CN112037052B - User behavior detection method and device - Google Patents
User behavior detection method and device Download PDFInfo
- Publication number
- CN112037052B CN112037052B CN202011218506.1A CN202011218506A CN112037052B CN 112037052 B CN112037052 B CN 112037052B CN 202011218506 A CN202011218506 A CN 202011218506A CN 112037052 B CN112037052 B CN 112037052B
- Authority
- CN
- China
- Prior art keywords
- data
- detection
- user behavior
- target
- configuration
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 360
- 230000002159 abnormal effect Effects 0.000 claims abstract description 17
- 230000006399 behavior Effects 0.000 claims description 208
- 238000012546 transfer Methods 0.000 claims description 84
- 238000013507 mapping Methods 0.000 claims description 66
- 230000003068 static effect Effects 0.000 claims description 30
- 230000002776 aggregation Effects 0.000 claims description 23
- 238000004220 aggregation Methods 0.000 claims description 23
- 238000011835 investigation Methods 0.000 claims description 13
- 238000000034 method Methods 0.000 claims description 10
- 230000007547 defect Effects 0.000 claims description 6
- 238000004590 computer program Methods 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000004364 calculation method Methods 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000010586 diagram Methods 0.000 description 1
- 239000000284 extract Substances 0.000 description 1
- 238000012545 processing Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G06Q40/03—Credit; Loans; Processing thereof
Landscapes
- Business, Economics & Management (AREA)
- Accounting & Taxation (AREA)
- Finance (AREA)
- Engineering & Computer Science (AREA)
- Development Economics (AREA)
- Economics (AREA)
- Marketing (AREA)
- Strategic Management (AREA)
- Technology Law (AREA)
- Physics & Mathematics (AREA)
- General Business, Economics & Management (AREA)
- General Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The user behavior detection method and device provided by the embodiment of the invention comprise the steps of firstly setting behavior labels for collected user behavior data, secondly setting corresponding label weighted values for the behavior labels corresponding to each group of user behavior data according to behavior data characteristics corresponding to each group of user behavior data, then determining multiple groups of initial detection thread configuration parameters based on the label weighted values, the behavior labels and the user behavior data characteristics, selecting at least multiple groups of target detection thread configuration parameters meeting set conditions to configure a current detection thread, finally obtaining the user behavior data to be detected and operating the current detection thread to detect the user behavior data to be detected to obtain a detection result, and judging whether the user behavior data to be detected is abnormal or not according to the detection result. Therefore, the configuration parameters of the target detection thread can be determined based on the user behavior data so as to configure the current detection thread, and therefore fraud detection can be accurately and quickly realized through the current detection thread.
Description
Technical Field
The invention relates to the technical field of user behavior detection, in particular to a user behavior detection method and device.
Background
With the development of internet technology, the online business is more and more mature. Taking credit service as an example, online credit service processing can be performed through service equipment such as a mobile phone and a tablet at the present stage. Therefore, anti-fraud detection for online credit services is critical to ensure that online credit services operate safely and stably. However, the existing credit anti-fraud technology is difficult to detect varied fraud, resulting in low accuracy and poor timeliness of fraud detection and fraud interception.
Disclosure of Invention
In order to solve the above problems, the present invention provides a method and an apparatus for detecting user behavior.
Based on the first aspect of the embodiments of the present invention, a user behavior detection method is provided, which is applied to a behavior detection server, and the method includes:
collecting a plurality of groups of user behavior data when the service equipment executes the target service application, and setting a behavior label for each group of user behavior data;
setting corresponding label weight values for the behavior labels corresponding to each group of user behavior data according to the behavior data characteristics corresponding to each group of user behavior data;
determining multiple groups of initial detection thread configuration parameters based on the label weight values, the behavior labels and the user behavior data characteristics, and selecting at least multiple groups of target detection thread configuration parameters meeting set conditions from the multiple groups of initial detection thread configuration parameters;
configuring a current detection thread for detecting user behavior data according to the target detection thread configuration parameters;
acquiring user behavior data to be detected and operating the current detection thread to detect the user behavior data to be detected and obtain a detection result; and judging whether the user behavior data to be detected is abnormal or not according to the detection result.
In an alternative implementation manner, when it is determined that the user behavior data to be detected is abnormal according to the detection result, the current service application corresponding to the user behavior data to be detected is refused to be responded.
In an alternative embodiment, the detecting the user behavior data to be detected to obtain a detection result includes:
carrying out multi-dimensional detection on the user behavior data to be detected through the current detection thread to obtain feature detection results of multiple dimensions;
determining each feature detection result, calculating an investigation rate corresponding to the feature detection result, and modifying the current configuration parameters of the feature detection result in the current detection thread when the investigation rate is lower than a set threshold value.
In an alternative embodiment, determining multiple sets of initial detection thread configuration parameters based on the tag weight values, the behavior tags, and the user behavior data characteristics, and selecting at least multiple sets of target detection thread configuration parameters meeting set conditions from the multiple sets of initial detection thread configuration parameters includes:
establishing a queue feature set corresponding to a two-dimensional mapping queue between the label weight value and the behavior label, and establishing a data feature set corresponding to the user behavior data; the queue feature set and the data feature set respectively comprise a plurality of set units with different feature identification degrees;
extracting memory resource data of a two-dimensional mapping queue between the label weight value and the behavior label in any set unit of the queue feature set, and determining the set unit with the minimum feature recognition degree in the data feature set as a target set unit;
mapping the memory resource data into the target set unit according to application category information and application transaction node information in the target service application to obtain resource mapping data in the target set unit, and generating a detection accuracy matching list between the two-dimensional mapping queue between the label weight value and the behavior label and the user behavior data according to the memory resource data and the resource mapping data;
acquiring detection hit rate data in the target aggregation unit by taking the resource mapping data as reference data, mapping the detection hit rate data to an aggregation unit where the memory resource data is located according to detection dimensions corresponding to the detection accuracy matching list and one-to-one matching paths of detection accuracy, acquiring detection confidence coefficient data corresponding to the detection hit rate data in the aggregation unit where the memory resource data is located, and determining the detection confidence coefficient data as thread configuration index data;
acquiring mapping log data of the memory resource data mapped to the target set unit; according to the association degrees between the detection confidence data and mapping defect data corresponding to a plurality of data nodes on the mapping log data, sequentially acquiring initial detection thread configuration parameters corresponding to the thread configuration index data layer by layer in the data feature set until the feature recognition degree of a set unit in which the acquired initial detection thread configuration parameters are located is consistent with the feature recognition degree of a set unit in which the thread configuration index data are in the queue feature set, stopping acquiring the initial detection thread configuration parameters in a next set unit, and selecting at least a plurality of groups of target detection thread configuration parameters from the acquired initial detection thread configuration parameters, wherein the corresponding detection hit rates are greater than a set probability and the memory resource occupation ratio is smaller than a set proportion.
In an alternative embodiment, configuring a current detection thread for detecting user behavior data according to the target detection thread configuration parameter includes:
acquiring a parameter distribution queue of the target detection thread configuration parameters and information of each configuration node;
under the condition that the target detection thread configuration parameters contain dynamic transfer parameter identifications according to the parameter distribution queue, determining the node association degree between each configuration node information of the target detection thread configuration parameters under the static transfer parameter identifications and each configuration node information under the dynamic transfer parameter identifications of the target detection thread configuration parameters according to the configuration node information of the target detection thread configuration parameters under the dynamic transfer parameter identifications and the configuration priority of the configuration node information, and adjusting the configuration node information of the target detection thread configuration parameters under the static transfer parameter identifications and the configuration node information under the dynamic transfer parameter identifications to be under the dynamic transfer parameter identifications;
under the condition that the target detection thread configuration parameter contains a plurality of discrete configuration node information under the current static transfer parameter identifier, determining the node association degree of the target detection thread configuration parameter among the discrete configuration node information under the current static transfer parameter identifier according to the configuration node information of the target detection thread configuration parameter under the dynamic transfer parameter identifier and the configuration priority of the configuration node information, and clustering the discrete configuration node information under the current static transfer parameter identifier according to the node association degree of the discrete configuration node information;
setting an adjustment weight for the target node information obtained by the clustering according to the configuration node information of the target detection thread configuration parameter under the dynamic transfer parameter identification and the configuration priority of the configuration node information, adjusting the target node information to be under the dynamic transfer parameter identification based on the adjustment weight, and configuring the current detection thread based on the configuration node information under the dynamic transfer parameter identification.
Based on the second aspect of the embodiments of the present invention, there is provided a user behavior detection apparatus, applied to a behavior detection server, the apparatus including:
the data acquisition module is used for acquiring a plurality of groups of user behavior data when the service equipment executes the target service application and setting a behavior label for each group of user behavior data;
the weight setting module is used for setting corresponding label weight values for the behavior labels corresponding to each group of user behavior data according to the behavior data characteristics corresponding to each group of user behavior data;
the configuration determining module is used for determining multiple groups of initial detection thread configuration parameters based on the label weight values, the behavior labels and the user behavior data characteristics, and selecting at least multiple groups of target detection thread configuration parameters meeting set conditions from the multiple groups of initial detection thread configuration parameters;
the thread configuration module is used for configuring a current detection thread for detecting the user behavior data according to the target detection thread configuration parameters;
the behavior detection module is used for acquiring behavior data of a user to be detected and operating the current detection thread so as to detect the behavior data of the user to be detected and obtain a detection result; and judging whether the user behavior data to be detected is abnormal or not according to the detection result.
In an alternative embodiment, the behavior detection module is configured to: and refusing to respond to the current service application corresponding to the user behavior data to be detected when the user behavior data to be detected is judged to be abnormal according to the detection result.
In an alternative embodiment, the behavior detection module is configured to:
carrying out multi-dimensional detection on the user behavior data to be detected through the current detection thread to obtain feature detection results of multiple dimensions;
determining each feature detection result, calculating an investigation rate corresponding to the feature detection result, and modifying the current configuration parameters of the feature detection result in the current detection thread when the investigation rate is lower than a set threshold value.
In an alternative embodiment, the configuration determining module is configured to:
establishing a queue feature set corresponding to a two-dimensional mapping queue between the label weight value and the behavior label, and establishing a data feature set corresponding to the user behavior data; the queue feature set and the data feature set respectively comprise a plurality of set units with different feature identification degrees;
extracting memory resource data of a two-dimensional mapping queue between the label weight value and the behavior label in any set unit of the queue feature set, and determining the set unit with the minimum feature recognition degree in the data feature set as a target set unit;
mapping the memory resource data into the target set unit according to application category information and application transaction node information in the target service application to obtain resource mapping data in the target set unit, and generating a detection accuracy matching list between the two-dimensional mapping queue between the label weight value and the behavior label and the user behavior data according to the memory resource data and the resource mapping data;
acquiring detection hit rate data in the target aggregation unit by taking the resource mapping data as reference data, mapping the detection hit rate data to an aggregation unit where the memory resource data is located according to detection dimensions corresponding to the detection accuracy matching list and one-to-one matching paths of detection accuracy, acquiring detection confidence coefficient data corresponding to the detection hit rate data in the aggregation unit where the memory resource data is located, and determining the detection confidence coefficient data as thread configuration index data;
acquiring mapping log data of the memory resource data mapped to the target set unit; according to the association degrees between the detection confidence data and mapping defect data corresponding to a plurality of data nodes on the mapping log data, sequentially acquiring initial detection thread configuration parameters corresponding to the thread configuration index data layer by layer in the data feature set until the feature recognition degree of a set unit in which the acquired initial detection thread configuration parameters are located is consistent with the feature recognition degree of a set unit in which the thread configuration index data are in the queue feature set, stopping acquiring the initial detection thread configuration parameters in a next set unit, and selecting at least a plurality of groups of target detection thread configuration parameters from the acquired initial detection thread configuration parameters, wherein the corresponding detection hit rates are greater than a set probability and the memory resource occupation ratio is smaller than a set proportion.
In an alternative embodiment, the thread configuration module is configured to:
acquiring a parameter distribution queue of the target detection thread configuration parameters and information of each configuration node;
under the condition that the target detection thread configuration parameters contain dynamic transfer parameter identifications according to the parameter distribution queue, determining the node association degree between each configuration node information of the target detection thread configuration parameters under the static transfer parameter identifications and each configuration node information under the dynamic transfer parameter identifications of the target detection thread configuration parameters according to the configuration node information of the target detection thread configuration parameters under the dynamic transfer parameter identifications and the configuration priority of the configuration node information, and adjusting the configuration node information of the target detection thread configuration parameters under the static transfer parameter identifications and the configuration node information under the dynamic transfer parameter identifications to be under the dynamic transfer parameter identifications;
under the condition that the target detection thread configuration parameter contains a plurality of discrete configuration node information under the current static transfer parameter identifier, determining the node association degree of the target detection thread configuration parameter among the discrete configuration node information under the current static transfer parameter identifier according to the configuration node information of the target detection thread configuration parameter under the dynamic transfer parameter identifier and the configuration priority of the configuration node information, and clustering the discrete configuration node information under the current static transfer parameter identifier according to the node association degree of the discrete configuration node information;
setting an adjustment weight for the target node information obtained by the clustering according to the configuration node information of the target detection thread configuration parameter under the dynamic transfer parameter identification and the configuration priority of the configuration node information, adjusting the target node information to be under the dynamic transfer parameter identification based on the adjustment weight, and configuring the current detection thread based on the configuration node information under the dynamic transfer parameter identification.
The user behavior detection method and device provided by the embodiment of the invention comprise the steps of firstly setting behavior labels for collected user behavior data, secondly setting corresponding label weighted values for the behavior labels corresponding to each group of user behavior data according to behavior data characteristics corresponding to each group of user behavior data, then determining multiple groups of initial detection thread configuration parameters based on the label weighted values, the behavior labels and the user behavior data characteristics, selecting at least multiple groups of target detection thread configuration parameters meeting set conditions to configure a current detection thread, finally obtaining the user behavior data to be detected and operating the current detection thread to detect the user behavior data to be detected to obtain a detection result, and judging whether the user behavior data to be detected is abnormal or not according to the detection result. Therefore, the configuration parameters of the target detection thread can be determined based on the user behavior data so as to configure the current detection thread, and therefore fraud detection can be accurately and quickly realized through the current detection thread.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings needed to be used in the embodiments will be briefly described below, it should be understood that the following drawings only illustrate some embodiments of the present invention and therefore should not be considered as limiting the scope, and for those skilled in the art, other related drawings can be obtained according to the drawings without inventive efforts.
Fig. 1 is a flowchart of a user behavior detection method according to an embodiment of the present invention.
Fig. 2 is a functional block diagram of a user behavior detection apparatus according to an embodiment of the present invention.
Detailed Description
In order to better understand the technical solutions of the present invention, the following detailed descriptions of the technical solutions of the present invention are provided with the accompanying drawings and the specific embodiments, and it should be understood that the specific features in the embodiments and the examples of the present invention are the detailed descriptions of the technical solutions of the present invention, and are not limitations of the technical solutions of the present invention, and the technical features in the embodiments and the examples of the present invention may be combined with each other without conflict.
To solve the technical problems in the prior art, an embodiment of the present invention provides a method and an apparatus for detecting user behavior, please refer to fig. 1, which shows a method for detecting user behavior, and specifically includes the following descriptions of step S110 to step S150.
Step S110, collecting multiple groups of user behavior data when the service device executes the target service application, and setting a behavior tag for each group of user behavior data.
For example, behavior tags may include: the application time, the application of the new or used version of the mobile phone system, the application of whether to use the root of the mobile phone, the application of the electric quantity state of the mobile phone, the application of the number of commonly used applications installed by using the mobile phone, the number of clicks in the application process, etc. are not limited herein. The target service application may be an online credit service application.
And step S120, setting corresponding label weight values for the behavior labels corresponding to each group of user behavior data according to the behavior data characteristics corresponding to each group of user behavior data.
For example, the value range of the tag weight value may be 0 to 100, and the tag weight value is used for representing a corresponding detection rule score of the behavior tag for subsequent fraud detection calculation.
Step S130, determining multiple sets of initial detection thread configuration parameters based on the tag weight values, the behavior tags, and the user behavior data characteristics, and selecting at least multiple sets of target detection thread configuration parameters meeting set conditions from the multiple sets of initial detection thread configuration parameters.
Step S140, configuring a current detection thread for detecting the user behavior data according to the target detection thread configuration parameter.
Step S150, acquiring user behavior data to be detected and operating the current detection thread to detect the user behavior data to be detected and obtain a detection result; and judging whether the user behavior data to be detected is abnormal or not according to the detection result.
It can be understood that based on the contents described in the above steps S110 to S150, firstly, behavior tags are set for the collected user behavior data, then, corresponding tag weight values are set for the behavior tags corresponding to each group of user behavior data according to behavior data characteristics corresponding to each group of user behavior data, then, at least multiple groups of target detection thread configuration parameters meeting set conditions are selected from multiple groups of initial detection thread configuration parameters based on the tag weight values, the behavior tags and the user behavior data characteristics, so as to configure a current detection thread, finally, the user behavior data to be detected is obtained and the current detection thread is operated to detect the user behavior data to be detected, so as to obtain a detection result, and whether the user behavior data to be detected is abnormal is determined according to the detection result. Therefore, the configuration parameters of the target detection thread can be determined based on the user behavior data so as to configure the current detection thread, and therefore fraud detection can be accurately and quickly realized through the current detection thread.
In a possible implementation manner, on the basis of step S150, the following steps may be further included: and refusing to respond to the current service application corresponding to the user behavior data to be detected when the user behavior data to be detected is judged to be abnormal according to the detection result.
It can be understood that when the user behavior data to be detected is abnormal, the current service application corresponding to the user behavior data to be detected can be determined as a fraud application, so that the current service application can be intercepted.
In a possible embodiment, in order to ensure the accuracy and reliability of the detection result, the detecting the user behavior data to be detected in step S150 to obtain the detection result specifically includes: carrying out multi-dimensional detection on the user behavior data to be detected through the current detection thread to obtain feature detection results of multiple dimensions; determining each feature detection result, calculating an investigation rate corresponding to the feature detection result, and modifying the current configuration parameters of the feature detection result in the current detection thread when the investigation rate is lower than a set threshold value.
In this embodiment, if the investigation rate is too low, it is considered whether there is another detection rule that can replace the detection rule, or whether the detection rule can be combined with another detection rule, and for this reason, the current configuration parameters of the feature detection result in the current detection thread are modified, so that the above purpose can be achieved, and the accuracy and reliability of the detection result are further ensured.
In a specific implementation, when the computer system resource is limited, the thread configuration parameters may need to be screened to improve the utilization rate of the computer system resource and ensure the detection accuracy of fraud credit, for this purpose, the method described in step S130 determines multiple sets of initial detection thread configuration parameters based on the tag weight values, the behavior tags and the user behavior data characteristics, and extracts at least multiple sets of target detection thread configuration parameters meeting the set conditions from the multiple sets of initial detection thread configuration parameters, which may specifically include the contents described in steps S131 to S135 below.
Step S131, constructing a queue feature set corresponding to a two-dimensional mapping queue between the label weight value and the behavior label, and constructing a data feature set corresponding to the user behavior data; the queue feature set and the data feature set respectively comprise a plurality of set units with different feature recognition degrees.
Step S132, extracting memory resource data of the two-dimensional mapping queue between the tag weight value and the behavior tag in any aggregation unit of the queue feature set, and determining an aggregation unit having a minimum feature recognition degree in the data feature set as a target aggregation unit.
Step S133, mapping the memory resource data to the target aggregation unit according to the application category information and the application transaction node information in the target service application, so as to obtain resource mapping data in the target aggregation unit, and generating a detection accuracy matching list between the two-dimensional mapping queue between the tag weight value and the behavior tag and the user behavior data according to the memory resource data and the resource mapping data.
Step S134, obtaining detection hit rate data in the target aggregation unit by using the resource mapping data as reference data, mapping the detection hit rate data to an aggregation unit where the memory resource data is located according to a detection dimension corresponding to the detection accuracy matching list and a one-to-one matching path of detection accuracy, obtaining detection confidence data corresponding to the detection hit rate data in the aggregation unit where the memory resource data is located, and determining the detection confidence data as thread configuration index data.
Step S135, obtaining mapping log data in which the memory resource data is mapped to the target set unit; according to the association degrees between the detection confidence data and mapping defect data corresponding to a plurality of data nodes on the mapping log data, sequentially acquiring initial detection thread configuration parameters corresponding to the thread configuration index data layer by layer in the data feature set until the feature recognition degree of a set unit in which the acquired initial detection thread configuration parameters are located is consistent with the feature recognition degree of a set unit in which the thread configuration index data are in the queue feature set, stopping acquiring the initial detection thread configuration parameters in a next set unit, and selecting at least a plurality of groups of target detection thread configuration parameters from the acquired initial detection thread configuration parameters, wherein the corresponding detection hit rates are greater than a set probability and the memory resource occupation ratio is smaller than a set proportion.
In this way, based on the steps S131 to S135, the thread configuration parameters can be filtered to improve the utilization rate of the computer system resources and ensure the detection accuracy of the fraud credit.
In an alternative embodiment, in order to ensure the running stability of the generated current detection thread, the configuration of the current detection thread for detecting the user behavior data according to the target detection thread configuration parameter, which is described in step S140, may specifically include what is described in the following step S141 to step S144.
Step S141, obtaining the parameter distribution queue of the target detection thread configuration parameters and the information of each configuration node.
Step S142, when it is determined that the target detection thread configuration parameter includes a dynamic transfer parameter identifier according to the parameter distribution queue, determining a node association degree between each configuration node information of the target detection thread configuration parameter under a static transfer parameter identifier and each configuration node information of the target detection thread configuration parameter under the dynamic transfer parameter identifier according to the configuration node information of the target detection thread configuration parameter under the dynamic transfer parameter identifier and a configuration priority of the configuration node information, and adjusting the configuration node information of the target detection thread configuration parameter under the static transfer parameter identifier and associated with the configuration node information under the dynamic transfer parameter identifier to be under the dynamic transfer parameter identifier.
Step S143, when the target detection thread configuration parameter includes a plurality of discrete configuration node information under the current static transfer parameter identifier, determining a node association degree between the discrete configuration node information under the current static transfer parameter identifier of the target detection thread configuration parameter according to the configuration node information under the dynamic transfer parameter identifier of the target detection thread configuration parameter and the configuration priority of the configuration node information, and clustering the discrete configuration node information under the current static transfer parameter identifier according to the node association degree between the discrete configuration node information.
Step S144, setting an adjustment weight for the target node information obtained by the above-mentioned cluster according to the configuration node information of the target detection thread configuration parameter under the dynamic transfer parameter identifier and the configuration priority of the configuration node information, adjusting the target node information to the dynamic transfer parameter identifier based on the adjustment weight, and configuring the current detection thread based on the configuration node information under the dynamic transfer parameter identifier.
It is understood that by performing the above steps S141 to S144, the running stability of the generated currently detected thread can be ensured.
Based on the same inventive concept as above, please refer to fig. 2, there is provided a user behavior detection apparatus 200, applied to a behavior detection server, the apparatus comprising:
the data acquisition module 210 is configured to acquire multiple sets of user behavior data of a service device when executing a target service application, and set a behavior tag for each set of user behavior data;
the weight setting module 220 is configured to set a corresponding label weight value for the behavior label corresponding to each group of user behavior data according to the behavior data characteristic corresponding to each group of user behavior data;
a configuration determining module 230, configured to determine multiple sets of initial detection thread configuration parameters based on the tag weight values, the behavior tags, and the user behavior data characteristics, and select at least multiple sets of target detection thread configuration parameters meeting set conditions from the multiple sets of initial detection thread configuration parameters;
a thread configuration module 240, configured to configure, according to the target detection thread configuration parameter, a current detection thread for detecting user behavior data;
a behavior detection module 250, configured to acquire user behavior data to be detected and run the current detection thread, so as to detect the user behavior data to be detected and obtain a detection result; and judging whether the user behavior data to be detected is abnormal or not according to the detection result.
In an alternative embodiment, the behavior detection module 250 is configured to: and refusing to respond to the current service application corresponding to the user behavior data to be detected when the user behavior data to be detected is judged to be abnormal according to the detection result.
In an alternative embodiment, the behavior detection module 250 is configured to:
carrying out multi-dimensional detection on the user behavior data to be detected through the current detection thread to obtain feature detection results of multiple dimensions;
determining each feature detection result, calculating an investigation rate corresponding to the feature detection result, and modifying the current configuration parameters of the feature detection result in the current detection thread when the investigation rate is lower than a set threshold value.
In an alternative embodiment, the configuration determining module 230 is configured to:
establishing a queue feature set corresponding to a two-dimensional mapping queue between the label weight value and the behavior label, and establishing a data feature set corresponding to the user behavior data; the queue feature set and the data feature set respectively comprise a plurality of set units with different feature identification degrees;
extracting memory resource data of a two-dimensional mapping queue between the label weight value and the behavior label in any set unit of the queue feature set, and determining the set unit with the minimum feature recognition degree in the data feature set as a target set unit;
mapping the memory resource data into the target set unit according to application category information and application transaction node information in the target service application to obtain resource mapping data in the target set unit, and generating a detection accuracy matching list between the two-dimensional mapping queue between the label weight value and the behavior label and the user behavior data according to the memory resource data and the resource mapping data;
acquiring detection hit rate data in the target aggregation unit by taking the resource mapping data as reference data, mapping the detection hit rate data to an aggregation unit where the memory resource data is located according to detection dimensions corresponding to the detection accuracy matching list and one-to-one matching paths of detection accuracy, acquiring detection confidence coefficient data corresponding to the detection hit rate data in the aggregation unit where the memory resource data is located, and determining the detection confidence coefficient data as thread configuration index data;
acquiring mapping log data of the memory resource data mapped to the target set unit; according to the association degrees between the detection confidence data and mapping defect data corresponding to a plurality of data nodes on the mapping log data, sequentially acquiring initial detection thread configuration parameters corresponding to the thread configuration index data layer by layer in the data feature set until the feature recognition degree of a set unit in which the acquired initial detection thread configuration parameters are located is consistent with the feature recognition degree of a set unit in which the thread configuration index data are in the queue feature set, stopping acquiring the initial detection thread configuration parameters in a next set unit, and selecting at least a plurality of groups of target detection thread configuration parameters from the acquired initial detection thread configuration parameters, wherein the corresponding detection hit rates are greater than a set probability and the memory resource occupation ratio is smaller than a set proportion.
In an alternative embodiment, the thread configuration module 240 is configured to:
acquiring a parameter distribution queue of the target detection thread configuration parameters and information of each configuration node;
under the condition that the target detection thread configuration parameters contain dynamic transfer parameter identifications according to the parameter distribution queue, determining the node association degree between each configuration node information of the target detection thread configuration parameters under the static transfer parameter identifications and each configuration node information under the dynamic transfer parameter identifications of the target detection thread configuration parameters according to the configuration node information of the target detection thread configuration parameters under the dynamic transfer parameter identifications and the configuration priority of the configuration node information, and adjusting the configuration node information of the target detection thread configuration parameters under the static transfer parameter identifications and the configuration node information under the dynamic transfer parameter identifications to be under the dynamic transfer parameter identifications;
under the condition that the target detection thread configuration parameter contains a plurality of discrete configuration node information under the current static transfer parameter identifier, determining the node association degree of the target detection thread configuration parameter among the discrete configuration node information under the current static transfer parameter identifier according to the configuration node information of the target detection thread configuration parameter under the dynamic transfer parameter identifier and the configuration priority of the configuration node information, and clustering the discrete configuration node information under the current static transfer parameter identifier according to the node association degree of the discrete configuration node information;
setting an adjustment weight for the target node information obtained by the clustering according to the configuration node information of the target detection thread configuration parameter under the dynamic transfer parameter identification and the configuration priority of the configuration node information, adjusting the target node information to be under the dynamic transfer parameter identification based on the adjustment weight, and configuring the current detection thread based on the configuration node information under the dynamic transfer parameter identification.
Based on the same inventive concept, there is also provided a behavior detection server comprising a processor and a memory in communication with each other. Wherein the processor is configured to retrieve the computer program from the memory and execute the computer program to implement the method shown in fig. 2.
To sum up, the user behavior detection method and apparatus provided in the embodiments of the present invention first set a behavior tag for the collected user behavior data, then set a corresponding tag weight value for the behavior tag corresponding to each group of user behavior data according to the behavior data characteristics corresponding to each group of user behavior data, then determine, based on the tag weight value, the behavior tag, and the user behavior data characteristics, multiple groups of initial detection thread configuration parameters to select at least multiple groups of target detection thread configuration parameters that meet the set conditions, and further configure the current detection thread, finally obtain the user behavior data to be detected and run the current detection thread to detect the user behavior data to obtain a detection result, and determine whether the user behavior data to be detected is abnormal according to the detection result. Therefore, the configuration parameters of the target detection thread can be determined based on the user behavior data so as to configure the current detection thread, and therefore fraud detection can be accurately and quickly realized through the current detection thread.
The above are merely examples of the present application and are not intended to limit the present application. Various modifications and changes may occur to those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.
Claims (8)
1. A user behavior detection method is applied to a behavior detection server, and comprises the following steps:
collecting a plurality of groups of user behavior data when the service equipment executes the target service application, and setting a behavior label for each group of user behavior data;
setting corresponding label weight values for the behavior labels corresponding to each group of user behavior data according to the behavior data characteristics corresponding to each group of user behavior data;
determining multiple groups of initial detection thread configuration parameters based on the label weight values, the behavior labels and the user behavior data characteristics, and selecting at least multiple groups of target detection thread configuration parameters meeting set conditions from the multiple groups of initial detection thread configuration parameters;
configuring a current detection thread for detecting user behavior data according to the target detection thread configuration parameters;
acquiring user behavior data to be detected and operating the current detection thread to detect the user behavior data to be detected and obtain a detection result; judging whether the user behavior data to be detected is abnormal or not according to the detection result;
determining multiple groups of initial detection thread configuration parameters based on the label weight values, the behavior labels and the user behavior data characteristics, and selecting at least multiple groups of target detection thread configuration parameters meeting set conditions from the multiple groups of initial detection thread configuration parameters, including:
establishing a queue feature set corresponding to a two-dimensional mapping queue between the label weight value and the behavior label, and establishing a data feature set corresponding to the user behavior data; the queue feature set and the data feature set respectively comprise a plurality of set units with different feature identification degrees;
extracting memory resource data of a two-dimensional mapping queue between the label weight value and the behavior label in any set unit of the queue feature set, and determining the set unit with the minimum feature recognition degree in the data feature set as a target set unit;
mapping the memory resource data into the target set unit according to application category information and application transaction node information in the target service application to obtain resource mapping data in the target set unit, and generating a detection accuracy matching list between the two-dimensional mapping queue between the label weight value and the behavior label and the user behavior data according to the memory resource data and the resource mapping data;
acquiring detection hit rate data in the target aggregation unit by taking the resource mapping data as reference data, mapping the detection hit rate data to an aggregation unit where the memory resource data is located according to detection dimensions corresponding to the detection accuracy matching list and one-to-one matching paths of detection accuracy, acquiring detection confidence coefficient data corresponding to the detection hit rate data in the aggregation unit where the memory resource data is located, and determining the detection confidence coefficient data as thread configuration index data;
acquiring mapping log data of the memory resource data mapped to the target set unit; according to the association degrees between the detection confidence data and mapping defect data corresponding to a plurality of data nodes on the mapping log data, sequentially acquiring initial detection thread configuration parameters corresponding to the thread configuration index data layer by layer in the data feature set until the feature recognition degree of a set unit in which the acquired initial detection thread configuration parameters are located is consistent with the feature recognition degree of a set unit in which the thread configuration index data are in the queue feature set, stopping acquiring the initial detection thread configuration parameters in a next set unit, and selecting at least a plurality of groups of target detection thread configuration parameters from the acquired initial detection thread configuration parameters, wherein the corresponding detection hit rates are greater than a set probability and the memory resource occupation ratio is smaller than a set proportion.
2. The method according to claim 1, wherein when it is determined according to the detection result that the user behavior data to be detected is abnormal, the current service application corresponding to the user behavior data to be detected is refused to be responded.
3. The method according to claim 1, wherein the detecting the user behavior data to be detected to obtain a detection result comprises:
carrying out multi-dimensional detection on the user behavior data to be detected through the current detection thread to obtain feature detection results of multiple dimensions;
determining each feature detection result, calculating an investigation rate corresponding to the feature detection result, and modifying the current configuration parameters of the feature detection result in the current detection thread when the investigation rate is lower than a set threshold value.
4. The method of claim 1, wherein configuring a current detection thread for detecting user behavior data according to the target detection thread configuration parameters comprises:
acquiring a parameter distribution queue of the target detection thread configuration parameters and information of each configuration node;
under the condition that the target detection thread configuration parameters contain dynamic transfer parameter identifications according to the parameter distribution queue, determining the node association degree between each configuration node information of the target detection thread configuration parameters under the static transfer parameter identifications and each configuration node information under the dynamic transfer parameter identifications of the target detection thread configuration parameters according to the configuration node information of the target detection thread configuration parameters under the dynamic transfer parameter identifications and the configuration priority of the configuration node information, and adjusting the configuration node information of the target detection thread configuration parameters under the static transfer parameter identifications and the configuration node information under the dynamic transfer parameter identifications to be under the dynamic transfer parameter identifications;
under the condition that the target detection thread configuration parameter contains a plurality of discrete configuration node information under the current static transfer parameter identifier, determining the node association degree of the target detection thread configuration parameter among the discrete configuration node information under the current static transfer parameter identifier according to the configuration node information of the target detection thread configuration parameter under the dynamic transfer parameter identifier and the configuration priority of the configuration node information, and clustering the discrete configuration node information under the current static transfer parameter identifier according to the node association degree of the discrete configuration node information;
setting an adjustment weight for the target node information obtained by the clustering according to the configuration node information of the target detection thread configuration parameter under the dynamic transfer parameter identification and the configuration priority of the configuration node information, adjusting the target node information to be under the dynamic transfer parameter identification based on the adjustment weight, and configuring the current detection thread based on the configuration node information under the dynamic transfer parameter identification.
5. A user behavior detection device, applied to a behavior detection server, the device comprising:
the data acquisition module is used for acquiring a plurality of groups of user behavior data when the service equipment executes the target service application and setting a behavior label for each group of user behavior data;
the weight setting module is used for setting corresponding label weight values for the behavior labels corresponding to each group of user behavior data according to the behavior data characteristics corresponding to each group of user behavior data;
the configuration determining module is used for determining multiple groups of initial detection thread configuration parameters based on the label weight values, the behavior labels and the user behavior data characteristics, and selecting at least multiple groups of target detection thread configuration parameters meeting set conditions from the multiple groups of initial detection thread configuration parameters;
the thread configuration module is used for configuring a current detection thread for detecting the user behavior data according to the target detection thread configuration parameters;
the behavior detection module is used for acquiring behavior data of a user to be detected and operating the current detection thread so as to detect the behavior data of the user to be detected and obtain a detection result; judging whether the user behavior data to be detected is abnormal or not according to the detection result;
wherein the configuration determining module is configured to:
establishing a queue feature set corresponding to a two-dimensional mapping queue between the label weight value and the behavior label, and establishing a data feature set corresponding to the user behavior data; the queue feature set and the data feature set respectively comprise a plurality of set units with different feature identification degrees;
extracting memory resource data of a two-dimensional mapping queue between the label weight value and the behavior label in any set unit of the queue feature set, and determining the set unit with the minimum feature recognition degree in the data feature set as a target set unit;
mapping the memory resource data into the target set unit according to application category information and application transaction node information in the target service application to obtain resource mapping data in the target set unit, and generating a detection accuracy matching list between the two-dimensional mapping queue between the label weight value and the behavior label and the user behavior data according to the memory resource data and the resource mapping data;
acquiring detection hit rate data in the target aggregation unit by taking the resource mapping data as reference data, mapping the detection hit rate data to an aggregation unit where the memory resource data is located according to detection dimensions corresponding to the detection accuracy matching list and one-to-one matching paths of detection accuracy, acquiring detection confidence coefficient data corresponding to the detection hit rate data in the aggregation unit where the memory resource data is located, and determining the detection confidence coefficient data as thread configuration index data;
acquiring mapping log data of the memory resource data mapped to the target set unit; according to the association degrees between the detection confidence data and mapping defect data corresponding to a plurality of data nodes on the mapping log data, sequentially acquiring initial detection thread configuration parameters corresponding to the thread configuration index data layer by layer in the data feature set until the feature recognition degree of a set unit in which the acquired initial detection thread configuration parameters are located is consistent with the feature recognition degree of a set unit in which the thread configuration index data are in the queue feature set, stopping acquiring the initial detection thread configuration parameters in a next set unit, and selecting at least a plurality of groups of target detection thread configuration parameters from the acquired initial detection thread configuration parameters, wherein the corresponding detection hit rates are greater than a set probability and the memory resource occupation ratio is smaller than a set proportion.
6. The apparatus of claim 5, wherein the behavior detection module is configured to: and refusing to respond to the current service application corresponding to the user behavior data to be detected when the user behavior data to be detected is judged to be abnormal according to the detection result.
7. The apparatus of claim 5, wherein the behavior detection module is configured to:
carrying out multi-dimensional detection on the user behavior data to be detected through the current detection thread to obtain feature detection results of multiple dimensions;
determining each feature detection result, calculating an investigation rate corresponding to the feature detection result, and modifying the current configuration parameters of the feature detection result in the current detection thread when the investigation rate is lower than a set threshold value.
8. The apparatus of claim 5, wherein the thread configuration module is configured to:
acquiring a parameter distribution queue of the target detection thread configuration parameters and information of each configuration node;
under the condition that the target detection thread configuration parameters contain dynamic transfer parameter identifications according to the parameter distribution queue, determining the node association degree between each configuration node information of the target detection thread configuration parameters under the static transfer parameter identifications and each configuration node information under the dynamic transfer parameter identifications of the target detection thread configuration parameters according to the configuration node information of the target detection thread configuration parameters under the dynamic transfer parameter identifications and the configuration priority of the configuration node information, and adjusting the configuration node information of the target detection thread configuration parameters under the static transfer parameter identifications and the configuration node information under the dynamic transfer parameter identifications to be under the dynamic transfer parameter identifications;
under the condition that the target detection thread configuration parameter contains a plurality of discrete configuration node information under the current static transfer parameter identifier, determining the node association degree of the target detection thread configuration parameter among the discrete configuration node information under the current static transfer parameter identifier according to the configuration node information of the target detection thread configuration parameter under the dynamic transfer parameter identifier and the configuration priority of the configuration node information, and clustering the discrete configuration node information under the current static transfer parameter identifier according to the node association degree of the discrete configuration node information;
setting an adjustment weight for the target node information obtained by the clustering according to the configuration node information of the target detection thread configuration parameter under the dynamic transfer parameter identification and the configuration priority of the configuration node information, adjusting the target node information to be under the dynamic transfer parameter identification based on the adjustment weight, and configuring the current detection thread based on the configuration node information under the dynamic transfer parameter identification.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011218506.1A CN112037052B (en) | 2020-11-04 | 2020-11-04 | User behavior detection method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011218506.1A CN112037052B (en) | 2020-11-04 | 2020-11-04 | User behavior detection method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112037052A CN112037052A (en) | 2020-12-04 |
| CN112037052B true CN112037052B (en) | 2021-01-26 |
Family
ID=73572946
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011218506.1A Active CN112037052B (en) | 2020-11-04 | 2020-11-04 | User behavior detection method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112037052B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113599776A (en) * | 2021-08-05 | 2021-11-05 | 北京理工大学 | Real-time push-up counting and standard judging method and system |
| CN115168917B (en) * | 2022-07-07 | 2023-09-22 | 大唐智创(山东)科技有限公司 | Abnormal user behavior processing method of cloud computing service and server |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110795217A (en) * | 2019-09-27 | 2020-02-14 | 广东浪潮大数据研究有限公司 | Task allocation method and system based on resource management platform |
| CN111368154A (en) * | 2020-05-26 | 2020-07-03 | 上海冰鉴信息科技有限公司 | Index information determination method and index information determination device |
Family Cites Families (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105893406A (en) * | 2015-11-12 | 2016-08-24 | 乐视云计算有限公司 | Group user profiling method and system |
| CN109345260B (en) * | 2018-10-09 | 2021-11-30 | 北京芯盾时代科技有限公司 | Method for detecting abnormal operation behavior |
| CN109829721B (en) * | 2019-02-13 | 2023-06-06 | 同济大学 | Online transaction multi-subject behavior modeling method based on heterogeneous network characterization learning |
| CN110796497A (en) * | 2019-10-31 | 2020-02-14 | 支付宝(杭州)信息技术有限公司 | Method and device for detecting abnormal operation behaviors |
| CN111291015B (en) * | 2020-04-28 | 2020-08-07 | 国网电子商务有限公司 | User behavior abnormity detection method and device |
-
2020
- 2020-11-04 CN CN202011218506.1A patent/CN112037052B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110795217A (en) * | 2019-09-27 | 2020-02-14 | 广东浪潮大数据研究有限公司 | Task allocation method and system based on resource management platform |
| CN111368154A (en) * | 2020-05-26 | 2020-07-03 | 上海冰鉴信息科技有限公司 | Index information determination method and index information determination device |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112037052A (en) | 2020-12-04 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN103117903B (en) | Surfing flow method for detecting abnormality and device | |
| CN109729131B (en) | Application request processing method and device and router | |
| TWI693527B (en) | Position information processing method and device | |
| CN110597719B (en) | Image clustering method, device and medium for adaptation test | |
| CN112037052B (en) | User behavior detection method and device | |
| CN112181767A (en) | Method and device for determining software system exception and storage medium | |
| CN111984383B (en) | Service data processing method and cloud platform based on cloud network fusion and artificial intelligence | |
| CN110909222A (en) | User portrait establishing method, device, medium and electronic equipment based on clustering | |
| CN112182007A (en) | Cloud computing data processing method based on artificial intelligence and artificial intelligence platform | |
| CN111259952A (en) | Abnormal user identification method and device, computer equipment and storage medium | |
| CN113313479A (en) | Payment service big data processing method and system based on artificial intelligence | |
| CN114978877A (en) | Exception handling method and device, electronic equipment and computer readable medium | |
| CN113254250B (en) | Database server abnormal cause detection method, device, equipment and storage medium | |
| CN110751354B (en) | Abnormal user detection method and device | |
| CN113765850B (en) | Internet of things abnormality detection method and device, computing equipment and computer storage medium | |
| CN113743968A (en) | Information delivery method, device and equipment | |
| CN114301821B (en) | Module testing method, device, terminal and computer readable storage medium | |
| CN111814909B (en) | Information processing method based on network live broadcast and online e-commerce delivery and cloud server | |
| CN111258788B (en) | Disk failure prediction method, device and computer readable storage medium | |
| CN112312590B (en) | Equipment communication protocol identification method and device | |
| CN110837894B (en) | Feature processing method, device and storage medium | |
| CN114444514A (en) | Semantic matching model training method, semantic matching method and related device | |
| CN115049446A (en) | Merchant identification method and device, electronic equipment and computer readable medium | |
| CN112003733A (en) | Comprehensive management method and management platform for smart park Internet of things | |
| CN115529271B (en) | Service request distribution method, device, equipment and medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |