CN111835561A - Abnormal user group detection method, device and equipment based on user behavior data - Google Patents
Abnormal user group detection method, device and equipment based on user behavior data Download PDFInfo
- Publication number
- CN111835561A CN111835561A CN202010611710.3A CN202010611710A CN111835561A CN 111835561 A CN111835561 A CN 111835561A CN 202010611710 A CN202010611710 A CN 202010611710A CN 111835561 A CN111835561 A CN 111835561A
- Authority
- CN
- China
- Prior art keywords
- user
- prediction
- data
- threshold
- probability
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 230000002159 abnormal effect Effects 0.000 title claims abstract description 80
- 238000001514 detection method Methods 0.000 title claims description 25
- 238000012549 training Methods 0.000 claims abstract description 79
- 238000009826 distribution Methods 0.000 claims abstract description 58
- 238000000034 method Methods 0.000 claims abstract description 35
- 230000006399 behavior Effects 0.000 claims description 120
- 230000000694 effects Effects 0.000 claims description 32
- 238000012360 testing method Methods 0.000 claims description 32
- 238000004364 calculation method Methods 0.000 claims description 16
- 238000004590 computer program Methods 0.000 claims description 12
- 230000006870 function Effects 0.000 claims description 11
- 238000000638 solvent extraction Methods 0.000 claims description 11
- 238000005192 partition Methods 0.000 claims 1
- 238000007405 data analysis Methods 0.000 abstract description 2
- 210000002268 wool Anatomy 0.000 description 14
- 238000010586 diagram Methods 0.000 description 7
- 230000008901 benefit Effects 0.000 description 4
- 238000004422 calculation algorithm Methods 0.000 description 4
- 230000008569 process Effects 0.000 description 4
- 238000004891 communication Methods 0.000 description 3
- 230000008859 change Effects 0.000 description 2
- 238000006243 chemical reaction Methods 0.000 description 2
- 230000006835 compression Effects 0.000 description 2
- 238000007906 compression Methods 0.000 description 2
- 238000010606 normalization Methods 0.000 description 2
- 238000006467 substitution reaction Methods 0.000 description 2
- 230000001360 synchronised effect Effects 0.000 description 2
- 238000004458 analytical method Methods 0.000 description 1
- 230000002547 anomalous effect Effects 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 239000003795 chemical substances by application Substances 0.000 description 1
- 238000013500 data storage Methods 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 238000011156 evaluation Methods 0.000 description 1
- 238000000605 extraction Methods 0.000 description 1
- 239000000835 fiber Substances 0.000 description 1
- 230000010365 information processing Effects 0.000 description 1
- 238000002372 labelling Methods 0.000 description 1
- 239000000463 material Substances 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 238000007781 pre-processing Methods 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/02—Marketing; Price estimation or determination; Fundraising
- G06Q30/0207—Discounts or incentives, e.g. coupons or rebates
- G06Q30/0225—Avoiding frauds
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
- H04L41/145—Network analysis or design involving simulating, designing, planning or modelling of a network
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
- H04L41/147—Network analysis or design for predicting network behaviour
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/16—Threshold monitoring
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/50—Network services
- H04L67/535—Tracking the activity of the user
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Business, Economics & Management (AREA)
- Strategic Management (AREA)
- Finance (AREA)
- Accounting & Taxation (AREA)
- Development Economics (AREA)
- Entrepreneurship & Innovation (AREA)
- General Engineering & Computer Science (AREA)
- Game Theory and Decision Science (AREA)
- Computer Hardware Design (AREA)
- Economics (AREA)
- Marketing (AREA)
- Physics & Mathematics (AREA)
- General Business, Economics & Management (AREA)
- General Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The application belongs to the field of data analysis and discloses a method and a device for detecting abnormal user groups based on user behavior data, computer equipment and a readable storage medium. The method comprises the steps of counting behavior characteristics of a user according to acquired user behavior data; calculating the Gaussian distribution of the behavior characteristics through a probability density function to obtain the distribution probability of each behavior characteristic; according to a preset weight table, giving weights to the distribution probabilities of different behavior characteristics; calculating the probability value of the user being a normal user based on the distribution probability and the weight; and comparing the probability value with a pre-training threshold value, and classifying the users corresponding to the probability value smaller than the pre-training threshold value into an abnormal user group. By the method, the problem that the prediction result is inaccurate due to the fact that the accuracy rate of abnormal prediction of the data of the current target time point based on the sample data of different time periods is deviated in the prior art is solved. The application also relates to blockchain techniques, where the user behavior data may be stored in blockchains.
Description
Technical Field
The present application relates to the field of data analysis, and in particular, to a method and an apparatus for detecting abnormal user groups based on user behavior data, a computer device, and a storage medium.
Background
At present, the 'wool party' is active on various internet platforms, and relatively low cost or even zero cost is exchanged for material benefit aiming at platform preferential activities. The wool party uses a large number of mobile phone cards to perform false registration and pick up active gifts in batches through equipment, and huge loss is brought to a platform. A "wool party" user may be considered an anomalous user relative to all users of the platform.
For abnormal user behavior detection, the following methods are currently available: calculating the potential difference between the lower quartile and the upper quartile based on the box diagram, and determining points outside a certain range as abnormal points, wherein the mode has poor precision and less identified abnormal points; the other mode is based on the abnormal detection of distance positions, firstly, it is assumed that normal user data are concentrated and have more neighbors, and abnormal data are isolated, but the mode is not suitable for a wool party, because the wool party generally performs batch registration and batch gift collection, and the characteristic of grouping is presented.
Therefore, the accuracy of the abnormal user prediction in the prior art is low.
Disclosure of Invention
In view of the above, it is necessary to provide a method, an apparatus, a computer device, and a storage medium for detecting an abnormal user group based on user behavior data, so as to solve the technical problem in the prior art that the accuracy of predicting abnormal users is low.
An abnormal user group detection method based on user behavior data, the method comprising:
counting the behavior characteristics of each user according to the acquired user behavior data, wherein the behavior characteristics comprise the number of UA devices of the user, the number of active days on the APP and the number of module operations;
calculating the Gaussian distribution of the behavior characteristics through a probability density function to obtain the distribution probability of each behavior characteristic;
giving weights to different distribution probabilities according to a preset weight table, wherein the weights of the number of active days and the number of module operations are set as first weights, and the weight of the number of UA devices is set as a second weight;
calculating a probability value of each user being a normal user based on the distribution probability and the weight; and are
And comparing the probability value with a pre-training threshold value, and classifying the users corresponding to the probability value smaller than the pre-training threshold value into an abnormal user group.
An abnormal user population detection apparatus based on user behavior data, the apparatus comprising:
the characteristic acquisition module is used for counting the behavior characteristics of each user according to the acquired user behavior data, wherein the behavior characteristics comprise the number of UA (user agent) equipment of the user, the number of active days on the APP (application) and the number of module operations;
the Gaussian calculation module is used for calculating the Gaussian distribution of the behavior characteristics through a probability density function to obtain the distribution probability of each behavior characteristic;
the weight giving module is used for giving weights to different distribution probabilities according to a preset weight table, wherein the weights of the number of active days and the number of module operation times are set as first weights, and the weight of the number of UA devices is set as a second weight;
a probability calculation module for calculating a probability value of each user being a normal user based on the distribution probability and the weight; and
and the threshold comparison module is used for comparing the probability value with a pre-training threshold and classifying the users corresponding to the probability value smaller than the pre-training threshold into an abnormal user group.
A computer device comprising a memory and a processor, and a computer program stored in the memory and executable on the processor, the processor implementing the steps of the above abnormal user group detection method based on user behavior data when executing the computer program.
A computer-readable storage medium, in which a computer program is stored, which, when being executed by a processor, carries out the above-mentioned steps of the abnormal user group detection method based on user behavior data.
According to the abnormal user group detection method and device based on the user behavior data, the computer equipment and the storage medium, the behavior data of the users are obtained in a point burying mode, a plurality of user behavior characteristics are obtained through statistics, the distribution probability of the behavior characteristics of each user is calculated based on Gaussian distribution, and the probability value of each user being a normal user is calculated by means of preset weight. The method comprises the steps of calculating a probability value, comparing the probability value with a pre-training threshold value, dividing a user into an abnormal user group and a normal user by taking the pre-training threshold value as a demarcation point, and predicting the complete behavior characteristics of the user by using Gaussian distribution to ensure the accuracy of prediction; in addition, the proposal also confirms the pre-training threshold value through the marked user behavior data, and the pre-training threshold value is closer to the true value with the increase of training samples in the training mode, so that the abnormal user prediction is more accurate.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings needed to be used in the description of the embodiments of the present invention will be briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and it is obvious for those skilled in the art that other drawings can be obtained according to these drawings without inventive labor.
FIG. 1 is a schematic diagram of an application environment of an abnormal user group detection method based on user behavior data;
FIG. 2 is a schematic flow chart of a method for detecting abnormal user groups based on user behavior data;
FIG. 3 is a schematic flow chart of step 202 in FIG. 2;
FIG. 4 is a schematic diagram of a training process for the pre-training threshold of FIG. 2;
FIG. 5 is a schematic diagram of an abnormal user population detection device based on user behavior data;
FIG. 6 is a diagram of a computer device in one embodiment.
Detailed Description
Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs; the terminology used in the description of the application herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application; the terms "including" and "having," and any variations thereof, in the description and claims of this application and the description of the above figures are intended to cover non-exclusive inclusions. The terms "first," "second," and the like in the description and claims of this application or in the above-described drawings are used for distinguishing between different objects and not for describing a particular order.
Reference herein to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the application. The appearances of the phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments mutually exclusive of other embodiments. It is explicitly and implicitly understood by one skilled in the art that the embodiments described herein can be combined with other embodiments.
In order to make the objects, technical solutions and advantages of the present application more apparent, the present application is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the present application. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
The abnormal user group detection method based on the user behavior data provided by the embodiment of the invention can be applied to the application environment shown in FIG. 1. The application environment may include a terminal 102, a network for providing a communication link medium between the terminal 102 and the server 104, and a server 104, wherein the network may include various connection types, such as wired, wireless communication links, or fiber optic cables, among others.
A user may use the terminal 102 to interact with the server 104 over a network to receive or send messages, etc. The terminal 102 may have installed thereon various communication client applications, such as a web browser application, a shopping application, a search application, an instant messaging tool, a mailbox client, social platform software, and the like.
The terminal 102 may be various electronic devices having a display screen and supporting web browsing, including but not limited to a smart phone, a tablet computer, an e-book reader, an MP3 player (Moving Picture Experts Group audio Layer III, mpeg compression standard audio Layer 3), an MP4 player (Moving Picture Experts Group audio Layer IV, mpeg compression standard audio Layer 4), a laptop portable computer, a desktop computer, and the like.
The server 104 may be a server that provides various services, such as a background server that provides support for pages displayed on the terminal 102.
It should be noted that the abnormal user group detection method based on user behavior data provided in the embodiment of the present application is generally executed by a server/terminal, and accordingly, the abnormal user group detection apparatus based on user behavior data is generally disposed in a server/terminal device.
It should be understood that the number of terminals, networks and servers in fig. 1 is merely illustrative. There may be any number of terminal devices, networks, and servers, as desired for implementation.
Wherein, the terminal 102 communicates with the server 104 through the network. The server 104 obtains the user behavior data from the terminal 102 to perform statistics of the behavior characteristics of the user, then calculates the distribution probability of the behavior characteristics according to the behavior characteristics, sets weights for the distribution probabilities of different behavior characteristics according to a preset weight table, and finally classifies the user corresponding to the probability value smaller than the pre-training threshold as an abnormal user group after calculating whether the user is normal according to the distribution probability and the weights and comparing the user with the pre-training threshold. The terminal 102 and the server 104 are connected through a network, the network may be a wired network or a wireless network, the terminal 102 may be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, and portable wearable devices, and the server 104 may be implemented by an independent server or a server cluster formed by a plurality of servers.
In an embodiment, as shown in fig. 2, a method for detecting an abnormal user group based on user behavior data is provided, which is described by taking the method applied to the server side in fig. 1 as an example, and includes the following steps:
User behavior data refers to how many devices a user has used, how many IPs have engaged in which activities of an APP within 30 days. User attributes of a user, such as active/inactive users of the APP, or normal/abnormal user groups (wool parties), can generally be evaluated from these user behavior data.
The wool party is a group of users which are active on various internet platforms, benefit of certain APP is achieved with relatively low cost, and the users are called abnormal users.
The user behavior data is generally obtained by means of embedding an APP, and after the user behavior data is obtained, some preprocessing needs to be performed on the user behavior data, such as normalization processing through a normalization formula, extraction of a feature null value, and the like.
N users within 30 days are X ═ (X)1,x2,…,xi,..,xn-1,xn) User xi＝(xi1,xi2,…，xij,…,xi28,xi29) Wherein x isijThe jth characteristic value representing the user i obtains 29 dimensional behavior characteristics, taking a certain car insurance APP as an example, respectively:
the number of the devices, the number of the IPs 20, the number of the IP attributions, the number of the UA devices, the number of the UA versions, the number of the APP versions, the number of the check-in days, the number of the participation times in the activities, the number of the active days, the number of the participation times in the 17 types of activities respectively and the time interval of registering and binding the vehicle, wherein the IP20 is a binary number obtained by converting the IP into a binary number, taking the first 20 digits from left to right, setting the rest digits to be 0 and converting the digits.
It is emphasized that, to further ensure the privacy and security of the user behavior data, the user behavior data may also be stored in a node of a blockchain. And 204, calculating the Gaussian distribution of the behavior characteristics through a probability density function to obtain the distribution probability of each behavior characteristic.
The Gaussian distribution is such that if the random variable X obeys a mathematical expectation mu, the variance is sigma2Normal distribution of (d) is expressed as N (μ, σ)2). The expected value μ of a normal distribution determines the position of the random variable X, and its standard deviation σ determines the magnitude of its distribution.
The probability density function f (x) is expressed by formula (1):
wherein:
in this embodiment, a probability model is constructed based on density in gaussian distribution, and it is generally considered that behavior characteristics of normal users are similar, behaviors of normal users tend to be a concentrated region as characteristics, and a position of a normal user may also represent a probability value of the normal user, while a distribution position of behavior characteristics of an abnormal user deviates from the normal user, and the position of the normal user represents a probability value of the abnormal user, and a threshold is used to divide which of normal user and abnormal user groups the user belongs to.
And step 206, giving weights to the distribution probabilities of different behavior characteristics according to a preset weight table, wherein the weights of the number of active days and the number of module operations are set as a first weight, and the weight of the number of UA devices is set as a second weight.
The preset weight table is a characteristic weight setting data table set for wool parties of different APPs, and because the types of activities corresponding to different APPs are different, if the same weight is set for all the activities during weight calculation, the judgment result of an abnormal user is influenced.
The first weight is 3 and the second weight is 1.
In this embodiment, a certain APP is taken as an example, and the wool party user group of the APP aims to participate in an activity and obtain a reward, so that only the weight of the user participating in the activity is increased, and the user can be obtained by performing empirical analysis according to the wool party group of the APP, for example, the number of times of the user participating in the activity is limited by the current activity of the mobile terminal, because most of abnormal user groups participate in the activity, a machine or a program is used to click an activity link, and the parameter of the number of times of actually allowed participation in the activity is not concerned.
Specifically, the probability distributions of 29 dimensions are respectively assigned with different weights, wherein the weights of the number of active days and the number of 17 module operations are set to be 3, and the weights of the data of other dimensions are set to be 1.
And step 208, calculating the probability value of each user as a normal user based on the distribution probability and the weight.
Can be determined by equation (2):
calculating the probability value of each user as a normal user, wherein the probability value is expressed as the following in a vector form:
L＝(LI,L2,…,Li,…,Lm-1，Lm)
where the mathematical expectation is μ and the variance is σ2，xijRepresenting the jth dimension characteristic of the ith user;
weight vector W ═ W1,w2,…,wj,…,w28,w29) Wherein w isjThe corresponding weight of the jth dimension feature is shown, i belongs to (1,2,3, …, m), j belongs to (1,2,3, …,29), and m represents a total of m users.
For example, the larger the value of the characteristics of the new person activity, the invitation to have a gift and the lottery ticket is, the higher the possibility that the user is an abnormal user in the abnormal user group is.
And step 210, comparing the probability value with a pre-training threshold value, and classifying the users corresponding to the probability value smaller than the pre-training threshold value into an abnormal user group.
The pre-training threshold is a value obtained by training user sample data and used for judging whether the user belongs to an abnormal user group.
In particular for user xi＝(xi1,xi2,…，xij,…,xi28,xi29) Calculating its probability value LiWith a pre-training thresholdfinalBy comparison, if LiLess than a pre-training thresholdfinalIf the user belongs to the abnormal user in the abnormal user group, storing the user and performing subsequent risk treatment; if L isiGreater than a pre-training thresholdfinalThe user is normal and no treatment is done.
In the abnormal user group detection method based on the user behavior data, the behavior data of the users are obtained in a point burying mode, a plurality of user behavior characteristics are obtained through statistics, the distribution probability of the behavior characteristics of each user is calculated based on Gaussian distribution, and the probability value of each user being a normal user is calculated by means of preset weight. The method comprises the steps of calculating a probability value, comparing the probability value with a pre-training threshold value, dividing a user into an abnormal user group and a normal user by taking the pre-training threshold value as a demarcation point, and predicting the complete behavior characteristics of the user by using Gaussian distribution to ensure the accuracy of prediction; in addition, the proposal also confirms the pre-training threshold value through the marked user behavior data, and the pre-training threshold value is closer to the true value with the increase of training samples in the training mode, so that the abnormal prediction of the abnormal user is more accurate.
In one embodiment, as shown in fig. 3, step 202, wherein the user behavior data is stored in a preset database, the preset database comprising a buried data table and an activity participation table, comprises:
The embedded data table is used for storing user data obtained by embedding an APP, where the data is information related to user data attributes, such as UA equipment of a user, and the UA equipment refers to a mobile phone device used by the user. In addition, the number of UA versions, the number of APP versions, the number of IP20, the number of IP homes, and the like of the user may also be included, where IP20 is a binary number of 20 digits before the conversion from left to right after the conversion of IP into binary, and the remaining digits are 0 and then converted into decimal.
And step 304, acquiring the number of active days of the user on the APP and the number of module operations from the activity participation table.
The activity participation table is behavior characteristic data which is acquired in an APP (application) embedding manner and is related to the operation behavior of the user, and the behavior characteristic data comprises the number of active days of the user on the APP, the number of module operation times and the like. Specifically, the number of days that the user signs in on the APP, the number of times of participating in an activity, the number of types of participating in an activity, the number of active days, the number of times that each type of activity of other set several types of activities participates respectively, the registration and binding mobile phone number, the identification card number, the time interval during which the account number is bound with the identification card or bound with the vehicle, and the like are included. These behavior feature data are closely related to determining whether the user is an abnormal user group (wool party). Generally, some woolen parties participate in an activity no more than 2 times, and the types of activities involved are obviously free to benefit.
And step 306, taking the number of UA devices, the number of active days and the number of module operations as the behavior characteristics of the user.
Usually, multiple behavior characteristics of the user can be obtained, and in this embodiment, for example, 29 behavior characteristics of the user are obtained, so that 29 behavior characteristics of the user are obtained, for example:
the number of the devices, the number of the IPs 20, the number of IP attributions, the number of UA devices, the number of UA versions, the number of APP versions, the number of check-in days, the number of times of participating in activities, the number of types of participating in activities, the number of times of participating in 17 types of activities respectively, and the time interval of vehicle registration and binding are determined, wherein the IP20 is a binary number obtained by converting the IP into binary number and then taking the first 20 digits from left to right, and the rest digits are 0 and then are converted into decimal numbers so as to determine whether the user is on the same subnet. A common ip address is the a/b/c class. The first 8 bits for the class a network address, the first 16 bits for the class b network address, and the first 24 bits for the class c network address. To balance the network host addresses of the various classes, the first 20 bits are used to identify the network address of its ip address, and the subsequent bits are considered to be the subnet segment. Taking 20, this is an appropriate value. The present embodiment is described by way of example only.
According to the embodiment, various behavior data of the user are acquired for abnormity judgment, various conditions are comprehensively considered, and the accuracy of prediction is guaranteed.
In one embodiment, as shown in fig. 4, before step 210, the method further includes:
The user sample data comprises user behavior data of labeled users, namely, whether each sample user is a wool party or a normal user is labeled by an actual label. User sample data is divided into user training data and user test data according to the proportion of 7:1 before training.
The probability value that the sample user is a normal user in the training data can be calculated by formula (2):
where μ is the mathematical expectation, σ2Is the variance, xijRepresenting the jth dimension characteristic of the ith sample user;
weight vector W ═ W1,w2,…,wj,…,w28,w29) Wherein w isjThe corresponding weight of the jth dimension feature is shown, i belongs to (1,2,3, …, m), j belongs to (1,2,3, …,29), and m represents a total of m sample users.
And 406, performing predictive partitioning on the training data by taking the minimum probability value as a threshold value to be trained to obtain a predictive partitioning result.
The range of the threshold to be trained is set to (min (L)i),max(Li) A preset interval value is added to the threshold value to be trained before each prediction division, and the preset interval value is set to 0.01 empirically in the embodiment. And when the wool party and the normal users are divided for the first time, obtaining the minimum probability value as a threshold value to be trained to predict and divide the sample users in the training data.
Specifically, sample users corresponding to the probability value smaller than or equal to the threshold value to be trained are divided into wool parties, the rest are divided into normal users, and the division result is used as a prediction division result.
Further, the prediction partitioning result may be one of the following:
TP: the prediction is true and correct and the prediction is true,
FP: the prediction is true and false and the prediction is false,
FN: the prediction is false and in error,
TN: the prediction is false and correct and the prediction is,
wherein TP and FN are true, indicating that the result of prediction is abnormal; TN and FP are false, indicating that the prediction result is normal, and the initial values of TP, FP, FN, and TN are 0. Such as:
if the probability value L1 of the user1 is greater than the threshold value to be trained, the user1 is judged to be false, which indicates that the user1 is a normal user, but the labeling information of the user1 is in a black list and is known to an abnormal user, and the prediction division result is as follows: if the prediction is false and false, belongs to FN, FN is incremented by 1, and so on for other results.
And step 408, calculating a prediction index corresponding to the threshold to be trained according to the prediction division result.
The prediction index is obtained according to the prediction division result of each sample user, and before the prediction index is calculated, the prediction accuracy and the recall rate need to be obtained. Wherein,
the calculation mode of the accuracy rate is formula (3):
the recall ratio is calculated in the following formula (4):
the calculation mode of the prediction index is formula (5):
the prediction index is an evaluation index for balancing accuracy and recall rate.
And adding a preset interval value of 0.01 to the threshold value to be trained after each calculation of the prediction index is finished, updating the threshold value to be trained until the threshold value to be trained is greater than the maximum probability value max (L), and finally obtaining the prediction index which is consistent with the number of the users.
Specifically, for the first traversal, the probability distribution vector L ═ for the training samples is traversed (L)I,L2,…,Li,…,Lm-1，Lm) The threshold is min (l) + 0.01:
if L isiIf the user is a blacklisted user, TP is equal to TP +1, and if the user is a whitelist user, FP is equal to FP + 1;
if L isiIf the number of the users is greater than min (l) +0.01, the user is normal, and the real label of the user is compared at the same time, if the user is a blacklist user, FN is equal to FN +1, and if the user is a whitelist user, TN is equal to TN + 1;
traversing the probability distribution vector L, calculating the prediction index F1-score, and adding F1 to the vector F with F1 ═ F1-score, i.e., F ═ F1.
Traversing for the second time, traversing the probability distribution vector L, and adding 0.01 to the threshold value to be trained on the original basis, wherein the steps are the same as the above; the threshold condition may be that the threshold to be trained is first greater than the maximum probability value max (l), or that the threshold to be trained is exactly equal to the maximum probability value max (l) -0.01.
When the k-th traversal is reached and the threshold value to be trained is larger than the maximum probability value max (L) or just equal to max (L) -0.01, the k-th traversal is ended, and the vector F ═ (F ═ F-1,F2,…,Fk)。
Obtaining max (F) as FmaxAnd the threshold value to be trained of the traversalfinal。
And step 410, adding a preset interval value to the threshold to be trained to update the threshold to be trained, repeating operations of prediction division and prediction index calculation until the threshold to be trained meets a threshold condition, and taking the threshold to be trained corresponding to the maximum prediction index as a threshold to be confirmed. The threshold condition means that the obtained threshold value to be trained is larger than the maximum probability value max (L) or is just equal to max (L) -0.01. Finally, the final threshold value to be trained is obtainedfinalAs the threshold to be determined.
And step 412, calculating the probability value of the test data as a normal user, and performing abnormal prediction on the test data according to the probability value of the test data and the threshold value to be confirmed.
And step 414, if the consistency of the obtained abnormal prediction result and the actual label of the test data reaches a set value, determining that the threshold to be confirmed is a pre-training threshold.
The set value is not less than 99%, and the set value of the embodiment may be 99%.
And calculating the probability value of the test user in each user test data, which is a normal user, and comparing the probability value with the threshold value to be confirmed to realize the abnormal prediction of the test data.
The specific prediction process is to obtain 30% of n users as test samples, i.e. Xtest＝(x1,x2,…,xq) Wherein q is 30;
are respectively paired with XtestCalculating probability distribution as probability value of normal user as test user in test data, and obtaining Ltest＝(L1,L2,…,Li,…,Lq-1，Lq)；
Using a threshold to be determinedfinalTo LtestDetecting if the probability value LiIs less thanfinalIf the user is a blacklist user, the TP is TP +1, and if the user is a white list user, the FP is FP + 1;
if L isiIs greater thanfinalIf the user is a blacklist user, FN +1, and if the user is a white list user, TN + 1;
go through LtestIf the consistency of the abnormal prediction result and the real label of the test user reaches 99%, determining a threshold value to be confirmedfinalThe method comprises the steps of pre-training a threshold value, simultaneously calculating a prediction index F1-score of a test user, testing the ductility of the pre-training threshold value, wherein the higher the prediction index is, the smaller the influence of different data needing to be predicted on the performance of the algorithm is, and the algorithm has a good effect on the prediction of different data.
In this embodiment, the minimum probability value is used as the initial threshold to be trained, the threshold to be trained is continuously trained until the minimum probability value meets a certain condition, so as to obtain the threshold to be determined, and then the test user is used to determine the threshold to be determinedfinalThe test is carried out to detect the ductility of the threshold to be confirmed, and the higher the prediction index F1-score is, so that the embodiment can be applied to different data, the influence of different data to be predicted on the performance of the algorithm is reduced, the effect of good prediction on different data is realized, and the universality of the technical scheme of the embodiment is improved.
It should be understood that although the various steps in the flowcharts of fig. 2-4 are shown in order as indicated by the arrows, the steps are not necessarily performed in order as indicated by the arrows. The steps are not performed in the exact order shown and described, and may be performed in other orders, unless explicitly stated otherwise. Moreover, at least some of the steps in fig. 2-4 may include multiple sub-steps or multiple stages that are not necessarily performed at the same time, but may be performed at different times, and the order of performing the sub-steps or stages is not necessarily sequential, but may be performed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.
In one embodiment, as shown in fig. 5, an abnormal user group detection apparatus based on user behavior data is provided, and the abnormal user group detection apparatus based on user behavior data corresponds to the abnormal user group detection method based on user behavior data in the above embodiment one to one. The abnormal user group detection device based on the user behavior data comprises:
the characteristic obtaining module 502 is configured to count behavior characteristics of each user according to the obtained user behavior data, where the behavior characteristics include the number of UA devices of the user, the number of active days on the APP, and the number of module operations.
The gaussian calculation module 504 is configured to calculate a gaussian distribution of the behavior features through a probability density function, so as to obtain a distribution probability of each behavior feature.
A weight assignment module 506, configured to assign weights to the different distribution probabilities according to a preset weight table, where the weights of the number of active days and the number of module operations are set as a first weight, and the weight of the number of UA devices is set as a second weight.
And a probability calculating module 508, configured to calculate a probability value that each user is a normal user based on the distribution probability and the weight. And
and a threshold comparison module 510, configured to compare the probability value with a pre-training threshold, and classify the user corresponding to the probability value smaller than the pre-training threshold into an abnormal user group.
Further, the feature obtaining module 502 includes:
and the UA acquisition submodule is used for acquiring the number of UA devices of the user from the buried point data table.
And the activity determination submodule is used for acquiring the number of active days of the user on the APP and the number of module operations from the activity participation table.
And the characteristic determination submodule is used for taking the number of the UA devices, the number of active days and the number of module operation times as the behavior characteristics of the user.
Further, the apparatus further comprises a pre-training threshold training module, the pre-training threshold training module comprising:
and the sample acquisition submodule is used for acquiring user sample data and dividing the user sample data into training data and testing data according to a preset proportion, wherein the user sample data comprises an actual label of a user.
And the probability calculation submodule is used for calculating the probability value of the sample user in the training data as a normal user.
And the prediction partitioning submodule is used for performing prediction partitioning on the training data by taking the minimum probability value as a threshold value to be trained to obtain a prediction partitioning result. And
and the index calculation submodule is used for calculating the prediction index corresponding to the threshold value to be trained according to the prediction division result.
And the threshold iteration submodule is used for adding a preset interval value to the threshold to be trained to update the threshold to be trained, repeating the operations of prediction division and prediction index calculation until the threshold to be trained meets the threshold condition, and taking the threshold to be trained corresponding to the maximum prediction index as the threshold to be confirmed.
And the threshold value checking submodule is used for calculating the probability value of the test data as a normal user and carrying out abnormal prediction on the test data according to the probability value of the test data and the threshold value to be confirmed.
And the threshold setting submodule is used for determining the threshold to be confirmed as a pre-training threshold if the consistency of the obtained abnormal prediction result and the actual label of the test data reaches a set value.
Further, predicting the partitioning result includes:
TP: the prediction is true and correct and the prediction is true,
FP: the prediction is true and false and the prediction is false,
FN: the prediction is false and in error,
TN: the prediction is false and correct and the prediction is,
wherein TP and FN are true, indicating that the result of prediction is abnormal;
TN and FP are false, which indicates that the prediction result is normal;
a prediction partitioning sub-module comprising:
the first judgment subunit is used for judging the sample user as an abnormal user when the probability value is not greater than the threshold value to be trained; and
the first comparison subunit is used for comparing the actual labels of the sample users;
a first loop subunit, configured to, when the sample user is a blacklist user, change TP to TP + 1;
a second loop subunit, configured to, when the sample data is a white list user, set FP as TN + 1;
the second judgment subunit is used for judging the sample user as a normal user when the probability value is greater than the threshold value to be trained; and
the second comparison subunit is used for comparing the actual labels of the sample users;
a third loop subunit, configured to set FN to FN +1 when the sample user is a blacklisted user;
a fourth circulation subunit, configured to, when the sample user is a white list user, change TN to TN + 1;
the index calculation subunit is used for calculating a prediction index according to the obtained TP, FP, FN and TN; and
and the numerical value updating subunit is used for updating the threshold value to be trained and repeatedly calculating the prediction indexes to obtain a plurality of prediction indexes, wherein the number of the prediction indexes is consistent with the number of the sample users.
It is emphasized that, to further ensure the privacy and security of the user behavior data, the user behavior data may also be stored in a node of a blockchain.
The abnormal user group detection device based on the user behavior data obtains the behavior data of the users in a point burying mode, obtains a plurality of user behavior characteristics through statistics, calculates the distribution probability of the behavior characteristics of each user based on Gaussian distribution, and calculates the probability value of each user being a normal user by means of preset weight. The method comprises the steps of calculating a probability value, comparing the probability value with a pre-training threshold value, dividing a user into an abnormal user group and a normal user by taking the pre-training threshold value as a demarcation point, and predicting the complete behavior characteristics of the user by using Gaussian distribution to ensure the accuracy of prediction; and the proposal also confirms the pre-training threshold value through the marked user behavior data, and the pre-training threshold value is closer to the true value with the increase of training samples in the training mode, so that the predicted result is more accurate finally.
In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as shown in fig. 6. The computer device includes a processor, a memory, a network interface, and a database connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a nonvolatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of an operating system and computer programs in the non-volatile storage medium. The database of the computer device is used for storing user data. The network interface of the computer device is used for communicating with an external terminal through a network connection. The computer program is executed by a processor to implement a method of abnormal user population detection based on user behavior data.
The method includes the steps of obtaining behavior data of users in a point burying mode, counting to obtain a plurality of user behavior characteristics, calculating the distribution probability of the behavior characteristics of each user based on Gaussian distribution, and calculating the probability value of each user as a normal user according to preset weight. The method comprises the steps of calculating a probability value, comparing the probability value with a pre-training threshold value, dividing a user into an abnormal user group and a normal user by taking the pre-training threshold value as a demarcation point, and predicting the complete behavior characteristics of the user by using Gaussian distribution to ensure the accuracy of prediction; and the proposal also confirms the pre-training threshold value through the marked user behavior data, and the pre-training threshold value is closer to the true value with the increase of training samples in the training mode, so that the predicted result is more accurate finally.
As will be understood by those skilled in the art, the computer device is a device capable of automatically performing numerical calculation and/or information processing according to a preset or stored instruction, and the hardware includes, but is not limited to, a microprocessor, an Application Specific Integrated Circuit (ASIC), a Programmable Gate Array (FPGA), a Digital Signal Processor (DSP), an embedded device, and the like.
Those skilled in the art will appreciate that the architecture shown in fig. 6 is merely a block diagram of some of the structures associated with the disclosed aspects and is not intended to limit the computing devices to which the disclosed aspects apply, as particular computing devices may include more or less components than those shown, or may combine certain components, or have a different arrangement of components.
In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and the computer program when executed by a processor implements the steps of the abnormal user group detection method based on user behavior data in the above-described embodiment, such as the steps 202 to 210 shown in fig. 2, or the processor implements the functions of the modules/units of the abnormal user group detection apparatus based on user behavior data in the above-described embodiment, such as the functions of the modules 502 to 510 shown in fig. 5. To avoid repetition, further description is omitted here.
The storage medium is used for acquiring the behavior data of the users in a point burying mode, counting to obtain a plurality of user behavior characteristics, calculating the distribution probability of the behavior characteristics of each user based on Gaussian distribution, and calculating the probability value of each user as a normal user by means of preset weight. The method comprises the steps of calculating a probability value, comparing the probability value with a pre-training threshold value, dividing a user into an abnormal user group and a normal user by taking the pre-training threshold value as a demarcation point, and predicting the complete behavior characteristics of the user by using Gaussian distribution to ensure the accuracy of prediction; and the proposal also confirms the pre-training threshold value through the marked user behavior data, and the pre-training threshold value is closer to the true value with the increase of training samples in the training mode, so that the predicted result is more accurate finally.
It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by hardware instructions of a computer program, which can be stored in a non-volatile computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. Any reference to memory, storage, database, or other medium used in the embodiments provided herein may include non-volatile and/or volatile memory, among others. Non-volatile memory can include read-only memory (ROM), Programmable ROM (PROM), Electrically Programmable ROM (EPROM), Electrically Erasable Programmable ROM (EEPROM), or flash memory. Volatile memory can include Random Access Memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms such as Static RAM (SRAM), Dynamic RAM (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDRSDRAM), Enhanced SDRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), Rambus Direct RAM (RDRAM), direct bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).
The block chain referred by the application is a novel application mode of computer technologies such as distributed data storage, point-to-point transmission, a consensus mechanism, an encryption algorithm and the like. A block chain (Blockchain), which is essentially a decentralized database, is a series of data blocks associated by using a cryptographic method, and each data block contains information of a batch of network transactions, so as to verify the validity (anti-counterfeiting) of the information and generate a next block. The blockchain may include a blockchain underlying platform, a platform product service layer, an application service layer, and the like.
It will be apparent to those skilled in the art that, for convenience and brevity of description, only the above-mentioned division of the functional units and modules is illustrated, and in practical applications, the above-mentioned function distribution may be performed by different functional units and modules according to needs, that is, the internal structure of the apparatus is divided into different functional units or modules to perform all or part of the above-mentioned functions.
The technical features of the above embodiments can be arbitrarily combined, and for the sake of brevity, all possible combinations of the technical features in the above embodiments are not described, but should be considered as the scope of the present specification as long as there is no contradiction between the combinations of the technical features.
The above-mentioned embodiments only express several embodiments of the present application, and the description thereof is more specific and detailed, but not construed as limiting the scope of the invention. It should be noted that, for those skilled in the art, without departing from the spirit and scope of the present invention, several changes, modifications and equivalent substitutions of some technical features may be made, and these changes or substitutions do not make the essence of the same technical solution depart from the spirit and scope of the technical solution of the embodiments of the present invention. Therefore, the protection scope of the present patent shall be subject to the appended claims.
Claims (10)
1. An abnormal user group detection method based on user behavior data is characterized by comprising the following steps:
acquiring user behavior data, and counting behavior characteristics of each user according to the user behavior data, wherein the behavior characteristics comprise the number of UA (user agent) equipment of the user, the number of active days on an APP (application) and the number of module operations;
calculating the Gaussian distribution of the behavior characteristics through a probability density function to obtain the distribution probability of each behavior characteristic;
giving weights to the distribution probabilities of different behavior characteristics according to a preset weight table, wherein the weights of the number of active days and the number of module operations are set as first weights, and the weight of the number of UA devices is set as a second weight, wherein the first weight is larger than the second weight;
calculating a probability value of each user being a normal user based on the distribution probability and the weight; and are
And comparing the probability value with a pre-training threshold value, and classifying the users corresponding to the probability value smaller than the pre-training threshold value into an abnormal user group.
2. The method of claim 1, wherein the user behavior data is stored in a preset database, the preset database comprises a buried data table and an activity participation table, and the counting behavior characteristics of each user according to the obtained user behavior data comprises:
acquiring the number of the UA devices of the user from the buried point data table;
acquiring the number of active days of a user on an APP and the number of module operations from the activity participation table;
and taking the number of the UA devices, the number of the active days and the number of the module operations as the behavior characteristics of the user.
3. The method of claim 1, further comprising, before the comparing the probability value with a pre-training threshold and classifying users corresponding to probability values smaller than the pre-training threshold into an abnormal user group:
acquiring user sample data, and dividing the user sample data into training data and test data according to a preset proportion, wherein the user sample data comprises an actual label of a user;
calculating the probability value of the sample user in the training data as a normal user;
performing predictive partitioning on the training data by taking the minimum probability value as a threshold value to be trained to obtain a predictive partitioning result; and are
Calculating a prediction index corresponding to the threshold to be trained according to the prediction division result;
adding a preset interval value to the threshold to be trained to update the threshold to be trained, repeating operations of prediction division and prediction index calculation until the threshold to be trained meets a threshold condition, and taking the threshold to be trained corresponding to the maximum prediction index as the threshold to be confirmed;
calculating the probability value of the test data being a normal user, and performing abnormal prediction on the test data according to the probability value of the test data and the threshold to be confirmed;
and if the consistency of the obtained abnormal prediction result and the actual label of the test data reaches a set value, determining the threshold to be confirmed as the pre-training threshold.
4. The method of claim 3, wherein predicting the partitioning result comprises:
TP: the prediction is true and correct and the prediction is true,
FP: the prediction is true and false and the prediction is false,
FN: the prediction is false and in error,
TN: the prediction is false and correct and the prediction is,
wherein TP and FN are true, indicating that the result of prediction is abnormal;
TN and FP are false, indicating that the prediction result is normal, and initial values of TP, FP, FN and TN are 0;
the predicting and dividing the training data by taking the minimum probability value as a threshold value to be trained to obtain a predicting and dividing result, which comprises the following steps:
if the probability value is not larger than the threshold value to be trained, judging that the sample user is an abnormal user; and are
Comparing the actual labels of the sample users;
if the sample user is a blacklist user, TP + 1;
if the sample data is a white list user, the FP is TN + 1;
if the probability value is larger than the threshold value to be trained, judging the sample user as a normal user; and are
Comparing the actual labels of the sample users;
if the sample user is a blacklist user, FN + 1;
if the sample user is a white list user, TN is TN + 1.
5. The method according to claim 4, wherein the calculating the prediction index corresponding to the threshold to be trained according to the prediction partition result comprises:
according to the formula
Calculating to obtain the Precision rate, wherein Precision represents the Precision rate;
according to the formula
The recall ratio is calculated, where Recal represents the recall ratio.
And calculating to obtain the prediction index according to the accuracy rate and the recall rate.
6. The method of claim 5, wherein said calculating the prediction index according to the accuracy rate and the recall rate comprises:
according to the formula
And calculating to obtain the prediction index, wherein F1-score is the prediction index.
7. The method of any of claims 1-6, wherein the user behavior data is distributed across a blockchain.
8. An abnormal user group detection device based on user behavior data, comprising:
the characteristic acquisition module is used for counting the behavior characteristics of each user according to the acquired user behavior data, wherein the behavior characteristics comprise the number of UA (user agent) equipment of the user, the number of active days on the APP (application), and the number of module operations;
the Gaussian calculation module is used for calculating the Gaussian distribution of the behavior characteristics through a probability density function to obtain the distribution probability of each behavior characteristic;
the weight giving module is used for giving weights to different distribution probabilities according to a preset weight table, wherein the weights of the number of active days and the number of module operation times are set as first weights, and the weight of the number of UA devices is set as a second weight;
a probability calculation module for calculating a probability value of each user being a normal user based on the distribution probability and the weight; and
and the threshold comparison module is used for comparing the probability value with a pre-training threshold and classifying the users corresponding to the probability value smaller than the pre-training threshold into an abnormal user group.
9. A computer device comprising a memory and a processor, the memory storing a computer program, wherein the processor implements the steps of the method of any one of claims 1 to 7 when executing the computer program.
10. A computer-readable storage medium, on which a computer program is stored, which, when being executed by a processor, carries out the steps of the method of any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010611710.3A CN111835561B (en) | 2020-06-29 | 2020-06-29 | Abnormal user group detection method, device and equipment based on user behavior data |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010611710.3A CN111835561B (en) | 2020-06-29 | 2020-06-29 | Abnormal user group detection method, device and equipment based on user behavior data |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111835561A true CN111835561A (en) | 2020-10-27 |
| CN111835561B CN111835561B (en) | 2024-07-02 |
Family
ID=72900624
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010611710.3A Active CN111835561B (en) | 2020-06-29 | 2020-06-29 | Abnormal user group detection method, device and equipment based on user behavior data |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111835561B (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113220749A (en) * | 2021-05-25 | 2021-08-06 | 中国农业银行股份有限公司 | Service data processing method and device and electronic equipment |
| CN113362120A (en) * | 2021-08-11 | 2021-09-07 | 北京达佳互联信息技术有限公司 | Group determination method and device, electronic equipment and computer readable storage medium |
| CN113449309A (en) * | 2021-06-28 | 2021-09-28 | 平安银行股份有限公司 | Terminal security state identification method, device, equipment and medium |
| CN115456788A (en) * | 2022-11-07 | 2022-12-09 | 支付宝(杭州)信息技术有限公司 | Method, device and equipment for detecting risk group |
| CN115965460A (en) * | 2022-11-22 | 2023-04-14 | 湖南长银五八消费金融股份有限公司 | Abnormal service identification method and device, computer equipment and storage medium |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102610228A (en) * | 2011-01-19 | 2012-07-25 | 上海弘视通信技术有限公司 | Audio exception event detection system and calibration method for the same |
| CN103186527A (en) * | 2011-12-27 | 2013-07-03 | 北京百度网讯科技有限公司 | System for building music classification model, system for recommending music and corresponding method |
| CN103280220A (en) * | 2013-04-25 | 2013-09-04 | 北京大学深圳研究生院 | Real-time recognition method for baby cry |
| CN107462330A (en) * | 2017-08-17 | 2017-12-12 | 深圳市比特原子科技有限公司 | A kind of color identification method and system |
| CN109325691A (en) * | 2018-09-27 | 2019-02-12 | 上海观安信息技术股份有限公司 | Abnormal behaviour analysis method, electronic equipment and computer program product |
| CN110232473A (en) * | 2019-05-22 | 2019-09-13 | 重庆邮电大学 | A kind of black production user in predicting method based on big data finance |
| CN111298445A (en) * | 2020-02-07 | 2020-06-19 | 腾讯科技（深圳）有限公司 | Target account detection method and device, electronic equipment and storage medium |
-
2020
- 2020-06-29 CN CN202010611710.3A patent/CN111835561B/en active Active
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102610228A (en) * | 2011-01-19 | 2012-07-25 | 上海弘视通信技术有限公司 | Audio exception event detection system and calibration method for the same |
| CN103186527A (en) * | 2011-12-27 | 2013-07-03 | 北京百度网讯科技有限公司 | System for building music classification model, system for recommending music and corresponding method |
| CN103280220A (en) * | 2013-04-25 | 2013-09-04 | 北京大学深圳研究生院 | Real-time recognition method for baby cry |
| CN107462330A (en) * | 2017-08-17 | 2017-12-12 | 深圳市比特原子科技有限公司 | A kind of color identification method and system |
| CN109325691A (en) * | 2018-09-27 | 2019-02-12 | 上海观安信息技术股份有限公司 | Abnormal behaviour analysis method, electronic equipment and computer program product |
| CN110232473A (en) * | 2019-05-22 | 2019-09-13 | 重庆邮电大学 | A kind of black production user in predicting method based on big data finance |
| CN111298445A (en) * | 2020-02-07 | 2020-06-19 | 腾讯科技（深圳）有限公司 | Target account detection method and device, electronic equipment and storage medium |
Cited By (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113220749A (en) * | 2021-05-25 | 2021-08-06 | 中国农业银行股份有限公司 | Service data processing method and device and electronic equipment |
| CN113220749B (en) * | 2021-05-25 | 2024-02-27 | 中国农业银行股份有限公司 | Service data processing method and device and electronic equipment |
| CN113449309A (en) * | 2021-06-28 | 2021-09-28 | 平安银行股份有限公司 | Terminal security state identification method, device, equipment and medium |
| CN113449309B (en) * | 2021-06-28 | 2023-10-27 | 平安银行股份有限公司 | Terminal security state identification method, device, equipment and medium |
| CN113362120A (en) * | 2021-08-11 | 2021-09-07 | 北京达佳互联信息技术有限公司 | Group determination method and device, electronic equipment and computer readable storage medium |
| CN115456788A (en) * | 2022-11-07 | 2022-12-09 | 支付宝(杭州)信息技术有限公司 | Method, device and equipment for detecting risk group |
| CN115456788B (en) * | 2022-11-07 | 2023-03-21 | 支付宝(杭州)信息技术有限公司 | Method, device and equipment for detecting risk group |
| CN115965460A (en) * | 2022-11-22 | 2023-04-14 | 湖南长银五八消费金融股份有限公司 | Abnormal service identification method and device, computer equipment and storage medium |
| CN115965460B (en) * | 2022-11-22 | 2023-09-01 | 湖南长银五八消费金融股份有限公司 | Abnormal service identification method, device, computer equipment and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111835561B (en) | 2024-07-02 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111835561A (en) | Abnormal user group detection method, device and equipment based on user behavior data | |
| CN112528025A (en) | Text clustering method, device and equipment based on density and storage medium | |
| CN110781379A (en) | Information recommendation method and device, computer equipment and storage medium | |
| CN110888911A (en) | Sample data processing method and device, computer equipment and storage medium | |
| CN111259952B (en) | Abnormal user identification method, device, computer equipment and storage medium | |
| CN110348471B (en) | Abnormal object identification method, device, medium and electronic equipment | |
| CN112365202B (en) | Method for screening evaluation factors of multi-target object and related equipment thereof | |
| CN112887371B (en) | Edge calculation method and device, computer equipment and storage medium | |
| CN112308173B (en) | Multi-target object evaluation method based on multi-evaluation factor fusion and related equipment thereof | |
| CN112417315A (en) | User portrait generation method, device, equipment and medium based on website registration | |
| CN116684330A (en) | Traffic prediction method, device, equipment and storage medium based on artificial intelligence | |
| CN116542456A (en) | Intelligent order sending method, device and equipment | |
| CN111177500A (en) | Data object classification method and device, computer equipment and storage medium | |
| CN113064916A (en) | Abnormal card punching behavior monitoring method and device, computer equipment and storage medium | |
| CN111340574B (en) | Risk user identification method and device and electronic equipment | |
| CN114692889A (en) | Meta-feature training model for machine learning algorithm | |
| CN110503296B (en) | Test method, test device, computer equipment and storage medium | |
| CN111814064A (en) | Abnormal user processing method and device based on Neo4j, computer equipment and medium | |
| CN117235633A (en) | Mechanism classification method, mechanism classification device, computer equipment and storage medium | |
| CN111147441A (en) | Method and device for automatically detecting fraud behaviors of online ticket purchasing and readable storage medium | |
| CN110598090A (en) | Interest tag generation method and device, computer equipment and storage medium | |
| CN113240323B (en) | Level evaluation method and device based on machine learning and related equipment | |
| CN114519612A (en) | Method and device for sending preferential information, computer equipment and storage medium | |
| CN112764923A (en) | Computing resource allocation method and device, computer equipment and storage medium | |
| CN114048392B (en) | Multimedia resource pushing method and device, electronic equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant |