CN105740667B - A kind of information identifying method and device based on user behavior - Google Patents
A kind of information identifying method and device based on user behavior Download PDFInfo
- Publication number
- CN105740667B CN105740667B CN201410759175.0A CN201410759175A CN105740667B CN 105740667 B CN105740667 B CN 105740667B CN 201410759175 A CN201410759175 A CN 201410759175A CN 105740667 B CN105740667 B CN 105740667B
- Authority
- CN
- China
- Prior art keywords
- information
- current
- historical
- sample set
- characteristic information
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Abstract
This application discloses a kind of information identifying method and device based on user behavior, this method comprises: determining the corresponding characteristic information of current operating information, as current characteristic information, determine the corresponding historical sample set of current characteristic information, it include multiple historical operation informations in the historical sample set, when according to the exceptional sample for including in the historical sample set, determining the current operating information is abnormal operation information, respective handling is carried out to the current operating information.Pass through this method, server can be according to the current characteristic information, determine its corresponding historical sample set, and according to the accounting of abnormal operation information in the historical sample set, determines that current operating information is the probability of abnormal operation information, judge whether current operating information is abnormal operation information so as to accurate, and, judgement verification can be carried out to current operating information, effectively improve safety and the practicability of verification when without using the mode of user identity verification.
Description
Technical field
This application involves field of computer technology more particularly to a kind of information identifying methods and dress based on user behavior
It sets.
Background technique
With the development of information technology, Internet technology is maked rapid progress, the network attack that on-line system (such as: website) faces
It becomes more diversified, complicate, magnanimity, great threat is constituted to the safety of user information in on-line system.
In the prior art, on-line system generallys use the mode of user identity verification, guarantees the safety of user information, so that
On-line operation can safely be carried out by obtaining user, that is, user needs after corresponding proof of identity, can just be logged on to online
In system, to carry out corresponding on-line operation.
Common identity verification method includes: that (such as: computer is whole for cryptographic check, biological characteristic verification and equipment verification
End verification, mobile terminal verification) etc..Above-mentioned user identity verification mode can be not only used for prevention and authorize without user
Network behavior, avoid user information impaired, decreasing user has the proof of identity process of perception (such as: using equipment verification
When, user is not necessarily to input validation information).
However, the mode of above-mentioned user identity verification have the defects that it is certain:
For cryptographic check, user verifies each time, requires to input corresponding encrypted message, checking procedure is more
It is cumbersome, also, if encrypted message loses after, other users can also be logged in smoothly using the encrypted message, on-line system without
Method judges the true identity of registrant, so that the safety of user information cannot be effectively ensured.
For biological characteristic verification, although biological characteristic verifies safety with higher, this verification mode
It is limited by software and hardware and recognizer accuracy, reduces the popularity of which, practicability is poor.
For equipment verification, equipment verification binds user information and relevant device, although carrying out identity
When verification, on-line system directly passes through the equipment and is assured that out user information, and the input without user operates, still, if
When user uses other equipment, user bound information again is needed, binding procedure is relatively complicated, moreover, and if user information
Mutually after the device losses of binding, other users arbitrarily can carry out network operation using the equipment, make to the safety of user information
At great threat.
Summary of the invention
The embodiment of the present application provides a kind of information identifying method and device based on user behavior, to solve current user
The problem that the safety of identity verification method is lower and limitation is larger.
A kind of information identifying method based on user behavior provided by the embodiments of the present application, comprising:
The corresponding characteristic information of current operating information is determined, as current characteristic information；
It determines the corresponding historical sample set of the current characteristic information, includes multiple history in the historical sample set
Operation information；
When according to the exceptional sample for including in the historical sample set, determining that the current operating information is abnormal operation
When information, respective handling is carried out to the current operating information.
A kind of information recognition device based on user behavior provided by the embodiments of the present application, comprising:
Characteristic information module, for determining the corresponding characteristic information of current operating information, as current characteristic information；
Historical sample collection modules, for determining the corresponding historical sample set of the current characteristic information, the history
It include multiple historical operation informations in sample set；
Processing module determines the current operation for working as according to the exceptional sample for including in the historical sample set
When information is abnormal operation information, respective handling is carried out to the current operating information.
The embodiment of the present application provides a kind of information identifying method and device based on user behavior, passes through this method, service
After device receives current operating information, the current characteristic information of the current operating information is determined, and according to the current characteristic information,
Its corresponding historical sample set is determined, due to the exceptional sample and normal sample in historical sample set comprising having identified
This, then, according to the accounting of abnormal operation information in the historical sample set, so that it may determine that current operating information is abnormal
The probability of operation information judges whether current operating information is abnormal operation information so as to accurate, and it is possible to
When without using the mode of user identity verification, judgement verification is carried out to current operating information, effectively improves the safety of verification
Property and practicability.
Detailed description of the invention
The drawings described herein are used to provide a further understanding of the present application, constitutes part of this application, this Shen
Illustrative embodiments and their description please are not constituted an undue limitation on the present application for explaining the application.In the accompanying drawings:
Fig. 1 is the information identification process provided by the embodiments of the present application based on user behavior；
Fig. 2 is the information identification process based on user behavior provided by the embodiments of the present application under practical application scene；
Fig. 3 is the information recognition device structural schematic diagram provided by the embodiments of the present application based on user behavior.
Specific embodiment
To keep the purposes, technical schemes and advantages of the application clearer, below in conjunction with the application specific embodiment and
Technical scheme is clearly and completely described in corresponding attached drawing.Obviously, described embodiment is only the application one
Section Example, instead of all the embodiments.Based on the embodiment in the application, those of ordinary skill in the art are not doing
Every other embodiment obtained under the premise of creative work out, shall fall in the protection scope of this application.
Fig. 1 is the information identification process provided by the embodiments of the present application based on user behavior, which specifically includes following
Step:
S101 determines the corresponding characteristic information of current operating information, as current characteristic information.
It in the embodiment of the present application, can when user wants to obtain business service by server (such as: Website server)
By the account of the user itself, corresponding operation information is issued to the server, such as: lower list operation information, reimbursement operation letter
Breath etc..
The operation information that server is issued according to user can determine the characteristic information of the operation information.The application is real
It applies in example, characteristic information can reflect out the operating habit of user.So, in the embodiment of the present application, characteristic information can wrap
The essential information in operation information is included, such as: lower list amount information, lower single temporal information, reimbursement amount information can also include
Reflect the information of user operation habits, such as: the average quantum of accumulative lower single total value, each time operation information.
Such as: for user A, the server of certain website is remembered according to past 4 historical operations of the user A of preservation
Record, statistics available user A out averagely carry out 1 transactional operation daily, and each transaction limit is 10 yuan.As it can be seen that user A
Transactional operation forms a kind of rule, then can be operated according to 4 historical tradings of the user A in the website, determines corresponding
Characteristic information.Specifically, this feature information may is that the transaction amount (as 10 yuan) of transactional operation each time, in a timing
Between total transaction amount in section (such as: in 4 days) be 40 yuan.
For above-mentioned steps S101, the corresponding operating information that user issues at current time to server, be exactly when
Preceding operation information, it is clear that include corresponding characteristic information in the current operating information, that is, current characteristic information.
In the embodiment of the present application, the current operating information includes transactional operation information, and the characteristic information includes: institute
State characteristic information include: the accumulative number of days for having transaction of account, the accumulative total transaction amount of account, the average daily amount of the history of account,
The ratio between current the ratio between transaction limit and accumulative total transaction amount, current transaction limit and the average daily amount of history, 24 from current time
Add up the ratio between transaction limit and accumulative total transaction amount in hour and adds up transaction limit in 24 hours from current time and go through
At least one of the ratio between average daily amount of history.As it can be seen that in the embodiment of the present application, the characteristic information can be expressed as numerical value
Or the form of numberical range.
S102 determines the corresponding historical sample set of the current characteristic information, includes more in the historical sample set
A historical operation information.
It in the embodiment of the present application, include multiple historical operation informations, these historical operations in the historical sample set
Information is exactly the sample in the historical sample set.Server can be by each historical operation with same characteristic features information of preservation
Information is divided into the same historical sample set, and each historical operation information with different characteristic information is divided into different
Historical sample set.
Such as: when dividing to 10 historical trading operation informations, " transaction limit of transactional operation is big each time for use
In 100 yuan " this characteristic information, above-mentioned 10 historical trading operation informations can be divided into two historical sample set: one
Each historical trading operation information for including in a historical sample set is all that transaction limit is greater than 100 yuan；And another history
Each historical trading operation information for including in sample set is all transaction limit no more than 100 yuan.
Certainly, in practical applications, various features information also can be used while dividing historical operation information.Such as: it is right
" transaction limit is greater than 100 yuan " and " transaction limit and upper one can be used in 10 historical trading operation informations in upper example
Less than 0.6 ", the two characteristic informations are divided the ratio of a month total transaction amount degree, thus, above-mentioned 10 historical tradings behaviour
The historical operation information made in information, while meeting the two characteristic informations will be divided in the same historical sample set.
That is, for different historical sample set, be all divided by different characteristic informations, then,
After the corresponding current characteristic information of current operating information has been determined, so that it may according to current characteristic information and divide history sample
The characteristic information of this set determines the corresponding historical sample set of current characteristic information.
It should be noted that the corresponding history feature information of each historical operation information in historical sample set, Neng Gou
Reflect the past operating habit of one or more users to a certain extent, therefore, in the embodiment of the present application, the historical operation
Information is the historical operation information that user uses its account to complete in respective server.Certainly, for some history sample
Each historical operation information in this set, can be and be made of the historical operation information that different user is issued, in certain situations
Under, it can also be made of the historical operation information that same user is issued, this does not constitute the restriction to the application.
S103, according to the exceptional sample for including in the historical sample set, judge the current operating information whether be
Abnormal operation information, if so, S104 is thened follow the steps, it is no to then follow the steps S105.
In practical applications, server can save a large amount of historical operation information.In these historical operation informations, exist
The operation information that a certain number of non-user issue, such as: other users steal the account of certain user, issue transactional operation letter
Breath, transaction limit is larger, the transaction limit previous much larger than the user, then, this kind of non-user are issued
Operation information, it is believed that constituted a threat to user information safety.
That is, containing exception that is a certain number of, constituting a threat to user information safety in historical operation information
Operation information, and other historical operation informations then belong to the normal operating information that user uses itself account to issue, in this Shen
Please be in embodiment, server can be that abnormal operation information or normal operating information are known for the historical operation information saved
Not, and the result that will identify that also is saved, thus, in the historical operation information that server saves, abnormal operation information
It is known with normal operating information, then, in the historical operation information that server saves, prestige is constituted to user information safety
The abnormal operation information of the side of body is exactly exceptional sample, and the normal operating information not constituted a threat to user information safety is exactly normal sample
This.In this way, exceptional sample and normal sample can be determined in the sample that historical sample set includes.
In the embodiment of the present application, according to the exceptional sample for including in the historical sample set, judge the current behaviour
Make whether information is abnormal operation information, specifically include: in all samples that the historical sample set includes, counting abnormal sample
This accounting determines that the current operating information is abnormal operation information when the accounting is greater than preset threshold.
In historical sample set, the accounting of exceptional sample is bigger, then each history of the explanation in the historical sample set
Operation information is that the probability of abnormal operation information is bigger.In the embodiment of the present application, if the feature of current operating information is believed
The corresponding historical sample set is ceased, then, which is that the probability of abnormal operation information is also relatively high.From
And the current operating information can be determined as to abnormal operation information.
It should be noted that the quantity of historical operation information wherein included is more, i.e., for above-mentioned historical sample set
Sample size is bigger, and the probability by its abnormal operation information determined is more accurate.
S104 carries out respective handling to the current operating information.
By above-mentioned judgment step, the abnormal operation information determined, it is most likely that threaten the information security of user, institute
With, in the embodiment of the present application, in order to guarantee the information security of user, which will be performed corresponding processing,
Such as: can be using promotion security monitoring grade otherwise, or increase the mode of safety check problem, only when sending should
After the user of current operating information inputs correct check information, just determine that current operating information is normal operation information；And or
Person can confirm that the current operating information etc. air control is handled using the phone number mutually bound with the account.At these air controls
Reason mode does not constitute the restriction to the application.
S105 is handled according to the current operating information.
If not determining the current operating information for exception information, it may be considered that this is current by above-mentioned judgment step
Operation information is normal information, then, in the embodiment of the present application, server will carry out corresponding according to the current operating information
Operation so that user obtains corresponding business service.
Certainly, since above-mentioned judgment mode is the accounting based on exceptional sample or normal sample in historical sample set,
Determine that the current operating information is abnormal operation information or normal operating information, do not ensure that it is absolutely accurate, therefore,
In practical application, for not being determined as the current operating information of exception information, it can also recognize in conjunction with re-authentication or phone number
The mode of card, authenticates current operating information, thus, the accuracy rate that significant increase determines current operating information, effectively
Protect the safety of user information.
Through the above steps, after server receives current operating information, the current signature of the current operating information is determined
Information, and according to the current characteristic information, its corresponding historical sample set is determined, due to including in historical sample set
The exceptional sample and normal sample identified, then, according to the accounting of abnormal operation information in the historical sample set, so that it may
It determines that current operating information is the probability of abnormal operation information, whether judges current operating information so as to accurate
For abnormal operation information, the safety verified to user identity and practicability are effectively improved.
In the embodiment of the present application, if it can accurately determine historical sample set corresponding to current characteristic information, it will
Influence subsequent determining current operating information whether be abnormal operation information accuracy.In view of in practical applications, currently grasping
Make the corresponding current characteristic information of information, always meets some characteristic informations in a certain historical operation information, therefore, the application
In embodiment, the corresponding historical sample set of the current characteristic information is determined, specifically: determine that each historical sample set includes
Historical operation information corresponding to history feature information, the current characteristic information and the history feature information are carried out
Match, by with historical sample set belonging to the matched history feature information of the current characteristic information, be determined as the current spy
Reference ceases corresponding historical sample set.
After historical operation information to be divided into different historical sample set, the history for including in historical sample set is grasped
Make the corresponding characteristic information of information, is exactly history feature information.For current characteristic information corresponding for current operating information,
Characteristic range value or characteristic value in its characteristic information, in fact it could happen that in history feature information value range or characteristic value be consistent
Conjunction or consistent situation, then, it may be considered that the current characteristic information matches with history feature information.
Such as: assuming that history feature information is turnover for 100 historical trading operation informations in certain website
Degree, classifies to this 100 historical trading operation informations according to transaction limit, forms the set such as table 1.
| Transaction limit (unit: member) | 0~60 | 61~80 | 81~95 |
| Set/sample size | X/50 | Y/30 | Z/20 |
Table 1
In table 1, set X, Y, Z are historical sample set, and the quantity for the historical trading operation information for including in set X is
50, show the transaction limit of this 50 historical tradings operation between 0~60 yuan.The historical trading behaviour for including in set Y
The quantity for making information is 30, and the transaction limit of this 30 historical tradings operation is between 61~80 yuan.Include in set Z
The quantity of historical trading operation information is 20, and the transaction limit of this 20 historical tradings operation is between 81~95 yuan.
Assuming that current time, user A issues current transactional operation information, the current transactional operation information pair using its account
The current transaction limit (namely current characteristic information) answered is 60 yuan.So, in conjunction with table 1, it may be determined that go out current transaction limit 0
In~60 yuan of range, that is, current transaction limit matches with 0~60 yuan of transaction limit, it is thus possible to which set X is determined
For the corresponding historical sample set of current transactional operation information.So, subsequent can be according to exceptional sample in set X
Accounting, determine user A issue the current transactional operation information be abnormal operation information probability.
It can be seen from the above example that, according to the corresponding current characteristic information of current operating information, using by the current characteristic information
Matched mode is carried out with history feature information, so that it may accurately determine historical sample collection corresponding to current characteristic information
It closes.
It, can be a variety of using decision tree, Bayes, artificial neural network etc. under a kind of mode in the embodiment of the present application
Historical operation information is divided into multiple historical sample set by sorting algorithm, wherein in use decision Tree algorithms to historical operation
In the case that information is divided, server can determine previously according to the corresponding history feature information of each historical operation information, generation
Plan tree, wherein each leaf node in the decision tree corresponds to different history feature information, then, in above-mentioned steps S102,
Determine the corresponding historical sample set of the current characteristic information, specifically: believed according to the decision tree and the current signature
Breath determines the leaf node of the current characteristic information hit, and as present node, determining has the present node corresponding
The set that each historical operation information of history feature information is constituted, as the corresponding historical sample collection of the current characteristic information
It closes.
For above-mentioned decision tree, root node and each leaf node in the decision tree, corresponding to different history features
Information, wherein root node corresponds to the history feature information of all historical operation informations, then, believed according to these history features
History feature information with same characteristic features value or range of characteristic values can be divided into one by the characteristic value or range of characteristic values of breath
Leaf node can form corresponding decision tree in this way.Obviously, the corresponding history feature information of root node is more, the decision
The quantity of leaf node contained in tree is also more, classifies it is thus possible to effectively be promoted to current characteristic information
Accuracy.
Specifically for example: assuming that decision tree as shown in Figure 2, corresponding gone through for the historical trading operation information of certain website
History characteristic information is divided, and decision tree is formed by.
Assuming that in the website, using the previous moon in all historical trading operation information as sample, total amount is
1000 (in practical applications, the historical operation information enormous amounts in website, for ease of description, being only with 1000 here
Example), in 1000 historical trading operation informations, the quantity of the abnormal transactional operation information U identified is 20, normally
The quantity of transactional operation information N is 980.As shown in Fig. 2, the root node 1 of decision tree corresponds to this 1000 historical trading behaviour
Make whole history feature information of information, in order to which visual representation designates in all nodes of the decision tree with the node
In history feature information historical trading operation information quantity (such as: for root node 1, share 20 abnormal transaction behaviour
Make information and 980 arm's length dealing operation informations, there is the corresponding history feature information of root node 1).
The corresponding history feature information of all leaf nodes in the decision tree, it is special by the corresponding history of the root node 1
Reference breath is divided and is formed, and for the leaf node in the decision tree, will specifically be divided according to following history feature information:
A, the average daily amount of the history of account.
B, the current transaction limit of account.
According to above-mentioned history feature information a and b, above-mentioned root node 1 can be divided into leaf node 2 and 3.Wherein, right
In leaf node 2, corresponding history feature information is " the average daily amount of the history of account is not less than 10 yuan ", in the leaf node
In 2, the quantity of the abnormal transactional operation information U with the history feature information is 6, the quantity of arm's length dealing operation information N
It is 680.
Correspondingly, corresponding history feature information is that " the average daily amount of the history of account is less than 10 for leaf node 3
Member ".In the leaf node 3, the quantity of the abnormal transactional operation information U with the history feature information is 14, normal to hand over
The quantity of information N easy to operate is 300.
And so on, it can divide to obtain leaf node 4~7, detailed process repeats no more.
It, can basis if a certain user issues current operating information at current time after above-mentioned decision tree is formed
The decision tree and the corresponding current characteristic information of the current operating information determine the leaf section that the current characteristic information is hit
Point, it is thus possible in the set constituted according to the historical operation information of the corresponding history feature information of the leaf node, it is abnormal
The accounting of sample determines that the current operating information is the probability of abnormal operation information.
Specifically for example, on the basis of decision tree as shown in Figure 2, certain user uses its account M to issue at current time
Current transactional operation information, it is assumed that the corresponding characteristic information of the current transactional operation information are as follows: the previous moon in, the account
The average daily amount of the history of M is 7 yuan, and current transaction limit is 700 yuan.
It so, can according to decision tree as shown in Figure 2 for the current characteristic information of above-mentioned current transactional operation information
To determine the leaf node of current characteristic information hit as leaf node 9.In the leaf node 9, historical sample set
In, the quantity of abnormal transactional operation information U is 10, and the quantity of arm's length dealing operation information N is 1, therefore, abnormal transaction behaviour
The accounting for making information is 10/10+1=0.909, that is, the probability that the current operating information is abnormal transactional operation information is
0.909, it is abnormal transactional operation information that this, which indicates that the current operating information very likely,.To which website, which can be directed to, deserves
Preceding operation information carries out corresponding air control processing.
Certainly, the corresponding historical sample set of the current characteristic information is determined for the mode above by decision tree,
And determine that the current operating information is the mode of the probability of abnormal operation information, only one of the embodiment of the present application is excellent
Mode is selected, the restriction to the application is not intended as.
The above are the information identifying methods provided by the embodiments of the present application based on user behavior, are based on same thinking, this
Application embodiment also provides a kind of information recognition device based on user behavior, as shown in Figure 3.
In Fig. 3, the information recognition device based on user behavior includes: characteristic information module 301, historical sample collection
Mold block 302 and processing module 303, wherein
The characteristic information module 301 is believed for determining the corresponding characteristic information of current operating information as current signature
Breath.
The historical sample collection modules 302, for determining the corresponding historical sample set of the current characteristic information, institute
It states in historical sample set comprising multiple historical operation informations.
The processing module 303, for that ought be worked as described in determination according to the exceptional sample for including in the historical sample set
When preceding operation information is abnormal operation information, respective handling is carried out to the current operating information.
Wherein, the historical sample collection modules 302, the historical operation for including specifically for each historical sample set of determination
History feature information corresponding to information matches the current characteristic information with the history feature information, will be with institute
Historical sample set belonging to the matched history feature information of current characteristic information is stated, it is corresponding to be determined as the current characteristic information
Historical sample set.
Under another way in the embodiment of the present application, the historical sample collection modules 302 in advance will be specifically used for
Each historical operation information is divided according to different history feature information, is formed decision tree, is determined the current characteristic information
In each characteristic value traverse the decision tree according to each characteristic value in the current characteristic information, it is unique by what is determined after traversal
The corresponding historical sample set of leaf node is determined as the corresponding historical sample set of the current characteristic information.
The processing module 303, specifically for counting exceptional sample in all samples that the historical sample set includes
Accounting, when the accounting be greater than preset threshold when, determine the current operating information be abnormal operation information.
In the embodiment of the present application, the current operating information includes transactional operation information, and the characteristic information includes: institute
State characteristic information include: the accumulative number of days for having transaction of account, the accumulative total transaction amount of account, the average daily amount of the history of account,
The ratio between current the ratio between transaction limit and accumulative total transaction amount, current transaction limit and the average daily amount of history, 24 from current time
Add up the ratio between transaction limit and accumulative total transaction amount in hour and adds up transaction limit in 24 hours from current time and go through
At least one of the ratio between average daily amount of history.
In a typical configuration, calculating equipment includes one or more processors (CPU), input/output interface, net
Network interface and memory.
Memory may include the non-volatile memory in computer-readable medium, random access memory (RAM) and/or
The forms such as Nonvolatile memory, such as read-only memory (ROM) or flash memory (flash RAM).Memory is computer-readable medium
Example.
Computer-readable medium includes permanent and non-permanent, removable and non-removable media can be by any method
Or technology come realize information store.Information can be computer readable instructions, data structure, the module of program or other data.
The example of the storage medium of computer includes, but are not limited to phase change memory (PRAM), static random access memory (SRAM), moves
State random access memory (DRAM), other kinds of random access memory (RAM), read-only memory (ROM), electric erasable
Programmable read only memory (EEPROM), flash memory or other memory techniques, read-only disc read only memory (CD-ROM) (CD-ROM),
Digital versatile disc (DVD) or other optical storage, magnetic cassettes, tape magnetic disk storage or other magnetic storage devices
Or any other non-transmission medium, can be used for storage can be accessed by a computing device information.As defined in this article, it calculates
Machine readable medium does not include temporary computer readable media (transitory media), such as the data-signal and carrier wave of modulation.
It should also be noted that, the terms "include", "comprise" or its any other variant are intended to nonexcludability
It include so that the process, method, commodity or the equipment that include a series of elements not only include those elements, but also to wrap
Include other elements that are not explicitly listed, or further include for this process, method, commodity or equipment intrinsic want
Element.In the absence of more restrictions, the element limited by sentence "including a ...", it is not excluded that including described want
There is also other identical elements in the process, method of element, commodity or equipment.
It will be understood by those skilled in the art that embodiments herein can provide as method, system or computer program product.
Therefore, complete hardware embodiment, complete software embodiment or embodiment combining software and hardware aspects can be used in the application
Form.It is deposited moreover, the application can be used to can be used in the computer that one or more wherein includes computer usable program code
The shape for the computer program product implemented on storage media (including but not limited to magnetic disk storage, CD-ROM, optical memory etc.)
Formula.
The above description is only an example of the present application, is not intended to limit this application.For those skilled in the art
For, various changes and changes are possible in this application.All any modifications made within the spirit and principles of the present application are equal
Replacement, improvement etc., should be included within the scope of the claims of this application.
Claims (8)
1. a kind of information identifying method based on user behavior characterized by comprising
The corresponding characteristic information of current operating information is determined, as current characteristic information；
It determines the corresponding historical sample set of the current characteristic information, includes multiple historical operations in the historical sample set
Information；
When according to the exceptional sample for including in the historical sample set, determining that the current operating information is abnormal operation information
When, respective handling is carried out to the current operating information；
According to the exceptional sample for including in the historical sample set, determine that the current operating information is abnormal operation information,
It specifically includes:
In all samples that the historical sample set includes, the accounting of exceptional sample is counted；
When the accounting is greater than preset threshold, determine that the current operating information is abnormal operation information.
2. the method as described in claim 1, which is characterized in that determine the corresponding historical sample collection of the current characteristic information
It closes, specifically includes:
Determine history feature information corresponding to historical operation information that each historical sample set includes；
The current characteristic information is matched with the history feature information；
By with historical sample set belonging to the matched history feature information of the current characteristic information, be determined as the current spy
Reference ceases corresponding historical sample set.
3. the method as described in claim 1, which is characterized in that believe previously according to the corresponding history feature of each historical operation information
Breath generates decision tree, wherein each leaf node in the decision tree corresponds to different history feature information；
It determines the corresponding historical sample set of the current characteristic information, specifically includes:
According to the decision tree and the current characteristic information, the leaf node of the current characteristic information hit is determined, as
Present node；
The set that there is each historical operation information of the corresponding history feature information of the present node to be constituted is determined, as institute
State the corresponding historical sample set of current characteristic information.
4. method as claimed in any one of claims 1 to 3, which is characterized in that the current operating information includes transactional operation
Information；
The characteristic information includes: that the accumulative number of days for having transaction of account, the accumulative total transaction amount of account, the history of account are average daily
The ratio between the ratio between amount, current transaction limit and accumulative total transaction amount, current transaction limit and the average daily amount of history, from current time
It plays accumulative the ratio between transaction limit and accumulative total transaction amount in 24 hours and adds up transaction limit in 24 hours from current time
At least one of with the ratio between the average daily amount of history.
5. a kind of information recognition device based on user behavior characterized by comprising
Characteristic information module, for determining the corresponding characteristic information of current operating information, as current characteristic information；
Historical sample collection modules, for determining the corresponding historical sample set of the current characteristic information, the historical sample
It include multiple historical operation informations in set；
Processing module determines the current operating information for working as according to the exceptional sample for including in the historical sample set
When for abnormal operation information, respective handling is carried out to the current operating information；
The processing module, is specifically used for: in all samples that the historical sample set includes, counting accounting for for exceptional sample
Than determining that the current operating information is abnormal operation information when the accounting is greater than preset threshold.
6. device as claimed in claim 5, which is characterized in that the historical sample collection modules are specifically used for: determination is respectively gone through
History feature information corresponding to the historical operation information that history sample set includes, by the current characteristic information and the history
Characteristic information is matched, by with historical sample set belonging to the matched history feature information of the current characteristic information, really
It is set to the corresponding historical sample set of the current characteristic information.
7. device as claimed in claim 5, which is characterized in that the historical sample collection modules are specifically used for: in advance will be each
Historical operation information is divided according to different history feature information, is formed decision tree, is determined in the current characteristic information
Each characteristic value traverse the decision tree according to each characteristic value in the current characteristic information, the unique leaf that will be determined after traversal
The corresponding historical sample set of child node is determined as the corresponding historical sample set of the current characteristic information.
8. the device as described in any in claim 5~7, which is characterized in that the current operating information includes transactional operation
Information；
The characteristic information includes: that the accumulative number of days for having transaction of account, the accumulative total transaction amount of account, the history of account are average daily
The ratio between the ratio between amount, current transaction limit and accumulative total transaction amount, current transaction limit and the average daily amount of history, from current time
It plays accumulative the ratio between transaction limit and accumulative total transaction amount in 24 hours and adds up transaction limit in 24 hours from current time
At least one of with the ratio between the average daily amount of history.
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811384517.XA CN109543373B (en) | 2014-12-10 | 2014-12-10 | Information identification method and device based on user behaviors |
| CN201410759175.0A CN105740667B (en) | 2014-12-10 | 2014-12-10 | A kind of information identifying method and device based on user behavior |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410759175.0A CN105740667B (en) | 2014-12-10 | 2014-12-10 | A kind of information identifying method and device based on user behavior |
Related Child Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811384517.XA Division CN109543373B (en) | 2014-12-10 | 2014-12-10 | Information identification method and device based on user behaviors |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN105740667A CN105740667A (en) | 2016-07-06 |
| CN105740667B true CN105740667B (en) | 2018-12-04 |
Family
ID=56239055
Family Applications (2)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811384517.XA Active CN109543373B (en) | 2014-12-10 | 2014-12-10 | Information identification method and device based on user behaviors |
| CN201410759175.0A Active CN105740667B (en) | 2014-12-10 | 2014-12-10 | A kind of information identifying method and device based on user behavior |
Family Applications Before (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811384517.XA Active CN109543373B (en) | 2014-12-10 | 2014-12-10 | Information identification method and device based on user behaviors |
Country Status (1)
| Country | Link |
|---|---|
| CN (2) | CN109543373B (en) |
Families Citing this family (12)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106507308A (en) * | 2016-11-29 | 2017-03-15 | 中国银联股份有限公司 | A kind of identity identifying method and device |
| CN108269084A (en) * | 2017-01-03 | 2018-07-10 | 阿里巴巴集团控股有限公司 | A kind of method and device for progress barcode scanning payment on the mobile apparatus |
| CN107169353B (en) * | 2017-04-20 | 2021-05-14 | 腾讯科技（深圳）有限公司 | Abnormal file identification method and device |
| CN109145109B (en) * | 2017-06-19 | 2022-06-03 | 国家计算机网络与信息安全管理中心 | User group message propagation abnormity analysis method and device based on social network |
| CN107480698B (en) * | 2017-07-12 | 2021-02-12 | 中山大学 | Quality control method based on multiple monitoring indexes |
| CN108090332A (en) * | 2017-12-06 | 2018-05-29 | 国云科技股份有限公司 | A kind of air control method that behavioural analysis is logged in based on user |
| CN108550052A (en) * | 2018-04-03 | 2018-09-18 | 杭州呯嘭智能技术有限公司 | Brush list detection method and system based on user behavior data feature |
| CN109582553A (en) * | 2018-11-12 | 2019-04-05 | 咪咕文化科技有限公司 | A kind of detection method, device and the storage medium of media play behavior |
| TWI725369B (en) * | 2018-12-28 | 2021-04-21 | 綠界科技股份有限公司 | Online refund system |
| CN110020858A (en) * | 2019-03-13 | 2019-07-16 | 北京三快在线科技有限公司 | Pay method for detecting abnormality, device, storage medium and electronic equipment |
| CN110598007B (en) * | 2019-09-09 | 2023-10-27 | 腾讯科技（深圳）有限公司 | Bill file processing method, device, medium and electronic equipment |
| CN112712368B (en) * | 2021-02-23 | 2021-12-14 | 深圳亚桐荟科技有限公司 | Cloud security account management method based on big data and cloud security platform |
Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103902885A (en) * | 2014-03-04 | 2014-07-02 | 重庆邮电大学 | Virtual machine security isolation system and method oriented to multi-security-level virtual desktop system |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN100478974C (en) * | 2007-11-20 | 2009-04-15 | 北京派瑞根科技开发有限公司 | Method and device for preventing from computer virus |
| CN101714931B (en) * | 2009-11-26 | 2012-09-19 | 成都市华为赛门铁克科技有限公司 | Early warning method, device and system of unknown malicious code |
| CN102163251A (en) * | 2010-02-22 | 2011-08-24 | 深圳市腾讯计算机系统有限公司 | Method and device for recognizing game cheating |
-
2014
- 2014-12-10 CN CN201811384517.XA patent/CN109543373B/en active Active
- 2014-12-10 CN CN201410759175.0A patent/CN105740667B/en active Active
Patent Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103902885A (en) * | 2014-03-04 | 2014-07-02 | 重庆邮电大学 | Virtual machine security isolation system and method oriented to multi-security-level virtual desktop system |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109543373A (en) | 2019-03-29 |
| CN105740667A (en) | 2016-07-06 |
| CN109543373B (en) | 2023-11-14 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN105740667B (en) | A kind of information identifying method and device based on user behavior | |
| TWI767879B (en) | Computer system-based online transaction risk identification method and device | |
| CN107563757B (en) | Data risk identification method and device | |
| CN107316198B (en) | Account risk identification method and device | |
| CN106156151B (en) | The Risk Identification Method and device of internetwork operation event | |
| CN106656932B (en) | Service processing method and device | |
| CN107679856B (en) | Transaction-based service control method and device | |
| CN106469276B (en) | Type identification method and device of data sample | |
| Lekha et al. | Data mining techniques in detecting and predicting cyber crimes in banking sector | |
| CN112036890B (en) | Customer identity authentication method and device | |
| CN105391594B (en) | The method and device of identification feature account | |
| CN111539811B (en) | Risk account identification method and device | |
| WO2019196254A1 (en) | Electronic resource packet processing method and apparatus, terminal device and medium | |
| CN104573434A (en) | Account protection method, device and system | |
| CN109035021A (en) | A kind of monitoring method, device and the equipment of index of trading | |
| CN113379530A (en) | User risk determination method and device and server | |
| CN113689218A (en) | Risk account identification method and device, computer equipment and storage medium | |
| CN108985559A (en) | Air control data processing method, device, computer equipment and storage medium | |
| CN110245954B (en) | Method and apparatus for risk control | |
| CN107679862B (en) | Method and device for determining characteristic value of fraud transaction model | |
| CN105991574A (en) | Risk behavior monitoring method and apparatus thereof | |
| CN105991609B (en) | A kind of risk case determines method and device | |
| CN116757702A (en) | Transaction data determining method and device, processor and electronic equipment | |
| CN110874638A (en) | Behavior analysis-oriented meta-knowledge federation method, device, electronic equipment and system | |
| CN110956544B (en) | Digital asset transaction risk control method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| TR01 | Transfer of patent right | ||
| TR01 | Transfer of patent right |
Effective date of registration: 20200921 Address after: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman Islands Patentee after: Innovative advanced technology Co.,Ltd. Address before: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman Islands Patentee before: Advanced innovation technology Co.,Ltd. Effective date of registration: 20200921 Address after: Cayman Enterprise Centre, 27 Hospital Road, George Town, Grand Cayman Islands Patentee after: Advanced innovation technology Co.,Ltd. Address before: A four-storey 847 mailbox in Grand Cayman Capital Building, British Cayman Islands Patentee before: Alibaba Group Holding Ltd. |