target user is determined according to the risk score value is institute
State risk data, comprising:
If the risk score value is higher than default score value, proof of identity further is carried out to the target user;
If the result of the proof of identity is that verification passes through, it is determined that the behavioral data of the target user is the risk
Data.
On the other hand, this specification one or more embodiment provides a kind of data risk profile device, comprising:
Module is obtained, for obtaining for training LSTM behavior sequence model, user behavior sequence including multiple users
The sample data of column data;Wherein, the user behavior sequence data includes multiple orderly user behavior datas, the user
Behavioral data is made of the event title and event attribute of the history event data of the user;
Training module, for according to the sample data training LSTM behavior sequence model;
Determining module, for determining whether the behavioral data of target user is wind according to the LSTM behavior sequence model
Dangerous data.
In one embodiment, the acquisition module includes:
First acquisition unit, the history event data of the specified quantity for obtaining the user;Wherein, each described
History event data is corresponding with respective first risk label;
First determination unit, the event title and each event title for determining each history event data are corresponding
Event attribute;
Screening unit is corresponded to for filtering out the first event title for meeting preset rules and each first event title
First event attribute be combined, obtain the corresponding user behavior data of the history event data;
Sequencing unit, for the Time To Event according to the history event data, to the user behavior data into
Row sequence, obtains user behavior sequence data;
Second determination unit, for determining the user behavior sequence data corresponding according to the first risk label
Two risk labels;And the user behavior sequence data and its corresponding second risk label are determined as the sample
Data.
In one embodiment, the screening unit is also used to:
Determine the title index value of each event title;And determine the corresponding event category of each event title
The ATTRIBUTE INDEX value of property;
According to the title index value, the ATTRIBUTE INDEX value and the preset rules, the first event name is filtered out
Claim and the corresponding first event attribute of each first event title is combined;Wherein, the preset rules include institute
State the regular and described ATTRIBUTE INDEX value and the second preset threshold of the size relation between title index value and the first preset threshold
Between size relation rule.
In one embodiment, the title index value includes the accounting of the event title;The ATTRIBUTE INDEX value packet
Include null value accounting, the counting of event attribute value, the aggregation of event attribute value dispersion, event attribute value of the event attribute
At least one of in degree.
In one embodiment, the determining module includes:
Second acquisition unit, the first history event data of the specified quantity for obtaining the target user;
Third determination unit, for determining the first user of the target user according to first history event data
Behavior sequence data;
4th determination unit, for using the first user behavior sequence data as the LSTM behavior sequence model
Whether input, be the risk data with the behavioral data of the determination target user.
In one embodiment, the 4th determination unit is also used to:
It is given a mark using the LSTM behavior sequence model to the first user behavior sequence data, obtains described
The corresponding risk score value of one user behavior sequence data;
Whether the behavioral data that the target user is determined according to the risk score value is the risk data.
In one embodiment, the 4th determination unit is also used to:
If the risk score value is higher than default score value, proof of identity further is carried out to the target user;
If the result of the proof of identity is that verification passes through, it is determined that the behavioral data of the target user is the risk
Data.
In another aspect, this specification one or more embodiment provides a kind of data risk profile equipment, comprising:
Processor;And
It is arranged to the memory of storage computer executable instructions, the executable instruction makes the place when executed
Manage device:
Obtain for training LSTM behavior sequence model, user behavior sequence data including multiple users sample number
According to;Wherein, the user behavior sequence data includes multiple orderly user behavior datas, and the user behavior data is by described
The event title and event attribute of the history event data of user are constituted;
According to the sample data training LSTM behavior sequence model;
According to the LSTM behavior sequence model, determine whether the behavioral data of target user is risk data.
In another aspect, the embodiment of the present application provides a kind of storage medium, for storing computer executable instructions, it is described can
It executes instruction and realizes following below scheme when executed:
Obtain for training LSTM behavior sequence model, user behavior sequence data including multiple users sample number
According to;Wherein, the user behavior sequence data includes multiple orderly user behavior datas, and the user behavior data is by described
The event title and event attribute of the history event data of user are constituted;
According to the sample data training LSTM behavior sequence model;
According to the LSTM behavior sequence model, determine whether the behavioral data of target user is risk data.
Using the technical solution of this specification one or more embodiment, by obtaining for training LSTM behavior sequence mould
(wherein, user behavior sequence data includes multiple having for sample data of type, user behavior sequence data including multiple users
The user behavior data of sequence, and user behavior data is made of the event title and event attribute of the history event data of user),
And then using the sample data training LSTM behavior sequence model obtained, and target user is determined according to LSTM behavior sequence model
Behavioral data whether be risk data.As it can be seen that the technical solution can be obtained automatically by event title and event attribute
The user behavior data of composition greatly reduces cost of labor and time cost needed for obtaining user behavior data, and is instructing
The event attribute of history event data is combined when practicing LSTM behavior sequence model, to improve the identification energy to risk data
Power.
Specific embodiment
This specification one or more embodiment provides a kind of data Risk Forecast Method and device, to realize automation
Ground obtains user behavior data, and then more efficiently trains the effect of the behavior sequence model of identification user behavior data, from
And improve the recognition capability to user behavior data.
In order to make those skilled in the art more fully understand the technical solution in this specification one or more embodiment,
Below in conjunction with the attached drawing in this specification one or more embodiment, to the technology in this specification one or more embodiment
Scheme is clearly and completely described, it is clear that and described embodiment is only this specification a part of the embodiment, rather than
Whole embodiments.Based on this specification one or more embodiment, those of ordinary skill in the art are not making creativeness
The model of this specification one or more embodiment protection all should belong in every other embodiment obtained under the premise of labour
It encloses.
Fig. 1 is according to a kind of schematic flow chart of data Risk Forecast Method of one embodiment of this specification, such as Fig. 1 institute
Show, this method comprises:
S102 is obtained LSTM behavior sequence model, user behavior sequence data including multiple users for training
Sample data.
Wherein, user behavior sequence data includes multiple orderly user behavior datas, and user behavior data is by user's
The event title and event attribute of history event data are constituted.
S104, according to sample data training LSTM behavior sequence model.
S106 determines whether the behavioral data of target user is risk data according to LSTM behavior sequence model.
Using the technical solution of this specification one or more embodiment, by obtaining for training LSTM behavior sequence mould
(wherein, user behavior sequence data includes multiple having for sample data of type, user behavior sequence data including multiple users
The user behavior data of sequence, and user behavior data is made of the event title and event attribute of the history event data of user),
And then using the sample data training LSTM behavior sequence model obtained, and target user is determined according to LSTM behavior sequence model
Behavioral data whether be risk data.As it can be seen that the technical solution can be obtained automatically by event title and event attribute
The user behavior data of composition greatly reduces cost of labor and time cost needed for obtaining user behavior data, and is instructing
The event attribute of history event data is combined when practicing LSTM behavior sequence model, to improve the identification energy to risk data
Power.
In the present embodiment, how the prior art belonged to according to sample data training LSTM behavior sequence model, therefore no longer
It repeats.How following detailed description is obtained sample data and how to be determined the row of target user using LSTM behavior sequence model
It whether is risk data for data.
In one embodiment, for training LSTM behavior sequence model, user behavior sequence including multiple users
The sample data of data A1-A5 can obtain as follows:
Step A1, the history event data of the specified quantity of user is obtained;Wherein, each history event data is corresponding with respectively
The first risk label.
In the step, when obtaining the history event data of specified quantity, user can be first taken out in nearest certain time
All history event datas in interior (in such as nearest January), then again from these history event datas, according to it is current when
Between be spaced ascending sequence and successively take out specified quantity history event data.
First risk label can be black, white two kinds according to the Type division of history event data.Wherein, history event data
The first risk label be " white " when, representing the history event data does not have risk or risk lower;History event data
When first risk label is " black ", it is higher with risk or risk to represent the history event data.
In addition, the present embodiment is not limited to characterize the first risk label using " black ", " white ", the first risk label can
By using it is any can distinguish data it is whether risky in a manner of characterized, such as " black " and " non-black ", " 1 and 0 " (its
In, " 1 " represents risky, and " 0 " represents no risk) etc..
Step A2, the event title and the corresponding event attribute of each event title of each history event data are determined.
Wherein, event title can represent the event content of corresponding history event data, as event entitled " withdrawal ",
" deposit " etc..Event attribute is the correlative detail information of corresponding history event data, right such as event title " withdrawal "
The event attribute answered may include withdrawal amount, time of withdrawing the money, withdrawal place, operation channel, IP address of withdrawal equipment etc..Each
History event data has unique event title and at least one event attribute.
Step A3, the first event title for meeting preset rules and the corresponding first event of each first event title are filtered out
Attribute is combined, and obtains the corresponding user behavior data of history event data.
Specifically, can first determine that the title index value and the corresponding event attribute of each event title of each event title
ATTRIBUTE INDEX value filter out first event title and each and then according to title index value, ATTRIBUTE INDEX value and preset rules
The corresponding first event attribute of one event title is combined.Wherein, preset rules include title index value and the first default threshold
The rule of size relation between the rule and ATTRIBUTE INDEX value and the second preset threshold of size relation between value.
Title index value includes the accounting of event title.For example, in the specified quantity history event data got,
Including event title A, B, then the accounting of event title is the ratio and thing that event title A accounts for all event title sums
Part title B accounts for the ratio of all event title sums.
ATTRIBUTE INDEX value include the null value accounting of event attribute, the counting of event attribute value, event attribute value dispersion,
Event attribute value concentration class, event attribute IV (information value, the value of information) etc..Wherein, the null value of event attribute
Accounting refers to that in the specified quantity history event data got, event attribute is that the quantity of null value accounts for all event attributes
Ratio;Event attribute value counts the number for referring to event attribute unique value, for example, for event attribute " operation channel ", packet
Tri- values of APP, PC, WAP are included, then the event attribute value is counted as 3.
For example, preset rules are as follows: event title accounting≤a1, event attribute null value accounting≤a2, event attribute IV >=a3.
Therefore, satisfaction rule is filtered out in specified quantity history event data, and " event title accounting≤a1, event attribute null value account for
It is combined than≤a2 and event attribute IV >=a3 " first event title and first event attribute, can be obtained at least one
User behavior data.First event title and the combination of first event attribute are unlimited, optionally, can successively combine the first thing
Part title and first event attribute, such as: event title+event attribute 1+ event attribute 2+ ...+event attribute k.
Step A4, according to the Time To Event of history event data, user behavior data is ranked up, obtains user
Behavior sequence data.
Step A5, the corresponding second risk label of user behavior sequence data is determined according to the first risk label;And it will use
Family behavior sequence data and its corresponding second risk label are determined as sample data.
It wherein, can basis when determining the corresponding second risk label of user behavior sequence data according to the first risk label
The type and its corresponding quantity of the first risk label determines in specified quantity history event data.It is exemplified below two kinds really
Determine mode:
Mode one, in the specified quantity history event data of user, at least one represents risk data if it exists
First risk label, it is determined that the corresponding second risk label of the user behavior sequence data of the user is to represent risk data
Label.
For example, in corresponding M history event data, representing the first of risk data including 1 for a certain user
Risk label " black " and a the first risk label " white " for representing devoid of risk data of M-1, then can determine user's row of the user
It is " black " for the corresponding second risk label of sequence data.
Mode two, in the specified quantity history event data of user, if representing the first risk label of risk data
Accounting reach preset threshold, it is determined that the corresponding second risk label of the user behavior sequence data of the user be represent risk
The label of data.
For example, in corresponding M history event data, representing the first of risk data including n for a certain user
Risk label " black " and a the first risk label " white " for representing devoid of risk data of M-n, if accounting value n/ (M-n) reaches pre-
If threshold value, then it can determine that the corresponding second risk label of the user behavior sequence data of the user is " black ";Conversely, if accounting value
N/ (M-n) is not up to preset threshold, then can determine that the corresponding second risk label of the user behavior sequence data of the user is
" white ".
It illustrates how to obtain sample data below by way of a concrete scene embodiment.
In a concrete scene embodiment, it is assumed that get a certain user M history event data and its corresponding thing
Part title, event attribute, the first risk label are as shown in table 1 below.It should be noted that as space is limited, in table 1 only symbolically
Show 3 history event datas of the user.Wherein, when the first risk label is " white ", this history event data is indicated
It is not belonging to risk data;When first risk label is " black ", indicate that this history event data belongs to risk data.Event attribute
Including exchange hour, transaction amount, loco and operation channel.
Table 1
|
History event data 1 |
History event data 2 |
History event data 3 |
Event title |
It withdraws the money |
Deposit |
It withdraws the money |
Attribute 1: exchange hour |
10:00 |
—— |
12:00 |
Attribute 2: transaction amount |
1000 yuan |
2000 yuan |
1000 yuan |
Attribute 3: loco |
Beijing |
—— |
—— |
Attribute 4: operation channel |
The end PC |
Cell phone client |
—— |
Risk label |
It is black |
It is white |
It is white |
In the present embodiment, it is assumed that the title index value of event title is event title accounting, the ATTRIBUTE INDEX of event attribute
Value includes that the null value accounting of event attribute and event attribute value count.
As seen from Table 1, in history event data 1, history event data 2 and history event data 3, historical events number
Event according to 1 and history event data 3 is entitled " withdrawal ", and the event of history event data 2 is entitled " deposit ", then event
The accounting of title " withdrawal " is 67%, and the accounting of event title " deposit " is 33%.
For event title " withdrawal ", the value sum of corresponding event attribute is 8 (i.e. event title " withdrawal " correspondences
The sum of the number of event attribute), due in the corresponding event attribute of event title " withdrawal ", the transaction of history event data 3
Place and operation channel are null value (it is 2 that i.e. event attribute, which is the number of null value), therefore under event title " withdrawal ", event category
Property null value accounting be 2/8=25%.Further, since under event title " withdrawal ", history event data 1 and historical events number
It is identical according to 3 transaction amount, therefore the corresponding event attribute value of event title " withdrawal " is counted as 5 (i.e. event title " takes
The number of unique value of the corresponding event attribute of money ").
For event title " deposit ", the value sum of corresponding event attribute is 4 (i.e. event title " deposit " correspondences
The sum of the number of event attribute), due in the corresponding event attribute of event title " deposit ", the transaction of history event data 2
Time and loco are null value (it is 2 that i.e. event attribute, which is the number of null value), therefore under event title " deposit ", event
The null value accounting of attribute is 2/4=50%, and event attribute value is counted as 2 (the i.e. corresponding event attributes of event title " deposit "
Unique value number).
In the present embodiment, it is assumed that preset rules are as follows: event title accounting >=60%, event attribute null value accounting≤30%,
And event attribute value counts >=3.It therefore meets the first event title and first event attribute of preset rules are event name
Claim " withdrawal " and its corresponding event attribute.Then, it by after first event title and first event combinations of attributes, can be used
Family behavioral data is as follows: withdrawal+10:00/12:00+1000 member+Beijing end+PC.If the user behavior data for obtaining user includes
When multiple, multiple user behavior datas are ranked up according to chronological order, user behavior sequence data can be obtained.This
In embodiment, due to only including a user behavior data, this user behavior data is user behavior sequence data.
In the present embodiment, at least one risk label for representing risk data if it exists, it is determined that user's row of the user
It is the label for representing risk data for the corresponding risk label of sequence data.Since in table 1, history event data 1 is corresponding
Risk label is " black ", therefore can determine that the corresponding risk label of the user behavior sequence data of the user is " black ".
To sum up, the user behavior sequence data " withdrawal+10:00/12:00+1000 member+Beijing end+PC " that gets and its
Corresponding risk label " black " is sample data.
In one embodiment, determine whether the behavioral data of target user is risk number according to LSTM behavior sequence model
According to when, the first history event data of the specified quantity of target user can be obtained first, then according to the first history event data
Determine the first user behavior sequence data of target user, then using the first user behavior sequence data as LSTM behavior sequence mould
The input of type, to determine whether the behavioral data of target user is risk data.
In the present embodiment, the first user behavior sequence of target user can be determined according to the step A1-A5 in above-described embodiment
Column data, it is no longer repeated herein.
It, can be first with LSTM row when determining whether the behavioral data of target user is risk data in one embodiment
It gives a mark for series model to the first user behavior sequence data, obtains the corresponding risk point of the first user behavior sequence data
Value, then determines whether the behavioral data of target user is risk data according to the risk score value.
Specifically, further proof of identity is carried out to target user, if identity school if risk score value is higher than default score value
The result tested is that verification passes through, it is determined that the behavioral data of target user is risk data.If risk score value is less than or equal to pre-
If score value, it is determined that the behavioral data of target user is not risk data.
In the present embodiment, the modes such as input password, fingerprint, voice, face head portrait can be used, identity is carried out to target user
Verification, to verify out whether current behavioral data is that I is operating.Specific proof of identity composition has been the prior art,
This is repeated no more.
To sum up, the specific embodiment of this theme is described.Other embodiments are in the appended claims
In range.In some cases, the movement recorded in detail in the claims can execute and still in a different order
Desired result may be implemented.In addition, process depicted in the drawing not necessarily requires the particular order shown or continuous suitable
Sequence, to realize desired result.In some embodiments, multitasking and parallel processing can be advantageous.
The above are the data Risk Forecast Methods that this specification one or more embodiment provides, and are based on same thinking,
This specification one or more embodiment also provides a kind of data risk profile device.
Fig. 2 is according to a kind of schematic block diagram of data risk profile device of one embodiment of this specification, such as Fig. 2 institute
Show, data risk profile device 200 includes:
Module 210 is obtained, for obtaining for training LSTM behavior sequence model, user behavior including multiple users
The sample data of sequence data;Wherein, user behavior sequence data includes multiple orderly user behavior datas, user behavior number
It is constituted according to by the event title and event attribute of the history event data of user;
Training module 220, for according to sample data training LSTM behavior sequence model;
Determining module 230, for determining whether the behavioral data of target user is risk according to LSTM behavior sequence model
Data.
In one embodiment, obtaining module 210 includes:
First acquisition unit, the history event data of the specified quantity for obtaining user;Wherein, each history event data
It is corresponding with respective first risk label;
First determination unit, for determining the event title and the corresponding event category of each event title of each history event data
Property;
Screening unit, for filtering out the first event title and each first event title corresponding that meet preset rules
One event attribute is combined, and obtains the corresponding user behavior data of history event data;
Sequencing unit is ranked up user behavior data for the Time To Event according to history event data, obtains
To user behavior sequence data;
Second determination unit, for determining the corresponding second risk mark of user behavior sequence data according to the first risk label
Label;And user behavior sequence data and its corresponding second risk label are determined as sample data.
In one embodiment, screening unit is also used to:
Determine the title index value of each event title;And determine the ATTRIBUTE INDEX of the corresponding event attribute of each event title
Value;
According to title index value, ATTRIBUTE INDEX value and preset rules, first event title and each first event name are filtered out
Corresponding first event attribute is claimed to be combined;Wherein, preset rules include between title index value and the first preset threshold
The rule of size relation between the rule and ATTRIBUTE INDEX value and the second preset threshold of size relation.
In one embodiment, title index value includes the accounting of event title;ATTRIBUTE INDEX value includes event attribute
Null value accounting, the counting of event attribute value, in event attribute value dispersion, event attribute value concentration class at least one of.
In one embodiment, determining module 230 includes:
Second acquisition unit, the first history event data of the specified quantity for obtaining target user;
Third determination unit, for determining the first user behavior sequence of target user according to the first history event data
Data;
4th determination unit, for using the first user behavior sequence data as the input of LSTM behavior sequence model, with
Whether the behavioral data for determining target user is risk data.
In one embodiment, the 4th determination unit is also used to:
It is given a mark using LSTM behavior sequence model to the first user behavior sequence data, obtains the first user behavior sequence
The corresponding risk score value of column data;
Whether the behavioral data that target user is determined according to risk score value is risk data.
In one embodiment, the 4th determination unit is also used to:
If risk score value is higher than default score value, proof of identity further is carried out to target user;
If the result of proof of identity is that verification passes through, it is determined that the behavioral data of target user is risk data.
It should be understood that above-mentioned data risk profile device can be used to realize previously described number
According to Risk Forecast Method, datail description therein should be described with method part above it is similar, it is cumbersome to avoid, do not go to live in the household of one's in-laws on getting married separately herein
It states.
Using the device of this specification one or more embodiment, by obtaining for training LSTM behavior sequence model
, the sample data of user behavior sequence data including multiple users (wherein, user behavior sequence data include it is multiple orderly
User behavior data, and user behavior data is made of the event title and event attribute of the history event data of user), into
And the sample data training LSTM behavior sequence model obtained is utilized, and determine target user's according to LSTM behavior sequence model
Whether behavioral data is risk data.As it can be seen that the technical solution can be obtained automatically by event title and event attribute structure
At user behavior data, cost of labor and time cost needed for obtaining user behavior data are greatly reduced, and in training
The event attribute of history event data is combined when LSTM behavior sequence model, to improve the identification energy to risk data
Power.
Based on same thinking, this specification one or more embodiment also provides a kind of data risk profile equipment, such as
Shown in Fig. 3.Data risk profile equipment can generate bigger difference because configuration or performance are different, may include one or one
A above processor 301 and memory 302 can store one or more storage application programs in memory 302
Or data.Wherein, memory 302 can be of short duration storage or persistent storage.The application program for being stored in memory 302 can wrap
One or more modules (diagram is not shown) are included, each module may include to a series of in data risk profile equipment
Computer executable instructions.Further, processor 301 can be set to communicate with memory 302, in data risk profile
The series of computation machine executable instruction in memory 302 is executed in equipment.Data risk profile equipment can also include one
Or more than one power supply 303, one or more wired or wireless network interfaces 304, one or more input and output
Interface 305, one or more keyboards 306.
Specifically in the present embodiment, data risk profile equipment includes memory and one or more journey
Sequence, perhaps more than one program is stored in memory and one or more than one program may include one for one of them
Or more than one module, and each module may include refers to executable to the series of computation machine in data risk profile equipment
Enable, and be configured to be executed this by one or more than one processor or more than one program include for carry out with
Lower computer executable instructions:
Obtain for training LSTM behavior sequence model, user behavior sequence data including multiple users sample number
According to;Wherein, the user behavior sequence data includes multiple orderly user behavior datas, and the user behavior data is by described
The event title and event attribute of the history event data of user are constituted;
According to the sample data training LSTM behavior sequence model;
According to the LSTM behavior sequence model, determine whether the behavioral data of target user is risk data.
Optionally, computer executable instructions when executed, can also make the processor:
Obtain the history event data of the specified quantity of the user;Wherein, each history event data is corresponding
There is respective first risk label;
Determine the event title and the corresponding event attribute of each event title of each history event data;
Filter out the first event title for meeting preset rules and the corresponding first event category of each first event title
Property is combined, and obtains the corresponding user behavior data of the history event data;
According to the Time To Event of the history event data, the user behavior data is ranked up, is used
Family behavior sequence data;
The corresponding second risk label of the user behavior sequence data is determined according to the first risk label;And it will
The user behavior sequence data and its corresponding second risk label are determined as the sample data.
Optionally, computer executable instructions when executed, can also make the processor:
Determine the title index value of each event title;And determine the corresponding event category of each event title
The ATTRIBUTE INDEX value of property;
According to the title index value, the ATTRIBUTE INDEX value and the preset rules, the first event name is filtered out
Claim and the corresponding first event attribute of each first event title is combined;Wherein, the preset rules include institute
State the regular and described ATTRIBUTE INDEX value and the second preset threshold of the size relation between title index value and the first preset threshold
Between size relation rule.
Optionally, the title index value includes the accounting of the event title;The ATTRIBUTE INDEX value includes the thing
The null value accounting of part attribute, the counting of event attribute value, in event attribute value dispersion, event attribute value concentration class extremely
One item missing.
Optionally, computer executable instructions when executed, can also make the processor:
Obtain the first history event data of the specified quantity of the target user;
According to first history event data, the first user behavior sequence data of the target user is determined;
Using the first user behavior sequence data as the input of the LSTM behavior sequence model, with the determination mesh
Whether the behavioral data for marking user is the risk data.
Optionally, computer executable instructions when executed, can also make the processor:
It is given a mark using the LSTM behavior sequence model to the first user behavior sequence data, obtains described
The corresponding risk score value of one user behavior sequence data;
Whether the behavioral data that the target user is determined according to the risk score value is the risk data.
Optionally, computer executable instructions when executed, can also make the processor:
If the risk score value is higher than default score value, proof of identity further is carried out to the target user;
If the result of the proof of identity is that verification passes through, it is determined that the behavioral data of the target user is the risk
Data.
This specification one or more embodiment also proposed a kind of computer readable storage medium, this is computer-readable to deposit
Storage media stores one or more programs, which includes instruction, and it is included multiple application programs which, which works as,
Electronic equipment when executing, the electronic equipment can be made to execute above-mentioned data Risk Forecast Method, and be specifically used for executing:
Obtain for training LSTM behavior sequence model, user behavior sequence data including multiple users sample number
According to;Wherein, the user behavior sequence data includes multiple orderly user behavior datas, and the user behavior data is by described
The event title and event attribute of the history event data of user are constituted;
According to the sample data training LSTM behavior sequence model;
According to the LSTM behavior sequence model, determine whether the behavioral data of target user is risk data.
System, device, module or the unit that above-described embodiment illustrates can specifically realize by computer chip or entity,
Or it is realized by the product with certain function.It is a kind of typically to realize that equipment is computer.Specifically, computer for example may be used
Think personal computer, laptop computer, cellular phone, camera phone, smart phone, personal digital assistant, media play
It is any in device, navigation equipment, electronic mail equipment, game console, tablet computer, wearable device or these equipment
The combination of equipment.
For convenience of description, it is divided into various units when description apparatus above with function to describe respectively.Certainly, implementing this
The function of each unit can be realized in the same or multiple software and or hardware when specification one or more embodiment.
It should be understood by those skilled in the art that, this specification one or more embodiment can provide for method, system or
Computer program product.Therefore, complete hardware embodiment can be used in this specification one or more embodiment, complete software is implemented
The form of example or embodiment combining software and hardware aspects.Moreover, this specification one or more embodiment can be used one
It is a or it is multiple wherein include computer usable program code computer-usable storage medium (including but not limited to disk storage
Device, CD-ROM, optical memory etc.) on the form of computer program product implemented.
This specification one or more embodiment is referring to according to the method for the embodiment of the present application, equipment (system) and meter
The flowchart and/or the block diagram of calculation machine program product describes.It should be understood that can be realized by computer program instructions flow chart and/
Or the combination of the process and/or box in each flow and/or block and flowchart and/or the block diagram in block diagram.It can
These computer program instructions are provided at general purpose computer, special purpose computer, Embedded Processor or other programmable datas
The processor of equipment is managed to generate a machine, so that holding by the processor of computer or other programmable data processing devices
Capable instruction generates for realizing in one or more flows of the flowchart and/or one or more blocks of the block diagram
The device of specified function.
These computer program instructions, which may also be stored in, is able to guide computer or other programmable data processing devices with spy
Determine in the computer-readable memory that mode works, so that it includes referring to that instruction stored in the computer readable memory, which generates,
Enable the manufacture of device, the command device realize in one box of one or more flows of the flowchart and/or block diagram or
The function of being specified in multiple boxes.
These computer program instructions also can be loaded onto a computer or other programmable data processing device, so that counting
Series of operation steps are executed on calculation machine or other programmable devices to generate computer implemented processing, thus in computer or
The instruction executed on other programmable devices is provided for realizing in one or more flows of the flowchart and/or block diagram one
The step of function of being specified in a box or multiple boxes.
In a typical configuration, calculating equipment includes one or more processors (CPU), input/output interface, net
Network interface and memory.
Memory may include the non-volatile memory in computer-readable medium, random access memory (RAM) and/or
The forms such as Nonvolatile memory, such as read-only memory (ROM) or flash memory (flash RAM).Memory is computer-readable medium
Example.
Computer-readable medium includes permanent and non-permanent, removable and non-removable media can be by any method
Or technology come realize information store.Information can be computer readable instructions, data structure, the module of program or other data.
The example of the storage medium of computer includes, but are not limited to phase change memory (PRAM), static random access memory (SRAM), moves
State random access memory (DRAM), other kinds of random access memory (RAM), read-only memory (ROM), electric erasable
Programmable read only memory (EEPROM), flash memory or other memory techniques, read-only disc read only memory (CD-ROM) (CD-ROM),
Digital versatile disc (DVD) or other optical storage, magnetic cassettes, tape magnetic disk storage or other magnetic storage devices
Or any other non-transmission medium, can be used for storage can be accessed by a computing device information.As defined in this article, it calculates
Machine readable medium does not include temporary computer readable media (transitory media), such as the data-signal and carrier wave of modulation.
It should also be noted that, the terms "include", "comprise" or its any other variant are intended to nonexcludability
It include so that the process, method, commodity or the equipment that include a series of elements not only include those elements, but also to wrap
Include other elements that are not explicitly listed, or further include for this process, method, commodity or equipment intrinsic want
Element.In the absence of more restrictions, the element limited by sentence "including a ...", it is not excluded that including described want
There is also other identical elements in the process, method of element, commodity or equipment.
This specification one or more embodiment can computer executable instructions it is general on
It hereinafter describes, such as program module.Generally, program module includes executing particular task or realization particular abstract data type
Routine, programs, objects, component, data structure etc..The application can also be practiced in a distributed computing environment, at these
In distributed computing environment, by executing task by the connected remote processing devices of communication network.In distributed computing
In environment, program module can be located in the local and remote computer storage media including storage equipment.
All the embodiments in this specification are described in a progressive manner, same and similar portion between each embodiment
Dividing may refer to each other, and each embodiment focuses on the differences from other embodiments.Especially for system reality
For applying example, since it is substantially similar to the method embodiment, so being described relatively simple, related place is referring to embodiment of the method
Part explanation.
The foregoing is merely this specification one or more embodiments, are not limited to this specification.For this
For the technical staff of field, this specification one or more embodiment can have various modifications and variations.It is all in this specification one
Any modification, equivalent replacement, improvement and so within the spirit and principle of a or multiple embodiments, should be included in this explanation
Within the scope of the claims of book one or more embodiment.