CN114022049A

CN114022049A - Intelligent service information risk processing method and system based on cloud computing

Info

Publication number: CN114022049A
Application number: CN202111502871.XA
Authority: CN
Inventors: 徐志全; 张红艳
Original assignee: Pingxiang Shengmai Internet Technology Co ltd
Current assignee: Foshan Fengwang Human Resources Co ltd
Priority date: 2021-12-10
Filing date: 2021-12-10
Publication date: 2022-02-08
Anticipated expiration: 2041-12-10
Also published as: CN114022049B

Abstract

The application relates to the technical field of cloud computing and business risk processing, in particular to a smart business information risk processing method and system based on cloud computing, and aims to solve the problem that a session distribution structure of a smart business session log with a privacy information stealing risk does not need to be modified, so that the software and hardware resource overhead of privacy threat information detection is reduced while the privacy threat information detection precision is ensured, and the privacy threat detection efficiency is improved to a certain extent.

Description

Intelligent service information risk processing method and system based on cloud computing

Technical Field

The embodiment of the application relates to the technical field of cloud computing and business risk processing, in particular to a cloud computing-based intelligent business information risk processing method and system.

Background

The cloud computing has the outstanding characteristics of having a large amount of basic software and hardware resources and realizing the scale of the basic resources. The cloud computing/cloud service can improve the utilization rate of resources and reduce the use cost of unit resources. Considering design based on an Iaas architecture, taking a cloud computing data center as a core, creating a public cloud independent of a plurality of application systems, and building a public cloud by various different clouds, such as: the system comprises a cloud storage module, a cloud management module and a cloud management module.

With the rapid development of cloud services, information threat detection becomes more and more difficult due to more and more complex application environments in the cloud service processing process, and therefore, it becomes especially important to strengthen risk protection on relevant service information.

Disclosure of Invention

In view of this, the embodiment of the present application provides a method and a system for risk processing of smart business information based on cloud computing.

In a first aspect, the present application provides a smart business information risk processing method based on cloud computing, including: performing session activity interest mining on intelligent service session logs with privacy information stealing risks to obtain abnormal activity interest description features 1 in a plurality of service states; based on the abnormal activity interest description feature1, performing interest description attribute updating to obtain an abnormal activity interest description feature2 corresponding to the abnormal activity interest description feature1 in each service state; the interest description attributes of the abnormal activity interest description feature2 corresponding to the abnormal activity interest description feature1 in different service states are consistent; updating the interest description attributes of the abnormal activity interest description feature2 in each service state one by one to obtain an abnormal activity interest description feature3 corresponding to the abnormal activity interest description feature2 in each service state, wherein the quantitative analysis result of the stage level index of the abnormal activity interest description feature3 in each service state is matched with the set quantitative analysis result; and determining privacy threat information in the intelligent service session log with the risk of privacy information stealing in combination with the abnormal activity interest description 3.

By the technical scheme, the interest description attribute updating is performed on the basis of the abnormal activity interest description feature1 to obtain the abnormal activity interest description feature2 corresponding to the abnormal activity interest description feature1 in each service state, and the stage-level index of the abnormal activity interest description feature2 in each service state is updated, so that the stage-level index of the abnormal activity interest description feature3 corresponding to the abnormal activity interest description feature2 in each service state has quantitative correlation, further the privacy information in the intelligent service session log with the risk of stealing the privacy information is determined on the basis of the abnormal activity interest description features 3 with different stage levels (different focus points of the privacy threat are reflected by different stage levels to further obtain the privacy threat characteristics under different focus points), and the intelligent service session log with the risk of stealing the privacy information is realized on the basis of the initial session distribution and the intelligent service session log with the risk of stealing the privacy information, the privacy threat information of the intelligent service session log with the privacy information stealing risk is determined, and in view of the fact that the session distribution structure of the intelligent service session log with the privacy information stealing risk does not need to be modified, the software and hardware resource overhead of the privacy threat information detection is reduced while the privacy threat information detection precision is guaranteed, and the privacy threat detection efficiency is improved to a certain extent.

For an independently implementable technical solution, the obtaining of the abnormal activity interest description feature2 corresponding to the abnormal activity interest description feature1 in each business state based on performing the interest description attribute update on the abnormal activity interest description feature1 includes: determining an abnormal activity interest description feature1 with the least quantization constraint in the interest description attributes corresponding to the abnormal activity interest description feature1 in each service state, updating the remaining abnormal activity interest description features 1 except the abnormal activity interest description feature1 with the least quantization constraint into an abnormal activity interest description with the same interest description attribute as the abnormal activity interest description feature1 with the least quantization constraint, and taking the abnormal activity interest description feature1 with the least quantization constraint and the updated abnormal activity interest description with the same interest description attribute as the abnormal activity interest description feature1 with the least quantization constraint as the abnormal activity interest description feature 2; or, updating the abnormal activity interest description feature1 in each service state to the abnormal activity interest description under the set interest description attribute, and taking the abnormal activity interest description under the set interest description attribute as the abnormal activity interest description feature 2.

By the design, the abnormal activity interest description feature1 in each service state is updated to be less quantitative constraint, and when the privacy threat information covered in the intelligent service session log with the privacy information stealing risk is detected, the software and hardware resource overhead of the privacy threat information detection can be reduced, so that the efficiency of the privacy threat detection is improved to a certain extent.

For an independently implementable technical solution, the performing session activity interest mining on the intelligent service session log with the risk of privacy information stealing to obtain an abnormal activity interest description feature1 in a plurality of service states includes: performing session activity interest mining on an intelligent service session log with privacy information stealing risk through a plurality of first AI machine learning models in service states to obtain abnormal activity interest description feature1 derived by the first AI machine learning model in each service state; the obtaining of the abnormal activity interest description feature2 corresponding to the abnormal activity interest description feature1 in each service state based on performing the interest description attribute update on the abnormal activity interest description feature1 includes: determining model variable data of a second AI machine learning model corresponding to the first AI machine learning model in each service state according to the determined updated interest description attribute and the interest description attribute of the abnormal activity interest description feature1 derived by the first AI machine learning model in each service state; and performing interest feature analysis on the abnormal activity interest description feature1 derived from the first AI machine learning model corresponding to the second AI machine learning model in the service state by combining the second AI machine learning model in each service state covering the determined model variable data to obtain the abnormal activity interest description feature2 derived from the second AI machine learning model in the service state.

By means of the design, the interest feature analysis is performed on the corresponding abnormal activity interest description feature1 by determining the model variable data of the second AI machine learning model in each service state and combining the second AI machine learning model in each service state covering the determined model variable data, so that the quantitative constraint in the interest description attribute of the abnormal activity interest description feature1 derived by the first AI machine learning model in each service state is updated to be less quantitative constraint, further, when the intelligent service session log with the risk of privacy information stealing is analyzed, the software and hardware resource overhead is reduced, and the efficiency of privacy threat detection is improved to a certain extent.

For an independently implementable technical solution, the performing session activity interest mining on the intelligent service session log with the risk of privacy information stealing to obtain an abnormal activity interest description feature1 in a plurality of service states includes: performing session activity interest mining on an intelligent service session log with privacy information stealing risk through a plurality of first AI machine learning models in service states to obtain abnormal activity interest description feature1 derived by the first AI machine learning model in each service state; the updating of the interest description attribute of the abnormal activity interest description feature2 in each service state one by one to obtain the abnormal activity interest description feature3 corresponding to the abnormal activity interest description feature2 in each service state includes: determining the stage level indexes of the abnormal activity interest description feature3 corresponding to the first AI machine learning model in each service state respectively based on the quantitative analysis result of the stage level indexes among the first AI machine learning models in different service states and the stage level indexes of the abnormal activity interest description feature2 corresponding to the first AI machine learning model in each service state; determining model variable data of a third AI machine learning model corresponding to the first AI machine learning model in each service state according to the determined stage level indexes of the abnormal activity interest description feature3 corresponding to the first AI machine learning model in each service state and the stage level indexes of the abnormal activity interest description feature2 corresponding to the first AI machine learning model in each service state; and performing interest feature analysis on the abnormal activity interest description feature2 corresponding to the third AI machine learning model in the service state by combining the third AI machine learning model in each service state covering the determined model variable data to obtain the abnormal activity interest description feature3 derived by the third AI machine learning model in the service state.

By means of the design, the stage level indexes of the abnormal activity interest description feature2 corresponding to the first AI machine learning model in each service state are modified, so that the stage level indexes of the abnormal activity interest description feature3 derived from the third AI machine learning model in each service state are matched with the set quantitative analysis result (which is equivalent to modifying the focus points of privacy threat information included in the intelligent service session log with the privacy information stealing risk), and the abnormal activity interest description feature3 after updating the stage level indexes can relatively accurately detect the privacy threat information included in the intelligent service session log with the privacy information stealing risk, and further improve the accuracy of privacy threat detection to a certain extent.

For an independently implementable technical solution, the determining privacy threat information in the intelligent business session log with privacy information stealing risk in combination with the abnormal activity interest description feature3 includes: connecting the abnormal activity interest description feature3 corresponding to the abnormal activity interest description feature2 in each service state to obtain an abnormal activity interest description feature4 after connection is completed; and determining privacy threat information in the intelligent service session log with the risk of privacy information stealing in combination with the abnormal activity interest description 4.

By means of the design, the abnormal activity interest description feature3 corresponding to the abnormal activity interest description feature2 in each service state is connected, so that the obtained abnormal activity interest description feature4 can include the features of the abnormal activity interest description features 3 with different stage-level indexes, and when the privacy threat information in the intelligent service session log with the privacy information stealing risk is determined based on the abnormal activity interest description features 4, the accuracy of privacy threat detection can be improved.

For an independently implementable technical solution, connecting the abnormal activity interest description 3 corresponding to the abnormal activity interest description 2 in each service state to obtain an abnormal activity interest description feature4 for completing connection, the method includes: according to a preset connection mode, the abnormal activity interest description features 3 corresponding to the abnormal activity interest description features 2 in each service state are connected one by one to obtain transition abnormal activity interest descriptions completing connection in each round; and obtaining the abnormal activity interest description feature4 based on the transition abnormal activity interest description of each round of completing connection.

For an independently implementable technical solution, taking an abnormal activity interest description feature3 corresponding to an abnormal activity interest description feature2 in each service state as an abnormal activity interest description feature3 in a first service state to an abnormal activity interest description feature3 in an xth service state, where a stage level index of the abnormal activity interest description feature3 in the xth service state is greater than a stage level index of the abnormal activity interest description feature3 in an xth service state, where X is a positive integer greater than 1, and then according to a preset connection manner, connecting the abnormal activity interest description features 3 corresponding to the abnormal activity interest description feature2 in each service state one by one to obtain a transition abnormal activity interest description for completing connection in each round, including: according to the connection mode from the abnormal activity interest description feature3 in the first service state to the abnormal activity interest description feature3 in the xth service state, connecting the abnormal activity interest descriptions feature3 in each service state one by one to respectively obtain abnormal activity interest descriptions of each round of connection completion, and taking the abnormal activity interest description feature3 in the first service state and the abnormal activity interest descriptions of each round of connection completion as the obtained transition abnormal activity interest descriptions; or, according to a connection mode from the abnormal activity interest description feature3 in the xth service state to the abnormal activity interest description feature3 in the first service state, connecting the abnormal activity interest descriptions feature3 in each service state one by one to obtain abnormal activity interest descriptions of which the connection is completed in each round, and using the abnormal activity interest description feature3 in the xth service state and the abnormal activity interest descriptions of which the connection is completed in each round as the obtained transitional abnormal activity interest descriptions; or, according to a connection manner from the abnormal activity interest description feature3 in the first service state to the abnormal activity interest description feature3 in the xth service state, connecting the abnormal activity interest descriptions feature3 in each service state, respectively obtaining abnormal activity interest descriptions completing connection in each round when connecting the abnormal activity interest description feature3 in the first service state to the abnormal activity interest description feature3 in the xth service state, respectively performing interest feature analysis on the abnormal activity interest description feature3 in the first service state and the abnormal activity interest descriptions completing connection in each round, and obtaining connection abnormal activity interest descriptions from the connection abnormal activity interest description in the first service state to the connection abnormal activity interest description in the xth service state, wherein the interest description attribute of the connection abnormal activity interest description in each service state and the interest description of the corresponding abnormal activity interest description before interest feature analysis The description attributes are consistent; according to a connection mode from the connection abnormal activity interest description in the Xth service state to the connection abnormal activity interest description in the first service state, performing connection processing on the connection abnormal activity interest descriptions in each service state one by one, respectively obtaining abnormal activity interest descriptions of each connection completion when performing connection processing from the connection abnormal activity interest description in the Xth service state to the connection abnormal activity interest description in the first service state, and taking the abnormal activity interest descriptions of each connection completion and the connection abnormal activity interest descriptions in the Xth service state as the obtained transition abnormal activity interest descriptions; or, according to the connection mode from the abnormal activity interest description feature3 in the first service state to the abnormal activity interest description feature3 in the xth service state, connecting the abnormal activity interest description feature3 in each service state, respectively obtaining the abnormal activity interest description for completing the connection in each round, connecting the abnormal activity interest description feature3 in the first service state and the abnormal activity interest description feature3 in the first service state to the abnormal activity interest description feature3 in the xth service state, as the obtained first transition abnormal activity interest description, and connecting the abnormal activity interest description feature3 in each service state according to the connection mode from the abnormal activity interest description feature3 in the xth service state to the abnormal activity interest description feature3 in the first service state, respectively obtaining abnormal activity interest description of each round of completed connection, and taking the abnormal activity interest description 3 in the Xth service state and the abnormal activity interest description 3 in the Xth service state as the second transition abnormal activity interest description obtained when the connection is completed in each round from the abnormal activity interest description 3 in the Xth service state to the abnormal activity interest description 3 in the first service state; taking the first transition abnormal activity interest description and the second transition abnormal activity interest description as the obtained transition abnormal activity interest description.

By the design, the abnormal activity interest description feature3 in each service state is connected one by setting various different connection modes, and the connection processing of the abnormal activity interest description can be flexibly realized.

For an independently implementable solution, the obtaining the abnormal activity interest description feature4 based on the transition abnormal activity interest description of each round of completing the connection includes: performing interest feature analysis on the transition abnormal activity interest description of each round of connection completion to obtain an abnormal activity interest description feature5 corresponding to the transition abnormal activity interest description; the stage level indexes of the abnormal activity interest description feature5 corresponding to each transition abnormal activity interest description are consistent; and sorting the abnormal activity interest description feature5 corresponding to each transition abnormal activity interest description to obtain the abnormal activity interest description feature 4.

By means of the design, based on the interest feature analysis of the transition abnormal activity interest description after connection is completed in each round, the abnormal activity interest description feature5 obtained after the interest feature analysis is sorted, the abnormal activity interest description feature4 is obtained, the abnormal activity interest description feature4 comprises description contents with comprehensive global interest description and description contents with comprehensive local interest description, the obtained abnormal activity interest description feature4 further comprises description contents of different stage level indexes, and when the abnormal activity interest description feature4 is used for detecting privacy information included in the intelligent service session log with privacy information stealing risk, the accuracy of privacy threat detection can be improved.

In a second aspect, an embodiment of the present application further provides an information risk processing system, including a processor, a network module, and a memory; the processor and the memory communicate through the network module, and the processor reads the computer program from the memory and operates to perform the above-described method.

In a third aspect, an embodiment of the present application further provides a computer storage medium, where a computer program is stored, and the computer program, when executed, implements the above-mentioned method.

In the description that follows, additional features will be set forth, in part, in the description. These features will be in part apparent to those skilled in the art upon examination of the following and the accompanying drawings, or may be learned by production or use. The features of the present application may be realized and attained by practice or use of various aspects of the methodologies, instrumentalities and combinations particularly pointed out in the detailed examples that follow.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings that are required to be used in the embodiments will be briefly described below, it should be understood that the following drawings only illustrate some embodiments of the present application and therefore should not be considered as limiting the scope, and for those skilled in the art, other related drawings can be obtained from the drawings without inventive effort.

Fig. 1 is a block diagram illustrating an information risk processing system according to an embodiment of the present disclosure.

Fig. 2 is a flowchart of a risk processing method for smart business information based on cloud computing according to an embodiment of the present disclosure.

Fig. 3 is a block diagram of an intelligent business information risk processing apparatus based on cloud computing according to an embodiment of the present disclosure.

Detailed Description

In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all the embodiments. The components of the embodiments of the present application, generally described and illustrated in the figures herein, can be arranged and designed in a wide variety of different configurations.

Thus, the following detailed description of the embodiments of the present application, presented in the accompanying drawings, is not intended to limit the scope of the claimed application, but is merely representative of selected embodiments of the application. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.

It should be noted that: like reference numbers and letters refer to like items in the following figures, and thus, once an item is defined in one figure, it need not be further defined and explained in subsequent figures.

Fig. 1 shows a block schematic diagram of an information risk processing system 10 provided in an embodiment of the present application. The information risk processing system 10 in the embodiment of the present application may be a server with data storage, transmission, and processing functions, as shown in fig. 1, the information risk processing system 10 includes: the system comprises a memory 11, a processor 12, a network module 13 and a cloud computing-based intelligent business information risk processing device 20.

The memory 11, the processor 12 and the network module 13 are electrically connected directly or indirectly to realize data transmission or interaction. For example, the components may be electrically connected to each other via one or more communication buses or signal lines. The memory 11 stores a cloud computing-based smart business information risk processing device 20, the cloud computing-based smart business information risk processing device 20 includes at least one software function module which can be stored in the memory 11 in a form of software or firmware (firmware), and the processor 12 executes various function applications and data processing by running software programs and modules stored in the memory 11, such as the cloud computing-based smart business information risk processing device 20 in the embodiment of the present application, so as to implement the cloud computing-based smart business information risk processing method in the embodiment of the present application.

The Memory 11 may be, but is not limited to, a Random Access Memory (RAM), a Read Only Memory (ROM), a Programmable Read-Only Memory (PROM), an Erasable Read-Only Memory (EPROM), an electrically Erasable Read-Only Memory (EEPROM), and the like. The memory 11 is used for storing a program, and the processor 12 executes the program after receiving an execution instruction.

The processor 12 may be an integrated circuit chip having data processing capabilities. The Processor 12 may be a general-purpose Processor including a Central Processing Unit (CPU), a Network Processor (NP), and the like. The various methods, steps and logic blocks disclosed in the embodiments of the present application may be implemented or performed. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

The network module 13 is used for establishing communication connection between the information risk processing system 10 and other communication terminal devices through a network, and implementing transceiving operation of network signals and data. The network signal may include a wireless signal or a wired signal.

It will be appreciated that the configuration shown in FIG. 1 is merely illustrative, and that information risk processing system 10 may include more or fewer components than shown in FIG. 1, or have a different configuration than shown in FIG. 1. The components shown in fig. 1 may be implemented in hardware, software, or a combination thereof.

An embodiment of the present application further provides a computer storage medium, where a computer program is stored, and the computer program implements the method when running.

For the convenience of understanding the present application, the following terms will be explained first.

In the embodiment of the present application, the abnormal activity interest description feature1 may be understood as a first abnormal activity interest description, the abnormal activity interest description feature2 may be understood as a second abnormal activity interest description, the abnormal activity interest description feature3 may be understood as a third abnormal activity interest description, the abnormal activity interest description feature4 may be understood as a fourth abnormal activity interest description, the abnormal activity interest description feature5 may be understood as a fifth abnormal activity interest description, and so on.

Fig. 2 shows a flowchart of a risk processing method for intelligent business information based on cloud computing according to an embodiment of the present application. The method steps defined by the flow related to the method are applied to the information risk processing system 10 and can be realized by the processor 12, and the method comprises the following recorded contents of steps 101-104.

Step 101, performing session activity interest mining on the intelligent service session log with the risk of privacy information stealing to obtain abnormal activity interest description features 1 in a plurality of service states.

102, updating the interest description attributes based on the abnormal activity interest description feature1 to obtain an abnormal activity interest description feature2 corresponding to the abnormal activity interest description feature1 in each service state; the interest description attributes of the abnormal activity interest description feature2 corresponding to the abnormal activity interest description feature1 in different business states are consistent.

And 103, updating the interest description attributes of the abnormal activity interest description feature2 in each service state one by one to obtain an abnormal activity interest description feature3 corresponding to the abnormal activity interest description feature2 in each service state, wherein the quantitative analysis result of the stage level index of the abnormal activity interest description feature3 in each service state is matched with the set quantitative analysis result.

And step 104, determining privacy threat information in the intelligent service session log with privacy information stealing risk based on the abnormal activity interest description feature 3.

Implementing the technical solutions recorded in steps 101 to 104, based on executing interest description attribute update on the abnormal activity interest description feature1, obtaining the abnormal activity interest description feature2 corresponding to the abnormal activity interest description feature1 in each service state, and updating the stage level index of the abnormal activity interest description feature2 in each service state, so that the obtained stage level index of the abnormal activity interest description feature3 corresponding to the abnormal activity interest description feature2 in each service state has quantitative correlation, and further based on the different abnormal activity interest description features 3 in the stage level (different stage levels are used to reflect different points of interest of privacy threats, and further privacy threat characteristics under different points of interest are obtained), determining privacy threat information in the intelligent service session log with privacy information stealing risk, and implementing an intelligent service log with privacy information stealing risk based on initial session distribution, the privacy threat information of the intelligent service session log with the privacy information stealing risk is determined, and in view of the fact that the session distribution structure of the intelligent service session log with the privacy information stealing risk does not need to be modified, the software and hardware resource overhead of the privacy threat information detection is reduced while the privacy threat information detection precision is guaranteed, and the privacy threat detection efficiency is improved to a certain extent.

The technical solutions described in steps 101 to 104 can be specifically explained by the following descriptions.

It can be understood that, for the intelligent business session log with privacy information stealing risk described in step 101, session activity interest mining is performed to obtain the abnormal activity interest description feature1 in multiple business states.

In the embodiment of the present application, the abnormal activity interest description feature1 in the first business state is obtained by performing session activity interest mining on an intelligent business session log with a risk of stealing privacy information, and the abnormal activity interest description feature1 in the latter business state of the abnormal activity interest description features 1 in the two associated business states is obtained by performing session activity interest mining on the abnormal activity interest description feature1 in the former business state of the abnormal activity interest description features 1 in the two associated business states.

It is understood that the determination of the existence of the risk of stealing the privacy information may be implemented according to a preset rule, such as a time period condition or a service type condition. Therefore, the intelligent service session log with the risk of stealing private information can be understood as the intelligent service session log to be processed, and the session log can be log text or image-text information of streaming record. Further, conversational interaction interest mining may be understood as feature extraction (corresponding to the extraction of abnormal activity interest descriptions).

In the embodiment of the application, when session activity interest mining is performed on the intelligent service session logs with the risk of stealing privacy information to obtain abnormal activity interest description features 1 in a plurality of service states, session activity interest mining is performed on the intelligent service session logs with the risk of stealing privacy information through a first AI machine learning model (such as a CNN) in the plurality of service states to obtain abnormal activity interest description features 1 derived from the first AI machine learning model in each service state. Further, the machine learning model formed by the first AI machine learning models in multiple service states may be understood as one of the machine learning models for detecting privacy threat information included in an intelligent service session log with a risk of privacy information theft, and in actual implementation, the machine learning model for detecting the privacy threat information included in the intelligent service session log to be detected may be divided (split or divided) into AI machine learning models of multiple processes (multiple stages), and the AI machine learning model of each process corresponds to the first AI machine learning model in one service state. The structure of the first AI machine learning model in multiple service states may be set according to real service requirements, and this embodiment of the present application is not described herein further.

For example, if the first AI machine learning models in the multiple service states include a first AI machine learning model in a first service state, a first AI machine learning model in a second service state, and a first AI machine learning model in a third service state, the first AI machine learning model in the first service state may perform interest feature analysis on an intelligent service session log with a risk of privacy information stealing to obtain an abnormal activity interest description feature1 derived by the first AI machine learning model in the first service state; transmitting the abnormal activity interest description feature1 derived by the first AI machine learning model in the first service state to the first AI machine learning model in the second service state, and performing interest feature analysis on the obtained abnormal activity interest description feature1 by the first AI machine learning model in the second service state to obtain an abnormal activity interest description feature1 derived by the first AI machine learning model in the second service state; and then, the abnormal activity interest description feature1 derived by the first AI machine learning model in the second service state is transmitted to the first AI machine learning model in the third service state, and the first AI machine learning model in the third service state performs interest feature analysis on the obtained abnormal activity interest description feature1 to obtain the abnormal activity interest description feature1 derived by the first AI machine learning model in the third service state, and further obtain the abnormal activity interest description feature1 derived by the first AI machine learning model in each service state. The abnormal activity interest description feature1 derived by the first AI machine learning model in the first business state is subjected to less interest feature analysis times, so that the abnormal activity interest description feature1 derived by the first AI machine learning model in the first business state has richer local description and less global description; and the number of times of interest feature analysis of the abnormal activity interest description feature1 derived by the first AI machine learning model in the third business state is large, so that the abnormal activity interest description feature1 derived by the first AI machine learning model in the third business state has a large global description (i.e. the description content related to privacy threat information contained in the abnormal activity interest description feature1 is rich) and a poor local description.

In the embodiment of the application, the intelligent service session log with the risk of stealing the privacy information may be any intelligent service session log covering privacy threat information. The duration of the intelligent service session log with the risk of stealing private information may be a random duration, for example: the duration of the intelligent service session log with the risk of stealing the private information can be 15min, 25min and the like. In practical implementation, the detection duration period of the intelligent service session log can be determined based on the first AI machine learning model in a plurality of service states, and when the duration period of the intelligent service session log with the risk of stealing privacy information exceeds the detection duration period of the intelligent service session log, the intelligent service session log with the risk of stealing privacy information can be divided into a plurality of intelligent service session logs, so that the duration period of each divided intelligent service session log is consistent with the detection duration period of the intelligent service session log. Such as: if the duration of the intelligent service session log with the risk of stealing the privacy information is 1.5 hours, and the determined duration of the intelligent service session log is 15min, the intelligent service session log with the risk of stealing the privacy information can be divided into 6 intelligent service session logs with the duration of 15min, a first AI machine learning model in a plurality of service states respectively executes session activity interest mining on each intelligent service session log with the duration of 15min, the privacy threat information corresponding to each intelligent service session log with the duration of 15min is determined, and then the privacy threat information of the intelligent service session log with the risk of stealing the privacy information is obtained.

In the embodiment of the present application, the abnormal activity interest description feature1 may include four levels of interest description attributes (e.g., parameter information). For example, if the first AI machine learning model in the multiple service states is an AI machine learning model in three layers (which may also be a convolutional neural network), an abnormal activity interest description feature1 of the intelligent service session log with a risk of stealing privacy information may be obtained, where the abnormal activity interest description feature1 may include interest description attributes in four layers; if the first AI machine learning models in the multiple service states are AI machine learning models in two layers, session activity interest mining can be executed through the first AI machine learning models in the multiple service states to obtain abnormal activity interest descriptions corresponding to each group of session events in the intelligent service session log with the risk of stealing privacy information, and the abnormal activity interest descriptions of each group of session event keywords in the obtained intelligent service session log with the risk of stealing privacy information are integrated according to a staged layer to obtain abnormal activity interest description feature1 corresponding to the intelligent service session log with the risk of stealing privacy information.

It can be understood that, for the step 102, based on performing the interest description attribute update on the abnormal activity interest description feature1, the abnormal activity interest description feature2 corresponding to the abnormal activity interest description feature1 in each business state is obtained.

For example, the interest description attribute of the abnormal activity interest description feature1 in the first business state, the interest description attribute of the abnormal activity interest description feature1 in the second business state, and the interest description attribute of the abnormal activity interest description feature1 in the third business state are updated to be the same.

For an independently implementable technical solution, the updating of the interest description attribute recorded in step 102 based on the abnormal activity interest description 1 is performed to obtain the abnormal activity interest description feature2 corresponding to the abnormal activity interest description feature1 in each business state, which may exemplarily include the following contents: determining an abnormal activity interest description feature1 with the least quantization constraint in the interest description attributes corresponding to the abnormal activity interest description feature1 in each service state, updating the remaining abnormal activity interest descriptions feature1 except the abnormal activity interest description feature1 with the least quantization constraint into an abnormal activity interest description with the same interest description attribute as the abnormal activity interest description feature1 with the least quantization constraint, and taking the abnormal activity interest description feature1 with the least quantization constraint and the updated abnormal activity interest description with the same interest description attribute as the abnormal activity interest description feature 38964 as the abnormal activity interest description feature1 with the least quantization constraint; or, the abnormal activity interest description feature1 in each business state is updated to be the abnormal activity interest description under the set interest description attribute, and the abnormal activity interest description under the set interest description attribute is taken as the abnormal activity interest description feature 2.

In this embodiment of the application, if the abnormal activity interest description feature1 in the multiple service states includes the abnormal activity interest description feature1 in the first service state, the abnormal activity interest description feature1 in the second service state, and the abnormal activity interest description feature1 in the third service state, then the abnormal activity interest description feature1 in the first service state, the abnormal activity interest description feature1 in the second service state, and the abnormal activity interest description feature1 in the third service state, where the abnormal activity interest description feature1 with the least quantization constraint is determined, then the least quantization constraint is determined in the interest description attributes corresponding to the abnormal activity interest description feature1 in the third service state, and then the interest description attributes of the abnormal activity interest description feature1 in the first service state and the abnormal activity interest description feature1 in the second service state are updated, so that the updated interest description attributes of the abnormal activity interest description features 2 in each service state are updated to make the updated interest description attributes of the abnormal activity description features 2 in each service state mutually update There is consistency between.

Or, determining a set interest description attribute, updating the abnormal activity interest description feature1 in each service state to the abnormal activity interest description under the set interest description attribute, and taking the abnormal activity interest description under the set interest description attribute as the abnormal activity interest description feature 2. It can be understood that the quantization constraint in the interest description attribute is set to be not greater than the interest description attribute of the abnormal activity interest description feature1 with the least quantization constraint in the interest description attribute corresponding to the abnormal activity interest description feature1 derived by the first AI machine learning model in each business state.

By the design, the first abnormal activity interest description feature1 in each service state is updated to be less quantization constraint, and when the privacy threat information covered in the intelligent service session log with the risk of privacy information stealing is detected, the software and hardware resource overhead of privacy threat information detection can be reduced, so that the efficiency of privacy threat detection is improved to a certain extent.

For an independently implementable technical solution, the performing, in step 101, session activity interest mining on the intelligent business session log with the risk of privacy information theft to obtain an abnormal activity interest description feature1 in a plurality of business states may exemplarily include: and performing session activity interest mining on the intelligent service session logs with privacy information stealing risks through the first AI machine learning models in the plurality of service states to obtain abnormal activity interest description feature1 derived by the first AI machine learning model in each service state.

On the basis of the above, the updating of the interest description attribute recorded in step 102 based on the abnormal activity interest description feature1 is performed to obtain the abnormal activity interest description feature2 corresponding to the abnormal activity interest description feature1 in each service state, which may exemplarily include the technical solutions recorded in step 201 and step 202.

Step 201, determining model variable data of a second AI machine learning model corresponding to the first AI machine learning model in each service state according to the determined updated interest description attribute and the interest description attribute of the abnormal activity interest description feature1 derived by the first AI machine learning model in each service state.

Step 202, performing interest feature analysis on the abnormal activity interest description feature1 derived from the first AI machine learning model corresponding to the second AI machine learning model in the service state in combination with the second AI machine learning model in each service state covering the determined model variable data, to obtain the abnormal activity interest description feature2 derived from the second AI machine learning model in the service state.

In this embodiment, according to the determined updated interest description attribute and the interest description attribute of the abnormal activity interest description feature1 derived from the first AI machine learning model in each business state, model variable data of the second AI machine learning model corresponding to the first AI machine learning model in the first business state, model variable data of the second AI machine learning model corresponding to the first AI machine learning model in the second business state, and model variable data of the second AI machine learning model corresponding to the first AI machine learning model in the third business state may be determined, respectively.

For example, the second AI machine learning model corresponding to the first AI machine learning model in the first service state and covering model variable data (for example, model parameter information) performs interest feature analysis on the abnormal activity interest description feature1 corresponding to the first AI machine learning model in the first service state, so as to obtain an abnormal activity interest description feature2 derived by the second AI machine learning model in the service state. And analogizing one by one, performing interest feature analysis on the abnormal activity interest description feature1 corresponding to the first AI machine learning model in the second service state by using a second AI machine learning model covering model variable data corresponding to the first AI machine learning model in the second service state to obtain an abnormal activity interest description feature2 derived by the second AI machine learning model in the service state. And performing interest feature analysis on the abnormal activity interest description feature1 corresponding to the first AI machine learning model in the third service state to obtain an abnormal activity interest description feature2 derived by the second AI machine learning model in the service state.

It will be appreciated that for step 103: in the embodiment of the present application, the interest description attribute of the abnormal activity interest description feature2 in each service state may be updated, and the abnormal activity interest description feature3 corresponding to the abnormal activity interest description feature2 in each service state is obtained, so that the quantitative analysis result of the stage level index of the abnormal activity interest description feature3 in each service state is matched with the set quantitative analysis result. Wherein, the abnormal activity interest description feature3 in each business state has a stage level index (such as a time dimension value) related to its coverage. In practical implementation, the less the times of interest characteristic analysis of abnormal activity interest description is, the smaller the coverage area is, and the larger the corresponding stage level index setting is, the privacy threat information in the intelligent service session log with privacy information stealing risk can be relatively accurately determined; on the contrary, the more times of interest feature analysis of abnormal activity description, the larger the coverage area, in order to reduce software and hardware resource overhead, the less the corresponding stage level indexes, so as to reduce the software and hardware resource overhead, and reduce the software and hardware resource overhead as much as possible while ensuring the accuracy of intelligent service session log detection with privacy information stealing risk, and improve the privacy threat detection efficiency. For example, the quantitative analysis result of the stage level indicator between the abnormal activity interest description feature3 in the first business state and the abnormal activity interest description feature3 in the second business state may be set to 2: 6 or 4: 16, etc.

For an independently implementable technical solution, the step 103 may update the interest description attribute of the abnormal activity interest description 2 in each service state one by one to obtain the abnormal activity interest description feature3 corresponding to the abnormal activity interest description feature2 in each service state, which may exemplarily include the technical solutions recorded in the steps 301 to 303.

Step 301, determining the stage level indexes of the abnormal activity interest description feature3 corresponding to the first AI machine learning model in each service state respectively based on the quantitative analysis result of the stage level indexes between the first AI machine learning models in different service states and the stage level indexes of the abnormal activity interest description feature2 corresponding to the first AI machine learning model in each service state.

Step 302, determining model variable data of a third AI machine learning model corresponding to the first AI machine learning model in each service state according to the stage level index of the abnormal activity interest description feature3 corresponding to the first AI machine learning model in each service state and the stage level index of the abnormal activity interest description feature2 corresponding to the first AI machine learning model in each service state.

And step 303, performing interest feature analysis on the abnormal activity interest description feature2 corresponding to the third AI machine learning model in the service state in combination with the third AI machine learning model in each service state covering the determined model variable data to obtain an abnormal activity interest description feature3 derived by the third AI machine learning model in the service state.

In the embodiment of the present application, the quantitative analysis result of the periodic level index between the first AI machine learning models in different service states may be set according to the real service requirement, for example: if the first AI machine learning models in the multiple service states include a first AI machine learning model in a first service state, a first AI machine learning model in a second service state, and a first AI machine learning model in a third service state, the quantitative analysis result (for example, a ratio) of the periodic level index between the first AI machine learning models in different service states may be 1: 4: 6, may be 1: 5: 10, etc. Further, if the stage level index (for example, the time dimension value) of the abnormal activity interest description feature2 corresponding to the first AI machine learning model in each service state is 32, the quantitative analysis result of the stage level index is 1: 4: 6, it may be determined that the stage level index of the abnormal activity interest description feature3 corresponding to the first AI machine learning model in the first service state is 8, the stage level index of the abnormal activity interest description feature3 corresponding to the first AI machine learning model in the second service state is 16, and the stage level index of the abnormal activity interest description feature3 corresponding to the first AI machine learning model in the third service state is 32.

In this embodiment of the application, the model variable data of the third AI machine learning model corresponding to the first AI machine learning model in each service state may be determined according to the above-mentioned related content. For example, different time-dimension intervals can be set for the third AI machine learning model in each business state, so that the stage level indexes of the abnormal activity interest description feature3 derived by the third AI machine learning model in each business state are the same as the set quantitative analysis result.

Illustratively, the third AI machine learning model covering model variable data corresponding to the first AI machine learning model in the first business state performs interest feature analysis on the corresponding abnormal activity interest description feature2 in the business state, so as to obtain an abnormal activity interest description feature3 derived by the third AI machine learning model in the business state. Deducing one by one, correspondingly carrying out a third AI machine learning model covering model variable data on the first AI machine learning model in the second service state, and carrying out interest characteristic analysis on the corresponding abnormal activity interest description feature2 in the service state to obtain an abnormal activity interest description feature3 derived by the third AI machine learning model in the service state. And carrying out interest feature analysis on the corresponding abnormal activity interest description feature2 in the service state by using a third AI machine learning model covering model variable data corresponding to the first AI machine learning model in the third service state to obtain an abnormal activity interest description feature3 derived by the third AI machine learning model in the service state.

By modifying the stage level index of the abnormal activity interest description feature2 corresponding to the first AI machine learning model in each service state, the content recorded in the steps 301 to 303 is implemented, so that the stage level index of the abnormal activity interest description feature3 derived from the third AI machine learning model in each service state is matched with the set quantitative analysis result (corresponding to the modification of the focus point of the privacy threat information included in the intelligent service session log with the risk of privacy information stealing), and the abnormal activity interest description feature3 after updating the stage level index can relatively accurately identify the privacy threat information included in the intelligent service session log with the risk of privacy information stealing, thereby improving the accuracy of privacy threat detection to a certain extent.

It is to be understood that for step 104: in the embodiment of the application, the abnormal activity interest descriptions 3 corresponding to the first AI machine learning model in each service state may be connected, and the abnormal activity interest descriptions obtained after the abnormal activity interest descriptions 3 are connected are imported into the test machine learning model, so as to obtain the privacy threat information included in the intelligent service session log with the risk of privacy information stealing. If the intelligent service session log with the risk of stealing the privacy information comprises a plurality of privacy threat information, each piece of privacy threat information included in the intelligent service session log with the risk of stealing the privacy information can be obtained.

For an independently implementable technical solution, the abnormal activity interest description feature3 recorded in step 104 is used to determine privacy threat information in the intelligent business session log at risk of privacy information stealing, which may illustratively include the contents recorded in step 401 and step 402.

Step 401, performing connection processing on the abnormal activity interest description feature3 corresponding to the abnormal activity interest description feature2 in each service state to obtain an abnormal activity interest description feature4 with the connection completed.

Step 402, based on the abnormal activity interest description feature4, determining privacy threat information in the intelligent service session log with privacy information stealing risk.

In the embodiment of the application, after obtaining the abnormal activity interest description feature3 corresponding to the abnormal activity interest description feature2 in each service state, the abnormal activity interest description feature3 in each service state may be connected to obtain the abnormal activity interest description feature4 that completes the connection, and based on the abnormal activity interest description feature4, the privacy threat information in the intelligent service session log where the privacy information stealing risk exists is determined.

The contents recorded in the step 401 and the step 402 are implemented, and the abnormal activity interest description feature3 corresponding to the abnormal activity interest description feature2 in each service state is subjected to connection processing, so that the obtained abnormal activity interest description feature4 can include the features of the abnormal activity interest description feature3 with different stage-level indexes, and when the privacy threat information in the intelligent service session log with the privacy information stealing risk is determined based on the abnormal activity interest description feature4, the accuracy of privacy threat detection can be improved.

For an independently implementable technical solution, the connecting processing is performed on the abnormal activity interest description 3 corresponding to the abnormal activity interest description 2 in each service state recorded in the above step 401, so as to obtain the abnormal activity interest description feature4 completing the connection, which may exemplarily include the following contents: according to a preset connection mode, the abnormal activity interest description 3 corresponding to the abnormal activity interest description 2 in each service state is connected one by one to obtain transition abnormal activity interest descriptions of which the connection is completed in each round; and obtaining an abnormal activity interest description feature4 based on the transition abnormal activity interest description of each round of completed connection.

In the embodiment of the present application, a connection manner (which may be understood as a fusion sequence) of the abnormal activity interest description feature3 may be set, and the abnormal activity interest description features 3 corresponding to the abnormal activity interest description features 2 in each service state are connected one by one according to a preset connection manner, so as to obtain transition abnormal activity interest descriptions that are completed in each round.

For example, if the predetermined connection method is: if the abnormal activity interest description feature3 corresponding to the first AI machine learning model in the first service state, the abnormal activity interest description feature3 corresponding to the first AI machine learning model in the second service state, and the abnormal activity interest description feature3 corresponding to the first AI machine learning model in the third service state, the abnormal activity interest description feature3 corresponding to the first AI machine learning model in the first service state may be connected to the abnormal activity interest description feature3 corresponding to the first AI machine learning model in the second service state, so as to obtain the first round of transition abnormal activity interest description for completing the connection; and connecting the obtained transition abnormal activity interest description completing the connection with the abnormal activity interest description 3 corresponding to the first AI machine learning model in the third service state to obtain a second round of transition abnormal activity interest description completing the connection. The abnormal activity interest description feature4 is derived from the transitional abnormal activity interest description that can complete the connection on a per-turn basis.

It can be understood that, when the abnormal activity interest description feature3 corresponding to the first AI machine learning model in the first service state is connected to the abnormal activity interest description feature3 corresponding to the first AI machine learning model in the second service state, the abnormal activity interest description feature3 corresponding to the first AI machine learning model in the first service state may be sampled, and the abnormal activity interest description feature3 corresponding to the first AI machine learning model in the first service state after the up-sampling operation is connected to the abnormal activity interest description feature3 corresponding to the first AI machine learning model in the second service state, so as to obtain the transition abnormal activity interest description for which the connection is completed in the first round. In each round of connection process, reference may be made to a process of connecting the abnormal activity interest description feature3 corresponding to the first AI machine learning model in the first service state with the abnormal activity interest description feature3 corresponding to the first AI machine learning model in the second service state, which is not described herein in detail in this embodiment of the present application.

For example, if the interest description attribute of the abnormal activity interest description feature3 corresponding to the first AI machine learning model in the first service state is value1, and the interest description attribute of the abnormal activity interest description feature3 corresponding to the first AI machine learning model in the second service state is value2, the abnormal activity interest description feature3 corresponding to the first AI machine learning model in the first service state may be first up-sampled, and the interest description attribute of the abnormal activity interest description feature3 corresponding to the first AI machine learning model in the first service state after the up-sampling operation is value 2; then, the description value of each activity interest description item in the abnormal activity interest description feature3 corresponding to the first AI machine learning model in the first service state after the up-sampling operation is integrated with the description value of the activity interest description item corresponding to the abnormal activity interest description feature3 corresponding to the first AI machine learning model in the second service state, so as to obtain a transition abnormal activity interest description of which the connection is completed in the first round, wherein the interest description attribute of the transition abnormal activity interest description of which the connection is completed in the first round is value 2.

For an independently implementable technical solution, an abnormal activity interest description feature3 corresponding to the abnormal activity interest description feature2 in each service state is used as the abnormal activity interest description feature3 in the first service state to the abnormal activity interest description feature3 in the xth service state, wherein a stage level index of the abnormal activity interest description feature3 in the xth service state is greater than a stage level index of the abnormal activity interest description feature3 in the xth service state, and X is a positive integer greater than 1. According to a preset connection mode, the abnormal activity interest description features 3 corresponding to the abnormal activity interest description feature2 in each service state are connected one by one to obtain a transition abnormal activity interest description for completing connection in each round, wherein the transition abnormal activity interest description comprises one of the following design ideas.

The first design idea is as follows: according to the connection mode from the abnormal activity interest description feature3 in the first service state to the abnormal activity interest description feature3 in the xth service state, the abnormal activity interest description features 3 in each service state are connected one by one to obtain the abnormal activity interest description of which the connection is completed in each round, and the abnormal activity interest description feature3 in the first service state and the abnormal activity interest description of which the connection is completed in each round are used as the obtained transitional abnormal activity interest description.

The second design idea is as follows: according to the connection mode from the abnormal activity interest description feature3 in the Xth service state to the abnormal activity interest description feature3 in the first service state, the abnormal activity interest description features 3 in each service state are connected one by one to respectively obtain abnormal activity interest descriptions of which the connection is completed in each round, and the abnormal activity interest description feature3 in the Xth service state and the abnormal activity interest description of which the connection is completed in each round are used as the interest descriptions of transitional abnormal activities.

The third design idea is as follows: according to the connection mode from the abnormal activity interest description feature3 in the first service state to the abnormal activity interest description feature3 in the Xth service state, the abnormal activity interest description feature3 in each service state is connected to obtain the abnormal activity interest description of each connection when the connection processing is performed from the abnormal activity interest description feature3 in the first service state to the abnormal activity interest description feature3 in the Xth service state, the abnormal activity interest description feature3 in the first service state and the abnormal activity interest description of each connection are subjected to interest feature analysis to obtain the connection abnormal activity interest description from the abnormal activity interest description in the first service state to the connection abnormal activity interest description in the Xth service state, the interest description attribute of the connection abnormal activity interest description in each service state is consistent with the interest description attribute of the corresponding abnormal activity interest description before interest feature analysis; according to the connection mode from the connection abnormal activity interest description in the Xth service state to the connection abnormal activity interest description in the first service state, connection processing is carried out on the connection abnormal activity interest descriptions in each service state one by one, abnormal activity interest descriptions of connection completion in each round when the connection abnormal activity interest description in the Xth service state is connected to the connection abnormal activity interest description in the first service state are obtained respectively, and the abnormal activity interest descriptions of connection completion in each round and the connection abnormal activity interest descriptions in the Xth service state are used as the obtained transition abnormal activity interest descriptions.

The fourth design idea: according to the connection mode from the abnormal activity interest description feature3 in the first service state to the abnormal activity interest description feature3 in the Xth service state, the abnormal activity interest description feature3 in each service state is connected to obtain the abnormal activity interest description of each round of connection completion, the abnormal activity interest description feature3 in the first service state and the abnormal activity interest description feature3 in the first service state are connected to the abnormal activity interest description feature3 in the Xth service state, the abnormal activity interest description of each round of connection completion is used as the obtained first transition abnormal activity interest description, and the abnormal activity interest description feature3 in each service state is connected according to the connection mode from the abnormal activity interest description feature3 in the Xth service state to the abnormal activity interest description feature3 in the first service state, respectively obtaining abnormal activity interest description of each round of completed connection, and taking the abnormal activity interest description 3 in the Xth service state and the abnormal activity interest description in each round of completed connection when performing connection processing from the abnormal activity interest description feature3 in the Xth service state to the abnormal activity interest description feature3 in the first service state as obtained second transition abnormal activity interest description; and taking the first transition abnormal activity interest description and the second transition abnormal activity interest description as the obtained transition abnormal activity interest description.

In the embodiment of the present application, the first design idea is explained, and when the abnormal activity interest description feature3 in each service state is connected, the abnormal activity interest description feature3 in the first service state may be connected with the abnormal activity interest description feature3 in the second service state to obtain a first round of abnormal activity interest description completing the connection; connecting the abnormal activity interest description which is obtained in the first round and completes the connection with the abnormal activity interest description feature3 in the third service state to obtain the abnormal activity interest description which completes the connection in the second round, and calculating according to the abnormal activity interest description until the abnormal activity interest description which completes the connection in the X-2 round is connected with the abnormal activity interest description feature3 in the X-1 round and the abnormal activity interest description which completes the connection in the X-1 round is obtained; and taking the abnormal activity interest description of the first round of completed connection (the abnormal activity interest description obtained after the abnormal activity interest description feature3 in the first business state is connected with the abnormal activity interest description feature3 in the second business state), the abnormal activity interest description of the second round of completed connection, …, the abnormal activity interest description of the X-1 th round of completed connection and the abnormal activity interest description feature3 in the first business state as the obtained transition abnormal activity interest description.

In the embodiment of the present application, the second design idea is explained, and when the abnormal activity interest description feature3 in each service state is connected, the abnormal activity interest description feature3 in the xth service state may be connected with the abnormal activity interest description feature3 in the xth service state to obtain the abnormal activity interest description for completing the connection in the first round; connecting the abnormal activity interest description obtained after the first round of connection with the abnormal activity interest description feature3 in the X-1 th service state to obtain the abnormal activity interest description completing the connection in the second round, and calculating the abnormal activity interest description until the abnormal activity interest description completing the connection in the X-2 th round is connected with the abnormal activity interest description feature3501 in the first service state to obtain the abnormal activity interest description completing the connection in the X-1 th round; and taking the abnormal activity interest description of the first round of completed connection (the abnormal activity interest description obtained after the abnormal activity interest description feature3 in the X-th business state is connected with the abnormal activity interest description feature3 in the X-1 th business state), the abnormal activity interest description of the second round of completed connection, …, the abnormal activity interest description of the X-1 th round of completed connection and the abnormal activity interest description feature3 in the X-th business state as the obtained transition abnormal activity interest description.

In the embodiment of the present application, the third design idea is explained, and when the abnormal activity interest description feature3 in each service state is connected, the abnormal activity interest description feature3 in the first service state may be connected with the abnormal activity interest description feature3 in the second service state to obtain the abnormal activity interest description for completing the connection in the first round; then, connecting the abnormal activity interest description which is obtained in the first round and completes the connection with the abnormal activity interest description feature3 in the third service state to obtain the abnormal activity interest description which completes the connection in the second round, and calculating to obtain the abnormal activity interest description which completes the connection in the X-1 round; respectively importing the abnormal activity interest description feature3 in the first service state, the abnormal activity interest description of the connection completed in the first round, the abnormal activity interest description of the connection completed in the second round, … and the abnormal activity interest description of the connection completed in the X-1 th round into a corresponding transition AI machine learning model for interest feature analysis, obtaining a connection abnormal activity interest description in a first service state corresponding to the abnormal activity interest description feature3 in the first service state, a connection abnormal activity interest description in a second service state corresponding to the abnormal activity interest description completing the connection in the first round, a connection abnormal activity interest description in a third service state corresponding to the abnormal activity interest description completing the connection in the second round, …, and a connection abnormal activity interest description in an X-th service state corresponding to the abnormal activity interest description completing the connection in the X-th round. For example, if the interest description attribute of the abnormal activity interest description feature3 in the first service state is value1, after the transition AI machine learning model corresponding to the abnormal activity interest description feature3 in the first service state performs interest feature analysis on the abnormal activity interest description feature3 in the first service state, the obtained interest description attribute of the connection abnormal activity interest description in the first service state is value 1; if the interest description attribute of the abnormal activity interest description of the first round of connection completion is value2, after the transition AI machine learning model corresponding to the abnormal activity interest description of the first round of connection completion performs interest feature analysis on the abnormal activity interest description of the first round of connection completion, the obtained interest description attribute of the abnormal activity interest description of the connection in the second service state is also value 2.

Further, according to a connection mode from the connection abnormal activity interest description in the xth service state to the connection abnormal activity interest description in the first service state, connection processing is performed on the connection abnormal activity interest descriptions in each service state one by one, abnormal activity interest descriptions of connection completion in each round when connection processing is performed from the connection abnormal activity interest description in the xth service state to the connection abnormal activity interest description in the first service state are obtained respectively, and the abnormal activity interest description of connection completion in each round and the connection abnormal activity interest description in the xth service state are used as the obtained transition abnormal activity interest descriptions.

In this embodiment of the application, the fourth design idea is explained, and when the abnormal activity interest descriptions feature3 in each business state are connected, the abnormal activity interest descriptions feature3 in each business state may be connected through the first design idea, and the abnormal activity interest descriptions feature3 in the first business state and the abnormal activity interest descriptions that complete connection in each round when the abnormal activity interest descriptions feature3 in the first business state are connected to the abnormal activity interest description feature3 in the xth business state are used as the obtained first transition abnormal activity interest description; meanwhile, the abnormal activity interest description feature3 in each service state can be connected through the second design idea, and the abnormal activity interest description feature3 in the xth service state and the abnormal activity interest description that completes connection in each round when the connection processing is performed from the abnormal activity interest description feature3 in the xth service state to the abnormal activity interest description feature3 in the first service state are used as the obtained second transition abnormal activity interest description; and the first transition abnormal activity interest description and the second transition abnormal activity interest description form a transition abnormal activity interest description obtained through the fourth design idea.

By implementing the four embodiments, the abnormal activity interest descriptions feature3 in each service state are connected one by setting various different connection modes, so that the connection processing of the abnormal activity interest descriptions can be flexibly realized.

For an independently implementable solution, the above-mentioned recorded transition abnormal activity interest description based on each round of completing connection to obtain the abnormal activity interest description feature4, the solution recorded in step 601 and step 602 may be included as an example.

601, performing interest feature analysis on the transition abnormal activity interest description of each round of connection completion to obtain an abnormal activity interest description feature5 corresponding to the transition abnormal activity interest description; and the stage level indexes of the abnormal activity interest description feature5 corresponding to each transition abnormal activity interest description are consistent.

Step 602, sorting the abnormal activity interest description feature5 corresponding to each transition abnormal activity interest description to obtain an abnormal activity interest description feature 4.

In this embodiment of the application, if the transition abnormal activity interest description (which may be understood as an intermediate abnormal activity interest description) of each round of completed connection includes a transition abnormal activity interest description whose interest description attribute is value1, a transition abnormal activity interest description of value2, and a transition abnormal activity interest description of value4, and the determined connection completion stage level indicator is 1, where the connection completion stage level indicator may be set according to a real business requirement, the model variable data of the fourth AI machine learning model corresponding to each transition abnormal activity interest description may be determined, that is, the model variable data of the fourth AI machine learning model Networks _1 corresponding to the transition abnormal activity interest description whose interest description attribute is value1, the model variable data of the fourth AI machine learning model Networks _2 corresponding to the transition abnormal activity interest description whose interest description attribute is value2, the model variable data of the fourth AI machine learning model Networks _2 corresponding to the transition abnormal activity interest description whose interest description attribute is value1, and the intermediate abnormal activity interest description are defined as value2, Determining model variable data of a fourth AI machine learning model, namely, Networks _3, corresponding to the interest description attribute of the abnormal transition activity of value 4; performing interest feature analysis on the interest description of the abnormal transition activity with the interest description attribute of value1 by using a fourth AI machine learning model Networks _1 based on the labeled model variable data to obtain an abnormal activity interest description feature5 corresponding to the interest description of the abnormal transition activity with the interest description attribute of value 1; further, an abnormal activity interest description feature5 corresponding to the transition abnormal activity interest description with the interest description attribute of value2 and an abnormal activity interest description feature5 corresponding to the transition abnormal activity interest description with the interest description attribute of value4 can be obtained, wherein the interest description attribute of the abnormal activity interest description feature5 corresponding to each transition abnormal activity interest description is value 1.

It can be understood that the abnormal activity interest description feature5 corresponding to each transition abnormal activity interest description is sorted to obtain an abnormal activity interest description feature4, that is, the interest description attribute of the obtained abnormal activity interest description feature4 is value 4.3. When the abnormal activity interest description feature5 corresponding to each transition abnormal activity interest description is sorted, the abnormal activity interest description features 5 can be sorted (connected or fused) through related operations, so that the abnormal activity interest description feature4 is obtained.

According to the technical scheme recorded in the step 601 and the step 602, based on the interest feature analysis of the transition abnormal activity interest description after connection is completed in each round, the abnormal activity interest description feature5 obtained after the interest feature analysis is sorted to obtain the abnormal activity interest description feature4, so that the abnormal activity interest description feature4 not only covers the description content with the comprehensive global interest description but also includes the description content with the comprehensive local interest description, and the obtained abnormal activity interest description feature4 also includes the description contents of different stage level indexes, so that when the abnormal activity interest description feature4 is used for detecting the privacy threat information included in the intelligent service session log with the risk of privacy information stealing, the accuracy of privacy threat detection can be improved.

Based on the above, for some design ideas that can be implemented independently, after determining the privacy threat information in the intelligent service session log where there is a risk of privacy information theft, the method may further include the following: and executing corresponding privacy threat protection measures according to the privacy threat information.

Based on the above, for some design ideas that can be implemented independently, executing corresponding privacy threat protection measures according to the privacy threat information may include the following: determining target individual user information to be subjected to anonymization processing according to the privacy threat information; respectively carrying out shared use demand analysis and exclusive use demand analysis on a plurality of individual user information segments in the target individual user information to obtain a shared use demand analysis result set and an exclusive use demand analysis result set; performing first adjustment processing on the shared use requirement analysis result set through a first specified adjustment strategy to obtain a first individual user information cluster comprising shared use requirements; performing second adjustment processing on the exclusive use requirement analysis result set through a second specified adjustment strategy to obtain a second user information cluster comprising the exclusive use requirement; performing downsampling processing on the basis of the first individual user information cluster and the second individual user information cluster to obtain a target individual user information cluster matched with a target use requirement in the target individual user information; the target use requirement comprises at least one of a shared use requirement and an exclusive use requirement, and the target individual user information cluster is used for anonymizing the target individual user information; and anonymizing at least part of the target individual user information based on the target individual user information cluster. By the design, targeted information anonymization processing can be realized by considering different use requirements, so that accurate and reliable privacy threat protection is realized.

Based on the same inventive concept, the embodiment of the present application further provides a cloud computing based intelligent business information risk processing apparatus 20, which is applied to the information risk processing system 10, and the apparatus includes:

the activity interest mining module 21 is configured to perform session activity interest mining on an intelligent service session log with a risk of stealing private information to obtain abnormal activity interest descriptions 1 in multiple service states;

the interest description acquiring module 22 is configured to perform interest description attribute updating on the abnormal activity interest description 1 to obtain an abnormal activity interest description feature2 corresponding to the abnormal activity interest description feature1 in each service state; the interest description attributes of the abnormal activity interest description feature2 corresponding to the abnormal activity interest description feature1 in different service states are consistent;

the interest description updating module 23 is configured to update the interest description attributes of the abnormal activity interest description feature2 in each service state one by one, and obtain an abnormal activity interest description feature3 corresponding to the abnormal activity interest description feature2 in each service state, where a quantitative analysis result of a stage level index of the abnormal activity interest description feature3 in each service state matches a set quantitative analysis result;

and the threat information determination module 24 is used for determining privacy threat information in the intelligent service session log with privacy information stealing risk based on the abnormal activity interest description feature 3.

In the embodiments provided in the present application, it should be understood that the disclosed apparatus and method can be implemented in other ways. The apparatus and method embodiments described above are illustrative only, as the flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods and computer program products according to various embodiments of the present application. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

In addition, functional modules in the embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

The functions, if implemented in the form of software functional modules and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application may be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, an information risk processing system 10, or a network device) to execute all or part of the steps of the methods described in the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing program codes. It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.

The above description is only a preferred embodiment of the present application and is not intended to limit the present application, and various modifications and changes may be made by those skilled in the art. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A smart business information risk processing method based on cloud computing is applied to an information risk processing system, and the method comprises the following steps:

performing session activity interest mining on intelligent service session logs with privacy information stealing risks to obtain abnormal activity interest description features 1 in a plurality of service states; based on the abnormal activity interest description feature1, performing interest description attribute updating to obtain an abnormal activity interest description feature2 corresponding to the abnormal activity interest description feature1 in each service state; the interest description attributes of the abnormal activity interest description feature2 corresponding to the abnormal activity interest description feature1 in different service states are consistent;

updating the interest description attributes of the abnormal activity interest description feature2 in each service state one by one to obtain an abnormal activity interest description feature3 corresponding to the abnormal activity interest description feature2 in each service state, wherein the quantitative analysis result of the stage level index of the abnormal activity interest description feature3 in each service state is matched with the set quantitative analysis result; and determining privacy threat information in the intelligent service session log with the risk of privacy information stealing in combination with the abnormal activity interest description 3.

2. The method of claim 1, wherein the obtaining of the abnormal activity interest description feature2 corresponding to the abnormal activity interest description feature1 in each business state based on performing the interest description attribute update on the abnormal activity interest description feature1 comprises:

determining an abnormal activity interest description feature1 with the least quantization constraint in the interest description attributes corresponding to the abnormal activity interest description feature1 in each service state, updating the remaining abnormal activity interest description features 1 except the abnormal activity interest description feature1 with the least quantization constraint into an abnormal activity interest description with the same interest description attribute as the abnormal activity interest description feature1 with the least quantization constraint, and taking the abnormal activity interest description feature1 with the least quantization constraint and the updated abnormal activity interest description with the same interest description attribute as the abnormal activity interest description feature1 with the least quantization constraint as the abnormal activity interest description feature 2; or, updating the abnormal activity interest description feature1 in each service state to the abnormal activity interest description under the set interest description attribute, and taking the abnormal activity interest description under the set interest description attribute as the abnormal activity interest description feature 2.

3. The method of claim 1, wherein performing session activity interest mining on intelligent business session logs at risk of privacy information theft to obtain abnormal activity interest description features 1 for multiple business states comprises: performing session activity interest mining on an intelligent service session log with privacy information stealing risk through a plurality of first AI machine learning models in service states to obtain abnormal activity interest description feature1 derived by the first AI machine learning model in each service state;

the obtaining of the abnormal activity interest description feature2 corresponding to the abnormal activity interest description feature1 in each service state based on performing the interest description attribute update on the abnormal activity interest description feature1 includes: determining model variable data of a second AI machine learning model corresponding to the first AI machine learning model in each service state according to the determined updated interest description attribute and the interest description attribute of the abnormal activity interest description feature1 derived by the first AI machine learning model in each service state; and performing interest feature analysis on the abnormal activity interest description feature1 derived from the first AI machine learning model corresponding to the second AI machine learning model in the service state by combining the second AI machine learning model in each service state covering the determined model variable data to obtain the abnormal activity interest description feature2 derived from the second AI machine learning model in the service state.

4. The method according to any one of claims 1 to 3, wherein the performing session activity interest mining on the intelligent business session logs with privacy information stealing risk to obtain abnormal activity interest description features 1 in a plurality of business states comprises: performing session activity interest mining on an intelligent service session log with privacy information stealing risk through a plurality of first AI machine learning models in service states to obtain abnormal activity interest description feature1 derived by the first AI machine learning model in each service state;

the updating of the interest description attribute of the abnormal activity interest description feature2 in each service state one by one to obtain the abnormal activity interest description feature3 corresponding to the abnormal activity interest description feature2 in each service state includes: determining the stage level indexes of the abnormal activity interest description feature3 corresponding to the first AI machine learning model in each service state respectively based on the quantitative analysis result of the stage level indexes among the first AI machine learning models in different service states and the stage level indexes of the abnormal activity interest description feature2 corresponding to the first AI machine learning model in each service state; determining model variable data of a third AI machine learning model corresponding to the first AI machine learning model in each service state according to the determined stage level indexes of the abnormal activity interest description feature3 corresponding to the first AI machine learning model in each service state and the stage level indexes of the abnormal activity interest description feature2 corresponding to the first AI machine learning model in each service state; and performing interest feature analysis on the abnormal activity interest description feature2 corresponding to the third AI machine learning model in the service state by combining the third AI machine learning model in each service state covering the determined model variable data to obtain the abnormal activity interest description feature3 derived by the third AI machine learning model in the service state.

5. The method of claim 1, wherein the determining privacy threat information in the intelligent business session log at risk of privacy information theft in conjunction with the abnormal activity interest description feature3 comprises:

connecting the abnormal activity interest description feature3 corresponding to the abnormal activity interest description feature2 in each service state to obtain an abnormal activity interest description feature4 after connection is completed;

and determining privacy threat information in the intelligent service session log with the risk of privacy information stealing in combination with the abnormal activity interest description 4.

6. The method according to claim 5, wherein the connecting the abnormal activity interest description feature3 corresponding to the abnormal activity interest description feature2 in each service state to obtain the abnormal activity interest description feature4 with completed connection comprises:

according to a preset connection mode, the abnormal activity interest description features 3 corresponding to the abnormal activity interest description features 2 in each service state are connected one by one to obtain transition abnormal activity interest descriptions completing connection in each round;

and obtaining the abnormal activity interest description feature4 based on the transition abnormal activity interest description of each round of completing connection.

7. The method according to claim 6, wherein an abnormal activity interest description feature3 corresponding to the abnormal activity interest description feature2 in each business state is taken as the abnormal activity interest description feature3 in the first business state to the abnormal activity interest description feature3 in the xth business state, wherein a stage level index of the abnormal activity interest description feature3 in the xth business state is larger than a stage level index of the abnormal activity interest description feature3 in the xth-1 business state, and X is a positive integer larger than 1, and then the abnormal activity interest description features 3 corresponding to the abnormal activity interest description feature2 in each business state are connected one by one according to a preset connection mode to obtain a transition abnormal activity interest description for completing connection in each round, which includes one of the following items:

according to the connection mode from the abnormal activity interest description feature3 in the first service state to the abnormal activity interest description feature3 in the xth service state, connecting the abnormal activity interest descriptions feature3 in each service state one by one to respectively obtain abnormal activity interest descriptions of each round of connection completion, and taking the abnormal activity interest description feature3 in the first service state and the abnormal activity interest descriptions of each round of connection completion as the obtained transition abnormal activity interest descriptions;

according to the connection mode from the abnormal activity interest description feature3 in the Xth service state to the abnormal activity interest description feature3 in the first service state, the abnormal activity interest descriptions 3 in each service state are connected one by one to respectively obtain abnormal activity interest descriptions of which the connection is completed in each round, and the abnormal activity interest description feature3 in the Xth service state and the abnormal activity interest descriptions of which the connection is completed in each round are used as the obtained transition abnormal activity interest descriptions;

according to the connection mode from the abnormal activity interest description feature3 in the first service state to the abnormal activity interest description feature3 in the Xth service state, the abnormal activity interest description features 3 in each service state are connected to obtain abnormal activity interest descriptions which are connected in each round when the abnormal activity interest description feature3 in the first service state is connected to the abnormal activity interest description feature3 in the Xth service state, the abnormal activity interest description feature3 in the first service state and the abnormal activity interest descriptions which are connected in each round are analyzed for interest characteristics, and the connection abnormal activity interest description in the first service state to the connection abnormal activity interest description in the Xth service state are obtained, wherein the interest description attribute of the connection abnormal activity interest description in each service state and the interest description of the corresponding abnormal activity interest description before the interest characteristic analysis are obtained The consistency is consistent; according to a connection mode from the connection abnormal activity interest description in the Xth service state to the connection abnormal activity interest description in the first service state, performing connection processing on the connection abnormal activity interest descriptions in each service state one by one, respectively obtaining abnormal activity interest descriptions of each connection completion when performing connection processing from the connection abnormal activity interest description in the Xth service state to the connection abnormal activity interest description in the first service state, and taking the abnormal activity interest descriptions of each connection completion and the connection abnormal activity interest descriptions in the Xth service state as the obtained transition abnormal activity interest descriptions;

according to the connection mode from the abnormal activity interest description feature3 in the first service state to the abnormal activity interest description feature3 in the xth service state, the abnormal activity interest description feature3 in each service state is connected to obtain the abnormal activity interest description for completing connection in each round, the abnormal activity interest description feature3 in the first service state and the abnormal activity interest description feature3 in the first service state to the abnormal activity interest description feature3 in the xth service state are connected to obtain the abnormal activity interest description for completing connection in each round, and the abnormal activity interest description feature3 in each service state is connected to the obtained first transition abnormal activity interest description according to the connection mode from the abnormal activity interest description feature3 in the xth service state to the abnormal activity interest description feature3 in the first service state, respectively obtaining abnormal activity interest description of each round of completed connection, and taking the abnormal activity interest description 3 in the Xth service state and the abnormal activity interest description 3 in the Xth service state as the second transition abnormal activity interest description obtained when the connection is completed in each round from the abnormal activity interest description 3 in the Xth service state to the abnormal activity interest description 3 in the first service state; taking the first transition abnormal activity interest description and the second transition abnormal activity interest description as the obtained transition abnormal activity interest description.

8. The method according to claim 6 or 7, wherein the obtaining the abnormal activity interest description feature4 based on the transition abnormal activity interest description of each round of completing the connection comprises:

performing interest feature analysis on the transition abnormal activity interest description of each round of connection completion to obtain an abnormal activity interest description feature5 corresponding to the transition abnormal activity interest description; the stage level indexes of the abnormal activity interest description feature5 corresponding to each transition abnormal activity interest description are consistent;

and sorting the abnormal activity interest description feature5 corresponding to each transition abnormal activity interest description to obtain the abnormal activity interest description feature 4.

9. An information risk processing system, comprising a processor, a network module, and a memory; the processor and the memory communicate through the network module, the processor reading a computer program from the memory and operating to perform the method of any of claims 1-8.

10. A computer storage medium, characterized in that it stores a computer program which, when executed, implements the method of any one of claims 1-8.