CN114707990B - User behavior pattern recognition method and device - Google Patents
User behavior pattern recognition method and device Download PDFInfo
- Publication number
- CN114707990B CN114707990B CN202210289732.1A CN202210289732A CN114707990B CN 114707990 B CN114707990 B CN 114707990B CN 202210289732 A CN202210289732 A CN 202210289732A CN 114707990 B CN114707990 B CN 114707990B
- Authority
- CN
- China
- Prior art keywords
- behavior
- transfer
- user behavior
- sequence
- value
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/401—Transaction verification
- G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
- G06F18/214—Generating training patterns; Bootstrap methods, e.g. bagging or boosting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/23—Clustering techniques
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N20/00—Machine learning
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q40/00—Finance; Insurance; Tax strategies; Processing of corporate or income taxes
- G06Q40/04—Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Business, Economics & Management (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Accounting & Taxation (AREA)
- Finance (AREA)
- Artificial Intelligence (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Evolutionary Computation (AREA)
- General Engineering & Computer Science (AREA)
- Evolutionary Biology (AREA)
- Software Systems (AREA)
- Bioinformatics & Computational Biology (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Life Sciences & Earth Sciences (AREA)
- Strategic Management (AREA)
- General Business, Economics & Management (AREA)
- Computing Systems (AREA)
- Medical Informatics (AREA)
- Computer Security & Cryptography (AREA)
- Mathematical Physics (AREA)
- Development Economics (AREA)
- Economics (AREA)
- Marketing (AREA)
- Technology Law (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The embodiment of the specification provides a method and a device for determining a user behavior pattern, wherein the method comprises the following steps: acquiring N user behavior sequences with labels, wherein each user behavior sequence comprises a plurality of operation behaviors in sequence; constructing a behavior transfer relation graph according to the N user behavior sequences; the behavior transfer relational graph comprises nodes and directed edges between the nodes, the nodes correspond to the operation behaviors, and the directed edges correspond to the transfer relation between two continuous operation behaviors in the N user behavior sequences; determining the information value of each transfer relation relative to the label; determining Q values of other operation behaviors after each operation behavior according to the information value and the transfer relation graph, wherein the Q values represent multi-step accumulated information values; and determining an optimized path from each operation behavior to the final operation behavior of each user behavior sequence according to the Q value and the transfer relation diagram, wherein the optimized path is used for determining the behavior mode of the user.
Description
Technical Field
One or more embodiments of the present disclosure relate to the field of data mining and machine learning, and in particular, to a method and apparatus for recognizing a user behavior pattern.
Background
In many industries where risk control is a problem, such as electronic payment and transaction platforms, operators often need to analyze whether there is a risk of illegal operations, particularly illegal transactions, among others, according to the behavioral link of the user. Traditionally, operators need to manually analyze a large number of illegal operation events to summarize a certain illegal operation rule, and especially the risk judgment efficiency is very low due to the user behavior pattern existing in illegal operation.
Therefore, in order to improve the risk judgment efficiency of the operator, a new method for identifying the user behavior pattern is required.
Disclosure of Invention
The embodiments in the present specification aim to provide a new method and apparatus for identifying a user behavior pattern, by which a user behavior pattern can be accurately and automatically acquired according to a behavior sequence formed by a large number of user behaviors. Therefore, on one hand, the workload of manual analysis in user behavior pattern recognition can be greatly reduced, on the other hand, the accuracy of the obtained user behavior pattern is improved, and the defects in the prior art are overcome.
According to a first aspect, there is provided a method for identifying a user behavior pattern, comprising:
acquiring N user behavior sequences with labels, wherein each user behavior sequence comprises a plurality of operation behaviors in sequence;
constructing a behavior transfer relation graph according to the N user behavior sequences; the behavior transfer relationship graph comprises nodes and directed edges between the nodes, the nodes correspond to the operation behaviors, and the directed edges correspond to the transfer relationship between two continuous operation behaviors in the N user behavior sequences;
determining the information value of each transfer relationship relative to the label;
determining a Q value of other operation behaviors after each operation behavior according to the information value and the transfer relation graph, wherein the Q value represents the multi-step accumulated information value;
and determining an optimized path from each operation behavior to the final operation behavior of each user behavior sequence according to the Q value and the transfer relation graph, wherein the optimized path is used for determining the behavior mode of the user.
In one possible embodiment, the method further comprises:
and according to the behavior subsequence corresponding to the optimized path, cutting the user behavior sequence containing the behavior subsequence in the N user behavior sequences to obtain an optimized sequence, wherein the optimized sequence is used for determining a behavior mode of a user.
In one possible embodiment, the method further comprises:
performing sequence clustering operation based on the optimized sequence to obtain a plurality of sequence clusters; and determining a plurality of corresponding user behavior modes according to the plurality of sequence class clusters.
In one possible embodiment, determining the information value of each transfer relationship relative to the label comprises:
determining a relationship vector corresponding to each transfer relationship according to the transfer relationship corresponding to each directed edge in the transfer relationship graph and the existing state in the N user behavior sequences;
and determining the information value IV of each transfer relation relative to the label according to the relation vector.
In a possible implementation manner, determining, according to a transition relation corresponding to each directed edge in the transition relation graph and an existing state in the N user behavior sequences, a relation vector corresponding to each transition relation includes:
for any transfer relation, determining the existence state value corresponding to the transfer relation and the user behavior sequence according to whether the transfer relation exists in each user behavior sequence;
and determining a relation vector corresponding to the transfer relation by combining the transfer relation and the existing state values corresponding to the user behavior sequences.
In one possible embodiment, the label is a positive swatch label or a negative swatch label;
determining the information value IV of each transfer relation relative to the label according to the relation vector, wherein the method comprises the following steps:
for any transfer relation, dividing the relation vector corresponding to the transfer relation according to the existing state value to obtain a plurality of state sub-box vectors;
for each state sub-box sub-vector, determining a sub-information value corresponding to the state sub-box sub-vector according to the label of the user behavior sequence corresponding to each component;
and determining the information value of the transfer relation according to the sub information value corresponding to each state sub-box sub-vector.
In one possible implementation, the positive sample labels correspond to sequences of behaviors known to be at risk for the target traffic, and the negative sample labels correspond to sequences of user behaviors outside of the sequence of at-risk behaviors.
In a possible implementation manner, the determining, according to the information value and the transition relation graph, a Q value of other operation actions taken after each operation action includes:
the method comprises the steps of obtaining a first information value of a transfer relationship corresponding to a second operation action after a first operation action, adopting a maximum value of a plurality of Q values corresponding to a plurality of next operation actions after the second operation action, and updating the Q value of the second operation action after the first operation action based on the sum of the first information value and the weighted value of the maximum value.
In one possible embodiment, determining an optimized path from each operation behavior to a final operation behavior of each user behavior sequence includes:
and in the transfer relational graph, starting from any node, carrying out node transfer for a plurality of times along the directed edge until the operation behavior corresponding to the arrival node belongs to the final operation behavior, wherein each time of node transfer comprises the step of transferring from the current node to the next node corresponding to the subsequent operation behavior with the maximum Q value.
According to a second aspect, there is provided an apparatus for recognizing a user behavior pattern, comprising:
the user behavior sequence acquisition unit is configured to acquire N user behavior sequences with labels, and each user behavior sequence comprises a plurality of operation behaviors in sequence;
the behavior transfer relation graph acquisition unit is configured to construct a behavior transfer relation graph according to the N user behavior sequences; the behavior transfer relationship graph comprises nodes and directed edges between the nodes, the nodes correspond to the operation behaviors, and the directed edges correspond to the transfer relationship between two continuous operation behaviors in the N user behavior sequences;
an information value determination unit configured to determine an information value of each transfer relationship with respect to the label;
a Q value determination unit configured to determine a Q value of taking another operation action after each operation action according to the information value and the transfer relationship diagram, the Q value indicating a multi-step accumulated information value;
and the optimized path determining unit is configured to determine an optimized path from each operation behavior to the final operation behavior of each user behavior sequence according to the Q value and the transfer relation diagram, wherein the optimized path is used for determining a behavior mode of the user.
In one possible embodiment, the apparatus further comprises:
and the optimization sequence acquisition unit is configured to cut the user behavior sequences including the behavior subsequences in the N user behavior sequences according to the behavior subsequences corresponding to the optimization path to obtain an optimization sequence, and the optimization sequence is used for determining a behavior mode of the user.
In a possible embodiment, the apparatus further comprises:
the user behavior mode determining unit is configured to perform sequence clustering operation based on the optimized sequence to obtain a plurality of sequence clusters; and determining a plurality of corresponding user behavior modes according to the plurality of sequence class clusters.
In one possible embodiment, the information value determination unit is further configured to:
determining a relationship vector corresponding to each transfer relationship according to the transfer relationship corresponding to each directed edge in the transfer relationship graph and the existing state in the N user behavior sequences;
and determining the information value IV of each transfer relation relative to the label according to the relation vector.
In one possible embodiment, the information value determination unit is further configured to:
for any transfer relation, determining the existence state value corresponding to the transfer relation and the user behavior sequence according to whether the transfer relation exists in each user behavior sequence;
and determining a relation vector corresponding to the transfer relation by combining the transfer relation and the existing state values corresponding to the user behavior sequences.
In one possible embodiment, the label is a positive swatch label or a negative swatch label;
an information value determination unit further configured to:
for any transfer relation, dividing the relation vector corresponding to the transfer relation according to the existing state value to obtain a plurality of state sub-box sub-vectors;
for each state sub-box vector, determining the sub-information value corresponding to the state sub-box vector according to the label of the user behavior sequence corresponding to each component;
and determining the information value of the transfer relation according to the sub information value corresponding to each state sub-box sub-vector.
In one possible implementation, the positive sample labels correspond to sequences known to be at risk for the target traffic, and the negative sample labels correspond to sequences of user behavior outside of the sequence of at-risk behavior.
In one possible implementation, the operation behaviors include a first operation behavior and a second operation behavior, the Q-value determining unit is further configured to,
the method comprises the steps of obtaining a first information value of a transfer relation corresponding to a second operation behavior after a first operation behavior, adopting a maximum value of a plurality of Q values corresponding to a plurality of next operation behaviors after the second operation behavior, and updating the Q value of the second operation behavior after the first operation behavior based on the sum of the first information value and a weighted value of the maximum value.
In a possible implementation, the optimized path determining unit is further configured to:
and in the transfer relation graph, starting from any node, carrying out node transfer for a plurality of times along the directed edge until the operation behavior corresponding to the reached node belongs to the final operation behavior, wherein each time of node transfer comprises the step of transferring from the current node to the next node corresponding to the subsequent operation behavior with the maximum Q value.
According to a third aspect, there is provided a computer readable storage medium having stored thereon a computer program which, when executed in a computer, causes the computer to perform the method of the first aspect.
According to a fourth aspect, there is provided a computing device comprising a memory having stored therein executable code and a processor that, when executing the executable code, implements the method of the first aspect.
By using one or more of the method, the apparatus, the computing device and the storage medium in the above aspects, the user behavior pattern can be accurately and automatically acquired, so that the workload of manual analysis in user behavior pattern recognition is reduced, and the accuracy of the acquired user behavior pattern is improved.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and it is obvious for those skilled in the art that other drawings can be obtained according to the drawings without creative efforts.
FIG. 1 is a schematic diagram illustrating a method for identifying patterns of user behavior according to an embodiment of the present disclosure;
FIG. 2 is a flow chart illustrating a method for identifying patterns of user behavior according to an embodiment of the present disclosure;
FIG. 3 is a diagram illustrating a user action sequence list according to an embodiment of the present description;
FIG. 4 is a schematic diagram illustrating a graph of action relationships according to an embodiment of the present description;
FIG. 5 illustrates a schematic diagram of an R-value table in accordance with embodiments herein;
FIG. 6 is a diagram illustrating a Q value table according to an embodiment of the present disclosure;
fig. 7 is a block diagram of an apparatus for recognizing a user behavior pattern according to an embodiment of the present disclosure.
Detailed Description
The solution provided by the present specification will be described below with reference to the accompanying drawings.
As previously mentioned, operational risk control is needed in many industries. For example, in electronic payment and transaction platforms, risk operators often need to analyze illegal operational links of some risk cases and from them analyze some common illegal operational patterns. In general, the behavioral link of a user within a client application can be very complex, and can include, for example, various complex behaviors such as registering, logging on, clicking, accessing, submitting requests, purchasing, and so forth.
However, for an illegal operation in a specific scenario, the behavioral links of the users may be very similar, such as in the scenario of account theft, typical illegal operation action sequences often include actions such as password changing, binding changing, body checking, payment, etc.; in a fraud scenario, a typical sequence of actions by a fraudster often includes acts such as opening an album to scan a code, adding friends, transferring money, etc.; in the context of credit cash-out, typical cash-out techniques often include acts such as viewing credit points, opening an offline payment switch, paying, collecting cash, etc. The traditional manual operation method often needs to manually analyze a plurality of illegal operation events to summarize a specific user behavior rule in the illegal operation or discover a user behavior pattern in the illegal operation. However, such a method requires a large number of operators and consumes a large amount of manual work, and the operation efficiency is very low.
Alternatively, the user action sequence is sequence coded and then a score or classification for risk identification is obtained, for example, by a regression model or classification model. The method classifies according to the total action sequence, a great amount of user operations irrelevant to risk identification or little in relevance can be mixed in the sequence, and the problems that the identification result is not accurate enough and the interpretability of the identification result is poor are also caused.
In order to improve the operation efficiency of risk operators, reduce the workload of the operators, and improve the accuracy of identifying a user behavior pattern, the embodiment of the specification provides a method for identifying a user behavior pattern. Fig. 1 is a schematic diagram illustrating a method for recognizing a user behavior pattern according to an embodiment of the present disclosure. As shown in fig. 1, first, a plurality of user behavior sequences are obtained, where the user behavior sequences may include a user behavior sequence composed of a plurality of ordered user operations in known illegal operation scenarios of different types, for example, the user behavior sequences may be obtained from known scenarios of account stealing, fraud, credit cash register, and the like. It may also include user behavior sequences other than those of the known illegal operation scenarios described above.
After the user behavior sequences are obtained, a behavior transfer relationship graph can be constructed according to the user behavior sequences. The construction method is that the nodes in the behavior transfer relationship graph are determined according to any user operation in each behavior sequence, and the directed edges between the nodes are determined according to the continuous relationship (or transfer relationship) between any two continuous user operations in different behavior sequences. And, the information value of each of these transfer relationships is determined.
After obtaining the behavior transition relationship diagram and the information value, Q-advancing learning can be performed based on the transition relationship diagram and the information value, wherein the former operation of two continuous user operations corresponds to the State (State) in the conventional Q-advancing learning, the latter operation corresponds to the Action (Action) taken under the State (State) in the conventional Q-advancing learning, and the information value is used as the Reward or Reward (Reward) of the two continuous user operations (corresponding transition relationship). Then, based on the reward and transition relation map between the continuous actions, the Q value corresponding to each transition relation is determined.
After the Q values corresponding to the respective transfer relationships are obtained, an optimized path from each operation behavior to the final operation behavior of each user behavior sequence can be determined according to the respective Q values and the transfer relationship diagram, and then, a behavior pattern of the user is determined according to the obtained optimized path. In an embodiment, for example, the user behavior sequence may be clipped according to the optimized path, then the optimized and clipped behavior sequence is used for clustering, a behavior sequence cluster is obtained, and the user behavior pattern is determined according to the behavior sequence cluster.
The method has the following advantages: on one hand, the method can be widely applied to scenes needing to analyze the user behavior sequence, can help risk operators to quickly analyze and discover various user behavior patterns, and can automatically acquire the behavior patterns according to the user behavior data compared with the method for acquiring the user behavior patterns through manual analysis, so that the workload of manual analysis in user behavior pattern recognition is greatly reduced, and the analysis efficiency is improved. In the second aspect, the optimized path obtained by the method has better correlation with the specific risk behaviors, so that the user behavior pattern implementing the specific risk behaviors can be better determined according to the optimized path.
The details of the process are further set forth below. Fig. 2 is a flowchart illustrating a method for identifying a user behavior pattern according to an embodiment of the present disclosure. As shown in fig. 2, the method at least comprises the following steps:
step 22, constructing a behavior transfer relation graph according to the N user behavior sequences; the behavior transfer relationship graph comprises nodes and directed edges between the nodes, the nodes correspond to the operation behaviors, and the directed edges correspond to the transfer relationship between two continuous operation behaviors in the N user behavior sequences;
and step 23, determining the information value of each transfer relation relative to the label.
Step 24, determining a Q value of other operation behaviors after each operation behavior according to the information value and the transfer relation graph, wherein the Q value represents a multi-step accumulated information value;
and 25, determining an optimized path from each operation behavior to the final operation behavior of each user behavior sequence according to the Q value and the transfer relation diagram, wherein the optimized path is used for determining the behavior mode of the user.
First, in step 21, N tagged user behavior sequences are obtained, each user behavior sequence comprising a plurality of operation behaviors in sequence.
In this step, the user behavior sequence may include a plurality of user operations in sequence. In different embodiments, the multiple user operations may be, for example, user operation behaviors for different specific applications, services, user terminals, and operation interfaces. In different embodiments, different specific ways of extracting or intercepting the user operation may be adopted. The present specification focuses on the processing procedure after obtaining the user behavior sequence, and does not focus on what kind of application object the user operation is directed to, or on the specific manner of extracting the user operation, and does not limit the application object.
According to an embodiment, the user operation may be a user operation for a target service. Thus, in one embodiment, a plurality of user behavior sequences may be obtained, wherein each user behavior sequence comprises a sequential plurality of user traffic behaviors for a target traffic. In one embodiment, the N user action sequences may form a user action sequence list, and fig. 3 is a schematic diagram of a user action sequence list according to an embodiment of the present specification, where a tag of a user action sequence indicates whether the user action sequence is a known action sequence with a specific property. In a specific embodiment, the tag may indicate whether the corresponding sequence is a behavior sequence with a known risk for the aforementioned target service, for example, a behavior sequence with a known risk of account theft, fraud, credit cash-out, and the like. For example, in one example, if the label is 1, it indicates that the behavior sequence is a behavior sequence known to be at risk for the target service, and if the label is 0, it indicates that the behavior sequence is a behavior sequence other than the known behavior sequence at risk. In different specific examples, the sequence of known behaviors at risk may be determined in different specific ways, for example, according to a user report or according to other recognition models, which is not limited in this specification. In different embodiments, the positive and negative swatch labels can correspond to whether they have different specific properties.
After acquiring the plurality of user behavior sequences, in step 22, constructing a behavior transfer relationship graph according to the N user behavior sequences; the behavior transfer relationship graph comprises nodes and directed edges between the nodes, the nodes correspond to the operation behaviors, and the directed edges correspond to the transfer relationship between two continuous operation behaviors in the N user behavior sequences.
In this step, a behavior transfer relationship diagram is constructed according to the user behavior sequence obtained in step 21. The sequence relation graph may be a directed graph, which includes nodes and directed edges between the nodes, where the nodes correspond to the operation behaviors, and the directed edges correspond to a transition relation between two consecutive operation behaviors in the N user behavior sequences. For example, act _3 and Act _ i, act _1 and Act _ n in fig. 3 each constitute a transfer relationship. Fig. 4 is a schematic diagram illustrating a behavior transition relationship diagram according to an embodiment of the present specification. As shown in fig. 4, each node corresponds to different operation behaviors, for example, node 1 corresponds to user operation Act _1, node 2 corresponds to user operation Act _2, and similarly, the rest nodes also have respective corresponding user operation behaviors. Directed edges between nodes represent a transition relationship between two successive operational behaviors. For example, in fig. 4, a directed edge exists between node 1 and node 2, which indicates that, in a plurality of user behavior sequences (for example, the user sequence list shown in fig. 3) according to which the action relationship graph is constructed, two consecutive operation actions Act _1 and Act _2 exist in one or more user behavior sequences, or that there is a transition from Act _1 to Act _ 2. For another example, a directed edge exists between the node 2 and the node i, which means that two consecutive operation actions Act _2 and Act _ i exist in one or more of the above-mentioned user behavior sequences, or that there is a transition from Act _2 to Act _ i. Similarly, the other directed edges respectively correspond to the transition from one user operation action to another user operation action. In one embodiment, an operation action transition, such as the transition from Act _2 to Act _ i, may occur multiple times in the same user behavior sequence or multiple user behavior sequences, and may correspond to only one directed edge in the action transition relationship graph. For example, in one example, the user behavior sequence S1 is "BEABCAE", wherein the individual characters "A", "B", "C", "E" \8230indicatedifferent user operations, and the user behavior sequence S2 is "XABCH". Then, in the action transfer relationship graph formed by the two, there is only one directed edge from the node corresponding to the action "A" to the node corresponding to the action "B".
Then, in step 33, the information value of each transfer relationship with respect to the label is determined.
Information Value (IV), is often used to measure the predictive power of a feature. In the context of the embodiments of the present specification, the information value of the transition relation may reflect that two consecutive actions corresponding to the transition relation play a role in the tag value of the behavior sequence to which the transition relation belongs, or whether the transition relation has a specific property (e.g., whether the transition relation is a risk sequence). For example, some continuous actions with high frequency hardly contribute to the judgment of the property of the behavior sequence, so that the information value is small; the occurrence of some continuous actions plays a decisive role in judging the properties of the behavior sequences, so that the information value is high. The information value IV value is obtained in the step and is mainly used for determining the Q value as a Reward value corresponding to each transfer relation in Q-learning reinforcement learning in the subsequent step, so that the optimal path reaching the final node is obtained.
Because each transfer relation is a behavior transfer relation existing in the user behavior sequence, a feature vector corresponding to each transfer relation can be determined according to the user behavior sequence and the label thereof, and then the corresponding information value is determined according to the feature vector. Therefore, in an embodiment, a relationship vector corresponding to each transfer relationship (i.e., a feature vector corresponding to the transfer relationship) may be determined according to the existence state of the transfer relationship corresponding to each directed edge in the transfer relationship graph in the N user behavior sequences; and determining the information value IV of each transfer relation relative to the label according to the relation vector. In a specific embodiment, for any transition relationship, determining a presence state value corresponding to the transition relationship and each user behavior sequence according to whether the transition relationship exists in each user behavior sequence; and determining a relation vector corresponding to the transfer relation by combining the transfer relation and the existing state values corresponding to the user behavior sequences. Then, the information value of the transfer relationship can be determined according to the label of each user behavior sequence and the relationship vector. In a particular embodiment, the tags of the user behavior sequence may be positive exemplar tags or negative exemplar tags; for any transfer relation, dividing the relation vector corresponding to the transfer relation according to the existing state value to obtain a plurality of state sub-box sub-vectors; for each state sub-box vector, determining the sub-information value corresponding to the state sub-box vector according to the label of the user behavior sequence corresponding to each component; and determining the information value of the transfer relation according to the sub information value corresponding to each state sub-box sub-vector.
In a specific embodiment, for example, for all 1000 sequences S1 to S1000, the transition relationship between Act _1 and Act _2 exists only in 100 sequences, for example, in S1 to S100 (the continuous sequences S1 to S100 are used for convenience of description only, and may be discontinuous in practice). Thus, the presence state value of the transition relationship in each sequence may include 0 and 1, corresponding to presence and absence, respectively. Further, the relation vector may be divided into 2 state binning sub-vectors, i.e., a first state binning sub-vector corresponding to S1 to S100 and a second state binning vector corresponding to S101 to S1000, according to the presence state value. Then, the sub information value corresponding to the sub vector may be determined based on the label of the sequence corresponding to each component in the binned sub vector (for example, the sub information value corresponding to the first state binned sub vector may be determined based on the label of each sequence in S1 to S100). And determining the information value corresponding to the transfer relationship by combining the sub information values corresponding to the sub vectors. In one specific example, the determination of the value of the sub-information may be expressed as:
wherein IV i The sub information value corresponding to the sub vector of the state sub box is set as i, the serial number of the sub vector of the state sub box is set as i, and Bad i For the number of all response sequences (e.g. sequences labeled 1) in the user behavior sequence corresponding to the state bin subvector, bad T For the number of all response sequences in all user behavior sequences, good i Good is the number of all non-response sequences (e.g. sequences with 0 label) in the user behavior sequence corresponding to the sub-vector of the box T The IV is the information value of the transfer relationship for the number of all non-response sequences in all user behavior sequences.
In one example, positive exemplar labels may correspond to known dangerous behavior sequences and negative exemplar labels may correspond to user behavior sequences other than known dangerous behavior sequences.
In one embodiment, the determined information value of each transfer relationship may constitute a transfer relationship prize table (R-value table). Fig. 5 is a diagram illustrating an R-value table according to an embodiment of the present disclosure, in which an award R _12 corresponds to a transition relationship from an action Act _1 to an action Act _2, that is, an information value corresponding to the transition relationship; the reward r _1n corresponding to the transition relationship from Act _1 to Act _ n, i.e. the information value corresponding to the transition relationship, and similarly, the transition relationship between other acts takes the corresponding information value as the reward of the transition relationship. The rewards corresponding to all the transfer relations can form a transfer relation reward table. In a specific embodiment, each migration relationship has no migration relationship for itself or does not constitute a meaningful migration relationship, for example, act _1 to Act _1 do not constitute a migration relationship, and thus the bonus value of a meaningless migration relationship may be represented in the migration relationship bonus table with a specific preset bonus value. In one example, the predetermined prize value is, for example, -1.
The acquired transfer relationship reward table is mainly used for determining the Q value of other operation behaviors after each operation behavior is determined according to the transfer relationship reward table based on Q-IEarning machine learning in the subsequent steps, and the detailed process refers to the description of the subsequent steps.
After the above information value is acquired, in step 24, a Q value for taking other operation actions after each operation action is determined based on the information value and the transition relation graph, and the Q value represents a multi-step accumulated information value.
In this step, the Q value of the other operation actions taken after each operation action is determined based on the information value of the transfer relationship (as the reward for the transfer relationship) acquired in step 23 and the transfer relationship diagram, essentially based on the Q-learning method. Conventionally, Q-Learning is a reinforcement Learning method that essentially includes three elements of State (State), action (Action), and reward (reward), and the purpose of Q-Learning is to learn the value (which may be estimated based on multi-step accumulation) of a particular Action at a particular State, i.e., the Q value. Specifically, a Q table may be created in which, for example, each state is a row and each action is a column. Then, the Q table is updated by searching from the start state included in the state space (composed of all the different states) to the target state included in the state space. Specifically, each time a transition is made between states in the search, the Q value corresponding to the action in the Q table, which is the initial state of the transition, is updated based on the reward (or report) associated with the action to be performed for the transition.
The Q-learning in this step is different from the conventional Q-advancing learning in that the Q value of different actions (act on) taken in different states (states) is generally learned in the conventional Q-advancing. In the embodiment of the present specification, the Q values of two consecutive actions, i.e., the Q value of the latter action taken under the pre-action, are learned through Q-learning. That is, the state space is essentially constituted by the operation motions, and the motion space is also constituted by the operation motions.
Specifically, in the learning process, the Q value of two consecutive actions can be determined according to the information value of the transition relationship corresponding to the two consecutive actions (essentially, as a reward for the transition of the action). Thus, in one embodiment, the Q table may be initialized first. Then, a random walk is performed in the transition relation graph to update the Q table. In the random walk process, for a first operation behavior and a second operation behavior connected with any directed edge, a first information value of a transfer relationship corresponding to the second operation behavior after the first operation behavior is obtained, a maximum value of a plurality of Q values corresponding to a plurality of next operation behaviors after the second operation behavior is obtained, and the Q value of the second operation behavior after the first operation behavior is updated according to the sum of the first information value and the weighted value of the maximum value. In a specific embodiment, the Q value of the second operation behavior (or its corresponding transition relationship) taken after the first operation behavior may be represented as:
Q(action，action next )
＝R(action，action next )+Gamma*Max[Q(action next ，allactions)]
wherein the action is an operation behavior before the action is transferred in the transfer relationship, i.e. the first operation behavior, action next Q (action) is the operation behavior after the action in the transition relation is transitioned, i.e. the aforementioned second operation behavior next ) The Q value, R (action ) corresponding to the transition relation next ) For the reward corresponding to the transfer relationship, gamma is a learning coefficient (as a weighting coefficient for weighted summation),
represents the second operation action next The largest Q value among Q values corresponding to all transition relationships formed by all subsequent possible operation actions. />
In one embodiment, the determined Q values for each of the branch relationships may form a Q value table. Fig. 6 is a schematic diagram illustrating a Q-value table according to an embodiment of the present specification, as shown in fig. 6, where a Q value corresponding to a transition relationship from action Act _1 to action Act _2 is Q _12; the Q value corresponding to the transition relationship from Act _1 to Act _ n is Q _1n, and similarly, the transition relationship between other acts has its corresponding Q value. The Q values of all the transfer relationships may form a Q value table.
Thereafter, in step 25, an optimized path from each operation behavior to the final operation behavior of each user behavior sequence is determined according to the Q value and the transition relation graph, wherein the optimized path is used for determining the behavior pattern of the user.
It will be appreciated that the optimized path from any initial action to any final action may be conveniently obtained from the Q-value table and the transition relation diagram described above. For example, for each action transfer in the transfer process from any initial action to any final action, the action transfer corresponding to the maximum Q value in the selectable action transfers is selected until the final action, and an optimized path is obtained by combining each action transfer. Therefore, in one embodiment, in the transfer relationship graph, node transfer may be performed several times from any node along the directed edge until an operation behavior corresponding to a node is reached and belongs to the final operation behavior, where each node transfer includes transferring from a current node to a next node corresponding to a subsequent operation behavior with a largest Q value. This part is similar to the conventional Q-learning scheme and is not described in detail herein.
The optimized path essence may correspond to a subsequence of the sequence of user behaviors that is more strongly associated with, for example, a particular risk behavior. Therefore, according to an implementation manner, the user behavior sequence including the behavior subsequence in the N user behavior sequences may also be cut according to the behavior subsequence corresponding to the optimized path, so as to obtain an optimized sequence, where the optimized sequence is used to determine a behavior pattern of the user. For example, the original user behavior sequence includes a user behavior sequence S3, specifically "acbadfbadfddand", where each character represents a different operation action. The obtained optimized path includes Y1 and Y2, which are "DAN" and "BAD", respectively. S3 may be clipped according to Y1, Y2, for example, retaining the optimized path portion therein and removing the rest, the clipped sequence being "baddadmadan". It will be appreciated that the tailored sequence of user behavior is also more strongly associated with, for example, a particular risk behavior, and thus, the user behavior pattern according to which the particular risk behavior is implemented can be more accurately determined. In different embodiments, the user behavior mode may be determined in different specific ways according to the clipped user behavior sequence, which is not limited in this specification. In one embodiment, for example, based on the optimized sequence, a sequence clustering operation may be performed to obtain a plurality of sequence clusters; and determining a plurality of corresponding user behavior modes according to the plurality of sequence class clusters. In different embodiments, different specific clustering algorithms may be used to obtain the clustering result (class cluster). A node class cluster of nodes may essentially correspond to a set of several user behavior sequences. Therefore, in one embodiment, after obtaining the plurality of user behavior sequence sets, the corresponding plurality of user behavior patterns may be determined according to the plurality of user behavior sequence sets.
According to an embodiment of another aspect, an apparatus for recognizing a user behavior pattern is also provided. Fig. 7 is a block diagram illustrating an apparatus for recognizing a user behavior pattern according to an embodiment of the present disclosure, and as shown in fig. 7, the apparatus 700 includes:
a user behavior sequence obtaining unit 71, configured to obtain N user behavior sequences with tags, where each user behavior sequence includes a plurality of operation behaviors in sequence;
a behavior transfer relationship diagram obtaining unit 72, configured to construct a behavior transfer relationship diagram according to the N user behavior sequences; the behavior transfer relationship graph comprises nodes and directed edges between the nodes, the nodes correspond to the operation behaviors, and the directed edges correspond to the transfer relationship between two continuous operation behaviors in the N user behavior sequences;
an information value determination unit 73 configured to determine an information value of each transfer relationship with respect to the label;
a Q value determining unit 74 configured to determine, based on the information value and the transfer relationship diagram, a Q value at which another operation action is taken after each operation action, the Q value indicating a multi-step accumulated information value;
and an optimized path determining unit 75 configured to determine, according to the Q value and the transition relation graph, an optimized path from each operation behavior to a final operation behavior of each user behavior sequence, where the optimized path is used to determine a behavior pattern of a user.
In one embodiment, the apparatus may further include:
and the optimization sequence acquisition unit is configured to cut the user behavior sequences including the behavior subsequences in the N user behavior sequences according to the behavior subsequences corresponding to the optimization path to obtain an optimization sequence, and the optimization sequence is used for determining a behavior mode of the user.
In one embodiment, the apparatus may further include:
the user behavior mode determining unit is configured to perform sequence clustering operation based on the optimized sequence to obtain a plurality of sequence clusters; and determining a plurality of corresponding user behavior modes according to the plurality of sequence class clusters.
In one embodiment, the information value determination unit may be further configured to:
determining a relationship vector corresponding to each transfer relationship according to the transfer relationship corresponding to each directed edge in the transfer relationship graph and the existing state in the N user behavior sequences;
and determining the information value IV of each transfer relation relative to the label according to the relation vector.
In one embodiment, the information value determination unit may be further configured to:
for any transfer relation, determining the existence state value corresponding to the transfer relation and the user behavior sequence according to whether the transfer relation exists in each user behavior sequence;
and determining a relation vector corresponding to the transfer relation by combining the transfer relation and the existing state values corresponding to the user behavior sequences.
In one embodiment, the label may be a positive swatch label or a negative swatch label;
an information value determination unit, which may be further configured to:
for any transfer relation, dividing the relation vector corresponding to the transfer relation according to the existing state value to obtain a plurality of state sub-box vectors;
for each state sub-box vector, determining the sub-information value corresponding to the state sub-box vector according to the label of the user behavior sequence corresponding to each component;
and determining the information value of the transfer relation according to the sub information value corresponding to each state sub-box sub-vector.
In one embodiment, the positive exemplar labels correspond to sequences known to be at risk for the target traffic, and the negative exemplar labels correspond to sequences of user behavior outside of the sequences of behavior at risk.
In one embodiment, the operation behaviors may include a first operation behavior and a second operation behavior, the Q value determination unit may be further configured to,
the method comprises the steps of obtaining a first information value of a transfer relation corresponding to a second operation behavior after a first operation behavior, adopting a maximum value of a plurality of Q values corresponding to a plurality of next operation behaviors after the second operation behavior, and updating the Q value of the second operation behavior after the first operation behavior based on the sum of the first information value and a weighted value of the maximum value.
In an embodiment, the optimized path determining unit may be further configured to:
and in the transfer relational graph, starting from any node, carrying out node transfer for a plurality of times along the directed edge until the operation behavior corresponding to the arrival node belongs to the final operation behavior, wherein each time of node transfer comprises the step of transferring from the current node to the next node corresponding to the subsequent operation behavior with the maximum Q value.
A further aspect of the present description provides a computer-readable storage medium having stored thereon a computer program which, when executed in a computer, causes the computer to perform any of the methods described above.
Yet another aspect of the present specification provides a computing device comprising a memory having stored therein executable code, and a processor that, when executing the executable code, implements any of the above methods.
It is to be understood that the terms "first," "second," and the like, herein are used for descriptive purposes only and not for purposes of limitation, to distinguish between similar concepts.
Those skilled in the art will recognize that, in one or more of the examples described above, the functions described in this invention may be implemented in hardware, software, firmware, or any combination thereof. When implemented in software, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.
The above-mentioned embodiments, objects, technical solutions and advantages of the present invention are further described in detail, it should be understood that the above-mentioned embodiments are only exemplary embodiments of the present invention, and are not intended to limit the scope of the present invention, and any modifications, equivalent substitutions, improvements and the like made on the basis of the technical solutions of the present invention should be included in the scope of the present invention.
Claims (20)
1. A method for recognizing a user behavior pattern comprises the following steps:
acquiring N user behavior sequences with labels, wherein each user behavior sequence comprises a plurality of operation behaviors in sequence; the operation behaviors comprise user operation behaviors aiming at one or more of application, service, user terminal and operation interface;
constructing a behavior transfer relation graph according to the N user behavior sequences; the behavior transfer relationship graph comprises nodes and directed edges between the nodes, the nodes correspond to the operation behaviors, and the directed edges correspond to the transfer relationship between two continuous operation behaviors in the N user behavior sequences;
determining the information value of each transfer relationship relative to the label;
determining a Q value of other operation behaviors after each operation behavior according to the information value and the transfer relation graph, wherein the Q value represents the multi-step accumulated information value;
and determining an optimized path from each operation behavior to the final operation behavior of each user behavior sequence according to the Q value and the transfer relation diagram, wherein the optimized path is used for determining a user behavior mode for implementing a specific risk behavior.
2. The method of claim 1, further comprising:
and according to the behavior subsequence corresponding to the optimized path, cutting the user behavior sequence containing the behavior subsequence in the N user behavior sequences to obtain an optimized sequence, wherein the optimized sequence is used for determining the user behavior mode.
3. The method of claim 2, further comprising:
performing sequence clustering operation based on the optimized sequence to obtain a plurality of sequence clusters; and determining a plurality of corresponding user behavior patterns according to the plurality of sequence class clusters.
4. The method of claim 1, wherein determining an informational value of each transfer relationship relative to the label comprises:
determining a relationship vector corresponding to each transfer relationship according to the transfer relationship corresponding to each directed edge in the transfer relationship graph and the existing state in the N user behavior sequences;
and determining the information value IV of each transfer relation relative to the label according to the relation vector.
5. The method according to claim 4, wherein determining, according to the existence state of the transition relation corresponding to each directed edge in the transition relation graph in the N user behavior sequences, a relation vector corresponding to each transition relation comprises:
for any transfer relation, determining the existence state value corresponding to the transfer relation and the user behavior sequence according to whether the transfer relation exists in each user behavior sequence;
and determining a relation vector corresponding to the transfer relation by combining the transfer relation and the existing state values corresponding to the user behavior sequences.
6. The method of claim 5, wherein,
the label is a positive sample label or a negative sample label;
determining the information value IV of each transfer relation relative to the label according to the relation vector, wherein the method comprises the following steps:
for any transfer relation, dividing the relation vector corresponding to the transfer relation according to the existing state value to obtain a plurality of state sub-box vectors;
for each state sub-box sub-vector, determining a sub-information value corresponding to the state sub-box sub-vector according to the label of the user behavior sequence corresponding to each component;
and determining the information value of the transfer relation according to the sub information value corresponding to each state sub-box sub-vector.
7. The method of claim 6, wherein the positive sample labels correspond to sequences of behaviors known to be at risk for a target service and the negative sample labels correspond to sequences of user behaviors outside of the sequences of at-risk behaviors.
8. The method of claim 1, wherein the operational behaviors include a first operational behavior and a second operational behavior, and determining, from the informational value and the transfer relationship graph, a Q value for taking other operational behaviors after each operational behavior comprises:
the method comprises the steps of obtaining a first information value of a transfer relation corresponding to a second operation behavior after a first operation behavior, adopting a maximum value of a plurality of Q values corresponding to a plurality of next operation behaviors after the second operation behavior, and updating the Q value of the second operation behavior after the first operation behavior based on the sum of the first information value and a weighted value of the maximum value.
9. The method of claim 1, wherein determining an optimized path from each operational behavior to a final operational behavior of each sequence of user behaviors comprises:
and in the transfer relational graph, starting from any node, carrying out node transfer for a plurality of times along the directed edge until the operation behavior corresponding to the arrival node belongs to the final operation behavior, wherein each time of node transfer comprises the step of transferring from the current node to the next node corresponding to the subsequent operation behavior with the maximum Q value.
10. An apparatus for recognizing a user behavior pattern, comprising:
the user behavior sequence acquisition unit is configured to acquire N user behavior sequences with labels, and each user behavior sequence comprises a plurality of operation behaviors in sequence; the operation behaviors comprise user operation behaviors aiming at one or more of application, service, user terminal and operation interface;
the behavior transfer relation graph acquisition unit is configured to construct a behavior transfer relation graph according to the N user behavior sequences; the behavior transfer relationship graph comprises nodes and directed edges between the nodes, the nodes correspond to the operation behaviors, and the directed edges correspond to the transfer relationship between two continuous operation behaviors in the N user behavior sequences;
an information value determination unit configured to determine an information value of each transfer relationship with respect to the label;
a Q value determination unit configured to determine a Q value of taking another operation action after each operation action according to the information value and the transfer relationship diagram, the Q value indicating a multi-step accumulated information value;
and the optimized path determining unit is configured to determine an optimized path from each operation behavior to the final operation behavior of each user behavior sequence according to the Q value and the transfer relation graph, wherein the optimized path is used for determining a user behavior mode for implementing a specific risk behavior.
11. The apparatus of claim 10, further comprising:
and the optimization sequence acquisition unit is configured to cut the user behavior sequences including the behavior subsequences in the N user behavior sequences according to the behavior subsequences corresponding to the optimization paths to obtain an optimization sequence, and the optimization sequence is used for determining the user behavior mode.
12. The apparatus of claim 11, further comprising:
the user behavior mode determining unit is configured to perform sequence clustering operation based on the optimized sequence to obtain a plurality of sequence clusters; and determining a plurality of corresponding user behavior patterns according to the plurality of sequence class clusters.
13. The apparatus of claim 10, wherein the information value determination unit is further configured to:
determining a relationship vector corresponding to each transfer relationship according to the transfer relationship corresponding to each directed edge in the transfer relationship graph and the existing state in the N user behavior sequences;
and determining the information value IV of each transfer relation relative to the label according to the relation vector.
14. The apparatus of claim 13, wherein the information value determination unit is further configured to:
for any transfer relation, determining the existence state value corresponding to the transfer relation and the user behavior sequence according to whether the transfer relation exists in each user behavior sequence;
and determining a relation vector corresponding to the transfer relation by combining the transfer relation and the existing state values corresponding to the user behavior sequences.
15. The apparatus of claim 14, wherein,
the label is a positive sample label or a negative sample label;
an information value determination unit further configured to:
for any transfer relation, dividing the relation vector corresponding to the transfer relation according to the existing state value to obtain a plurality of state sub-box vectors;
for each state sub-box vector, determining the sub-information value corresponding to the state sub-box vector according to the label of the user behavior sequence corresponding to each component;
and determining the information value of the transfer relation according to the sub information value corresponding to each state sub-box sub-vector.
16. The apparatus of claim 15, wherein the positive sample labels correspond to sequences known to be at risk for target traffic and the negative sample labels correspond to sequences of user behavior outside of the sequences of at-risk behavior.
17. The apparatus of claim 10, wherein the operational behaviors include a first operational behavior and a second operational behavior, the Q-value determination unit further configured to,
the method comprises the steps of obtaining a first information value of a transfer relation corresponding to a second operation behavior after a first operation behavior, adopting a maximum value of a plurality of Q values corresponding to a plurality of next operation behaviors after the second operation behavior, and updating the Q value of the second operation behavior after the first operation behavior based on the sum of the first information value and a weighted value of the maximum value.
18. The apparatus of claim 10, wherein the optimized path determination unit is further configured to:
and in the transfer relation graph, starting from any node, carrying out node transfer for a plurality of times along the directed edge until the operation behavior corresponding to the reached node belongs to the final operation behavior, wherein each time of node transfer comprises the step of transferring from the current node to the next node corresponding to the subsequent operation behavior with the maximum Q value.
19. A computer-readable storage medium, on which a computer program is stored which, when executed in a computer, causes the computer to carry out the method of any one of claims 1-9.
20. A computing device comprising a memory having executable code stored therein and a processor that, when executing the executable code, implements the method of any of claims 1-9.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210289732.1A CN114707990B (en) | 2022-03-23 | 2022-03-23 | User behavior pattern recognition method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210289732.1A CN114707990B (en) | 2022-03-23 | 2022-03-23 | User behavior pattern recognition method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114707990A CN114707990A (en) | 2022-07-05 |
| CN114707990B true CN114707990B (en) | 2023-04-07 |
Family
ID=82168570
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210289732.1A Active CN114707990B (en) | 2022-03-23 | 2022-03-23 | User behavior pattern recognition method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114707990B (en) |
Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111291816A (en) * | 2020-02-17 | 2020-06-16 | 支付宝(杭州)信息技术有限公司 | Method and device for carrying out feature processing aiming at user classification model |
Family Cites Families (9)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107316198B (en) * | 2016-04-26 | 2020-05-29 | 阿里巴巴集团控股有限公司 | Account risk identification method and device |
| CN108230057A (en) * | 2016-12-09 | 2018-06-29 | 阿里巴巴集团控股有限公司 | A kind of intelligent recommendation method and system |
| CN108229963B (en) * | 2016-12-12 | 2021-07-30 | 创新先进技术有限公司 | Risk identification method and device for user operation behaviors |
| EP3499396A1 (en) * | 2017-12-12 | 2019-06-19 | Institute for Imformation Industry | Abnormal behavior detection model building apparatus and abnormal behavior detection model building method thereof |
| CN110839031B (en) * | 2019-11-15 | 2020-11-10 | 中国人民解放军陆军工程大学 | Malicious user behavior intelligent detection system based on reinforcement learning |
| KR102334388B1 (en) * | 2019-12-16 | 2021-12-01 | 연세대학교 산학협력단 | Method and Apparatus for Action Recognition Using Sequential Feature Data |
| CN111340506A (en) * | 2020-05-22 | 2020-06-26 | 支付宝(杭州)信息技术有限公司 | Method and device for identifying risk of transaction behavior, storage medium and computer equipment |
| CN111681049B (en) * | 2020-06-04 | 2023-08-11 | 广州视源电子科技股份有限公司 | Processing method of user behavior, storage medium and related equipment |
| CN111652451B (en) * | 2020-08-06 | 2020-12-01 | 腾讯科技（深圳）有限公司 | Social relationship obtaining method and device and storage medium |
-
2022
- 2022-03-23 CN CN202210289732.1A patent/CN114707990B/en active Active
Patent Citations (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111291816A (en) * | 2020-02-17 | 2020-06-16 | 支付宝(杭州)信息技术有限公司 | Method and device for carrying out feature processing aiming at user classification model |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114707990A (en) | 2022-07-05 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108428132B (en) | Fraud transaction identification method, device, server and storage medium | |
| US11645515B2 (en) | Automatically determining poisonous attacks on neural networks | |
| CN108596616B (en) | User data authenticity analysis method and device, storage medium and electronic equipment | |
| CN110852755B (en) | User identity identification method and device for transaction scene | |
| AU2021203164A1 (en) | Predictive issue detection | |
| US20200074359A1 (en) | Detecting an issue related to a report | |
| US10067990B1 (en) | System, method, and computer program for identifying significant attributes of records | |
| CN111612037A (en) | Abnormal user detection method, device, medium and electronic equipment | |
| CN113468520A (en) | Data intrusion detection method applied to block chain service and big data server | |
| CN111159241A (en) | Click conversion estimation method and device | |
| JP2021051589A (en) | Information processing apparatus, and information processing method | |
| CN115935265B (en) | Method for training risk identification model, risk identification method and corresponding device | |
| CN116883181B (en) | Financial service pushing method based on user portrait, storage medium and server | |
| CN114707990B (en) | User behavior pattern recognition method and device | |
| CN111274907A (en) | Method and apparatus for determining a category label of a user using a category identification model | |
| CN113409050B (en) | Method and device for judging business risk based on user operation | |
| CN113312457B (en) | Method, computing system, and computer readable medium for problem resolution | |
| CN115438747A (en) | Abnormal account recognition model training method, device, equipment and medium | |
| CN113052604A (en) | Object detection method, device, equipment and storage medium | |
| CN113935034A (en) | Malicious code family classification method and device based on graph neural network and storage medium | |
| CN114978616B (en) | Construction method and device of risk assessment system, and risk assessment method and device | |
| CN114677691B (en) | Text recognition method, device, electronic equipment and storage medium | |
| CN112214387B (en) | Knowledge graph-based user operation behavior prediction method and device | |
| CN112949752B (en) | Training method and device of business prediction system | |
| US20240185090A1 (en) | Assessment of artificial intelligence errors using machine learning |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |