CN110347724A - Abnormal behaviour recognition methods, device, electronic equipment and medium - Google Patents
Abnormal behaviour recognition methods, device, electronic equipment and medium Download PDFInfo
- Publication number
- CN110347724A CN110347724A CN201910631735.7A CN201910631735A CN110347724A CN 110347724 A CN110347724 A CN 110347724A CN 201910631735 A CN201910631735 A CN 201910631735A CN 110347724 A CN110347724 A CN 110347724A
- Authority
- CN
- China
- Prior art keywords
- historical behavior
- user
- feature
- frequency
- behavioral data
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/245—Query processing
- G06F16/2458—Special types of queries, e.g. statistical queries, fuzzy queries or distributed queries
- G06F16/2462—Approximate or statistical queries
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/245—Query processing
- G06F16/2458—Special types of queries, e.g. statistical queries, fuzzy queries or distributed queries
- G06F16/2474—Sequence data queries, e.g. querying versioned data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/245—Query processing
- G06F16/2458—Special types of queries, e.g. statistical queries, fuzzy queries or distributed queries
- G06F16/2477—Temporal data queries
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/30—Information retrieval; Database structures therefor; File system structures therefor of unstructured textual data
- G06F16/33—Querying
- G06F16/3331—Query processing
- G06F16/334—Query execution
- G06F16/3346—Query execution using probabilistic model
Landscapes
- Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Probability & Statistics with Applications (AREA)
- General Engineering & Computer Science (AREA)
- Computational Linguistics (AREA)
- Data Mining & Analysis (AREA)
- Databases & Information Systems (AREA)
- General Physics & Mathematics (AREA)
- Software Systems (AREA)
- Mathematical Physics (AREA)
- Fuzzy Systems (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The embodiment of the present disclosure discloses a kind of abnormal behaviour recognition methods, device, electronic equipment and medium.Wherein, this method comprises: obtaining the user's history behavioral data in default historical time section；The identification feature of the user's history behavioral data is extracted, and calculates the words-frequency feature of the user's history behavioral data, and the identification feature based on the user's history behavioral data and words-frequency feature training obtain abnormal behaviour identification model；Behavioral data to be identified is obtained, and the identification feature of the behavioral data to be identified and words-frequency feature are input in the abnormal behaviour identification model, obtains abnormal behaviour recognition result.
Description
Technical field
This disclosure relates to field of information processing, and in particular to a kind of abnormal behaviour recognition methods, device, electronic equipment and Jie
Matter.
Background technique
While the development of big data and artificial intelligence technology provides the data service of high quality for users, also grow
Given birth to numerous abnormal behaviours, for example sabotaged, cheat, swindle etc., in order to efficiently identify these abnormal behaviours, increasingly
More researchers utilizes deep learning, such as RNN using operational indicator as model variable using machine learning method
(Recurrent Neural Networks, Recognition with Recurrent Neural Network), LSTM (Long Short-Term Memory, shot and long term note
The methods of recall network), Lai Xunlian abnormal behaviour disaggregated model.Although the technological means can identify that a certain extent user is different
Chang Hangwei, but have the disadvantage in that 1, be usually by Manual definition's as the operational indicator of model variable, it is therefore desirable to it is a large amount of
Manpower intervention processing；2, the training of deep learning method is at high cost, amount of training data is big, the model training period is long and result can
Explanatory poor, weight redundancy height.Therefore, need that a kind of training is at low cost, amount of training data is small, the model training period is short and knows
The high abnormal behaviour recognition methods of other accuracy.
Summary of the invention
For above-mentioned technical problem in the prior art, the embodiment of the present disclosure propose a kind of abnormal behaviour recognition methods,
Device, electronic equipment and medium.
The first aspect of the embodiment of the present disclosure provides a kind of abnormal behaviour recognition methods, comprising:
Obtain the user's history behavioral data in default historical time section；
The identification feature of the user's history behavioral data is extracted, and the word frequency for calculating the user's history behavioral data is special
Sign, and the identification feature based on the user's history behavioral data and words-frequency feature training obtain abnormal behaviour identification model；
Behavioral data to be identified is obtained, and the identification feature of the behavioral data to be identified and words-frequency feature are input to institute
It states in abnormal behaviour identification model, obtains abnormal behaviour recognition result.
In some embodiments, the user's history behavioral data obtained in default historical time section, comprising:
Obtain the user's history behavioral data in default historical time section；
The user's history behavioral data is divided into positive sample historical behavior data and negative sample historical behavior data；
The positive sample historical behavior data are split as two or more positive sample historical behaviors with the first fractionation frequency
The negative sample historical behavior data are split as two or more negative sample historical behavior sequences with the second fractionation frequency by sequence
Column.
In some embodiments, described first frequency is split less than the second fractionation frequency.
In some embodiments, the user's history behavioral data obtained in default historical time section, further includes:
Duplicate removal processing is carried out for the positive sample historical behavior sequence and the negative sample historical behavior sequence.
In some embodiments, the identification feature for extracting the user's history behavioral data, and calculate the user
The words-frequency feature of historical behavior data, and the identification feature based on the user's history behavioral data and words-frequency feature training obtain
Abnormal behaviour identification model, comprising:
Extract the identification feature of the user's history behavioral data；
Calculate separately the words-frequency feature of the positive sample historical behavior sequence and the negative sample historical behavior sequence；
Identification feature and word frequency based on the positive sample historical behavior sequence and the negative sample historical behavior sequence are special
Sign training obtains abnormal behaviour identification model.
In some embodiments, described to calculate separately the positive sample historical behavior sequence and the negative sample historical behavior
After the words-frequency feature of sequence, further includes:
Delete the words-frequency feature for being less than default word frequency threshold.
The second aspect of the embodiment of the present disclosure provides a kind of abnormal behaviour identification device, comprising:
Module is obtained, is configured as obtaining the user's history behavioral data in default historical time section；
Training module is configured as extracting the identification feature of the user's history behavioral data, and calculates the user and go through
The words-frequency feature of history behavioral data, and the identification feature based on the user's history behavioral data and words-frequency feature training obtain it is different
Normal Activity recognition model；
Identification module, is configured as obtaining behavioral data to be identified, and by the identification feature of the behavioral data to be identified
It is input in the abnormal behaviour identification model with words-frequency feature, obtains abnormal behaviour recognition result.
In some embodiments, the acquisition module includes:
Acquisition submodule is configured as obtaining the user's history behavioral data in default historical time section；
First splits submodule, be configured as the user's history behavioral data being divided into positive sample historical behavior data and
Negative sample historical behavior data；
Second splits submodule, is configured as that the positive sample historical behavior data are split as two with the first fractionation frequency
A or multiple positive sample historical behavior sequences, with second fractionation frequency by the negative sample historical behavior data be split as two or
Multiple negative sample historical behavior sequences.
In some embodiments, described first frequency is split less than the second fractionation frequency.
In some embodiments, the acquisition module further include:
Submodule is handled, is configured as the positive sample historical behavior sequence and the negative sample historical behavior sequence
Carry out duplicate removal processing.
In some embodiments, the training module includes:
Extracting sub-module is configured as extracting the identification feature of the user's history behavioral data；
Computational submodule is configured to calculate the positive sample historical behavior sequence and the negative sample historical behavior
The words-frequency feature of sequence；
Training submodule, is configured as based on the positive sample historical behavior sequence and the negative sample historical behavior sequence
Identification feature and words-frequency feature training obtain abnormal behaviour identification model.
In some embodiments, after the computational submodule, further includes:
Submodule is deleted, is configured as deleting the words-frequency feature for being less than default word frequency threshold.
The third aspect of the embodiment of the present disclosure provides a kind of computer program product, and the computer program product includes
The computer program being stored on computer readable storage medium, the computer program include program instruction, work as described program
When instruction is computer-executed, it can be used to realize the method as described in foregoing embodiments.
The embodiment of the present disclosure is based on the user's history behavior by calculating the words-frequency feature of user's history behavioral data
The words-frequency feature training of data obtains abnormal behaviour identification model to realize the identification for abnormal behaviour.The embodiment of the present disclosure exists
In the case where capable of effectively identifying for abnormal behaviour, the dependence for input vector artificial treatment is reduced, and instruct
White silk is at low cost, amount of training data is small, the model training period is short, and then can greatly promote the recognition efficiency of abnormal behaviour identification.
Detailed description of the invention
The feature and advantage of the disclosure can be more clearly understood by reference to attached drawing, attached drawing is schematically without that should manage
Solution is carries out any restrictions to the disclosure, in the accompanying drawings:
Fig. 1 is a kind of flow chart of abnormal behaviour recognition methods according to shown in some embodiments of the present disclosure；
Fig. 2 is the process signal of the step S102 of the abnormal behaviour recognition methods according to shown in some embodiments of the present disclosure
Figure；
Fig. 3 is that the user behavior data according to shown in some embodiments of the present disclosure splits schematic diagram；
Fig. 4 is that the process of the step S102 of the abnormal behaviour recognition methods according to shown in other embodiments of the disclosure is shown
It is intended to；
Fig. 5 is the process signal of the step S104 of the abnormal behaviour recognition methods according to shown in some embodiments of the present disclosure
Figure；
Fig. 6 is that the process of the step S104 of the abnormal behaviour recognition methods according to shown in other embodiments of the disclosure is shown
It is intended to；
Fig. 7 is a kind of structural block diagram of abnormal behaviour identification device according to shown in some embodiments of the present disclosure；
Fig. 8 is the structure of the acquisition module 710 of the abnormal behaviour identification device according to shown in some embodiments of the present disclosure
Block diagram；
Fig. 9 is the knot of the acquisition module 710 of the abnormal behaviour identification device according to shown in other embodiments of the disclosure
Structure block diagram；
Figure 10 is the structure of the training module 720 of the abnormal behaviour identification device according to shown in some embodiments of the present disclosure
Block diagram；
Figure 11 is the knot of the training module 720 of the abnormal behaviour identification device according to shown in other embodiments of the disclosure
Structure block diagram；
Figure 12 is the schematic diagram of the electronic equipment according to shown in some embodiments of the present disclosure；
Figure 13 is adapted for the general purpose computer section for realizing the abnormal behaviour recognition methods according to the embodiment of the present disclosure
The structural schematic diagram of point.
Specific embodiment
In the following detailed description, many details of the disclosure are elaborated by example, in order to provide to correlation
The thorough understanding of disclosure.However, for those of ordinary skill in the art, the disclosure can obviously not have this
Implement in the case where a little details.It should be understood that using " system ", " device ", " unit " and/or " module " art in the disclosure
Language is for distinguishing in the sequence arrangement different components of different stage, element, part or a kind of method of component.However, such as
Identical purpose may be implemented in other expression formulas of fruit, these terms can be replaced by other expression formulas.
It should be understood that when equipment, unit or module be referred to as " ... on ", " being connected to " or " being coupled to " it is another
When equipment, unit or module, can directly in another equipment, unit or module, be connected or coupled to or with other equipment,
Unit or module communication, or may exist intermediate equipment, unit or module, unless context clearly prompts exceptional situation.Example
Such as, term "and/or" used in the disclosure includes any one and all combinations of entry listed by one or more correlations.
Term used in the disclosure limits disclosure range only for describing specific embodiment.Such as present disclosure specification
With shown in claims, unless context clearly prompts exceptional situation, " one ", "one", the words such as "an" and/or "the"
Odd number is not refered in particular to, may also comprise plural number.It is, in general, that term " includes " and "comprising" only prompt to include the spy clearly identified
Sign, entirety, step, operation, element and/or component, and such statement do not constitute one it is exclusive enumerate, other features,
Including entirety, step, operation, element and/or component also may include.
Referring to the following description and the annexed drawings, these or other feature and feature, operating method, the phase of structure of the disclosure
Function, the combination of part and the economy of manufacture for closing element can be better understood, and wherein description and accompanying drawings form
Part of specification.It is to be expressly understood, however, that attached drawing is used only as the purpose of illustration and description, it is not intended to limit this
Disclosed protection scope.It is understood that attached drawing is not necessarily drawn to scale.
Various structures figure has been used to be used to illustrate various modifications according to an embodiment of the present disclosure in the disclosure.It should be understood that
, before or following structure be not for limiting the disclosure.The protection scope of the disclosure is subject to claim.
Fig. 1 is a kind of flow diagram of abnormal behaviour recognition methods according to shown in some embodiments of the present disclosure, such as
Shown in Fig. 1, the abnormal behaviour recognition methods the following steps are included:
S102 obtains the user's history behavioral data in default historical time section.
S104, extracts the identification feature of the user's history behavioral data, and calculates the user's history behavioral data
Words-frequency feature, and the identification feature based on the user's history behavioral data and words-frequency feature training obtain abnormal behaviour identification mould
Type.
S106 obtains behavioral data to be identified, and the identification feature of the behavioral data to be identified and words-frequency feature is defeated
Enter into the abnormal behaviour identification model, obtains abnormal behaviour recognition result.
Mentioned above, the development of big data and artificial intelligence technology provides the data service of high quality for users
Meanwhile also having bred numerous abnormal behaviours, for example having sabotaged, cheat, swindle etc., in order to efficiently identify these abnormal rows
Machine learning method is used for, more and more researchers, using operational indicator as model variable, using deep learning, than
Such as the methods of RNN, LSTM, Lai Xunlian abnormal behaviour disaggregated model.Although the technological means can identify use to a certain extent
Family abnormal behaviour, but have the disadvantage in that 1, be usually by Manual definition's as the operational indicator of model variable, it is therefore desirable to
A large amount of manpower intervention processing；2, the training of deep learning method is at high cost, amount of training data is big, the model training period is long and ties
Fruit interpretation is poor, weight redundancy is high.Therefore, need that a kind of training is at low cost, amount of training data is small, the model training period is short simultaneously
And the abnormal behaviour recognition methods that recognition correct rate is high.
In order to solve the above-mentioned problems of the prior art, in some embodiments, a kind of abnormal behaviour identification side is proposed
Method, this method pass through the words-frequency feature for calculating user's history behavioral data, and the identification based on the user's history behavioral data
Feature and words-frequency feature training obtain abnormal behaviour identification model to realize the identification for abnormal behaviour.The embodiment of the present disclosure exists
In the case where capable of effectively identifying for abnormal behaviour, the dependence for input vector artificial treatment is reduced, and instruct
White silk is at low cost, amount of training data is small, the model training period is short, and then can greatly promote the recognition efficiency of abnormal behaviour identification.
In some embodiments, the user's history behavioral data refers in default historical time section produced by user
Behavioral data, such as operation, browsing, collection, click, transaction, payment etc. behavioral datas, wherein for convenience for user
Sequence of values can be used to represent between different operation and operation in the measurement of behavior, the user's history behavioral data
Relationship.Wherein, the default historical time section can according to the needs of practical application and the characteristics of user behavior data is set
It sets and selects, the disclosure is not especially limited it, for example can be 6 months, 1 year etc..
Wherein, refer to can be for spy that the characteristics of user's history behavioral data is characterized for the identification feature
Sign, for example, can be the statistics identification features such as total access duration, single page access duration, average access duration, or
TFIDF (Term Frequency-Inverse Document Frequency, word frequency inverse document frequency), bigram (two
First feature), trigram (ternary feature) even n-gram feature (n member feature) etc., if be expressed as than a sequence (l1,
L2, l4, l5, l6, l1 ...), then its bigram feature can indicate are as follows: (l1:2), (l2:1), (l4:1), (l5:1), (l6:
1), (l1-l2:1), (l2-l4:1), (l4-l5:1), (l5-l6:1), (l6-l1:1) etc., and trigram, n-gram feature
It can generate in a similar fashion.
Wherein, the words-frequency feature refers to that TF (Term Frequency, word frequency) value, TF value can be used in assessment one
Word for a field file set in a file or a corpus repetition degree, certainly according to the need of practical application
It wants and the characteristics of user behavior data can also use TFIDF equivalence to replace TF value or together with TF value as the defeated of model
Enter characteristic value, the disclosure is not particularly limited the particular content of words-frequency feature.
In some alternative embodiments, as shown in Fig. 2, the step S102, that is, obtain in default historical time section
The step of user's history behavioral data, comprising the following steps:
S202 obtains the user's history behavioral data in default historical time section.
The user's history behavioral data is divided into positive sample historical behavior data and negative sample historical behavior number by S204
According to.
The positive sample historical behavior data are split as two or more positive sample history with the first fractionation frequency by S206
The negative sample historical behavior data are split as two or more negative sample historical behaviors with the second fractionation frequency by behavior sequence
Sequence.
In some embodiments, the positive sample historical behavior data refer to normal, non-abnormal user behavior number
According to, the negative sample historical behavior data refer to improper, abnormal user behavior data, for example sabotage, cheat,
The behaviors such as swindle.
In view of the quantity variance of positive negative sample in many cases, is larger, i.e., the quantity of negative sample is far less than positive sample
This quantity, therefore, it is necessary to the quantity for negative sample reasonably to be increased, to improve the effective of final abnormal behaviour identification
Property.In this embodiment, the reasonable increase of negative sample quantity is realized using the method for serializing sample enhancing, it is specifically, first
The user's history behavioral data in default historical time section is first obtained, the user's history behavioral data is then divided into positive sample
Historical behavior data and negative sample historical behavior data；Finally the positive sample historical behavior data are torn open with the first fractionation frequency
It is divided into two or more positive sample historical behavior sequences, is split as the negative sample historical behavior data with the second fractionation frequency
Two or more negative sample historical behavior sequences.
Wherein, described first frequency is split less than the second fractionation frequency, the i.e. fractionation for positive sample historical behavior data
Density is less than the fractionation density for negative sample historical behavior data, for example can be split as a positive sample historical behavior data
Two positive sample historical behavior sequences, and a negative sample historical behavior data are split as ten negative sample historical behavior sequences
Column, can not also split positive sample historical behavior data, and a negative sample historical behavior data are only split as five and are born
Sample historical behavior sequence.Thus the number of negative sample can be effectively promoted in the positive and negative biggish situation of sample size difference
Amount.Wherein, the historical behavior sequence length split is less than the length of the historical behavior data before splitting, that is, is based on history row
The shorter sample data of some sequence lengths is obtained for data.
Although in view of directly using the abnormal behaviour recognition methods based on words-frequency feature that can obtain in the early stage preferably
Effect, but over time, the performance of the increase of behavioral data length, this method can constantly decline, thus can not adapt to
The identification of abnormal behaviour in long period (for example the monitoring period is 1 year) monitoring scene.Therefore, in some embodiments, can pass through
Behavior sequence length, and the mode for pushing ahead the sequence ends time point gradually are set, to obtain the shorter behavior of sequence
Sequence, wherein the behavior sequence length is less than the length of the behavioral data, when implementing to split every time, the behavior sequence
Length is also possible to variable either fixed.For example, as shown in figure 3, the user behavior data that can be 15 by length
L1, l2 ... l15 is split as three different behavior sequences of length, respectively indicates are as follows: sequence length be 7 l1, l2, l3,
L4, l5, l6, l7 }, { l5, l6, l7, l1, l5, the l10 } and sequence length that sequence length is 6 be 5 l2, l12, l9,
l14,l15}
In some embodiments, in order to further ensure the quantity of negative sample, the balance of positive and negative sample size is promoted, is guaranteed
The accuracy of abnormal behaviour identification model, the first fractionation frequency is not only smaller than the second fractionation frequency, but also needs to be less than
Second splits the 1/n of frequency, wherein n can be taken as positive integer, such as 5,6,7 etc..
In some alternative embodiments, in order to reduce repeated data to final abnormal behaviour identification model training shadow
It rings, the step S102 further includes that the positive sample historical behavior sequence and the negative sample historical behavior sequence are gone
The step of handling again, i.e., as shown in figure 4, the step S102, that is, obtain the user's history behavior number in default historical time section
According to the step of, comprising the following steps:
S402 obtains the user's history behavioral data in default historical time section.
The user's history behavioral data is divided into positive sample historical behavior data and negative sample historical behavior number by S404
According to.
The positive sample historical behavior data are split as two or more positive sample history with the first fractionation frequency by S406
The negative sample historical behavior data are split as two or more negative sample historical behaviors with the second fractionation frequency by behavior sequence
Sequence.
S408 carries out duplicate removal processing for the positive sample historical behavior sequence and the negative sample historical behavior sequence.
In some alternative embodiments, as shown in figure 5, the step S104, that is, extract the user's history behavior number
According to identification feature, and calculate the words-frequency feature of the user's history behavioral data, and be based on the user's history behavioral data
Identification feature and words-frequency feature training the step of obtaining abnormal behaviour identification model, comprising the following steps:
S502 extracts the identification feature of the user's history behavioral data.
S504, the word frequency for calculating separately the positive sample historical behavior sequence and the negative sample historical behavior sequence are special
Sign.
S506, based on the training of the words-frequency feature of the positive sample historical behavior sequence and the negative sample historical behavior sequence
Obtain abnormal behaviour identification model.
In this embodiment, using without rely on artificial treatment identification feature and words-frequency feature as abnormal behaviour identification
The input vector of model carries out the training of abnormal behaviour identification model.Wherein, the abnormal behaviour identification model is chosen as GBDT
(gradient decline tree) model, is trained using the model, the dimensionality reduction for input vector can be achieved at the same time, such as can be by deleting
Except feature importance (feature importances) be 0 input vector, by 8000 input vectors drop to 2000 hereinafter,
The redundancy for thus greatly reducing feature effectively reduces model training calculation amount.
In some alternative embodiments, the S504 calculates separately the positive sample historical behavior sequence and described negative
After the words-frequency feature of sample historical behavior sequence, further include the steps that deleting the words-frequency feature for being less than default word frequency threshold, i.e.,
As shown in fig. 6, the step S104, that is, extract the identification feature of the user's history behavioral data, and calculates the user and go through
The words-frequency feature of history behavioral data, and the identification feature based on the user's history behavioral data and words-frequency feature training obtain it is different
The step of normal Activity recognition model, comprising the following steps:
S602 extracts the identification feature of the user's history behavioral data.
S604, the word frequency for calculating separately the positive sample historical behavior sequence and the negative sample historical behavior sequence are special
Sign.
S606 deletes the words-frequency feature for being less than default word frequency threshold.
S608, identification feature and word based on the positive sample historical behavior sequence and the negative sample historical behavior sequence
The training of frequency feature obtains abnormal behaviour identification model.
In order to improve the validity of model training, in this embodiment, the positive sample historical behavior sequence is being calculated
After column and the words-frequency feature of the negative sample historical behavior sequence, also the words-frequency feature for being less than default word frequency threshold is deleted
It removes, subsequent further according to the identification feature, words-frequency feature training obtains abnormal behaviour identification model with treated.Wherein, described
Default word frequency threshold can according to the needs of practical application and the characteristics of words-frequency feature is selected and determined, the disclosure has it
Body value is not particularly limited.
In some alternative embodiments, in the case where not reducing model performance capabilities, the abnormal behaviour identifies mould
The training process of type can repeatedly be carried out with iteration, and select an optimal abnormal behaviour identification model according to default optimal conditions
Carry out the identification of subsequent behavioral data to be identified.Wherein, the default optimal conditions can be selected according to the needs of practical application
It selects and determines, the disclosure is not particularly limited its specific set content.For example, the model that wherein an iteration obtains may be selected
As the optimal abnormal behaviour identification model.
It is the specific embodiment for the abnormal behaviour recognition methods that the disclosure provides above.
Fig. 7 is the abnormal behaviour identification device schematic diagram according to shown in some embodiments of the present disclosure.As shown in fig. 7, institute
Stating abnormal behaviour identification device 700 includes:
Module 710 is obtained, is configured as obtaining the user's history behavioral data in default historical time section.
Training module 720 is configured as extracting the identification feature of the user's history behavioral data, and calculates the user
The words-frequency feature of historical behavior data, and the identification feature based on the user's history behavioral data and words-frequency feature training obtain
Abnormal behaviour identification model.
Identification module 730 is configured as obtaining behavioral data to be identified, and the identification of the behavioral data to be identified is special
Words-frequency feature of seeking peace is input in the abnormal behaviour identification model, obtains abnormal behaviour recognition result.
Mentioned above, the development of big data and artificial intelligence technology provides the data service of high quality for users
Meanwhile also having bred numerous abnormal behaviours, for example having sabotaged, cheat, swindle etc., in order to efficiently identify these abnormal rows
Machine learning method is used for, more and more researchers, using operational indicator as model variable, using deep learning, than
Such as the methods of RNN, LSTM, Lai Xunlian abnormal behaviour disaggregated model.Although the technological means can identify use to a certain extent
Family abnormal behaviour, but have the disadvantage in that 1, be usually by Manual definition's as the operational indicator of model variable, it is therefore desirable to
A large amount of manpower intervention processing；2, the training of deep learning method is at high cost, amount of training data is big, the model training period is long and ties
Fruit interpretation is poor, weight redundancy is high.Therefore, need that a kind of training is at low cost, amount of training data is small, the model training period is short simultaneously
And the abnormal behaviour recognition methods that recognition correct rate is high.
In order to solve the above-mentioned problems of the prior art, in some embodiments, a kind of abnormal behaviour identification dress is proposed
It sets, which passes through the words-frequency feature for calculating user's history behavioral data, and the identification based on the user's history behavioral data
Feature and words-frequency feature training obtain abnormal behaviour identification model to realize the identification for abnormal behaviour.The embodiment of the present disclosure exists
In the case where capable of effectively identifying for abnormal behaviour, the dependence for input vector artificial treatment is reduced, and instruct
White silk is at low cost, amount of training data is small, the model training period is short, and then can greatly promote the recognition efficiency of abnormal behaviour identification.
In some embodiments, the user's history behavioral data refers in default historical time section produced by user
Behavioral data, such as operation, browsing, collection, click, transaction, payment etc. behavioral datas, wherein for convenience for user
Sequence of values can be used to represent between different operation and operation in the measurement of behavior, the user's history behavioral data
Relationship.Wherein, the default historical time section can according to the needs of practical application and the characteristics of user behavior data is set
It sets and selects, the disclosure is not especially limited it, for example can be 6 months, 1 year etc..
Wherein, refer to can be for spy that the characteristics of user's history behavioral data is characterized for the identification feature
Sign, for example, can be the statistics identification features such as total access duration, single page access duration, average access duration, or
TFIDF (Term Frequency-Inverse Document Frequency, word frequency inverse document frequency), bigram (two
First feature), trigram (ternary feature) even n-gram feature (n member feature) etc., if be expressed as than a sequence (l1,
L2, l4, l5, l6, l1 ...), then its bigram feature can indicate are as follows: (l1:2), (l2:1), (l4:1), (l5:1), (l6:
1), (l1-l2:1), (l2-l4:1), (l4-l5:1), (l5-l6:1), (l6-l1:1) etc., and trigram, n-gram feature
It can generate in a similar fashion.
Wherein, the words-frequency feature refers to that TF (Term Frequency, word frequency) value, TF value can be used in assessment one
Word for a field file set in a file or a corpus repetition degree, certainly according to the need of practical application
It wants and the characteristics of user behavior data can also use TFIDF equivalence to replace TF value or together with TF value as the defeated of model
Enter characteristic value, the disclosure is not particularly limited the particular content of words-frequency feature.
In some alternative embodiments, as shown in figure 8, the acquisition module 710 includes:
Acquisition submodule 810 is configured as obtaining the user's history behavioral data in default historical time section.
First splits submodule 820, is configured as the user's history behavioral data being divided into positive sample historical behavior number
According to negative sample historical behavior data.
Second splits submodule 830, is configured as splitting the positive sample historical behavior data with the first fractionation frequency
For two or more positive sample historical behavior sequences, the negative sample historical behavior data are split as two with the second fractionation frequency
A or multiple negative sample historical behavior sequences.
In some embodiments, the positive sample historical behavior data refer to normal, non-abnormal user behavior number
According to, the negative sample historical behavior data refer to improper, abnormal user behavior data, for example sabotage, cheat,
The behaviors such as swindle.
In view of the quantity variance of positive negative sample in many cases, is larger, i.e., the quantity of negative sample is far less than positive sample
This quantity, therefore, it is necessary to the quantity for negative sample reasonably to be increased, to improve the effective of final abnormal behaviour identification
Property.In this embodiment, realize that the reasonable increase of negative sample quantity specifically obtains using the method for serializing sample enhancing
Submodule 810 is taken to obtain the user's history behavioral data in default historical time section, first splits submodule 820 for the user
Historical behavior data are divided into positive sample historical behavior data and negative sample historical behavior data；Second splits submodule 830 with the
The positive sample historical behavior data are split as two or more positive sample historical behavior sequences by one fractionation frequency, are torn open with second
The negative sample historical behavior data are split as two or more negative sample historical behavior sequences by crossover rate.
Wherein, described first frequency is split less than the second fractionation frequency, the i.e. fractionation for positive sample historical behavior data
Density is less than the fractionation density for negative sample historical behavior data, for example can be split as a positive sample historical behavior data
Two positive sample historical behavior sequences, and a negative sample historical behavior data are split as ten negative sample historical behavior sequences
Column, can not also split positive sample historical behavior data, and a negative sample historical behavior data are only split as five and are born
Sample historical behavior sequence.Thus the number of negative sample can be effectively promoted in the positive and negative biggish situation of sample size difference
Amount.Wherein, the historical behavior sequence length split is less than the length of the historical behavior data before splitting, that is, is based on history row
The shorter sample data of some sequence lengths is obtained for data.
Although in view of directly using the abnormal behaviour recognition methods based on words-frequency feature that can obtain in the early stage preferably
Effect, but over time, the performance of the increase of behavioral data length, this method can constantly decline, thus can not adapt to
The identification of abnormal behaviour in long period (for example the monitoring period is 1 year) monitoring scene.Therefore, in some embodiments, can pass through
Behavior sequence length, and the mode for pushing ahead the sequence ends time point gradually are set, to obtain the shorter behavior of sequence
Sequence, wherein the behavior sequence length is less than the length of the behavioral data, when implementing to split every time, the behavior sequence
Length is also possible to variable either fixed.For example, as shown in figure 3, the user behavior data that can be 15 by length
L1, l2 ... l15 is split as three different behavior sequences of length, respectively indicates are as follows: sequence length be 7 l1, l2, l3,
L4, l5, l6, l7 }, { l5, l6, l7, l1, l5, the l10 } and sequence length that sequence length is 6 be 5 l2, l12, l9,
l14,l15}
In some embodiments, in order to further ensure the quantity of negative sample, the balance of positive and negative sample size is promoted, is guaranteed
The accuracy of abnormal behaviour identification model, the first fractionation frequency is not only smaller than the second fractionation frequency, but also needs to be less than
Second splits the 1/n of frequency, wherein n can be taken as positive integer, such as 5,6,7 etc..
In some alternative embodiments, in order to reduce repeated data to final abnormal behaviour identification model training shadow
Ring, the acquisition module 710 further include for the positive sample historical behavior sequence and the negative sample historical behavior sequence into
The part of row duplicate removal processing, i.e., as shown in figure 9, the acquisition module 710 includes:
Acquisition submodule 910 is configured as obtaining the user's history behavioral data in default historical time section.
First splits submodule 920, is configured as the user's history behavioral data being divided into positive sample historical behavior number
According to negative sample historical behavior data.
Second splits submodule 930, is configured as splitting the positive sample historical behavior data with the first fractionation frequency
For two or more positive sample historical behavior sequences, the negative sample historical behavior data are split as two with the second fractionation frequency
A or multiple negative sample historical behavior sequences.
Submodule 940 is handled, is configured as the positive sample historical behavior sequence and the negative sample historical behavior
Sequence carries out duplicate removal processing.
In some alternative embodiments, as shown in Figure 10, the training module 720 includes:
Extracting sub-module 1010 is configured as extracting the identification feature of the user's history behavioral data.
Computational submodule 1020 is configured to calculate the positive sample historical behavior sequence and the negative sample history
The words-frequency feature of behavior sequence.
Training submodule 1030, is configured as based on the positive sample historical behavior sequence and the negative sample historical behavior
Identification feature and the words-frequency feature training of sequence obtain abnormal behaviour identification model.
In this embodiment, using without rely on artificial treatment identification feature and words-frequency feature as abnormal behaviour identification
The input vector of model carries out the training of abnormal behaviour identification model.Wherein, the abnormal behaviour identification model is chosen as GBDT
(gradient decline tree) model, is trained using the model, the dimensionality reduction for input vector can be achieved at the same time, such as can be by deleting
Except feature importance (feature importances) be 0 input vector, by 8000 input vectors drop to 2000 hereinafter,
The redundancy for thus greatly reducing feature effectively reduces model training calculation amount.
It in some alternative embodiments, further include deleting to be less than default word frequency threshold after the computational submodule 1002
The part of the words-frequency feature of value, i.e., as shown in figure 11, the training module 720 includes:
Extracting sub-module 1110 is configured as extracting the identification feature of the user's history behavioral data.
Computational submodule 1120 is configured to calculate the positive sample historical behavior sequence and the negative sample history
The words-frequency feature of behavior sequence.
Submodule 1130 is deleted, is configured as deleting the words-frequency feature for being less than default word frequency threshold.
Training submodule 1140, is configured as based on the positive sample historical behavior sequence and the negative sample historical behavior
Identification feature and the words-frequency feature training of sequence obtain abnormal behaviour identification model.
In order to improve the validity of model training, in this embodiment, computational submodule 1120 be calculated it is described just
After the words-frequency feature of sample historical behavior sequence and the negative sample historical behavior sequence, deleting submodule 1130 will also be less than
The words-frequency feature of default word frequency threshold is deleted, subsequent trained further according to the identification feature and treated words-frequency feature
To abnormal behaviour identification model.Wherein, the default word frequency threshold can according to the needs of practical application and the spy of words-frequency feature
Point is selected and is determined that the disclosure is not particularly limited its specific value.
In some alternative embodiments, in the case where not reducing model performance capabilities, the abnormal behaviour identifies mould
The training process of type can repeatedly be carried out with iteration, and select an optimal abnormal behaviour identification model according to default optimal conditions
Carry out the identification of subsequent behavioral data to be identified.Wherein, the default optimal conditions can be selected according to the needs of practical application
It selects and determines, the disclosure is not particularly limited its specific set content.For example, the model that wherein an iteration obtains may be selected
As the optimal abnormal behaviour identification model.
With reference to attached drawing 12, the electronic equipment schematic diagram provided for an embodiment of the present disclosure.As shown in figure 12, which sets
Standby 1200 include:
Memory 1230 and one or more processors 1210；
Wherein, the memory 1230 is communicated to connect with one or more of processors 1210, the memory 1230
In be stored with the instruction 1232 that can be executed by one or more of processors, described instruction 1232 is by one or more of places
It manages device 1210 to execute, so that one or more of processors 1210 execute above-mentioned abnormal behaviour identification step.
One embodiment of the disclosure provides a kind of computer readable storage medium, in the computer readable storage medium
Computer executable instructions are stored with, the computer executable instructions execute above-mentioned abnormal behaviour identification step after being performed.
In conclusion the present disclosure proposes a kind of abnormal behaviour recognition methods, device, electronic equipments and its computer-readable
Storage medium.The embodiment of the present disclosure is based on the user's history row by calculating the words-frequency feature of user's history behavioral data
It obtains abnormal behaviour identification model for the words-frequency feature training of data and realizes the identification for abnormal behaviour.The embodiment of the present disclosure
In the case where can effectively identify for abnormal behaviour, the dependence for input vector artificial treatment is reduced, and
Training is at low cost, amount of training data is small, the model training period is short, and then can greatly promote the identification effect of abnormal behaviour identification
Rate.
It is apparent to those skilled in the art that for convenience and simplicity of description, the equipment of foregoing description
, can be with reference to the corresponding description in aforementioned device embodiment with the specific work process of module, details are not described herein.
Although subject matter described herein is held in the execution on the computer systems of binding operation system and application program
It is provided in capable general context, but it will be appreciated by the appropriately skilled person that may also be combined with other kinds of program module
To execute other realizations.In general, program module include routines performing specific tasks or implementing specific abstract data types,
Program, component, data structure and other kinds of structure.It will be understood by those skilled in the art that subject matter described herein can
It is practiced, including handheld device, multicomputer system, based on microprocessor or can compiled with using other computer system configurations
Journey consumption electronic product, minicomputer, mainframe computer etc., it is possible to use in wherein task by being connected by communication network
In the distributed computing environment that remote processing devices execute.In a distributed computing environment, program module can be located locally and far
In the two of journey memory storage device.
Those of ordinary skill in the art may be aware that list described in conjunction with the examples disclosed in the embodiments of the present disclosure
Member and method and step can be realized with the combination of electronic hardware or computer software and electronic hardware.These functions are actually
It is implemented in hardware or software, the specific application and design constraint depending on technical solution.Professional technician
Each specific application can be used different methods to achieve the described function, but this realization is it is not considered that exceed
The scope of the present disclosure.
It, can be with if the function is realized in the form of SFU software functional unit and when sold or used as an independent product
It is stored in a computer readable storage medium.Based on this understanding, the technical solution of the disclosure is substantially in other words
The part of the part or the technical solutions that contribute to original technology can be embodied in the form of software products, the meter
Calculation machine software product is stored in a storage medium, including some instructions are used so that a computer equipment (can be a
People's computer, server or network equipment etc.) execute each embodiment the method for the disclosure all or part of the steps.
For example, typically, the technical solution of the disclosure can by least one as shown in fig. 13 that general purpose computer node 1310 come
It realizes and/or propagates.In Figure 13, general purpose computer node 1310 includes: computer system/server 1312, peripheral hardware
1314 and display equipment 1316；Wherein, the computer system/server 1312 connects including processing unit 1320, input/output
Mouth 1322, network adapter 1324 and memory 1330, the internal bus that usually passes through realize data transmission；Further, it stores
Device 1330 is usually made of a variety of storage equipment, for example, RAM (Random Access Memory, random access memory) 1332, slow
Deposit 1334 and storage system (being generally made of one or more large capacity non-volatile memory mediums) 1336 etc.；Realize the disclosure
The program 1340 of some or all of technical solution function is stored in memory 1330, usually with multiple program modules 1342
Form exists.
And computer-readable storage medium above-mentioned includes to store such as computer readable instructions, data structure, program
Any mode or technology of the information such as module or other data are come the physics volatile and non-volatile, removable and can not realized
Because of eastern medium.Computer-readable storage medium specifically includes, but is not limited to, USB flash disk, mobile hard disk, read-only memory (ROM,
Read-Only Memory), random access memory (RAM, Random Access Memory), erasable programmable is read-only deposits
Reservoir (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), flash memory or other solid-state memory technologies, CD-ROM, number
Word versatile disc (DVD), HD-DVD, blue light (Blue-Ray) or other light storage devices, tape, disk storage or other magnetism
Storage equipment or any other medium that can be used to store information needed and can be accessed by computer.
It should be understood that the above-mentioned specific embodiment of the disclosure is used only for exemplary illustration or explains the disclosure
Principle, without constituting the limitation to the disclosure.Therefore, that is done without departing from spirit and scope of the present disclosure is any
Modification, equivalent replacement, improvement etc., should be included within the protection scope of the disclosure.In addition, disclosure appended claims purport
Covering the whole variations fallen into attached claim scope and boundary or this range and the equivalent form on boundary and is repairing
Change example.
Claims (14)
1. a kind of abnormal behaviour recognition methods characterized by comprising
Obtain the user's history behavioral data in default historical time section；
The identification feature of the user's history behavioral data is extracted, and calculates the words-frequency feature of the user's history behavioral data,
And identification feature based on the user's history behavioral data and words-frequency feature training obtain abnormal behaviour identification model；
Behavioral data to be identified is obtained, and the identification feature of the behavioral data to be identified and words-frequency feature is input to described different
In normal Activity recognition model, abnormal behaviour recognition result is obtained.
2. the method according to claim 1, wherein the user's history row obtained in default historical time section
For data, comprising:
Obtain the user's history behavioral data in default historical time section；
The user's history behavioral data is divided into positive sample historical behavior data and negative sample historical behavior data；
The positive sample historical behavior data are split as two or more positive sample historical behavior sequences with the first fractionation frequency,
The negative sample historical behavior data are split as two or more negative sample historical behavior sequences with the second fractionation frequency.
3. according to the method described in claim 2, it is characterized in that, described first splits frequency less than the second fractionation frequency.
4. according to the method described in claim 2, it is characterized in that, the user's history row obtained in default historical time section
For data, further includes:
Duplicate removal processing is carried out for the positive sample historical behavior sequence and the negative sample historical behavior sequence.
5. according to the method described in claim 2, it is characterized in that, the identification for extracting the user's history behavioral data is special
Sign, and the words-frequency feature of the user's history behavioral data is calculated, and the identification feature based on the user's history behavioral data
Abnormal behaviour identification model is obtained with words-frequency feature training, comprising:
Extract the identification feature of the user's history behavioral data；
Calculate separately the words-frequency feature of the positive sample historical behavior sequence and the negative sample historical behavior sequence；
Identification feature and words-frequency feature instruction based on the positive sample historical behavior sequence and the negative sample historical behavior sequence
Get abnormal behaviour identification model.
6. according to the method described in claim 5, it is characterized in that, it is described calculate separately the positive sample historical behavior sequence and
After the words-frequency feature of the negative sample historical behavior sequence, further includes:
Delete the words-frequency feature for being less than default word frequency threshold.
7. a kind of abnormal behaviour identification device characterized by comprising
Module is obtained, is configured as obtaining the user's history behavioral data in default historical time section；
Training module is configured as extracting the identification feature of the user's history behavioral data, and calculates the user's history row
For the words-frequency feature of data, and the identification feature based on the user's history behavioral data and words-frequency feature training obtain abnormal row
For identification model；
Identification module, is configured as obtaining behavioral data to be identified, and by the identification feature and word of the behavioral data to be identified
Frequency feature is input in the abnormal behaviour identification model, obtains abnormal behaviour recognition result.
8. device according to claim 7, which is characterized in that the acquisition module includes:
Acquisition submodule is configured as obtaining the user's history behavioral data in default historical time section；
First splits submodule, is configured as the user's history behavioral data being divided into positive sample historical behavior data and negative sample
This historical behavior data；
Second split submodule, be configured as with first fractionation frequency by the positive sample historical behavior data be split as two or
The negative sample historical behavior data are split as two or more by multiple positive sample historical behavior sequences with the second fractionation frequency
Negative sample historical behavior sequence.
9. device according to claim 8, which is characterized in that described first, which splits frequency, splits frequency less than second.
10. device according to claim 8, which is characterized in that the acquisition module further include:
Submodule is handled, is configured as carrying out the positive sample historical behavior sequence and the negative sample historical behavior sequence
Duplicate removal processing.
11. device according to claim 8, which is characterized in that the training module includes:
Extracting sub-module is configured as extracting the identification feature of the user's history behavioral data；
Computational submodule is configured to calculate the positive sample historical behavior sequence and the negative sample historical behavior sequence
Words-frequency feature；
Training submodule, is configured as the knowledge based on the positive sample historical behavior sequence and the negative sample historical behavior sequence
Other feature and words-frequency feature training obtain abnormal behaviour identification model.
12. device according to claim 11, which is characterized in that after the computational submodule, further includes:
Submodule is deleted, is configured as deleting the words-frequency feature for being less than default word frequency threshold.
13. a kind of electronic equipment characterized by comprising
Memory and one or more processors；
Wherein, the memory is connect with one or more of processor communications, and being stored in the memory can be described
The instruction that one or more processors execute, when described instruction is executed by one or more of processors, the electronic equipment
For realizing as the method according to claim 1 to 6.
14. a kind of computer readable storage medium, is stored thereon with computer executable instructions, refer to when the computer is executable
When order is executed by a computing apparatus, it can be used to realize as the method according to claim 1 to 6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910631735.7A CN110347724A (en) | 2019-07-12 | 2019-07-12 | Abnormal behaviour recognition methods, device, electronic equipment and medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910631735.7A CN110347724A (en) | 2019-07-12 | 2019-07-12 | Abnormal behaviour recognition methods, device, electronic equipment and medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN110347724A true CN110347724A (en) | 2019-10-18 |
Family
ID=68176090
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910631735.7A Pending CN110347724A (en) | 2019-07-12 | 2019-07-12 | Abnormal behaviour recognition methods, device, electronic equipment and medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110347724A (en) |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111178396A (en) * | 2019-12-12 | 2020-05-19 | 国网北京市电力公司 | Method and device for identifying abnormal electricity consumption user |
| CN111417021A (en) * | 2020-03-16 | 2020-07-14 | 广州虎牙科技有限公司 | Plug-in identification method and device, computer equipment and readable storage medium |
| CN111858275A (en) * | 2020-07-03 | 2020-10-30 | 深圳前海微众银行股份有限公司 | Method, device, equipment and storage medium for identifying abnormal media behaviors |
| CN112738088A (en) * | 2020-12-28 | 2021-04-30 | 上海观安信息技术股份有限公司 | Behavior sequence anomaly detection method and system based on unsupervised algorithm |
| CN113485993A (en) * | 2021-07-13 | 2021-10-08 | 浙江网商银行股份有限公司 | Data identification method and device |
| CN113742184A (en) * | 2020-06-05 | 2021-12-03 | 国家计算机网络与信息安全管理中心 | Method and device for constructing user historical behavior expression vector and detecting user behavior abnormity |
| WO2021253223A1 (en) * | 2020-06-16 | 2021-12-23 | Paypal, Inc. | Training recurrent neural network machine learning model with behavioral data |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| GB2557253A (en) * | 2016-12-02 | 2018-06-20 | F Secure Corp | Machine learning based malware detection system |
| CN108306864A (en) * | 2018-01-12 | 2018-07-20 | 深圳壹账通智能科技有限公司 | Network data detection method, device, computer equipment and storage medium |
| CN109714341A (en) * | 2018-12-28 | 2019-05-03 | 厦门服云信息科技有限公司 | A kind of Web hostile attack identification method, terminal device and storage medium |
| CN109815084A (en) * | 2018-12-29 | 2019-05-28 | 北京城市网邻信息技术有限公司 | Abnormality recognition method, device and electronic equipment and storage medium |
-
2019
- 2019-07-12 CN CN201910631735.7A patent/CN110347724A/en active Pending
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| GB2557253A (en) * | 2016-12-02 | 2018-06-20 | F Secure Corp | Machine learning based malware detection system |
| CN108306864A (en) * | 2018-01-12 | 2018-07-20 | 深圳壹账通智能科技有限公司 | Network data detection method, device, computer equipment and storage medium |
| CN109714341A (en) * | 2018-12-28 | 2019-05-03 | 厦门服云信息科技有限公司 | A kind of Web hostile attack identification method, terminal device and storage medium |
| CN109815084A (en) * | 2018-12-29 | 2019-05-28 | 北京城市网邻信息技术有限公司 | Abnormality recognition method, device and electronic equipment and storage medium |
Cited By (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111178396A (en) * | 2019-12-12 | 2020-05-19 | 国网北京市电力公司 | Method and device for identifying abnormal electricity consumption user |
| CN111417021A (en) * | 2020-03-16 | 2020-07-14 | 广州虎牙科技有限公司 | Plug-in identification method and device, computer equipment and readable storage medium |
| CN113742184A (en) * | 2020-06-05 | 2021-12-03 | 国家计算机网络与信息安全管理中心 | Method and device for constructing user historical behavior expression vector and detecting user behavior abnormity |
| CN113742184B (en) * | 2020-06-05 | 2024-03-26 | 国家计算机网络与信息安全管理中心 | Method and device for constructing user history behavior representation vector and detecting user behavior abnormality |
| WO2021253223A1 (en) * | 2020-06-16 | 2021-12-23 | Paypal, Inc. | Training recurrent neural network machine learning model with behavioral data |
| CN111858275A (en) * | 2020-07-03 | 2020-10-30 | 深圳前海微众银行股份有限公司 | Method, device, equipment and storage medium for identifying abnormal media behaviors |
| CN111858275B (en) * | 2020-07-03 | 2022-12-20 | 深圳前海微众银行股份有限公司 | Method, device, equipment and storage medium for identifying abnormal media behaviors |
| CN112738088A (en) * | 2020-12-28 | 2021-04-30 | 上海观安信息技术股份有限公司 | Behavior sequence anomaly detection method and system based on unsupervised algorithm |
| CN113485993A (en) * | 2021-07-13 | 2021-10-08 | 浙江网商银行股份有限公司 | Data identification method and device |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110347724A (en) | Abnormal behaviour recognition methods, device, electronic equipment and medium | |
| US20200050968A1 (en) | Interactive interfaces for machine learning model evaluations | |
| US10318882B2 (en) | Optimized training of linear machine learning models | |
| US10339465B2 (en) | Optimized decision tree based models | |
| CN110992167A (en) | Bank client business intention identification method and device | |
| CN107679082A (en) | Question and answer searching method, device and electronic equipment | |
| CN111143578B (en) | Method, device and processor for extracting event relationship based on neural network | |
| US11423307B2 (en) | Taxonomy construction via graph-based cross-domain knowledge transfer | |
| CN107832291A (en) | Client service method, electronic installation and the storage medium of man-machine collaboration | |
| CN107908796A (en) | E-Government duplicate checking method, apparatus and computer-readable recording medium | |
| CN109767269A (en) | A kind for the treatment of method and apparatus of game data | |
| CN114693192A (en) | Wind control decision method and device, computer equipment and storage medium | |
| CN109754290A (en) | A kind for the treatment of method and apparatus of game data | |
| US11481580B2 (en) | Accessible machine learning | |
| CN111951050A (en) | Financial product recommendation method and device | |
| CN114495137B (en) | Bill abnormity detection model generation method and bill abnormity detection method | |
| CN108921431A (en) | Government and enterprise customers clustering method and device | |
| CN115130756A (en) | Online service management method and device, electronic equipment and storage medium | |
| CN115048487A (en) | Artificial intelligence-based public opinion analysis method, device, computer equipment and medium | |
| CN114090797A (en) | Intelligent recommendation-based component retrieval method and device | |
| CN114693325A (en) | User public praise intelligent guarantee method and device based on neural network | |
| CN113159926A (en) | Loan transaction repayment date determination method and device | |
| CN107992286A (en) | Intelligent coding method, device, terminal device and storage medium | |
| US20230034850A1 (en) | Method to determine that a credit card number change has occurred | |
| US20210042768A1 (en) | Synthetic cohort decay analysis and uses thereof |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20191018 |