CN110399705A - Judge the method, apparatus, equipment and storage medium of fraudulent user - Google Patents
Judge the method, apparatus, equipment and storage medium of fraudulent user Download PDFInfo
- Publication number
- CN110399705A CN110399705A CN201910594702.XA CN201910594702A CN110399705A CN 110399705 A CN110399705 A CN 110399705A CN 201910594702 A CN201910594702 A CN 201910594702A CN 110399705 A CN110399705 A CN 110399705A
- Authority
- CN
- China
- Prior art keywords
- user
- feature
- timing
- index
- browsing
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/45—Structures or tools for the administration of authentication
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/049—Temporal neural networks, e.g. delay elements, oscillating neurons or pulsed inputs
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Computer Security & Cryptography (AREA)
- Software Systems (AREA)
- General Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Health & Medical Sciences (AREA)
- Biomedical Technology (AREA)
- Evolutionary Computation (AREA)
- Computational Linguistics (AREA)
- Molecular Biology (AREA)
- Computing Systems (AREA)
- Biophysics (AREA)
- Data Mining & Analysis (AREA)
- Mathematical Physics (AREA)
- Artificial Intelligence (AREA)
- Life Sciences & Earth Sciences (AREA)
- Health & Medical Sciences (AREA)
- Computer Hardware Design (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
A kind of method, apparatus, equipment and storage medium judging fraudulent user, the method for judging fraudulent user includes: construction feature matrix, eigenmatrix includes timing category feature, timing category feature is feature relevant to fraudulent user, and timing category feature is extracted based on the collected data of an operation are buried；The timing neural network based on attention mechanism is built, eigenmatrix is input to timing neural network, and using the weight of each timing category feature of attention mechanism training, to define fraudulent user；The data of user to be tested are input to be completed it is trained, judge whether user to be tested is fraudulent user based on the timing neural network of attention mechanism.Technical solution of the present invention can be relatively accurate and judges fraudulent user in time.
Description
Technical field
The present invention relates to internet financial technology fields, more particularly to judge the method, apparatus of fraudulent user, equipment and
Storage medium.
Background technique
With the development of internet finance, diversification, such as fishing website, trojan horse, puppet is presented in financial fraud means
Base station etc..Currently, internet financial field uses kinds of risks preventing control method, for example, killing at the user terminal that timely updates
Malicious software is with checking and killing Trojan virus；Authentication is carried out to user by means such as real-name management, recognition of face, fingerprint recognitions；
Real-time guard is carried out to account by digital certificate and dynamic password.
But existing risk prevention system method is still difficult to the various financial fraud users for judging to emerge one after another.
Summary of the invention
The technical issues of embodiment of the present invention solves is how effectively to judge fraudulent user.
In order to solve the above technical problems, the embodiment of the present invention provides a kind of method for judging fraudulent user, this method comprises:
Construction feature matrix, eigenmatrix include timing category feature, and timing category feature is feature relevant to fraudulent user, and timing class is special
Sign is extracted based on the collected data of an operation are buried；The timing neural network based on attention mechanism is built, by feature square
Battle array is input to timing neural network, and using the weight of each timing category feature of attention mechanism training, to define
Fraudulent user；The data of user to be tested are input to, timing neural network trained, based on attention mechanism is completed
To judge whether user to be tested is fraudulent user.
Optionally, timing category feature include operating characteristics and browsing feature at least one of, operating characteristics be and input
The relevant feature of operational order, operating characteristics include click help button number, input text box needed for duration, browsing
Feature is feature relevant to page browsing, and browsing feature includes the number for browsing rate related pages, browsing rate related pages
The duration in face, the number for browsing loaning bill related pages, the duration for browsing loaning bill related pages.
Optionally, timing category feature includes at least one in user information feature, position feature and equipment feature, user
Information characteristics include that whether user appears in reference information blacklist library, whether user occurs in Crime Information database, position
Whether the geographical location of the change frequency, user of setting the IP address that feature includes user terminal appear in black address base, user
Whether cell room rate abnormal, whether the IP address of user terminal corresponding with the geographical location of user, equipment feature includes user
Whether terminal issues whether abnormal data packet, user terminal use proxy server.
Optionally, operation is buried to include classification indicators, determine event, bury a little and collect data, classification indicators be classification and
The associated index of timing category feature, determine event be based on preset parameter determine triggering with the associated event of index, bury a little with
Collecting data is by burying a setting event and collecting the data with event correlation based on event.
Optionally, classification and the associated index of timing category feature include sort operation index, browse index, user information and refer to
Mark, positioning index and equipment index, operation index be with the associated index of operating characteristics, browsing index is the finger with browsing feature
Mark, user information index are the index with user information feature association, and positioning index is and the associated index of position feature, equipment
Index is the index with equipment feature association.
Optionally, preset parameter is selected from one or more of following item: clicking help within preset first period
Duration needed for the number of button, input text box is the multiple, clear within preset second period of duration needed for normal input
Look at rate related pages number, browse rate related pages duration be normal browsing needed for duration multiple, preset
The number that loaning bill related pages are browsed in the third period, the duration for browsing loaning bill related pages are times of duration needed for normal browsing
Number, whether user appears in reference information blacklist library, whether user occurs in Crime Information database, the preset 4th
The change frequency of user terminal IP address in period, user geographical location whether appear in black address base, the cell of user
Whether whether, user terminal corresponding with the geographical location of user issues abnormal number to whether abnormal, user terminal the IP address of room rate
Whether proxy server is used according to packet, user terminal.
The embodiment of the present invention also provides a kind of device for judging fraudulent user, comprising: constructing module is suitable for construction feature
Matrix, eigenmatrix include timing category feature, and timing category feature is feature relevant to fraudulent user, and timing category feature is based on burying
Point operates collected data to extract；It builds and training module, is suitable for building the timing class nerve based on attention mechanism
Eigenmatrix is input to timing neural network by network, and using the power of each timing category feature of attention mechanism training
Weight, to define fraudulent user；Judgment module is suitable for for the data of user to be tested being input to that trained, base is completed
Judge whether the user to be tested is fraudulent user in the timing neural network of attention mechanism.
Optionally, the device of the judgement fraudulent user include bury point module, bury point module include classification indicators submodule, really
Determine event submodule, bury a little and collect data submodule, classification indicators submodule is suitable for classification and the associated finger of timing category feature
Mark determines that event submodule is suitable for determining triggering and the associated event of index based on preset parameter, buries a little and collect data
Module is suitable for by burying a setting event and being collected the data with event correlation based on event.
The embodiment of the present invention also provides a kind of equipment for judging fraudulent user, including memory and processor, on memory
It is stored with the computer instruction that can be run on a processor, processor executes above-mentioned judgement fraudulent user when running computer instruction
The step of method.
The embodiment of the present invention also provides a kind of storage medium, computer instruction is stored thereon with, when computer instruction is run
The step of executing above-mentioned judgement fraudulent user method.
Compared with prior art, the technical solution of the embodiment of the present invention has the advantages that
Construction and the closely related timing category feature of fraudulent user, build the timing class nerve net based on attention mechanism
Network, and from time dimension and characteristic dimension training these timing category features, so as to by be completed it is trained, based on note
The timing neural network of meaning power mechanism comes relatively accurate and judges whether user to be tested is fraudulent user in time.For example,
These timing category features of training, so that some features closer on time dimension have higher weight, in characteristic dimension
Specific some features (such as the operating characteristics for the number for clicking help button) have higher weight, so that the timing class mind
It can more accurately judge whether user to be tested is fraudulent user through network.
Detailed description of the invention
Fig. 1 is a kind of flow chart for judging fraudulent user method in the embodiment of the present invention；
Fig. 2 is the schematic diagram of eigenmatrix in the embodiment of the present invention；
Fig. 3 is the schematic diagram of the timing neural network in the embodiment of the present invention based on attention mechanism；
Fig. 4 is a kind of structural schematic diagram for judging fraudulent user device in the embodiment of the present invention；
Fig. 5 is the structural schematic diagram that point module is buried in the embodiment of the present invention.
Specific embodiment
With the development of information technology, various financial fraud means also emerge one after another, this is constantly proposed newly for risk prevention system
Challenge；Wherein, the scene of financial fraud is related to network marketing, Mobile banking, the consumer finance, network loan, network payment etc..
A kind of means to cope with challenges be user behavior data tracking (User Behavior Tracking, referred to as
UBT).UBT the relevant technologies can recorde user's data relevant to APP (application software) at mobile terminal (such as mobile phone),
Also data relevant to browser software at fixed terminal (such as computer) be can recorde.But UBT the amount of data recorded is non-
Chang great, shows as that data content is mixed and disorderly and noise is more, data dimension is high and very sparse, this makes the difficulty of data mining
It is bigger.
Another means to cope with challenges are to build timing neural network.Timing neural network includes circulation nerve net
Network (Recurrent Neural Network, referred to as RNN), RNN include shot and long term memory (Long Short Term
Memory, referred to as LSTM) network and gating cycle unit (Gated Recurrent Unit, referred to as GRU)；These timing
Neural network can obtain specific operation behavior.But in face of the record data of magnanimity, it is difficult to construct the feature square of fining
Battle array.
The prior art does not consider that arriving above-mentioned technical problem relevant to UBT and timing neural network.And the present invention recognizes
Know, solving these problems, which will be helpful to, more accurately judges fraudulent user；Also, the embodiment provides corresponding skills
Art scheme.
Specifically, the embodiment of the present invention construction and the closely related timing category feature of fraudulent user, these timing classes
The weight of feature can train so that timing category feature more focuses, such as in focus on time closer some features,
Or history judges the more effectively some features of effect.
It is understandable to enable the above-mentioned purpose, feature and beneficial effect of the embodiment of the present invention to become apparent, below with reference to attached
Figure is described in detail specific embodiments of the present invention.
Fig. 1 is a kind of flow chart for judging fraudulent user method 100 in the embodiment of the present invention.The flow chart includes following step
Suddenly.
Step S110: construction feature matrix, this feature matrix include timing category feature, and timing category feature is and fraudulent user
Relevant feature, timing category feature are extracted based on the collected data of an operation are buried.
Step S120: building the timing neural network based on attention mechanism, and eigenmatrix is input to timing class mind
Through network, and using the weight of each timing category feature of attention mechanism training, to define fraudulent user；
Step S130: the data of user to be tested are input to, timing class trained, based on attention mechanism is completed
Neural network judges whether user to be tested is fraudulent user.
In the execution of step S110, construction includes the eigenmatrix of timing category feature, which is and fraud
The relevant feature of user.
As shown in Fig. 2, eigenmatrix 200 includes time dimension W and characteristic dimension X, wherein W=[W1, W2, W3 ...,
Wm], m is the number of time slice, and X=[X1, X2, X3 ..., Xn], n are the number of the feature counted.In eigenmatrix 200
In, feature Xj (wherein, j is 1 to any integer between n) is related to time series, and therefore, it is special that this feature Xj is known as timing class
Sign；The element of eigenmatrix indicates (wherein, i is 1 to any integer between m, and j is 1 to any integer between n) by Aij.
The embodiment of the present invention carries out quantitative analysis to the scene of financial fraud.Specifically, timing category feature is classified
At operating characteristics, browsing feature, user information feature, position feature and equipment feature etc., and further these are classified
Timing category feature decompose, construct the specific timing category feature closely related with fraudulent user；Also, this is obtained by training
The weight distribution of a little timing category features, so that having completed trained, based on attention mechanism timing neural network
Can the data based on user to be tested and effectively and in time judge whether user to be tested is fraudulent user.
In specific implementation, timing category feature includes at least one in operating characteristics and browsing feature, and operating characteristics are
Feature relevant to the operational order of input, when operating characteristics include needed for the number for clicking help button, input text box
Long, browsing feature is feature relevant to page browsing, and browsing feature includes the number for browsing rate related pages, browsing rate
The duration of related pages, the number for browsing loaning bill related pages, the duration for browsing loaning bill related pages.
In specific implementation, timing category feature further include in user information feature, position feature and equipment feature at least
One, user information feature includes that whether user appears in reference information blacklist library, whether user Crime Information number occurs
According in library, position feature includes the geographical position of the change frequency of address IP (Internet Protocol) of user terminal, user
Set whether (geographical location can be positioned by positioning systems such as GPS (Global Position System)) appears in unregistered land
In the library of location, whether the room rate of user's cell (cell can be positioned by positioning systems such as GPS) abnormal, IP of user terminal
Whether location is corresponding with the geographical location of user, and equipment feature includes that whether user terminal issues abnormal data packet, user terminal is
It is no to use proxy server.
The embodiment of the present invention extracts timing category feature based on the collected data of an operation are buried.
In specific implementation, an operation is buried to include classification indicators, determine event, bury a little and collect data.
Classification indicators classification indicators, the index of the classification and timing of classification for scene and theme based on financial fraud
Category feature association, the index of the classification include operation index, browsing index, user information index, positioning index and equipment index；
And can be by the index decomposition of classification to the specific targets that can be implemented, the specific targets of the decomposition and specific timing class are special
Sign association, the specific targets of the decomposition include: duration, browsing rate needed for clicking the number of help button, input text box
The number of related pages, the duration for browsing rate related pages, the number for browsing loaning bill related pages, browsing loaning bill related pages
Duration, whether user appears in reference information blacklist library, whether user occurs in Crime Information database, user terminal
The change frequency of IP address, whether the geographical location of user appears in black address base, whether the cell room rate of user abnormal,
Whether whether, user terminal corresponding with the geographical location of user issues abnormal data packet, user terminal to the IP address of user terminal
Whether proxy server is used.
Determine that event is to determine trigger event based on preset parameter, which is associated with above-mentioned specific targets.Wherein, in advance
If parameter include: that the number of help button is clicked within preset first period, i.e., frequently click help whithin a period of time
Button then belongs to fraudulent user or the probability of fraud is higher, and in one embodiment, parameter value was the first period for partly
A hour, number be three times, in another embodiment, parameter value be a hour, number the first period be five times, again
In one embodiment, parameter value be one day the first period, number is eight times；Duration needed for inputting text box is normal input
The multiple of required duration, i.e., whithin a period of time input text box time too short then user behavior may for duplication and paste,
Too long, user behavior may be usurped for account, and the probability for being consequently belonging to fraudulent user or fraud is higher, at one
In embodiment, parameter value is three times that duration needed for inputting text box is duration needed for normal input, in another embodiment
In, parameter value is five times that duration needed for inputting text box is duration needed for normal input, In yet another embodiment, parameter
Value is 1/5th times that duration needed for inputting text box is duration needed for normal input；It is browsed within preset second period
The number of rate related pages, i.e., frequently browsing rate related pages then belong to fraudulent user or fraud row whithin a period of time
For probability it is higher, in one embodiment, parameter value be the second period be half an hour, number be three times, in another reality
Apply in example, parameter value be a hour, number the second period be five times, In yet another embodiment, when parameter value is second
Duan Weiyi days, number be eight times；The duration for browsing rate related pages is the multiple of duration needed for normal browsing, i.e. browsing rate
The duration of related pages is too long, and the probability for belonging to fraudulent user or fraud is higher, and in one embodiment, browsing is taken
The duration of rate related pages is three times of duration needed for normal browsing, in another embodiment, browsing rate related pages
Duration is five times of duration needed for normal browsing；The number that loaning bill related pages are browsed within the preset third period, i.e., one
Frequently browse that loaning bill related pages then belong to fraudulent user or the probability of fraud is higher in the section time, in one embodiment
In, parameter value is to be half an hour, number the third period for three times, in another embodiment, parameter value is the third period to be
One hour, number are five times, In yet another embodiment, parameter value be one day the third period, number is eight times；Browsing is borrowed
The duration of money related pages is the multiple of duration needed for normal browsing, i.e. the duration of browsing loaning bill related pages is too long, belongs to and takes advantage of
The probability for cheating user or fraud is higher, and in one embodiment, the duration of browsing loaning bill related pages is normal browsing
Three times of required duration, in another embodiment, the duration of browsing loaning bill related pages are five of duration needed for normal browsing
Times；Whether user appears in reference information blacklist library, i.e., user, which appears in reference information blacklist library, then belongs to fraud
The probability of user or fraud is higher, and in one embodiment, parameter value is that user appears in reference information blacklist library
In；Whether user appears in Crime Information database, i.e., user, which appears in Crime Information database, then belongs to fraudulent user
Or the probability of fraud is higher, in one embodiment, parameter value is that user appears in Crime Information database；Pre-
If the 4th period in user terminal IP address change frequency, i.e., user terminal IP address frequently changes then whithin a period of time
The probability for belonging to fraudulent user or fraud is higher, in one embodiment, parameter value be the 4th period be half an hour,
Change frequency be three times, in another embodiment, parameter value be a hour, change frequency the 4th period be five times, In
In another embodiment, parameter value be the 4th period be one day, change frequency is eight times；Whether the geographical location of user appears in
In black address base, i.e. the geographical location of user, which appears in reference information blacklist library, then belongs to fraudulent user or fraud
Probability it is higher, in one embodiment, parameter value be user geographical location appear in black address base；The cell room of user
Whether valence abnormal, i.e. the cell room rate of user have it is abnormal then belong to fraudulent user or the probability of fraud is higher, at one
In embodiment, parameter value is that the cell room rate of user has exception；The IP address of user terminal whether the geographical location pair with user
Answer, i.e., the IP address of user terminal is not corresponding with the geographical location of user, belong to the probability of fraudulent user or fraud compared with
Height, in one embodiment, parameter value are that the IP address of user terminal is not corresponding with the geographical location of user；Whether user terminal
Issuing abnormal data packet, (abnormal data packet includes that the flow of data packet is excessive, data packet length is too long, it is abnormal to occur in data packet
Field etc.), i.e., user terminal sending abnormal data Bao Ze belongs to fraudulent user or the probability of fraud is higher, in a reality
It applies in example, user terminal issues abnormal data packet；Whether user terminal uses proxy server, i.e. user terminal uses agency's clothes
Business device then belongs to fraudulent user or the probability of fraud is higher, and in one embodiment, parameter value is user terminal use
Proxy server.Each parameter value and fraudulent user through a large amount of data statistics of inventor, arrangement and analysis, in above-described embodiment
Or fraud has the association of high probability.Above-mentioned parameter can be individually or in any combination for training fraud
User and/or test whether that is fraudulent user.
Bury a little and collect data be by burying a setting event and collecting the data with event correlation based on event,
Burying a little includes that client buries point (also referred to as front end is buried a little) and server buries point (also referred to as rear end is buried a little), and collection data include net
Page data is collected and APP data collection.
In the execution of step S120, when building the timing neural network 300 based on attention mechanism, and training this
Sequence neural network 300, to define fraudulent user.
As shown in figure 3, the timing neural network 300 based on attention mechanism includes input layer 310, hidden layer 320, note
Meaning power layer 330 and output layer 340.Build and train the process of the timing neural network based on attention mechanism as follows.Firstly,
Input layer 310 inputs relevant to fraudulent user timing category feature (X=[X1, X2, X3 ..., Xn]) to hidden layer 320；Then,
By each timing category feature be input to hidden layer 320 (including Hidden unit h1, h2, h3 ..., hn), hidden layer 320 calculates
To the output of hidden layer (including α 1, α 2, α 3 ..., α n)；Then, a hidden layer is input to attention layer 330, infused
Power layer 330 of anticipating matches a hidden layer output and initial vector z0, and secondary vector z is obtained by calculation1；Then, hidden layer 320
Secondary hidden layer is calculated based on timing category feature and exports and be input to attention layer 330, attention layer 330 matches secondary hidden layer
Output and secondary vector z1, and vector z three times is obtained by calculation2, the above-mentioned calculating of circulating repetition, training obtain each timing class
The weight of feature；Finally, the weight definition of updated based on this, each timing category feature goes out learning objective Y, the learning objective
It is under financial fraud scene " fraudulent user ".Wherein, this, which is built, is related to timing class nerve known in the art with training process
Principles of Network and attention mechanism, the timing neural network can be RNN, LSTM network or GRU.
In the execution of step S130, by the data of user to be tested be input to trained completion, based on attention
The timing neural network of mechanism analyzes the data of user to be tested；And user to be tested is judged by weighted calculation is
No is fraudulent user.
Fig. 4 is a kind of structural schematic diagram for judging fraudulent user device 400 in the embodiment of the present invention.
Judge that fraudulent user device 400 includes constructing module 410, builds and training module 420, judgment module 430.Its
In, constructing module 410 is suitable for construction feature matrix, and eigenmatrix includes timing category feature, and timing category feature is and fraudulent user
Relevant feature, timing category feature are extracted based on the collected data of an operation are buried；It builds and is suitable for building with training module 420
Eigenmatrix is input to timing neural network, and uses attention by the timing neural network based on attention mechanism
The weight of each timing category feature of mechanism training, to define fraudulent user；Judgment module 430 is suitable for user's to be tested
Data be input to be completed it is trained, judge whether user to be tested is to take advantage of based on the timing neural network of attention mechanism
Cheat user.
Moreover, it is judged that fraudulent user device 400 may include burying point module 500, Fig. 5 is that a mould is buried in the embodiment of the present invention
The structural schematic diagram of block 500.
Point module 500 is buried to include classification indicators submodule 510, determine event submodule 520, bury a little and collect data submodule
Block 530.Wherein, classification indicators submodule 510 is suitable for classification and the associated index of timing category feature；Determine event submodule 520
Suitable for determining triggering and the associated event of index based on preset parameter；Data submodule 530 is buried a little and collects to be suitable for by burying
It puts setting event and collects the data with event correlation based on event.
In specific implementation, judge the relationship between the module in fraudulent user device 400 and each module, bury point module
The relationship between submodule and each submodule in 500 can be used with reference to above-mentioned in the embodiment of the present invention about judgement fraud
The description of family method, details are not described herein again.
The embodiment of the present invention also provides a kind of equipment for judging fraudulent user, including memory and processor, memory
On be stored with the computer instruction that can be run on a processor, when processor operation computer instruction, executes above-mentioned judgement fraud and uses
The step of family method.
The embodiments of the present invention also provide a kind of storage mediums, are stored thereon with computer instruction, computer instruction fortune
The step of above-mentioned judgement fraudulent user method is executed when row.
Those of ordinary skill in the art will appreciate that all or part of the steps in the various methods of above-described embodiment is can
It is completed with instructing relevant hardware by program, which can store in any computer readable storage medium storing program for executing, deposit
Storage media may include: read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random
Access Memory, referred to as RAM), disk or CD etc..
Although present disclosure is as above, present invention is not limited to this.Anyone skilled in the art are not departing from this
It in the spirit and scope of invention, can make various changes or modifications, therefore protection scope of the present invention should be with claim institute
Subject to the range of restriction.
Claims (10)
1. a kind of method for judging fraudulent user characterized by comprising
Construction feature matrix, the eigenmatrix include timing category feature, and the timing category feature is and the fraudulent user phase
The feature of pass, the timing category feature are extracted based on the collected data of an operation are buried；
The timing neural network based on attention mechanism is built, the eigenmatrix is input to the timing class nerve net
Network, and using the weight of each timing category feature of attention mechanism training, to define the fraudulent user；
The data of user to be tested are input to be completed it is trained, described based on the timing neural network of attention mechanism come
Judge whether the user to be tested is the fraudulent user.
2. the method according to claim 1, wherein the timing category feature includes operating characteristics and browsing feature
At least one of in, the operating characteristics are feature relevant to the operational order of input, and the operating characteristics include clicking side
Duration needed for helping the number of button, inputting text box, the browsing feature are feature relevant to page browsing, the browsing
Feature include browse rate related pages number, browse rate related pages duration, browse loaning bill related pages number,
Browse the duration of loaning bill related pages.
3. method according to claim 1 or 2, which is characterized in that the timing category feature includes user information feature, position
At least one in feature and equipment feature is set, the user information feature includes whether user appears in reference information blacklist
In library, user whether occur in Crime Information database, the position feature include the IP address of user terminal change frequency,
Whether the geographical location of user appears in black address base, whether abnormal, user terminal the IP address of the cell room rate of user is
No corresponding with the geographical location of user, the equipment feature includes that whether user terminal issues abnormal data packet, user terminal is
It is no to use proxy server.
4. according to the method described in claim 3, it is characterized in that, described bury operation and include classification indicators, determine event, bury
Point and collect data, the classification indicators be classification with the associated index of timing category feature, the determining event be based on
Preset parameter determines triggering and the associated event of the index, described to bury a little and collect data as by burying a setting thing
Part and data with the event correlation are collected based on the event.
5. according to the method described in claim 4, it is characterized in that, classification is with the associated index of timing category feature including dividing
Generic operation index, browsing index, user information index, positioning index and equipment index, the operation index are and the operation
The index of feature association, the browsing index are the index with the browsing feature, and the user information index is and the use
The associated index of family information characteristics, the positioning index be with the associated index of the position feature, the equipment index be with
The index of the equipment feature association.
6. according to the method described in claim 4, it is characterized in that, one or more in following item of the preset parameter
A: duration needed for clicking the number of the help button within preset first period, inputting text box is normal input institute
Take long multiple, the number for browsing within preset second period rate related pages, the browsing rate related pages
The duration in face is the multiple of duration needed for normal browsing, browses the secondary of the loaning bill related pages within the preset third period
It counts, browse the duration of the loaning bill related pages and whether appear in reference information for the multiple of duration needed for normal browsing, user
In blacklist library, user whether occur in Crime Information database, within preset 4th period user terminal IP address change
Change number, whether the geographical location of user appears in black address base, whether abnormal, user terminal the IP of the cell room rate of user
Whether whether, user terminal corresponding with the geographical location of user issue abnormal data packet, user terminal using agency for address
Server.
7. a kind of device for judging fraudulent user characterized by comprising
Constructing module, be suitable for construction feature matrix, the eigenmatrix includes timing category feature, the timing category feature for institute
The relevant feature of fraudulent user is stated, the timing category feature is extracted based on the collected data of an operation are buried；
It builds and training module inputs the eigenmatrix suitable for building the timing neural network based on attention mechanism
To the timing neural network, and using the weight of each timing category feature of attention mechanism training, to define
The fraudulent user out；
Judgment module, suitable for the data of user to be tested are input to be completed it is trained, described based on attention mechanism when
Sequence neural network judges whether the user to be tested is the fraudulent user.
8. device according to claim 7, which is characterized in that described device includes burying point module, described to bury point module packet
Classification indicators submodule is included, event submodule is determined, buries a little and collect data submodule, the classification indicators submodule is suitable for dividing
Class and the associated index of timing category feature, the determining event submodule are suitable for determining triggering and institute based on preset parameter
The associated event of index is stated, it is described to bury a little and collect data submodule suitable for by burying a setting event and based on institute
Event is stated to collect the data with the event correlation.
9. a kind of equipment for judging fraudulent user, including memory and processor, being stored on the memory can be at the place
The computer instruction run on reason device, which is characterized in that perform claim requires 1 when the processor runs the computer instruction
To described in any one of 6 the step of judgement fraudulent user method.
10. a kind of storage medium, is stored thereon with computer instruction, which is characterized in that the computer instruction executes when running
The step of judgement fraudulent user method described in any one of claims 1 to 6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910594702.XA CN110399705A (en) | 2019-07-03 | 2019-07-03 | Judge the method, apparatus, equipment and storage medium of fraudulent user |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910594702.XA CN110399705A (en) | 2019-07-03 | 2019-07-03 | Judge the method, apparatus, equipment and storage medium of fraudulent user |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN110399705A true CN110399705A (en) | 2019-11-01 |
Family
ID=68322774
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910594702.XA Pending CN110399705A (en) | 2019-07-03 | 2019-07-03 | Judge the method, apparatus, equipment and storage medium of fraudulent user |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110399705A (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111340112A (en) * | 2020-02-26 | 2020-06-26 | 腾讯科技（深圳）有限公司 | Classification method, classification device and server |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108428132A (en) * | 2018-03-15 | 2018-08-21 | 阿里巴巴集团控股有限公司 | Fraudulent trading recognition methods, device, server and storage medium |
| CN108510280A (en) * | 2018-03-23 | 2018-09-07 | 上海氪信信息技术有限公司 | A kind of financial fraud behavior prediction method based on mobile device behavioral data |
| CN109101896A (en) * | 2018-07-19 | 2018-12-28 | 电子科技大学 | A kind of video behavior recognition methods based on temporal-spatial fusion feature and attention mechanism |
| CN109389494A (en) * | 2018-10-25 | 2019-02-26 | 北京芯盾时代科技有限公司 | Borrow or lend money fraud detection model training method, debt-credit fraud detection method and device |
| CN109409896A (en) * | 2018-10-17 | 2019-03-01 | 北京芯盾时代科技有限公司 | Identification model training method, bank's fraud recognition methods and device are cheated by bank |
-
2019
- 2019-07-03 CN CN201910594702.XA patent/CN110399705A/en active Pending
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108428132A (en) * | 2018-03-15 | 2018-08-21 | 阿里巴巴集团控股有限公司 | Fraudulent trading recognition methods, device, server and storage medium |
| CN108510280A (en) * | 2018-03-23 | 2018-09-07 | 上海氪信信息技术有限公司 | A kind of financial fraud behavior prediction method based on mobile device behavioral data |
| CN109101896A (en) * | 2018-07-19 | 2018-12-28 | 电子科技大学 | A kind of video behavior recognition methods based on temporal-spatial fusion feature and attention mechanism |
| CN109409896A (en) * | 2018-10-17 | 2019-03-01 | 北京芯盾时代科技有限公司 | Identification model training method, bank's fraud recognition methods and device are cheated by bank |
| CN109389494A (en) * | 2018-10-25 | 2019-02-26 | 北京芯盾时代科技有限公司 | Borrow or lend money fraud detection model training method, debt-credit fraud detection method and device |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111340112A (en) * | 2020-02-26 | 2020-06-26 | 腾讯科技（深圳）有限公司 | Classification method, classification device and server |
| CN111340112B (en) * | 2020-02-26 | 2023-09-26 | 腾讯科技（深圳）有限公司 | Classification method, classification device and classification server |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111428231B (en) | Safety processing method, device and equipment based on user behaviors | |
| CN110598016B (en) | Method, device, equipment and medium for recommending multimedia information | |
| Pacheco et al. | Uncovering coordinated networks on social media | |
| CN104836781B (en) | Distinguish the method and device for accessing user identity | |
| CN106453061B (en) | A kind of method and system identifying network fraudulent act | |
| CN110781308B (en) | Anti-fraud system for constructing knowledge graph based on big data | |
| CN113344562B (en) | Method and device for detecting Etheng phishing accounts based on deep neural network | |
| CN108491714A (en) | The man-machine recognition methods of identifying code | |
| CN106355405A (en) | Method and device for identifying risks and system for preventing and controlling same | |
| CN112231570B (en) | Recommendation system support attack detection method, device, equipment and storage medium | |
| CN110348528A (en) | Method is determined based on the user credit of multidimensional data mining | |
| Weng et al. | Towards understanding the security of modern image captchas and underground captcha-solving services | |
| CN110598982B (en) | Active wind control method and system based on intelligent interaction | |
| CN109413023A (en) | The training of machine recognition model and machine identification method, device, electronic equipment | |
| CN109831459A (en) | Method, apparatus, storage medium and the terminal device of secure access | |
| CN105337987A (en) | Network user identity authentication method and system | |
| CN107888606A (en) | A kind of domain name credit assessment and system | |
| CN116996325B (en) | Network security detection method and system based on cloud computing | |
| CN110675252A (en) | Risk assessment method and device, electronic equipment and storage medium | |
| CN110457601B (en) | Social account identification method and device, storage medium and electronic device | |
| CN109948339A (en) | A kind of malicious script detection method based on machine learning | |
| CN110399705A (en) | Judge the method, apparatus, equipment and storage medium of fraudulent user | |
| CN113609394A (en) | Information flow-oriented safety recommendation system | |
| CN111125747B (en) | Commodity browsing privacy protection method and system for commercial website user | |
| CN116319065A (en) | Threat situation analysis method and system applied to business operation and maintenance |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20191101 |