CN110162939A - Man-machine recognition methods, equipment and medium - Google Patents

Man-machine recognition methods, equipment and medium Download PDF

Info

Publication number
CN110162939A
CN110162939A CN201811248586.8A CN201811248586A CN110162939A CN 110162939 A CN110162939 A CN 110162939A CN 201811248586 A CN201811248586 A CN 201811248586A CN 110162939 A CN110162939 A CN 110162939A
Authority
CN
China
Prior art keywords
man
machine
terminal device
probability
prediction probability
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN201811248586.8A
Other languages
Chinese (zh)
Other versions
CN110162939B (en
Inventor
范小龙
张西文
陈良文
曾键
钟子檀
张谋辉
杨正朋
沈维杰
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Tencent Technology Shenzhen Co Ltd
Original Assignee
Tencent Technology Shenzhen Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Tencent Technology Shenzhen Co Ltd filed Critical Tencent Technology Shenzhen Co Ltd
Priority to CN201811248586.8A priority Critical patent/CN110162939B/en
Publication of CN110162939A publication Critical patent/CN110162939A/en
Application granted granted Critical
Publication of CN110162939B publication Critical patent/CN110162939B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00Pattern recognition
    • G06F18/20Analysing
    • G06F18/24Classification techniques
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31User authentication

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Artificial Intelligence (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Evolutionary Biology (AREA)
  • Evolutionary Computation (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

Disclose man-machine recognition methods, equipment and medium.The man-machine recognition methods includes: to receive the initial data acquired by the terminal device in response to the man-machine identification request from terminal device;The feature of multiple dimensions of the first quantity is extracted from the initial data;The feature of multiple dimensions of first quantity is separately input into multiple personal behavior models of the second quantity, and exports multiple man-machine sub- probability of prediction of the second quantity from multiple personal behavior models of second quantity;Based on the multiple man-machine sub- probability of prediction, man-machine prediction probability is determined;And it is based on the man-machine prediction probability, obtain the man-machine recognition result about the operation at the terminal device.

Description

Man-machine recognition methods, equipment and medium
Technical field
This disclosure relates to man-machine identification field.More specifically to man-machine recognition methods, equipment and medium.
Background technique
Man-machine identification is a kind of for executing the safety measure of authentication.Man-machine identifying system usually may require that user is complete It is normal users with prove execution operation, rather than one attempts to shoot password-protected account at a simple test The computer at family.
Current man-machine identification method is mainly using identifying code mode, including inputs character, understands the meaning of the question, picture point It hits, window sliding etc..These man-machine identification methods belong to the man-machine identification method for having perception.This man-machine identification for having perception Mode needs to be additionally carried out input verifying by user in the case where user can appreciate that.Therefore, such problems is, If being arranged simply by identifying code for the considerations of reducing user's operation complexity, which is readily able to break through. But if for the considerations of breaking through the identifying code is not easy identifying code is arranged complicated, such as user is allowed to go to calculate mathematics Topic, or see that figure clicks the picture etc. of designated state, then user's operation complexity will greatly improve and be unfavorable for practical application.
In addition, traditional malice machine recognition scheme, is mainly based upon the strategy generatings such as IP resource, frequent operation.But Present black Industrial Resources are more and more abundant, are very easy to break through these strategy limitations.
Summary of the invention
In view of above situation, it is intended to provide a kind of man-machine recognition methods, equipment and Jie of unaware, Behavior-based control class Matter can be realized the man-machine identification of high accuracy and be effectively prevented the breakthrough of black industry.
According to one aspect of the disclosure, a kind of man-machine recognition methods is provided, comprising: in response to from terminal device Man-machine identification request, receives the initial data acquired by the terminal device;The first quantity is extracted from the initial data The feature of multiple dimensions;The feature of multiple dimensions of first quantity is separately input into multiple user behaviors of the second quantity Model, and from multiple personal behavior models of second quantity export the second quantity multiple man-machine sub- probability of prediction;Base In the multiple man-machine sub- probability of prediction, man-machine prediction probability is determined;And it is based on the man-machine prediction probability, it obtains about institute State the man-machine recognition result of the operation at terminal device.
In addition, in the man-machine recognition methods according to the embodiment of the present disclosure, multiple user behavior moulds of second quantity Type is that different supervised classification algorithms is based respectively on about same sample database come obtained from training.
In addition, in the man-machine recognition methods according to the embodiment of the present disclosure, after the step of determining man-machine prediction probability, Further comprise: the man-machine prediction probability and the terminal device are stored in association in a database.
In addition, in the man-machine recognition methods according to the embodiment of the present disclosure, after the step of determining man-machine prediction probability, Further comprise: searching for from the database and obtain the man-machine prediction probability of multiple history of the terminal device;And it will Current man-machine prediction probability and the man-machine prediction probability of the multiple history is input to a weighted model, and with the weighted model Output update the man-machine prediction probability.
In addition, the man-machine recognition methods according to the embodiment of the present disclosure further comprises: described in library updates based on the data Sample database;And with updated the multiple personal behavior model of sample database re -training.
In addition, extracting the first number from the initial data in the man-machine recognition methods according to the embodiment of the present disclosure After the step of feature of multiple dimensions of amount, further comprise: enhancing processing being executed to the feature extracted, to obtain third The feature of multiple dimensions of quantity.
In addition, the man-machine recognition methods according to the embodiment of the present disclosure further comprises: in response to the people from terminal device Machine identification request, Xiang Suoshu terminal device sends a token, wherein the man-machine prediction probability of the token and the terminal device It is associated.
According to another aspect of the present disclosure, provide a kind of man-machine identification equipment, comprising: communication unit, in response to Man-machine identification request from terminal device, receives the initial data acquired by the terminal device;Extraction unit, for described The feature of multiple dimensions of the first quantity is extracted in initial data;And processing unit, for by the multiple of first quantity The feature of dimension is separately input into multiple personal behavior models of the second quantity, and from multiple user's rows of second quantity Multiple man-machine sub- probability of prediction of the second quantity are exported for model, are based on the multiple man-machine sub- probability of prediction, are determined man-machine pre- Probability is surveyed, and is based on the man-machine prediction probability, obtains the man-machine recognition result about the operation at the terminal device.
In addition, the processing unit further comprises in the man-machine identification equipment according to the embodiment of the present disclosure: modeling is single Member obtains the multiple of second quantity for being based respectively on different supervised classification algorithms about same sample database to train Personal behavior model.
In addition, the man-machine identification equipment according to the embodiment of the present disclosure further comprises: storage unit, for storing a data Library, and wherein, the man-machine prediction probability and the terminal device are stored in association in the database.
In addition, the man-machine identification equipment according to the embodiment of the present disclosure further comprises: historical query unit is used for from described The man-machine prediction probability of multiple history of the terminal device is searched for and obtained in database, and wherein it is described processing further by It is configured that and current man-machine prediction probability and the man-machine prediction probability of the multiple history is input to a weighted model, and with institute The output of weighted model is stated to update the man-machine prediction probability.
In addition, the man-machine identification equipment according to the embodiment of the present disclosure further comprises: updating unit, for being based on the number The sample database is updated according to library;And wherein the modeling unit is configured to: being instructed again with updated sample database Practice the multiple personal behavior model.
In addition, the man-machine identification equipment according to the embodiment of the present disclosure further comprises: feature enhancement unit, for extraction Feature out executes enhancing processing, to obtain the feature of multiple dimensions of third quantity.
In addition, the communication unit is configured in the man-machine recognition methods according to the embodiment of the present disclosure: ringing Ying Yu is requested from the man-machine identification of terminal device, and Xiang Suoshu terminal device sends a token, wherein the token and the end The man-machine prediction probability of end equipment is associated.
According to another aspect of the present disclosure, provide a kind of man-machine identification equipment, comprising: communication unit, in response to Man-machine identification request from terminal device, receives the initial data acquired by the terminal device;Storage unit, at it Upper storage computer program;Processing unit, for when loaded and executed, performing the steps of from described original The feature of multiple dimensions of the first quantity is extracted in data;The feature of multiple dimensions of first quantity is separately input into Multiple personal behavior models of two quantity, and the more of the second quantity are exported from multiple personal behavior models of second quantity Personal-machine predicts sub- probability;Multiple man-machine sub- probability of prediction based on second quantity, determine man-machine prediction probability;And base In the man-machine prediction probability, the man-machine recognition result about the operation at the terminal device is obtained.
According to another aspect of the present disclosure, a kind of computer readable recording medium is provided, stores computer program thereon, For when executing the computer program by processing unit, performing the steps of in response to the man-machine knowledge from terminal device It does not invite and asks, receive the initial data acquired by the terminal device;Multiple dimensions of the first quantity are extracted from the initial data The feature of degree;The feature of multiple dimensions of first quantity is separately input into multiple personal behavior models of the second quantity, And multiple man-machine sub- probability of prediction of the second quantity are exported from multiple personal behavior models of second quantity;Based on described Multiple man-machine sub- probability of prediction of second quantity, determine man-machine prediction probability;And it is based on the man-machine prediction probability, it is closed The man-machine recognition result of operation at the terminal device.
In man-machine recognition methods according to an embodiment of the present disclosure and equipment, executed by the way of non-perception man-machine Identification.That is, in the case where user is unaware of, by the feature at the terminal device of acquisition, to judge the behaviour at terminal device Whether be normal users operation.Therefore, need to calculate identifying code with user in the prior art to execute the side of man-machine identification Formula is compared, it is no longer necessary to which user executes any additional operation, to farthest reduce user's operation complexity.This Outside, in man-machine recognition methods according to an embodiment of the present disclosure and equipment, the raw data acquisition based on plurality of classes is multiple The feature of dimension, and features inputted to personal behavior model and multiple dimensions.In other words, user's row in the disclosure For model is the feature of multiple dimensions acquired for the initial data based on plurality of classes and the model established.With existing skill It is compared in art using only the scheme of the other behavioral data of unitary class (for example, keyboard, mouse action data) to predict, according to this public affairs The man-machine recognition methods for the embodiment opened due to consider larger class data and more various dimensions feature to accuracy more It is high.In addition, in man-machine recognition methods according to an embodiment of the present disclosure, using based on a variety of of different supervised classification algorithms Personal behavior model executes prediction respectively, and integrates the result of this multiple and different model to obtain final man-machine prediction result. Compared with the scheme predicted in the prior art using only single model, the precision of prediction can be further increased.Also, in root According in the man-machine recognition methods of embodiment of the disclosure and equipment, iterative user row can be continuously updated based on the database For model, therefore personal behavior model can more effectively cope with the quick variation of black industry, thus even if in black industry Also accurate man-machine recognition result can be obtained in fast-changing situation.Also, according to an embodiment of the present disclosure man-machine In recognition methods and equipment, can by this man-machine prediction probability further combined with history man-machine prediction probability to obtain most Whole man-machine prediction probability, can further increase the accuracy of prediction.
Detailed description of the invention
Fig. 1 is to show the schematic diagram of the application environment of embodiment of the disclosure;
Fig. 2 is to show the flow chart of man-machine recognition methods according to an embodiment of the present disclosure;
Fig. 3 is to show the flow chart of man-machine recognition methods according to another embodiment of the present disclosure;
Fig. 4 is to show the flow chart of the man-machine recognition methods of the another embodiment according to the disclosure;
Fig. 5 is to show the functional block diagram of man-machine identification equipment according to an embodiment of the present disclosure;
Fig. 6 is to show the functional block diagram of man-machine identification equipment according to another embodiment of the present disclosure;
Fig. 7 is to show the functional block diagram of the man-machine identification equipment of the another embodiment according to the disclosure;
Fig. 8 is the schematic diagram of the data flow between the server and terminal device shown according to the disclosure;
Fig. 9 shows one as hardware entities according to the device of the synthesis credit score for calculating equipment of the disclosure Example;And
Figure 10 shows the schematic diagram of computer readable recording medium according to an embodiment of the present disclosure.
Specific embodiment
Each preferred embodiment of the disclosure is described below with reference to accompanying drawings.It provides referring to the drawings Description, to help the understanding to the example embodiment of the disclosure as defined by appended claims and their equivalents.It includes side The various details of assistant's solution, but they can only be counted as illustratively.Therefore, it would be recognized by those skilled in the art that Embodiment described herein can be made various changes and modifications, without departing from the scope and spirit of the disclosure.Moreover, in order to Keep specification more clear succinct, by omission pair it is well known that the detailed description of function and construction.
Firstly, briefly describing the application environment of embodiment of the disclosure.As shown in Figure 1, server 10, server 20 pass through Network 40 is connected to multiple terminal devices 30.The multiple terminal device 30 can be the equipment for actually carrying out various businesses. Although terminal device 30 has uniformly been shown as mobile phone in Fig. 1, the disclosure is not limited to that.Those skilled in the art can To understand, the equipment that terminal device 30 can also be any other type, such as PDA (personal digital assistant), tablet computer, platform Formula computer etc..Server 10 can be the equipment for man-machine identification described below.Server 20 can be and the clothes Other servers of the business interaction of device 10.For example, server 20 can be and described below inquire man-machine identification to server 10 As a result business air control background server.The network 40 can be any kind of wired or wireless network, such as internet. It should be appreciated that the quantity of server 10 shown in FIG. 1, server 20 and terminal device 30 is schematical, rather than limit Property.
Next, by the man-machine recognition methods referring to Fig. 2 description according to a kind of embodiment of the disclosure.The man-machine identification Method can be applied to server 10 shown in Fig. 1.As shown in Fig. 2, the man-machine recognition methods includes the following steps.
Firstly, requesting in step S201 in response to the man-machine identification from terminal device, reception is adopted by the terminal device The initial data of collection.Initial data is the data collected in real time on the terminal device.Specifically, when in terminal device Side executes the operation for needing to carry out man-machine identification, when such as logging in some Bank Account Number, the operation to terminal equipment side is needed to carry out Man-machine identification judges that the operation is the operation executed by normal users, or executed by malice machine (that is, abnormal user) Operation.At this point, terminal device can issue man-machine identification request to server, and man-machine identification request front and back predetermined period will be issued The data of inherent terminal device acquisition are reported to server.The initial data includes the data of plurality of classes.For example, the original Beginning data not only may include by terminal device front-end collection a variety of behavioral datas, but also can further include about The local attribute data and basic environment data of the terminal device.For example, behavioral data may include the keyboard of terminal device Data, mouse data etc., local attribute data may include the attribute data about terminal device itself, such as terminal device type Using number of days etc., basic environment data may include for number, stem version data, underlying hardware data, software data, equipment IP address, the WIFI data accessed etc. of terminal device access internet.
Next, extracting the feature of multiple dimensions of the first quantity from the initial data in step S202.As above Described in, initial data may include the data of plurality of classes.The quantity of the plurality of classes can be the 4th quantity.First number Amount and the 4th quantity are natural numbers independent of each other.For example, the first quantity is the natural number more than or equal to 1.The tool of first quantity Body numerical value will be depending on the operation at different application scenarios and terminal device.4th quantity is the nature more than or equal to 2 Number.The specific value of 4th quantity will depend on different application scenarios and preset.For the data of each classification, all It can be from the feature for wherein extracting multiple dimensions.
Initial data is pre-processed first.Specifically, it is described pretreatment may include data it is isometric filling and it is different Regular data cleaning etc..Then, for executing feature extraction processing by pretreated data.For example, extracting the processing of feature It may include carrying out numeralization to nonnumeric feature and operation being normalized etc. to a variety of data.It executes at normalization Reason.For example, following formula (1) or (2) Lai Zhihang normalized can be passed through.
F (x)=(a+x)/(b+x) (1)
Wherein, F (x) indicates the feature obtained after normalized, and x indicates initial data.A and b respectively indicates normalization Parameter, can according to different data fields index be adjusted.
For example, by the way that the initial data x of number of days will be used to be input to above formula as equipment, between output 0~1 Value, as the feature for being input to subsequent user behavior model.Certainly, different functions can be used for different initial data It is normalized, and method for normalizing is also not necessarily limited to enumerated above two kinds.
Additionally, there are the data acquired in the predetermined period are few, and then the situation that extractible feature is few.However, A small amount of feature is unfavorable for the processing of subsequent man-machine identification.Therefore, in this case, from the initial data After the step of feature of the middle multiple dimensions for extracting the first quantity, the method be may further include: to the spy extracted Sign executes enhancing processing, to obtain the feature (not shown) of multiple dimensions of third quantity.That is, extracting On the basis of the feature of multiple dimensions of first quantity, the feature of multiple dimensions of third quantity is extraly obtained.Third quantity It is greater than the natural number equal to 1.Therefore, it is handled by enhancing, it is total to obtain multiple dimensions that the first quantity adds third quantity The feature of degree, so as to extend feature obtained dimension quantity.In addition, it is necessary to, it is noted that respectively for from same The feature extracted in a kind of initial data of classification executes enhancing processing.
For example, the mode of data enhancing may include to behavior number for the behavioral data in the initial data According to being counted, to obtain various statistical natures.In addition, the mode of data enhancing can also include carrying out difference to behavioral data Operation.Furthermore the mode of data enhancing also may include that space-time multidimensional expands.For example, in the behavioral data of terminal device acquisition Including mouse data.The x of the cursor position of the display screen display for the middle terminal device that the mouse data obtains for multiple repairing weld, Y-coordinate.Other dimensions such as mobile speed, the angular speed of mouse can be further obtained by the multiple x of analysis, y-coordinate Feature.For example, being handled by feature enhancing, foundation characteristic can be tieed up in original 20 increases to 70 dimensional features.
Next, the feature of multiple dimensions of first quantity is separately input into the second quantity in step S203 Multiple personal behavior models, and the multiple man-machine pre- of the second quantity is exported from multiple personal behavior models of second quantity Survey sub- probability.Second quantity is independent of each other with first quantity.Second quantity is the nature more than or equal to 2 Number.The specific value of second quantity will depend on different application scenarios and preset.
It is pointed out here that multiple personal behavior models of second quantity are distinguished about same sample database Obtained from being trained based on different supervised classification algorithms.Supervised classification algorithm includes target variable (dependent variable, i.e. people Machine predicts sub- probability) and predictive variable (independent variable, that is, the multidimensional characteristic extracted) for predicting target variable.Here, people Machine predicts that sub- probability is the prediction result exported from each personal behavior model.A mould can be built by these variables Type, hence for a known predictive variable value, available corresponding target variable value.This model of repetition training, directly Scheduled accuracy can be reached on training dataset to it.Specifically, in embodiment of the disclosure, sample database includes Multidimensional characteristic and prediction probability known, as output dependent variable knowing, as input independent variable.For example, user behavior Model includes function corresponding with multidimensional characteristic and parameter etc..Training is to train those based on known independent variable and dependent variable Function and parameter.By the training learning process of algorithm, function and parameter are continuously adjusted, it is correct finally to find one group of realization Prediction result function and parameter.Once function and parameter determine, model has also been determined that.Then model is used for sample database Characteristic variable in addition, and then obtain corresponding prediction result.For example, the specific example of supervised classification algorithm includes: that gradient mentions Rise tree (Gradient Boosting Decision Tree, GBDT), convolutional neural networks (Convolutional Neural Network, CNN), logistic regression (Logistic Regression, LR), random forest (Random Forest, RF) etc..
For example, in the man-machine recognition methods according to the disclosure, the second quantity can be set to 3.I.e., it is possible to use Three personal behavior models execute man-machine behavior prediction.Gradient boosted tree, convolution is respectively adopted in these three personal behavior models Neural network and the method for random forest are trained to be based on sample database.Since these three personal behavior models are based respectively on not With method train, therefore even if the same or about characteristic variable of input, will also export different man-machine prediction Probability.
Certainly, the quantity of personal behavior model, i.e. the second quantity, are not limited in three.Those skilled in the art answers The understanding, the personal behavior model of any other quantity can also be applied similarly to the disclosure, and should be included in the disclosure In the range of.
Next, in step S204, multiple man-machine sub- probability of prediction based on second quantity determine that man-machine prediction is general Rate.That is, needing to the multiple man-machine pre- of the second quantity exported respectively by multiple personal behavior models of the second quantity Sub- probability is surveyed to be integrated to obtain man-machine recognition result to the end.For example, as a kind of possible embodiment, it can be to Multiple man-machine sub- probability of prediction of two quantity are averaged, and using calculated average value as to the man-machine recognition result of determination Man-machine prediction probability.
Then, in step S205, it is based on the man-machine prediction probability, obtains the people about the operation at the terminal device Machine recognition result.For example, can be by judging the numberical range of the man-machine prediction probability, to determine at the terminal device Operation whether be normal users operation.Specifically, when man-machine prediction probability is greater than a specific threshold, it is believed that terminal device The operation at place is the operation of abnormal user.When man-machine prediction probability is less than a specific threshold, it is believed that the operation at terminal device For the operation of normal users.
As can be seen that being executed by the way of non-perception in man-machine recognition methods according to an embodiment of the present disclosure Man-machine identification.That is, in the case where user is unaware of, by the feature at the terminal device of acquisition, to judge at terminal device Operation whether be normal users operation.Therefore, need to calculate identifying code with user in the prior art to execute man-machine identification Mode compare, it is no longer necessary to user executes any additional operation, to farthest reduce user's operation complexity. In addition, the raw data acquisition based on plurality of classes is more in man-machine recognition methods according to an embodiment of the present disclosure and equipment The feature of a dimension, and features inputted to personal behavior model and multiple dimensions.In other words, the user in the disclosure Behavior model is the feature of multiple dimensions acquired for the initial data based on plurality of classes and the model established.With it is existing It is compared in technology using only the scheme of the other behavioral data of unitary class (for example, keyboard, mouse action) to predict, according to the disclosure Embodiment man-machine recognition methods due to consider larger class data and more various dimensions feature to accuracy it is higher. In addition, in man-machine recognition methods according to an embodiment of the present disclosure, using a variety of use based on different supervised classification algorithms Family behavior model executes prediction respectively, and integrates the result of this multiple and different model to obtain final man-machine prediction result.With The scheme predicted in the prior art using only single model is compared, and the precision of prediction can be further increased.
In addition, calculating every time for the terminal device can also be stored as alternatively possible embodiment Man-machine prediction probability, the man-machine prediction history data as the terminal device.Specifically, Fig. 3 is shown according to this public affairs The man-machine recognition methods for another embodiment opened.The man-machine recognition methods includes the steps that being described above referring to Fig. 2 S201~S205.In addition to this, as shown in figure 3, being still further comprised according to the man-machine recognition methods of disclosed another embodiment Step S301.In step S301, the man-machine prediction probability and the terminal device are stored in association in a database. For example, the database can be human-computer behavior and the black library of abnormal environment.For the considerations of reducing amount of storage, will can only indicate different The man-machine prediction probability at common family is stored in the human-computer behavior and the black library of abnormal environment.That is, only when described man-machine When prediction probability indicates that the operation at the terminal device is not the operation of normal users, the processing of step S301 is just executed.
By the way that each calculated man-machine recognition result to be stored in the database, can to protect in database Hold all historical identification datas.Certainly, in addition to this, database can also receive the black data record in other sources, including different Chang Hangwei, warping apparatus, exception IP etc..That is, database further summarizes the man-machine recognition result of history and various Black Industrial Resources, therefore more vaild act features can be provided, and provide more black libraries of malice machine resources, prevent The only behavior model of black Breakthrough in Industry single-point.
If it is possible to iterative user behavior model is continuously updated based on the database, then user behavior mould Type will more effectively cope with the quick variation of black industry, thus can in the fast-changing situation of black industry It is enough to obtain accurately man-machine recognition result.
For this reason, after step S301, the man-machine recognition methods can further include following steps.
In step S302, library updates the sample database based on the data.It can be by a part of number in the database According to, such as the data of recent renewal, it is synchronized in the sample database.
Then, in step S303, with multiple user behavior moulds of the second quantity described in updated sample database re -training Type.
In addition, in referring to man-machine recognition methods described in Fig. 2, only with the man-machine prediction probability of single as finally Man-machine prediction probability.However, the disclosure is not limited to that.For example, according in disclosed another embodiment, it can be by this Man-machine prediction probability final man-machine prediction probability is obtained further combined with the man-machine prediction probability of history.
Fig. 4 shows the man-machine recognition methods of the another embodiment according to the disclosure.Referring to Fig. 4, again according to the disclosure The man-machine recognition methods of one embodiment is included in above in reference to step S201~S205 of Fig. 2 description and describes referring to Fig. 3 Step S301.In addition to this, further comprised the steps according to the man-machine recognition methods of the another embodiment of the disclosure.
In step S401, searches for from the database and the man-machine prediction of multiple history for obtaining the terminal device is general Rate.
Then, in step S402, current man-machine prediction probability and the man-machine prediction probability of the multiple history are input to One weighted model, and the man-machine prediction probability is updated with the output of the weighted model.
Theoretically speaking weight corresponding with current man-machine prediction probability is maximum, more early history is man-machine pre- with the time It is smaller to survey the corresponding weight of probability.But for example, the specific value of the weight of the weighted model can pass through supervised classification algorithm To learn to obtain.In addition, the use of how many a historical results being also that the analysis of supervised classification algorithm is needed to obtain.
Specifically, it is calculated based on current man-machine prediction probability and the man-machine prediction probability of multiple history final man-machine Prediction probability f are as follows:
Wherein:
ki: weight to be learned;
ti: time attenuation coefficient takes recognition time to the difference of current point in time, then does normalized;
Pi: the man-machine prediction probability value of single prediction;
N: default takes 10 times, can be automatically adjusted according to scene.
To, in the man-machine recognition methods according to the another embodiment of the disclosure, due to combining historical forecast data, Therefore the accuracy of prediction can be further increased.
In addition, the man-machine recognition methods according to the disclosure can further include: in response to the people from terminal device Machine identification request, Xiang Suoshu terminal device sends a token (token), wherein the man-machine knowledge of the token and the terminal device Other result is associated.Specifically, when the operation for needing to carry out man-machine identification in terminal equipment side execution, some bank is such as logged in When account, the operation to terminal equipment side is needed to carry out man-machine identification, that is, judges that the operation is the operation executed by normal users, Or the operation executed by malice machine (that is, abnormal user).Also, it is to be herein pointed out intentionally getting about terminal The man-machine recognition result of equipment is business air control background server.For example, when logging in some Bank Account Number, the industry of the bank Business air control background server intentionally gets the man-machine recognition result about terminal device to decide whether that user is allowed to set in terminal The operation at standby place.At this point, obtained token is sent to business air control background server, and business air control backstage by terminal device Server inquires the man-machine recognition result about terminal device based on the token to the server for man-machine identification.
Next, man-machine identification equipment according to an embodiment of the present disclosure will be described referring to Fig. 5.The man-machine identification equipment It can be the server 10 above with reference to Fig. 1 description.As shown in figure 5, man-machine identification equipment 500 includes: communication unit 501, extraction unit 502 and processing unit 503.
Communication unit 501 is used to request in response to the man-machine identification from terminal device, and reception is adopted by the terminal device The initial data of collection.
The feature of multiple dimensions of the extraction unit 502 for extracting the first quantity in the initial data.
Processing unit 503 is used to the feature of multiple dimensions of first quantity being separately input into the multiple of the second quantity Personal behavior model, and multiple man-machine prediction for exporting the second quantity from the personal behavior model of second quantity are general Rate, and multiple man-machine sub- probability of prediction based on second quantity, determine man-machine prediction probability.Then, based on described man-machine Prediction probability obtains the man-machine recognition result about the operation at the terminal device.
Also, the processing unit 503 further comprises: modeling unit 5031, for distinguishing base about same sample database Multiple personal behavior models of second quantity are obtained in different supervised classification algorithms to train.
As can be seen that being executed by the way of non-perception in man-machine identification equipment according to an embodiment of the present disclosure Man-machine identification.That is, in the case where user is unaware of, by the feature at the terminal device of acquisition, to judge at terminal device Operation whether be normal users operation.Therefore, need to calculate identifying code with user in the prior art to execute man-machine identification Mode compare, it is no longer necessary to user executes any additional operation, to farthest reduce user's operation complexity. In addition, the raw data acquisition based on plurality of classes is more in man-machine recognition methods according to an embodiment of the present disclosure and equipment The feature of a dimension, and features inputted to personal behavior model and multiple dimensions.In other words, the user in the disclosure Behavior model is the feature of multiple dimensions acquired for the initial data based on plurality of classes and the model established.With it is existing It is compared in technology using only the scheme of the other behavioral data of unitary class (for example, keyboard, mouse action) to predict, according to the disclosure Embodiment man-machine identification equipment due to consider larger class data and more various dimensions feature to accuracy it is higher. In addition, in man-machine identification equipment according to an embodiment of the present disclosure, using a variety of use based on different supervised classification algorithms Family behavior model executes prediction respectively, and integrates the result of this multiple and different model to obtain final man-machine prediction result.With The scheme predicted in the prior art using only single model is compared, and the precision of prediction can be further increased.
In addition, calculating every time for the terminal device can also be stored as alternatively possible embodiment Man-machine prediction probability, the man-machine prediction history data as the terminal device.Specifically, Fig. 6 is shown according to this public affairs The man-machine identification equipment for another embodiment opened.As shown in fig. 6, in addition to communication unit 501, extraction unit 502 and processing unit Except 503, man-machine identification equipment 600 further comprises: storage unit 601, for storing a database.Also, by the place The man-machine prediction probability and the terminal device that reason unit is determined are stored in association in the database.
By the way that each calculated man-machine recognition result to be stored in the database, can to protect in database Hold all historical identification datas.Certainly, in addition to this, database can also receive the black data record in other sources, including different Chang Hangwei, warping apparatus, exception IP etc..That is, database further summarizes the man-machine recognition result of history and various Black Industrial Resources, therefore more vaild act features can be provided, and provide more black libraries of malice machine resources, prevent The only behavior model of black Breakthrough in Industry single-point.
If it is possible to iterative user behavior model is continuously updated based on the database, then user behavior mould Type will more effectively cope with the quick variation of black industry, thus can in the fast-changing situation of black industry It is enough to obtain accurately man-machine recognition result.
For this reason, man-machine identification equipment 600 may further include: updating unit 602, for being based on the number The sample database is updated according to library.And wherein the modeling unit 5031 is configured to: with updated sample database weight Newly train multiple personal behavior models of second quantity.
In addition, processing unit 503 is general only with the man-machine prediction of single in the man-machine identification equipment referring to described in Fig. 5 Rate is as final man-machine prediction probability.However, the disclosure is not limited to that.For example, according to disclosed another embodiment In, it is general this man-machine prediction probability can be obtained to final man-machine prediction further combined with the man-machine prediction probability of history Rate.
Fig. 7 shows the man-machine identification equipment of the another embodiment according to the disclosure.As shown in fig. 7, in addition to communication unit 501, except extraction unit 502, processing unit 503 and storage unit 601, man-machine identification equipment 700 further comprises: history is looked into Unit 701 is ask, for searching for and obtaining the man-machine prediction probability of multiple history of the terminal device from the database.And And the processing 503 is configured to: current man-machine prediction probability and the man-machine prediction probability of the multiple history is defeated Enter to a weighted model, and the man-machine prediction probability is updated with the output of the weighted model.
In addition, the communication unit 501 is configured in the man-machine identification equipment according to the disclosure: response In the man-machine identification request from terminal device, Xiang Suoshu terminal device sends a token, wherein the token and the terminal The man-machine recognition result of equipment is associated.
Fig. 8 shows server 10 for executing man-machine identification, terminal device 30 and for inquiring man-machine identification knot Data flow between the server 30 of fruit.Specifically, when the operation for needing to carry out man-machine identification in terminal equipment side execution, such as When logging in some Bank Account Number, needs the operation to terminal equipment side to carry out man-machine identification, that is, judge that the operation is by just commonly using The operation that family executes, or the operation executed by malice machine (that is, abnormal user).As shown in figure 8, at this time terminal device 30 to Server 10 sends man-machine identification request.It is requested in response to the man-machine identification, server 10 sends token to terminal device.And And as mentioned above it is possible, intentionally get the man-machine recognition result about terminal device is business air control background server.Example Such as, when logging in some Bank Account Number, the business air control background server of the bank is intentionally got about the man-machine of terminal device Recognition result is to decide whether to allow operation of the user at terminal device.At this point, terminal device 30 sends obtained token To business air control background server 20, and business air control background server 20 based on the token to the service for man-machine identification Device 10 inquires the man-machine recognition result about terminal device.
Example such as Fig. 9 according to the device of the synthesis credit score for calculating equipment of the disclosure as hardware entities It is shown.Described device includes processor 901, memory 902 and at least one external communication interface 903.The processor 901, memory 902 and external communication interface 903 are connected by bus 804.
For the processor 901 for data processing, when executing processing, microprocessor, centre can be used Manage device (CPU, Central Processing Unit), digital signal processor (DSP, Digital Singnal Processor) or programmable logic array (FPGA, Field-Programmable Gate Array) is realized;For storage It include operational order, which can be computer-executable code, by the operational order come real for device 902 Each step in the method flow of each embodiment of the existing above-mentioned disclosure.
Figure 10 shows the schematic diagram of the computer readable recording medium of embodiment according to the present invention.As shown in Figure 10, Computer readable recording medium 1000 according to an embodiment of the present invention is stored thereon with computer program instructions 1001.When the meter When calculation machine program instruction 1001 is run by processor, the man-machine knowledge according to an embodiment of the present invention referring to the figures above description is executed Other method.
So far, man-machine recognition methods according to an embodiment of the present disclosure is described in detail referring to figs. 1 to Figure 10 And equipment.In man-machine recognition methods according to an embodiment of the present disclosure and equipment, executed by the way of non-perception man-machine Identification.That is, in the case where user is unaware of, by the feature at the terminal device of acquisition, to judge the behaviour at terminal device Whether be normal users operation.Therefore, need to calculate identifying code with user in the prior art to execute the side of man-machine identification Formula is compared, it is no longer necessary to which user executes any additional operation, to farthest reduce user's operation complexity.This Outside, in man-machine recognition methods according to an embodiment of the present disclosure and equipment, the raw data acquisition based on plurality of classes is multiple The feature of dimension, and features inputted to personal behavior model and multiple dimensions.In other words, user's row in the disclosure For model is the feature of multiple dimensions acquired for the initial data based on plurality of classes and the model established.With existing skill It is compared in art using only the scheme of the other behavioral data of unitary class (for example, keyboard, mouse action) to predict, according to the disclosure The man-machine recognition methods of embodiment is due to considering the data of larger class and the feature of more various dimensions to which accuracy is higher.This Outside, in man-machine recognition methods according to an embodiment of the present disclosure, using a variety of users based on different supervised classification algorithms Behavior model executes prediction respectively, and integrates the result of this multiple and different model to obtain final man-machine prediction result.With it is existing There is the scheme predicted in technology using only single model to compare, the precision of prediction can be further increased.Also, according to this In the man-machine recognition methods of disclosed embodiment and equipment, iterative user behavior mould can be continuously updated based on the database Type, therefore personal behavior model can more effectively cope with the quick variation of black industry, thus even if quick in black industry Also accurate man-machine recognition result can be obtained in the case where variation.Also, in man-machine identification according to an embodiment of the present disclosure In method and apparatus, this man-machine prediction probability can be obtained further combined with the man-machine prediction probability of history final Man-machine prediction probability can further increase the accuracy of prediction.
It should be noted that in the present specification, the terms "include", "comprise" or its any other variant are intended to Non-exclusive inclusion, so that the process, method, article or equipment including a series of elements is not only wanted including those Element, but also including other elements that are not explicitly listed, or further include for this process, method, article or equipment Intrinsic element.In the absence of more restrictions, the element limited by sentence " including ... ", it is not excluded that including There is also other identical elements in the process, method, article or equipment of the element.
Finally, it is to be noted that, it is above-mentioned it is a series of processing not only include with sequence described here in temporal sequence The processing of execution, and the processing including executing parallel or respectively rather than in chronological order.
Through the above description of the embodiments, those skilled in the art can be understood that the disclosure can be by Software adds the mode of required hardware platform to realize, naturally it is also possible to all be implemented by software.Based on this understanding, The technical solution of the disclosure can be embodied in the form of software products in whole or in part to what background technique contributed, The computer software product can store in storage medium, such as ROM/RAM, magnetic disk, CD, including some instructions are to make It obtains a computer equipment (can be personal computer, server or the network equipment etc.) and executes each embodiment of the disclosure Or method described in certain parts of embodiment.
The disclosure is described in detail above, used herein principle and embodiment party of the specific case to the disclosure Formula is expounded, disclosed method that the above embodiments are only used to help understand and its core concept;Meanwhile it is right Change is had in specific embodiments and applications according to the thought of the disclosure in those of ordinary skill in the art Place, in conclusion the content of the present specification should not be construed as the limitation to the disclosure.

Claims (15)

1. a kind of man-machine recognition methods, comprising:
In response to the man-machine identification request from terminal device, the initial data acquired by the terminal device is received;
The feature of multiple dimensions of the first quantity is extracted from the initial data;
The feature of multiple dimensions of first quantity is separately input into multiple personal behavior models of the second quantity, and from Multiple personal behavior models of second quantity export multiple man-machine sub- probability of prediction of the second quantity;
Multiple man-machine sub- probability of prediction based on second quantity, determine man-machine prediction probability;And
Based on the man-machine prediction probability, the man-machine recognition result about the operation at the terminal device is obtained.
2. according to the method described in claim 1, wherein multiple personal behavior models of second quantity are about same This library is based respectively on different supervised classification algorithms come obtained from training.
3. according to the method described in claim 2, further comprising wherein after the step of determining man-machine prediction probability:
The man-machine prediction probability and the terminal device are stored in association in a database.
4. according to the method described in claim 3, further comprising wherein after the step of determining man-machine prediction probability:
The man-machine prediction probability of multiple history of the terminal device is searched for and obtained from the database;And
Current man-machine prediction probability and the man-machine prediction probability of the multiple history are input to a weighted model, and added with described The output of model is weighed to update the man-machine prediction probability.
5. according to the method described in claim 3, further comprising:
Library updates the sample database based on the data;And
With multiple personal behavior models of the second quantity described in updated sample database re -training.
6. according to the method described in claim 1, wherein extracting multiple dimensions of the first quantity from the initial data After the step of feature, further comprise:
Enhancing processing is executed to the feature extracted, to obtain the feature of multiple dimensions of third quantity.
7. according to the method described in claim 1, further comprising:
In response to from terminal device man-machine identification request, Xiang Suoshu terminal device send a token, wherein the token with The man-machine prediction probability of the terminal device is associated.
8. a kind of man-machine identification equipment, comprising:
Communication unit receives the original acquired by the terminal device for requesting in response to the man-machine identification from terminal device Beginning data;
Extraction unit, the feature of multiple dimensions for extracting the first quantity in the initial data;And
Processing unit, for the feature of multiple dimensions of first quantity to be separately input into multiple user's rows of the second quantity For model, multiple man-machine sub- probability of prediction of the second quantity are exported from multiple personal behavior models of second quantity;It is based on Multiple man-machine sub- probability of prediction of second quantity determine man-machine prediction probability, and are based on the man-machine prediction probability, obtain Man-machine recognition result about the operation at the terminal device.
9. equipment according to claim 8, wherein the processing unit further comprises:
Modeling unit obtains described second for being based respectively on different supervised classification algorithms about same sample database to train Multiple personal behavior models of quantity.
10. equipment according to claim 9, further comprises:
Storage unit, for storing a database, and
Wherein, the man-machine prediction probability and the terminal device are stored in association in the database.
11. equipment according to claim 10, further comprises:
Historical query unit, the man-machine prediction of multiple history for searching for and obtaining the terminal device from the database are general Rate, and
Wherein the processing is configured to: by current man-machine prediction probability and the man-machine prediction probability of the multiple history It is input to a weighted model, and the man-machine prediction probability is updated with the output of the weighted model.
12. equipment according to claim 10, further comprises:
Updating unit updates the sample database for library based on the data;And
Wherein the modeling unit is configured to: with the multiple of the second quantity described in updated sample database re -training Personal behavior model.
13. equipment according to claim 8, further comprises:
Feature enhancement unit, for executing enhancing processing to the feature extracted, to obtain the spy of multiple dimensions of third quantity Sign.
14. equipment according to claim 8, wherein the communication unit is configured to:
In response to from terminal device man-machine identification request, Xiang Suoshu terminal device send a token, wherein the token with The man-machine prediction probability of the terminal device is associated.
15. a kind of computer readable recording medium, stores computer program thereon, the calculating is executed by processing unit for working as When machine program, perform the steps of
In response to the man-machine identification request from terminal device, the initial data acquired by the terminal device is received;
The feature of multiple dimensions of the first quantity is extracted from the initial data;
The feature of multiple dimensions of first quantity is separately input into multiple personal behavior models of the second quantity, and from Multiple personal behavior models of second quantity export multiple man-machine sub- probability of prediction of the second quantity;
Multiple man-machine sub- probability of prediction based on second quantity, determine man-machine prediction probability;And
Based on the man-machine prediction probability, the man-machine recognition result about the operation at the terminal device is obtained.
CN201811248586.8A 2018-10-25 2018-10-25 Man-machine identification method, equipment and medium Active CN110162939B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201811248586.8A CN110162939B (en) 2018-10-25 2018-10-25 Man-machine identification method, equipment and medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201811248586.8A CN110162939B (en) 2018-10-25 2018-10-25 Man-machine identification method, equipment and medium

Publications (2)

Publication Number Publication Date
CN110162939A true CN110162939A (en) 2019-08-23
CN110162939B CN110162939B (en) 2023-05-02

Family

ID=67645259

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201811248586.8A Active CN110162939B (en) 2018-10-25 2018-10-25 Man-machine identification method, equipment and medium

Country Status (1)

Country Link
CN (1) CN110162939B (en)

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109784015A (en) * 2018-12-27 2019-05-21 腾讯科技(深圳)有限公司 A kind of authentication identifying method and device
CN111177668A (en) * 2019-11-21 2020-05-19 武汉极意网络科技有限公司 Man-machine interaction verification method based on mobile device sensor
CN113124636A (en) * 2019-12-31 2021-07-16 海信集团有限公司 Refrigerator with a door
WO2021184836A1 (en) * 2020-03-20 2021-09-23 深圳前海微众银行股份有限公司 Method and apparatus for training recognition model, device, and readable storage medium

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104980421A (en) * 2014-10-15 2015-10-14 腾讯科技(深圳)有限公司 Method and system for processing batch requests
CN106155298A (en) * 2015-04-21 2016-11-23 阿里巴巴集团控股有限公司 Man-machine recognition methods and device, the acquisition method of behavior characteristics data and device
CN106997493A (en) * 2017-02-14 2017-08-01 云数信息科技(深圳)有限公司 Lottery user attrition prediction method and its system based on multi-dimensional data
CN108416198A (en) * 2018-02-06 2018-08-17 平安科技(深圳)有限公司 Man-machine identification model establishes device, method and computer readable storage medium

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104980421A (en) * 2014-10-15 2015-10-14 腾讯科技(深圳)有限公司 Method and system for processing batch requests
CN106155298A (en) * 2015-04-21 2016-11-23 阿里巴巴集团控股有限公司 Man-machine recognition methods and device, the acquisition method of behavior characteristics data and device
CN106997493A (en) * 2017-02-14 2017-08-01 云数信息科技(深圳)有限公司 Lottery user attrition prediction method and its system based on multi-dimensional data
CN108416198A (en) * 2018-02-06 2018-08-17 平安科技(深圳)有限公司 Man-machine identification model establishes device, method and computer readable storage medium

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
张志腾等: "基于梯度提升决策树的鼠标轨迹识别方法与研究", 《信息通信》 *

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109784015A (en) * 2018-12-27 2019-05-21 腾讯科技(深圳)有限公司 A kind of authentication identifying method and device
CN109784015B (en) * 2018-12-27 2023-05-12 腾讯科技(深圳)有限公司 Identity authentication method and device
CN111177668A (en) * 2019-11-21 2020-05-19 武汉极意网络科技有限公司 Man-machine interaction verification method based on mobile device sensor
CN113124636A (en) * 2019-12-31 2021-07-16 海信集团有限公司 Refrigerator with a door
CN113124636B (en) * 2019-12-31 2022-05-24 海信集团有限公司 Refrigerator
WO2021184836A1 (en) * 2020-03-20 2021-09-23 深圳前海微众银行股份有限公司 Method and apparatus for training recognition model, device, and readable storage medium

Also Published As

Publication number Publication date
CN110162939B (en) 2023-05-02

Similar Documents

Publication Publication Date Title
CN107818344B (en) Method and system for classifying and predicting user behaviors
JP2024026276A (en) Computer-based system, computer component and computer object configured to implement dynamic outlier bias reduction in machine learning model
US11190562B2 (en) Generic event stream processing for machine learning
US10484413B2 (en) System and a method for detecting anomalous activities in a blockchain network
CN110162939A (en) Man-machine recognition methods, equipment and medium
WO2018235252A1 (en) Analysis device, log analysis method, and recording medium
WO2019200742A1 (en) Short-term profit prediction method, apparatus, computer device, and storage medium
CN112819024B (en) Model processing method, user data processing method and device and computer equipment
CN115004652B (en) Business wind control processing method and device, electronic equipment and storage medium
CN116684330A (en) Traffic prediction method, device, equipment and storage medium based on artificial intelligence
Linn et al. Sequential anomaly detection techniques in business processes
WO2021139255A1 (en) Model based method and apparatus for predicting data change frequency, and computer device
CN116501979A (en) Information recommendation method, information recommendation device, computer equipment and computer readable storage medium
CN114900346B (en) Network security testing method and system based on knowledge graph
CN111737319B (en) User cluster prediction method, device, computer equipment and storage medium
CN117009509A (en) Data security classification method, apparatus, device, storage medium and program product
CN115619245A (en) Portrait construction and classification method and system based on data dimension reduction method
CN115660101A (en) Data service providing method and device based on service node information
Korstanje Machine Learning for Streaming Data with Python: Rapidly build practical online machine learning solutions using River and other top key frameworks
US11409589B1 (en) Methods and systems for determining stopping point
Park et al. A new forecasting system using the latent dirichlet allocation (LDA) topic modeling technique
CN113360357A (en) Data monitoring method, system, equipment and computer program product
CN116883181B (en) Financial service pushing method based on user portrait, storage medium and server
KR102395550B1 (en) Method and apparatus for analyzing confidential information
CN114091738A (en) Complaint probability obtaining method and device and electronic equipment

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant