CN115461740A - Behavior control method and device and storage medium - Google Patents
Behavior control method and device and storage medium Download PDFInfo
- Publication number
- CN115461740A CN115461740A CN202080100085.4A CN202080100085A CN115461740A CN 115461740 A CN115461740 A CN 115461740A CN 202080100085 A CN202080100085 A CN 202080100085A CN 115461740 A CN115461740 A CN 115461740A
- Authority
- CN
- China
- Prior art keywords
- behavior
- model
- feature
- sequence
- group
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/31—User authentication
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Theoretical Computer Science (AREA)
- Computer Hardware Design (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Image Analysis (AREA)
Abstract
The embodiment of the application discloses a behavior control method, a behavior control device and a storage medium, wherein the method comprises the following steps: acquiring a behavior feature sequence of the first identity identifier in a preset time period, wherein behavior features in the behavior feature sequence are sorted according to time; performing feature extraction on the behavior feature sequence by using an autoencoder model to obtain a group of feature vectors corresponding to the first identity; inputting a group of feature vectors into a time sequence processing model to obtain a behavior discrimination result corresponding to a behavior feature sequence; and when the target behavior of the first identity mark is received, performing behavior control on the target behavior according to the behavior judgment result.
Description
The embodiment of the application relates to the field of electronic application, in particular to a behavior control method and device and a storage medium.
The existing business safety wind control system is mainly started from business characteristics, users are subdivided according to the business, and relevant rules are formulated to identify black-producing users. Specifically, daily business is subjected to statistical analysis through Hadoop, spark and other big data tools, user characteristics relevant to the business are extracted, a rule base is designed according to business characteristics, the rule base and the user characteristics are used for grading the user, the risk level of the user is set according to a grading result, relevant authority is opened for the user according to the risk level, and therefore certain behaviors of the user are rejected.
The reliability of the black product users identified by the method is high, but a plurality of potential black product users often exist in normal users, and the black product users are difficult to identify by the form of the rule base and the subdivision users, so that the accuracy of behavior control on the black product users is low.
Disclosure of Invention
The embodiment of the application provides a behavior control method and device and a storage medium, which can improve the accuracy of identifying black-yielding users and further improve the accuracy of performing behavior control on the black-yielding users.
The technical scheme of the embodiment of the application is realized as follows:
the embodiment of the application provides a behavior control method, which comprises the following steps:
acquiring a behavior feature sequence of a first identity identifier in a preset time period, wherein behavior features in the behavior feature sequence are sorted according to time;
extracting the characteristics of the behavior characteristic sequence by using a self-encoder model to obtain a group of characteristic vectors corresponding to the first identity;
inputting the group of characteristic vectors into a time sequence processing model to obtain a behavior judgment result corresponding to the behavior characteristic sequence;
and when the target behavior of the first identity mark is received, performing behavior control on the target behavior according to the behavior judgment result.
In the above method, the self-encoder model is a noise reduction self-encoder DAE model, and the performing feature extraction on the behavior feature sequence by using the self-encoder model to obtain a group of feature vectors corresponding to the first identity identifier includes:
inputting the behavior characteristic sequence into the DAE model, and performing characteristic compression on the behavior characteristic sequence by using a coding neural network in the DAE model to obtain a group of intermediate characteristic vectors;
and normalizing the group of intermediate characteristic vectors to obtain the group of characteristic vectors.
In the above method, the time sequence processing model is a long-short term memory LSTM network, and the inputting the set of feature vectors into the time sequence processing model to obtain the behavior discrimination result corresponding to the behavior feature sequence includes:
inputting the group of feature vectors into a stacked LSTM layer of the LSTM network, and outputting the network state of the last layer of LSTM units in the stacked LSTM layer, wherein the stacked LSTM layer is composed of a plurality of layers of LSTM units;
inputting the network state into a full connection layer of the LSTM network to obtain probability values corresponding to the group of feature vectors;
and determining the probability value as the behavior judgment result.
In the above method, before the inputting the behavior feature sequence into the DAE model and performing feature compression on the behavior feature sequence by using a coding neural network in the DAE to obtain a set of intermediate feature vectors, the method further includes:
and carrying out model training on the initial DAE model by utilizing the sample behavior characteristics to obtain the DAE model.
In the above method, the performing model training on the initial DAE model by using the sample behavior characteristics to obtain the DAE model includes:
adding random noise in the sample behavior characteristics to obtain sample input behavior characteristics;
inputting the sample input behavior characteristics into a coding neural network in the initial DAE model to obtain a first sample characteristic vector;
inputting the first sample feature vector into a decoding neural network corresponding to the coding neural network, and outputting a sample output behavior feature;
and performing model training on the initial DAE model by using the sample behavior characteristics and the sample output behavior characteristics to obtain the DAE model.
In the above method, the method further comprises:
respectively acquiring a static feature vector and the behavior feature sequence corresponding to the first identity identifier;
correspondingly, the time sequence processing model is a depth ordering model, and the step of inputting the group of feature vectors into the time sequence processing model to obtain the behavior discrimination result corresponding to the behavior feature sequence includes:
and inputting the static feature vector and the group of feature vectors into the depth ordering model to obtain the behavior discrimination result.
In the above method, the behavior feature includes: operating at least one of an application, an operation type, an operation environment, and a network environment.
An embodiment of the present application provides a behavior control device, the device includes:
the device comprises an acquisition unit, a judgment unit and a processing unit, wherein the acquisition unit is used for acquiring a behavior characteristic sequence of a first identity identifier in a preset time period, and behavior characteristics in the behavior characteristic sequence are sorted according to time;
a feature extraction unit, configured to perform feature extraction on the behavior feature sequence by using a self-encoder model to obtain a set of feature vectors corresponding to the first identity;
the behavior distinguishing unit is used for inputting the group of characteristic vectors into a time sequence processing model to obtain a behavior distinguishing result corresponding to the behavior characteristic sequence;
and the behavior control unit is used for performing behavior control on the target behavior according to the behavior judgment result when the target behavior of the first identity identifier is received.
An embodiment of the present application provides a behavior control device, the device includes: a processor, a memory, and a communication bus, the processor implementing the method as described in any one of the above when executing a running program stored in the memory.
The embodiment of the application provides a computer readable storage medium, on which a program is stored, and the program is applied to a behavior control device, and when the program is executed by a processor, the program realizes the method according to any one of the above.
The embodiment of the application provides a behavior control method, a behavior control device and a storage medium, wherein the method comprises the following steps: acquiring a behavior feature sequence of the first identity identifier in a preset time period, wherein behavior features in the behavior feature sequence are sorted according to time; performing feature extraction on the behavior feature sequence by using a self-encoder model to obtain a group of feature vectors corresponding to the first identity; inputting a group of feature vectors into a time sequence processing model to obtain a behavior discrimination result corresponding to a behavior feature sequence; and when the target behavior of the first identity mark is received, performing behavior control on the target behavior according to the behavior judgment result. Therefore, in the embodiment of the application, the behavior feature sequence in the preset time period is used as input, the self-encoder model is used for performing high-dimensional extraction and enhancement on the behavior feature sequence, behavior judgment can be performed more flexibly according to the behavior feature sequence of the user in a period of time, and then behavior control is performed on the user according to the judgment result, so that the identification accuracy is greatly improved, and the accuracy of behavior control on the black-producing user is further improved.
FIG. 1 is a schematic structural diagram of a system for implementing business safety risk based on an AI model in the prior art;
fig. 2 is a first flowchart of a behavior control method according to an embodiment of the present disclosure;
fig. 3 is a second flowchart of a behavior control method according to an embodiment of the present application;
FIG. 4 is a schematic structural diagram of an exemplary DAE model provided by an embodiment of the present application;
fig. 5 is a schematic structural diagram of an exemplary LSTM network provided in an embodiment of the present application;
fig. 6 is a first schematic structural diagram of a behavior control device according to an embodiment of the present application;
fig. 7 is a schematic structural diagram of a behavior control device according to an embodiment of the present application.
The existing business safety wind control based on a rule base and pre-divided risk levels of users has the following problems:
(1) Different rules need to be formulated according to different service scenes and wind control targets and by combining with related expert experiences according to service characteristics, the problem of high specifying and updating cost exists in the formulation of the rules, the subjectivity is strong, and the cross cooperativity among the rules is weak;
(2) Along with the deepening of the service, the system becomes more and more huge, so that the false interception rate is increased;
(3) The established expert rules are strongly related to the cheating means of the black-producing users, have strong interpretability, and the examined characteristic correlation is strong, so the black-producing users can guess and avoid the existing business safety wind control system by analyzing the false flow attack effect of the black-producing users.
In order to solve the above problems, a method for performing business safety air control modeling by using an Artificial Intelligence (AI) model is also proposed to perform business safety air control, as shown in fig. 1, the model is composed of a data storage system, a computing cluster, a rule engine, a management platform and a rule base, wherein the data storage system is composed of a relational database and a non-relational database; the computing cluster consists of an offline computing cluster and an online cluster, the real-time computing cluster is used for online computing, and the offline computing cluster is used for periodically executing tasks; the rule engine generates rules through the rule base, so that the rule matching is optimized, and the efficiency of the real-time wind control system is improved; the management platform consists of a rule configuration module and a rule evaluation module, and the rule evaluation module based on indexes and models can ensure that the effectiveness of the wind control rules is tracked in real time. The transaction data, the equipment portrait and the log data are input into the AI model, and then the user identification result can be output.
The AI model realizes the business safety wind control and has the following problems:
(1) The user traffic data is massive, and especially for the traffic type data, the characteristic dimension is low, and the problem of difficult marking exists. Therefore, a complete supervised algorithm cannot be used alone for safe wind control modeling;
(2) In the process of carrying out characteristic engineering and model training, a large amount of noise exists in an original data set, the noise can bring great negative influence on the accuracy of a model, and the cost and difficulty of modeling are greatly improved by adopting manual denoising;
(3) In the false flow detection process, only the important behaviors (such as downloading, clicking, paying and the like) concerned by the relation service cause low accuracy of the judgment result.
In order to solve the above problems, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. It is to be understood that the specific embodiments described herein are merely illustrative of the relevant application and are not limiting of the application. It should be further noted that, for the convenience of description, only the portions relevant to the related applications are shown in the drawings.
The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application.
In an embodiment, an embodiment of the present application provides a behavior control method, and fig. 2 is a schematic implementation flow diagram of the behavior control method provided in the embodiment of the present application, where the method may include:
s101, acquiring a behavior feature sequence of the first identity identifier in a preset time period, and sequencing behavior features in the behavior feature sequence according to time.
In the embodiment of the present application, each time a user generates an operation behavior, the behavior control device records a behavior characteristic corresponding to the operation behavior, including: at least one of the operation application, the operation type, the operation environment, and the network environment, it should be noted that the behavior characteristics are not limited to the above, and may also include the time from the last operation, and the like, which are specifically selected and added according to the actual situation, and the embodiment of the present application is not specifically limited. The behavior features described above constitute a one-time user behavior.
In this embodiment of the present Application, the operation Application may include an Application (APP) name and an APP type, where the APP type may include: instant messaging, shopping, video viewing, and the like.
In the embodiment of the present application, the operation types may include: download, search, click, comment, etc.
In this embodiment, the operating environment may include: a current operation page, a last operation page, an out-link source, etc.
In this embodiment of the application, the first Identity identifier may be user Identity Identifier (ID) information.
In this embodiment of the application, the behavior control device sorts all behavior characteristics of the first identity within a preset time period according to a time sequence to obtain a behavior characteristic sequence of the first identity within the preset time period.
In the embodiment of the present application, the preset time period may be one day, one week, and the like, and is specifically selected according to an actual situation, and the embodiment of the present application is not specifically limited.
Further, the behavior control device may also perform behavior discrimination on the first identity identifier by using the static feature vector and the behavior feature sequence corresponding to the first identity identifier at the same time, and at this time, the behavior control device obtains the static feature vector and the behavior feature sequence corresponding to the first identity identifier respectively.
In this embodiment, the static feature vector corresponding to the first identity identifier may be a feature vector used to represent features that are not easily changed, such as an image feature.
S102, extracting the characteristics of the behavior characteristic sequence by using the self-encoder model to obtain a group of characteristic vectors corresponding to the first identity.
The behavior control device trains a self-encoder model in advance, and after the behavior control device obtains a behavior characteristic sequence of the first identity in a preset time period, the behavior control device performs characteristic extraction on the behavior characteristic sequence by using the self-encoder model to obtain a group of characteristic vectors corresponding to the first identity.
In the embodiment of the application, the behavior control device inputs the behavior feature sequence into the self-encoder model for feature extraction, and outputs a group of feature vectors corresponding to the first identity.
In the embodiment of the present application, the self-Encoder model is a noise reduction Auto Encoder (DAE) model.
In the embodiment of the application, the DAE model includes an encoder and a decoder, where the encoder is composed of a coding neural network, the decoder is composed of a decoding neural network corresponding to the coding neural network, the coding neural network may be a double-layer neural network or a three-layer neural network, and the like.
In the embodiment of the application, the behavior control device inputs the behavior feature sequence into the DAE model, and performs feature compression on the behavior feature sequence by using a coding neural network in the DAE model to obtain a group of intermediate feature vectors, so that a process of performing feature extraction on the initial behavior feature sequence is realized, and then, the behavior control device normalizes the group of intermediate feature vectors to obtain a group of feature vectors.
In the embodiment of the application, the behavior control device inputs a group of intermediate characteristic vectors into a Batch Normalization (BN) layer to perform Batch Normalization, the BN layer is used for normalizing the group of intermediate characteristic vectors, the data distribution can be kept, the values can be normalized, the generalization capability of a network is further increased, gradient extinction and explosion are avoided simultaneously, and the training efficiency is improved.
In practical applications, the BN layer is added to the DAE model, and as part of the intermediate hidden layer processing logic, the learning process for data distribution is also implemented during the training process of the DAE.
Further, based on the first embodiment, in the embodiment of the present application, before the behavior control device inputs the behavior feature sequence into the DAE model and performs feature compression on the behavior feature sequence by using a coding neural network in the DAE model to obtain a set of intermediate feature vectors, the behavior control device further performs model training on the initial DAE model by using the sample behavior features to obtain the DAE model, as shown in fig. 3, which may specifically include the following steps:
s201, adding random noise in the sample behavior characteristics by the behavior control device to obtain sample input behavior characteristics.
In the embodiment of the application, the behavior control device acquires sample behavior characteristics, wherein the behavior control device can acquire local historical behavior characteristics as the sample behavior characteristics, or acquire historical behavior characteristics of a user from other equipment on line, and specifically selects the historical behavior characteristics according to actual conditions, and the embodiment of the application is not specifically limited.
In the embodiment of the application, the behavior control device inputs the sample behavior characteristics into the input layer, and randomly shields some input layer nodes, so that random noise is added into the sample behavior characteristics, the obtained sample input behavior characteristics are the behavior characteristics containing certain noise, the conditions that partial fields of data of the behavior characteristics are lost and incomplete in a real scene are simulated, the generalization performance and robustness of the DAE model can be enhanced by training the DAE model by using the sample input behavior characteristics, and the interference of the input noise is removed.
S202, the behavior control device inputs the sample input behavior features into a coding neural network in the initial DAE model to obtain a first sample feature vector.
In the embodiment of the application, the initial DAE model comprises a coding neural network and a decoding neural network which is symmetrical to the coding neural network, and the behavior control device inputs the sample into the coding neural network of the initial DAE model for feature compression to obtain a compressed first sample feature vector of the hidden layer.
And S203, the behavior control device inputs the first sample characteristic vector into a decoding neural network corresponding to the coding neural network and outputs the sample output behavior characteristic.
In the embodiment of the application, the behavior control device inputs the first sample feature vector into a decoding neural network corresponding to the coding neural network, performs decoding reduction, and outputs the sample output behavior feature.
And S204, the behavior control device performs model training on the DAE model by using the sample behavior characteristics and the sample output behavior characteristics to obtain the DAE model.
In the embodiment of the application, the behavior control device enables the initial DAE model to be converged by minimizing the root mean square error between the sample behavior characteristics and the sample output behavior characteristics, so that the behavior control device completes the process of performing model training on the initial DAE model by using the sample behavior characteristics and the sample output behavior characteristics, and the trained initial DAE model is the DAE model.
Illustratively, as shown in fig. 4, the DAE model includes an encoder and a decoder, and the sample behavior feature X is added with random noise and then input into the encoder to obtain a sample behavior feature Z, and then input into the decoder to obtain a sample behavior feature X ', and the DAE model converges the DAE model by minimizing the root mean square error between X and X'.
S103, inputting the group of feature vectors into a time sequence processing model to obtain a behavior distinguishing result corresponding to the behavior feature sequence.
The behavior control device also trains a time sequence processing model in advance, and after the behavior control device obtains a group of characteristic vectors corresponding to the first identity, the behavior control device inputs the group of characteristic vectors into the time sequence processing model to obtain a behavior distinguishing result corresponding to the behavior characteristic sequence.
In the embodiment of the present application, the timing processing model may be a Long Short-Term Memory (LSTM) network.
In the embodiment of the application, the LSTM network comprises a stacked LSTM layer and a full connection layer, after the BN layer outputs a group of feature vectors, the group of feature vectors are input into the stacked LSTM layer of the LSTM network, and the network state of the last layer of LSTM units in the stacked LSTM layer is output, wherein the stacked LSTM layer is composed of a plurality of layers of LSTM units; then, inputting the network state into a full connection layer of the LSTM network to obtain probability values corresponding to a group of feature vectors, specifically, the full connection layer consists of a dense layer and an activation function sigmod, inputting the network state into the dense layer and the sigmod in sequence, and outputting the probability values corresponding to the group of feature vectors; and determining the probability value as a behavior judgment result.
Fig. 5 is a schematic structural diagram of an LSTM network, the LSTM network is composed of a stacked LSTM layer and a fully connected layer, wherein the stacked LSTM layer is composed of n layers of LSTM units, each layer of LSTM unit calls a cell _ init method, the fully connected layer is composed of a dense layer and a sigmod, in fig. 5, X1, X2, …, xt are behavior feature sequences, after an encoder and a BN layer, a group of feature vectors Z1, Z2, …, zt are obtained, Z1, Z2, …, zt are input into the LSTM layer, after learning of the multiple layers of LSTM _ cell units, and after a dense operation, a network state 0t of an LSTM _ cell (cell) of the nth layer is used as an output, and after the dense operation, an activation function sigmod is input, and a classification probability value of 0-1 is generated. Wherein 0 represents a normal user and 1 represents a black user.
In the embodiment of the application, the cross entropy minimization is adopted as a loss function to carry out model optimization on the LTSM network.
In the embodiment of the application, in order to perform behavior discrimination operation by using the static feature vector and the behavior feature sequence of the first identity identifier at the same time, the time sequence processing model may also be a depth ordering model, where the depth ordering model includes a wide & deep model, a deep fm model, and the like, and the deep model is an LTSM network. And inputting the static feature vectors and a group of feature vectors into the depth ordering model to obtain a behavior discrimination result.
In an optional embodiment, for the wide & deep model, the static feature vector is input into the wide model, the behavior feature sequence is input into the deep model, and the behavior discrimination result is output.
In another alternative embodiment, for the deep FM model, the static feature vector is input into the FM model, the behavior feature sequence is input into the deep model, and the behavior discrimination criterion is output.
And S104, when the target behavior of the first identity mark is received, performing behavior control on the target behavior according to a behavior judgment result.
After the behavior control device obtains the behavior discrimination result corresponding to the behavior feature sequence, the behavior control device may determine whether the first identity identifier is a black user according to the behavior discrimination result, and when the behavior control device receives the target behavior of the first identity identifier again, the behavior control device performs corresponding behavior control on the target behavior according to the behavior discrimination result.
In the embodiment of the application, when the first identity identifier is determined to be a black user according to the behavior discrimination result, some behaviors of the first identity identifier need to be limited, specifically, when a target behavior of the first identity identifier is received next time, the type of the target behavior is determined, and when the type of the target behavior meets the limitation behavior type, the target behavior is limited; the restricted action type may include actions of drawing, exposing, browsing, and the like, which are specifically selected according to actual situations, and the embodiment of the present application is not specifically limited.
Furthermore, the self-encoder model and the time sequence processing model can be used as basic models, and further combined with semi-supervised algorithm frameworks such as a Positive sample and Unlabeled (PU) learning algorithm and a Teacher-Student network architecture, the wind control scene suitable for large flow and few marks is realized.
The behavior characteristic sequence in the preset time period is used as input, the self-encoder model is used for performing high-dimensional extraction and enhancement on the behavior characteristic sequence, behavior judgment can be performed more flexibly according to the behavior characteristic sequence of the user in a period of time, and then behavior control is performed on the user according to a judgment result, so that the identification accuracy is greatly improved, and the accuracy of behavior control on the black-producing user is improved.
Based on the foregoing embodiment, in another embodiment of the present application, fig. 6 is a schematic structural diagram of a component of a behavior control device according to an embodiment of the present application, and as shown in fig. 6, a behavior control device 1 according to an embodiment of the present application may include:
the acquiring unit 10 is configured to acquire a behavior feature sequence of the first identity identifier within a preset time period, where behavior features in the behavior feature sequence are sorted according to time;
a feature extraction unit 11, configured to perform feature extraction on the behavior feature sequence by using a self-encoder model to obtain a group of feature vectors corresponding to the first identity;
a behavior discrimination unit 12, configured to input the group of feature vectors into a time sequence processing model to obtain a behavior discrimination result corresponding to the behavior feature sequence;
and the behavior control unit 13 is configured to perform behavior control on the target behavior according to the behavior determination result when the target behavior of the first identity is received.
Further, the self-encoder model is a noise reduction self-encoder DAE model, and the apparatus further includes: a feature compression unit and a normalization unit;
the characteristic compression unit is used for inputting the behavior characteristic sequence into the DAE model and performing characteristic compression on the behavior characteristic sequence by using a coding neural network in the DAE model to obtain a group of intermediate characteristic vectors;
the normalization unit is configured to normalize the group of intermediate feature vectors to obtain the group of feature vectors.
Further, the time sequence processing model is a long-short term memory (LSTM) network,
the behavior discrimination unit 12 is specifically configured to input the group of feature vectors into a stacked LSTM layer of the LSTM network, and output a network state of a last layer of LSTM units in the stacked LSTM layer, where the stacked LSTM layer is composed of multiple layers of LSTM units; inputting the network state into a full-connection layer of the LSTM network to obtain probability values corresponding to the group of feature vectors; and determining the probability value as the behavior judgment result.
Further, the apparatus further comprises: a model training unit;
and the model training unit is used for performing model training on the initial DAE model by using the sample behavior characteristics to obtain the DAE model.
Further, the model training unit is specifically configured to add random noise to the sample behavior feature to obtain a sample input behavior feature; inputting the sample input behavior characteristics into a coding neural network in the initial DAE model to obtain a first sample characteristic vector; inputting the first sample feature vector into a decoding neural network corresponding to the coding neural network, and outputting a sample output behavior feature; and performing model training on the initial DAE model by using the sample behavior characteristics and the sample output behavior characteristics to obtain the DAE model.
Further, the obtaining unit 10 is further configured to obtain a static feature vector and the behavior feature sequence corresponding to the first identity identifier, respectively;
the behavior discrimination unit 12 is further configured to input the static feature vector and the group of feature vectors into the depth ordering model to obtain the behavior discrimination result.
Further, the behavior features include: operating at least one of an application, an operation type, an operation environment, and a network environment.
Fig. 7 is a schematic diagram of a second composition structure of the behavior control device according to the embodiment of the present disclosure, and as shown in fig. 7, the behavior control device 1 according to the embodiment of the present disclosure may further include a processor 110, a memory 111, and a communication bus 112.
In the process of a Specific embodiment, the obtaining Unit 10, the feature extracting Unit 11, the behavior determining Unit 12, the behavior controlling Unit 13, the feature compressing Unit, the normalizing Unit and the model training Unit may be implemented by a Processor 110 located on the behavior controlling Device 1, and in an embodiment of the present Application, the Processor 110 may be at least one of an Application Specific Integrated Circuit (ASIC), a Digital Signal Processor (DSP), a Digital Signal Processing Device (DSPD), a ProgRAMmable Logic Device (PLD), a Field ProgRAMmable Gate Array (FPGA), a Central Processing Unit (CPU), a controller, a microcontroller and a microprocessor. It is understood that the electronic device for implementing the above processor function may be other electronic devices, and the embodiments of the present application are not limited in particular. The memory 111 is used to store executable program code comprising computer operating instructions, and the memory 111 may comprise a high speed RAM memory and may also comprise a non-volatile memory, such as at least two disk memories.
In the embodiment of the present application, the communication bus 112 is used for connecting the processor 110, the memory 111 and the intercommunication among these devices.
In an embodiment of the present application, the memory 111 is used for storing instructions and data.
A processor 110, configured to obtain a behavior feature sequence of the first identity identifier within a preset time period, where behavior features in the behavior feature sequence are sorted according to time; extracting the characteristics of the behavior characteristic sequence by using a self-encoder model to obtain a group of characteristic vectors corresponding to the first identity; inputting the group of feature vectors into a time sequence processing model to obtain a behavior discrimination result corresponding to the behavior feature sequence; and when the target behavior of the first identity mark is received, performing behavior control on the target behavior according to the behavior judgment result.
Further, in an embodiment of the present application, the self-encoder model is a noise reduction self-encoder DAE model, and the processor 110 is further configured to input the behavior feature sequence into the DAE model, and perform feature compression on the behavior feature sequence by using a coding neural network in the DAE model to obtain a set of intermediate feature vectors; and normalizing the group of intermediate feature vectors to obtain the group of feature vectors.
Further, in an embodiment of the present application, the time-series processing model is a long-short term memory LSTM network, and the processor 110 is further configured to input the set of feature vectors into a stacked LSTM layer of the LSTM network, and output a network state of a last LSTM unit in the stacked LSTM layer, where the stacked LSTM layer is composed of multiple layers of LSTM units; inputting the network state into a full-connection layer of the LSTM network to obtain probability values corresponding to the group of feature vectors; and determining the probability value as the behavior judgment result.
Further, in an embodiment of the present application, the processor 110 is further configured to perform model training on the initial DAE model by using the sample behavior characteristics, so as to obtain the DAE model.
Further, in an embodiment of the present application, the processor 110 is further configured to add random noise to the sample behavior feature to obtain a sample input behavior feature; inputting the sample input behavior characteristics into a coding neural network in the initial DAE model to obtain a first sample characteristic vector; inputting the first sample feature vector into a decoding neural network corresponding to the coding neural network, and outputting a sample output behavior feature; and performing model training on the initial DAE model by using the sample behavior characteristics and the sample output behavior characteristics to obtain the DAE model.
Further, in an embodiment of the present application, the time sequence processing model is a depth ordering model, and the processor 110 is further configured to obtain a static feature vector and the behavior feature sequence corresponding to the first identity identifier respectively; and inputting the static feature vector and the group of feature vectors into the depth ordering model to obtain the behavior discrimination result.
Further, the behavior features include: operating at least one of an application, an operation type, an operation environment, and a network environment.
In practical applications, the Memory 111 may be a volatile first Memory (volatile Memory), such as a Random-Access Memory (RAM); or a non-volatile first Memory (non-volatile Memory), such as a Read-Only Memory (ROM), a flash Memory (flash Memory), a Hard Disk Drive (HDD) or a Solid-State Drive (SSD); or a combination of first memory of the above sort and provides instructions and data to the processor 110.
In addition, each functional module in this embodiment may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware or a form of a software functional module.
Based on the understanding that the technical solutions of the present embodiment substantially or partially contribute to the prior art, or all or part of the technical solutions may be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling a computer device (which may be a personal computer, a server, or a network device, etc.) or a processor (processor) to execute all or part of the steps of the method of the present embodiment. And the aforementioned storage medium includes: various media capable of storing program codes, such as a usb disk, a removable hard disk, a Read Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk, or an optical disk.
The behavior control method, the behavior control device and the storage medium provided by the embodiment of the application acquire a behavior feature sequence of a first identity within a preset time period, wherein behavior features in the behavior feature sequence are sorted according to time; performing feature extraction on the behavior feature sequence by using a self-encoder model to obtain a group of feature vectors corresponding to the first identity; inputting a group of feature vectors into a time sequence processing model to obtain a behavior discrimination result corresponding to a behavior feature sequence; and when the target behavior of the first identity mark is received, performing behavior control on the target behavior according to the behavior judgment result. Therefore, in the embodiment of the application, the behavior feature sequence in the preset time period is used as input, the self-encoder model is used for performing high-dimensional extraction and enhancement on the behavior feature sequence, behavior judgment can be performed more flexibly according to the behavior feature sequence of the user in a period of time, and then behavior control is performed on the user according to the judgment result, so that the identification accuracy is greatly improved, and the accuracy of behavior control on the black-producing user is further improved.
Embodiments of the present application provide a computer-readable storage medium, on which a program is stored, which when executed by a processor implements the method as described above.
Specifically, the program instructions corresponding to a behavior control method in this embodiment may be stored in a storage medium such as an optical disc, a hard disc, or a usb disk, and when the program instructions corresponding to a behavior control method in the storage medium are read or executed by an electronic device, the method described in any of the above embodiments is implemented.
As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of a hardware embodiment, a software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, optical storage, and the like) having computer-usable program code embodied therein.
The present application is described with reference to flowchart illustrations and/or block diagrams of implementations of methods, apparatus (systems) and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart block or blocks and/or flowchart block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart block or blocks for implementing the flowchart block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks in the flowchart and/or block diagram block or blocks.
The above description is only a preferred embodiment of the present application, and is not intended to limit the scope of the present application.
The embodiment of the application provides a behavior control method, a behavior control device and a storage medium, wherein a behavior characteristic sequence in a preset time period is used as input, a self-encoder model is used for performing high-dimensional extraction and enhancement on the behavior characteristic sequence, behavior judgment can be performed more flexibly according to the behavior characteristic sequence of a user in a period of time, and then the user is subjected to behavior control according to a judgment result, so that the identification accuracy is greatly improved, and the accuracy of behavior control on a black product user is further improved.
Claims (10)
- A method of behavior control, the method comprising:acquiring a behavior feature sequence of a first identity identifier in a preset time period, wherein behavior features in the behavior feature sequence are sorted according to time;extracting the characteristics of the behavior characteristic sequence by using a self-encoder model to obtain a group of characteristic vectors corresponding to the first identity;inputting the group of feature vectors into a time sequence processing model to obtain a behavior discrimination result corresponding to the behavior feature sequence;and when the target behavior of the first identity mark is received, performing behavior control on the target behavior according to the behavior judgment result.
- The method as claimed in claim 1, wherein the self-encoder model is a de-noising self-encoder DAE model, and the performing feature extraction on the behavior feature sequence by using the self-encoder model to obtain a set of feature vectors corresponding to the first identity identifier comprises:inputting the behavior characteristic sequence into the DAE model, and performing characteristic compression on the behavior characteristic sequence by using a coding neural network in the DAE model to obtain a group of intermediate characteristic vectors;and normalizing the group of intermediate feature vectors to obtain the group of feature vectors.
- The method of claim 1, wherein the time-series processing model is a Long Short Term Memory (LSTM) network, and the inputting the set of feature vectors into the time-series processing model to obtain the behavior discrimination result corresponding to the behavior feature sequence comprises:inputting the group of feature vectors into a stacked LSTM layer of the LSTM network, and outputting the network state of the last layer of LSTM units in the stacked LSTM layer, wherein the stacked LSTM layer is composed of a plurality of layers of LSTM units;inputting the network state into a full-connection layer of the LSTM network to obtain probability values corresponding to the group of feature vectors;and determining the probability value as the behavior judgment result.
- The method of claim 2, wherein before inputting the behavior feature sequence into the DAE model and feature compressing the behavior feature sequence using a neural network encoded in the DAE to obtain a set of intermediate feature vectors, the method further comprises:and carrying out model training on the initial DAE model by utilizing the sample behavior characteristics to obtain the DAE model.
- The method of claim 4, wherein the model training of the initial DAE model using the sample behavior features to obtain the DAE model comprises:adding random noise in the sample behavior characteristics to obtain sample input behavior characteristics;inputting the sample input behavior characteristics into a coding neural network in the initial DAE model to obtain a first sample characteristic vector;inputting the first sample feature vector into a decoding neural network corresponding to the coding neural network, and outputting a sample output behavior feature;and performing model training on the initial DAE model by using the sample behavior characteristics and the sample output behavior characteristics to obtain the DAE model.
- The method of claim 1, wherein the method further comprises:respectively acquiring a static feature vector and the behavior feature sequence corresponding to the first identity identifier;correspondingly, the time sequence processing model is a depth ordering model, and the step of inputting the group of feature vectors into the time sequence processing model to obtain the behavior discrimination result corresponding to the behavior feature sequence includes:and inputting the static feature vector and the group of feature vectors into the depth ordering model to obtain the behavior discrimination result.
- The method of any of claims 1-6, wherein the behavioral characteristics include: operating at least one of an application, an operation type, an operation environment, and a network environment.
- A behavior control device, the device comprising:the device comprises an acquisition unit, a judgment unit and a processing unit, wherein the acquisition unit is used for acquiring a behavior characteristic sequence of a first identity identifier in a preset time period, and behavior characteristics in the behavior characteristic sequence are sorted according to time;the characteristic extraction unit is used for extracting the characteristics of the behavior characteristic sequence by utilizing a self-encoder model to obtain a group of characteristic vectors corresponding to the first identity;the behavior distinguishing unit is used for inputting the group of characteristic vectors into a time sequence processing model to obtain a behavior distinguishing result corresponding to the behavior characteristic sequence;and the behavior control unit is used for performing behavior control on the target behavior according to the behavior judgment result when the target behavior of the first identity identifier is received.
- A behavior control device, the device comprising: a processor, a memory, and a communication bus, the processor implementing the method of any one of claims 1-7 when executing a running program stored in the memory.
- A computer-readable storage medium, having stored thereon a program for use in a behavior control apparatus, the program, when executed by a processor, implementing the method according to any one of claims 1-7.
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| PCT/CN2020/093853 WO2021243534A1 (en) | 2020-06-02 | 2020-06-02 | Behavior control method and apparatus and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN115461740A true CN115461740A (en) | 2022-12-09 |
Family
ID=78829996
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202080100085.4A Pending CN115461740A (en) | 2020-06-02 | 2020-06-02 | Behavior control method and device and storage medium |
Country Status (2)
| Country | Link |
|---|---|
| CN (1) | CN115461740A (en) |
| WO (1) | WO2021243534A1 (en) |
Families Citing this family (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN115001843A (en) * | 2022-06-24 | 2022-09-02 | 咪咕文化科技有限公司 | Identity verification method and device, electronic equipment and computer readable storage medium |
Family Cites Families (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN103530540B (en) * | 2013-09-27 | 2017-02-22 | 西安交通大学 | User identity attribute detection method based on man-machine interaction behavior characteristics |
| US20200125394A1 (en) * | 2018-10-17 | 2020-04-23 | The Boston Consulting Group, Inc. | Data analytics platform |
| CN110096499B (en) * | 2019-04-10 | 2021-08-10 | 华南理工大学 | User object identification method and system based on behavior time series big data |
| CN110290466B (en) * | 2019-06-14 | 2021-07-09 | 中国移动通信集团黑龙江有限公司 | Floor distinguishing method, device, equipment and computer storage medium |
| CN110807180A (en) * | 2019-10-28 | 2020-02-18 | 支付宝(杭州)信息技术有限公司 | Method and device for safety certification and training safety certification model and electronic equipment |
-
2020
- 2020-06-02 WO PCT/CN2020/093853 patent/WO2021243534A1/en active Application Filing
- 2020-06-02 CN CN202080100085.4A patent/CN115461740A/en active Pending
Also Published As
| Publication number | Publication date |
|---|---|
| WO2021243534A1 (en) | 2021-12-09 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108737406B (en) | Method and system for detecting abnormal flow data | |
| CN110263538B (en) | Malicious code detection method based on system behavior sequence | |
| CN111143838B (en) | Database user abnormal behavior detection method | |
| CN113011889B (en) | Account anomaly identification method, system, device, equipment and medium | |
| CN112329816A (en) | Data classification method and device, electronic equipment and readable storage medium | |
| CN113297393A (en) | Situation awareness and big data based information generation method and information security system | |
| CN113591924A (en) | Phishing number detection method, system, storage medium and terminal equipment | |
| CN113553577B (en) | Unknown user malicious behavior detection method and system based on hypersphere variational automatic encoder | |
| CN117992953A (en) | Abnormal user behavior identification method based on operation behavior tracking | |
| CN115461740A (en) | Behavior control method and device and storage medium | |
| CN112738098A (en) | Anomaly detection method and device based on network behavior data | |
| CN113869431B (en) | False information detection method, system, computer equipment and readable storage medium | |
| CN113259369B (en) | Data set authentication method and system based on machine learning member inference attack | |
| CN115758337A (en) | Back door real-time monitoring method based on timing diagram convolutional network, electronic equipment and medium | |
| CN113469816A (en) | Digital currency identification method, system and storage medium based on multigroup technology | |
| CN113518058B (en) | Abnormal login behavior detection method and device, storage medium and computer equipment | |
| CN112905987B (en) | Account identification method, device, server and storage medium | |
| Punjabi et al. | Forensic Intelligence-Combining Artificial Intelligence with Digital Forensics | |
| CN114528908A (en) | Network request data classification model training method, classification method and storage medium | |
| CN112950222A (en) | Resource processing abnormity detection method and device, electronic equipment and storage medium | |
| CN110990876A (en) | Database sensitivity correlation attribute desensitization method based on invariant random response technology | |
| CN111104963A (en) | Target user determination method and device, storage medium and electronic equipment | |
| Sun et al. | Neural Network Semantic Backdoor Detection and Mitigation: A Causality-Based Approach | |
| CN116383883B (en) | Big data-based data management authority processing method and system | |
| Stava | A Comparative study of model performance on multiple systems for real-time object detection. |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |