CN112221156A

CN112221156A - Data abnormality recognition method, data abnormality recognition device, storage medium, and electronic device

Info

Publication number: CN112221156A
Application number: CN202011166127.2A
Authority: CN
Inventors: 陈观钦; 陈健柯; 何施慧; 陈远; 王摘星; 刘恩吏
Original assignee: Tencent Technology Shenzhen Co Ltd
Current assignee: Tencent Technology Shenzhen Co Ltd
Priority date: 2020-10-27
Filing date: 2020-10-27
Publication date: 2021-01-15
Anticipated expiration: 2040-10-27
Also published as: CN112221156B

Abstract

The invention discloses a data anomaly identification method and device, a storage medium and electronic equipment. Wherein, the method comprises the following steps: acquiring a data identification request; responding to the data identification request, and acquiring attribute statistical characteristics and behavior sequence data corresponding to log data, wherein the attribute statistical characteristics comprise characteristics obtained by respectively counting parameter changes of a plurality of attribute parameters associated with the target account in a target time period, and the behavior sequence data comprise time sequence data of behaviors executed by a virtual object controlled by the target account in the target time period; inputting the attribute statistical characteristics into a conversion model to obtain attribute combination characteristics output by the conversion model; and inputting the attribute combination features, the attribute statistical features and the behavior sequence data into the recognition model to obtain a data recognition result output by the recognition model. The invention solves the technical problem of low accuracy of data anomaly identification.

Description

Data abnormality recognition method, data abnormality recognition device, storage medium, and electronic device

Technical Field

The invention relates to the field of computers, in particular to a data anomaly identification method and device, a storage medium and electronic equipment.

Background

In many game applications, in order to ensure the fairness of the game, it is often determined whether a game player is an abnormal player based on determining whether log data generated by historical game behaviors of different players is abnormal.

In the related art, in the face of the abnormal recognition of the log data, some features are designed manually through understanding business knowledge, the features with fixed dimensionality are obtained after feature selection is carried out, and then the characteristics of high-quality players in the data are learned through constructing a machine learning model form based on the designed features.

However, the characteristics of manual design cannot take into consideration the combination characteristics among the changes of the attributes of the players and the sequence characteristics among the time-series behaviors of the players, so that the problem of low accuracy in identifying the abnormal log data exists.

In view of the above problems, no effective solution has been proposed.

Disclosure of Invention

The embodiment of the invention provides a data anomaly identification method, a data anomaly identification device, a storage medium and electronic equipment, and at least solves the technical problem of low accuracy of data anomaly identification.

According to an aspect of an embodiment of the present invention, there is provided a data anomaly identification method, including: acquiring a data identification request, wherein the data identification request is used for requesting and confirming whether log data generated by a target account in a target game application in a target time period is abnormal or not; responding to the data identification request, acquiring attribute statistical characteristics and behavior sequence data corresponding to the log data, wherein the attribute statistical characteristics comprise characteristics obtained by respectively counting parameter changes of a plurality of attribute parameters associated with the target account in the target time period, and the behavior sequence data comprise time sequence data of behaviors executed by a virtual object controlled by the target account in the target time period; inputting the attribute statistical characteristics into a conversion model to obtain attribute combination characteristics output by the conversion model, wherein the conversion model is used for converting the input characteristics into output characteristics of characteristic combination information with decision tree characteristics; inputting the attribute combination feature, the attribute statistical feature and the behavior sequence data into a recognition model to obtain a data recognition result output by the recognition model, wherein the data recognition result is used for indicating whether the log data is abnormal, and the recognition model comprises a first fusion structure for fusing the attribute combination feature and the attribute statistical feature to obtain a first fusion feature, a second fusion structure for fusing the first fusion feature and the behavior sequence data to obtain a second fusion feature, and a recognition structure for recognizing whether the log data is abnormal by using the second fusion feature.

According to another aspect of the embodiments of the present invention, there is also provided a data anomaly identification apparatus, including: the system comprises an acquisition unit, a processing unit and a processing unit, wherein the acquisition unit is used for acquiring a data identification request which is used for requesting to confirm whether log data generated by a target account in a target game application in a target time period is abnormal or not; a response unit, configured to respond to the data identification request, and acquire an attribute statistical feature and behavior sequence data corresponding to the log data, where the attribute statistical feature includes a feature obtained by respectively counting parameter changes of a plurality of attribute parameters associated with the target account within the target time period, and the behavior sequence data includes time sequence data of a behavior executed by a virtual object controlled by the target account within the target time period; a first input unit, configured to input the attribute statistical features into a conversion model to obtain attribute combination features output by the conversion model, where the conversion model is used to convert input features into output features of feature combination information with decision tree characteristics; and a second input unit configured to input the attribute combination feature, the attribute statistical feature, and the behavior sequence data into a recognition model to obtain a data recognition result output by the recognition model, wherein the data recognition result indicates whether the log data is abnormal, and the recognition model includes a first fusion structure configured to fuse the attribute combination feature and the attribute statistical feature to obtain a first fusion feature, a second fusion structure configured to fuse the first fusion feature and the behavior sequence data to obtain a second fusion feature, and a recognition structure configured to recognize whether the log data is abnormal using the second fusion feature.

According to another aspect of the embodiments of the present invention, there is also provided a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the above data anomaly identification method when running.

According to another aspect of the embodiments of the present invention, there is also provided an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the data anomaly identification method through the computer program.

In the embodiment of the invention, a data identification request is acquired, wherein the data identification request is used for requesting to confirm whether log data generated by a target account in a target game application in a target time period is abnormal or not; responding to the data identification request, acquiring attribute statistical characteristics and behavior sequence data corresponding to the log data, wherein the attribute statistical characteristics comprise characteristics obtained by respectively counting parameter changes of a plurality of attribute parameters associated with the target account in the target time period, and the behavior sequence data comprise time sequence data of behaviors executed by a virtual object controlled by the target account in the target time period; inputting the attribute statistical characteristics into a conversion model to obtain attribute combination characteristics output by the conversion model, wherein the conversion model is used for converting the input characteristics into output characteristics of characteristic combination information with decision tree characteristics; inputting the attribute combination feature, the attribute statistical feature and the behavior sequence data into a recognition model to obtain a data recognition result output by the recognition model, wherein the data recognition result is used for indicating whether the log data is abnormal, the recognition model comprises a first fusion structure for fusing the attribute combination feature and the attribute statistical feature to obtain a first fusion feature, a second fusion structure for fusing the first fusion feature and the behavior sequence data to obtain a second fusion feature, and a recognition structure for recognizing whether the log data is abnormal by using the second fusion feature, firstly using a conversion model and the obtained attribute statistical feature to obtain an attribute combination feature with stronger discretization and combination capability, and simultaneously fusing the attribute statistical feature and the attribute combination feature so that the output first fusion feature has the advantage of high correlation specific to the attribute statistical feature, original feature information is recorded due to the attribute statistical features, so that the problem of information loss possibly occurring in the follow-up process is solved for the acquired first fusion features; furthermore, the identification model is reused to fuse the acquired behavior sequence data and the first fusion characteristic, and the behavior sequence data has key and rich voice characteristics for judging data abnormity and is complementary with the first fusion characteristic, so that the output second fusion characteristic combines the retained original information of the attribute statistical characteristic, the high correlation of the attribute combination characteristic and the rich advantages of the behavior sequence data, and further the purpose of enabling the characteristics for acquiring the data identification result to be more robust is achieved, the effect of improving the accuracy of data abnormity identification is realized, and the technical problem of low accuracy of data abnormity identification is solved.

Drawings

The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this application, illustrate embodiment(s) of the invention and together with the description serve to explain the invention without limiting the invention. In the drawings:

FIG. 1 is a schematic diagram of an application environment of an alternative data anomaly identification method according to an embodiment of the invention;

FIG. 2 is a schematic diagram of a flow chart of an alternative data anomaly identification method according to an embodiment of the present invention;

FIG. 3 is a schematic diagram of an alternative data anomaly identification method according to an embodiment of the present invention;

FIG. 4 is a schematic diagram of an alternative data anomaly identification method according to an embodiment of the present invention;

FIG. 5 is a schematic diagram of an alternative data anomaly identification method according to an embodiment of the present invention;

FIG. 6 is a schematic diagram of an alternative data anomaly identification method according to an embodiment of the present invention;

FIG. 7 is a schematic diagram of an alternative data anomaly identification method according to an embodiment of the present invention;

FIG. 8 is a schematic diagram of an alternative data anomaly identification method according to an embodiment of the present invention;

FIG. 9 is a schematic diagram of an alternative data anomaly identification method according to an embodiment of the present invention;

FIG. 10 is a schematic diagram of an alternative data anomaly identification method according to an embodiment of the present invention;

FIG. 11 is a schematic diagram of an alternative data anomaly identification method according to an embodiment of the present invention;

FIG. 12 is a schematic diagram of an alternative data anomaly identification method according to an embodiment of the present invention;

FIG. 13 is a schematic diagram of an alternative data anomaly identification apparatus according to an embodiment of the present invention;

fig. 14 is a schematic structural diagram of an alternative electronic device according to an embodiment of the invention.

Detailed Description

In order to make the technical solutions of the present invention better understood, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

It should be noted that the terms "first," "second," and the like in the description and claims of the present invention and in the drawings described above are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the invention described herein are capable of operation in sequences other than those illustrated or described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.

In the embodiments of the present application, the following technical terms may be used, but are not limited to:

artificial Intelligence (AI) is a theory, method, technique and application system that uses a digital computer or a machine controlled by a digital computer to simulate, extend and expand human Intelligence, perceive the environment, acquire knowledge and use the knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technique of computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can react in a manner similar to human intelligence. Artificial intelligence is the research of the design principle and the realization method of various intelligent machines, so that the machines have the functions of perception, reasoning and decision making.

The artificial intelligence technology is a comprehensive subject and relates to the field of extensive technology, namely the technology of a hardware level and the technology of a software level. The artificial intelligence infrastructure generally includes technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technologies, operation/interaction systems, mechatronics, and the like. The artificial intelligence software technology mainly comprises a computer vision technology, a voice processing technology, a natural language processing technology, machine learning/deep learning and the like.

Machine Learning (ML for short) is a multi-domain cross subject, and relates to multiple subjects such as probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory and the like. The special research on how a computer simulates or realizes the learning behavior of human beings so as to acquire new knowledge or skills and reorganize the existing knowledge structure to continuously improve the performance of the computer. Machine learning is the core of artificial intelligence, is the fundamental approach for computers to have intelligence, and is applied to all fields of artificial intelligence. Machine learning and deep learning generally include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and formal education learning.

Convolutional Neural Networks (CNN) are a type of feed-forward Neural network with a deep structure that includes convolution calculations, and are one of deep learning algorithms. The method has the characteristic learning capability, and can carry out translation invariant classification on the input information according to the hierarchical structure. The hidden layer of the convolutional neural network comprises a convolutional layer, a pooling layer and a full-connection layer, and a convolutional core in the convolutional layer comprises a weight coefficient.

Multi-scale one-dimensional CNN structure: the multi-scale system comprises a feature embedding module and a CNN feature extraction module, and represents richer and more comprehensive feature information from various angles. In the feature embedding module, input sequence data is converted into dense feature vector sequences and then combined into feature information in a matrix form, rows represent vector representations of each sequence point, and columns represent lengths of the row sequences. In the CNN feature extraction module, convolution of windows with different widths (also called different scales) is respectively adopted to extract features of n-grams (convolution kernels), and high-level key features with different scales are extracted hierarchically through multi-layer one-dimensional convolution CNN.

According to an aspect of the embodiments of the present invention, a data anomaly identification method is provided, and optionally, as an optional implementation manner, the data anomaly identification method may be applied to, but is not limited to, a data anomaly identification system in a hardware environment as shown in fig. 1, where the data anomaly identification system may include, but is not limited to, a terminal device 102, a network 104, and a server 106. A target game application client (e.g., a game application client) is running in the terminal device 102. The terminal device 102 includes a human-machine interaction screen 1022, a processor 1024, and a memory 1026. The man-machine interaction screen 1022 is used for presenting an application interface (such as a game application interface) of the target game application client, and is also used for providing a man-machine interaction interface to receive man-machine interaction operations performed on the man-machine interaction interface; the processor 1024 is configured to obtain a human-computer interaction instruction in response to the human-computer interaction operation, and transmit the human-computer interaction instruction to the server 106. The memory 108 is used for storing log data generated by the target account number in the game application.

The server 106 includes a database 1062 and a processing engine 1064, and the database 1062 is used to store log data of each account, and attribute statistical features and behavior sequence data corresponding to the log data. The processing engine 1064 is used to accurately identify the attribute statistical features and the behavior sequence data according to the log data.

The specific process comprises the following steps: assuming that a game application interface is displayed in the terminal device (e.g., mobile terminal) 102, in steps S102-S104, log data generated by the target account in the target game application within a target time period is obtained, and the log data is sent to the server 106 through the network. The log data herein may include, but is not limited to, a behavior record generated by the target account performing an interactive behavior in the game application within a target time period, and one or more attribute values of the target account within the game application within the target time period.

The server 106 will then perform steps S106-S116: the server 106 extracts the attribute statistical characteristics and the behavior sequence data of the target account in the target time period from the log data. The behavior sequence data is used for indicating the time sequence characteristics of the interactive behaviors in the target time period, and the attribute statistical characteristics are used for indicating statistical results of the interactive behaviors after statistics is carried out on the basis of a plurality of statistical labels respectively. Then inputting the attribute statistical characteristics into a pre-trained conversion model to obtain attribute combination characteristics output by the conversion model; and inputting the attribute combination features, the attribute statistical features and the behavior sequence data into the recognition model to obtain a data recognition result output by the recognition model, and sending the data recognition result to the terminal device 102 through the network 104, so that the terminal device 102 can display the data recognition result, and whether the target account is abnormal or not can be analyzed conveniently.

It should be noted that, in this embodiment, based on a multi-tower model constructed by the attribute combination feature, the attribute statistical feature and the behavior sequence data, the behavior sequence data and the attribute statistical feature are extracted from the log data of the target account, and based on a trained conversion model, the attribute combination feature matched with the attribute statistical feature is acquired, so as to fuse the three input data or features to obtain a data recognition result indicating whether the log data is abnormal or not. That is to say, by fusing the attribute combination features with high correlation, the attribute statistical features with the original data and the behavior sequence data with high latitude, the robustness of the features for determining the data identification result is improved, the acquisition accuracy of the data identification result is further improved, and the technical problem of low accuracy of data abnormal identification in the related technology is further solved.

Optionally, in this embodiment, the terminal device may be a terminal device configured with a client of the target game application, and may include but is not limited to at least one of the following: mobile phones (such as Android phones, iOS phones, etc.), notebook computers, tablet computers, palm computers, MID (Mobile Internet Devices), PAD, desktop computers, smart televisions, etc. The client of the target game application may be a game client, a video client, an instant messaging client, a browser client, an educational client, and the like. Such networks may include, but are not limited to: a wired network, a wireless network, wherein the wired network comprises: a local area network, a metropolitan area network, and a wide area network, the wireless network comprising: bluetooth, WIFI, and other networks that enable wireless communication. The server may be a single server, a server cluster composed of a plurality of servers, or a cloud server. The above is merely an example, and this is not limited in this embodiment.

Optionally, as an optional implementation manner, as shown in fig. 2, the data anomaly identification method includes:

s202, acquiring a data identification request, wherein the data identification request is used for requesting and confirming whether log data generated by a target account in a target game application in a target time period is abnormal or not;

s204, responding to the data identification request, and acquiring attribute statistical characteristics and behavior sequence data corresponding to the log data, wherein the attribute statistical characteristics comprise characteristics obtained by respectively counting parameter changes of a plurality of attribute parameters associated with the target account in the target time period, and the behavior sequence data comprise time sequence data of behaviors executed by a virtual object controlled by the target account in the target time period;

s206, inputting the attribute statistical characteristics into a conversion model to obtain attribute combination characteristics output by the conversion model, wherein the conversion model is used for converting the input characteristics into attribute combination characteristics with decision tree characteristics;

and S208, inputting the attribute combination feature, the attribute statistical feature and the behavior sequence data into a recognition model to obtain a data recognition result output by the recognition model, wherein the data recognition result is used for indicating whether the log data is abnormal, the recognition model comprises a first fusion structure for fusing the attribute combination feature and the attribute statistical feature to obtain a first fusion feature, a second fusion structure for fusing the first fusion feature and the behavior sequence data to obtain a second fusion feature, and the recognition structure for recognizing whether the log data is abnormal by using the second fusion feature.

Optionally, in the present embodiment, the data anomaly identification method described above may be applied, but not limited, to identifying and striking anomalous behaviors or anomalous users in a game application to clean up the scene of the game application environment. Through the steps provided in the embodiment of the application, the behavior sequence data and the attribute statistical characteristics of each account are extracted according to the behavior record generated by the human-computer interaction behavior executed by the user in the client and the account number of the user or the attribute value of the virtual role controlled by the user, and the attribute combination characteristics with higher correlation with abnormal data are further obtained based on the trained conversion model and the attribute statistical characteristics, so that the three data/characteristics are fused to perform abnormity judgment on the user, and a data identification result for indicating whether the user behavior or the attribute value is abnormal is obtained, so that the abnormal user is accurately identified, and the abnormal user is controlled to a certain degree to purify the game environment. In addition, through the steps provided in the embodiment of the present application, when the operator actually uses the game, the operator may further but not limited to find a certain number of highly suspicious abnormal users for effective hit according to the data identification result by setting a probability threshold, and perform an operation of importing the target list according to the low suspicious abnormal users found according to the data identification result, which may but not limited to perform more strict manual judgment on the users, so as to reduce the cost of game security operation.

It should be noted that, the conversion model and the obtained attribute statistical characteristics are firstly utilized to obtain attribute combination characteristics with stronger discretization and combination capabilities, and meanwhile, the attribute statistical characteristics and the attribute combination characteristics are fused, so that the output first fusion characteristics have the advantage of high correlation peculiar to the attribute statistical characteristics, and the obtained first fusion characteristics also avoid the problem of information loss possibly occurring in the follow-up process due to the fact that the attribute statistical characteristics record original characteristic information; alternatively, the attribute combination characteristic may be, but is not limited to, an output characteristic of the characteristic combination information.

Furthermore, behavior sequence data and the first fusion feature which are obtained by fusing the recognition model are utilized, wherein the behavior sequence data has key and rich voice features for distinguishing data abnormity and are complementary with the first fusion feature, so that the output second fusion feature combines the advantages of the attribute statistical feature of retaining original information, high correlation of attribute combination features and rich behavior sequence data, high robustness of the feature output by the recognition model is ensured, the output feature with high robustness ensures that the finally output data recognition result has higher recognition accuracy, and the technical problem of lower data abnormity recognition accuracy in the related technology is further solved.

Optionally, in this embodiment, the behavior sequence data may be determined, but is not limited to, based on an active behavior sequence of the target account performing an interactive behavior in the target game application. The active behavior sequence here may be, but is not limited to, a one-dimensional behavior sequence. For example, a time point sequence of the target account performing the interactive action by using the target game application in a target time period (for example, one day) is obtained from the user log, and the time points of the time point sequence are converted into sequence characteristics convenient for machine training according to a form of fixed time period slicing. For example, a day is taken as an example, 24 pieces can be obtained by dividing 24 hours a day, and the game duration (0-60 minutes) of each hour piece forms behavior sequence data with the length of 24.

Further, assuming that the current interactive behavior is represented by number information at each time point, for the behavior sequence data having a length L of the behavior sequence, the interactive behavior at each sequence number can also be represented by a distributed vector of parameters. For example, ID Embedding is performed on each ID number in the behavior sequence data with the sequence length of L to obtain M-dimensional vector sequences, which are combined into a single-channel feature matrix, e.g., the output data is a matrix (L, M) corresponding to the behavior sequence.

Optionally, in this embodiment, the attribute statistical characteristics include characteristics obtained by respectively counting parameter changes of a plurality of attribute parameters associated with the target account within the target time period, specifically, the attribute statistical characteristics may also be, but are not limited to, interactive behaviors performed on the target account and/or attribute values of the target account, and statistical results are respectively counted based on a plurality of statistical tags. For example, taking a game application as an example, the statistical tags may include, but are not limited to: game type preferences, number of game activations, activity period distribution, team speaking, and the like. Here, the attribute statistical characteristics may include, but are not limited to: continuous numerical features, category type features. The above attribute statistical characteristics can be further processed: for example, normalizing the values of the continuous value features, and performing one-hot (one-hot) encoding on the discrete class features, wherein, optionally, one-hot encoding may be, but is not limited to, one-bit effective encoding, which mainly uses an N-bit status register to encode N states, each state is provided with its own independent register bit, and only one bit is effective at any time. Then, the processed features are filtered to remove redundant features, and other reference features meeting conditions are removed, such as single variable verification of the features, then variables with extremely small numerical variance and small Information Value (IV) are removed, or variables with high correlation are found through correlation coefficients.

Optionally, the interaction behavior executed by the target account may be, but is not limited to, an interaction operation executed in the target game application for a virtual character controlled by the target account, such as selling a virtual commodity, attacking an enemy virtual character, receiving a virtual task, and the like;

optionally, the attribute value of the target account may be, but is not limited to, an attribute value of the target account itself, such as a member level, an account login duration, an account name number of virtual characters, a payment number, a payment rate, and the like, and the attribute value of the target account may also be, but is not limited to, an attribute value of a virtual character controlled by the target account in a target game application, such as a level of the virtual character, virtual currency, a virtual item, a profit rate, a login duration, a game profit, and the like. The above is an example, and this is not limited in this embodiment.

Optionally, in this embodiment, but not limited to, an identification model combining a transition network and a multi-tower structure may be adopted to fuse the acquired attribute statistical characteristics and behavior sequence data to obtain output characteristics with high robustness, so as to acquire an output data identification result;

for example, as shown in fig. 3, optionally, the attribute statistical features are input into a conversion model 302 to obtain output attribute combination features, and directly obtained attribute statistical features and behavior sequence data, the identification model 304 of the multi-tower structure is input, and in the identification model 304, the attribute combination features and the attribute statistical features are fused based on a first fusion structure 3042 to obtain first fusion features, and the first fusion features and the behavior sequence data are fused based on a second fusion structure 3044 to obtain second fusion features with higher robustness, and then the second fusion features are input into an identification structure 3046 to obtain data identification results.

Optionally, in this embodiment, in order to identify a key behavior sequence feature from a plurality of behavior sequences, in the identification model, a Convolutional Neural Network (CNN) may be configured, but not limited to, to further convert the input behavior sequence data into a corresponding behavior sequence feature, and the CNN may include, but is not limited to: embedding layer (Embedding), convolution layer and gating filter layer, wherein the convolution layer can be but not limited to an A layer B scale convolution structure, and A, B is a positive integer. The above-mentioned gated filter layer may be, but is not limited to, a gated filter structure, such as a Highway structure. Alternatively, in the case where the length of the behavior sequence data is smaller than the preset length (indefinite length), the length of the behavior sequence data is complemented with the preset length by complementing "0".

It should be noted that, the design purpose of the identification model combining the above-mentioned switching network and the above-mentioned multi-tower structure is mainly for the following considerations:

two different feature transformation techniques are used for automatically transforming the attribute statistical features. One of the features is feature transformation in prediction based on a pre-trained transformation model, that is, a new feature is constructed on a path from a root node to each leaf node in each tree, and the predicted leaf nodes of a plurality of trees form an attribute combination feature, so that the attribute combination feature is equivalent to feature combination information with decision tree characteristics. And the other method is that the fusion structure in the identification model of the multi-tower structure performs adaptive fusion on the attribute combination characteristics and the attribute statistical characteristics. The characteristics of tree model discretization and combination characteristics and the advantages of the neural network self-adaptive fusion original statistical characteristics are combined and supplemented with each other, so that the characteristic extraction is more comprehensive and robust, and the generalization performance and effect are improved.

In addition, combining the key semantic vector extracted based on the behavior sequence data, and combining a classification loss function with a full connection layer configured in the identification model of the multi-tower structure to output the model from end to end.

Optionally, in terms of operation efficiency, in combination with the design of the conversion network and the recognition model of the multi-tower structure, the network structures of the attribute combination features, the attribute statistical features and the behavior sequence data are all lightweight, except for the pre-trained conversion model, the feature conversion and fusion of the attribute statistical features are equivalent to several layers of fully-connected layers, and the feature conversion of the behavior sequence data can be but is not limited to use a CNN structure capable of being parallel, so that the overall operation efficiency of the model is high, and the requirement of simultaneous deployment of multiple game services can be met. In the aspect of prediction effect, due to the fact that the conversion network and the design of the identification model of the multi-tower structure are combined, key information of attribute statistical characteristics and behavior sequence data can be extracted more comprehensively, and the attribute statistical characteristics and the behavior sequence data can be fused in a self-adaptive mode, and therefore the prediction performance of the model is improved.

In a word, the design of the identification model of the conversion network and the multi-tower structure is combined, so that complicated rules and characteristic design are avoided, the operation efficiency and excellent prediction effect of the model are considered, and the method has high expandability and universality. For different games, the design of the identification model combining the conversion network and the multi-tower structure can adapt to the statistical game attribute features with different dimensions and the behavior sequence data with different lengths, so that the method can be quickly transplanted to the player abnormity judging task of other games at low cost.

Optionally, in this embodiment, in order to perform some cross-combinations and high-level fusion on features to obtain more abundant and important features, the recognition model may further include, but is not limited to, a multi-level feature fusion structure, where the multi-level feature fusion structure may include, but is not limited to: the attribute statistical feature extraction device comprises a first-order feature extraction structure for extracting first-order features in the attribute statistical features, a second-order feature extraction structure for extracting second-order features in the attribute statistical features and a high-order feature extraction structure for extracting high-order features in the attribute statistical features. This is an example, and this is not limited in this embodiment.

Optionally, in this embodiment, the above conversion model may be, but is not limited to, used for converting the input features into the output features of the feature combination information having the decision tree characteristics, in other words, the conversion model may be, but is not limited to, a decision tree model, for example, the conversion model may be, but is not limited to, a classification number model, a regression tree model, an XGBoost model, a deep forest (gcForest) model, and the like. Alternatively, the Decision Tree (Decision Tree) may be, but is not limited to, a basic classification and regression method, and is called a classification number when the Decision Tree is used for classification and a regression Tree when the Decision Tree is used for regression. The decision tree may be, but is not limited to, composed of nodes and directed edges, the nodes may be, but are not limited to, divided into two classes, i.e., an internal node that identifies a feature or attribute, and a leaf node that represents a class, optionally, one decision tree includes a root node, a plurality of internal nodes and a plurality of leaf nodes, the leaf nodes correspond to the decision result, each node corresponds to an attribute volume number, the sample set contained in each node is divided into the sub-nodes according to the result of the attribute test, the root node contains a collection of samples, the path from the root node to each leaf node corresponds to a predetermined test sequence, in other words, a predetermined test sequence includes the path from the root node to each leaf node, and the path from the root node to each leaf node comprises codes corresponding to leaf child nodes under the path, wherein the code corresponding to one leaf child node corresponds to one code characteristic.

Optionally, in this embodiment, the trained transformation model learns various different combination relationships of the user's original game attribute features (i.e., attribute statistical features) through a feature segmentation manner of the decision tree and a learning manner of gradient boosting, and the combination features flexibly segmented from the root node to the leaf nodes are highly related to whether the target account is an abnormal target. The characteristics formed by the automatic combination of the tree models can supplement the defects of manual design characteristics, and manual combination exploration analysis of the user game attribute characteristics is reduced. Meanwhile, the transformation model predicts the leaf node characteristics of each tree, and the leaf node characteristics are formed by arbitrary discretization segmentation of characteristic values and combination of a plurality of characteristic nodes, so that incomplete surfaces of attribute statistical characteristics can be further supplemented.

Optionally, in this embodiment, the attribute statistical characteristics are input into the conversion model to obtain the attribute combination characteristics, which may be, but not limited to, as shown in fig. 4, where the conversion model 402 includes m tree structures, which are respectively tree 1 and tree 2 (not shown in the figure) … … tree m, the attribute statistical characteristics are respectively input into the m tree structures, and then a path code of a leaf node predicted by each tree is obtained as an output coding characteristic of the tree, for example, the number of path codes of the leaf nodes of the m trees is n, then in tree 1, a path of the leaf node with a dotted arrow is path code 2 of the leaf node predicted by tree 1, and in tree m, a path of the leaf node with a dotted arrow is path code (n-1) of the leaf node predicted by tree 1. In other words, the m trees respectively output the coding features corresponding to the predicted path codes to obtain m coding features, and then the m coding features are output as the attribute combination features.

Optionally, in this embodiment, after obtaining the data recognition result output by the recognition model, a processing instruction for determining a target account in the target game application may be, but is not limited to, based on the data recognition result, where the processing instruction is used to instruct to block the target account, for example, to block the target account, and optionally, a period of blocking may be, but is not limited to, positively correlated with an abnormality degree of the target account represented by the data recognition result; further, the processing instructions may be used to negatively adjust the target account number, such as but not limited to, reduce the income of the low credit player, increase the threshold of the interaction of the low credit player in the game, such as speaking/chatting/friend-adding, etc., limit the transaction of the low credit player or cancel the game testing qualification, experience qualification, or activity qualification of the low credit player, etc. Alternatively, in the case that the data recognition result indicates that the target account is not abnormal, in order to compensate for the negative influence on the target account caused by abnormal recognition, the processing instructions may also be used for positively adjusting the authority of the target account, such as providing a privilege or benefit for use, for example, providing game testing qualification, experience qualification, or activity qualification. The above is an example, and the present embodiment is not limited to this.

For further example, in a case that the data identification result indicates that the target account is abnormal, a processing instruction corresponding to the data identification result is generated; in response to the processing instruction, the target account is sealed, and a prompt message is sent to the client where the target account is located, where the prompt message may be, but is not limited to, as shown in fig. 5, and is used to prompt that the target account has an illegal game behavior, and the length of time the account has been sealed, and optionally, the prompt message may also be, but is not limited to, carry information of at least one of the following: the sealing time, the sealing reason, the unsealing time, the upper complaint link and the like.

According to the embodiment provided by the application, a data identification request is obtained, wherein the data identification request is used for requesting to confirm whether log data generated by a target account in a target game application in a target time period is abnormal; responding to the data identification request, and acquiring attribute statistical characteristics and behavior sequence data corresponding to log data, wherein the attribute statistical characteristics comprise characteristics obtained by respectively counting parameter changes of a plurality of attribute parameters associated with the target account in a target time period, and the behavior sequence data comprise time sequence data of behaviors executed by a virtual object controlled by the target account in the target time period; inputting the attribute statistical characteristics into a conversion model to obtain attribute combination characteristics output by the conversion model, wherein the conversion model is used for converting the input characteristics into the attribute combination characteristics with decision tree characteristics; inputting the attribute combination feature, the attribute statistical feature and the behavior sequence data into a recognition model to obtain a data recognition result output by the recognition model, wherein the data recognition result is used for indicating whether log data are abnormal or not, the recognition model comprises a first fusion structure for fusing the attribute combination feature and the attribute statistical feature to obtain a first fusion feature, a second fusion structure for fusing the first fusion feature and the behavior sequence data to obtain a second fusion feature, and the recognition structure for recognizing whether the log data are abnormal or not by using the second fusion feature, firstly using a conversion model and the obtained attribute statistical feature to obtain an attribute combination feature with stronger discretization and combination capability, and simultaneously fusing the attribute statistical feature and the attribute combination feature to ensure that the output first fusion feature has the advantage of high correlation specific to the attribute statistical feature, original feature information is recorded due to the attribute statistical features, so that the problem of information loss possibly occurring in the follow-up process is solved for the acquired first fusion features; furthermore, the identification model is reused to fuse the acquired behavior sequence data and the first fusion characteristic, and the behavior sequence data has key and rich voice characteristics for judging data abnormity and is complementary with the first fusion characteristic, so that the output second fusion characteristic combines the reserved original information of the attribute statistical characteristic, the high correlation of the attribute combination characteristic and the rich advantages of the behavior sequence data, the purpose of enabling the characteristics for acquiring the data identification result to be more robust is achieved, and the effect of improving the accuracy of data abnormity identification is achieved.

As an alternative, the inputting the attribute combination feature, the attribute statistical feature and the behavior sequence data into the recognition model to obtain the data recognition result output by the recognition model includes:

s1, inputting the attribute combination characteristics into a first sub-network to obtain first output characteristics, wherein the identification model comprises the first sub-network;

s2, inputting the attribute statistical characteristics into a second sub-network to obtain second output characteristics, wherein the identification model comprises the second sub-network;

s3, inputting the first output feature and the second output feature into a first fully-connected layer to obtain a first fused feature, wherein the first output feature and the second output feature are fused in the first fully-connected layer, and the first fused structure comprises the first fully-connected layer;

s4, inputting the behavior sequence data into a third sub-network to obtain a third output characteristic, wherein the recognition model comprises the third sub-network;

s5, inputting the third output feature and the first fusion feature into a second full-link layer to obtain a second fusion feature, wherein the second fusion structure comprises the second full-link layer;

and S6, inputting the second fusion feature into a classification layer of the second full connection layer to obtain a data identification result, wherein the identification structure comprises the classification layer.

The attribute statistical characteristics, the attribute combination characteristics and the behavior sequence data are input into a recognition model of a multi-tower network structure, the attribute statistical characteristics are converted into first output characteristics by using a first sub-network in the recognition model, the attribute combination characteristics are converted into second output characteristics by using a second sub-network in the recognition model, and the behavior sequence data are converted into third output characteristics by using a third sub-network in the recognition model;

further, the first output feature and the second output feature acquired based on the first sub-network and the second sub-network are input to the first full connection layer by using the first full connection layer in the identification model to acquire a first fusion feature with respective advantages of the attribute statistical feature and the attribute combination feature fused, and the first fusion feature and the third output feature acquired based on the first full connection layer and the third sub-network are input to the second full connection layer by using the second full connection layer in the identification model to acquire a second fusion feature with multiple dimensional features fused;

and moreover, a classification layer is also configured in the second full-connection layer, the classification layer converts the second fusion characteristics obtained by fusing the second full-connection layer into data identification results, performs off-line prediction by day or real-time on-line prediction based on the data identification results, and returns the abnormal suspicious probability of the target account.

By way of further example, the network architecture of the recognition model may be selected as shown in fig. 6, and specifically, the attribute statistical features, the attribute combination features, and the behavior sequence data are input into a recognition model 602 of the multi-tower network structure, the attribute statistical features are converted into first output features by using a first sub-network 604 in the recognition model 602, the attribute combination features are converted into second output features by using a second sub-network 606 in the recognition model 602, and the behavior sequence data are converted into third output features by using a third sub-network 610 in the recognition model 602;

further, the first output feature and the second output feature obtained based on the first sub-network 604 and the second sub-network 606 are input to the first fully-connected layer 608 by using the first fully-connected layer 608 in the recognition model 602 to obtain a first fused feature with respective advantages of the attribute statistical feature and the attribute combination feature fused, and the first fused feature and the third output feature obtained based on the first fully-connected layer 608 and the third sub-network 610 are input to the second fully-connected layer 612 by using the second fully-connected layer 612 in the recognition model 602 to obtain a second fused feature with multiple dimensional features fused, wherein the second fully-connected layer 612 may be configured with, but not limited to, a fused layer 6122, and the fused layer 6122 is used for fusing the input features input to the second fully-connected layer 612;

moreover, a classification layer 6124 is further configured in the second fully-connected layer 612, and the classification layer 6124 converts the second fusion feature obtained by fusing the second fully-connected layer 612 into a data recognition result.

By the embodiments provided herein, the attribute combination feature is input into a first sub-network to obtain a first output feature, wherein the recognition model comprises the first sub-network; inputting the attribute statistical features into a second sub-network to obtain second output features, wherein the recognition model comprises the second sub-network; inputting the first output feature and the second output feature into a first fully-connected layer to obtain a first fused feature, wherein the first output feature and the second output feature are fused in the first fully-connected layer, and the first fused structure comprises the first fully-connected layer; inputting the behavior sequence data into a third sub-network to obtain a third output characteristic, wherein the recognition model comprises the third sub-network; inputting the third output feature and the first fused feature into a second fully-connected layer to obtain a second fused feature, wherein the second fused structure comprises the second fully-connected layer; and inputting the second fusion characteristic into a classification layer of a second full connection layer to obtain a data identification result, wherein the identification structure comprises the classification layer, so that the aim of outputting the output characteristic with higher robustness by using an identification model of a multi-tower network structure is fulfilled, and the effect of improving the accuracy of the data identification result obtained based on the output characteristic is realized.

As an alternative, inputting the attribute combination characteristic into the first sub-network to obtain the first output characteristic comprises:

s1, inputting the attribute combination features into the embedding layer of the first sub-network to obtain M attribute combination vectors, wherein the attribute combination vectors correspond to the attribute combination features, and M is a positive integer greater than or equal to 1;

and S2, fusing the M attribute combination vectors based on the attention mechanism to obtain a target attribute fusion vector, and taking the target attribute fusion vector as a first output feature.

Alternatively, the Attention Mechanism (Attention Mechanism) can be divided into two aspects, namely, but not limited to, determining the portion that needs to be focused on the input and allocating limited information processing resources to the important portion. Alternatively, the attention mechanism may be, but is not limited to, enabling the neural network to have the ability to focus on a subset of its inputs (or features): a particular input is selected. The attention mechanism may be applied, but is not limited to, any type of input regardless of its shape. In situations where computing power is limited, the attention mechanism may be, but is not limited to, a resource allocation scheme that is the primary means of addressing the information overload problem, allocating computing resources to more important tasks.

Optionally, in this embodiment, the attribute combination features obtained by predicting the leaf nodes of each tree by the transformation model are mapped into a distributed vector representation in the form of ID Embedding through the embedded layer of the first subnetwork, where the computation principle of the embedded layer of the first subnetwork is shown in the following formula (1).

E_{xgb_i}＝ID_{tree_leafi}W_{xgb_embed}

Wherein, W_{xgb_embed}The number feature matrix is formed by all tree leaf nodes of the conversion model, when the number of leaf nodes of the conversion model is C and the vector dimension of the embedded layer of the first sub-network is r, the number matrix size of the learnable parameter is (C, r). ID_{tree_leafi}Denotes the leaf node numbered i, E_{xgb_i}Representing the feature vector mapped by the leaf node i. Assuming that the embedding layer of the first subnetwork has m trees in total, m feature directions can be obtainedThe quantity (attribute combination feature), and thus the embedding layer output result dimension of the first subnetwork, should be (m, r).

For further example, the optional transformation model may be formed by, but not limited to, a gradient boosting-based method and optimized learning through node splitting and continuously stacking structures of more trees, so that leaf nodes of different trees in a prediction result of the same transformation model have a certain correlation, and feature importance of the leaf nodes in different trees is different, that is, importance of different attribute combination features is different. The feature vectors (M attribute combination vectors) of the leaf nodes can be fused by attention mechanism weighting, and the fusion relation of the leaf expression vectors can be modeled adaptively, so as to highlight important leaf node features. The specific principle of the leaf node vector weighted attention mechanism is shown in the following formula (2) and formula (3).

a＝softmax(V^Ttanh(WH^T)) (2)

P_xgb＝sum(a*H) (3)

Wherein, H is the output characteristic matrix (m, r) of the front leaf node Embedding layer, W and V are learnable parameters, and the weight value of each line in the matrix can be learned to form the attention weight vector a. The above equation (3) represents that the feature vector P is obtained by multiplying and summing the attention weight vector a and each row of the original input matrix H_xgb. Therefore, the attention mechanism can perform weighted fusion on the leaf node feature vectors to obtain a fusion expression vector of the conversion model, and the feature vector P finally output by the fusion expression vector_xgbThe dimension is r.

In this embodiment, for example, as shown in fig. 7, the attribute combination feature is optionally used as an input of the first sub-network 702, the attribute combination feature is converted and fused into a target attribute fusion vector by using the embedding layer 7022 of the first sub-network 702, and the target attribute fusion vector is further used as a first output feature of the first sub-network 702.

According to the embodiment provided by the application, the attribute combination characteristics are input into the embedding layer of the first sub-network to obtain M attribute combination vectors, wherein the attribute combination vectors correspond to the attribute combination characteristics, and M is a positive integer greater than or equal to 1; based on an attention mechanism, M attribute combination vectors are fused to obtain a target attribute fusion vector, the target attribute fusion vector is used as a first output feature, and features formed through automatic combination of a tree model can supplement the defect of manual design features, so that the aim of reducing manual combination exploration and analysis of user game attribute features is fulfilled, and the effect of improving the efficiency of data anomaly identification is achieved.

As an alternative, inputting the statistical characteristic of the attribute into a second sub-network to obtain a second output characteristic, includes:

s1, inputting the attribute statistical characteristics into the embedding layer of the second sub-network to obtain attribute statistical vectors of target dimensions, wherein the target dimensions are matched with the second sub-network, and the attribute statistical vectors are distributed vectors corresponding to the attribute statistical characteristics;

s2, the attribute statistics vector is input into a second subnetwork to obtain a second output characteristic.

Optionally, in this embodiment, regardless of continuous numerical features such as a fighting rate, an income, a game duration, and the like, or category discrete features such as a user game level, the attribute statistical features are regarded as independent dimension information, and feature numbers of different dimensions may obtain distributed vector representations belonging to different features in a vector Embedding form, for example, a distributed vector representation mapped to a specific dimension in an ID Embedding form.

According to the embodiment provided by the application, the attribute statistical characteristics are input into the embedding layer of the second sub-network to obtain the attribute statistical vector of the target dimension, wherein the target dimension is matched with the second sub-network, and the attribute statistical vector is a distributed vector corresponding to the attribute statistical characteristics; and inputting the attribute statistical vector into the second sub-network to obtain a second output characteristic, so that the purpose of obtaining the same dimension characteristic output by the second sub-network is achieved, and the effect of improving the characteristic processing efficiency is realized.

As an alternative, inputting the attribute statistics vector into a second sub-network to obtain a second output characteristic, comprising:

s1, obtaining a first-order output vector according to the target product of the attribute statistical vector and the characteristic value of the attribute statistical characteristic, wherein the first-order output vector is obtained by performing weighted calculation on the target product;

s2, combining the attribute statistical vectors pairwise to obtain a second-order output vector;

and S3, inputting the first-order output vector and the second-order output vector into a third full-connection layer of the second sub-network to obtain a third fusion characteristic, wherein the third fusion characteristic is used for representing the fusion characteristic of the first-order output vector and the second-order output vector.

Optionally, in this embodiment, the second sub-network is configured to process the attribute statistical characteristic to obtain a second output characteristic. The features of different orders need to be extracted through a multi-order feature fusion structure, and then fusion is carried out to obtain a second output feature. The attribute statistical characteristics may include, but are not limited to: type preference, number of activities, period distribution, team speaking, etc.

The distributed representation of features and multi-level feature fusion will be described with reference to fig. 8, which is as follows:

because the attribute statistical characteristics are the characteristics of different dimensions obtained according to the statistical results of a plurality of statistical labels, distributed vector representations of different characteristics can be obtained in a vector Embedding (Embedding) mode, and then a weighting is carried out by combining the characteristic values of the attribute statistical characteristics, so that the multi-dimensional vector representation of the statistical characteristics is obtained. Here, the multidimensional vector can be, but is not limited to, a learnable parameter, optimized with an objective function, and used as an input to a subsequent statistical feature module.

It should be noted that the attribute statistical features herein include a continuous numerical feature and a discrete class feature, where the discrete class feature is a discrete feature. As shown in fig. 8, each discrete feature (e.g., the features from feature 1 to feature F) is regarded as information of an independent dimension, and is mapped to a distributed vector representation of a specific dimension in the form of an ID embedded vector (e.g., Embedding), and then multiplied by its own feature value to obtain a multidimensional vector representation of each feature.

It may be specifically as in formula (4), where E_iIs the vector obtained after embedding. Wherein, OneHot_iRepresents the characteristic i (i e [1, 2, … F ]) shown in FIG. 8]) Number of (1), W_embedAre the embedding matrix parameters. The statistical features include F features, the embedding vector has K dimensions, so that the output vector has (F, K) dimensions and E dimensions_iRepresenting the result of the feature field embedding. In the formula (5), x_iIs the original eigenvalue of the characteristic i, embedding_iIndicating that the feature passed the Embedding layer result.

E_i＝OneHot_iW_embed (4)

Embeding_i＝E_i*x_i (5)

In addition, it should be noted that, in this embodiment, the original feature information of the attribute statistical features is critical. Some combinations of different dimensional features can better describe the authenticity of the interaction behavior performed by the user account. For example, it can automatically learn the weight of the second-order cross feature in the form of a network structure. Furthermore, the multi-layer nonlinear transformation of all the attribute statistical features can extract some high-order fusion features which cannot be drawn artificially.

Therefore, in the aspect of attribute statistical feature extraction, in this embodiment, two different feature extraction structures are used to respectively extract a first-order feature (a first-order feature extracted by using the first feature extraction structure) and a second-order feature (a second-order feature extracted by using the second feature extraction structure) of an attribute statistical feature, and then further fusion is performed to obtain a third fusion feature. The principle here is similar to that of Deep FM model in recommendation system, and multiple structures are adopted to enrich the multi-order fusion original characteristics. The second sub-network operates in the following manner:

the first feature extraction structure is to perform pairwise crossing combination on the attribute statistical vectors of the attribute statistical features after Embedding to obtain second-order combined features (such as the second-order features). As shown in the right side of fig. 8, the corresponding elements of every two feature vectors in all the feature vectors of the features 1 to F after being subjected to Embedding processing are multiplied, and then the corresponding elements are added. And then the conversion of the full connection layer with the Tanh activation function is carried out. The effect is to do a second order cross-over of features for different domains.

The calculation principle for the second order cross feature is shown in the following equation (6), where x_iAnd x_jRepresenting the original characteristic value, E_iAnd E_jAn embedded vector representing the statistical features, and F represents the number of features. An indication of a corresponding element multiplication. That is, after multiplying every two corresponding elements of all the feature vectors, the corresponding elements are summed.

In order to improve the operation efficiency, a calculation method of the second-order cross characteristic can be further optimized, and the multiplication calculation amount of the second-order cross characteristic is reduced from O (n2) to O (n). The principle of the method is similar to a second-order cross solving method of input features in classical algorithms NFM and Deep FM in a recommendation system, and an equivalent formula is as shown in the following formula (7). The operation of summing corresponding elements of all attribute statistical vectors and then squaring, squaring and then summing is directly performed, so that the operation of circularly traversing all the features twice in feature cross calculation is avoided.

The second feature extraction structure is to perform corresponding element addition summation SUM on the attribute statistical vector of the attribute statistical feature after Embedding of the previous layer, and then learn the high-order feature (such as the second-order feature) of the first-order linear weighting feature step by step through a multilayer nonlinear mapping layer. As shown in the middle of fig. 8, after the features 1 to F are subjected to Embedding processing, attribute statistical vectors of all attribute statistical features are subjected to multi-dimensional linear weighted summation to obtain multi-dimensional vector output. And then, further converting the characteristics through two nonlinear full-connection layers comprising a compact layer and a Relu function. Therefore, the original features are subjected to first-order line weighting mapping of various different weighting parameters to obtain M-dimensional feature vectors (namely the M-dimensional vectors obtained by the summation of the Embedding layers), and then the high-order features of the first-order linear weighting features are gradually learned through the multilayer nonlinear mapping layers, so that the high-order relation among the original statistical features is automatically learned.

It should be noted that, here, the first and second feature extraction structures are both shared Embedding layers.

The third feature extraction structure is to scale and directly splice the feature values of the attribute statistical features according to preset weights (such as the first-order features described above). As shown in the left side of fig. 8, the first-order stitching is performed on the features 1 to F, which is equivalent to a linear layer of logistic regression, so as to highlight important original features, and the features avoid excessive loss of the original first-order features. From another perspective, this also amounts to the effect of a linear residual join.

Then, the feature vectors (such as the first-order output vector and the second-order output vector) of the first-order feature and the second-order feature obtained by the feature extraction structure are directly spliced (merged), and the feature vectors of different orders are further fused through a nonlinear full-connection layer comprising a compact layer and a Relu function, so that the global feature vector of the statistical feature is obtained.

According to the embodiment provided by the application, a first-order output vector is obtained according to the target product of the attribute statistical vector and the characteristic value of the attribute statistical characteristic, wherein the first-order output vector is obtained by performing weighting calculation on the target product; combining the attribute statistical vectors pairwise to obtain a second-order output vector; and inputting the first-order output vector and the second-order output vector into a third full-connection layer of the second sub-network to obtain a third fusion characteristic, wherein the third fusion characteristic is used for representing the fusion characteristic of the first-order output vector and the second-order output vector, so that the aim of obtaining the high-order characteristic output by the second sub-network is fulfilled, and the effect of improving the robustness of the output characteristic is realized.

As an alternative, inputting the behavior sequence data into a third sub-network to obtain a third output characteristic, comprising:

s1, in the embedding layer of the third sub-network, performing vector mapping on the behavior sequence data to obtain a first behavior sequence vector;

s2, in the convolutional layer of the third subnetwork, performing feature extraction on the first behavior sequence vector to obtain a second behavior sequence vector;

s3, in the pooling layer of the third sub-network, performing feature fusion on the second behavior sequence vector to obtain a third behavior sequence vector;

s4, in the conversion layer of the third sub-network, the retention and fusion of the high-level features are carried out on the third row-wise sequence vector to obtain a fourth row-wise sequence vector;

s5, in the fourth fully-connected layer of the third sub-network, performing feature transformation and feature dimension reduction on the fourth row-wise sequence vector to obtain a fifth row-wise sequence vector;

and S6, taking the fifth behavior sequence vector as a third output characteristic.

Optionally, in this embodiment, the third sub-network is configured to process the behavior sequence data to obtain a third output characteristic. Wherein, a sliding convolution operation of one-dimensional convolution needs to be performed through a multi-scale convolution structure (such as an M-layer N-scale convolution structure) to obtain N candidate behavior segment feature matrices. Extracting the segment characteristics, and performing maximum pooling respectively to obtain N key behavior segment characteristic vectors of the target user account.

It should be noted that, since the length of the segment of the critical behavior is variable, a one-dimensional convolution operation with multiple scales needs to be used to capture the features of multiple segments simultaneously. Moreover, the CNN structure has the function of layer-by-layer abstract characteristics, and the multilayer structure can enlarge the receptive field, increase the length of the segment and see a longer behavior segment. Therefore, in the embodiment of the present application, a multi-scale three-layer one-dimensional convolution structure may be adopted to extract the behavior sequence features, but not limited to. The specific operation principle can be described as follows with reference to the content shown in fig. 9:

assume that after L sequence variables in the matrix are acquired, embed processing is performed, and then the matrices are merged to acquire a matrix (L, M) corresponding to the behavior sequence features. 3 layers of one-dimensional convolution operations with N different widths are performed on the data, and each width convolution kernel also has a plurality of convolution kernels (for example, 32 convolution kernels are selected in the embodiment), each width convolution operation is performed separately, and the convolution kernels with different parameters can extract features with different aspects.

Here, the feature matrix is subjected to a one-dimensional sliding convolution operation on the basis of rows by a convolution layer of the first layer (the "first layer" shown in fig. 9), and features of the shallow layer are extracted. Where a one-dimensional convolution kernel uses convolution windows of a variety of different widths (i.e., multi-scale). For example, as shown in fig. 9, assuming that N is 7, i.e., conv1 to conv7 are used to represent 7 kinds of one-dimensional convolution operations with different widths, features of 1 to Ngram are extracted. Here, a convolution kernel of each width can result in 32 signature sequences of length L. Or 32-dimensional feature vectors with length L, have a total of N widths, so the output of the convolutional layer of the first layer is (N, L, 32).

The convolution operation performed by the convolution layer of the second layer (the "second layer" shown in fig. 9) is based on the output result of the convolution layer of the first layer, and further feature extraction is performed on the (N, L, 32) features of the output of the convolution layer of the first layer, and at the same time, the sliding convolution operation is performed on the 32 one-dimensional convolution kernels of the same width respectively applied to the outputs (L, 32) of the convolution layers of the same width of the first layer, so that the output result of the convolution layer of the second layer is also (N, L, 32).

The convolution operation performed by the convolution layer of the third layer (the "third layer" shown in fig. 9) is superimposed on the output result of the convolution of the second layer, and the convolution operation is the same as that of the second layer. Here, the features are abstracted hierarchically by convolution operation of multi-layer superimposition, and a high-level sequence feature is obtained. Wherein the output result of the convolution layer of the third layer is (N, L, 32).

And then, further feature filtering is carried out on the output features of the convolution layer of the third layer of each scale, so as to highlight the key behavior segment features. Here, for the convolution output of each width of the third layer, the 32-dimensional feature vector with the sequence length of L is subjected to maximum pooling processing based on the sequence length of L to obtain a 32-dimensional output vector. Due to the N different width convolution types, the output is N32-dimensional vectors, which is 7 × 32 key behavior segment feature vectors as shown in fig. 9.

The following will describe in detail the specific operation process of the one-dimensional CNN module by taking the convolution mode of 2-gram as an example: firstly, convolving and adding two ID embedded vectors (output results of Embedding layers shown in fig. 9) sequentially connected by a behavior sequence channel, as shown in formula (8):

wherein, W₁And W₂Respectively representing two adjacent ID-embedded vectors T_iAnd T_i+1And the weight parameters are used when the operations of multiplying and adding the corresponding elements are carried out. Then, the elements are added and summed to obtain a real value

Then, since one layer of the convolution structure has 32 different sets of convolution kernel parameters, there are 32 output values. Respectively passing the element values obtained by the convolution operation through an excitation function Relu by the following formula (9) to obtain an output vector C with 32 dimensions_i。

At this point, the operation of the first layer convolutional layer is completed, and output vectors with 32 dimensions and sequence length L are obtained.

The convolution output matrix of the previous layer of the subsequent CNN convolution layer is used as input, and the convolution operation and the output result are the same as the formula (8) and the formula (9), wherein the subscript i represents the length L of the sequence, and the subscript j represents the number of convolution kernels used.

After the triple-layer convolution operation is completed, the maximum pooling is performed on the output result of the convolution layer of the third layer, that is, the maximum value of the element is taken based on the dimension of the sequence length L, and the following formula (10) is defined, so that after the convolution output of 32 convolution kernels in each scale is subjected to the maximum pooling, a 32-dimensional vector is output.

Optionally, in this embodiment, the gated filtering structure may be, but is not limited to, a Highway structure, and optionally, the Highway structure may be, but is not limited to, a threshold mechanism that can be learned, in which some information flows pass through some network layers without being attenuated and are used in a random gradient descent (SGD) method, and the Highway structure may be, but is not limited to, a network framework that solves the difficulty of deep network training.

It should be noted that, for the one-dimensional convolution operation performed by the M-layer N-scale convolution structure, a plurality of candidate behavior segment feature matrices are extracted from the behavior sequence data, and a plurality of scales of the candidate behavior segment feature matrices can be set according to actual scene needs. The feature vectors of the N key behavior segments also need to be extracted independently and further fused. In the embodiment, the HighWay structure can better fuse a plurality of candidate segment features, and highlight some important active behavior segments through gating mechanism reinforcement. Therefore, the HighWay structure can further fuse and convert the feature vectors of the N key behavior segments extracted by the upper convolution structure to obtain the global behavior vector with fixed dimensionality.

The N key behavior segment feature vectors are subjected to element-level gating filtering and global feature fusion, which is equivalent to further gating filtering and feature transformation on the output result of each convolution kernel. Here, the different convolution window widths are hyper-parameters, so that the multi-scale features and the feature elements of each dimension can be further adaptively fused, and the result is more robust. Referring to the HighWay network structure, the following formula (11), formula (12), and formula (13) can be referred to, where Input represents an Input vector, i.e., a feature vector with dimensions N × 32,

and

is a weight parameter.

output＝trans*gate+Input*(1-gate) (13)

By the embodiment provided by the application, in an embedding layer of a third sub-network, performing vector mapping on the behavior sequence data to obtain a first behavior sequence vector; performing feature extraction on the first behavior sequence vector in a convolutional layer of a third subnetwork to obtain a second behavior sequence vector; performing feature fusion on the second behavior sequence vector in a pooling layer of a third subnetwork to obtain a third behavior sequence vector; in the conversion layer of the third subnetwork, the retention and fusion of the high-level features are carried out on the third row of the sequence vector to obtain a fourth row of the sequence vector; in a fourth fully connected layer of the third subnetwork, performing feature conversion and feature dimensionality reduction on the fourth row-wise sequence vector to obtain a fifth row-wise sequence vector; and the fifth behavior sequence vector is used as the third output feature, so that the purpose of improving the global property of the third output feature output by the third sub-network is achieved, and the effect of improving the robustness of the feature obtained based on the third output feature is realized.

As an optional solution, inputting the attribute statistical characteristics into the conversion model to obtain attribute combination characteristics output by the conversion model, including:

s1, inputting the attribute statistical characteristics into a conversion model;

s2, respectively predicting M attribute combination sub-features corresponding to the attribute statistical features by using the tree structures of M decision trees in the conversion model, wherein each attribute combination sub-feature is a coding feature corresponding to a leaf node of one tree structure;

and S3, taking the M attribute combination sub-characteristics as attribute combination characteristics.

Optionally, in this embodiment, as shown in fig. 4, for example, the conversion model 402 includes M number of structures, which are respectively tree 1 and tree 2 (not shown in the figure) … … tree M, each number of structures respectively predicts an attribute combination sub-feature corresponding to the attribute statistical feature, and obtains M attribute combination sub-features in total, for example, the attribute combination sub-feature (code 2) predicted by tree 1 is a coding feature corresponding to a leaf sub-node of tree 1 indicated by a dashed arrow.

According to the embodiment provided by the application, the attribute statistical characteristics are input into the conversion model; respectively predicting M attribute combination sub-features corresponding to the attribute statistical features by using tree structures of M decision trees in a conversion model, wherein each attribute combination sub-feature is a coding feature corresponding to a leaf sub-node of one tree structure; the M attribute combination sub-features are used as attribute combination features, and a large number of important attribute combination sub-features are constructed by converting paths of each tree in the model from a root node to a leaf node, so that the aims of improving the difficulty and generalization performance of parameter optimization reduction of a subsequent model are fulfilled, and the effect of improving the efficiency of the model for outputting a data identification result is realized.

As an optional scheme, in response to the data identification request, obtaining an attribute statistical characteristic corresponding to the log data, including:

s1, extracting initial attribute statistical characteristics from the log data, wherein the initial attribute statistical characteristics comprise continuous numerical characteristics and discrete category characteristics;

and S2, performing normalization processing on the continuous numerical characteristics, and performing filtering and encoding processing on the discrete type characteristics to obtain attribute statistical characteristics.

Optionally, in this embodiment, obtaining the attribute statistical characteristic includes: removing redundant features from the initial attribute statistical features; carrying out normalization processing on the continuous numerical characteristics after the redundant characteristics are removed, and carrying out one-bit coding processing on the discrete type characteristics after the redundant characteristics are removed to obtain intermediate attribute statistical characteristics; and eliminating the reference features meeting the target elimination condition in the intermediate attribute statistical features to obtain the final attribute statistical features.

Optionally, in this embodiment, the obtaining of the attribute statistical characteristics corresponding to the log data may be, but is not limited to, by the following manners: after combining with the understanding of the service and the initial features 1004 (such as multi-dimensional feature information of type preference, active quantity, active period distribution, team speech, and the like) obtained by conversion according to various log information (such as the user activity log 1002-1, the user speech log 1002-2, the user team log 1002-3, and the user collection log 1002-4 shown in fig. 10), step S1002-1 may be performed to perform feature conversion, for example, obtaining a time point sequence of the target user account using the target application in the target time period from the user activity log, and converting time points of the time point sequence into a behavior sequence feature (such as the timing feature 1010) indicating a timing characteristic of the target user account performing the interaction behavior in a form of fixed time period slices.

Important few statistical features are reserved through simple feature engineering, irrelevant and redundant features are eliminated, the time of model training is shortened, and the accuracy of the model is improved. Then, step S1002-2 is performed on the statistical features to perform normalization preprocessing to obtain preprocessed features 1006: carrying out numerical value normalization processing on the continuous numerical value characteristics; and carrying out one-hot coding processing on the class type characteristics. Then, as shown in fig. 10, step S1004 feature selection is performed on the statistical features based on the statistical labels, mainly performing univariate verification on all the features, and removing variables with extremely small numerical variance and small IV. And finding out the variable with higher correlation through the correlation coefficient, and performing random elimination. Finally, the features are further filtered and supplemented based on a random forest modeling mode, and finally F features (such as attribute statistical features 1008 shown in fig. 10) are obtained, wherein the F features comprise continuous numerical features and discrete category features.

According to the embodiment provided by the application, the initial attribute statistical characteristics are extracted from the log data, wherein the initial attribute statistical characteristics comprise continuous numerical value characteristics and discrete category characteristics; the continuous numerical characteristics are subjected to normalization processing, the discrete category characteristics are subjected to filtering and coding processing to obtain attribute statistical characteristics, and the multiple dimension characteristics are selected, so that the purpose of reducing the model processing amount is achieved, and the effect of identifying the processing efficiency of the model is realized.

As an alternative, in response to the data identification request, acquiring behavior sequence data corresponding to the log data, including:

s1, extracting initial behavior sequence data from the log data, wherein the initial behavior sequence data comprises N behavior data, the N behavior data correspond to N moments, the target time period comprises N moments, and N is an integer greater than or equal to 0;

and S2, counting and sequencing the N behavior data according to the generation sequence of the N moments to obtain a behavior data sequence.

Optionally, in this embodiment, the behavior sequence data may be determined, but is not limited to, based on an active behavior sequence of the target user account performing an interactive behavior in the target application. The active behavior sequence here may be, but is not limited to, a one-dimensional behavior sequence. For example, a time point sequence of the target user account performing the interactive behavior by using the target application in a target time period (for example, one day) is obtained from the user log, and the time points of the time point sequence are converted into sequence features convenient for machine training according to a form of fixed time period slicing. For example, a day is taken as an example, 24 pieces can be obtained by dividing 24 hours a day, and the game duration (0-60 minutes) of each hour piece forms behavior sequence data with the length of 24.

Optionally, in this embodiment, for the processing of the behavior sequence data, the behavior sequence data of the user (target account) is converted into a sequence form of behavior numbers according to chronological order from the game user behavior log data, for example, the game behavior name here is to pick up an item, and the item numbers ID picked up in the game of the user are configured into ordered behavior sequence data according to chronological order, for example, behavior sequence data in the form of "23, 34, 56, 1, 1, 2, 34, 55, 65, 34, 1, 2, 123, 23, 45, 34, 34, 324, 42, 34, 434, 43, 23, 4", where each number represents an item type. Since the sequence of behaviors of each user is different, the lengths of the sequences of behaviors of the users are not uniform because the player may play only 1 hour, or even 10 hours or even 20 hours, etc. Based on the comprehensive consideration of sequence length, operation efficiency and predictive performance, a behavior sequence with the maximum length is intercepted from the behavior sequence data of each user, and the sequence length which can cover 90% of the length distribution of the behavior sequence of the user is taken as the maximum length generally according to the length distribution of the behavior sequence data.

And finally, correlating the user number from which the statistical characteristics and the behavior sequence characteristics are extracted with an existing user blacklist and white list library, so as to print black and white labels on the characteristic data, and constructing training set data according to a certain black and white proportion (for example, 1: 2). The training data format of the user game log data after feature conversion processing is "user id | attribute statistical feature | attribute combination feature | behavior number sequence (behavior sequence data) | tag (black list and white list)", wherein optionally the column is not tagged during model prediction.

By the embodiment provided by the application, the initial behavior sequence data is extracted from the log data, wherein the initial behavior sequence data comprises N behavior data, the N behavior data correspond to N moments, the target time period comprises N moments, and N is an integer greater than or equal to 0; according to the generation sequence of the N moments, the N behavior data are counted and sequenced to obtain a behavior data sequence, the purpose of quickly determining the behavior sequence data with the time sequence attribute is achieved, and the effect of improving the acquisition efficiency of the behavior sequence data is achieved.

As an optional scheme, before acquiring the data identification request, the method includes:

s1, training the conversion model by using the first sample characteristic in the first sample set, wherein the first sample characteristic comprises at least one of the following: the method comprises the following steps of carrying continuous sample characteristics of an abnormal label and carrying discrete sample characteristics of the abnormal label, wherein the abnormal label is used for indicating whether the abnormal label belongs to an abnormal state or not;

and S2, determining the conversion model with the output result meeting the first convergence condition as the conversion model.

Optionally, in this embodiment, the exception tag may be, but is not limited to, associated with an existing user blacklist and white list library, where the blacklist may be, but is not limited to, indicating an exception, and the white list may be, but is not limited to, indicating a normal.

It should be noted that the conversion model is trained using a first sample feature in the first sample set, where the first sample feature includes at least one of: the method comprises the following steps of carrying continuous sample characteristics of an abnormal label and carrying discrete sample characteristics of the abnormal label, wherein the abnormal label is used for indicating whether the abnormal label belongs to an abnormal state or not; and determining the conversion model of which the output result meets the first convergence condition as the conversion model.

Optionally, in this embodiment, the initialized conversion model is trained for multiple times by using multiple sample user logs, so as to obtain a conversion model;

the features in the multiple sample user logs used above may, but need not, be subject to the following processing operations: three stages of data acquisition, feature design and feature selection. The following description takes a game application as an example: in the data acquisition stage, in order that the trained model can be more universal in the whole Game, representative games are respectively selected from a plurality of Game categories such as leisure, First Person shooter games (FPS for short), Multiplayer Online tactical sports games (MOBA for short), Massive Multiplayer Online Role Playing network games (MMPRPG for short), and high-quality active samples are extracted according to business understanding. For example, MMORPG games are judged to be active with high quality through the dimensions of normal social behaviors, core play activities, income expression and the like. In the FPS game, whether the game is high-quality active or not is judged according to dimensions such as killing number, rescue number, escape proportion and the like. Through the screening mode, a batch of high-quality positive sample user logs and non-high-quality negative sample user logs are obtained. As much as possible of the different activity-related data is taken, including the duration, type, number, etc. of recently active games.

By the embodiments provided by the present application, the conversion model is trained using the first sample features in the first sample set, wherein the first sample features include at least one of: the method comprises the following steps of carrying continuous sample characteristics of an abnormal label and carrying discrete sample characteristics of the abnormal label, wherein the abnormal label is used for indicating whether the abnormal label belongs to an abnormal state or not; and determining the conversion model with the output result meeting the first convergence condition as the conversion model, so that the aim of fusing the trained conversion model into the identification model of the multi-tower network structure is fulfilled, and the effect of improving the correlation between the output characteristics of the identification model of the multi-tower network result and the abnormity is achieved.

s1, training the recognition model by using second sample characteristics in the second sample set, wherein the second sample characteristics comprise at least one of the following: the method comprises the steps of carrying out sample attribute statistical characteristics of an abnormal label, carrying sample attribute combination characteristics of the abnormal label and carrying sample behavior sequence data of the abnormal label, wherein the abnormal label is used for indicating whether the abnormal label belongs to an abnormal state or not;

and S2, determining the recognition model with the output result meeting the second convergence condition as the recognition model.

It should be noted that, the training of the recognition model of the multi-tower structure is optimized based on a two-class cross entropy objective function, the optimization method is to optimize each layer parameter of the model by using the Adam algorithm, and the learning rate can be set to 0.0001 but not limited thereto. To avoid overfitting, L2 regularization may be added, but is not limited to, to the final fully-connected layer weight parameters.

Optionally, in this embodiment, the training the initialized recognition network model multiple times by using a plurality of sample user logs to obtain the target recognition network model includes: sequentially inputting a plurality of sample user logs into a recognition network model in training to obtain a corresponding training result; and adjusting weight parameters in the recognition network model in training based on a binary cross entropy objective function, wherein the weight parameters comprise a first weight parameter set associated with a multi-scale convolution structure in a first recognition sub-network and a second weight parameter set associated with a gating filter structure, and a third weight parameter set associated with a multi-scale feature fusion structure in a second recognition sub-network.

It should be noted that, in this embodiment, the features in the multiple sample user logs used above may be, but are not limited to, the following processing operations: three stages of data acquisition, feature design and feature selection. The following description takes a game application as an example:

in the data acquisition stage, in order that the trained model can be more universal in the whole Game, representative games are respectively selected from a plurality of Game categories such as leisure, First Person shooter games (FPS for short), Multiplayer Online tactical sports games (MOBA for short), Massive Multiplayer Online Role Playing network games (MMPRPG for short), and high-quality active samples are extracted according to business understanding. For example, MMORPG games are judged to be active with high quality through the dimensions of normal social behaviors, core play activities, income expression and the like. In the FPS game, whether the game is high-quality active or not is judged according to dimensions such as killing number, rescue number, escape proportion and the like. Through the screening mode, a batch of high-quality positive sample user logs and non-high-quality negative sample user logs are obtained. As much as possible of the different activity-related data is taken, including the duration, type, number, etc. of recently active games. In addition, in the stage of selecting the design of the features, reference may be made to the above embodiments, which are not described in detail in this embodiment.

By the embodiments provided herein, the recognition model is trained using second sample features in the second sample set, wherein the second sample features include at least one of: the method comprises the steps of carrying out sample attribute statistical characteristics of an abnormal label, carrying sample attribute combination characteristics of the abnormal label and carrying sample behavior sequence data of the abnormal label, wherein the abnormal label is used for indicating whether the abnormal label belongs to an abnormal state or not; and determining the recognition model with the output result meeting the second convergence condition as a recognition model, and training by utilizing multi-dimensional rich characteristics to obtain the recognition model capable of accurately recognizing whether the target account number of the user is abnormal or not.

The description is made with reference to the example shown in fig. 11: the application scheme is assumed to be implemented in the following environment: the adopted hardware platform comprises a core (TM) i7-8700 CPU @3.6GHz processor, a 14G memory, a 256G solid state disk and a STRIX-GTX1080TI-11G video card. The software platform used was a 64-bit operating system based on window10, python2.7, Tensorflow1.8.

Based on the user anomaly discrimination model architecture in fig. 11 that adapts user game attributes and behavior sequences based on the multi-tower neural network structure, parameters and output dimensions of each module are described as follows. The characteristics extracted from the game logs of the single user are used as input samples, wherein the length of the extracted behavior sequence is L, the number of the statistical characteristics of the game attributes of the original user is N, the number of the characteristics of the XGboost leaf nodes is M, and the specific structural parameters and the output results of the whole network are shown in the following tables 1-4. Table 1 is a network structure parameter table of the attention mechanism based sequence CNN module. Table 2 is a multi-order feature extraction of the original game attribute features, and table 3 is a network structure parameter table of the attention feature fusion module based on XGBoost leaf nodes. Table 4 is a table of classified network parameters that fuses two statistical feature vectors and behavior sequence feature vectors. (some Drop Out and regularization assist operations that avoid overfitting, activation functions, etc. are not represented in the table below).

TABLE 1

TABLE 1 (continuation)

TABLE 2

Table 2 (continuation)

TABLE 3

TABLE 4

Table 4 (continuation)

Further, the following description is specifically made with reference to an example shown in fig. 12:

optionally, the specific steps are as shown in fig. 12: firstly, behavior sequence data (such as behavior sequences of tasks, money gains, ID of picked-up articles and the like) is extracted from log data by using a general sequence preprocessing script, and the behavior sequence features of the ID with indefinite length are obtained through conversion. Meanwhile, user game attribute features (attribute statistical features) are obtained from log data in a statistical mode by using a general statistical script, original features of the user game attributes are further obtained through numerical value normalization, combined feature numbers formed by paths from root nodes to leaf nodes in each tree are obtained through prediction of a trained XGboost model, and Multi-Hot features are formed by the combined feature numbers of a plurality of trees. And then, reading the three characteristic data through a model preprocessing script to automatically generate a corresponding model configuration file, scheduling the multi-tower classification model provided by the text for model training, and storing the model with the optimal effect in the verification set. Regardless of the game, the method can adaptively generate training data of the original features, the Multi-Hot features and the behavior sequence features through a universal preprocessing script, and then, the method is combined with a Multi-tower model to carry out automatic model training to adaptively learn the relationship between the features and the abnormal label of the user. Because the feature extraction part uses the user general features in the game, the method can realize the integration and the process of feature conversion and model training which are not changed due to the change of the game types. Moreover, for the game which needs to be further modeled by using some special user game attribute features, only the mode of extracting the features from the log source data needs to be modified, and the feature conversion and model training part can be adaptive to the types and dimensions of the features for automatic training. Therefore, the method can be conveniently transferred from one game to the other game for judging the user abnormity.

Finally, in this embodiment, the deployment of the online prediction system is also streamlined, and as long as the model file name and the prediction mode to be loaded are selected in the form of the configuration file, the feature conversion of the user log can be completed and the daily offline prediction or real-time online prediction can be performed through the general feature processing and model prediction program, and the suspicious probability of the user is returned. The operator side can conveniently manage a certain number of highly suspicious users by combining the probability threshold value of the model.

Further, based on the feature extraction flow shown in fig. 12, a training data set composed of user game attribute features, XGBoost tree node features, and behavior sequences is extracted from a user game log of a certain game of the MMORPG class, and model training is performed on a plurality of models. Then, at a black-and-white sample ratio of 37843: 250436, the model effect evaluation table 5 demonstrates the excellent performance of the model of the present invention. For the model names in table 5, wherein XGBSUM indicates that the XGBoost predicts that leaf nodes are Embedding and then directly sum the corresponding element dimensions of the leaf nodes of all trees (i.e. leaf node features are OneHot encoded and then mapped into feature vectors through the full connection layer), the operations of XGBATT and XGBSUM are similar, and the summation operation is changed into the above-described attention weighting operation. NFM represents the multi-level feature fusion network architecture module introduced above based on user game attribute features. CNNATT represents the multi-scale CNN behavior sequence feature extraction structure combined with the attention mechanism introduced above; CNNMAX is similar to CNNATT, replacing the attention mechanism with a max-pooling operation for the compression of CNN output results. SELFATT represents a 2-layer self-attack structure of the encoder part in the transform architecture. "merge" means that the models of names before and after merge are trained separately and then averaged based on probability. Modules without merge to represent names between model name representations "_" are connected by a network fabric, enabling end-to-end trained models. The model name, e.g., XGBATT _ NFM _ CNNATT, represents the above-described inventive model. As can be seen from Table 5, the XBATT _ NFM _ CNNMAX model has the best effect in the models containing both the CNNMAX modules, and the effect is better than that of the model containing only one of the XBATT and the NFM, so that the effectiveness of the XBATT _ NFM statistical feature conversion structure is proved, and the user game attribute features can be comprehensively extracted and fused in a self-adaptive manner. This also shows that the dual user game attribute feature structure is more efficient in comparison of the 3 models XBATT _ NFM, XBATT and NFM. Meanwhile, the XGBAT model and the XGBAT _ NFM _ CNNMAX model have better effects than the XGBUM model and the XGBUM _ NFM _ CNNMAX model respectively, which shows that the XGBAT structure is more excellent than the XGBUM structure, and proves that the scheme of fusing the XGboost leaf nodes by combining the attention mechanism in the embodiment is more effective than direct summation.

TABLE 5

The conclusion can be further verified from the comparison of the ROC curve effect obtained from the experiment. Moreover, no matter whether the behavior sequence feature extraction is performed by using CNNMAX, CNNAT or SELFATT, the effect of the model containing the statistical features of the behavior features is improved by about 1% compared with the effect of the model containing the statistical features, and the effect of the model containing the behavior sequence features is improved by about 1.5% compared with the effect of the model containing the behavior sequence features, which shows the importance of combination of the statistical features and the behavior sequence features. Furthermore, in the model containing both statistical and sequence features, whether the behavior sequence feature extraction is performed by using CNNMAX, CNNAT or self fatt, the end-to-end model has better effect than the model based on probability integration (including "merge"). Meanwhile, the XGBAT _ NFM _ CNNATT model recorded in the application has better effect than XGBUM _ NFM _ CNNMAX, is slightly worse than XGBAT _ NFM _ SELFATT model, and has higher operation efficiency than XGBAT _ NFM _ SELFATT model. Furthermore, it was found from the ROC curve comparison obtained from the experiments that the test set of the XBATT _ NFM _ CNNATT model evaluated the AUC value to be 0.9884, while the AUC value of the XBATT _ NFM _ SELFATT model was 0.9881, indicating that the two are not primary and secondary.

Finally, the effect performance of a plurality of models in the test set is integrated, which shows that the model of the embodiment has excellent effect performance. Due to the simple and easy use of the scheme of the embodiment, various combination features of the user game attribute features can be adequately mined in a self-adaptive manner, and the fusion modeling of behavior sequence data with different lengths is supported. Based on the processing flow in fig. 12, only the original user game attribute features and game behavior sequence data need to be improved, the model can be trained with low cost and high efficiency, and then online prediction can be performed by selecting a mode of loading the trained model. Therefore, the modeling cost and the prediction cost for judging the abnormal user are reduced, and the judgment accuracy of the abnormal user is further improved through the multi-tower network structure integrating the multi-source characteristics. When the user anomaly detection model is actually used by an operator, a certain number of highly suspicious anomalous users can be found according to the prediction probability of the user anomaly judgment model by setting a probability threshold value, and the highly suspicious anomalous users are controlled to a certain degree. In a word, the embodiment effectively hits abnormal players, purifies the game environment and reduces the cost of safe operation of the game.

It should be noted that, for simplicity of description, the above-mentioned method embodiments are described as a series of acts or combination of acts, but those skilled in the art will recognize that the present invention is not limited by the order of acts, as some steps may occur in other orders or concurrently in accordance with the invention. Further, those skilled in the art should also appreciate that the embodiments described in the specification are preferred embodiments and that the acts and modules referred to are not necessarily required by the invention.

According to another aspect of the embodiment of the invention, a data anomaly identification device for implementing the data anomaly identification method is further provided. As shown in fig. 13, the apparatus includes:

an obtaining unit 1302, configured to obtain a data identification request, where the data identification request is used to request to confirm whether log data generated by a target account in a target game application in a target time period is abnormal;

a response unit 1304, configured to respond to the data identification request, and acquire attribute statistical characteristics and behavior sequence data corresponding to the log data, where the attribute statistical characteristics include characteristics obtained by respectively counting parameter changes of multiple attribute parameters associated with the target account within a target time period, and the behavior sequence data include time sequence data of a behavior executed by a virtual object controlled by the target account within the target time period;

a first input unit 1306, configured to input the attribute statistical features into a conversion model to obtain attribute combination features output by the conversion model, where the conversion model is used to convert the input features into output features of feature combination information with decision tree characteristics;

a second input unit 1308, configured to input the attribute combination feature, the attribute statistical feature, and the behavior sequence data into a recognition model to obtain a data recognition result output by the recognition model, where the data recognition result is used to indicate whether the log data is abnormal, and the recognition model includes a first fusion structure for fusing the attribute combination feature and the attribute statistical feature to obtain a first fusion feature, a second fusion structure for fusing the first fusion feature and the behavior sequence data to obtain a second fusion feature, and a recognition structure for recognizing whether the log data is abnormal by using the second fusion feature.

Optionally, in this embodiment, the data anomaly recognition apparatus may be applied, but not limited to, in a human-computer interaction application (i.e., a target game application), such as a game application, an instant messaging application, a video playing application, and so on. Through the steps provided in the embodiment of the application, the behavior sequence data and the attribute statistical characteristics of each account are extracted according to the behavior record generated by the human-computer interaction behavior executed by the user in the client and the account number of the user or the attribute value of the virtual role controlled by the user, and the attribute combination characteristics with higher correlation with abnormal data are further obtained based on the trained conversion model and the attribute statistical characteristics, so that the three data/characteristics are fused to perform abnormity judgment on the user, and a data identification result for indicating whether the user behavior or the attribute value is abnormal is obtained, so that the abnormal user is accurately identified, and the abnormal user is controlled to a certain degree to purify the game environment. In addition, through the steps provided in the embodiment of the present application, when the operator actually uses the game, the operator may further but not limited to find a certain number of highly suspicious abnormal users for effective hit according to the data identification result by setting a probability threshold, and perform an operation of importing the target list according to the low suspicious abnormal users found according to the data identification result, which may but not limited to perform more strict manual judgment on the users, so as to reduce the cost of game security operation.

It should be noted that, the conversion model and the obtained attribute statistical characteristics are firstly utilized to obtain attribute combination characteristics with stronger discretization and combination capabilities, and meanwhile, the attribute statistical characteristics and the attribute combination characteristics are fused, so that the output first fusion characteristics have the advantage of high correlation peculiar to the attribute statistical characteristics, and the obtained first fusion characteristics also avoid the problem of information loss possibly occurring in the follow-up process due to the fact that the attribute statistical characteristics record original characteristic information;

Optionally, in this embodiment, the attribute statistical characteristics include characteristics obtained by respectively counting parameter changes of a plurality of attribute parameters associated with the target account within the target time period, specifically, the attribute statistical characteristics may also be, but are not limited to, interactive behaviors performed on the target account and/or attribute values of the target account, and statistical results are respectively counted based on a plurality of statistical tags. For example, taking a game application as an example, the statistical tags may include, but are not limited to: game type preferences, number of game activations, activity period distribution, team speaking, and the like. Here, the attribute statistical characteristics may include, but are not limited to: continuous numerical features, category type features. The above attribute statistical characteristics can be further processed: for example, the value of the continuous numerical value feature is normalized, and the one-hot encoding (one-hot) processing is performed on the discrete category feature. Then, the processed features are filtered to remove redundant features, and other reference features meeting conditions are removed, such as single variable verification of the features, then variables with extremely small numerical variance and small Information Value (IV) are removed, or variables with high correlation are found through correlation coefficients.

Optionally, in this embodiment, but not limited to, the obtained attribute statistical features and the behavior sequence data may be fused by using a recognition model combining a transform network and a multi-tower structure to obtain output features with high robustness, so as to obtain an output data recognition result.

According to the embodiment provided by the application, a data identification request is obtained, wherein the data identification request is used for requesting to confirm whether log data generated by a target account in a target game application in a target time period is abnormal; responding to the data identification request, and acquiring attribute statistical characteristics and behavior sequence data corresponding to log data, wherein the attribute statistical characteristics comprise characteristics obtained by respectively counting parameter changes of a plurality of attribute parameters associated with the target account in a target time period, and the behavior sequence data comprise time sequence data of behaviors executed by a virtual object controlled by the target account in the target time period; inputting the attribute statistical characteristics into a conversion model to obtain attribute combination characteristics output by the conversion model, wherein the conversion model is used for converting the input characteristics into output characteristics of characteristic combination information with decision tree characteristics; inputting the attribute combination feature, the attribute statistical feature and the behavior sequence data into a recognition model to obtain a data recognition result output by the recognition model, wherein the data recognition result is used for indicating whether log data are abnormal or not, the recognition model comprises a first fusion structure for fusing the attribute combination feature and the attribute statistical feature to obtain a first fusion feature, a second fusion structure for fusing the first fusion feature and the behavior sequence data to obtain a second fusion feature, and the recognition structure for recognizing whether the log data are abnormal or not by using the second fusion feature, firstly using a conversion model and the obtained attribute statistical feature to obtain an attribute combination feature with stronger discretization and combination capability, and simultaneously fusing the attribute statistical feature and the attribute combination feature to ensure that the output first fusion feature has the advantage of high correlation specific to the attribute statistical feature, original feature information is recorded due to the attribute statistical features, so that the problem of information loss possibly occurring in the follow-up process is solved for the acquired first fusion features; furthermore, the identification model is reused to fuse the acquired behavior sequence data and the first fusion characteristic, and the behavior sequence data has key and rich voice characteristics for judging data abnormity and is complementary with the first fusion characteristic, so that the output second fusion characteristic combines the reserved original information of the attribute statistical characteristic, the high correlation of the attribute combination characteristic and the rich advantages of the behavior sequence data, the purpose of enabling the characteristics for acquiring the data identification result to be more robust is achieved, and the effect of improving the accuracy of data abnormity identification is achieved.

For a specific embodiment, reference may be made to the example shown in the data anomaly identification method, which is not described herein again in this example.

As an alternative, the second input unit 1308 includes:

a first input module for inputting the attribute combination characteristic into a first sub-network to obtain a first output characteristic, wherein the recognition model comprises the first sub-network;

a second input module, configured to input the attribute statistical characteristic into a second sub-network to obtain a second output characteristic, wherein the recognition model includes the second sub-network;

a third input module, configured to input the first output feature and the second output feature into the first fully-connected layer to obtain a first fused feature, where the first output feature and the second output feature are fused in the first fully-connected layer, and the first fused structure includes the first fully-connected layer;

a fourth input module, configured to input the behavior sequence data into a third sub-network to obtain a third output characteristic, wherein the recognition model includes the third sub-network;

a fifth input module, configured to input the third output feature and the first fused feature into the second fully-connected layer to obtain a second fused feature, where the second fused structure includes the second fully-connected layer;

and the sixth input module is used for inputting the second fusion characteristic into the classification layer of the second full connection layer so as to obtain a data identification result, wherein the identification structure comprises the classification layer.

As an alternative, the first input module includes:

a first input sub-module, configured to input the attribute combination features into an embedding layer of a first sub-network to obtain M attribute combination vectors, where the attribute combination vectors correspond to the attribute combination features, and M is a positive integer greater than or equal to 1;

and the fusion submodule is used for fusing the M attribute combination vectors based on the attention mechanism to obtain a target attribute fusion vector, and taking the target attribute fusion vector as a first output characteristic.

As an alternative, the second input module includes:

the second input sub-module is used for inputting the attribute statistical characteristics into the embedding layer of the second sub-network so as to obtain attribute statistical vectors of target dimensions, wherein the target dimensions are matched with the second sub-network, and the attribute statistical vectors are distributed vectors corresponding to the attribute statistical characteristics;

and the third input submodule is used for inputting the attribute statistical vector into the second sub-network so as to obtain a second output characteristic.

As an alternative, the third input submodule includes:

the acquiring subunit is used for acquiring a first-order output vector according to the target product of the attribute statistical vector and the characteristic value of the attribute statistical characteristic, wherein the first-order output vector is obtained by performing weighting calculation on the target product;

the combination subunit is used for pairwise combining the attribute statistical vectors to obtain a second-order output vector;

and the fourth input submodule is used for inputting the first-order output vector and the second-order output vector into a third full-connection layer of the second sub-network so as to obtain a third fusion characteristic, wherein the third fusion characteristic is used for representing the fusion characteristic of the first-order output vector and the second-order output vector.

As an optional solution, the fourth input module includes:

a first execution sub-module, configured to perform vector mapping on the behavior sequence data in an embedding layer of the third sub-network to obtain a first behavior sequence vector;

a second execution sub-module, configured to perform feature extraction on the first behavior sequence vector in a convolutional layer of a third sub-network to obtain a second behavior sequence vector;

performing feature fusion on the second behavior sequence vector in a pooling layer of a third subnetwork to obtain a third behavior sequence vector;

a third execution submodule, configured to perform, in the translation layer of the third subnetwork, preservation and fusion of high-level features on the third row sequence vector to obtain a fourth row sequence vector;

a fourth execution submodule, configured to perform feature conversion and feature dimensionality reduction on the fourth row-wise sequence vector in a fourth fully-connected layer of the third subnetwork to obtain a fifth row-wise sequence vector;

and the fifth execution submodule is used for taking the fifth behavior sequence vector as a third output characteristic.

As an alternative, the first input unit 1306 includes:

the seventh input module is used for inputting the attribute statistical characteristics into the conversion model;

the prediction module is used for respectively predicting M attribute combination sub-features corresponding to the attribute statistical features by using tree structures of M decision trees in the conversion model, wherein each attribute combination sub-feature is a coding feature corresponding to a leaf node of one tree structure;

and taking the M attribute combination sub-features as attribute combination features.

As an optional solution, the response unit 1304 includes:

the device comprises a first extraction module, a second extraction module and a third extraction module, wherein the first extraction module is used for extracting initial attribute statistical characteristics from log data, and the initial attribute statistical characteristics comprise continuous numerical characteristics and discrete category characteristics;

and the first processing module is used for carrying out normalization processing on the continuous numerical characteristics and carrying out filtering and coding processing on the discrete type characteristics so as to obtain attribute statistical characteristics.

As an optional solution, the response unit 1304 includes:

the second extraction module is used for extracting initial behavior sequence data from the log data, wherein the initial behavior sequence data comprises N behavior data, the N behavior data correspond to N moments, the target time period comprises N moments, and N is an integer greater than or equal to 0;

and the second processing module is used for counting and sequencing the N behavior data according to the generation sequence of the N moments to obtain a behavior data sequence.

As an alternative, the method comprises the following steps:

a first training unit, configured to train the conversion model using first sample features in a first sample set before obtaining the data recognition request, where the first sample features include at least one of: the method comprises the following steps of carrying continuous sample characteristics of an abnormal label and carrying discrete sample characteristics of the abnormal label, wherein the abnormal label is used for indicating whether the abnormal label belongs to an abnormal state or not;

and a first determination unit configured to determine, as a conversion model, a conversion model whose output result satisfies a first convergence condition before acquiring the data recognition request.

As an alternative, the method comprises the following steps:

a second training unit, configured to train the recognition model using second sample features in a second sample set before obtaining the data recognition request, where the second sample features include at least one of: the method comprises the steps of carrying out sample attribute statistical characteristics of an abnormal label, carrying sample attribute combination characteristics of the abnormal label and carrying sample behavior sequence data of the abnormal label, wherein the abnormal label is used for indicating whether the abnormal label belongs to an abnormal state or not;

and a second determination unit configured to determine, as the recognition model, a recognition model whose output result satisfies a second convergence condition before acquiring the data recognition request.

According to a further aspect of the embodiments of the present invention, there is also provided an electronic device for implementing the data anomaly identification method, as shown in fig. 14, the electronic device includes a memory 1402 and a processor 1404, the memory 1402 stores therein a computer program, and the processor 1404 is configured to execute the steps in any one of the method embodiments by the computer program.

Optionally, in this embodiment, the electronic device may be located in at least one network device of a plurality of network devices of a computer network.

Optionally, in this embodiment, the processor may be configured to execute the following steps by a computer program:

s1, acquiring a data identification request, wherein the data identification request is used for requesting to confirm whether log data generated by a target account in a target game application in a target time period is abnormal or not;

s2, responding to the data identification request, and acquiring attribute statistical characteristics and behavior sequence data corresponding to the log data, wherein the attribute statistical characteristics comprise characteristics obtained by respectively counting parameter changes of a plurality of attribute parameters associated with the target account in the target time period, and the behavior sequence data comprise time sequence data of behaviors executed by a virtual object controlled by the target account in the target time period;

s3, inputting the attribute statistical characteristics into a conversion model to obtain attribute combination characteristics output by the conversion model, wherein the conversion model is used for converting the input characteristics into output characteristics of characteristic combination information with decision tree characteristics;

and S4, inputting the attribute combination feature, the attribute statistical feature and the behavior sequence data into a recognition model to obtain a data recognition result output by the recognition model, wherein the data recognition result is used for indicating whether the log data are abnormal or not, the recognition model comprises a first fusion structure used for fusing the attribute combination feature and the attribute statistical feature to obtain a first fusion feature, a second fusion structure used for fusing the first fusion feature and the behavior sequence data to obtain a second fusion feature, and the recognition structure used for recognizing whether the log data are abnormal or not by using the second fusion feature.

Alternatively, it can be understood by those skilled in the art that the structure shown in fig. 14 is only an illustration, and the electronic device may also be a terminal device such as a smart phone (e.g., an Android phone, an iOS phone, etc.), a tablet computer, a palmtop computer, and a Mobile Internet Device (MID), a PAD, and the like. Fig. 14 does not limit the structure of the electronic device. For example, the electronic device may also include more or fewer components (e.g., network interfaces, etc.) than shown in FIG. 14, or have a different configuration than shown in FIG. 14.

The memory 1402 may be configured to store software programs and modules, such as program instructions/modules corresponding to the data exception identifying method and apparatus in the embodiment of the present invention, and the processor 1404 executes various functional applications and data processing by running the software programs and modules stored in the memory 1402, that is, implementing the data exception identifying method. Memory 1402 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 1402 may further include memory located remotely from the processor 1404, which may be connected to a terminal over a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof. The memory 1402 may be specifically, but not limited to, used to store information such as data identification request, attribute combination feature, attribute statistical feature, behavior sequence data, and data identification result. As an example, as shown in fig. 14, the memory 1402 may include, but is not limited to, an obtaining unit 1302, a responding unit 1304, a first input unit 1306, and a second input unit 1308 of the data abnormality recognition apparatus. In addition, the data anomaly identification device may further include, but is not limited to, other module units in the data anomaly identification device, which is not described in detail in this example.

Optionally, the transmitting device 1406 is used for receiving or sending data via a network. Examples of the network may include a wired network and a wireless network. In one example, the transmission device 1406 includes a Network adapter (NIC) that can be connected to a router via a Network cable and other Network devices to communicate with the internet or a local area Network. In one example, the transmitting device 1406 is a Radio Frequency (RF) module, which is used to communicate with the internet by wireless means.

In addition, the electronic device further includes: a display 1408 for displaying information such as the data identification request, the attribute combination feature, the attribute statistical feature, the behavior sequence data, and the data identification result; and a connection bus 1410 for connecting the respective module parts in the above-described electronic apparatus.

In other embodiments, the terminal device or the server may be a node in a distributed system, where the distributed system may be a blockchain system, and the blockchain system may be a distributed system formed by connecting a plurality of nodes through a network communication. The nodes may form a Peer-To-Peer (P2P) network, and any type of computing device, such as a server, a terminal, and other electronic devices, may become a node in the blockchain system by joining the Peer-To-Peer network.

According to an aspect of the application, a computer program product or computer program is provided, comprising computer instructions, the computer instructions being stored in a computer readable storage medium. A processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions to cause the computer device to execute the data anomaly identification method, wherein the computer program is configured to execute the steps in any of the method embodiments.

Alternatively, in the present embodiment, the above-mentioned computer-readable storage medium may be configured to store a computer program for executing the steps of:

Alternatively, in this embodiment, a person skilled in the art may understand that all or part of the steps in the methods of the foregoing embodiments may be implemented by a program instructing hardware associated with the terminal device, where the program may be stored in a computer-readable storage medium, and the storage medium may include: flash disks, Read-Only memories (ROMs), RandoM Access Memories (RAMs), magnetic or optical disks, and the like.

The above-mentioned serial numbers of the embodiments of the present invention are merely for description and do not represent the merits of the embodiments.

The integrated unit in the above embodiments, if implemented in the form of a software functional unit and sold or used as a separate product, may be stored in the above computer-readable storage medium. Based on such understanding, the technical solution of the present invention may be substantially or partially implemented in the prior art, or all or part of the technical solution may be embodied in the form of a software product stored in a storage medium, and including instructions for causing one or more computer devices (which may be personal computers, servers, or network devices) to execute all or part of the steps of the method according to the embodiments of the present invention.

In the above embodiments of the present invention, the descriptions of the respective embodiments have respective emphasis, and for parts that are not described in detail in a certain embodiment, reference may be made to related descriptions of other embodiments.

In the several embodiments provided in the present application, it should be understood that the disclosed client may be implemented in other manners. The above-described embodiments of the apparatus are merely illustrative, and for example, a division of a unit is merely a division of a logic function, and an actual implementation may have another division, for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, units or modules, and may be in an electrical or other form.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit.

The foregoing is only a preferred embodiment of the present invention, and it should be noted that, for those skilled in the art, various modifications and decorations can be made without departing from the principle of the present invention, and these modifications and decorations should also be regarded as the protection scope of the present invention.

Claims

1. A data anomaly identification method is characterized by comprising the following steps:

acquiring a data identification request, wherein the data identification request is used for requesting to confirm whether log data generated by a target account in a target game application within a target time period is abnormal or not;

responding to the data identification request, and acquiring attribute statistical characteristics and behavior sequence data corresponding to the log data, wherein the attribute statistical characteristics comprise characteristics obtained by respectively counting parameter changes of a plurality of attribute parameters associated with the target account in the target time period, and the behavior sequence data comprise time sequence data of behaviors executed by a virtual object controlled by the target account in the target time period;

inputting the attribute statistical characteristics into a conversion model to obtain attribute combination characteristics output by the conversion model, wherein the conversion model is used for converting the input characteristics into the attribute combination characteristics with decision tree characteristics;

inputting the attribute combination feature, the attribute statistical feature and the behavior sequence data into a recognition model to obtain a data recognition result output by the recognition model, wherein the data recognition result is used for indicating whether the log data is abnormal, the recognition model comprises a first fusion structure for fusing the attribute combination feature and the attribute statistical feature to obtain a first fusion feature, a second fusion structure for fusing the first fusion feature and the behavior sequence data to obtain a second fusion feature, and a recognition structure for recognizing whether the log data is abnormal by using the second fusion feature.

2. The method of claim 1, wherein the inputting the attribute combination feature, the attribute statistical feature and the behavior sequence data into a recognition model to obtain a data recognition result output by the recognition model comprises:

inputting the attribute combination feature into a first sub-network to obtain a first output feature, wherein the recognition model comprises the first sub-network;

inputting the attribute statistical features into a second sub-network to obtain second output features, wherein the recognition model comprises the second sub-network;

inputting the first output feature, the second output feature into a first fully-connected layer to obtain the first fused feature, wherein the first output feature and the second output feature are fused in the first fully-connected layer, the first fused structure comprising the first fully-connected layer;

inputting the behavior sequence data into a third sub-network to obtain a third output characteristic, wherein the recognition model comprises the third sub-network;

inputting the third output feature, the first fused feature into a second fully-connected layer to obtain the second fused feature, wherein the second fused structure comprises the second fully-connected layer;

inputting the second fused feature into a classification layer of the second fully-connected layer to obtain the data recognition result, wherein the recognition structure comprises the classification layer.

3. The method of claim 2, wherein inputting the attribute combination characteristic into a first sub-network to obtain a first output characteristic comprises:

inputting the attribute combination features into an embedding layer of the first subnetwork to obtain M attribute combination vectors, wherein the attribute combination vectors correspond to the attribute combination features, and M is a positive integer greater than or equal to 1;

fusing the M attribute combination vectors based on an attention mechanism to obtain a target attribute fusion vector, and taking the target attribute fusion vector as the first output feature.

4. The method of claim 2, wherein inputting the attribute statistical characteristic into a second sub-network to obtain a second output characteristic comprises:

inputting the attribute statistical features into an embedding layer of the second sub-network to obtain attribute statistical vectors of target dimensions, wherein the target dimensions are matched with the second sub-network, and the attribute statistical vectors are distributed vectors corresponding to the attribute statistical features;

inputting the attribute statistics vector into the second subnetwork to obtain the second output characteristic.

5. The method of claim 4, wherein inputting the attribute statistics vector into the second sub-network to obtain the second output feature comprises:

acquiring a first-order output vector according to the attribute statistical vector and a target product of the characteristic values of the attribute statistical characteristics, wherein the first-order output vector is obtained by performing weighted calculation on the target product;

combining the attribute statistical vectors pairwise to obtain a second-order output vector;

inputting the first-order output vector and the second-order output vector into a third fully-connected layer of the second sub-network to obtain a third fused feature, wherein the third fused feature is used for representing the fused feature of the first-order output vector and the second-order output vector.

6. The method of claim 2, wherein inputting the behavior sequence data into a third sub-network to obtain a third output characteristic comprises:

performing, in an embedding layer of the third subnetwork, vector mapping on the behavior sequence data to obtain a first behavior sequence vector;

performing feature extraction on the first behavior sequence vector in a convolutional layer of the third subnetwork to obtain a second behavior sequence vector;

performing feature fusion on the second behavior sequence vector in a pooling layer of the third subnetwork to obtain a third behavior sequence vector;

in the translation layer of the third subnetwork, performing preservation and fusion of high-level features on the third row-wise sequence vector to obtain a fourth row-wise sequence vector;

in a fourth fully connected layer of the third subnetwork, performing feature transformation and feature dimensionality reduction on the fourth row-wise sequence vector to obtain a fifth row-wise sequence vector;

taking the fifth behavior sequence vector as the third output feature.

7. The method of claim 3, wherein inputting the attribute statistical features into a transformation model to obtain attribute combination features output by the transformation model comprises:

inputting the attribute statistical features into the conversion model;

respectively predicting M attribute combination sub-features corresponding to the attribute statistical features by using tree structures of M decision trees in the conversion model, wherein each attribute combination sub-feature is a coding feature corresponding to a leaf node of one tree structure;

and taking the M attribute combination sub-features as the attribute combination feature.

8. The method of claim 1, wherein obtaining attribute statistics corresponding to the log data in response to the data identification request comprises:

extracting initial attribute statistical characteristics from the log data, wherein the initial attribute statistical characteristics comprise continuous numerical characteristics and discrete category characteristics;

and normalizing the continuous numerical features, and filtering and coding the discrete type features to obtain the attribute statistical features.

9. The method of claim 1, wherein the obtaining behavior sequence data corresponding to the log data in response to the data recognition request comprises:

extracting initial behavior sequence data from the log data, wherein the initial behavior sequence data comprises N behavior data, the N behavior data correspond to N time instants, the target time period comprises the N time instants, and N is an integer greater than or equal to 0;

and counting and sequencing the N behavior data according to the generation sequence of the N moments to obtain a behavior data sequence.

10. The method of claim 1, prior to the get data identification request, comprising:

training the conversion model using first sample features in a first sample set, wherein the first sample features include at least one of: the method comprises the following steps of carrying continuous sample characteristics of an abnormal label and carrying discrete sample characteristics of the abnormal label, wherein the abnormal label is used for indicating whether the abnormal label belongs to an abnormal state or not;

and determining the conversion model with the output result meeting the first convergence condition as the conversion model.

11. The method of claim 1, prior to the get data identification request, comprising:

training the recognition model using second sample features in a second sample set, wherein the second sample features include at least one of: the method comprises the steps of carrying out sample attribute statistical characteristics of an abnormal label, carrying sample attribute combination characteristics of the abnormal label and carrying sample behavior sequence data of the abnormal label, wherein the abnormal label is used for indicating whether the abnormal label belongs to an abnormal state or not;

and determining the recognition model with the output result meeting a second convergence condition as the recognition model.

12. A data abnormality recognition apparatus, characterized by comprising:

the system comprises an acquisition unit, a processing unit and a processing unit, wherein the acquisition unit is used for acquiring a data identification request which is used for requesting to confirm whether log data generated by a target account in a target game application in a target time period is abnormal or not;

a response unit, configured to respond to the data identification request, and acquire an attribute statistical feature and behavior sequence data corresponding to the log data, where the attribute statistical feature includes features obtained by respectively counting parameter changes of multiple attribute parameters associated with the target account in the target time period, and the behavior sequence data includes time sequence data of a behavior executed by a virtual object controlled by the target account in the target time period;

the first input unit is used for inputting the attribute statistical characteristics into a conversion model to obtain attribute combination characteristics output by the conversion model, wherein the conversion model is used for converting the input characteristics into output characteristics of characteristic combination information with decision tree characteristics;

a second input unit, configured to input the attribute combination feature, the attribute statistical feature and the behavior sequence data into a recognition model to obtain a data recognition result output by the recognition model, where the data recognition result is used to indicate whether the log data is abnormal, and the recognition model includes a first fusion structure used to fuse the attribute combination feature and the attribute statistical feature to obtain a first fusion feature, a second fusion structure used to fuse the first fusion feature and the behavior sequence data to obtain a second fusion feature, and a recognition structure used to recognize whether the log data is abnormal by using the second fusion feature.

13. The apparatus of claim 12, wherein the second input unit comprises:

a first input module for inputting the attribute combination feature into a first sub-network to obtain a first output feature, wherein the recognition model comprises the first sub-network;

a third input module, configured to input the first output feature and the second output feature into a first fully-connected layer to obtain the first fused feature, wherein the first output feature and the second output feature are fused in the first fully-connected layer, and the first fused structure comprises the first fully-connected layer;

a fifth input module, configured to input the third output feature and the first fused feature into a second fully-connected layer to obtain the second fused feature, where the second fused structure includes the second fully-connected layer;

a sixth input module, configured to input the second fusion feature into a classification layer of the second full connection layer to obtain the data identification result, where the identification structure includes the classification layer.

14. A computer-readable storage medium, comprising a stored program, wherein the program is operable to perform the method of any one of claims 1 to 11.

15. An electronic device comprising a memory and a processor, characterized in that the memory has stored therein a computer program, the processor being arranged to execute the method of any of claims 1 to 11 by means of the computer program.