CN114707990A - User behavior pattern recognition method and device - Google Patents

User behavior pattern recognition method and device Download PDF

Info

Publication number
CN114707990A
CN114707990A CN202210289732.1A CN202210289732A CN114707990A CN 114707990 A CN114707990 A CN 114707990A CN 202210289732 A CN202210289732 A CN 202210289732A CN 114707990 A CN114707990 A CN 114707990A
Authority
CN
China
Prior art keywords
behavior
sequence
transfer
value
user behavior
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN202210289732.1A
Other languages
Chinese (zh)
Other versions
CN114707990B (en
Inventor
王宝坤
张屹綮
石磊磊
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alipay Hangzhou Information Technology Co Ltd
Original Assignee
Alipay Hangzhou Information Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alipay Hangzhou Information Technology Co Ltd filed Critical Alipay Hangzhou Information Technology Co Ltd
Priority to CN202210289732.1A priority Critical patent/CN114707990B/en
Publication of CN114707990A publication Critical patent/CN114707990A/en
Application granted granted Critical
Publication of CN114707990B publication Critical patent/CN114707990B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00—Payment architectures, schemes or protocols
    • G06Q20/38—Payment protocols; Details thereof
    • G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401—Transaction verification
    • G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
    • G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/23—Clustering techniques
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N20/00—Machine learning
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
    • G06Q40/04—Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Business, Economics & Management (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Accounting & Taxation (AREA)
  • Finance (AREA)
  • Artificial Intelligence (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Evolutionary Computation (AREA)
  • General Engineering & Computer Science (AREA)
  • Evolutionary Biology (AREA)
  • Strategic Management (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Software Systems (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • General Business, Economics & Management (AREA)
  • Economics (AREA)
  • Technology Law (AREA)
  • Marketing (AREA)
  • Computer Security & Cryptography (AREA)
  • Medical Informatics (AREA)
  • Development Economics (AREA)
  • Computing Systems (AREA)
  • Mathematical Physics (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

The embodiment of the specification provides a method and a device for determining a user behavior pattern, wherein the method comprises the following steps: acquiring N user behavior sequences with labels, wherein each user behavior sequence comprises a plurality of operation behaviors in sequence; constructing a behavior transfer relation graph according to the N user behavior sequences; the behavior transfer relational graph comprises nodes and directed edges between the nodes, the nodes correspond to the operation behaviors, and the directed edges correspond to the transfer relation between two continuous operation behaviors in the N user behavior sequences; determining the information value of each transfer relation relative to the label; determining Q values of other operation behaviors after each operation behavior according to the information value and the transfer relation graph, wherein the Q values represent multi-step accumulated information values; and determining an optimized path from each operation behavior to the final operation behavior of each user behavior sequence according to the Q value and the transfer relation diagram, wherein the optimized path is used for determining the behavior mode of the user.

Description

User behavior pattern recognition method and device
Technical Field
One or more embodiments of the present disclosure relate to the field of data mining and machine learning, and in particular, to a method and apparatus for recognizing a user behavior pattern.
Background
In many industries where risk control is a problem, such as electronic payment and transaction platforms, operators often need to analyze whether there is a risk of illegal operations, particularly illegal transactions, among others, according to the behavioral link of the user. Traditionally, operators need to manually analyze a large number of illegal operation events to summarize a certain illegal operation rule, and especially the risk judgment efficiency is very low due to the user behavior pattern existing in illegal operation.
Therefore, in order to improve the risk judgment efficiency of the operator, a new method for identifying the user behavior pattern is required.
Disclosure of Invention
The embodiments in the present specification aim to provide a new method and apparatus for identifying a user behavior pattern, by which a user behavior pattern can be accurately and automatically acquired according to a behavior sequence formed by a large number of user behaviors. Therefore, on one hand, the workload of manual analysis in user behavior pattern recognition can be greatly reduced, on the other hand, the accuracy of the obtained user behavior pattern is improved, and the defects in the prior art are overcome.
According to a first aspect, there is provided a method for identifying a user behavior pattern, comprising:
acquiring N user behavior sequences with labels, wherein each user behavior sequence comprises a plurality of operation behaviors in sequence;
constructing a behavior transfer relation graph according to the N user behavior sequences; the behavior transfer relationship graph comprises nodes and directed edges between the nodes, the nodes correspond to the operation behaviors, and the directed edges correspond to the transfer relationship between two continuous operation behaviors in the N user behavior sequences;
determining the information value of each transfer relationship relative to the label;
determining a Q value of other operation behaviors after each operation behavior according to the information value and the transfer relation graph, wherein the Q value represents the multi-step accumulated information value;
and determining an optimized path from each operation behavior to the final operation behavior of each user behavior sequence according to the Q value and the transfer relation diagram, wherein the optimized path is used for determining the behavior mode of the user.
In one possible embodiment, the method further comprises:
and according to the behavior subsequence corresponding to the optimized path, cutting the user behavior sequence containing the behavior subsequence in the N user behavior sequences to obtain an optimized sequence, wherein the optimized sequence is used for determining a behavior mode of a user.
In one possible embodiment, the method further comprises:
performing sequence clustering operation based on the optimized sequence to obtain a plurality of sequence clusters; and determining a plurality of corresponding user behavior modes according to the plurality of sequence class clusters.
In one possible embodiment, determining the information value of each transfer relationship relative to the label comprises:
determining a relationship vector corresponding to each transfer relationship according to the transfer relationship corresponding to each directed edge in the transfer relationship graph and the existing state in the N user behavior sequences;
and determining the information value IV of each transfer relation relative to the label according to the relation vector.
In a possible implementation manner, determining, according to a transition relation corresponding to each directed edge in the transition relation graph and an existing state in the N user behavior sequences, a relation vector corresponding to each transition relation includes:
for any transfer relation, determining the existence state value corresponding to the transfer relation and the user behavior sequence according to whether the transfer relation exists in each user behavior sequence;
and determining a relation vector corresponding to the transfer relation by combining the transfer relation and the existing state values corresponding to the user behavior sequences.
In one possible embodiment, the label is a positive swatch label or a negative swatch label;
determining an information value IV of each transfer relation relative to the label according to the relation vector, wherein the information value IV comprises the following steps:
for any transfer relation, dividing the relation vector corresponding to the transfer relation according to the existing state value to obtain a plurality of state sub-box vectors;
for each state sub-box vector, determining the sub-information value corresponding to the state sub-box vector according to the label of the user behavior sequence corresponding to each component;
and determining the information value of the transfer relation according to the sub information value corresponding to each state sub-box sub-vector.
In one possible implementation, the positive sample labels correspond to sequences of behaviors known to be at risk for the target traffic, and the negative sample labels correspond to sequences of user behaviors outside of the sequence of at-risk behaviors.
In a possible implementation manner, the determining, according to the information value and the transition relation graph, a Q value of other operation actions taken after each operation action includes:
the method comprises the steps of obtaining a first information value of a transfer relation corresponding to a second operation behavior after a first operation behavior, adopting a maximum value of a plurality of Q values corresponding to a plurality of next operation behaviors after the second operation behavior, and updating the Q value of the second operation behavior after the first operation behavior based on the sum of the first information value and a weighted value of the maximum value.
In one possible embodiment, determining an optimized path from each operation behavior to a final operation behavior of each user behavior sequence includes:
and in the transfer relation graph, starting from any node, carrying out node transfer for a plurality of times along the directed edge until the operation behavior corresponding to the reached node belongs to the final operation behavior, wherein each time of node transfer comprises the step of transferring from the current node to the next node corresponding to the subsequent operation behavior with the maximum Q value.
According to a second aspect, there is provided an apparatus for recognizing a user behavior pattern, comprising:
the user behavior sequence acquisition unit is configured to acquire N user behavior sequences with labels, and each user behavior sequence comprises a plurality of operation behaviors in sequence;
the behavior transfer relation graph acquisition unit is configured to construct a behavior transfer relation graph according to the N user behavior sequences; the behavior transfer relationship graph comprises nodes and directed edges between the nodes, the nodes correspond to the operation behaviors, and the directed edges correspond to the transfer relationship between two continuous operation behaviors in the N user behavior sequences;
an information value determination unit configured to determine an information value of each transfer relationship with respect to the label;
a Q value determination unit configured to determine, based on the information value and the transfer relationship diagram, a Q value at which another operation action is taken after each operation action, the Q value indicating a multi-step accumulated information value;
and the optimized path determining unit is configured to determine an optimized path from each operation behavior to the final operation behavior of each user behavior sequence according to the Q value and the transfer relation diagram, wherein the optimized path is used for determining a behavior mode of the user.
In a possible embodiment, the apparatus further comprises:
and the optimization sequence acquisition unit is configured to cut the user behavior sequences including the behavior subsequences in the N user behavior sequences according to the behavior subsequences corresponding to the optimization path to obtain an optimization sequence, and the optimization sequence is used for determining a behavior mode of the user.
In a possible embodiment, the apparatus further comprises:
the user behavior mode determining unit is configured to perform sequence clustering operation based on the optimized sequence to obtain a plurality of sequence clusters; and determining a plurality of corresponding user behavior modes according to the plurality of sequence class clusters.
In one possible embodiment, the information value determination unit is further configured to:
determining a relationship vector corresponding to each transfer relationship according to the transfer relationship corresponding to each directed edge in the transfer relationship graph and the existing state in the N user behavior sequences;
and determining the information value IV of each transfer relation relative to the label according to the relation vector.
In one possible embodiment, the information value determination unit is further configured to:
for any transfer relation, determining the existence state value corresponding to the transfer relation and the user behavior sequence according to whether the transfer relation exists in each user behavior sequence;
and determining a relation vector corresponding to the transfer relation by combining the transfer relation and the existing state values corresponding to the user behavior sequences.
In one possible embodiment, the label is a positive swatch label or a negative swatch label;
an information value determination unit further configured to:
for any transfer relation, dividing the relation vector corresponding to the transfer relation according to the existing state value to obtain a plurality of state sub-box vectors;
for each state sub-box vector, determining the sub-information value corresponding to the state sub-box vector according to the label of the user behavior sequence corresponding to each component;
and determining the information value of the transfer relation according to the sub information value corresponding to each state sub-box sub-vector.
In one possible implementation, the positive sample labels correspond to sequences known to be at risk for the target traffic, and the negative sample labels correspond to sequences of user behavior outside of the sequence of at-risk behavior.
In one possible implementation, the operation behaviors include a first operation behavior and a second operation behavior, the Q value determination unit is further configured to,
the method comprises the steps of obtaining a first information value of a transfer relation corresponding to a second operation behavior after a first operation behavior, adopting a maximum value of a plurality of Q values corresponding to a plurality of next operation behaviors after the second operation behavior, and updating the Q value of the second operation behavior after the first operation behavior based on the sum of the first information value and a weighted value of the maximum value.
In a possible implementation, the optimized path determining unit is further configured to:
and in the transfer relation graph, starting from any node, carrying out node transfer for a plurality of times along the directed edge until the operation behavior corresponding to the reached node belongs to the final operation behavior, wherein each time of node transfer comprises the step of transferring from the current node to the next node corresponding to the subsequent operation behavior with the maximum Q value.
According to a third aspect, there is provided a computer readable storage medium having stored thereon a computer program which, when executed in a computer, causes the computer to perform the method of the first aspect.
According to a fourth aspect, there is provided a computing device comprising a memory having stored therein executable code and a processor that, when executing the executable code, implements the method of the first aspect.
By using one or more of the method, the apparatus, the computing device and the storage medium in the above aspects, the user behavior pattern can be accurately and automatically acquired, so that the workload of manual analysis in user behavior pattern recognition is reduced, and the accuracy of the acquired user behavior pattern is improved.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and it is obvious for those skilled in the art that other drawings can be obtained according to the drawings without creative efforts.
FIG. 1 is a schematic diagram illustrating a method for identifying patterns of user behavior according to an embodiment of the present disclosure;
FIG. 2 is a flow chart illustrating a method for identifying patterns of user behavior according to an embodiment of the present disclosure;
FIG. 3 is a diagram illustrating a user action sequence list according to an embodiment of the present description;
FIG. 4 illustrates a schematic diagram of an action relationship diagram according to an embodiment of the present description;
FIG. 5 illustrates a schematic diagram of an R-value table in accordance with embodiments herein;
FIG. 6 is a diagram illustrating a Q value table according to an embodiment of the present disclosure;
fig. 7 is a block diagram illustrating a device for recognizing a user behavior pattern according to an embodiment of the present disclosure.
Detailed Description
The solution provided by the present specification will be described below with reference to the accompanying drawings.
As previously mentioned, operational risk control is needed in many industries. For example, in electronic payment and transaction platforms, risk operators often need to analyze illegal operational links of some risk cases and from them analyze some common illegal operational patterns. In general, the behavioral link of a user within a client application can be very complex, and can include, for example, various complex behaviors such as registering, logging on, clicking, accessing, submitting requests, purchasing, and so forth.
However, for an illegal operation in a specific scenario, the behavioral links of users may be very similar, such as in the scenario of stealing accounts, typical illegal operation action sequences often include actions such as changing encryption, changing bindings, checking, paying, etc.; in a fraud scenario, a typical sequence of actions by a fraudster often includes acts such as opening an album to scan a code, adding friends, transferring money, etc.; in the context of credit cash-out, typical cash-out techniques often include acts such as viewing credit points, opening an offline payment switch, paying, collecting cash, etc. The traditional manual operation method often needs to manually analyze a plurality of illegal operation events to summarize a specific user behavior rule in the illegal operation or discover a user behavior pattern in the illegal operation. However, such a method requires a large number of operators and consumes a large amount of manual work, and the operation efficiency is very low.
Alternatively, the user action sequence is sequence coded and then a score or classification for risk identification is obtained, for example, by a regression model or classification model. The method classifies according to the total action sequence, a great amount of user operations irrelevant to risk identification or little in relevance can be mixed in the sequence, and the problems that the identification result is not accurate enough and the interpretability of the identification result is poor are also caused.
In order to improve the operation efficiency of risk operators, reduce the workload of the operators, and improve the accuracy of identifying a user behavior pattern, the embodiment of the specification provides a method for identifying a user behavior pattern. Fig. 1 is a schematic diagram illustrating a method for recognizing a user behavior pattern according to an embodiment of the present disclosure. As shown in fig. 1, first, a plurality of user behavior sequences are obtained, where the user behavior sequences may include a user behavior sequence composed of a plurality of ordered user operations in known illegal operation scenarios of different types, for example, the user behavior sequences may be obtained from known scenarios of account stealing, fraud, credit cash register, and the like. It may also include user behavior sequences other than those of the known illegal operation scenarios described above.
After the user behavior sequences are obtained, a behavior transfer relationship graph can be constructed according to the user behavior sequences. The construction method is that the nodes in the behavior transfer relationship graph are determined according to any user operation in each behavior sequence, and the directed edges between the nodes are determined according to the continuous relationship (or transfer relationship) between any two continuous user operations in different behavior sequences. And, the information value of each of these transfer relationships is determined.
After obtaining the behavior transition relationship diagram and the information value, Q-advancing learning can be performed based on the transition relationship diagram and the information value, wherein the former operation of two continuous user operations corresponds to the State (State) in the conventional Q-advancing learning, the latter operation corresponds to the Action (Action) taken under the State (State) in the conventional Q-advancing learning, and the information value is used as the Reward or Reward (Reward) of the two continuous user operations (corresponding transition relationship). Then, based on the reward and the transition relation graph between the continuous actions, the Q value corresponding to each transition relation is determined.
After the Q values corresponding to the transfer relationships are obtained, an optimized path from each operation behavior to the final operation behavior of each user behavior sequence is determined according to each Q value and the transfer relationship diagram, and then a behavior pattern of the user is determined according to the obtained optimized path. In one embodiment, for example, the user behavior sequence may be clipped according to the optimized path, then the behavior sequence after optimized clipping is used for clustering, a behavior sequence cluster is obtained, and the user behavior pattern is determined according to the behavior sequence cluster.
The method has the following advantages: on one hand, the method can be widely applied to scenes needing to analyze the user behavior sequence, can help risk operators to quickly analyze and discover various user behavior patterns, and can automatically acquire the behavior patterns according to the user behavior data compared with the method for acquiring the user behavior patterns through manual analysis, so that the workload of manual analysis in user behavior pattern recognition is greatly reduced, and the analysis efficiency is improved. In a second aspect, the optimized path obtained according to the method has better correlation with a specific risk behavior, so that according to the optimized path, a user behavior pattern implementing the specific risk behavior can be better determined.
The details of the process are further set forth below. Fig. 2 is a flowchart illustrating a method for identifying a user behavior pattern according to an embodiment of the present disclosure. As shown in fig. 2, the method at least comprises the following steps:
step 21, acquiring N user behavior sequences with labels, wherein each user behavior sequence comprises a plurality of operation behaviors in sequence;
step 22, constructing a behavior transfer relation graph according to the N user behavior sequences; the behavior transfer relationship graph comprises nodes and directed edges between the nodes, the nodes correspond to the operation behaviors, and the directed edges correspond to the transfer relationship between two continuous operation behaviors in the N user behavior sequences;
and step 23, determining the information value of each transfer relation relative to the label.
Step 24, determining a Q value of other operation behaviors after each operation behavior according to the information value and the transfer relation graph, wherein the Q value represents a multi-step accumulated information value;
and 25, determining an optimized path from each operation behavior to the final operation behavior of each user behavior sequence according to the Q value and the transfer relation graph, wherein the optimized path is used for determining the behavior mode of the user.
First, in step 21, N tagged user behavior sequences are obtained, each user behavior sequence comprising a plurality of operation behaviors in sequence.
In this step, the user behavior sequence may include a plurality of user operations in sequence. In different embodiments, the multiple user operations may be, for example, user operation behaviors for different specific applications, services, user terminals, and operation interfaces. In different embodiments, different specific ways of extracting or intercepting the user operation may be adopted. The present specification focuses on the processing procedure after obtaining the user behavior sequence, and does not focus on what kind of application object the user operation is directed to, or on the specific manner of extracting the user operation, and does not limit the application object.
According to an embodiment, the user operation may be a user operation for a target service. Thus, in one embodiment, a plurality of user behavior sequences may be obtained, wherein each user behavior sequence comprises a sequential plurality of user traffic behaviors for a target traffic. In one embodiment, the N user action sequences may form a user action sequence list, and fig. 3 is a schematic diagram of a user action sequence list according to an embodiment of the present specification, where a tag of a user action sequence indicates whether the user action sequence is a known action sequence with a specific property. In a specific embodiment, the tag may indicate whether the corresponding sequence is a behavior sequence with a known risk for the aforementioned target service, for example, a behavior sequence known to have a risk of stealing an account, fraud, credit cash register, etc. For example, in one example, if the label is 1, it indicates that the behavior sequence is a behavior sequence known to be at risk for the target service, and if the label is 0, it indicates that the behavior sequence is a behavior sequence other than the known behavior sequence at risk. In different specific examples, the known behavior sequence with risk may be determined in different specific ways, for example, according to a user report or according to other recognition models, which is not limited by the present specification. In different embodiments, the positive and negative swatch labels can correspond to whether they have different specific properties.
After acquiring the plurality of user behavior sequences, in step 22, constructing a behavior transfer relationship graph according to the N user behavior sequences; the behavior transfer relationship graph comprises nodes and directed edges between the nodes, the nodes correspond to the operation behaviors, and the directed edges correspond to the transfer relationship between two continuous operation behaviors in the N user behavior sequences.
In this step, a behavior transfer relationship diagram is constructed according to the user behavior sequence obtained in step 21. The sequence relation graph may be a directed graph, which includes nodes and directed edges between the nodes, where the nodes correspond to the operation behaviors, and the directed edges correspond to a transition relation between two consecutive operation behaviors in the N user behavior sequences. For example, Act _3 and Act _ i, Act _1 and Act _ n in fig. 3 each constitute a transfer relationship. Fig. 4 is a schematic diagram illustrating a behavior transition relationship diagram according to an embodiment of the present specification. As shown in fig. 4, each node corresponds to different operation behaviors, for example, node 1 corresponds to user operation Act _1, node 2 corresponds to user operation Act _2, and similarly, the rest nodes also have respective corresponding user operation behaviors. Directed edges between nodes represent a transition relationship between two successive operational behaviors. For example, in fig. 4, a directed edge exists between node 1 and node 2, which indicates that, in a plurality of user behavior sequences (for example, the user sequence list shown in fig. 3) according to which the action relationship graph is constructed, two consecutive operation actions Act _1 and Act _2 exist in one or more user behavior sequences, or that there is a transition from Act _1 to Act _ 2. For another example, a directed edge exists between the node 2 and the node i, which means that two consecutive operation actions Act _2 and Act _ i exist in one or more of the above-mentioned user behavior sequences, or that there is a transition from Act _2 to Act _ i. Similarly, the other directed edges respectively correspond to the transition from one user operation action to another user operation action. In one embodiment, an operation action transition, such as the transition from Act _2 to Act _ i, may occur multiple times in the same user behavior sequence or multiple user behavior sequences, and may correspond to only one directed edge in the action transition relationship graph. For example, in one example, the user behavior sequence S1 is "beacabase," where the individual characters "a", "B", "C", "E" … represent different user operations, and the user behavior sequence S2 is "XABCH. Then, according to the action transfer relationship graph formed by the two, the node corresponding to the action "A" to the node corresponding to the action "B" only have one directed edge.
Then, in step 33, the information value of each transfer relationship with respect to the label is determined.
Information Value (IV), is often used to measure the predictive power of a feature. In the context of the embodiments of the present specification, the information value of the transition relation may reflect the magnitude of the role played by two consecutive actions corresponding to the transition relation on the tag value of the belonging behavior sequence, or whether the action has a specific property (e.g., whether the action is a risk sequence). For example, some continuous actions with high frequency hardly contribute to the judgment of the property of the behavior sequence, so that the information value is small; the occurrence of some continuous actions plays a decisive role in judging the properties of the behavior sequences, so that the information value is high. The information value IV value is obtained in the step and is mainly used for determining the Q value as a Reward value corresponding to each transfer relation in Q-learning reinforcement learning in the subsequent step, so that the optimal path reaching the final node is obtained.
Because each transfer relation is a behavior transfer relation existing in the user behavior sequence, a feature vector corresponding to each transfer relation can be determined according to the user behavior sequence and the label thereof, and then the corresponding information value is determined according to the feature vector. Therefore, in an embodiment, a relationship vector corresponding to each transition relationship (i.e., a feature vector corresponding to the transition relationship) may be determined according to the existence state of the transition relationship corresponding to each directed edge in the transition relationship graph in the N user behavior sequences; and determining the information value IV of each transfer relation relative to the label according to the relation vector. In a specific embodiment, for any transfer relationship, determining a presence state value corresponding to the transfer relationship and each user behavior sequence according to whether the transfer relationship exists in each user behavior sequence; and determining a relation vector corresponding to the transfer relation by combining the transfer relation and the existing state values corresponding to the user behavior sequences. Then, the information value of the transfer relationship can be determined according to the label of each user behavior sequence and the relationship vector. In a particular embodiment, the tags of the user behavior sequence may be positive exemplar tags or negative exemplar tags; for any transfer relation, dividing the relation vector corresponding to the transfer relation according to the existing state value to obtain a plurality of state sub-box vectors; for each state sub-box vector, determining the sub-information value corresponding to the state sub-box vector according to the label of the user behavior sequence corresponding to each component; and determining the information value of the transfer relation according to the sub information value corresponding to each state sub-box sub-vector.
In a specific embodiment, for example, for all 1000 sequences S1-S1000, the transition relationship of Act _1 to Act _2 exists only in 100 sequences, for example, in S1-S100 (the continuous sequences S1-S100 are used for convenience of description only, and may be discontinuous in practice). Thus, the presence state value of the transition relationship in each sequence may include 0 and 1, corresponding to presence and absence, respectively. Further, the relationship vector may be divided into 2 state binning subvectors, i.e., a first state binning subvector corresponding to S1 to S100 and a second state binning vector corresponding to S101 to S1000, according to the presence state value. Then, the sub information value corresponding to the sub vector may be determined from the label of the sequence corresponding to each component in the binned sub vector (for example, the sub information value corresponding to the first state binned sub vector may be determined from the labels of the sequences in S1 to S100). And determining the information value corresponding to the transfer relationship by combining the sub information values corresponding to the sub vectors. In one specific example, the determination of the value of the sub-information may be expressed as:
Figure BDA0003561269620000101
Figure BDA0003561269620000102
wherein IViThe sub information value corresponding to the sub vector of the state sub box is set as i, the serial number of the sub vector of the state sub box is set as i, and BadiFor the number of all response sequences (e.g. sequences labeled 1) in the user behavior sequence corresponding to the state bin subvector, BadTFor the number of all response sequences in all user behavior sequences, GoodiGood is the number of all non-response sequences (e.g. sequences with 0 label) in the user behavior sequence corresponding to the sub-vector of the boxTThe IV is the information value of the transfer relationship for the number of all non-response sequences in all user behavior sequences.
In one example, positive exemplar labels may correspond to known dangerous behavior sequences and negative exemplar labels may correspond to user behavior sequences other than known dangerous behavior sequences.
In one embodiment, the determined information value of each transfer relationship may constitute a transfer relationship prize table (R-value table). Fig. 5 is a schematic diagram illustrating an R-value table according to an embodiment of the present disclosure, in which a reward R _12 corresponding to a transition relationship from action Act _1 to action Act _2, that is, an information value corresponding to the transition relationship; the reward r _1n corresponding to the transition relationship from Act _1 to Act _ n, i.e. the information value corresponding to the transition relationship, and similarly, the transition relationship between other acts takes the corresponding information value as the reward of the transition relationship. The rewards corresponding to all transfer relations can form a transfer relation reward table. In a specific embodiment, each migration relationship has no migration relationship for itself or does not constitute a meaningful migration relationship, for example, Act _1 to Act _1 do not constitute a migration relationship, and thus the bonus value of a meaningless migration relationship may be represented in the migration relationship bonus table with a specific preset bonus value. In one example, the predetermined prize value is, for example, -1.
The acquired transfer relationship reward table is mainly used for determining the Q value of other operation behaviors after each operation behavior is determined according to the transfer relationship reward table based on Q-IEarning machine learning in the subsequent steps, and the detailed process refers to the description of the subsequent steps.
After the above information value is acquired, in step 24, a Q value for taking other operation actions after each operation action is determined based on the information value and the transition relation graph, and the Q value represents a multi-step accumulated information value.
In this step, the Q value of the other operation actions taken after each operation action is determined based on the information value of the transfer relationship (as the reward for the transfer relationship) acquired in step 23 and the transfer relationship diagram, essentially based on the Q-learning method. Conventionally, Q-Learning is a reinforcement Learning method that essentially includes three elements of State (State), Action (Action), and reward (reward), and the purpose of Q-Learning is to learn the value (which may be estimated based on multi-step accumulation) of a particular Action at a particular State, i.e., the Q value. Specifically, a Q table may be created in which, for example, each state is a row and each action is a column. Then, the Q table is updated by searching from the start state included in the state space (composed of all the different states) to the target state included in the state space. Specifically, each time a transition between states is made in the search, the initial state of the transition, i.e., the Q value of the action in the Q table, is updated based on the reward (or return) associated with the action to be performed for the transition.
The Q-learning in this step is different from the conventional Q-advancing learning in that the Q value of different actions (act on) taken in different states (states) is generally learned in the conventional Q-advancing. In the embodiment of the present specification, the Q values of two consecutive actions, i.e., the Q value of the latter action taken under the preceding action, are learned through Q-learning. That is, the state space is essentially constituted by the operation motions, and the motion space is also constituted by the operation motions.
Specifically, in the learning process, the Q value of two consecutive actions can be determined according to the information value of the transition relationship corresponding to the two consecutive actions (essentially, as a reward for the transition of the action). Thus, in one embodiment, the Q table may be initialized first. Then, a random walk is performed in the transition relation graph to update the Q table. In the random walk process, for a first operation behavior and a second operation behavior connected with any directed edge, a first information value of a transfer relationship corresponding to the second operation behavior after the first operation behavior is taken can be obtained, a maximum value of a plurality of Q values corresponding to a plurality of next operation behaviors after the second operation behavior is obtained, and the Q value of the second operation behavior after the first operation behavior is taken is updated according to the sum of weighted values of the first information value and the maximum value. In a specific embodiment, the Q value of the second operation behavior (or its corresponding transition relationship) taken after the first operation behavior may be represented as:
Q(action，actionnext)
＝R(action，actionnext)+Gamma*Max[Q(actionnext，allactions)]
wherein, action is the operation behavior before the action is transferred in the transfer relationship, i.e. the first operation behavior, actionnextFor the operation behavior after the action transfer in the transfer relationship, i.e. the aforesaid second operationAct, Q (action)next) The Q value, R (action ) corresponding to the transition relationnext) For the reward corresponding to the transfer relationship, Gamma is a learning coefficient (as a weighting coefficient for weighted summation),
Figure BDA0003561269620000111
represents the second operation actionnextThe largest Q value among Q values corresponding to all transition relationships formed by all subsequent possible operation actions.
In one embodiment, the determined Q values for each of the branch relationships may form a Q value table. Fig. 6 is a schematic diagram illustrating a Q-value table according to an embodiment of the present specification, as shown in fig. 6, where a Q value corresponding to a transition relationship from action Act _1 to action Act _2 is Q _ 12; the transition from Act _1 to Act _ n corresponds to a Q value of Q _1n, and similarly, the transition between other acts also has its corresponding Q value. The Q values of all the transfer relationships may form a Q value table.
Thereafter, in step 25, an optimized path from each operation behavior to the final operation behavior of each user behavior sequence is determined according to the Q value and the transition relation graph, wherein the optimized path is used for determining the behavior pattern of the user.
It will be appreciated that the optimized path from any initial action to any final action may be conveniently obtained from the Q-value table and the transition relation diagram described above. For example, for each action transfer in the transfer process from any initial action to any final action, the action transfer corresponding to the maximum Q value in the selectable action transfers is selected until the final action, and an optimized path is obtained by combining each action transfer. Therefore, in one embodiment, in the transfer relationship graph, node transfer may be performed several times from any node along the directed edge until an operation behavior corresponding to a node is reached and belongs to the final operation behavior, where each node transfer includes transferring from a current node to a next node corresponding to a subsequent operation behavior with a largest Q value. This part is similar to the conventional Q-learning scheme and is not described in detail herein.
The optimized path essence may correspond to a subsequence of the sequence of user behaviors that is more strongly associated with, for example, a particular risk behavior. Therefore, according to an implementation manner, the user behavior sequence including the behavior subsequence in the N user behavior sequences may also be cut according to the behavior subsequence corresponding to the optimized path, so as to obtain an optimized sequence, where the optimized sequence is used to determine a behavior pattern of the user. For example, the original user behavior sequence includes a user behavior sequence S3, specifically "acbadfbaddand", where each character represents a different operation action. The obtained optimized path comprises Y1 and Y2, which are respectively 'DAN' and 'BAD'. S3 may be clipped according to Y1, Y2, for example, to retain the optimized path portion therein and remove the remaining portion, the clipped sequence being "baddadmadan". It will be appreciated that the tailored sequence of user behavior is also more strongly associated with, for example, a particular risk behavior, and thus, the user behavior pattern according to which the particular risk behavior is implemented can be more accurately determined. In different embodiments, the user behavior mode may be determined in different specific ways according to the clipped user behavior sequence, which is not limited in this specification. In one embodiment, for example, based on the optimized sequence, a sequence clustering operation may be performed to obtain a plurality of sequence clusters; and determining a plurality of corresponding user behavior modes according to the plurality of sequence class clusters. In different embodiments, different specific clustering algorithms may be used to obtain the clustering result (class cluster). A node class cluster of several nodes may essentially correspond to a set of several user behavior sequences. Therefore, in one embodiment, after obtaining the plurality of user behavior sequence sets, the corresponding plurality of user behavior patterns may be determined according to the plurality of user behavior sequence sets.
According to an embodiment of another aspect, an apparatus for recognizing a user behavior pattern is also provided. Fig. 7 is a block diagram illustrating an apparatus for recognizing a user behavior pattern according to an embodiment of the present disclosure, and as shown in fig. 7, the apparatus 700 includes:
a user behavior sequence obtaining unit 71, configured to obtain N user behavior sequences with tags, where each user behavior sequence includes a plurality of operation behaviors in sequence;
a behavior transfer relationship diagram obtaining unit 72 configured to construct a behavior transfer relationship diagram according to the N user behavior sequences; the behavior transfer relationship graph comprises nodes and directed edges between the nodes, the nodes correspond to the operation behaviors, and the directed edges correspond to the transfer relationship between two continuous operation behaviors in the N user behavior sequences;
an information value determination unit 73 configured to determine an information value of each transfer relationship with respect to the tag;
a Q value determination unit 74 configured to determine, based on the information value and the transfer relationship diagram, a Q value indicating a multi-step accumulated information value at which another operation action is taken after each operation action;
and an optimized path determining unit 75 configured to determine, according to the Q value and the transition relation graph, an optimized path from each operation behavior to a final operation behavior of each user behavior sequence, where the optimized path is used to determine a behavior pattern of a user.
In one embodiment, the apparatus may further include:
and the optimization sequence acquisition unit is configured to cut the user behavior sequences including the behavior subsequences in the N user behavior sequences according to the behavior subsequences corresponding to the optimization paths to obtain an optimization sequence, and the optimization sequence is used for determining the behavior mode of the user.
In one embodiment, the apparatus may further include:
the user behavior mode determining unit is configured to perform sequence clustering operation based on the optimized sequence to obtain a plurality of sequence clusters; and determining a plurality of corresponding user behavior modes according to the plurality of sequence class clusters.
In one embodiment, the information value determination unit may be further configured to:
determining a relationship vector corresponding to each transfer relationship according to the transfer relationship corresponding to each directed edge in the transfer relationship graph and the existing state in the N user behavior sequences;
and determining the information value IV of each transfer relation relative to the label according to the relation vector.
In one embodiment, the information value determination unit may be further configured to:
for any transfer relation, determining the existence state value corresponding to the transfer relation and the user behavior sequence according to whether the transfer relation exists in each user behavior sequence;
and determining a relation vector corresponding to the transfer relation by combining the transfer relation and the existing state values corresponding to the user behavior sequences.
In one embodiment, the label may be a positive swatch label or a negative swatch label;
an information value determination unit, which may be further configured to:
for any transfer relation, dividing the relation vector corresponding to the transfer relation according to the existing state value to obtain a plurality of state sub-box sub-vectors;
for each state sub-box vector, determining the sub-information value corresponding to the state sub-box vector according to the label of the user behavior sequence corresponding to each component;
and determining the information value of the transfer relation according to the sub information value corresponding to each state sub-box sub-vector.
In one embodiment, the positive sample labels correspond to sequences known to be at risk for the target traffic, and the negative sample labels correspond to sequences of user behavior outside of the sequence of at-risk behavior.
In one embodiment, the operation behaviors may include a first operation behavior and a second operation behavior, the Q-value determining unit may be further configured to,
the method comprises the steps of obtaining a first information value of a transfer relation corresponding to a second operation behavior after a first operation behavior, adopting a maximum value of a plurality of Q values corresponding to a plurality of next operation behaviors after the second operation behavior, and updating the Q value of the second operation behavior after the first operation behavior based on the sum of the first information value and a weighted value of the maximum value.
In one embodiment, the optimized path determining unit may be further configured to:
and in the transfer relation graph, starting from any node, carrying out node transfer for a plurality of times along the directed edge until the operation behavior corresponding to the reached node belongs to the final operation behavior, wherein each time of node transfer comprises the step of transferring from the current node to the next node corresponding to the subsequent operation behavior with the maximum Q value.
Yet another aspect of the present specification provides a computer readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform any of the methods described above.
Yet another aspect of the present specification provides a computing device comprising a memory having stored therein executable code, and a processor that, when executing the executable code, implements any of the methods described above.
It is to be understood that the terms "first," "second," and the like, herein are used for descriptive purposes only and not for purposes of limitation, to distinguish between similar concepts.
Those skilled in the art will recognize that, in one or more of the examples described above, the functions described in this invention may be implemented in hardware, software, firmware, or any combination thereof. When implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.
The above-mentioned embodiments, objects, technical solutions and advantages of the present invention are further described in detail, it should be understood that the above-mentioned embodiments are only examples of the present invention, and are not intended to limit the scope of the present invention, and any modifications, equivalent substitutions, improvements and the like made on the basis of the technical solutions of the present invention should be included in the scope of the present invention.

Claims (20)

1. A method for recognizing a user behavior pattern comprises the following steps:
acquiring N user behavior sequences with labels, wherein each user behavior sequence comprises a plurality of operation behaviors in sequence;
constructing a behavior transfer relation graph according to the N user behavior sequences; the behavior transfer relationship graph comprises nodes and directed edges between the nodes, the nodes correspond to the operation behaviors, and the directed edges correspond to the transfer relationship between two continuous operation behaviors in the N user behavior sequences;
determining the information value of each transfer relationship relative to the label;
determining a Q value of other operation behaviors after each operation behavior according to the information value and the transfer relation graph, wherein the Q value represents the multi-step accumulated information value;
and determining an optimized path from each operation behavior to the final operation behavior of each user behavior sequence according to the Q value and the transfer relation diagram, wherein the optimized path is used for determining the behavior mode of the user.
2. The method of claim 1, further comprising:
and according to the behavior subsequence corresponding to the optimized path, cutting the user behavior sequence containing the behavior subsequence in the N user behavior sequences to obtain an optimized sequence, wherein the optimized sequence is used for determining a behavior mode of a user.
3. The method of claim 2, further comprising:
performing sequence clustering operation based on the optimized sequence to obtain a plurality of sequence clusters; and determining a plurality of corresponding user behavior modes according to the plurality of sequence class clusters.
4. The method of claim 1, wherein determining an informational value of each transfer relationship relative to the label comprises:
determining a relationship vector corresponding to each transfer relationship according to the transfer relationship corresponding to each directed edge in the transfer relationship graph and the existing state in the N user behavior sequences;
and determining the information value IV of each transfer relation relative to the label according to the relation vector.
5. The method according to claim 4, wherein determining, according to the existence state of the transition relation corresponding to each directed edge in the transition relation graph in the N user behavior sequences, a relation vector corresponding to each transition relation comprises:
for any transfer relation, determining the existence state value corresponding to the transfer relation and the user behavior sequence according to whether the transfer relation exists in each user behavior sequence;
and determining a relation vector corresponding to the transfer relation by combining the transfer relation and the existing state values corresponding to the user behavior sequences.
6. The method of claim 5, wherein,
the label is a positive sample label or a negative sample label;
determining the information value IV of each transfer relation relative to the label according to the relation vector, wherein the method comprises the following steps:
for any transfer relation, dividing the relation vector corresponding to the transfer relation according to the existing state value to obtain a plurality of state sub-box sub-vectors;
for each state sub-box vector, determining the sub-information value corresponding to the state sub-box vector according to the label of the user behavior sequence corresponding to each component;
and determining the information value of the transfer relation according to the sub information value corresponding to each state sub-box sub-vector.
7. The method of claim 6, wherein the positive sample labels correspond to sequences of behaviors known to be at risk for a target service and the negative sample labels correspond to sequences of user behaviors outside of the sequences of at-risk behaviors.
8. The method of claim 1, wherein the operational behaviors include a first operational behavior and a second operational behavior, and determining a Q value of other operational behaviors taken after each operational behavior based on the informational value and the transition relationship graph comprises:
the method comprises the steps of obtaining a first information value of a transfer relationship corresponding to a second operation action after a first operation action, adopting a maximum value of a plurality of Q values corresponding to a plurality of next operation actions after the second operation action, and updating the Q value of the second operation action after the first operation action based on the sum of the first information value and the weighted value of the maximum value.
9. The method of claim 1, wherein determining an optimized path from each operational behavior to a final operational behavior of each sequence of user behaviors comprises:
and in the transfer relation graph, starting from any node, carrying out node transfer for a plurality of times along the directed edge until the operation behavior corresponding to the reached node belongs to the final operation behavior, wherein each time of node transfer comprises the step of transferring from the current node to the next node corresponding to the subsequent operation behavior with the maximum Q value.
10. An apparatus for recognizing a user behavior pattern, comprising:
the user behavior sequence acquisition unit is configured to acquire N user behavior sequences with labels, and each user behavior sequence comprises a plurality of operation behaviors in sequence;
the behavior transfer relation graph acquisition unit is configured to construct a behavior transfer relation graph according to the N user behavior sequences; the behavior transfer relationship graph comprises nodes and directed edges between the nodes, the nodes correspond to the operation behaviors, and the directed edges correspond to the transfer relationship between two continuous operation behaviors in the N user behavior sequences;
an information value determination unit configured to determine an information value of each transfer relationship with respect to the label;
a Q value determination unit configured to determine a Q value of taking another operation action after each operation action according to the information value and the transfer relationship diagram, the Q value indicating a multi-step accumulated information value;
and the optimized path determining unit is configured to determine an optimized path from each operation behavior to the final operation behavior of each user behavior sequence according to the Q value and the transfer relation diagram, wherein the optimized path is used for determining a behavior mode of the user.
11. The apparatus of claim 10, further comprising:
and the optimization sequence acquisition unit is configured to cut the user behavior sequences including the behavior subsequences in the N user behavior sequences according to the behavior subsequences corresponding to the optimization path to obtain an optimization sequence, and the optimization sequence is used for determining a behavior mode of the user.
12. The apparatus of claim 11, further comprising:
the user behavior mode determining unit is configured to perform sequence clustering operation based on the optimized sequence to obtain a plurality of sequence clusters; and determining a plurality of corresponding user behavior modes according to the plurality of sequence class clusters.
13. The apparatus of claim 10, wherein the information value determination unit is further configured to:
determining a relationship vector corresponding to each transfer relationship according to the transfer relationship corresponding to each directed edge in the transfer relationship graph and the existing state in the N user behavior sequences;
and determining the information value IV of each transfer relation relative to the label according to the relation vector.
14. The apparatus of claim 13, wherein the information value determination unit is further configured to:
for any transfer relation, determining the existence state value corresponding to the transfer relation and the user behavior sequence according to whether the transfer relation exists in each user behavior sequence;
and determining a relation vector corresponding to the transfer relation by combining the transfer relation and the existing state values corresponding to the user behavior sequences.
15. The apparatus of claim 14, wherein,
the label is a positive sample label or a negative sample label;
an information value determination unit further configured to:
for any transfer relation, dividing the relation vector corresponding to the transfer relation according to the existing state value to obtain a plurality of state sub-box vectors;
for each state sub-box sub-vector, determining a sub-information value corresponding to the state sub-box sub-vector according to the label of the user behavior sequence corresponding to each component;
and determining the information value of the transfer relation according to the sub information value corresponding to each state sub-box sub-vector.
16. The apparatus of claim 15, wherein the positive sample labels correspond to sequences known to be at risk for target traffic and the negative sample labels correspond to sequences of user behavior outside of the sequences of at-risk behavior.
17. The apparatus of claim 10, wherein the operational behaviors include a first operational behavior and a second operational behavior, the Q value determination unit further configured to,
the method comprises the steps of obtaining a first information value of a transfer relation corresponding to a second operation behavior after a first operation behavior, adopting a maximum value of a plurality of Q values corresponding to a plurality of next operation behaviors after the second operation behavior, and updating the Q value of the second operation behavior after the first operation behavior based on the sum of the first information value and a weighted value of the maximum value.
18. The apparatus of claim 10, wherein the optimized path determination unit is further configured to:
and in the transfer relation graph, starting from any node, carrying out node transfer for a plurality of times along the directed edge until the operation behavior corresponding to the reached node belongs to the final operation behavior, wherein each time of node transfer comprises the step of transferring from the current node to the next node corresponding to the subsequent operation behavior with the maximum Q value.
19. A computer-readable storage medium, on which a computer program is stored which, when executed in a computer, causes the computer to carry out the method of any one of claims 1-9.
20. A computing device comprising a memory having executable code stored therein and a processor that, when executing the executable code, implements the method of any of claims 1-9.
CN202210289732.1A 2022-03-23 2022-03-23 User behavior pattern recognition method and device Active CN114707990B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202210289732.1A CN114707990B (en) 2022-03-23 2022-03-23 User behavior pattern recognition method and device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202210289732.1A CN114707990B (en) 2022-03-23 2022-03-23 User behavior pattern recognition method and device

Publications (2)

Publication Number Publication Date
CN114707990A true CN114707990A (en) 2022-07-05
CN114707990B CN114707990B (en) 2023-04-07

Family

ID=82168570

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202210289732.1A Active CN114707990B (en) 2022-03-23 2022-03-23 User behavior pattern recognition method and device

Country Status (1)

Country Link
CN (1) CN114707990B (en)

Citations (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN108230057A (en) * 2016-12-09 2018-06-29 阿里巴巴集团控股有限公司 A kind of intelligent recommendation method and system
CN108229963A (en) * 2016-12-12 2018-06-29 阿里巴巴集团控股有限公司 The Risk Identification Method and device of user's operation behavior
EP3499396A1 (en) * 2017-12-12 2019-06-19 Institute for Imformation Industry Abnormal behavior detection model building apparatus and abnormal behavior detection model building method thereof
CN110839031A (en) * 2019-11-15 2020-02-25 中国人民解放军陆军工程大学 Malicious user behavior intelligent detection method based on reinforcement learning
CN111291816A (en) * 2020-02-17 2020-06-16 支付宝(杭州)信息技术有限公司 Method and device for carrying out feature processing aiming at user classification model
CN111340506A (en) * 2020-05-22 2020-06-26 支付宝(杭州)信息技术有限公司 Method and device for identifying risk of transaction behavior, storage medium and computer equipment
CN111652451A (en) * 2020-08-06 2020-09-11 腾讯科技（深圳）有限公司 Social relationship obtaining method and device and storage medium
CN111681049A (en) * 2020-06-04 2020-09-18 广州视源电子科技股份有限公司 User behavior processing method, storage medium and related equipment
CN111784348A (en) * 2016-04-26 2020-10-16 阿里巴巴集团控股有限公司 Account risk identification method and device
KR20210076659A (en) * 2019-12-16 2021-06-24 연세대학교 산학협력단 Method and Apparatus for Action Recognition Using Sequential Feature Data

Patent Citations (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111784348A (en) * 2016-04-26 2020-10-16 阿里巴巴集团控股有限公司 Account risk identification method and device
CN108230057A (en) * 2016-12-09 2018-06-29 阿里巴巴集团控股有限公司 A kind of intelligent recommendation method and system
CN108229963A (en) * 2016-12-12 2018-06-29 阿里巴巴集团控股有限公司 The Risk Identification Method and device of user's operation behavior
EP3499396A1 (en) * 2017-12-12 2019-06-19 Institute for Imformation Industry Abnormal behavior detection model building apparatus and abnormal behavior detection model building method thereof
CN110839031A (en) * 2019-11-15 2020-02-25 中国人民解放军陆军工程大学 Malicious user behavior intelligent detection method based on reinforcement learning
KR20210076659A (en) * 2019-12-16 2021-06-24 연세대학교 산학협력단 Method and Apparatus for Action Recognition Using Sequential Feature Data
CN111291816A (en) * 2020-02-17 2020-06-16 支付宝(杭州)信息技术有限公司 Method and device for carrying out feature processing aiming at user classification model
CN111340506A (en) * 2020-05-22 2020-06-26 支付宝(杭州)信息技术有限公司 Method and device for identifying risk of transaction behavior, storage medium and computer equipment
CN111681049A (en) * 2020-06-04 2020-09-18 广州视源电子科技股份有限公司 User behavior processing method, storage medium and related equipment
CN111652451A (en) * 2020-08-06 2020-09-11 腾讯科技（深圳）有限公司 Social relationship obtaining method and device and storage medium

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
吴晓婕等: "基于Segmental-DTW的无监督行为序列分割", 《软件学报》 *
罗文？等: "基于非用户操作序列的恶意软件检测方法", 《计算机应用》 *

Also Published As

Publication number Publication date
CN114707990B (en) 2023-04-07

Similar Documents

Publication Publication Date Title
EP3989131A1 (en) Method and system for realizing machine learning modeling process
CN108428132B (en) Fraud transaction identification method, device, server and storage medium
US11562315B2 (en) Detecting an issue related to a report
US12118552B2 (en) User profiling based on transaction data associated with a user
US11645515B2 (en) Automatically determining poisonous attacks on neural networks
AU2021203164A1 (en) Predictive issue detection
CN108596616B (en) User data authenticity analysis method and device, storage medium and electronic equipment
CN110310114B (en) Object classification method, device, server and storage medium
US10067990B1 (en) System, method, and computer program for identifying significant attributes of records
CN113468520A (en) Data intrusion detection method applied to block chain service and big data server
CN111159241A (en) Click conversion estimation method and device
CN113409050B (en) Method and device for judging business risk based on user operation
CN116883181B (en) Financial service pushing method based on user portrait, storage medium and server
CN113312457B (en) Method, computing system, and computer readable medium for problem resolution
CN115935265B (en) Method for training risk identification model, risk identification method and corresponding device
CN113259872A (en) Product processing method and system for unmanned network
CN114707990B (en) User behavior pattern recognition method and device
CN111652713B (en) Equity wind control modeling method and device
CN111815442B (en) Link prediction method and device and electronic equipment
CN113052604A (en) Object detection method, device, equipment and storage medium
CN114978616B (en) Construction method and device of risk assessment system, and risk assessment method and device
CN112949752B (en) Training method and device of business prediction system
CN118626806B (en) Potential partner identification method, device and storage medium for executing fraudulent conduct
CN112396513B (en) Data processing method and device
Kılıç et al. Data mining and statistics in data science

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant