CN116132178A

CN116132178A - Behavior data processing method, device, equipment and storage medium

Info

Publication number: CN116132178A
Application number: CN202310126092.7A
Authority: CN
Inventors: 原京瑞; 边志毅
Original assignee: Baidu com Times Technology Beijing Co Ltd
Current assignee: Baidu com Times Technology Beijing Co Ltd
Priority date: 2023-02-15
Filing date: 2023-02-15
Publication date: 2023-05-16

Abstract

The application discloses a behavior data processing method, device, equipment and storage medium, relates to the technical field of data processing, and particularly relates to artificial intelligence and deep learning technology. The specific implementation scheme is as follows: responding to the received behavior data processing request, and acquiring the real-time stream data of the cheating behavior from the behavior data processing request based on a preset anti-cheating recognition model; determining a service scene corresponding to the behavior data processing request, and acquiring a reference cheating behavior parameter of the service scene; acquiring a user pool to be treated according to the real-time stream data of the cheating behaviors, the reference cheating behavior parameters and the first user multi-threshold calculation model; determining a level treatment policy corresponding to the user to be treated in the user to be treated pool, and performing corresponding treatment on the user to be treated in the user to be treated pool based on the determined level treatment policy. And different users can be correspondingly processed according to different thresholds, so that the probability of cracking the behavior mode of the anti-cheating identification model is reduced.

Description

Behavior data processing method, device, equipment and storage medium

Technical Field

The present disclosure relates to the field of data processing technologies, and in particular, to an artificial intelligence and deep learning technology, and in particular, to a behavior data processing method, apparatus, device, and storage medium.

Background

In the related art, the anti-cheating recognition model can detect the cheating probability of the abnormal behavior based on the related parameters and treat the abnormal behavior based on the cheating probability. However, the behavior mode of the anti-cheating recognition model may be perceived, so that the anti-cheating recognition model can be bypassed through corresponding behaviors to disable the anti-cheating model. For example, when a user accesses again using a handled IP (Internet Protocol Address, internet protocol) address, the anti-cheating recognition model increases the probability of cheating by detecting the access behavior of the IP address, but the user can reduce the probability of being detected as a cheating behavior by the anti-cheating recognition model by replacing the IP address.

Disclosure of Invention

The application provides a behavior data processing method, device, equipment and storage medium.

According to an aspect of the present application, there is provided a behavior data processing method, including: responding to a received behavior data processing request, and acquiring real-time stream data of a cheating behavior from the behavior data processing request based on a preset anti-cheating identification model; determining a service scene corresponding to the behavior data processing request, and acquiring a reference cheating behavior parameter of the service scene; acquiring a user pool to be treated according to the cheating behavior real-time stream data, the reference cheating behavior parameters and a first user multi-threshold calculation model; wherein, the first user multi-threshold computing model has learned to obtain the mapping relation between the cheating behavior parameter sample and the cheating probability; determining a level treatment policy corresponding to a user to be treated in the user to be treated pool, and performing respective treatments on the corresponding user to be treated in the user to be treated pool based on the determined level treatment policy.

In one implementation, the obtaining the user pool to be treated according to the real-time streaming data of the cheating behavior, the reference cheating behavior parameter and the first user multi-threshold computing model includes: extracting cheating behavior parameters in the cheating behavior real-time stream data; inputting the cheating behavior parameters and the reference cheating behavior parameters into the first user multi-threshold computing model, and acquiring the cheating probability of each user in each channel in the cheating behavior real-time stream data; and acquiring the user pool to be treated according to the cheating probability of each user in each channel and the operation configuration information of the service scene.

In an optional implementation manner, the obtaining the to-be-disposed user pool according to the cheating probability of each user in each channel and the operation configuration information of the service scenario includes: determining a high-precision recall pool and/or a cheating probability threshold of the high-precision recall pool corresponding to the service scene according to the operation configuration information of the service scene; according to the cheating probability of each user in each channel, the high-precision recall pool and/or the cheating probability threshold value of the high-recall pool are used for placing the identification information of the user in the real-time stream data of the cheating behavior into the corresponding high-precision recall pool and/or the high-recall pool; and acquiring the user pool to be treated according to the identification information in the high-precision recall pool and/or the high-recall pool.

Optionally, the obtaining the user pool to be treated according to the identification information in the high-precision recall pool and/or the high-recall pool includes: counting the number of the same identification information in the high-precision recall pool and/or the high-recall pool; and under the condition that the number of the same identification information reaches a treatment threshold, putting the identification information reaching the treatment threshold into a user pool, and taking the user pool as the user pool to be treated.

Optionally, the determining a level handling policy corresponding to the user to be handled in the user to be handled pool includes: determining an identification information source in the user pool to be treated; determining a level treatment policy of a user corresponding to the identification information from the high-precision recall pool as a first level treatment policy in response to the identification information from the to-be-treated user pool being derived from the high-precision recall pool; or in response to the identification information in the to-be-handled user pool being sourced from the Gao Zhao recall pool, determining that the level handling policy of the user corresponding to the identification information sourced from the Gao Zhao recall pool is a second level handling policy.

In one implementation, the performing, based on the determined level handling policy, respective handling of corresponding users to be handled in the pool of users to be handled includes: based on the determined level treatment policy, respective treatments are performed on corresponding users in the pool of users to be treated in combination with a random time factor and/or a random treatment scale factor.

In one implementation, the method further comprises: based on the anti-cheating recognition model, acquiring real-time streaming data of normal behaviors of a user from the behavior data processing request; performing aggregation calculation on the real-time stream data of the cheating behaviors to obtain composite dimension cheating behavior parameters with service scene characteristics; training a second user multi-threshold computing model according to the user normal behavior real-time stream data, the cheating behavior real-time stream data and the composite dimension cheating behavior parameters; the second user multi-threshold computing model is a first version model of a user multi-threshold computing model, and the first user multi-threshold computing model is a second version model of the user multi-threshold computing model.

In an alternative implementation manner, the training the second user multi-threshold computing model according to the user normal behavior real-time stream data, the cheating behavior real-time stream data and the composite dimension cheating behavior parameter includes: training the second user multi-threshold computing model by a semi-supervised learning method based on the user normal behavior real-time streaming data; the second user multi-threshold computing model learns the behavior parameters and the range of the behavior parameters of the normal user in the training; based on the real-time stream data of the normal behavior of the user and the composite dimension cheating behavior parameters, training the second user multi-threshold computing model continuously by the semi-supervised learning method; the second user multi-threshold computing model learns the mapping relation between the cheating behavior parameters and the cheating probability in the training.

According to a second aspect of the present application, there is provided a behavioural data processing device comprising: the first acquisition module is used for responding to the received behavior data processing request and acquiring the real-time stream data of the cheating behavior from the behavior data processing request based on a preset anti-cheating identification model; the first processing module is used for determining a service scene corresponding to the behavior data processing request and acquiring a reference cheating behavior parameter of the service scene; the second acquisition module acquires a user pool to be treated according to the cheating behavior real-time stream data, the reference cheating behavior parameters and the first user multi-threshold calculation model; wherein, the first user multi-threshold computing model has learned to obtain the mapping relation between the cheating behavior parameter sample and the cheating probability; and the second processing module is used for determining a level treatment strategy corresponding to the user to be treated in the user to be treated pool and carrying out corresponding treatment on the user to be treated in the user to be treated pool based on the determined level treatment strategy.

In one implementation manner, the second obtaining module is specifically configured to: extracting cheating behavior parameters in the cheating behavior real-time stream data; inputting the cheating behavior parameters and the reference cheating behavior parameters into the first user multi-threshold computing model, and acquiring the cheating probability of each user in each channel in the cheating behavior real-time stream data; and acquiring the user pool to be treated according to the cheating probability of each user in each channel and the operation configuration information of the service scene.

In an alternative implementation manner, the second obtaining module is specifically configured to: determining a high-precision recall pool and/or a cheating probability threshold of the high-precision recall pool corresponding to the service scene according to the operation configuration information of the service scene; according to the cheating probability of each user in each channel, the high-precision recall pool and/or the cheating probability threshold value of the high-recall pool are used for placing the identification information of the user in the real-time stream data of the cheating behavior into the corresponding high-precision recall pool and/or the high-recall pool; and acquiring the user pool to be treated according to the identification information in the high-precision recall pool and/or the high-recall pool.

Optionally, the second obtaining module is specifically configured to: counting the number of the same identification information in the high-precision recall pool and/or the high-recall pool;

and under the condition that the number of the same identification information reaches a treatment threshold, putting the identification information reaching the treatment threshold into a user pool, and taking the user pool as the user pool to be treated.

Optionally, the second obtaining module is specifically configured to: determining an identification information source in the user pool to be treated; determining a level treatment policy of a user corresponding to the identification information from the high-precision recall pool as a first level treatment policy in response to the identification information from the to-be-treated user pool being derived from the high-precision recall pool; or in response to the identification information in the to-be-handled user pool being sourced from the Gao Zhao recall pool, determining that the level handling policy of the user corresponding to the identification information sourced from the Gao Zhao recall pool is a second level handling policy.

In one implementation, the second processing module is specifically configured to: based on the determined level treatment policy, respective treatments are performed on corresponding users in the pool of users to be treated in combination with a random time factor and/or a random treatment scale factor.

In one implementation, the apparatus further comprises: the third acquisition module is used for acquiring the real-time streaming data of the normal behavior of the user from the behavior data processing request based on the anti-cheating identification model; the third processing module is used for carrying out aggregation calculation on the real-time stream data of the cheating behaviors so as to obtain composite dimension cheating behavior parameters with service scene characteristics; the training module is used for training a second user multi-threshold computing model according to the user normal behavior real-time stream data, the cheating behavior real-time stream data and the composite dimension cheating behavior parameters; the second user multi-threshold computing model is a first version model of a user multi-threshold computing model, and the first user multi-threshold computing model is a second version model of the user multi-threshold computing model.

In an alternative implementation, the training module is specifically configured to: training the second user multi-threshold computing model through a semi-supervised learning device based on the user normal behavior real-time streaming data; the second user multi-threshold computing model learns the behavior parameters and the range of the behavior parameters of the normal user in the training; based on the real-time stream data of the normal behavior of the user and the composite dimension cheating behavior parameters, training the second user multi-threshold computing model continuously through the semi-supervised learning device; the second user multi-threshold computing model learns the mapping relation between the cheating behavior parameters and the cheating probability in the training.

According to a third aspect of the present application, there is provided an electronic device comprising: at least one processor; and a memory communicatively coupled to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of the first aspect.

According to a fourth aspect of the present application, there is provided a non-transitory computer readable storage medium storing computer instructions for causing the computer to perform the method of the first aspect.

According to a fifth aspect of the present application there is provided a computer program product comprising a computer program which, when executed by a processor, implements the steps of the method of the first aspect.

According to the technology, the real-time flow data of the cheating behaviors can be obtained from the behavior data processing request based on the preset anti-cheating recognition model, and the reference cheating behavior parameters of the corresponding service scene are determined, so that a user pool to be treated is obtained according to the real-time flow data of the cheating behaviors, the reference cheating behavior parameters and the first user multi-threshold calculation model, and corresponding treatment is carried out according to the level treatment strategy corresponding to the user to be treated. And the different users are correspondingly processed according to different thresholds and level treatment strategies, so that the probability of cracking the behavior mode of the anti-cheating identification model is reduced.

It should be understood that the description of this section is not intended to identify key or critical features of the embodiments of the application or to delineate the scope of the application. Other features of the present application will become apparent from the description that follows.

Drawings

The drawings are for better understanding of the present solution and do not constitute a limitation of the present application. Wherein:

FIG. 1 is a schematic diagram according to a first embodiment of the present application;

FIG. 2 is an overall flow chart of a behavioral data processing scheme provided by an embodiment of the present application;

FIG. 3 is a schematic diagram according to a second embodiment of the present application;

FIG. 4 is a schematic diagram of a pending user pool generation flow provided by an embodiment of the present application;

FIG. 5 is a schematic diagram of a first user multi-threshold computing model yield data storage flow provided in an embodiment of the present application;

FIG. 6 is a schematic diagram of a treatment policy scheduling procedure provided in an embodiment of the present application;

FIG. 7 is a schematic diagram according to a third embodiment of the present application;

FIG. 8 is a schematic diagram of a model training process provided in an embodiment of the present application;

FIG. 9 is a schematic diagram of a behavior data processing apparatus according to an embodiment of the present application;

FIG. 10 is a schematic diagram of another behavioral data processing apparatus according to an embodiment of the present application;

Fig. 11 is a block diagram of an electronic device for implementing a method of behavioral data processing according to an embodiment of the application.

Detailed Description

Exemplary embodiments of the present application are described below in conjunction with the accompanying drawings, which include various details of the embodiments of the present application to facilitate understanding, and should be considered as merely exemplary. Accordingly, one of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the present application. Also, descriptions of well-known functions and constructions are omitted in the following description for clarity and conciseness.

Referring to fig. 1, fig. 1 is a schematic diagram according to a first embodiment of the present application. As shown in fig. 1, the behavior data processing method provided in this embodiment may include, but is not limited to, the following steps.

Step S101: and responding to the received behavior data processing request, and acquiring the real-time stream data of the cheating behavior from the behavior data processing request based on a preset anti-cheating recognition model.

Wherein, in embodiments of the present application, the behavior data may include, but is not limited to, behavior data when a user accesses a website or uses an application.

For example, in response to receiving a request for processing behavior data, behavior data corresponding to the behavior data processing request is identified based on a preset anti-cheating identification model, and real-time stream data of the cheating behavior is obtained.

Step S102: and determining a service scene corresponding to the behavior data processing request, and acquiring the reference cheating behavior parameters of the service scene.

In an embodiment of the present application, the above-mentioned business scenario may be a scenario in which a user uses a different application program product (for example, a social application, a community application, or a live application, etc.).

As an example, determining a service scene corresponding to a behavior data processing request as a social application scene, and acquiring a preset reference cheating behavior parameter corresponding to the social application scene.

Step S103: and acquiring a user pool to be treated according to the cheating behavior real-time stream data, the reference cheating behavior parameters and the first user multi-threshold calculation model.

In the embodiment of the application, the first user multi-threshold computing model has learned to obtain the mapping relationship between the cheating behavior parameter sample and the cheating probability.

It may be appreciated that in embodiments of the present application, each different business scenario may correspond to a different first user multi-threshold computing model.

For example, the real-time stream data of the cheating behavior and the reference cheating behavior parameters are input into a first user multi-threshold computing model, the actual cheating probability of each user is obtained, and the users with the actual cheating probabilities larger than the preset probability threshold are put into a user pool to be treated.

Step S104: determining a level treatment policy corresponding to the user to be treated in the user to be treated pool, and performing corresponding treatment on the user to be treated in the user to be treated pool based on the determined level treatment policy.

For example, from a preset plurality of level treatment policies, determining a level treatment policy corresponding to each user to be treated in the user to be treated pool, and performing respective treatment on each corresponding user to be treated in the user to be treated pool based on the level treatment policy corresponding to each user to be treated.

By implementing the embodiment of the application, the real-time flow data of the cheating behavior can be obtained from the behavior data processing request based on the preset anti-cheating identification model, and the reference cheating behavior parameters of the corresponding service scene are determined, so that the user pool to be treated is obtained according to the real-time flow data of the cheating behavior, the reference cheating behavior parameters and the first user multi-threshold calculation model, and corresponding treatment is carried out according to the level treatment strategy corresponding to the user to be treated. And the different users are correspondingly processed according to different thresholds and level treatment strategies, so that the probability of cracking the behavior mode of the anti-cheating identification model is reduced.

As an example, referring to fig. 2, fig. 2 is an overall flowchart of a behavioral data processing scheme provided in an embodiment of the present application. As shown in fig. 2, the behavior data processing scheme provided in the embodiment of the present application firstly processes related data of user cheating behavior to obtain basic data, and obtains a to-be-handled user pool in combination with a preset data processing policy, and then matches each user in the to-be-handled user pool with a corresponding handling policy based on a preset handling policy schedule, so as to perform corresponding processing on the users in the to-be-handled user pool based on the handling policy.

In one implementation, the cheating behavior parameters may be obtained from the cheating behavior real-time streaming data to obtain a pool of users to be disposed of based on the cheating behavior parameters. As an example, please refer to fig. 3, fig. 3 is a schematic diagram according to a second embodiment of the present application. As shown in fig. 3, the behavior data processing method provided in this embodiment may include, but is not limited to, the following steps.

Step S301: and responding to the received behavior data processing request, and acquiring the real-time stream data of the cheating behavior from the behavior data processing request based on a preset anti-cheating recognition model.

In the embodiment of the present application, step S301 may be implemented in any manner in each embodiment of the present application, which is not limited to this embodiment, and is not repeated herein.

Step S302: and determining a service scene corresponding to the behavior data processing request, and acquiring the reference cheating behavior parameters of the service scene.

In the embodiment of the present application, step S302 may be implemented in any manner in each embodiment of the present application, which is not limited to this embodiment, and is not repeated herein.

Step S303: and extracting cheating behavior parameters in the cheating behavior real-time stream data.

For example, by aggregating the cheating behavior calculations, the cheating behavior parameters in the cheating behavior real-time streaming data are extracted.

Step S304: and inputting the cheating behavior parameters and the reference cheating behavior parameters into a first user multi-threshold calculation model, and acquiring the cheating probability of each user in each channel in the cheating behavior real-time stream data.

For example, the cheating behavior parameters and the reference cheating behavior parameters are used as input data to be input into a first user multi-threshold computing model, and the corresponding cheating probability of each user in each channel in the cheating behavior real-time stream data is obtained.

Step S305: and acquiring a user pool to be treated according to the cheating probability of each user in each channel and the operation configuration information of the service scene.

For example, according to operation configuration information of a service scene, a corresponding cheating probability threshold value of each service channel is obtained, the cheating probability of each user in each service channel is compared with the corresponding cheating probability threshold value of each service channel, and a user with the cheating probability of any service channel being greater than or equal to the corresponding cheating probability threshold value of the service channel is obtained as a user to be treated, so that a user pool to be treated is obtained.

In an optional implementation manner, the obtaining the user pool to be disposed according to the cheating probability of each user in each channel and the operation configuration information of the service scenario may include: determining a high-precision recall pool and/or a cheating probability threshold value of the high-precision recall pool corresponding to the service scene according to operation configuration information of the service scene; according to the cheating probability of each user in each channel, the high-precision recall pool and/or the cheating probability threshold value of the high-recall pool are/is used for putting the identification information of the user in the real-time stream data of the cheating behavior into the corresponding high-precision recall pool and/or the high-recall pool; and acquiring a user pool to be treated according to the high-precision recall pool and/or the identification information in the high-precision recall pool.

As an example, a high-precision recall pool corresponding to a service scene is determined according to operation configuration information of the service scene, identification information (e.g., UID (User Identification, user identification)) of a user with a cheating probability greater than or equal to a cheating probability threshold corresponding to the high-precision recall pool is obtained from the cheating behavior real-time stream data of each user in each channel according to the cheating probability of each user, and the identification information is put into the corresponding high-precision recall pool, so that a user pool to be treated is obtained according to the identification information in the high-precision recall pool.

As another example, a recall pool Gao Zhao (i.e. high recall rate) corresponding to a service scenario is determined according to operation configuration information of the service scenario, identification information of a user with a cheating probability greater than or equal to a threshold value of the cheating probability corresponding to the high recall pool is obtained from the real-time stream data of the cheating behavior according to the cheating probability of each user in each channel, and the identification information is put into the corresponding recall pool Gao Zhao, so that a pool of users to be treated is obtained according to the identification information in the recall pool Gao Zhao.

As yet another example, a high-precision recall pool and a Gao Zhao recall pool corresponding to a service scene are determined according to operation configuration information of the service scene, and according to the cheating probability of each user in each channel, the identification information of the user with the cheating probability greater than or equal to the cheating probability threshold corresponding to the high-precision recall pool and greater than or equal to the cheating probability threshold corresponding to the Gao Zhao recall pool is obtained from the real-time stream data of the cheating behaviors, and the identification information is put into the corresponding high-precision recall pool and Gao Zhao recall pool, so that a pool of users to be treated is obtained according to the identification information in the high-precision recall pool and the Gao Zhao recall pool.

It can be appreciated that the above method can simultaneously consider the service requirement of high-precision recall and the service requirement of high-recall rate recall, thereby meeting the requirements of different service scenes with strong error recall sensitivity and/or strong pollution sensitivity.

Referring to fig. 4, fig. 4 is a schematic diagram of a pending user pool generation procedure according to an embodiment of the present application. As shown in fig. 4, in the to-be-handled user pool generation flow provided in the embodiment of the present application, real-time processing may be performed on real-time stream data and basic data of a user's cheating behavior based on a real-time computing cluster, so that data with a cheating probability greater than or equal to a cheating probability threshold corresponding to a high-precision recall pool is obtained from the real-time stream data to generate the high-precision recall pool, and data with a cheating probability greater than or equal to a cheating probability threshold corresponding to the high-precision recall pool may be obtained from the real-time stream data to generate the Gao Zhao recall pool.

Optionally, the obtaining the user pool to be disposed according to the high-precision recall pool and/or the identification information in the high-precision recall pool may include: counting the number of identical identification information in the high-precision recall pool and/or the high-recall pool; and under the condition that the number of the same identification information reaches the treatment threshold, putting the identification information reaching the treatment threshold into a user pool, and taking the user pool as a user pool to be treated.

As an example, the number of identical identification information in the high-precision recall pool is counted, and when the number of identical identification information is greater than or equal to a preset treatment threshold, the identification information reaching the treatment threshold is put into the user pool, and the user pool is used as the user pool to be treated.

As another example, the number of identical identification information in the recall pool Gao Zhao is counted, and in the case where the number of identical identification information is greater than or equal to the preset disposition threshold, the identification information reaching the disposition threshold is put into the user pool, and the user pool is taken as the user pool to be disposed.

As yet another example, counting the number of identical identification information in the high-precision recall pool and the Gao Zhao recall pool; and under the condition that the number of the same identification information is larger than or equal to a preset treatment threshold value, putting the identification information reaching the treatment threshold value into a user pool, and taking the user pool as a user pool to be treated.

Referring to fig. 5, fig. 5 is a schematic diagram of a first user multi-threshold computing model output data storage flow according to an embodiment of the present application. As shown in fig. 5, in an embodiment of the present application, the first user multi-threshold computing model may calculate the user cheating probability based on the behavior data of each user, compare the cheating probability with the handling threshold under the high-precision model and the handling threshold under the high-precision model, respectively, store the result that the cheating probability is greater than the handling threshold under the high-precision model, the relevant mapping data (such as the real-time UID, the handling threshold, and the channel data), and the global information of the corresponding user (including, but not limited to, the user information, the user behavior information, and the like), and store the result that the cheating probability is greater than the handling threshold under the Gao Zhao model, the relevant mapping data, and the global information of the corresponding user.

Step S306: determining a level treatment policy corresponding to the user to be treated in the user to be treated pool, and performing corresponding treatment on the user to be treated in the user to be treated pool based on the determined level treatment policy.

In the embodiment of the present application, step S306 may be implemented in any manner in each embodiment of the present application, which is not limited to this embodiment, and is not repeated herein.

Optionally, the determining the level treatment policy corresponding to the user to be treated in the user to be treated pool may include: determining the source of identification information in the user pool to be treated; determining that the level treatment policy of the user corresponding to the identification information from the high-precision recall pool is a first level treatment policy in response to the identification information from the to-be-treated user pool from the high-precision recall pool; or in response to the identification information in the to-be-handled user pool originating from the high recall pool, determining that the level handling policy of the user corresponding to the identification information originating from the Gao Zhao recall pool is the second level handling policy.

As an example, it is determined that the identification information in the to-be-handled user pool originates from the high-precision recall pool, and the level handling policy of the user corresponding to the identification information originating from the high-precision recall pool is determined to be a preset first level handling policy.

In an embodiment of the present application, the first level processing policy may be a UV (Unique identifier) processing policy.

As another example, it is determined that the identification information in the to-be-handled user pool originates from the recall pool, and it is determined that the level handling policy of the user corresponding to the identification information originating from the recall pool Gao Zhao is a preset second level handling policy.

In an embodiment of the present application, the second level handling policy may be a PV (Page View) level handling policy.

As an example, please refer to fig. 6, fig. 6 is a schematic diagram of a treatment policy scheduling procedure provided in an embodiment of the present application. As shown in fig. 6, in an embodiment of the present application, after obtaining the pool of users to be treated according to Gao Zhao recall pool and/or high-precision recall pool, the treatment scheduler may determine that the users to be treated originate from the high-precision recall pool or the high-precision recall pool based on the identification information in the pool of users to be treated; in response to determining that the user to be treated originates from the high-precision recall pool, dividing the user to be treated into a UV-level policy group to perform respective treatments on the user to be treated based on the UV-level policies; alternatively, in response to determining that the to-be-treated user originated from the Gao Zhao recall pool, the to-be-treated user is partitioned into a set of PV-level policies to perform respective treatments on the to-be-treated user based on the PV-level policies.

By implementing the embodiment of the application, the cheating behavior parameters can be acquired based on the acquired cheating behavior real-time streaming data, the reference cheating behavior parameters corresponding to the service scene are determined, the cheating probability of each user in each channel is acquired based on the first user multi-threshold calculation model, the user pool to be treated is acquired by combining the operation configuration information of the service scene, and corresponding treatment is performed according to the level treatment strategy corresponding to the user to be treated. Therefore, corresponding processing is carried out on different users according to different service scenes, and the probability of cracking the behavior mode of the anti-cheating identification model is reduced.

In one implementation, the corresponding to-be-treated users in the pool of to-be-treated users may be treated accordingly in combination with a random time factor and/or a random treatment scale factor. As an example, please refer to fig. 7, fig. 7 is a schematic diagram according to a third embodiment of the present application. As shown in fig. 7, the behavior data processing method provided by this embodiment may include, but is not limited to, the following steps.

Step S701: and responding to the received behavior data processing request, and acquiring the real-time stream data of the cheating behavior from the behavior data processing request based on a preset anti-cheating recognition model.

In the embodiment of the present application, step S701 may be implemented in any manner in each embodiment of the present application, which is not limited to this embodiment, and is not repeated herein.

Step S702: and determining a service scene corresponding to the behavior data processing request, and acquiring the reference cheating behavior parameters of the service scene.

In the embodiment of the present application, step S702 may be implemented in any manner in each embodiment of the present application, which is not limited to this embodiment, and is not repeated herein.

Step S703: and acquiring a user pool to be treated according to the cheating behavior real-time stream data, the reference cheating behavior parameters and the first user multi-threshold calculation model.

In the embodiment of the present application, step S703 may be implemented in any manner in each embodiment of the present application, which is not limited and will not be described in detail.

Step S704: determining a level treatment policy corresponding to the user to be treated in the user to be treated pool, and carrying out corresponding treatment on the user to be treated in the user to be treated pool by combining a random time factor and/or a random treatment scale factor based on the determined level treatment policy.

As an example, a level treatment policy corresponding to the users to be treated in the pool of users to be treated is determined, a corresponding delay time is determined in combination with a random time factor, and after the delay time is passed, the corresponding users to be treated in the pool of users to be treated are treated based on the determined level treatment policy.

As another example, a level treatment policy corresponding to a user to be treated in a pool of users to be treated is determined, a treatment percentage is determined in combination with a random treatment scale factor, a target user to be treated is randomly selected from all users to be treated in the pool of users to be treated based on the treatment percentage, and the target user to be treated is correspondingly treated based on the determined level treatment policy.

As yet another example, a level treatment policy corresponding to a user to be treated in a pool of users to be treated is determined, a corresponding delay time is determined in combination with a random time factor, a treatment percentage is determined in combination with a random treatment scale factor, a target user to be treated is randomly selected from all users to be treated in the pool of users to be treated based on the treatment percentage, and after the delay time, the target user to be treated is correspondingly processed based on the determined level treatment policy.

By implementing the embodiment of the application, the real-time flow data of the cheating behavior can be obtained from the behavior data processing request based on the preset anti-cheating identification model, and the reference cheating behavior parameters of the corresponding service scene are determined, so that the user pool to be treated is obtained according to the real-time flow data of the cheating behavior, the reference cheating behavior parameters and the first user multi-threshold calculation model, and the corresponding treatment is performed according to the level treatment strategy corresponding to the user to be treated by combining the random time factor and/or the random treatment scale factor. Thereby reducing the probability of perceived processing behavior to reduce the probability of cracking the behavior pattern of the anti-cheating recognition model.

In some embodiments of the present application, the behavior data processing method may further include: based on the anti-cheating recognition model, acquiring real-time streaming data of normal behaviors of the user from the behavior data processing request; performing aggregation calculation on the real-time stream data of the cheating behaviors to obtain composite dimension cheating behavior parameters with service scene characteristics; and training a second user multi-threshold computing model according to the user normal behavior real-time stream data, the cheating behavior real-time stream data and the composite dimension cheating behavior parameters.

In an embodiment of the present application, the second user multi-threshold computing model is a first version model of the user multi-threshold computing model, and the first user multi-threshold computing model is a second version model of the user multi-threshold computing model.

For example, based on an anti-cheating recognition model, recognizing the behavior real-time streaming data corresponding to the behavior data processing request, and obtaining the normal behavior real-time streaming data of the user; the real-time stream data of the cheating behaviors are aggregated and calculated to obtain composite dimension cheating behavior parameters with service scene characteristics; and training a second user multi-threshold computing model according to the user normal behavior real-time stream data, the cheating behavior real-time stream data and the composite dimension cheating behavior parameters.

Optionally, training the second user multi-threshold computing model according to the user normal behavior real-time stream data, the cheating behavior real-time stream data and the composite dimension cheating behavior parameters may include the following steps.

And a step a1 of training a second user multi-threshold calculation model by a semi-supervised learning method based on the real-time streaming data of the normal behavior of the user.

In the embodiment of the application, the second user multi-threshold computing model learns the behavior parameters and the range of the behavior parameters of the normal user through the training.

For example, the real-time streaming data of the normal behavior of the user is used as training data, the cross entropy is used as a loss function, and the second user multi-threshold computing model is trained by a semi-supervised learning method, so that the second user multi-threshold computing model learns the behavior parameters and the range of the normal user in the training.

And a2, on the basis of completing training a second user multi-threshold computing model based on the user normal behavior real-time stream data, continuously training the second user multi-threshold computing model by a semi-supervised learning method based on the cheating behavior real-time stream data and the composite dimension cheating behavior parameters.

In the embodiment of the application, the second user multi-threshold computing model learns the mapping relation between the cheating behavior parameters and the cheating probability in the training.

For example, the cheating behavior real-time stream data and the composite dimension cheating behavior parameters are used as training data, cross entropy is used as a loss function, and training of the second user multi-threshold computing model based on the user normal behavior real-time stream data is completed through a semi-supervised learning method to continue training.

As an example, please refer to fig. 8, fig. 8 is a schematic diagram of a model training procedure provided in an embodiment of the present application. As shown in fig. 8, in the embodiment of the present application, firstly, recognition processing is performed on behavior data of a user based on an anti-cheating recognition model to obtain behavior data and cheating behavior data of a total amount of users, and the cheating behavior data is input into an aggregate calculation model to obtain a composite dimension cheating parameter with service characteristics as a bypass data stream; then calculating cheating probability of each user in each channel based on the flying oar frame; based on the cheating probability, the real-time stream data A corresponding to the behavior data of the full users and the real-time stream data B corresponding to the cheating behavior data are combined to train a second user multi-threshold computing model.

Referring to fig. 9, fig. 9 is a schematic diagram of a behavior data processing apparatus according to an embodiment of the present application. As shown in fig. 9, the apparatus 900 includes: the first obtaining module 901 is configured to obtain, in response to receiving the behavioral data processing request, real-time streaming data of the cheating behavior from the behavioral data processing request based on a preset anti-cheating recognition model; the first processing module 902 is configured to determine a service scenario corresponding to the behavioral data processing request, and obtain a reference cheating behavior parameter of the service scenario; the second obtaining module 903 obtains a user pool to be treated according to the real-time stream data of the cheating behavior, the reference cheating behavior parameters and the first user multi-threshold computing model; wherein, the first user multi-threshold computing model has learned to obtain the mapping relation between the cheating behavior parameter sample and the cheating probability; a second processing module 904, configured to determine a level handling policy corresponding to a user to be handled in the user to be handled pool, and perform respective handling on the corresponding user to be handled in the user to be handled pool based on the determined level handling policy.

In one implementation, the second obtaining module 903 is specifically configured to: extracting cheating behavior parameters in the real-time stream data of the cheating behavior; inputting the cheating behavior parameters and the reference cheating behavior parameters into a first user multi-threshold calculation model, and acquiring the cheating probability of each user in each channel in the cheating behavior real-time stream data; and acquiring a user pool to be treated according to the cheating probability of each user in each channel and the operation configuration information of the service scene.

In an alternative implementation, the second obtaining module 903 is specifically configured to: determining a high-precision recall pool and/or a cheating probability threshold value of the high-precision recall pool corresponding to the service scene according to operation configuration information of the service scene; according to the cheating probability of each user in each channel, the high-precision recall pool and/or the cheating probability threshold value of the high-recall pool are/is used for putting the identification information of the user in the real-time stream data of the cheating behavior into the corresponding high-precision recall pool and/or the high-recall pool; and acquiring a user pool to be treated according to the high-precision recall pool and/or the identification information in the high-precision recall pool.

Optionally, the second obtaining module 903 is specifically configured to: counting the number of identical identification information in the high-precision recall pool and/or the high-recall pool; and under the condition that the number of the same identification information reaches the treatment threshold, putting the identification information reaching the treatment threshold into a user pool, and taking the user pool as a user pool to be treated.

Optionally, the second obtaining module 903 is specifically configured to: determining the source of identification information in the user pool to be treated; determining that the level treatment policy of the user corresponding to the identification information from the high-precision recall pool is a first level treatment policy in response to the identification information from the to-be-treated user pool from the high-precision recall pool; or in response to the identification information in the to-be-handled user pool originating from the high recall pool, determining that the level handling policy of the user corresponding to the identification information originating from the Gao Zhao recall pool is the second level handling policy.

In one implementation, the second processing module 904 is specifically configured to: based on the determined level treatment policy, respective treatments are performed on corresponding users to be treated in the pool of users to be treated in combination with a random time factor and/or a random treatment scale factor.

In one implementation, the apparatus further includes: the system comprises a third acquisition module, a third processing module and a training module. As an example, please refer to fig. 10, fig. 10 is a schematic diagram of another behavior data processing apparatus provided in an embodiment of the present application. As shown in fig. 10. The device 1000 includes a third obtaining module 1005, configured to obtain, from a behavior data processing request, real-time streaming data of normal behavior of a user based on an anti-cheating recognition model; a third processing module 1006, configured to aggregate the real-time stream data of the cheating behavior to obtain a composite dimension cheating behavior parameter with a service scene feature; the training module 1007 is configured to train the second user multi-threshold calculation model according to the user normal behavior real-time stream data, the cheating behavior real-time stream data and the composite dimension cheating behavior parameter; the second user multi-threshold computing model is a first version model of the user multi-threshold computing model, and the first user multi-threshold computing model is a second version model of the user multi-threshold computing model. Wherein 1001-1004 in fig. 10 and 901-904 in fig. 9 have the same function and structure.

In an alternative implementation, training module 1007 is specifically configured to: training a second user multi-threshold calculation model through a semi-supervised learning device based on the user normal behavior real-time streaming data; the second user multi-threshold calculation model learns the behavior parameters and the range of the behavior parameters of the normal user in the training; based on the real-time stream data of the normal behavior of the user and the composite dimension cheating behavior parameters, the second user multi-threshold computing model is trained continuously through a semi-supervised learning device; the second user multi-threshold computing model learns the mapping relation between the cheating behavior parameters and the cheating probability in the training.

By the device, the real-time flow data of the cheating behavior can be obtained from the behavior data processing request based on the preset anti-cheating identification model, and the reference cheating behavior parameters of the corresponding business scene are determined, so that the user pool to be treated is obtained according to the real-time flow data of the cheating behavior, the reference cheating behavior parameters and the first user multi-threshold calculation model, and corresponding treatment is carried out according to the level treatment strategy corresponding to the user to be treated. And accordingly, different users are correspondingly processed according to different thresholds, and the probability of cracking the behavior mode of the anti-cheating identification model is reduced.

The specific manner in which the various modules perform the operations in the apparatus of the above embodiments have been described in detail in connection with the embodiments of the method, and will not be described in detail herein.

According to embodiments of the present application, an electronic device and a readable storage medium are also provided.

As shown in fig. 11, a block diagram of an electronic device is provided for a method of behavioral data processing according to an embodiment of the present application. Electronic devices are intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular telephones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be exemplary only, and are not meant to limit implementations of the application described and/or claimed herein.

As shown in fig. 11, the electronic device includes: one or more processors 1101, memory 1102, and interfaces for connecting the various components, including a high speed interface and a low speed interface. The various components are interconnected using different buses and may be mounted on a common motherboard or in other manners as desired. The processor may process instructions executing within the electronic device, including instructions stored in or on memory to display graphical information of the GUI on an external input/output device, such as a display device coupled to the interface. In other embodiments, multiple processors and/or multiple buses may be used, if desired, along with multiple memories and multiple memories. Also, multiple electronic devices may be connected, each providing a portion of the necessary operations (e.g., as a server array, a set of blade servers, or a multiprocessor system). In fig. 11, a processor 1101 is taken as an example.

Memory 1102 is a non-transitory computer-readable storage medium provided herein. Wherein the memory stores instructions executable by the at least one processor to cause the at least one processor to perform the methods of behavioral data processing provided herein. The non-transitory computer readable storage medium of the present application stores computer instructions for causing a computer to perform the methods of behavioral data processing provided herein.

The memory 1102 is used as a non-transitory computer readable storage medium for storing non-transitory software programs, non-transitory computer-executable programs, and modules, such as program instructions/modules (e.g., the first acquisition module 901, the first processing module 902, the second acquisition module 903, and the second processing module 904, and the third acquisition module 1005, the third processing module 1006, and the training module 1007, respectively, shown in fig. 9) corresponding to the method of behavior data processing in the embodiments of the present application. The processor 1101 executes various functional applications of the server and data processing, i.e., a method of performing behavioral data processing in the above-described method embodiments, by running non-transitory software programs, instructions, and modules stored in the memory 1102.

Memory 1102 may include a storage program area that may store an operating system, at least one application program required for functionality, and a storage data area; the storage data area may store data created according to the use of the electronic device of the behavior data processing, and the like. In addition, memory 1102 may include high-speed random access memory, and may also include non-transitory memory, such as at least one magnetic disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory 1102 optionally includes memory located remotely from processor 1101, which may be connected to the behavioural data processing electronics through a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.

The electronic device of the method of behavioural data processing may further comprise: an input device 1103 and an output device 1104. The processor 1101, memory 1102, input device 1103 and output device 1104 may be connected by a bus or other means, for example in fig. 11.

The input device 1103 may receive input numeric or character information, as well as generate key signal inputs related to user settings and function control of the electronic device for behavioral data processing, such as a touch screen, a keypad, a mouse, a trackpad, a touchpad, a pointer stick, one or more mouse buttons, a trackball, a joystick, and the like. The output device 1104 may include a display device, auxiliary lighting (e.g., LEDs), and haptic feedback (e.g., a vibration motor), among others. The display device may include, but is not limited to, a Liquid Crystal Display (LCD), a Light Emitting Diode (LED) display, and a plasma display. In some implementations, the display device may be a touch screen.

Various implementations of the systems and techniques described here can be realized in digital electronic circuitry, integrated circuitry, application specific ASIC (application specific integrated circuit), computer hardware, firmware, software, and/or combinations thereof. These various embodiments may include: implemented in one or more computer programs, the one or more computer programs may be executed and/or interpreted on a programmable system including at least one programmable processor, which may be a special purpose or general-purpose programmable processor, that may receive data and instructions from, and transmit data and instructions to, a storage system, at least one input device, and at least one output device.

These computing programs (also referred to as programs, software applications, or code) include machine instructions for a programmable processor, and may be implemented in a high-level procedural and/or object-oriented programming language, and/or in assembly/machine language. As used herein, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, apparatus, and/or device (e.g., magnetic discs, optical disks, memory, programmable Logic Devices (PLDs)) used to provide machine instructions and/or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The term "machine-readable signal" refers to any signal used to provide machine instructions and/or data to a programmable processor.

To provide for interaction with a user, the systems and techniques described here can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to a user; and a keyboard and pointing device (e.g., a mouse or trackball) by which a user can provide input to the computer. Other kinds of devices may also be used to provide for interaction with a user; for example, feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form, including acoustic input, speech input, or tactile input.

The systems and techniques described here can be implemented in a computing system that includes a background component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., a user computer having a graphical user interface or a web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such background, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local Area Networks (LANs), wide Area Networks (WANs), the internet, and blockchain networks.

The computer system may include a client and a server. The client and server are typically remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, also called a cloud computing server or a cloud host, and is a host product in a cloud computing service system, so that the defects of high management difficulty and weak service expansibility in the traditional physical hosts and VPS service ("Virtual Private Server" or simply "VPS") are overcome. The server may also be a server of a distributed system or a server that incorporates a blockchain.

According to the technical scheme of the embodiment of the application, the cheating behavior real-time stream data can be obtained from the behavior data processing request based on the preset anti-cheating recognition model, and the reference cheating behavior parameters of the corresponding business scene are determined, so that the user pool to be treated is obtained according to the cheating behavior real-time stream data, the reference cheating behavior parameters and the first user multi-threshold calculation model, and corresponding treatment is carried out according to the level treatment strategy corresponding to the user to be treated. And accordingly, different users are correspondingly processed according to different thresholds, and the probability of cracking the behavior mode of the anti-cheating identification model is reduced.

It should be appreciated that the various forms of flow shown above may be used, reordered, augmented, or performed in a different order, provided that the desired results of the presently disclosed technology are achieved, and are not limited herein.

The above embodiments do not limit the scope of the application. It will be apparent to those skilled in the art that various modifications, combinations, sub-combinations and alternatives are possible, depending on design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application are intended to be included within the scope of the present application.

Claims

1. A behavioral data processing method comprising:

responding to a received behavior data processing request, and acquiring real-time stream data of a cheating behavior from the behavior data processing request based on a preset anti-cheating identification model;

determining a service scene corresponding to the behavior data processing request, and acquiring a reference cheating behavior parameter of the service scene;

acquiring a user pool to be treated according to the cheating behavior real-time stream data, the reference cheating behavior parameters and a first user multi-threshold calculation model; wherein, the first user multi-threshold computing model has learned to obtain the mapping relation between the cheating behavior parameter sample and the cheating probability;

Determining a level treatment policy corresponding to a user to be treated in the user to be treated pool, and performing respective treatments on the corresponding user to be treated in the user to be treated pool based on the determined level treatment policy.

2. The method of claim 1, wherein the obtaining a pool of users to be treated from the cheating behavior real-time streaming data, the reference cheating behavior parameters, and a first user multi-threshold computing model comprises:

extracting cheating behavior parameters in the cheating behavior real-time stream data;

inputting the cheating behavior parameters and the reference cheating behavior parameters into the first user multi-threshold computing model, and acquiring the cheating probability of each user in each channel in the cheating behavior real-time stream data;

and acquiring the user pool to be treated according to the cheating probability of each user in each channel and the operation configuration information of the service scene.

3. The method of claim 2, wherein the obtaining the pool of users to be disposed according to the cheating probability of each user in each channel and the operation configuration information of the service scenario comprises:

determining a high-precision recall pool and/or a cheating probability threshold of the high-precision recall pool corresponding to the service scene according to the operation configuration information of the service scene;

According to the cheating probability of each user in each channel, the high-precision recall pool and/or the cheating probability threshold value of the high-recall pool are used for placing the identification information of the user in the real-time stream data of the cheating behavior into the corresponding high-precision recall pool and/or the high-recall pool;

and acquiring the user pool to be treated according to the identification information in the high-precision recall pool and/or the high-recall pool.

4. The method of claim 3, wherein the obtaining the pool of users to be treated from the identification information among the high-precision recall pool and/or high-recall pool comprises:

counting the number of the same identification information in the high-precision recall pool and/or the high-recall pool;

5. The method of claim 3 or 4, wherein the determining a level handling policy corresponding to a user to be handled in the pool of users to be handled comprises:

determining an identification information source in the user pool to be treated;

determining a level treatment policy of a user corresponding to the identification information from the high-precision recall pool as a first level treatment policy in response to the identification information from the to-be-treated user pool being derived from the high-precision recall pool;

Or in response to the identification information in the to-be-handled user pool being sourced from the Gao Zhao recall pool, determining that the level handling policy of the user corresponding to the identification information sourced from the Gao Zhao recall pool is a second level handling policy.

6. The method of claim 1, wherein the respective treatment of the corresponding treatment user in the pool of treatment users based on the determined level treatment policy comprises:

based on the determined level treatment policy, respective treatments are performed on corresponding users in the pool of users to be treated in combination with a random time factor and/or a random treatment scale factor.

7. The method of claim 1, further comprising:

based on the anti-cheating recognition model, acquiring real-time streaming data of normal behaviors of a user from the behavior data processing request;

performing aggregation calculation on the real-time stream data of the cheating behaviors to obtain composite dimension cheating behavior parameters with service scene characteristics;

training a second user multi-threshold computing model according to the user normal behavior real-time stream data, the cheating behavior real-time stream data and the composite dimension cheating behavior parameters;

the second user multi-threshold computing model is a first version model of a user multi-threshold computing model, and the first user multi-threshold computing model is a second version model of the user multi-threshold computing model.

8. The method of claim 7, wherein the training a second user multi-threshold computing model based on the user normal behavior real-time streaming data, the cheating behavior real-time streaming data, and the composite dimension cheating behavior parameters comprises:

training the second user multi-threshold computing model by a semi-supervised learning method based on the user normal behavior real-time streaming data; the second user multi-threshold computing model learns the behavior parameters and the range of the behavior parameters of the normal user in the training;

based on the real-time stream data of the normal behavior of the user and the composite dimension cheating behavior parameters, training the second user multi-threshold computing model continuously by the semi-supervised learning method; the second user multi-threshold computing model learns the mapping relation between the cheating behavior parameters and the cheating probability in the training.

9. A behavioural data processing apparatus, comprising:

the first acquisition module is used for responding to the received behavior data processing request and acquiring the real-time stream data of the cheating behavior from the behavior data processing request based on a preset anti-cheating identification model;

The first processing module is used for determining a service scene corresponding to the behavior data processing request and acquiring a reference cheating behavior parameter of the service scene;

the second acquisition module acquires a user pool to be treated according to the cheating behavior real-time stream data, the reference cheating behavior parameters and the first user multi-threshold calculation model; wherein, the first user multi-threshold computing model has learned to obtain the mapping relation between the cheating behavior parameter sample and the cheating probability;

and the second processing module is used for determining a level treatment strategy corresponding to the user to be treated in the user to be treated pool and carrying out corresponding treatment on the user to be treated in the user to be treated pool based on the determined level treatment strategy.

10. The apparatus of claim 9, wherein the second acquisition module is specifically configured to:

11. The apparatus of claim 10, wherein the second acquisition module is specifically configured to:

12. The apparatus of claim 11, wherein the second acquisition module is specifically configured to:

13. The apparatus of claim 11 or 12, wherein the second acquisition module is specifically configured to:

14. The apparatus of claim 9, wherein the second processing module is specifically configured to:

15. The apparatus of claim 9, further comprising:

the third acquisition module is used for acquiring the real-time streaming data of the normal behavior of the user from the behavior data processing request based on the anti-cheating identification model;

the third processing module is used for carrying out aggregation calculation on the real-time stream data of the cheating behaviors so as to obtain composite dimension cheating behavior parameters with service scene characteristics;

The training module is used for training a second user multi-threshold computing model according to the user normal behavior real-time stream data, the cheating behavior real-time stream data and the composite dimension cheating behavior parameters;

16. The apparatus of claim 15, wherein the training module is specifically configured to:

training the second user multi-threshold computing model through a semi-supervised learning device based on the user normal behavior real-time streaming data; the second user multi-threshold computing model learns the behavior parameters and the range of the behavior parameters of the normal user in the training;

based on the real-time stream data of the normal behavior of the user and the composite dimension cheating behavior parameters, training the second user multi-threshold computing model continuously through the semi-supervised learning device; the second user multi-threshold computing model learns the mapping relation between the cheating behavior parameters and the cheating probability in the training.

17. An electronic device, comprising:

at least one processor; and

a memory communicatively coupled to the at least one processor; wherein,,

the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 8.

18. A non-transitory computer readable storage medium storing computer instructions for causing the computer to perform the method of any one of claims 1 to 8.

19. A computer program product comprising a computer program which, when executed by a processor, implements the steps of the method of any one of claims 1 to 8.