CN106257507A

CN106257507A - The methods of risk assessment of user behavior and device

Info

Publication number: CN106257507A
Application number: CN201510342295.5A
Authority: CN
Inventors: 沈雄
Original assignee: Alibaba Group Holding Ltd
Current assignee: Advanced New Technologies Co Ltd; Advantageous New Technologies Co Ltd
Priority date: 2015-06-18
Filing date: 2015-06-18
Publication date: 2016-12-28
Anticipated expiration: 2035-06-18
Also published as: CN106257507B

Abstract

The invention discloses methods of risk assessment and the device of a kind of user behavior.Wherein, the method includes: obtains the first account and performs the user behavior frequency corresponding to the first behavior in the first preset time period；Obtain the reversion behavior frequency that user behavior frequency is corresponding；According to user behavior frequency and reversion behavior frequency, obtain the First Eigenvalue that the first behavior is corresponding；According to the First Eigenvalue that the first behavior is corresponding, calculate the characteristic ratio that the First Eigenvalue is shared in the eigenvalue of all behaviors of all accounts；Feature based ratio and the user behavior parameter obtained in advance, obtain the first account and perform the risk evaluation result of the first behavior in the first preset time period.The present invention solves prior art and carries out the risk assessment of user behavior owing to being based only upon user behavior frequency, causes in some special cases, the technical problem that risk evaluation result error rate is higher.

Description

The methods of risk assessment of user behavior and device

Technical field

The present invention relates to internet arena, in particular to methods of risk assessment and the device of a kind of user behavior.

Background technology

Along with developing rapidly of the Internet, increasing user can produce some user behaviors on the internet, such as, User some websites perform search, browse, give a mark, the behavior such as purchase.Along with the generation of various user behaviors, Risk assessment based on user behavior is also just arisen at the historic moment, and the risk assessment of user behavior refers to owing to user may profit With system vulnerability or user by steal-number, non-when operating in person, user behavior and have discrimination at ordinary times, by calculating district Indexing differentiates that this user is the most abnormal.

The methods of risk assessment of the user behavior of prior art is usually and judges according to user behavior frequency, but, If being based only upon user behavior frequency to carry out the risk assessment of user behavior, then in some special cases, such as By double 11, the impact of big sales promotion etc., can judge that exception occurs in a lot of user, i.e. risk evaluation result error rate is relatively Height, causes the problem that the risk assessment accuracy of user behavior is relatively low.

For above-mentioned problem, effective solution is the most not yet proposed.

Summary of the invention

Embodiments provide methods of risk assessment and the device of a kind of user behavior, at least to solve prior art Carry out the risk assessment of user behavior owing to being based only upon user behavior frequency, cause in some special cases, wind The technical problem that danger assessment result error rate is higher.

An aspect according to embodiments of the present invention, it is provided that the methods of risk assessment of a kind of user behavior, including: obtain Take the first account in the first preset time period, perform the user behavior frequency corresponding to the first behavior；Obtain above-mentioned user The reversion behavior frequency that behavior frequency is corresponding, wherein, above-mentioned reversion behavior frequency is according to the first sum and the second sum Obtaining, above-mentioned first sum refers to the quantity of the first behavior of all accounts in above-mentioned first preset time period, on State the second sum and refer to the quantity of all behaviors of all accounts in above-mentioned first preset time period；According to above-mentioned user Behavior frequency and above-mentioned reversion behavior frequency, obtain the First Eigenvalue that above-mentioned first behavior is corresponding；According to above-mentioned The above-mentioned the First Eigenvalue that one behavior is corresponding, calculates the above-mentioned the First Eigenvalue eigenvalue in all behaviors of all accounts Characteristic ratio shared by；Based on features described above ratio and the user behavior parameter that obtains in advance, obtain above-mentioned first Account performs the risk evaluation result of above-mentioned first behavior in above-mentioned first preset time period.

Another aspect according to embodiments of the present invention, additionally provides the risk assessment device of a kind of user behavior, including: First acquiring unit, performs the user's row corresponding to the first behavior for obtaining the first account in the first preset time period For frequency；Second acquisition unit, for obtaining the reversion behavior frequency that above-mentioned user behavior frequency is corresponding, wherein, on Stating reversion behavior frequency to obtain according to the first sum and the second sum, above-mentioned first sum refers to above-mentioned first pre- If the quantity of the first behavior of all accounts in the time period, above-mentioned second sum refers in above-mentioned first preset time period The quantity of all behaviors of all accounts；Processing unit, for according to above-mentioned user behavior frequency and above-mentioned reversion row For frequency, obtain the First Eigenvalue that above-mentioned first behavior is corresponding；First computing unit, for according to above-mentioned the first row For corresponding above-mentioned the First Eigenvalue, calculate above-mentioned the First Eigenvalue institute in the eigenvalue of all behaviors of all accounts The characteristic ratio accounted for；Risk assessment unit, for based on features described above ratio and the user behavior parameter that obtains in advance, Obtain above-mentioned first account in above-mentioned first preset time period, perform the risk evaluation result of above-mentioned first behavior.

In embodiments of the present invention, acquisition the first account is used to perform corresponding to the first behavior in the first preset time period User behavior frequency；Obtaining the reversion behavior frequency that user behavior frequency is corresponding, wherein, reversion behavior frequency is root Obtaining according to the first sum and the second sum, the first sum refers to the first row of all accounts in the first preset time period For quantity, the second sum refers to the quantity of all behaviors of all accounts in the first preset time period；According to user Behavior frequency and reversion behavior frequency, obtain the First Eigenvalue that the first behavior is corresponding；Corresponding according to the first behavior The First Eigenvalue, calculates the characteristic ratio that the First Eigenvalue is shared in the eigenvalue of all behaviors of all accounts；Base In characteristic ratio and the user behavior parameter that obtains in advance, obtain the first account in the first preset time period, perform The mode of the risk evaluation result of one behavior, by obtaining user behavior frequency and the reversion behavior frequency of the first account, Obtain the characteristic ratio of the first behavior, and then obtain the risk of the first behavior based on the user behavior parameter obtained in advance and comment Estimate result, reached accurately user behavior to be carried out the purpose of risk assessment, it is achieved thereby that it is correct to increase risk assessment The technique effect of rate, and then solve prior art and carry out the risk of user behavior owing to being based only upon user behavior frequency and comment Estimate, cause in some special cases, the technical problem that risk evaluation result error rate is higher.

Accompanying drawing explanation

Accompanying drawing described herein is used for providing a further understanding of the present invention, constitutes the part of the application, this Bright schematic description and description is used for explaining the present invention, is not intended that inappropriate limitation of the present invention.At accompanying drawing In:

Fig. 1 is the hard of the terminal of a kind of methods of risk assessment running user behavior according to embodiments of the present invention Part structured flowchart；

Fig. 2 is the schematic flow sheet of the methods of risk assessment of a kind of optional user behavior according to embodiments of the present invention；

Fig. 3 is the schematic flow sheet of the methods of risk assessment of another kind of optional user behavior according to embodiments of the present invention；

Fig. 4 is the schematic flow sheet of the methods of risk assessment of the optional user behavior of according to embodiments of the present invention another；

Fig. 5 is the structural representation of the risk assessment device of a kind of optional user behavior according to embodiments of the present invention；

Fig. 6 is the structural representation of a kind of optional first acquiring unit according to embodiments of the present invention；

Fig. 7 is the structural representation of a kind of optional second acquisition unit according to embodiments of the present invention；

Fig. 8 is the structural representation of the risk assessment device of another kind of optional user behavior according to embodiments of the present invention；

Fig. 9 is the structural representation of a kind of optional creating unit according to embodiments of the present invention.

Detailed description of the invention

In order to make those skilled in the art be more fully understood that the present invention program, below in conjunction with in the embodiment of the present invention Accompanying drawing, is clearly and completely described the technical scheme in the embodiment of the present invention, it is clear that described embodiment It is only the embodiment of a present invention part rather than whole embodiments.Based on the embodiment in the present invention, ability The every other embodiment that territory those of ordinary skill is obtained under not making creative work premise, all should belong to The scope of protection of the invention.

It should be noted that term " first " in description and claims of this specification and above-mentioned accompanying drawing, " Two " it is etc. for distinguishing similar object, without being used for describing specific order or precedence.Should be appreciated that this Sample use data can exchange in the appropriate case, in order to embodiments of the invention described herein can with except Here the order beyond those illustrating or describing is implemented.Additionally, term " includes " and " having " and they Any deformation, it is intended that cover non-exclusive comprising, such as, contain series of steps or the process of unit, side Method, system, product or equipment are not necessarily limited to those steps or the unit clearly listed, but can include the clearest List or for intrinsic other step of these processes, method, product or equipment or unit.

Embodiment 1

According to embodiments of the present invention, additionally provide the embodiment of the method for the methods of risk assessment of a kind of user behavior, need Illustrate, can be in the department of computer science of such as one group of computer executable instructions in the step shown in the flow chart of accompanying drawing System performs, and, although show logical order in flow charts, but in some cases, can be with difference Step shown or described by performing in order herein.

The embodiment of the method that the embodiment of the present application one is provided can be in mobile terminal, terminal or similar fortune Calculate in device and perform.As a example by running on computer terminals, Fig. 1 is a kind of user behavior of the embodiment of the present invention The hardware block diagram of the terminal of methods of risk assessment.As it is shown in figure 1, terminal 10 can include one Individual or multiple (only illustrating one in figure) (processor 102 can include but not limited to Micro-processor MCV to processor 102 Or the processing means of PLD FPGA etc.), for storing the memorizer 104 of data and for communicating The transmitting device 106 of function.It will appreciated by the skilled person that the structure shown in Fig. 1 is only signal, its The structure of above-mentioned electronic installation is not caused restriction.Such as, terminal 10 may also include than shown in Fig. 1 more more Many or less assembly, or there is the configuration different from shown in Fig. 1.

Memorizer 104 can be used for storing software program and the module of application software, such as the user in the embodiment of the present invention Programmed instruction/module that the methods of risk assessment of behavior is corresponding, processor 102 is stored in memorizer 104 by operation Interior software program and module, thus perform the application of various function and data process, i.e. realize above-mentioned application journey The leak detection method of sequence.Memorizer 104 can include high speed random access memory, may also include nonvolatile memory, Such as one or more magnetic storage device, flash memory or other non-volatile solid state memories.In some instances, Memorizer 104 can farther include the memorizer remotely located relative to processor 102, and these remote memories are permissible It is connected to terminal 10 by network.The example of above-mentioned network include but not limited to the Internet, intranet, LAN, mobile radio communication and combinations thereof.

Transmitting device 106 is for receiving via a network or sending data.Above-mentioned network instantiation can include The wireless network that the communication providers of terminal 10 provides.In an example, transmitting device 106 includes one Network adapter (Network Interface Controller, NIC), they can be by base station and other network equipments It is connected thus communication can be carried out with the Internet.In an example, transmitting device 106 can be radio frequency (Radio Frequency, RF) module, it is for wirelessly carrying out communication with the Internet.

Under above-mentioned running environment, this application provides the methods of risk assessment of user behavior as shown in Figure 2.Fig. 2 It it is the flow chart of the methods of risk assessment of the user behavior of according to embodiments of the present invention.

As in figure 2 it is shown, the methods of risk assessment of this user behavior can include step implemented as described below:

Step S202, obtains the first account and performs the user behavior frequency corresponding to the first behavior in the first preset time period Rate.

First behavior i.e. user behavior in the application above-mentioned steps S202, can include that user occurs on website all Behavior, as search for, browse, give a mark, comment on, add shopping cart, take out Shopping Basket, add expect list (WishList), Buy, use discount cupon and the return of goods etc.；Even can be included in the corelation behaviour on third party website, such as the rate of exchange, see Relevant evaluate and test, participate in discussion, exchange in social media and good friend's interaction etc..

Wherein, the risk assessment device of the user behavior of the embodiment of the present invention is carrying out the wind of user behavior to the first account During the assessment of danger, can daily, week, the moon or random time interval obtain the behavioral data of the first account, i.e. obtain first The first behavior that account performs in the first preset time period, the first behavior here can be substantially an event group Close, i.e. include concrete behavior and object, can be purchase-the articles for daily use such as the first behavior or browse-page etc..

The risk assessment device of user behavior is obtaining the first behavior that the first account performs in the first preset time period Afterwards, the user behavior frequency (Behaviour Frequency, BF) of its correspondence can be calculated.For the first account, User behavior frequency refers to that the number of times of a behavior appearance in time window is divided by the first account of this in time window The sum of all behaviors, wherein, the first preset time period that time window is the most above-mentioned.

Include as a example by " purchase-the articles for daily use " by the first behavior, all behaviors in the first Preset Time of first account Sum be 100, and " purchase-the articles for daily use " occurs in that 3 times in the first preset time period, then " buy -the articles for daily use " user behavior frequency be 3/100=0.03.

Step S204, obtains the reversion behavior frequency that user behavior frequency is corresponding, and wherein, reversion behavior frequency is basis First sum and the second sum obtain, and the first sum refers to the first behavior of all accounts in the first preset time period Quantity, the second sum refers to the quantity of all behaviors of all accounts in the first preset time period.

In the application above-mentioned steps S204, reversion behavior frequency (Inverse Behaviour Frequency, IBF) In referring to time window, all accounts perform the quantity of " purchase-the articles for daily use ", divided by accounts all in time window The sum of all behaviors.

Still include as a example by " purchase-the articles for daily use " by the first behavior, in the first preset time period, if " bought -the articles for daily use " occurred 1,000 time, and the sum of all behaviors of all accounts in this first preset time period is If 10,000,000, its reversion behavior frequency is lg (10,000,000/1,000)=4.

Step S206, according to user behavior frequency and reversion behavior frequency, obtains the fisrt feature that the first behavior is corresponding Value.

In the application above-mentioned steps S206, the First Eigenvalue can be as the classification of the first account or the important spy of cluster Levy, in the embodiment of the present invention, can be by user behavior frequency obtained above be multiplied by reversion behavior obtained above Frequency, and then obtain the First Eigenvalue that the first behavior is corresponding, wherein, the First Eigenvalue is the biggest, then illustrate this first Behavior is the most obvious.

Still include as a example by " purchase-the articles for daily use " by the first behavior, be 0.03 according to the above-mentioned user behavior frequency drawn, Reversion behavior frequency is 4, and obtaining the First Eigenvalue is BF*IBF=0.03*4=0.12.

It should be noted that merely just include illustrating as a example by " purchase-the articles for daily use " by the first behavior, when When one behavior also includes other behaviors, such as " browsing-page ", its computational methods are same as mentioned above, do not do Repeat.

Step S208, according to the First Eigenvalue that the first behavior is corresponding, calculates the First Eigenvalue owning in all accounts Characteristic ratio shared in the eigenvalue of behavior.

In the application above-mentioned steps S208, the risk assessment device of user behavior is based on user behavior frequency and reversion After behavior frequency obtains the First Eigenvalue that the first behavior is corresponding, need to calculate the First Eigenvalue in all accounts Characteristic ratio shared in the eigenvalue of all behaviors, in order to the follow-up input parameter as risk assessment.

Wherein, the eigenvalue of all behaviors of above-mentioned all accounts all can be according to above-mentioned steps S202 to step S206 Described method calculates, and here is omitted.

Step S210, feature based ratio and the user behavior parameter obtained in advance, obtain the first account pre-first If performing the risk evaluation result of the first behavior in the time period.

In the application above-mentioned steps S210, the user behavior parameter obtained in advance can include conditional probability parameter and divide Class ratio, wherein, conditional probability parameter and Classified Proportion are by being pre-created training sample set, and based on Piao Element Bayesian model obtains, and will be described in detail in concrete grammar subsequent embodiment.

The risk assessment device feature based ratio of the user behavior of the embodiment of the present invention and the user behavior obtained in advance Parameter, i.e. can perform the first behavior in the first preset time period to the first account and carry out risk assessment.

From the foregoing, it will be observed that the scheme that the above embodiments of the present application one are provided, by obtaining the user behavior frequency of the first account Rate and reversion behavior frequency, obtain the characteristic ratio of the first behavior, and then based on the user behavior parameter obtained in advance Obtain the risk evaluation result of the first behavior, reach accurately user behavior to be carried out the purpose of risk assessment, thus real Show the technique effect increasing risk assessment accuracy, and then solve prior art owing to being based only upon user behavior frequency Carrying out the risk assessment of user behavior, cause in some special cases, risk evaluation result error rate is higher Technical problem.

In a kind of alternative that the above embodiments of the present application provide, above-mentioned steps S202, obtain the first account first Perform the user behavior frequency corresponding to the first behavior in preset time period, may include that

S20, determines the 3rd sum and the 4th sum, and wherein, the 3rd sum refers to that the first account is in the first preset time period The quantity of interior execution the first behavior, the 4th sum refers to the number of first account all behaviors in the first preset time period Amount.

In the application above-mentioned steps S20, the risk assessment device of user behavior to obtain the first account in the very first time When performing the user behavior frequency corresponding to the first behavior in section, needing to obtain two data, one is that the first account exists Performing the quantity of the first behavior in first preset time period, the i.e. the 3rd sum, it two is that the first account is when first presets Between the quantity of all behaviors in section, the i.e. the 4th sum.

Still include that, as a example by " purchase-the articles for daily use ", the first account performs in the first preset time period by the first behavior The quantity of the first behavior, the i.e. the 3rd sum is 3, the quantity of first account all behaviors in the first preset time period, I.e. the 4th sum is 100.

S22, according to the 3rd sum and the 4th sum, calculates user behavior frequency.

In the application above-mentioned steps S20, the risk assessment device of user behavior determine the first account first preset Perform in time period the quantity of the first behavior and all behaviors in the first preset time period of first account quantity it After, the quantity of the first behavior and the first account can be performed in the first preset time period according to this first account The quantity of all behaviors in one preset time period calculates user behavior frequency.

Still include as a example by " purchase-the articles for daily use " by the first behavior, owing to the risk assessment device of user behavior determines First account performs the quantity of the first behavior in the first preset time period, and the i.e. the 3rd sum is 3, and the first account is The quantity of all behaviors in one preset time period, the i.e. the 4th sum is 100, then user behavior frequency is 3/100=0.03.

In a kind of alternative that the above embodiments of the present application provide, above-mentioned steps S204, obtain user behavior frequency pair The reversion behavior frequency answered, may include that

S30, determines the first sum and the second sum.

In the application above-mentioned steps S30, the risk assessment device of user behavior is corresponding in user behavior frequency to be obtained During reversion behavior frequency, needing to obtain two data, one is the first row of all accounts in the first preset time period For quantity, the i.e. first sum, it two is the quantity of all behaviors of all accounts in the first preset time period, i.e. Second sum.

Still include as a example by " purchase-the articles for daily use " by the first behavior, in the first preset time period, if " bought -the articles for daily use " occurred 1,000 time, and the sum of all behaviors of all accounts in this first preset time period is 10,000,000, then the quantity of the first behavior of all accounts in the first preset time period, the i.e. first sum is 1,000, the quantity of all behaviors of all accounts in the first preset time period, the i.e. second sum is 10,000,000.

S32, by formula I=lg (k/q), calculates reversion behavior frequency, and wherein, I represents reversion behavior frequency, k Representing the second sum, q represents the first sum.

In the application above-mentioned steps S20, the risk assessment device of user behavior is determining in the first preset time period The quantity of the first behavior of all accounts and in the first preset time period after the quantity of all behaviors of all accounts, Can be according to the quantity of this first behavior of all accounts in the first preset time period and in the first preset time period The quantity of all behaviors of all accounts calculates reversion behavior frequency.

Still include as a example by " purchase-the articles for daily use " by the first behavior, owing to the risk assessment device of user behavior determines The quantity of the first behavior of all accounts in the first preset time period, the i.e. first sum is 1,000, presets first The quantity of all behaviors of all accounts in time period, the i.e. second sum is 10,000,000, then user behavior frequency It is lg (10,000,000/1,000)=4.

In a kind of alternative that the above embodiments of the present application provide, above-mentioned steps S206, corresponding according to the first behavior The First Eigenvalue, calculates the characteristic ratio that the First Eigenvalue is shared in the eigenvalue of all behaviors of all accounts, can To include:

Pass through formulaObtain the First Eigenvalue in the eigenvalue of all behaviors of all accounts Shared characteristic ratio, wherein, a_jRepresent the First Eigenvalue, P (a_j) be used for representing a_jAll row in all accounts For eigenvalue shared by characteristic ratio, j is the integer more than 0.

Alternatively, according to the 3rd sum and the 4th sum, calculate user behavior frequency, including: by the 3rd sum divided by 4th sum, obtains user behavior frequency.

Alternatively, according to user behavior frequency and reversion behavior frequency, obtain the First Eigenvalue that the first behavior is corresponding, Including: user behavior frequency is multiplied by reversion behavior frequency, obtains the First Eigenvalue that the first behavior is corresponding.

In a kind of alternative that the above embodiments of the present application provide, as it is shown on figure 3, at the user behavior obtained in advance In the case of parameter includes conditional probability parameter and Classified Proportion, obtain conditional probability parameter and the step of Classified Proportion Suddenly may include that

S302, creates training sample set, and wherein, training sample set is bonded to include less a sample characteristics and extremely The risk assessment label that a few sample characteristics is corresponding.

In the application above-mentioned steps S302, the risk assessment device of user behavior to the first account at the first Preset Time Before the first behavior performed in section carries out risk assessment, training sample set can be created, set up based on simple pattra leaves This model.

Wherein, training sample set is bonded to include less a sample characteristics and wind corresponding at least one sample characteristics Danger assessment tag, similar with the calculating process of above-mentioned the First Eigenvalue, at least one sample in training sample set Eigenvalue can also be the sample of users behavior frequency corresponding by the sample behavior of sample account and sample of users behavior frequency Sample reversion behavior frequency corresponding to rate obtains.Alternatively, risk assessment label can be 0 or 1, such as 0 table Showing devoid of risk, 1 represents risky.

Alternatively, above-mentioned steps S302 creates training sample set, and wherein, training sample set is bonded to include a sample less Eigen value and risk assessment label corresponding at least one sample characteristics, may include that

S40, obtains at least one sample of users behavior of at least one sample account in the second preset time period.

In the application above-mentioned steps S40, the training sample set that the risk assessment device of user behavior is created, be also The behavior of certain user based on certain time period, in order to above-mentioned first account, the first behavior make a distinction, here I The account in training sample set is referred to as sample account, behavior is referred to as sample of users behavior, wherein, sample is used Family behavior equally includes all behaviors that user occurs on website, as searched for, browse, give a mark, comment on, adding Enter shopping cart, take out Shopping Basket, add and expect list, buy, use discount cupon and the return of goods etc.；Even can include Corelation behaviour on third party website, as the rate of exchange, see relevant evaluate and test, participate in discussion, exchange in social media, Interactive with good friend etc..

S42, calculates the sample of users behavior frequency of at least one sample of users behavior, and sample of users behavior frequency pair The sample reversion behavior frequency answered, wherein, sample reversion behavior frequency obtains according to the 5th sum and the 6th sum, 5th sum refers to the quantity of at least one sample of users behavior of all accounts in the second preset time period and In two preset time period, the sum of all behaviors of all accounts obtains.

In the application above-mentioned steps S42, similar with said process, the risk assessment device of user behavior is obtaining In the second preset time period after at least one sample of users behavior of at least one sample account, need to calculate at least The sample of users behavior frequency of one sample of users behavior, and the sample reversion behavior that sample of users behavior frequency is corresponding Frequency, wherein, sample reversion behavior frequency obtains according to the 5th sum and the 6th sum, and the 5th sum refers to In second preset time period at least one sample of users behavior of all accounts quantity and in the second preset time period The sum of all behaviors of all accounts obtains.

Alternatively, the sample of users behavior frequency of at least one sample of users behavior, and sample of users behavior frequency are calculated The sample reversion behavior frequency that rate is corresponding, may include that

In the second preset time period, the quantity of at least one sample of users behavior of at least one sample account is divided by In two preset time period, the quantity of all behaviors of at least one sample account, obtains at least one sample of users behavior Sample of users behavior frequency；And by formula I '=lg (k '/q '), calculate sample reversion behavior frequency, wherein, I ' table Sample this reversion behavior frequency, k ' represents the 5th sum, and q ' represents the 6th sum.

S44, inverts behavior frequency according to sample of users behavior frequency and sample, obtains at least one sample characteristics.

In the application above-mentioned steps S44, similar with said process, the risk assessment device of user behavior is calculating The sample of users behavior frequency of at least one sample of users behavior, and the sample reversion that sample of users behavior frequency is corresponding After behavior frequency, behavior frequency can be inverted according to sample of users behavior frequency and sample, obtain at least one sample Eigen value.

Alternatively, invert behavior frequency according to sample of users behavior frequency and sample, obtain at least one sample characteristics Value, including: mix the sample with family behavior frequency and be multiplied by sample reversion behavior frequency, obtain at least one sample characteristics.

S46, the risk assessment label corresponding according at least one sample characteristics and at least one sample characteristics creates Training sample set.

In the application above-mentioned steps S46, the risk assessment device of user behavior is obtaining at least one sample characteristics above-mentioned After value, the risk assessment label corresponding based at least one sample characteristics and at least one sample characteristics creates Training sample set.

You need to add is that, obtaining at least one sample characteristics and risk corresponding at least one sample characteristics After assessment tag, the risk assessment device of user behavior can also be to this at least one sample characteristics and at least one Risk assessment label corresponding to individual sample characteristics is optimized, i.e. can at least one sample characteristics and at least The set that risk assessment label corresponding to one sample characteristics is constituted first has the extraction T number evidence put back to, every part Data include the risk assessment label of N number of sample characteristics and correspondence thereof, then to every number according to without putting back to M sample of extraction The risk assessment label of eigen value and correspondence thereof, M=Z^1/2, wherein Z is the quantity of total sample characteristics, the value of T Slightly larger than the value of Z, such as Z=400, T=500, and then obtain above-mentioned training sample set, but, the present invention implements This is not limited by example.

S304, according to the risk assessment label that at least one sample characteristics and at least one sample characteristics are corresponding, Obtain conditional probability parameter and Classified Proportion.

In the application above-mentioned steps S304, similar with said process, the risk assessment device of user behavior obtain to After a few sample characteristics and risk assessment label corresponding at least one sample characteristics, can be according at least One sample characteristics and risk assessment label corresponding at least one sample characteristics, obtain above-mentioned conditional probability ginseng Number and Classified Proportion.

Alternatively, step S304 is according to risk corresponding at least one sample characteristics and at least one sample characteristics Assessment tag, obtains conditional probability parameter and Classified Proportion, may include that

Pass through formulaObtain conditional probability parameter, wherein, P (a '_j|c_i) be used for representing a '_j Belong to c_iConditional probability parameter, a '_jRepresent sample characteristics, c_iRepresent risk assessment label, Count (a '_j|c_i) represent Belong to c_iA ' occurs_jNumber of times, Count (c_i) represent belong to c_iNumber of times, wherein, 0 ＜ j ＜ n, n is training sample set In total sample number, 0 ＜ i ＜ m, m is the species number of risk assessment label, and i, j are integer；And

Pass through formulaObtain Classified Proportion, wherein, P (c_i) be used for representing c_iRisky in institute Classified Proportion shared in assessment tag.

In a kind of alternative that the above embodiments of the present application provide, above-mentioned steps S210, feature based ratio and pre- The user behavior parameter first obtained, obtains the first account and performs the risk assessment of the first behavior in the first preset time period As a result, it is possible to include:

S50, passes through formulaObtain the first account in the first preset time period Perform the risk evaluation result of the first behavior, wherein, c_MAPIt is that the first account performs first in the first preset time period The risk evaluation result of behavior.

In the application above-mentioned steps S50, the risk assessment device of user behavior is obtaining P (a_jAfter), based on passing through P (a ' that training sample set obtains_j|c_j) and P (c_i), obtain the first account in the first preset time period, perform the first row For risk evaluation result c_MAP。

Below in conjunction with Fig. 4, the methods of risk assessment of the user behavior of the embodiment of the present invention is described:

Step A, gathers the sample behavior of sample account in the second preset time period.

Wherein, the training sample set that the risk assessment device of user behavior is created, it is also based on certain time period The behavior of certain user, in order to above-mentioned first account, the first behavior make a distinction, we are by training sample set here In account be referred to as sample account, behavior is referred to as sample of users behavior, wherein, sample of users behavior is equally wrapped Include all behaviors that user occurs on website, as searched for, browse, give a mark, comment on, add shopping cart, taking out and purchase Thing basket, add and expect list, buy, use discount cupon and the return of goods etc.；Even can be included on third party website Corelation behaviour, as the rate of exchange, see relevant evaluate and test, participate in discussion, exchange in social media and good friend's interaction etc..

Step B, calculates sample B F and sample IBF.

Wherein, in the second preset time period, the quantity of at least one sample of users behavior of at least one sample account is removed With the quantity of all behaviors of at least one sample account in the second preset time period, obtain at least one sample of users The sample of users behavior frequency of behavior；And by formula I '=lg (k '/q '), calculate sample reversion behavior frequency, wherein, I ' represents sample reversion behavior frequency, and k ' represents the 5th sum, and q ' represents the 6th sum.

Step C, collects the risk assessment label of sample B F* sample IBF and correspondence thereof, creates training sample set.

Wherein, the risk assessment device of user behavior is calculating the sample of users behavior of at least one sample of users behavior Frequency, and sample of users behavior frequency corresponding sample reversion behavior frequency after, can be according to sample of users behavior Frequency and sample reversion behavior frequency, obtain at least one sample characteristics.

The risk assessment device of user behavior is after obtaining at least one sample characteristics above-mentioned, based at least one sample Eigen value and risk assessment label corresponding at least one sample characteristics create training sample set.

Step D, obtains user behavior parameter based on training sample set.

Wherein, user behavior parameter includes conditional probability parameter and Classified Proportion.

Specifically, formula is passed throughObtain conditional probability parameter, wherein, P (a '_j|c_i) use In representing a '_jBelong to c_iConditional probability parameter, a '_jRepresent sample characteristics, c_iRepresent risk assessment label, Count(a′_j|c_i) represent belong to c_iA ' occurs_jNumber of times, Count (c_i) represent belong to c_iNumber of times, wherein, 0 ＜ j ＜ n, n For the total sample number in training sample set, 0 ＜ i ＜ m, m is the species number of risk assessment label, and i, j are integer； And

Step E, carries out risk assessment to the first account in first preset time period the first behavior.

Wherein, identical to step S210 with above-mentioned steps S202, the risk assessment device of user behavior can be to One account carries out risk assessment in first preset time period the first behavior, obtains the first account in the first preset time period The risk evaluation result of one behavior.

It should be noted that for aforesaid each method embodiment, in order to be briefly described, therefore it is all expressed as one it be The combination of actions of row, but those skilled in the art should know, the present invention not limiting by described sequence of movement System, because according to the present invention, some step can use other orders or carry out simultaneously.Secondly, art technology Personnel also should know, embodiment described in this description belongs to preferred embodiment, involved action and module Not necessarily necessary to the present invention.

Through the above description of the embodiments, those skilled in the art is it can be understood that arrive according to above-mentioned enforcement The method of example can add the mode of required general hardware platform by software and realize, naturally it is also possible to by hardware, but In the case of Hen Duo, the former is more preferably embodiment.Based on such understanding, technical scheme substantially or Saying that the part contributing prior art can embody with the form of software product, this computer software product is deposited Storage is in a storage medium (such as ROM/RAM, magnetic disc, CD), including some instructions with so that a station terminal Equipment (can be mobile phone, computer, server, or the network equipment etc.) performs described in each embodiment of the present invention Method.

Embodiment 2

According to embodiments of the present invention, a kind of device embodiment for implementing said method embodiment, this Shen are additionally provided Please can run on computer terminals by the device that provided of above-described embodiment.

Fig. 5 is the structural representation of the risk assessment device of the user behavior according to the embodiment of the present application.

As it is shown in figure 5, the risk assessment device of this user behavior can include that the first acquiring unit 502, second obtains Unit 504, processing unit the 506, first computing unit 508 and risk assessment unit 510.

Wherein, the first acquiring unit 502, in the first preset time period, perform the first behavior for obtaining the first account Corresponding user behavior frequency；Second acquisition unit 504, for obtaining the reversion that described user behavior frequency is corresponding Behavior frequency, wherein, described reversion behavior frequency obtains according to the first sum and the second sum, described first total Number refers to the quantity of the first behavior of all accounts in described first preset time period, and described second sum refers in institute The quantity of all behaviors of all accounts in stating the first preset time period；Processing unit 506, for according to described user Behavior frequency and described reversion behavior frequency, obtain the First Eigenvalue that described first behavior is corresponding；First calculates list Unit 508, for the described the First Eigenvalue corresponding according to described first behavior, calculates described the First Eigenvalue all Characteristic ratio shared in the eigenvalue of all behaviors of account；Risk assessment unit 510, for based on described feature Ratio and the user behavior parameter obtained in advance, obtain described first account and perform in described first preset time period The risk evaluation result of described first behavior.

Herein it should be noted that above-mentioned first acquiring unit 502, second acquisition unit 504, processing unit 506, First computing unit 508 and risk assessment unit 510 corresponding to step S202 in embodiment one to step S210, Five modules are identical with the example that corresponding step is realized and application scenarios, but are not limited to disclosed in above-described embodiment one Content.It should be noted that above-mentioned module may operate in, as the part of device, the calculating that embodiment one provides In machine terminal 10, can be realized by software, it is also possible to realized by hardware.

Alternatively, as shown in Figure 6, described first acquiring unit 502 may include that first determines subelement 602 He First computation subunit 604.

Wherein, first determines subelement 602, is used for determining the 3rd sum and the 4th sum, wherein, described 3rd total Number refers to that described first account performs the quantity of described first behavior in described first preset time period, described 4th total Number refers to the quantity of described first account all behaviors in described first preset time period；First computation subunit 604, for according to described 3rd total and described 4th sum, calculating described user behavior frequency.

Herein it should be noted that above-mentioned first determines that subelement 602 and the first computation subunit 604 are corresponding to implementing Step S20 in example one is to step S22, and two modules are identical with the example that corresponding step is realized and application scenarios, But it is not limited to above-described embodiment one disclosure of that.It should be noted that above-mentioned module can as the part of device To operate in the terminal 10 that embodiment one provides, can be realized by software, it is also possible to realized by hardware.

Alternatively, as it is shown in fig. 7, described second acquisition unit 504 may include that second determines subelement 702 He Second computation subunit 704.

Second determines subelement 702, is used for determining described first total and described second sum；Second computation subunit 704, for by formula I=lg (k/q), calculate described reversion behavior frequency, wherein, I represents described reversion behavior Frequency, k represents described second sum, and q represents described first sum.

Herein it should be noted that above-mentioned second determines that subelement 702 and the second computation subunit 704 are corresponding to implementing Step S30 in example one is to step S32, and two modules are identical with the example that corresponding step is realized and application scenarios, But it is not limited to above-described embodiment one disclosure of that.It should be noted that above-mentioned module can as the part of device To operate in the terminal 10 that embodiment one provides, can be realized by software, it is also possible to realized by hardware.

Alternatively, the first computing unit 508 for perform following steps according to described first behavior corresponding described first Eigenvalue, calculates the characteristic ratio that described the First Eigenvalue is shared in the eigenvalue of all behaviors of all accounts: logical Cross formulaObtain described the First Eigenvalue institute in the eigenvalue of all behaviors of all accounts The characteristic ratio accounted for, wherein, a_jRepresent described the First Eigenvalue, P (a_j) be used for representing a_jOwning in all accounts Described characteristic ratio shared by the eigenvalue of behavior, j is the integer more than 0.

Alternatively, the first computation subunit 604 is used for performing following steps according to described 3rd total and described 4th total Number, calculates described user behavior frequency: by described 3rd sum divided by described 4th sum, obtain described user behavior Frequency；

Processing unit 506 is used for performing following steps according to described user behavior frequency and described reversion behavior frequency, Obtain the First Eigenvalue that described first behavior is corresponding: described user behavior frequency is multiplied by described reversion behavior frequency, Obtain the First Eigenvalue that described first behavior is corresponding.

Alternatively, as shown in Figure 8, include conditional probability parameter in the described user behavior parameter obtained in advance and divide In the case of class ratio, the risk assessment device of user behavior can also include: creating unit 802 and second calculates list Unit 804.

Wherein, creating unit 802, it is used for creating training sample set, wherein, described training sample set is bonded to few bag Include a sample characteristics and risk assessment label corresponding at least one sample characteristics described；Second computing unit 804, for the described risk corresponding according at least one sample characteristics described and at least one sample characteristics described Assessment tag, obtains described conditional probability parameter and described Classified Proportion.

Herein it should be noted that above-mentioned creating unit 802 and the second computing unit 804 are corresponding in embodiment one Step S302 is to step S304, and two modules are identical with the example that corresponding step is realized and application scenarios, but not It is limited to above-described embodiment one disclosure of that.It should be noted that above-mentioned module can be transported as the part of device Row, in the terminal 10 that embodiment one provides, can be realized by software, it is also possible to realized by hardware.

Alternatively, as it is shown in figure 9, described creating unit 802 may include that acquisition subelement the 902, the 3rd calculating Subelement the 904, the 4th computation subunit 906 and establishment subelement 908.

Wherein, obtaining subelement 902, for obtaining in the second preset time period, at least one sample account is at least One sample of users behavior；3rd computation subunit 904, for calculating the sample of at least one sample of users behavior described This user behavior frequency, and the sample reversion behavior frequency that described sample of users behavior frequency is corresponding, wherein, described Sample reversion behavior frequency obtains according to the 5th sum and the 6th sum, and described 5th sum refers to described second In preset time period at least one sample of users behavior described of all accounts quantity and in the second preset time period The sum of all behaviors of all accounts obtains；4th computation subunit 906, for according to described sample of users row Invert behavior frequency for frequency and described sample, obtain at least one sample characteristics described；Create subelement 908, For the risk assessment label corresponding according at least one sample characteristics described and at least one sample characteristics described Create described training sample set.

Herein it should be noted that above-mentioned acquisition subelement the 902, the 3rd computation subunit the 904, the 4th computation subunit 906 and create subelement 908 corresponding to step S40 in embodiment one to step S46, four modules are with corresponding The example that step is realized is identical with application scenarios, but is not limited to above-described embodiment one disclosure of that.Need explanation , above-mentioned module may operate in the terminal 10 that embodiment one provides as a part for device, permissible Realized by software, it is also possible to realized by hardware.

Alternatively, the 3rd computation subunit 904 is used for performing following steps calculating at least one sample of users behavior described Sample of users behavior frequency, and described sample of users behavior frequency corresponding sample reversion behavior frequency:

By at least one sample of users behavior described at least one sample account described in described second preset time period Quantity divided by the quantity of all behaviors of at least one sample account described in described second preset time period, obtain The described sample of users behavior frequency of at least one sample of users behavior described；And

By formula I '=lg (k '/q '), calculating described sample reversion behavior frequency, wherein, I ' represents that described sample inverts Behavior frequency, k ' represents described 5th sum, and q ' represents described 6th sum.

Alternatively, the second computing unit 804 be used for performing following steps according at least one sample characteristics described and The described risk assessment label that at least one sample characteristics described is corresponding, obtains described conditional probability parameter and described Classified Proportion:

Pass through formulaObtain described conditional probability parameter, wherein, described P (a '_j|c_i) use In representing a '_jBelong to c_iDescribed conditional probability parameter, a '_jRepresent sample characteristics, c_iRepresent described risk assessment label, Coumt(a′_j|c_i) represent belong to c_iA ' occurs_jNumber of times, Count (c_i) represent belong to c_iNumber of times, wherein, 0 ＜ j ＜ n, n For the total sample number in described training sample set, 0 ＜ i ＜ m, m is the species number of risk assessment label, and i, j are whole Number；And

Pass through formulaObtain described Classified Proportion, wherein, P (c_i) be used for representing c_iAll Described Classified Proportion shared in risk assessment label.

Alternatively, risk assessment unit 510 and obtains based on described characteristic ratio in advance for performing following steps User behavior parameter, obtains described first account and performs the risk of described first behavior in described first preset time period Assessment result: pass through formulaObtain described first account described first pre- If performing the described risk evaluation result of described first behavior, wherein, c in the time period_MAPFor described first account in institute The described risk evaluation result of described first behavior is performed in stating the first preset time period.

Embodiment 3

Embodiments of the invention additionally provide a kind of storage medium.Alternatively, in the present embodiment, above-mentioned storage medium May be used for preserving the program code performed by methods of risk assessment of the user behavior that above-described embodiment one is provided.

Alternatively, in the present embodiment, during above-mentioned storage medium may be located at computer network Computer terminal group In any one terminal, or it is positioned in any one mobile terminal in mobile terminal group.

Alternatively, in the present embodiment, storage medium is arranged to storage for the program code performing following steps: Obtain the first account in the first preset time period, perform the user behavior frequency corresponding to the first behavior；Obtain described use The reversion behavior frequency that family behavior frequency is corresponding, wherein, described reversion behavior frequency is total according to the first sum and second Number obtains, and described first sum refers to the quantity of the first behavior of all accounts in described first preset time period, Described second sum refers to the quantity of all behaviors of all accounts in described first preset time period；According to described use Family behavior frequency and described reversion behavior frequency, obtain the First Eigenvalue that described first behavior is corresponding；According to described The described the First Eigenvalue that first behavior is corresponding, calculates the described the First Eigenvalue feature in all behaviors of all accounts Characteristic ratio shared in value；Based on described characteristic ratio and the user behavior parameter that obtains in advance, obtain described One account performs the risk evaluation result of described first behavior in described first preset time period.

Alternatively, storage medium is also configured to storage for the program code performing following steps: determine the 3rd sum With the 4th sum, wherein, described 3rd sum refers to that described first account performs institute in described first preset time period Stating the quantity of the first behavior, described 4th sum refers to described first account owning in described first preset time period The quantity of behavior；According to described 3rd total and described 4th sum, calculate described user behavior frequency.

Alternatively, storage medium is also configured to storage for the program code performing following steps: determine described first Total and described second sum；By formula I=lg (k/q), calculating described reversion behavior frequency, wherein, I represents Described reversion behavior frequency, k represents described second sum, and q represents described first sum.

Alternatively, storage medium is also configured to storage for the program code performing following steps: pass through formulaObtain the spy that described the First Eigenvalue is shared in the eigenvalue of all behaviors of all accounts Levy ratio, wherein, a_jRepresent described the First Eigenvalue, P (a_j) be used for representing a_jAll behaviors in all accounts Described characteristic ratio shared by eigenvalue, j is the integer more than 0.

Alternatively, storage medium is also configured to storage for the program code performing following steps: by described 3rd total Number, divided by described 4th sum, obtains described user behavior frequency.

Alternatively, storage medium is also configured to storage for the program code performing following steps: by described user's row It is multiplied by described reversion behavior frequency for frequency, obtains the First Eigenvalue that described first behavior is corresponding.

Alternatively, storage medium is also configured to storage for the program code performing following steps: create training sample Set, wherein, described training sample set is bonded to include a sample characteristics and at least one sample characteristics described less The risk assessment label that value is corresponding；According at least one sample characteristics described and at least one sample characteristics described Corresponding described risk assessment label, obtains described conditional probability parameter and described Classified Proportion.

Alternatively, storage medium is also configured to storage for the program code performing following steps: obtain pre-second If at least one sample of users behavior of at least one sample account in the time period；Calculate at least one sample of users described The sample of users behavior frequency of behavior, and the sample reversion behavior frequency that described sample of users behavior frequency is corresponding, its In, described sample reversion behavior frequency obtains according to the 5th sum and the 6th sum, and described 5th sum refers to In described second preset time period at least one sample of users behavior described of all accounts quantity and second preset In time period, the sum of all behaviors of all accounts obtains；According to described sample of users behavior frequency and described sample This reversion behavior frequency, obtains at least one sample characteristics described；According at least one sample characteristics described and The risk assessment label described training sample set of establishment that at least one sample characteristics described is corresponding.

Alternatively, storage medium is also configured to storage for the program code performing following steps: will be described second In preset time period, the quantity of at least one sample of users behavior described of at least one sample account described is divided by described The quantity of all behaviors of at least one sample account described in second preset time period, obtains at least one sample described The described sample of users behavior frequency of user behavior；And by formula I '=lg (k '/q '), calculate described sample reversion row For frequency, wherein, I ' represents that described sample inverts behavior frequency, and k ' represents described 5th sum, and q ' represents described the Six sums.

Alternatively, storage medium is also configured to storage for the program code performing following steps: pass through formulaObtain described conditional probability parameter, wherein, described P (a '_j|c_i) be used for representing a '_jBelong to The described conditional probability parameter of ci, a '_jRepresent sample characteristics, c_iRepresent described risk assessment label, Count (a '_j|c_i) Represent and belong to c_iA ' occurs_jNumber of times, Count (c_i) represent belong to c_iNumber of times, wherein, 0 ＜ j ＜ n, n is described training Total sample number in sample set, 0 ＜ i ＜ m, m is the species number of risk assessment label, and i, j are integer；And it is logical Cross formulaObtain described Classified Proportion, wherein, P (c_i) be used for representing c_iRisky comment in institute Estimate described Classified Proportion shared in label.

Alternatively, storage medium is also configured to storage for the program code performing following steps: pass through formulaObtain described first account and perform described in described first preset time period The described risk evaluation result of the first behavior, wherein, c_MAPFor described first account in described first preset time period Perform the described risk evaluation result of described first behavior.

Alternatively, in the present embodiment, above-mentioned storage medium can include but not limited to: USB flash disk, read only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), portable hard drive, magnetic The various medium that can store program code such as dish or CD.

Alternatively, the concrete example in the present embodiment is referred to the example described in above-described embodiment, the present embodiment Do not repeat them here.

The invention described above embodiment sequence number, just to describing, does not represent the quality of embodiment.

In the above embodiment of the present invention, the description to each embodiment all emphasizes particularly on different fields, and does not has in certain embodiment The part described in detail, may refer to the associated description of other embodiments.

In several embodiments provided herein, it should be understood that disclosed technology contents, can be passed through other Mode realize.Wherein, device embodiment described above is only schematically, the division of the most described unit, Being only a kind of logic function to divide, actual can have other dividing mode, the most multiple unit or assembly when realizing Can in conjunction with or be desirably integrated into another system, or some features can be ignored, or does not performs.Another point, institute The coupling each other shown or discuss or direct-coupling or communication connection can be by some interfaces, unit or mould The INDIRECT COUPLING of block or communication connection, can be being electrical or other form.

The described unit illustrated as separating component can be or may not be physically separate, shows as unit The parts shown can be or may not be physical location, i.e. may be located at a place, or can also be distributed to On multiple NEs.Some or all of unit therein can be selected according to the actual needs to realize the present embodiment The purpose of scheme.

It addition, each functional unit in each embodiment of the present invention can be integrated in a processing unit, it is also possible to It is that unit is individually physically present, it is also possible to two or more unit are integrated in a unit.Above-mentioned integrated Unit both can realize to use the form of hardware, it would however also be possible to employ the form of SFU software functional unit realizes.

If described integrated unit is using the form realization of SFU software functional unit and as independent production marketing or use, Can be stored in a computer read/write memory medium.Based on such understanding, technical scheme essence On the part that in other words prior art contributed or this technical scheme completely or partially can be with software product Form embodies, and this computer software product is stored in a storage medium, including some instructions with so that one Platform computer equipment (can be for personal computer, server or the network equipment etc.) performs each embodiment institute of the present invention State all or part of step of method.And aforesaid storage medium includes: USB flash disk, read only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), portable hard drive, magnetic disc or CD Etc. the various media that can store program code.

The above is only the preferred embodiment of the present invention, it is noted that for the ordinary skill people of the art For Yuan, under the premise without departing from the principles of the invention, it is also possible to make some improvements and modifications, these improve and profit Decorations also should be regarded as protection scope of the present invention.

Claims

1. the methods of risk assessment of a user behavior, it is characterised in that including:

Obtain the first account in the first preset time period, perform the user behavior frequency corresponding to the first behavior；

Obtaining the reversion behavior frequency that described user behavior frequency is corresponding, wherein, described reversion behavior frequency is root Obtaining according to the first sum and the second sum, described first sum refers in described first preset time period all The quantity of the first behavior of account, described second sum refers to all accounts in described first preset time period The quantity of all behaviors；

According to described user behavior frequency and described reversion behavior frequency, obtain that described first behavior is corresponding One eigenvalue；

According to the described the First Eigenvalue that described first behavior is corresponding, calculate described the First Eigenvalue in all accounts All behaviors eigenvalue in shared characteristic ratio；

Based on described characteristic ratio and the user behavior parameter that obtains in advance, obtain described first account described The risk evaluation result of described first behavior is performed in first preset time period.

Method the most according to claim 1, it is characterised in that described acquisition the first account is in the first preset time period User behavior frequency corresponding to interior execution the first behavior, including:

Determining the 3rd sum and the 4th sum, wherein, described 3rd sum refers to that described first account is described the Performing the quantity of described first behavior in one preset time period, described 4th sum refers to that described first account is in institute State the quantity of all behaviors in the first preset time period；

According to described 3rd total and described 4th sum, calculate described user behavior frequency.

Method the most according to claim 1, it is characterised in that corresponding anti-of described acquisition described user behavior frequency Change one's profession as frequency, including:

Determine described first total and described second sum；

By formula I=lg (k/q), calculating described reversion behavior frequency, wherein, I represents described reversion behavior Frequency, k represents described second sum, and q represents described first sum.

Method the most according to claim 1, it is characterised in that described according to described first behavior corresponding described One eigenvalue, calculates the aspect ratio that described the First Eigenvalue is shared in the eigenvalue of all behaviors of all accounts Example, including:

Pass through formulaObtain all behaviors in all accounts of the described the First Eigenvalue Characteristic ratio shared in eigenvalue, wherein, a_jRepresent described the First Eigenvalue, P (a_j) be used for representing a_j? Described characteristic ratio shared by the eigenvalue of all behaviors of all accounts, j is the integer more than 0.

Method the most according to claim 2, it is characterised in that

Described according to described 3rd total and described 4th sum, calculate described user behavior frequency, including:

By described 3rd sum divided by described 4th sum, obtain described user behavior frequency；

Described according to described user behavior frequency and described reversion behavior frequency, obtain described first behavior corresponding The First Eigenvalue, including:

Described user behavior frequency is multiplied by described reversion behavior frequency, obtain that described first behavior is corresponding first Eigenvalue.

Method the most according to any one of claim 1 to 5, it is characterised in that the described user obtained in advance In the case of behavioral parameters includes conditional probability parameter and Classified Proportion, obtain described conditional probability parameter and The step of described Classified Proportion includes:

Create training sample set, wherein, described training sample set be bonded to include less a sample characteristics and The risk assessment label that at least one sample characteristics described is corresponding；

According to the described risk that at least one sample characteristics described and at least one sample characteristics described are corresponding Assessment tag, obtains described conditional probability parameter and described Classified Proportion.

Method the most according to claim 6, it is characterised in that described establishment training sample set, wherein, described Training sample set is bonded to include less a sample characteristics and risk corresponding at least one sample characteristics described Assessment tag, including:

At least one sample of users behavior of at least one sample account in the second preset time period of acquisition；

Calculate the sample of users behavior frequency of at least one sample of users behavior described, and described sample of users row For the sample reversion behavior frequency that frequency is corresponding, wherein, described sample reversion behavior frequency is according to the 5th sum Obtaining with the 6th sum, described 5th sum refers in described second preset time period described in all accounts The quantity of at least one sample of users behavior and in the second preset time period all behaviors of all accounts total Number obtains；

Invert behavior frequency according to described sample of users behavior frequency and described sample, obtain described at least one Sample characteristics；

According to the risk assessment that at least one sample characteristics described and at least one sample characteristics described are corresponding Label creates described training sample set.

Method the most according to claim 7, it is characterised in that at least one sample of users behavior described in described calculating Sample of users behavior frequency, and described sample of users behavior frequency corresponding sample reversion behavior frequency, bag Include:

By at least one sample of users described at least one sample account described in described second preset time period The quantity of behavior is divided by the number of all behaviors of at least one sample account described in described second preset time period Amount, obtains the described sample of users behavior frequency of at least one sample of users behavior described；And

By formula I '=lg (k '/q '), calculating described sample reversion behavior frequency, wherein, I ' represents described sample Reversion behavior frequency, k ' represents described 5th sum, and q ' represents described 6th sum.

Method the most according to claim 6, it is characterised in that at least one sample characteristics described in described basis with And the described risk assessment label that described at least one sample characteristics is corresponding, obtain described conditional probability parameter with And described Classified Proportion, including:

Pass through formulaObtain described conditional probability parameter, wherein, described P (a '_j|c_i) For representing a '_jBelong to c_iDescribed conditional probability parameter, a '_jRepresent sample characteristics, c_iRepresent that described risk is commented Estimate label, Count (a '_j|c_i) represent belong to c_iA ' occurs_jNumber of times, Count (c_i) represent belong to c_iNumber of times, its In, 0 ＜ j ＜ n, n are the total sample number in described training sample set, and 0 ＜ i ＜ m, m is the kind of risk assessment label Class number, i, j are integer；And

Pass through formulaObtain described Classified Proportion, wherein, P (c_i) be used for representing c_i? Described Classified Proportion shared in all risk assessment labels.

Method the most according to claim 9, it is characterised in that described based on described characteristic ratio and obtain in advance User behavior parameter, obtain described first account in described first preset time period, perform described first behavior Risk evaluation result, including:

Pass through formulaObtain described first account to preset described first The described risk evaluation result of described first behavior, wherein, c is performed in time period_MAPExist for described first account The described risk evaluation result of described first behavior is performed in described first preset time period.

The risk assessment device of 11. 1 kinds of user behaviors, it is characterised in that including:

First acquiring unit, performs corresponding to the first behavior in the first preset time period for obtaining the first account User behavior frequency；

Second acquisition unit, for obtaining the reversion behavior frequency that described user behavior frequency is corresponding, wherein, institute Stating reversion behavior frequency to obtain according to the first sum and the second sum, described first sum refers to described the The quantity of the first behavior of all accounts in one preset time period, described second sum refers to preset described first The quantity of all behaviors of all accounts in time period；

Processing unit, for according to described user behavior frequency and described reversion behavior frequency, obtains described the The First Eigenvalue that one behavior is corresponding；

First computing unit, for according to described the First Eigenvalue corresponding to described first behavior, calculates described the The characteristic ratio that one eigenvalue is shared in the eigenvalue of all behaviors of all accounts；

Risk assessment unit, for based on described characteristic ratio and the user behavior parameter that obtains in advance, obtaining Described first account performs the risk evaluation result of described first behavior in described first preset time period.

12. devices according to claim 11, it is characterised in that described first acquiring unit includes:

First determines subelement, is used for determining the 3rd sum and the 4th sum, and wherein, described 3rd sum refers to Described first account performs the quantity of described first behavior, described 4th sum in described first preset time period Refer to the quantity of described first account all behaviors in described first preset time period；

First computation subunit, for according to described 3rd total and described 4th sum, calculating described user's row For frequency.

13. devices according to claim 11, it is characterised in that described second acquisition unit includes:

Second determines subelement, is used for determining described first total and described second sum；

Second computation subunit, for by formula I=lg (k/q), calculates described reversion behavior frequency, wherein, I represents described reversion behavior frequency, and k represents described second sum, and q represents described first sum.

14. devices according to claim 11, it is characterised in that described first computing unit is used for performing following steps According to the described the First Eigenvalue that described first behavior is corresponding, calculate the described the First Eigenvalue institute in all accounts Characteristic ratio shared by having in the eigenvalue of behavior:

15. devices according to claim 12, it is characterised in that

Described first computation subunit is used for performing following steps according to described 3rd total and described 4th sum, Calculate described user behavior frequency: by described 3rd sum divided by described 4th sum, obtain described user behavior Frequency；

Described processing unit is used for performing following steps according to described user behavior frequency and described reversion behavior frequency Rate, obtains the First Eigenvalue that described first behavior is corresponding: described user behavior frequency is multiplied by described reversion row For frequency, obtain the First Eigenvalue that described first behavior is corresponding.

16. according to the device according to any one of claim 11 to 15, it is characterised in that in the described use obtained in advance In the case of family behavioral parameters includes conditional probability parameter and Classified Proportion, described device also includes:

Creating unit, is used for creating training sample set, and wherein, described training sample set is bonded to include one less Sample characteristics and risk assessment label corresponding at least one sample characteristics described；

Second computing unit, for special according at least one sample characteristics described and at least one sample described The described risk assessment label that value indicative is corresponding, obtains described conditional probability parameter and described Classified Proportion.

17. devices according to claim 16, it is characterised in that described creating unit includes:

Obtain subelement, for obtaining at least one sample of at least one sample account in the second preset time period This user behavior；

3rd computation subunit, for calculating the sample of users behavior frequency of at least one sample of users behavior described, And the sample reversion behavior frequency that described sample of users behavior frequency is corresponding, wherein, the reversion behavior of described sample Frequency obtains according to the 5th sum and the 6th sum, and described 5th sum refers at described second Preset Time The quantity of at least one sample of users behavior described of all accounts and all in the second preset time period in section The sum of all behaviors of account obtains；

4th computation subunit, for inverting behavior frequency according to described sample of users behavior frequency and described sample Rate, obtains at least one sample characteristics described；

Create subelement, for according at least one sample characteristics described and at least one sample characteristics described The risk assessment label described training sample set of establishment that value is corresponding.

18. devices according to claim 17, it is characterised in that described 3rd computation subunit is used for performing following walking The rapid sample of users behavior frequency calculating at least one sample of users behavior described, and described sample of users behavior The sample reversion behavior frequency that frequency is corresponding:

19. devices according to claim 16, it is characterised in that described second computing unit is used for performing following steps According to the described risk assessment that at least one sample characteristics described and at least one sample characteristics described are corresponding Label, obtains described conditional probability parameter and described Classified Proportion:

20. devices according to claim 19, it is characterised in that described risk assessment unit is used for performing following steps Based on described characteristic ratio and the user behavior parameter that obtains in advance, obtain described first account described first The risk evaluation result of described first behavior of execution in preset time period: