CN110008991A

CN110008991A - The identification of risk case, risk identification model generation method and device

Info

Publication number: CN110008991A
Application number: CN201910140124.2A
Authority: CN
Inventors: 赵乾坤; 肖凯; 王维强
Original assignee: Alibaba Group Holding Ltd
Current assignee: Advanced New Technologies Co Ltd; Advantageous New Technologies Co Ltd
Priority date: 2019-02-26
Filing date: 2019-02-26
Publication date: 2019-07-12
Anticipated expiration: 2039-02-26
Also published as: CN110008991B

Abstract

This specification embodiment provides a kind of identification of risk case, the generation method of risk identification model and device, this method comprises: determining the affair character data of object event；Wherein, which includes common characteristic data and characteristic feature data；Risk identification is carried out to object event according to the first risk identification module in common characteristic data and the risk identification model of training, obtain the first risk identification result, and, according in characteristic feature data and risk identification model with object event belonging to event scenarios corresponding second risk identification module risk identification is carried out to object event, obtain the second risk identification result；First risk identification result and the second risk identification result are subjected to fusion treatment, to determine the risk identification result of object event.

Description

The identification of risk case, risk identification model generation method and device

Technical field

This application involves Internet technical field more particularly to a kind of identifications of risk case, the life of risk identification model At method and device.

Background technique

With the fast development of information technology and Internet technology, quick development has been obtained in line service and has widely been answered With, and the safety in line service how is improved, obtain more and more concerns and attention.In general, online in order to improve The safety of business can carry out risk identification in line service using risk prevention system strategy.

But for every business under same type, it is also possible to which there are the exclusive business scenario of each business, examples Such as, for class business of transferring accounts, corresponding business scenario may transfer accounts to account, transfer accounts and arrive bank card etc.；For payment class Business, the possible wired lower barcode scanning payment of corresponding business scenario, on-line payment etc..And how to there are multiple business scenes Business carry out risk identification, the technical issues of becoming current urgent need to resolve.

Summary of the invention

The purpose of this specification embodiment be to provide a kind of identification of risk case, risk identification model generation method and Device, when carrying out risk identification to object event, respectively according to common to the event under object event and other event scenarios Common characteristic data and risk identification model in the first wind for training of the general character based on the event under each event scenarios Dangerous identification module to object event carry out risk identification, obtain the first risk identification as a result, and, according to object event institute it is peculiar Characteristic feature data and the second risk identification module corresponding with the affiliated event scenarios of object event to object event carry out wind Danger identification, obtains the second risk identification as a result, finally, merging to the first risk identification result and the second risk identification result Processing, to determine the risk identification result for carrying out risk identification to object event；In this specification embodiment, to object event When carrying out risk identification, common characteristic data and characteristic feature data according to corresponding to object event pass through different wind respectively Dangerous identification model carries out risk identification to object event, then merges to risk identification result corresponding to different characteristic, from And determine the risk of object event, so that risk identification ability is more excellent, and the accuracy of risk identification can be improved；In addition, Risk identification is carried out since the event under each event scenarios can input above-mentioned risk identification model, it can thus be avoided The corresponding risk identification model of the event scenarios is disposed, under each event scenarios so as to reduce O&M cost.

In order to solve the above technical problems, this specification embodiment is achieved in that

This specification embodiment provides a kind of recognition methods of risk case, comprising:

Determine the affair character data of object event；Wherein, the affair character data include the object event and its Characteristic feature data specific to common characteristic data and the object event common to event under his event scenarios；

According to the first risk identification module in the common characteristic data and the risk identification model of training to the mesh Mark event carries out risk identification, obtain the first risk identification as a result, and, known according to the characteristic feature data and the risk In other model the second risk identification module corresponding with event scenarios belonging to the object event to the object event into Row risk identification obtains the second risk identification result；

Wherein, the risk identification model includes the first risk identification module and multiple second risk identification modules, each The second risk identification module corresponds to a kind of event scenarios；The first risk identification module is based on the thing under each event scenarios The common characteristic data of part train to obtain；The second risk identification module is based on the peculiar of the event under every kind of event scenarios Characteristic trains to obtain；

The first risk identification result and the second risk identification result are subjected to fusion treatment, with the determination mesh The risk identification result of mark event.

This specification embodiment additionally provides a kind of generation method of risk identification model, comprising:

Determine affair character data corresponding to the sample event under each event scenarios and event tag data；Wherein, institute Event tag data are stated for characterizing whether the sample event is risk sample event；

According to the affair character data of the sample event under each event scenarios, determine corresponding to target sample event Common characteristic data and object event label data；Wherein, the target sample event is from the sample thing under each event scenarios The sample event of the satisfaction setting rule filtered out in part；

According to common characteristic data corresponding to the target sample event and the object event label data, training institute State the first risk identification module of risk identification model；And the affair character number according to corresponding to each event scenarios respectively Characteristic feature data and the event tag data in are trained in the risk identification model corresponding to each event scenarios The second risk identification module.

This specification embodiment additionally provides a kind of identification device of risk case, comprising:

First determining module, for determining the affair character data of object event；Wherein, the affair character data include Specific to common characteristic data common to event under the object event and other event scenarios and the object event Characteristic feature data；

Risk identification module, for according to the first risk in the common characteristic data and the risk identification model of training Identification module to the object event carry out risk identification, obtain the first risk identification as a result, and, according to the characteristic feature The second risk identification module corresponding with event scenarios belonging to the object event in data and the risk identification model Risk identification is carried out to the object event, obtains the second risk identification result；

Second determining module, for merging the first risk identification result and the second risk identification result Processing, with the risk identification result of the determination object event.

This specification embodiment additionally provides a kind of generating means of risk identification model, comprising:

First determining module, for determining affair character data and event corresponding to the sample event under each event scenarios Label data；Wherein, the event tag data are for characterizing whether the sample event is risk sample event；

Second determining module determines mesh for the affair character data according to the sample event under each event scenarios Common characteristic data and object event label data corresponding to standard specimen present event；Wherein, the target sample event is from each The sample event of the satisfaction setting rule filtered out in sample event under event scenarios；

Training module, for the common characteristic data according to corresponding to the target sample event and the object event mark Sign data, the first risk identification module of the training risk identification model；And respectively according to corresponding to each event scenarios Affair character data in characteristic feature data and the event tag data, each thing in the training risk identification model Second risk identification module corresponding to part scene.

This specification embodiment additionally provides a kind of identification equipment of risk case, comprising:

Processor；And

It is arranged to the memory of storage computer executable instructions, the executable instruction makes the place when executed Manage device:

This specification embodiment additionally provides a kind of generating device of risk identification model, comprising:

Processor；And

This specification embodiment additionally provides a kind of storage medium, described to hold for storing computer executable instructions Following below scheme is realized in row instruction when executed:

Technical solution in the present embodiment, when carrying out risk identification to object event, respectively according to object event and its Based on the event under each event scenarios in common characteristic data and risk identification model common to event under his event scenarios The first risk identification module for training of general character risk identification is carried out to object event, obtain the first risk identification knot Fruit, and, the characteristic feature data according to specific to object event and the second wind corresponding with the affiliated event scenarios of object event Dangerous identification module carries out risk identification to object event, obtains the second risk identification as a result, finally, to the first risk identification result Fusion treatment is carried out with the second risk identification result, to determine the risk identification result for carrying out risk identification to object event；This In specification embodiment, when carrying out risk identification to object event, the common characteristic number according to corresponding to object event respectively Risk identification is carried out to object event by different risk identification models according to characteristic feature data, then right to different characteristic institute The risk identification result answered is merged, so that it is determined that the risk of object event, so that risk identification ability is more excellent, can be with Improve the accuracy of risk identification；In addition, since the event under each event scenarios can input above-mentioned risk identification model Risk identification is carried out, it can thus be avoided the corresponding risk identification model of the event scenarios is disposed under each event scenarios, from And O&M cost can be reduced.

Detailed description of the invention

In order to illustrate more clearly of this specification embodiment or technical solution in the prior art, below will to embodiment or Attached drawing needed to be used in the description of the prior art is briefly described, it should be apparent that, the accompanying drawings in the following description is only Some embodiments as described in this application, for those of ordinary skill in the art, in the premise not made the creative labor Under, it is also possible to obtain other drawings based on these drawings.

Fig. 1 is one of the method flow diagram of recognition methods of risk case that this specification embodiment provides；

Fig. 2 is the model of the first risk identification module in the recognition methods for the risk case that this specification embodiment provides Schematic diagram；

Fig. 3 is the two of the method flow diagram of the recognition methods for the risk case that this specification embodiment provides；

Fig. 4 is one of the method flow diagram of generation method for the risk identification model that this specification embodiment provides；

Fig. 5 is the flow diagram of the generation method for the risk identification model that this specification embodiment provides；

Fig. 6 is the two of the method flow diagram of the generation method for the risk identification model that this specification embodiment provides；

Fig. 7 is the module composition schematic diagram of the identification device for the risk case that this specification embodiment provides；

Fig. 8 is the module composition schematic diagram of the generating means for the risk identification model that this specification embodiment provides；

Fig. 9 is the structural schematic diagram of the identification equipment for the risk case that this specification embodiment provides.

Specific embodiment

In order to make those skilled in the art better understand the technical solutions in the application, below in conjunction with this specification Attached drawing in embodiment is clearly and completely described the technical solution in this specification embodiment, it is clear that described Embodiment is merely a part but not all of the embodiments of the present application.Based on the embodiment in the application, this field Those of ordinary skill's every other embodiment obtained without creative efforts, all should belong to the application The range of protection.

The thought of this specification embodiment is, when carrying out risk identification to object event, uses different wind respectively Common feature data and characteristic feature data of the dangerous identification model based on object event identify object event, and to two Recognition result carries out fusion treatment, obtains the risk identification of object event as a result, combining by two kinds of risk identification modules Mode, so that risk identification ability is more excellent, and the accuracy of risk identification can be improved.Based on this, this specification is implemented Example provides a kind of identification of risk case, the generation method and device of risk identification model.It is following to be situated between in detail one by one It continues.

Fig. 1 is one of the method flow diagram of recognition methods of risk case that this specification embodiment provides, and this method can To be applied to server side, i.e. the executing subject of this method can be server, specifically, can be to be mounted on server The identification device of risk case.Wherein, method shown in FIG. 1 includes at least following steps:

Step 102, the affair character data of object event are determined；Wherein, above-mentioned affair character data include object event With characteristic feature data specific to common characteristic data common to the event under other event scenarios and object event.

Wherein, above-mentioned object event can be transaction event；Specifically, can be money transfer transactions event, payment transaction thing Part etc..And for different transaction events, and different scenes can be corresponded to, for example, for money transfer transactions event, it is corresponding Event scenarios may include transferring accounts to bank card, transferring accounts and arrive account etc..

In this specification embodiment, above-mentioned affair character data are then the feature for characterizing the object event, for example, can be with Time, place, the specific event content etc. occurred including object event.For example, for the event transferred accounts to account, then it is corresponding Affair character data may include the characteristics such as transfer amounts, transfer accounts time, the side of producing, the side of being transferred to；For barcode scanning under line Payment events, corresponding affair character data may include the place of payment, payment events, payer, beneficiary, payment amount Etc. characteristics.

There can be some identical characteristics for the event under different event scene, for example, the time of event generation, Object, age, gender of transaction event etc. can also have characteristic specific to each event scenarios certainly, for example, being directed to Off-line transaction may have this characteristic feature of loco.

Step 104, according to the first risk identification module in above-mentioned common characteristic data and the risk identification model of training Risk identification is carried out to object event, obtain the first risk identification as a result, and, known according to above-mentioned characteristic feature data and risk The second risk identification module corresponding with event scenarios belonging to object event carries out risk knowledge to object event in other model Not, the second risk identification result is obtained.

Wherein, above-mentioned risk identification model includes the first risk identification module and multiple second risk identification modules, each Second risk identification module corresponds to a kind of event scenarios；First risk identification module is based on the shared of the event under each event scenarios Characteristic trains to obtain；Second risk identification module is instructed based on the characteristic feature data of the event under every kind of event scenarios It gets.

Risk identification model used by this specification embodiment includes the first risk identification module and the second risk identification Module, and include multiple second risk identification modules, corresponding second risk of every kind of event scenarios in risk identification model Identification module, in this way, when carrying out risk identification to object event using risk identification model, it can be right according to object event institute The event scenarios answered select corresponding second risk identification module.

And the first risk identification module in risk identification model is then based on event corresponding under each event scenarios General character training obtains.For example, being directed to payment transaction event, the affair character that each event includes includes: the year of less The features such as age, gender, amount paid, the means of payment, only for the payment events under different event scene, presumable branch The event of paying will include the exclusive feature such as place of payment；And the second risk identification module is then based on the event institute under each event scenarios What distinctive peculiar affair character was trained.

Specifically, when carrying out risk identification to object event, being based respectively on object event in this specification embodiment Affair character data in common characteristic data and characteristic feature data to object event carry out risk identification.It is being embodied When, then it is that risk identification is carried out to object event based on the common characteristic data of object event using the first risk identification module, Risk identification is carried out to object event based on the characteristic feature data of object event using the second risk identification module.I.e. by first Risk identification module and the second risk identification module, which combine, is based respectively on the different characteristics of object event, from different Angle, which carries out risk identification to object event, can be improved the accuracy of risk identification so that risk identification ability is more excellent.

Wherein, mentioned by this specification embodiment to event scenarios can be understood as the specific occurrence scene of the event, For example, barcode scanning transaction belongs to a kind of event scenarios under line for payment transaction event, on-line payment transaction belongs to a kind of thing Part scene；For money transfer transactions event, transferring accounts to bank card belongs to that a kind of event scenarios, transferring accounts belongs to a kind of thing to account Part scene.

Step 106, the first risk identification result and the second risk identification result are subjected to fusion treatment, with the above-mentioned mesh of determination The risk identification result of mark event.

In this specification embodiment, the first risk identification result and the second risk identification result are according to object event Different characteristic data, using different risk identification modules to object event carry out risk identification as a result, therefore, in order to obtain Finally to the risk identification result of object event, it is also necessary to melt the first risk identification result and the second risk identification result Conjunction processing.

It should be noted that in the specific implementation, above-mentioned first risk identification result and the second risk identification result can be with For risk identification score value, determined correspondingly, carrying out fusion treatment to the first risk identification result and the second risk identification result The risk identification result of object event out may be risk identification score value；Alternatively, in above-mentioned steps 106, it can also be true After making the final risk score value of object event, the target thing based on determined by object event final risk score value is directly exported Whether part is risk case；Also alternatively, in above-mentioned steps 106, the final risk score value of object event can also be being determined Afterwards, the risk class for the object event that output is determined based on the final risk score value of object event.

The recognition methods for the risk case that this specification embodiment provides for ease of understanding, it is following to will be described in detail above-mentioned step Rapid 104 and step 106 specific implementation process.

In above-mentioned steps 104, according to the first risk identification in common characteristic data and the risk identification model of training Module carries out risk identification to object event, obtains the first risk identification as a result, specifically including:

According to above-mentioned common characteristic data and the first risk identification module, the degree of risk of above-mentioned object event is beaten Point, the first score value corresponding to object event is obtained, as the first risk identification result；

Correspondingly, in above-mentioned steps 104, according in characteristic feature data and risk identification model and belonging to object event The corresponding second risk identification module of event scenarios to object event carry out risk identification, obtain the second risk identification as a result, Include:

According to above-mentioned characteristic feature data and the second risk identification module, give a mark to the degree of risk of object event, The second score value corresponding to object event is obtained, as the second risk identification result.

In this specification embodiment, the first risk identification module and the second risk identification module can determine for gradient promotion Plan tree (Gradient Boosting Decision Tree, GBDT) model；It is, of course, also possible to be linear logic regression model. Certainly, in addition to this, above-mentioned first risk identification module and the second risk identification module can also be other models, this specification Embodiment is defined not to this.And in the specific implementation, the first risk identification module and the second risk identification module can To use identical module, different models can also be used.

In order to facilitate understanding in this specification embodiment, pass through the first risk identification module and the second risk identification module pair The detailed process that the degree of risk of object event is given a mark, it is following will by the first risk identification module be GBDT model for, Introduce the detailed process given a mark by the first risk identification module to the degree of risk of object event.

Fig. 2 is the department pattern schematic diagram of the first risk identification module in this specification embodiment, using shown in Fig. 2 When first risk identification module gives a mark to object event, first according to the registration time length of beneficiary in object event and payment Side registration time length determine first node corresponding to object event, if for example, the registration time length of beneficiary be greater than 30 hours, And the registration time length of paying party is greater than 60 hours, then gives a mark into model shown in Fig. 2 to object event.If so, payment Fang Nianling then obtains being scored at 0.35 greater than 25 for the node, if this time amount of money of transaction is greater than 3000, then being directed to should The score value that node obtains is -0.19, if paying party gender, which is greater than zero, (can pre-define gender male, value 0, gender female takes Value 1, gender is unknown, value -1), then it obtains being scored at 0.15 for the node, if transaction amount is greater than 30, then being directed to should Node obtains being scored at -0.43；After obtaining corresponding score based on above-mentioned each affair character, each score is asked With, i.e. 0.35+ (- 0.19)+0.15+ (- 0.43)=- 0.12, i.e., the first risk identification module shown in Fig. 2 to object event into The score value of row marking is -0.12.

Certainly, Fig. 2 is the part of model for depicting the first risk identification module.In addition, above-mentioned only with first Risk identification module is is illustrated for GBDT model, if the first risk identification module and the second risk identification module For other models, then should be given a mark using method corresponding with the model to object event, this specification embodiment is no longer It illustrates one by one.

In the specific implementation, due to needing using corresponding with the event scenarios of object event second in above-mentioned steps 104 Risk identification module carries out risk identification to object event, and therefore, in this specification embodiment, above-mentioned steps 104 further include Following steps:

Determine event scenarios belonging to object event；The event scenarios according to belonging to object event, from above-mentioned risk identification Determine that the second risk for carrying out risk identification to object event is known in multiple second risk identification modules that model includes Other module.

In the specific implementation, can be in risk identification model, there are many event scenarios and its corresponding second wind for storage The mapping relations of dangerous identification module, a kind of possible storage form are as shown in table 1.

Table 1

Event scenarios	Second risk identification module
		It transfers accounts to bank card	Second risk identification module 1
It is paid on line	Second risk identification module 2
		Barcode scanning is paid under line	Second risk identification module 3

It wherein, in table 1 above, then be with event scenarios is that scanning payment is under transferring accounts to payment, line on bank card, line Example citing is illustrated, and does not constitute the restriction to this specification embodiment.

In above-mentioned steps 106, the first risk identification result and the second risk identification result are subjected to fusion treatment, with true The risk identification for the event that sets the goal is as a result, specifically comprise the following steps (1) and step (2)；

Step (1), the fusion score value for calculating the first score value and the second score value；

Step (2), the risk identification result that above-mentioned fusion score value is determined as to object event.

In a specific embodiment, it can directly be exported by this specification embodiment and risk is carried out to object event The risk score value of identification, in this way, related personnel can judge whether the object time is risk according to the risk score value exported Event；Further judged alternatively, can also export the risk score value to other models, thus direct from other models Whether output object event is risk case or directly exports the risk class of object event；Alternatively, can also be by above-mentioned wind Dangerous score value export to other systems carry out using.This specification embodiment does not limit the subsequent processing of above-mentioned risk score value It is fixed.

Specifically, in this specification embodiment, melting for the first score value and the second score value can be calculated by following formula Close score value；

Wherein, in above-mentioned publicity, x₁Indicate the first score value, x₂It indicates the second score value, merges score value described in x.

Certainly, in above-mentioned shown amalgamation mode, full marks corresponding to the first score value and the second score value are 1 point of system.Except this Except, if the first score value and the second score value use ten score values or hundred-mark system, then above-mentioned formula can be adjusted, so as to Calculate the fusion score value of the first score value and the second score value.

Fig. 3 is the two of the method flow diagram of the recognition methods for the risk case that this specification embodiment provides, shown in Fig. 3 Method includes at least following steps:

Step 302, the affair character data of object event are determined；Wherein, which includes common characteristic number According to characteristic feature data.

Wherein, so-called common characteristic data are then feature common to the event under object event and other event scenarios, Characteristic feature data are then feature specific to object event.

Step 304, the first risk identification mould of the risk identification model trained according to above-mentioned common characteristic data and in advance Block gives a mark to the degree of risk of object event, obtains the first score value corresponding to object event.

Step 306, event scenarios belonging to object event are determined.

Step 308, the event scenarios according to belonging to object event, multiple second risks for including from risk identification model The second risk identification module for carrying out risk identification to object event is determined in identification module.

Step 310, according to above-mentioned characteristic feature data and identified second risk identification module, to the wind of object event Dangerous degree is given a mark, and the second score value corresponding to object event is obtained.

Step 312, the fusion score value for calculating the first score value and the second score value, using the fusion score value as the wind of object event Dangerous recognition result.

It certainly, is then to first pass through the first risk identification module to the degree of risk of object event in flow chart shown in Fig. 3 It gives a mark, then is given a mark by the second risk identification module to the degree of risk of object event；And in the specific implementation, also The second risk identification module can be first passed through to give a mark to the degree of risk of object event, then pass through the first risk identification module It gives a mark to the degree of risk of object event；Alternatively, passing through the first wind after determining the affair character data of object event Dangerous identification module and the second risk identification module simultaneously give a mark to the degree of risk of object event.

Wherein, the specific implementation process of each step can refer to embodiment corresponding to Fig. 1, Fig. 2 in embodiment illustrated in fig. 3, Details are not described herein again.

The recognition methods for the risk case that this specification embodiment provides, when carrying out risk identification to object event, point It is not based on according in object event and common characteristic data common to the event under other event scenarios and risk identification model The first risk identification module that the general character of event under each event scenarios is trained carries out risk identification to object event, obtains To the first risk identification as a result, and, the characteristic feature data according to specific to object event and with the affiliated event of object event The corresponding second risk identification module of scene carries out risk identification to object event, obtains the second risk identification as a result, finally, again First risk identification result and the second risk identification result carry out fusion treatment, carry out risk identification to object event to determine Risk identification result；It is right according to object event institute respectively when carrying out risk identification to object event in this specification embodiment The common characteristic data and characteristic feature data answered carry out risk identification to object event by different risk identification models, Risk identification result corresponding to different characteristic is merged, so that it is determined that the risk of object event, so that risk is known Other ability is more excellent, and the accuracy of risk identification can be improved；In addition, since the event under each event scenarios can input It states risk identification model and carries out risk identification, it can thus be avoided it is corresponding to dispose the event scenarios under each event scenarios Risk identification model, so as to reduce O&M cost.

Corresponding to the recognition methods for the risk case that this specification embodiment provides, it is based on identical thinking, this specification Embodiment additionally provides a kind of generation method of risk identification model, for generating used in the recognition methods of risk case Risk identification model, Fig. 4 are one of the method flow diagram of generation method for the risk identification model that this specification embodiment provides, Method shown in Fig. 4 includes at least following steps:

Step 402, affair character data corresponding to the sample event under each event scenarios and event tag data are determined； Wherein, the event tag data are for characterizing whether sample event is risk sample event.

Wherein, above-mentioned event can be transaction event, for example, can be the event of transferring accounts, payment events etc., and for difference Event, corresponding affair character data may be distinct.

In this specification embodiment, above-mentioned event tag data are for characterizing whether sample event is risk sample thing Part, if for example, risk sample event, corresponding to event tag data can be denoted as 0, if being non-risk sample event, Event tag data corresponding to it can be denoted as 1.

Step 404, according to the affair character data of the sample event under each event scenarios, determine that target sample event institute is right The common characteristic data and object event label data answered；Wherein, target sample event is from the sample thing under each event scenarios The sample event of the satisfaction setting rule filtered out in part.

In the affair character as corresponding to the event under different event scene, it is understood that there may be have identical feature, each Event can also have its own exclusive feature.For example, for payment class event, payment amount, the means of payment, less Age, gender etc. can all exist in the payment class event under each scene, and therefore, these features can be used as payment class event Common characteristic.

Specifically, needing to filter out the part for meeting setting rule from all sample events in above-mentioned steps 404 Sample event is as target sample event, then, determines based on affair character data corresponding to each target sample event Common characteristic data corresponding to target sample event.

In a specific embodiment, above-mentioned setting rule includes: risk sample event and non-risk sample event Ratio meets setting ratio.

That is the ratio of the event number of selected target sample event risk sample event and non-risk sample event Meet setting ratio.For example, in target sample event, the quantity of the quantity of risk sample event and non-risk sample event can be with For 1:2.Certainly, only exemplary illustration herein, does not constitute the restriction to this specification embodiment.

In the specific implementation, the risk sample in the target sample event filtered out can be aggregated to together, by non-wind Dangerous sample condenses together, the training for risk identification model.

Step 406, common characteristic data and object event label data according to corresponding to target sample event, training wind First risk identification module of dangerous identification model；And respectively in the affair character data according to corresponding to each event scenarios Characteristic feature data and event tag data, the second risk corresponding to each event scenarios is known in training risk identification model Other module.

Wherein, in above-mentioned steps 406, training risk identification model when, need training the first risk identification module and Second risk identification module, and the first risk identification module is based on characteristic common to the sample event under each event scenarios Training obtains, and the second risk identification module is then that characteristic feature data based on the sample event under each event scenarios are trained It arrives, wherein each event scenarios used in the second risk identification module of training are then each corresponding to sample event Event scenarios, or each event scenarios corresponding to target sample event can specifically be carried out according to practical application scene Selection, this specification embodiment are defined not to this.

Certainly, in this specification embodiment, above-mentioned first risk identification module and the second risk identification module can be GBDT model.It in that case, can be according to the conventional training method of GBDT model in the prior art to the first risk identification Module and the second risk identification module are trained, since this specification embodiment does not make the specific training process of model It improves, therefore, its training process that details are not described herein again.

It should be noted that in this specification embodiment, if the first risk identification module and the second risk identification mould Block uses GBDT model, and model over-fitting, the complexity of Controlling model can be added when carrying out model training in order to prevent Regular terms.In addition, the first risk identification module is dominated in training by the sample event of some event scenarios in order to prevent, When every wheel iteration starts to calculate residual error, it may be considered that contribution of each event scenarios to residual error, if some event scenarios Sample event (can be configured, for example, can set the contribution accounting of residual error beyond given threshold according to practical application scene It is set to 0.8 equal numerical value), iteration can be terminated in advance.

In addition, above-mentioned first risk identification module and the second risk identification module can adopt in this specification embodiment With linear logic regression model, if using linear logic regression model, then it can be according to the training of linear logic regression model Method is trained the first risk identification module and the second risk identification module, its specific training process that details are not described herein again.

In the specific implementation, in above-mentioned steps 406, respectively in the affair character data according to corresponding to each event scenarios Characteristic feature data and event tag data, the second risk corresponding to each event scenarios is known in training risk identification model Other module, can specifically be accomplished in that

Characteristic feature data and event tag data according to corresponding to each event scenarios respectively, to first risk Identification module optimizes, and obtains the second risk identification module corresponding to each event scenarios.

I.e. in the specific implementation, each thing can be based on the basis of the first risk identification module trained The characteristic feature data of corresponding sample event continue to train under part scene, so that each second risk identification module is obtained, from And obtain trained risk identification model.

Sample training method provided by this specification embodiment for ease of understanding, it is following will be based on 1 He of event scenarios For sample event under event scenarios 2, the sample training method of this specification embodiment offer is introduced.

Fig. 5 is the flow diagram for the sample training method that this specification embodiment provides, and Fig. 6 is the side corresponding to Fig. 5 Method flow chart, for flow diagram shown in fig. 5, method flow diagram shown in fig. 6 includes at least following steps:

Step 602, the affair character data and sample thing of event scenarios 1, sample event under event scenarios 2 are determined respectively Part label data respectively obtains sample data 2 corresponding to sample data 1, event scenarios 2 corresponding to event scenarios 1.

Wherein, above-mentioned sample data need include under the event scenarios affair character data corresponding to various kinds present event with And label data.

Step 604, the target sample event in sample drawn data 1 and sample data 2 and target sample event institute are right The common characteristic data answered.

Step 606, common characteristic data and target sample event, the first risk identification of training risk identification model are based on Module.

Step 608, according to sample data 1, sample data 2 and the first risk identification module, risk identification mould is respectively trained Each second risk identification module of type.

Wherein, the corresponding second risk identification module of event scenarios 1, corresponding second risk identification of event scenarios 2 Module.

The generation method for the risk identification model that this specification embodiment provides, based on sample event under each event scenarios First risk identification module of common characteristic data training risk identification model, and based on sample event institute under each event scenarios Second risk identification module of the characteristic feature data training risk identification model in corresponding affair character data, thus gained The risk identification module arrived includes the first risk identification module and multiple second risk identification modules；Make in this way, it is subsequent right When object event carries out risk identification, respectively according to object event and common characteristic common to the event under other event scenarios The first risk identification module that the general character based on the event under each event scenarios is trained in data and risk identification model To object event carry out risk identification, obtain the first risk identification as a result, and, the characteristic feature according to specific to object event Data and the second risk identification module corresponding with the affiliated event scenarios of object event carry out risk identification to object event, obtain Second risk identification is as a result, finally, carry out fusion treatment to the first risk identification result and the second risk identification result, with determination The risk identification result of risk identification is carried out to object event；In this specification embodiment, risk knowledge is being carried out to object event When other, common characteristic data and characteristic feature data according to corresponding to object event pass through different risk identification models respectively Risk identification is carried out to object event, is merged to risk identification result corresponding to different characteristic, so that it is determined that target The risk of event, so that risk identification ability is more excellent, and the accuracy of risk identification can be improved；In addition, due to each thing Event under part scene can input above-mentioned risk identification model and carry out risk identification, it can thus be avoided in each event The corresponding risk identification model of the event scenarios is disposed under scene, so as to reduce O&M cost.

Corresponding to the recognition methods for the risk case that this specification embodiment provides, it is based on identical thinking, this specification Embodiment additionally provides a kind of identification device of risk case, the knowledge of the risk case for executing the offer of this specification embodiment Other method, Fig. 7 is the module composition schematic diagram of the identification device for the risk case that this specification embodiment provides, shown in Fig. 7 Device, comprising:

First determining module 702, for determining the affair character data of object event；Wherein, above-mentioned affair character data Including object event with it is peculiar specific to common characteristic data common to the event under other event scenarios and object event Characteristic；

Risk identification module 704, for according to the first risk in common characteristic data and the risk identification model of training Identification module to object event carry out risk identification, obtain the first risk identification as a result, and, according to above-mentioned characteristic feature data With the second risk identification module corresponding with event scenarios belonging to object event in risk identification model to object event into Row risk identification obtains the second risk identification result；

Wherein, risk identification model include the first risk identification module and multiple second risk identification modules, each second Risk identification module corresponds to a kind of event scenarios；First common characteristic of the risk identification module based on the event under each event scenarios Data train to obtain；Second risk identification module is trained based on the characteristic feature data of the event under every kind of event scenarios It arrives；

Second determining module 706, for the first risk identification result and the second risk identification result to be carried out fusion treatment, To determine the risk identification result of object event.

Optionally, above-mentioned risk identification module 704, comprising:

First marking unit, is used for according to above-mentioned common characteristic data and the first risk identification module, to object event Degree of risk is given a mark, and the first score value corresponding to object event is obtained, as the first risk identification result；

Second marking unit, is used for according to above-mentioned characteristic feature data and the second risk identification module, to object event Degree of risk is given a mark, and the second score value corresponding to object event is obtained, as the second risk identification result.

Optionally, above-mentioned risk identification module 704, further includes:

Second determination unit, for determining event scenarios belonging to object event；

Third determination unit, for the event scenarios according to belonging to object event, include from risk identification model is more The second risk identification module for carrying out risk identification to object event is determined in a second risk identification module.

Optionally, above-mentioned second determining module 706, comprising:

Computing unit, for calculating the fusion score value of the first score value and the second score value；

First determination unit, the risk identification result for being determined as object event for score value will to be merged.

Optionally, above-mentioned computing unit, is specifically used for:

The fusion score value of the first score value and the second score value is calculated by following formula:

Wherein, in above-mentioned formula, x₁Indicate the first score value, x₂Indicate that the second score value, x indicate fusion score value.

The identification device of the risk case of this specification embodiment can also carry out the identification device of Fig. 1-Fig. 3 risk event The method of execution, and the identification device of risk case is realized in Fig. 1-embodiment illustrated in fig. 3 function, details are not described herein.

The identification device for the risk case that this specification embodiment provides, when carrying out risk identification to object event, point It is not based on according in object event and common characteristic data common to the event under other event scenarios and risk identification model The first risk identification module that the general character of event under each event scenarios is trained carries out risk identification to object event, obtains To the first risk identification as a result, and, the characteristic feature data according to specific to object event and with the affiliated event of object event The corresponding second risk identification module of scene carries out risk identification to object event, obtains the second risk identification as a result, finally, right First risk identification result and the second risk identification result carry out fusion treatment, carry out risk identification to object event to determine Risk identification result；It is right according to object event institute respectively when carrying out risk identification to object event in this specification embodiment The common characteristic data and characteristic feature data answered carry out risk identification to object event by different risk identification models, Risk identification result corresponding to different characteristic is merged, so that it is determined that the risk of object event, so that risk is known Other ability is more excellent, and the accuracy of risk identification can be improved；In addition, since the event under each event scenarios can input It states risk identification model and carries out risk identification, it can thus be avoided it is corresponding to dispose the event scenarios under each event scenarios Risk identification model, so as to reduce O&M cost.

Corresponding to the generation method for the risk identification model that this specification embodiment provides, it is based on identical thinking, this theory Bright book embodiment additionally provides a kind of generating means of risk identification model, for executing the risk of this specification embodiment offer The generation method of identification model, Fig. 8 are the module composition of the generating means for the risk identification model that this specification embodiment provides Schematic diagram, device shown in Fig. 8, comprising:

First determining module 802, for determine affair character data corresponding to the sample event under each event scenarios and Event tag data；Wherein, the event tag data are for characterizing whether the sample event is risk sample event；

Second determining module 804 is determined for the affair character data according to the sample event under each event scenarios Common characteristic data and object event label data corresponding to target sample event；Wherein, the target sample event be from The sample event of the satisfaction setting rule filtered out in sample event under each event scenarios；

Training module 806, for the common characteristic data according to corresponding to target sample event and the object event mark Sign data, the first risk identification module of the training risk identification model；And respectively according to corresponding to each event scenarios Affair character data in characteristic feature data and event tag data, each algebra of events in the training risk identification model Second risk identification module corresponding to scape.

Optionally, the setting rule includes: that the ratio of the risk sample event and non-risk sample event meets and sets Determine ratio.

Optionally, above-mentioned training module 806, is specifically used for:

The generating means for the risk identification model that this specification embodiment provides, based on sample event under each event scenarios First risk identification module of common characteristic data training risk identification model, and based on sample event institute under each event scenarios Second risk identification module of the characteristic feature data training risk identification model in corresponding affair character data, thus gained The risk identification module arrived includes the first risk identification module and multiple second risk identification modules；Make in this way, it is subsequent right When object event carries out risk identification, respectively according to object event and common characteristic common to the event under other event scenarios The first risk identification module that the general character based on the event under each event scenarios is trained in data and risk identification model To object event carry out risk identification, obtain the first risk identification as a result, and, the characteristic feature according to specific to object event Data and the second risk identification module corresponding with the affiliated event scenarios of object event carry out risk identification to object event, obtain Second risk identification is as a result, finally, carry out fusion treatment to the first risk identification result and the second risk identification result, with determination The risk identification result of risk identification is carried out to object event；In this specification embodiment, risk knowledge is being carried out to object event When other, common characteristic data and characteristic feature data according to corresponding to object event pass through different risk identification models respectively Risk identification is carried out to object event, is merged to risk identification result corresponding to different characteristic, so that it is determined that target The risk of event, so that risk identification ability is more excellent, and the accuracy of risk identification can be improved；In addition, due to each thing Event under part scene can input above-mentioned risk identification model and carry out risk identification, it can thus be avoided in each event The corresponding risk identification model of the event scenarios is disposed under scene, so as to reduce O&M cost.

Further, based on above-mentioned Fig. 1 to method shown in Fig. 3, this specification embodiment additionally provides a kind of risk thing The identification equipment of part, as shown in Figure 9.

The identification equipment of risk case can generate bigger difference because configuration or performance are different, may include one or More than one processor 901 and memory 902 can store one or more storages in memory 902 using journey Sequence or data.Wherein, memory 902 can be of short duration storage or persistent storage.The application program for being stored in memory 902 can be with Including one or more modules (diagram is not shown), each module may include one in the identification equipment to risk case Family computer executable instruction information.Further, processor 901 can be set to communicate with memory 902, in risk The series of computation machine executable instruction information in memory 902 is executed in the identification equipment of event.The identification of risk case is set Standby can also include one or more power supplys 903, one or more wired or wireless network interfaces 904, one or More than one input/output interface 905, one or more keyboards 906 etc..

In a specific embodiment, the identification equipment of risk case include memory and one or one with On program, perhaps more than one program is stored in memory and one or more than one program can wrap for one of them Include one or more modules, and each module may include that series of computation machine in identification equipment to risk case can Information is executed instruction, and is configured to execute this by one or more than one processor or more than one program includes For carrying out following computer executable instructions information:

Determine the affair character data of object event；Wherein, which includes object event and other events Characteristic feature data specific to common characteristic data and object event common to event under scene；

According to common characteristic data and training risk identification model in the first risk identification module to object event into Row risk identification, obtain the first risk identification as a result, and, according in above-mentioned characteristic feature data and risk identification model with mesh The corresponding second risk identification module of event scenarios belonging to mark event carries out risk identification to object event, obtains the second wind Dangerous recognition result；

First risk identification result and the second risk identification result are subjected to fusion treatment, to determine the risk of object event Recognition result.

Optionally, computer executable instructions information when executed, is known according to common characteristic data and the risk of training The first risk identification module objectives event in other model carries out risk identification, obtains the first risk identification result, comprising:

According to common characteristic data and the first risk identification module, gives a mark, obtain to the degree of risk of object event First score value corresponding to object event, as the first risk identification result；

According in characteristic feature data and risk identification model with object event belonging to event scenarios corresponding second Risk identification module carries out risk identification to object event, obtains the second risk identification result, comprising:

According to characteristic feature data and the second risk identification module, gives a mark, obtain to the degree of risk of object event Second score value corresponding to object event, as the second risk identification result.

Optionally, computer executable instructions information when executed, according to characteristic feature data and risk identification model In the second risk identification module corresponding with event scenarios belonging to object event to object event carry out risk identification, obtain Second risk identification result, further includes:

Determine event scenarios belonging to object event；

The event scenarios according to belonging to object event, the multiple second risk identification modules for including from risk identification model Middle determination is for carrying out the second risk identification module of risk identification to object event.

Optionally, when executed, the first risk identification result and the second risk are known for computer executable instructions information Other result carries out fusion treatment, to determine the risk identification result of object event, comprising:

Calculate the fusion score value of the first score value and the second score value；

Fusion score value is determined as to the risk identification result of object event.

Optionally, computer executable instructions information when executed, calculates the first score value and second by following formula The fusion score value of score value:

The identification equipment for the risk case that this specification embodiment provides, when carrying out risk identification to object event, point It is not based on according in object event and common characteristic data common to the event under other event scenarios and risk identification model The first risk identification module that the general character of event under each event scenarios is trained carries out risk identification to object event, obtains To the first risk identification as a result, and, the characteristic feature data according to specific to object event and with the affiliated event of object event The corresponding second risk identification module of scene carries out risk identification to object event, obtains the second risk identification as a result, finally, right First risk identification result and the second risk identification result carry out fusion treatment, carry out risk identification to object event to determine Risk identification result；It is right according to object event institute respectively when carrying out risk identification to object event in this specification embodiment The common characteristic data and characteristic feature data answered carry out risk identification to object event by different risk identification models, Risk identification result corresponding to different characteristic is merged, so that it is determined that the risk of object event, so that risk is known Other ability is more excellent, and the accuracy of risk identification can be improved；In addition, since the event under each event scenarios can input It states risk identification model and carries out risk identification, it can thus be avoided it is corresponding to dispose the event scenarios under each event scenarios Risk identification model, so as to reduce O&M cost.

Further, based on method shown in above-mentioned fig. 4 to fig. 6, this specification embodiment additionally provides a kind of risk knowledge The generating device of other model, the specific structure of risk identification model and the identification equipment of risk case are identical, can refer to Fig. 9 institute Show.

In a specific embodiment, the generating device of risk identification model includes memory and one or one A above program, perhaps more than one program is stored in memory and one or more than one program can for one of them To include one or more modules, and each module may include the series of computation in identification equipment to risk case Machine executable instruction information, and be configured to execute this or more than one program by one or more than one processor Comprising for carrying out following computer executable instructions information:

According to common characteristic data corresponding to the target sample event and the object event label data, training institute State the first risk identification module of risk identification model；And the affair character number according to corresponding to each event scenarios respectively Characteristic feature data and event tag data in, in the training risk identification model the corresponding to each event scenarios Two risk identification modules.

Optionally, when executed, the setting rule includes: the risk sample thing to computer executable instructions information The ratio of part and non-risk sample event meets setting ratio.

Optionally, computer executable instructions information is when executed, described respectively according to corresponding to each event scenarios Affair character data in characteristic feature data and event tag data, each algebra of events in the training risk identification model Second risk identification module corresponding to scape, comprising:

The generating device for the risk identification model that this specification embodiment provides, based on sample event under each event scenarios First risk identification module of common characteristic data training risk identification model, and based on sample event institute under each event scenarios Second risk identification module of corresponding affair character data training risk identification model, thus obtained risk identification module Including the first risk identification module and multiple second risk identification modules；Make in this way, it is subsequent that risk is being carried out to object event When identification, respectively according to object event and common characteristic data and risk identification mould common to the event under other event scenarios The first risk identification module that general character based on the event under each event scenarios in type is trained carries out wind to object event Danger identification, obtain the first risk identification as a result, and, characteristic feature data and and object event according to specific to object event The corresponding second risk identification module of affiliated event scenarios carries out risk identification to object event, obtains the second risk identification knot Fruit determines finally, carrying out fusion treatment to the first risk identification result and the second risk identification result and carries out wind to object event The risk identification result nearly identified；In this specification embodiment, when carrying out risk identification to object event, respectively according to target Common characteristic data and characteristic feature data corresponding to event carry out wind to object event by different risk identification models Danger identification, is merged to risk identification result corresponding to different characteristic, so that it is determined that the risk of object event, makes in this way It is more excellent to obtain risk identification ability, the accuracy of risk identification can be improved；In addition, due to the event under each event scenarios Risk identification is carried out to input above-mentioned risk identification model, it can thus be avoided disposing the algebra of events under each event scenarios The corresponding risk identification model of scape, so as to reduce O&M cost.

Further, based on above-mentioned Fig. 1 to method shown in Fig. 3, this specification embodiment additionally provides a kind of storage Jie Matter, for storing computer executable instructions information, in a kind of specific embodiment, the storage medium can for USB flash disk, CD, Hard disk etc., the computer executable instructions information of storage medium storage are able to achieve following below scheme when being executed by processor:

Optionally, the computer executable instructions information of storage medium storage is when being executed by processor, according to shared The first risk identification module in characteristic and the risk identification model of training carries out risk identification to object event, obtains the One risk identification result, comprising:

Optionally, the computer executable instructions information of storage medium storage is when being executed by processor, according to peculiar The second risk identification module corresponding with event scenarios belonging to object event is to mesh in characteristic and risk identification model Mark event carries out risk identification, obtains the second risk identification result, further includes:

Determine event scenarios belonging to object event；

Optionally, the computer executable instructions information of storage medium storage is when being executed by processor, by the first wind Dangerous recognition result and the second risk identification result carry out fusion treatment, to determine the risk identification result of object event, comprising:

Optionally, the computer executable instructions information of storage medium storage is when being executed by processor, by as follows The fusion score value of formula calculating the first score value and the second score value:

The computer executable instructions information for the storage medium storage that this specification embodiment provides is held by processor When row, when carrying out risk identification to object event, respectively according to common to the event under object event and other event scenarios Common characteristic data and risk identification model in the first wind for training of the general character based on the event under each event scenarios Dangerous identification module to object event carry out risk identification, obtain the first risk identification as a result, and, according to object event institute it is peculiar Characteristic feature data and the second risk identification module corresponding with the affiliated event scenarios of object event to object event carry out wind Danger identification, obtains the second risk identification as a result, finally, merging to the first risk identification result and the second risk identification result Processing determines the risk identification result that risk identification is carried out to object event；In this specification embodiment, to object event into When row risk identification, common characteristic data and characteristic feature data according to corresponding to object event pass through different risks respectively Identification model carries out risk identification to object event, merges to risk identification result corresponding to different characteristic, thus Determine the risk of object event, so that risk identification ability is more excellent, and the accuracy of risk identification can be improved；In addition, by Event under each event scenarios can input above-mentioned risk identification model and carry out risk identification, it can thus be avoided The corresponding risk identification model of the event scenarios is disposed under each event scenarios, so as to reduce O&M cost.

Further, based on method shown in above-mentioned fig. 4 to fig. 6, this specification embodiment additionally provides a kind of storage Jie Matter, for storing computer executable instructions information, in a kind of specific embodiment, the storage medium can for USB flash disk, CD, Hard disk etc., the computer executable instructions information of storage medium storage are able to achieve following below scheme when being executed by processor:

Optionally, the computer executable instructions information of storage medium storage is when being executed by processor, the setting Rule includes: the ratio satisfaction setting ratio of the risk sample event and non-risk sample event.

Optionally, the computer executable instructions information of storage medium storage is when being executed by processor, the difference According to the characteristic feature data and event tag data in affair character data corresponding to each event scenarios, the training wind Second risk identification module corresponding to each event scenarios in dangerous identification model, comprising:

The computer executable instructions information for the storage medium storage that this specification embodiment provides is being executed by processor When, the first risk identification module of risk identification model is trained based on the common characteristic data of sample event under each event scenarios, And the second risk based on the training risk identification model of affair character data corresponding to sample event under each event scenarios is known Other module, so that obtained risk identification module includes the first risk identification module and multiple second risk identification modules；This Sample makes, subsequent when carrying out risk identification to object event, respectively according to the event under object event and other event scenarios The general character based on the event under each event scenarios is trained in common common characteristic data and risk identification model First risk identification module to object event carry out risk identification, obtain the first risk identification as a result, and, according to object event Specific characteristic feature data and the second risk identification module corresponding with the affiliated event scenarios of object event are to object event Carry out risk identification, obtain the second risk identification as a result, finally, to the first risk identification result and the second risk identification result into Row fusion treatment determines the risk identification result that risk identification is carried out to object event；In this specification embodiment, to target When event carries out risk identification, common characteristic data and characteristic feature data according to corresponding to object event pass through difference respectively Risk identification model to object event carry out risk identification, melt to risk identification result corresponding to different characteristic It closes, so that it is determined that the risk of object event, so that risk identification ability is more excellent, and the accuracy of risk identification can be improved； In addition, carry out risk identification since the event under each event scenarios can input above-mentioned risk identification model, it can be with It avoids disposing the corresponding risk identification model of the event scenarios under each event scenarios, so as to reduce O&M cost.

In the 1990s, the improvement of a technology can be distinguished clearly be on hardware improvement (for example, Improvement to circuit structures such as diode, transistor, switches) or software on improvement (improvement for method flow).So And with the development of technology, the improvement of current many method flows can be considered as directly improving for hardware circuit. Designer nearly all obtains corresponding hardware circuit by the way that improved method flow to be programmed into hardware circuit.Cause This, it cannot be said that the improvement of a method flow cannot be realized with hardware entities module.For example, programmable logic device (Programmable Logic Device, PLD) (such as field programmable gate array (Field Programmable Gate Array, FPGA)) it is exactly such a integrated circuit, logic function determines device programming by user.By designer Voluntarily programming comes a digital display circuit " integrated " on a piece of PLD, designs and makes without asking chip maker Dedicated IC chip.Moreover, nowadays, substitution manually makes IC chip, this programming is also used instead mostly " is patrolled Volume compiler (logic compiler) " software realizes that software compiler used is similar when it writes with program development, And the source code before compiling also write by handy specific programming language, this is referred to as hardware description language (Hardware Description Language, HDL), and HDL is also not only a kind of, but there are many kind, such as ABEL (Advanced Boolean Expression Language)、AHDL(Altera Hardware Description Language)、Confluence、CUPL(Cornell University Programming Language)、HDCal、JHDL (Java Hardware Description Language)、Lava、Lola、MyHDL、PALASM、RHDL(Ruby Hardware Description Language) etc., VHDL (Very-High-Speed is most generally used at present Integrated Circuit Hardware Description Language) and Verilog.Those skilled in the art also answer This understands, it is only necessary to method flow slightly programming in logic and is programmed into integrated circuit with above-mentioned several hardware description languages, The hardware circuit for realizing the logical method process can be readily available.

Controller can be implemented in any suitable manner, for example, controller can take such as microprocessor or processing The computer for the computer readable program code (such as software or firmware) that device and storage can be executed by (micro-) processor can Read medium, logic gate, switch, specific integrated circuit (Application Specific Integrated Circuit, ASIC), the form of programmable logic controller (PLC) and insertion microcontroller, the example of controller includes but is not limited to following microcontroller Device: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20 and Silicone Labs C8051F320 are deposited Memory controller is also implemented as a part of the control logic of memory.It is also known in the art that in addition to Pure computer readable program code mode is realized other than controller, can be made completely by the way that method and step is carried out programming in logic Controller is obtained to come in fact in the form of logic gate, switch, specific integrated circuit, programmable logic controller (PLC) and insertion microcontroller etc. Existing identical function.Therefore this controller is considered a kind of hardware component, and to including for realizing various in it The device of function can also be considered as the structure in hardware component.Or even, it can will be regarded for realizing the device of various functions For either the software module of implementation method can be the structure in hardware component again.

System, device, module or the unit that above-described embodiment illustrates can specifically realize by computer chip or entity, Or it is realized by the product with certain function.It is a kind of typically to realize that equipment is computer.Specifically, computer for example may be used Think personal computer, laptop computer, cellular phone, camera phone, smart phone, personal digital assistant, media play It is any in device, navigation equipment, electronic mail equipment, game console, tablet computer, wearable device or these equipment The combination of equipment.

For convenience of description, it is divided into various units when description apparatus above with function to describe respectively.Certainly, implementing this The function of each unit can be realized in the same or multiple software and or hardware when application.

It should be understood by those skilled in the art that, embodiments herein can provide as method, system or computer program Product.Therefore, complete hardware embodiment, complete software embodiment or reality combining software and hardware aspects can be used in the application Apply the form of example.Moreover, it wherein includes the computer of computer usable program code that the application, which can be used in one or more, The computer program implemented in usable storage medium (including but not limited to magnetic disk storage, CD-ROM, optical memory etc.) produces The form of product.

The application is reference according to the method for this specification embodiment, the stream of equipment (system) and computer program product Journey figure and/or block diagram describe.It should be understood that can be by computer program instructions information realization flowchart and/or the block diagram The combination of process and/or box in each flow and/or block and flowchart and/or the block diagram.It can provide these calculating Machine program instruction information is to general purpose computer, special purpose computer, Embedded Processor or other programmable data processing devices Processor is to generate a machine, so that the instruction executed by computer or the processor of other programmable data processing devices Information generates specifies for realizing in one or more flows of the flowchart and/or one or more blocks of the block diagram Function device.

These computer program instructions information, which may also be stored in, is able to guide computer or other programmable data processing devices In computer-readable memory operate in a specific manner, so that command information stored in the computer readable memory produces Raw includes the manufacture of command information device, the command information device realize in one or more flows of the flowchart and/or The function of being specified in one or more blocks of the block diagram.

These computer program instructions information also can be loaded onto a computer or other programmable data processing device, so that Series of operation steps are executed on a computer or other programmable device to generate computer implemented processing, thus calculating The command information that is executed on machine or other programmable devices provide for realizing in one or more flows of the flowchart and/or The step of function of being specified in one or more blocks of the block diagram.

In a typical configuration, calculating equipment includes one or more processors (CPU), input/output interface, net Network interface and memory.

Memory may include the non-volatile memory in computer-readable medium, random access memory (RAM) and/or The forms such as Nonvolatile memory, such as read-only memory (ROM) or flash memory (flash RAM).Memory is computer-readable medium Example.

Computer-readable medium includes permanent and non-permanent, removable and non-removable media can be by any method Or technology come realize information store.Information can be computer-readable instruction information, data structure, the module of program or other numbers According to.The example of the storage medium of computer includes, but are not limited to phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other kinds of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory techniques, CD-ROM are read-only Memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, tape magnetic disk storage or Other magnetic storage devices or any other non-transmission medium, can be used for storage can be accessed by a computing device information.According to Herein defines, and computer-readable medium does not include temporary computer readable media (transitory media), such as modulation Data-signal and carrier wave.

It should also be noted that, the terms "include", "comprise" or its any other variant are intended to nonexcludability It include so that the process, method, commodity or the equipment that include a series of elements not only include those elements, but also to wrap Include other elements that are not explicitly listed, or further include for this process, method, commodity or equipment intrinsic want Element.In the absence of more restrictions, the element limited by sentence "including a ...", it is not excluded that including described want There is also other identical elements in the process, method of element, commodity or equipment.

It will be understood by those skilled in the art that embodiments herein can provide as method, system or computer program product. Therefore, complete hardware embodiment, complete software embodiment or embodiment combining software and hardware aspects can be used in the application Form.It is deposited moreover, the application can be used to can be used in the computer that one or more wherein includes computer usable program code The shape for the computer program product implemented on storage media (including but not limited to magnetic disk storage, CD-ROM, optical memory etc.) Formula.

The application can computer executable instructions information it is general up and down described in the text, such as Program module.Generally, program module include routines performing specific tasks or implementing specific abstract data types, it is program, right As, component, data structure etc..The application can also be practiced in a distributed computing environment, in these distributed computing environment In, by executing task by the connected remote processing devices of communication network.In a distributed computing environment, program module It can be located in the local and remote computer storage media including storage equipment.

All the embodiments in this specification are described in a progressive manner, same and similar portion between each embodiment Dividing may refer to each other, and each embodiment focuses on the differences from other embodiments.Especially for system reality For applying example, since it is substantially similar to the method embodiment, so being described relatively simple, related place is referring to embodiment of the method Part explanation.

The above description is only an example of the present application, is not intended to limit this application.For those skilled in the art For, various changes and changes are possible in this application.All any modifications made within the spirit and principles of the present application are equal Replacement, improvement etc., should be included within the scope of the claims of this application.

Claims

1. a kind of recognition methods of risk case, which comprises

Determine the affair character data of object event；Wherein, the affair character data include the object event and other things Characteristic feature data specific to common characteristic data and the object event common to event under part scene；

According to the first risk identification module in the common characteristic data and the risk identification model of training to the target thing Part carry out risk identification, obtain the first risk identification as a result, and, according to the characteristic feature data and the risk identification mould The second risk identification module corresponding with event scenarios belonging to the object event carries out wind to the object event in type Danger identification, obtains the second risk identification result；

Wherein, the risk identification model includes the first risk identification module and multiple second risk identification modules, each described Second risk identification module corresponds to a kind of event scenarios；The first risk identification module is based on the event under each event scenarios Common characteristic data train to obtain；The characteristic feature of the second risk identification module based on the event under every kind of event scenarios Data train to obtain；

The first risk identification result and the second risk identification result are subjected to fusion treatment, with the determination target thing The risk identification result of part.

2. the method as described in claim 1, described according in the common characteristic data and the risk identification model of training First risk identification module carries out risk identification to the object event, obtains the first risk identification result, comprising:

According to the common characteristic data and the first risk identification module, the degree of risk of the object event is beaten Point, the first score value corresponding to the object event is obtained, as the first risk identification result；

It is described according in the characteristic feature data and the risk identification model with event scenarios belonging to the object event Corresponding second risk identification module carries out risk identification to the object event, obtains the second risk identification result, comprising:

According to the characteristic feature data and the second risk identification module, the degree of risk of the object event is beaten Point, the second score value corresponding to the object event is obtained, as the second risk identification result.

3. method according to claim 1 or 2, it is described according in the characteristic feature data and the risk identification model with The corresponding second risk identification module of event scenarios belonging to the object event carries out risk identification to the object event, Obtain the second risk identification result, further includes:

Determine event scenarios belonging to the object event；

According to event scenarios belonging to the object event, multiple second risk identifications for including from the risk identification model The second risk identification module for carrying out risk identification to the object event is determined in module.

4. method according to claim 2, described by the first risk identification result and the second risk identification result Fusion treatment is carried out, with the risk identification result of the determination object event, comprising:

Calculate the fusion score value of first score value and second score value；

The fusion score value is determined as to the risk identification result of the object event.

5. method as claimed in claim 4 calculates the fusion of first score value and second score value by following formula Score value:

Wherein, in above-mentioned formula, x₁Indicate first score value, x₂Indicate that second score value, x indicate the fusion score value.

6. a kind of generation method of risk identification model, which comprises

Determine affair character data corresponding to the sample event under each event scenarios and event tag data；Wherein, the thing Part label data is for characterizing whether the sample event is risk sample event；

According to the affair character data of the sample event under each event scenarios, determines and shared corresponding to target sample event Characteristic and object event label data；Wherein, the target sample event is from the sample event under each event scenarios The sample event of the satisfaction setting rule filtered out；

According to common characteristic data corresponding to the target sample event and the object event label data, training risk is known First risk identification module of other model；And the spy in the affair character data according to corresponding to each event scenarios respectively There are characteristic and the event tag data, the second wind corresponding to each event scenarios in the training risk identification model Dangerous identification module.

7. method as claimed in claim 6, the setting rule includes: the risk sample event and non-risk sample event Ratio meet setting ratio.

8. method according to claim 6 or 7, in the affair character data according to corresponding to each event scenarios respectively Characteristic feature data and the event tag data, in the training risk identification model the corresponding to each event scenarios Two risk identification modules, comprising:

9. a kind of identification device of risk case, described device include:

First determining module, for determining the affair character data of object event；Wherein, the affair character data include described Object event with it is peculiar specific to common characteristic data common to the event under other event scenarios and the object event Characteristic；

Risk identification module, for according to the first risk identification in the common characteristic data and the risk identification model of training Module to the object event carry out risk identification, obtain the first risk identification as a result, and, according to the characteristic feature data With the second risk identification module corresponding with event scenarios belonging to the object event in the risk identification model to institute It states object event and carries out risk identification, obtain the second risk identification result；

Second determining module, for carrying out the first risk identification result and the second risk identification result at fusion Reason, with the risk identification result of the determination object event.

10. device as claimed in claim 9, the risk identification module, comprising:

First marking unit, is used for according to the common characteristic data and the first risk identification module, to the target thing The degree of risk of part is given a mark, and the first score value corresponding to the object event is obtained, as the first risk identification knot Fruit；

Second marking unit, is used for according to the characteristic feature data and the second risk identification module, to the target thing The degree of risk of part is given a mark, and the second score value corresponding to the object event is obtained, as the second risk identification knot Fruit.

11. device as claimed in claim 10, second determining module, comprising:

Computing unit, for calculating the fusion score value of first score value and second score value；

First determination unit, for the fusion score value to be determined as to the risk identification result of the object event.

12. device as claimed in claim 11, the computing unit, are specifically used for:

The fusion score value of first score value and second score value is calculated by following formula:

13. a kind of generating means of risk identification model, described device include:

First determining module, for determining affair character data and event tag corresponding to the sample event under each event scenarios Data；Wherein, the event tag data are for characterizing whether the sample event is risk sample event；

Second determining module determines target sample for the affair character data according to the sample event under each event scenarios Common characteristic data and object event label data corresponding to present event；Wherein, the target sample event is from each event The sample event of the satisfaction setting rule filtered out in sample event under scene；

Training module, for the common characteristic data according to corresponding to the target sample event and the object event number of tags According to the first risk identification module of training risk identification model；And the event according to corresponding to each event scenarios is special respectively Levy the characteristic feature data and the event tag data in data, each event scenarios institute in the training risk identification model Corresponding second risk identification module.

14. a kind of identification equipment of risk case, comprising:

Processor；And

It is arranged to the memory of storage computer executable instructions, the executable instruction makes the processing when executed Device:

15. a kind of generating device of risk identification model, comprising:

Processor；And

16. a kind of storage medium, for storing computer executable instructions, the executable instruction is realized following when executed Process:

17. a kind of storage medium, for storing computer executable instructions, the executable instruction is realized following when executed Process: