CN115700787A - Abnormal object identification method and device, electronic equipment and storage medium - Google Patents

Abstract

The present application discloses a method, device, electronic equipment, and storage medium for identifying an abnormal object. The method includes: obtaining first information and second information of at least one target object; the first information is operation behavior information, and the The second information is activity participation information; obtain sample data based on the first information and second information of the at least one target object; use the sample data to train the recognition model to be trained to obtain the recognition model; based on the at least one The first information of the target object, the second information and the identification model determine an abnormal object in the at least one target object. This application can use user behavior characteristic information to fully mine user behavior characteristics, identify abnormal users among website users based on user operation behavior information, activity participation information and other data in the website, and solve various business scenarios of various websites Issues such as cash-out evasion, CP self-consumption, and marketing activity audits.

Description

A method, device, electronic device, and storage medium for identifying abnormal objects

technical field

The embodiments of the present application relate to the field of computer technology, and in particular, to a method, device, electronic device, and storage medium for identifying abnormal objects.

Background technique

With the continuous development of personal computer (PC, Personal Computer) and mobile terminal services, and the continuous expansion of the user scale, from partner promotion monitoring to activity auditing to operation analysis, it is necessary to sort, clean, and filter abnormal data on the website. The demand is becoming more and more urgent. In some cases, there may be a large number of abnormal users such as channel arbitrage users, consumer product (CP, Consumer Products) self-consumption users, and marketing users on the website. , business income, etc. have a negative impact, therefore, it is necessary to provide an effective method to identify the above-mentioned abnormal users.

Contents of the invention

In order to solve the above technical problems, embodiments of the present application provide a method, device, electronic device, and storage medium for identifying abnormal objects.

An embodiment of the present application provides a method for identifying an abnormal object, the method including:

Obtain first information and second information of at least one target object; the first information is operational behavior information, and the second information is activity participation information;

obtaining sample data based on the first information and second information of the at least one target object;

Using the sample data to train the recognition model to be trained to obtain the recognition model;

An abnormal object in the at least one target object is determined based on the first information, the second information of the at least one target object, and the recognition model.

In an optional implementation manner of the present application, the sample data includes positive sample data and negative sample data;

The obtaining sample data based on the first information and second information of the at least one target object includes:

constructing an input information table based on the first information and the second information of the at least one target object;

matching a plurality of abnormal feature information based on the input information table as positive sample data in the sample data;

Matching a plurality of normal feature information as negative sample data in the sample data based on the input information table.

In an optional implementation manner of the present application, the determining the abnormal object in the at least one target object based on the first information, the second information and the identification model of the at least one target object includes:

The input information table is input into the recognition model, and the abnormal objects in the at least one target object are determined by using the recognition model.

In an optional implementation manner of the present application, the sample data includes a plurality of feature indicators, and using the sample data to train the recognition model to be trained includes:

Determining the correlation between each of the feature indexes in the plurality of feature indexes, and determining at least one important index in the plurality of feature indexes based on the correlation;

The identification model to be trained is trained by using the sample data corresponding to the at least one important indicator in the sample data.

In an optional implementation manner of the present application, the recognition model to be trained includes a gradient boosting decision tree GBDT model, and the recognition model to be trained is trained using the sample data to obtain the recognition model, including:

Dividing the sample data according to operational behavior characteristics and activity participation characteristics to obtain an operational behavior characteristic set and an activity participation characteristic set;

Respectively establishing a first GBDT model corresponding to the operating behavior characteristics and a second GBDT model corresponding to the activity participation characteristics;

Traverse the first GBDT model by using the operation behavior feature set to obtain the first feature output by the leaf node of the first GBDT model;

The second GBDT model is traversed by using the activity participation feature set to obtain second features output by the leaf nodes of the second GBDT model.

In an optional implementation manner of the present application, the recognition model to be trained also includes a logistic regression LR model, and the training of the recognition model to be trained by using the sample data to obtain the recognition model further includes:

The LR model is trained by using the first feature and the second feature to obtain a trained LR model; the output of the LR model includes the identification information of the training object included in the sample data and the training The type ID of the object.

In an optional implementation manner of the present application, using the sample data to train the recognition model to be trained to obtain the recognition model includes:

Based on the sample data, the recognition model to be trained is trained using the K-fold crossover method to obtain K target recognition models with different parameters;

The target recognition model with the largest harmonic mean value among the K target recognition models with different parameters is selected as the recognition model.

In an optional implementation manner of the present application, using the sample data to train the recognition model to be trained, after obtaining the recognition model, the method further includes:

Using test sample data to test the recognition model, determine whether the indicators of the recognition model meet preset conditions; and/or, determine the recognition of the recognition model based on the third information of each object in the at least one target object whether the result is correct;

If the index of the recognition model does not meet the preset condition, and/or, the recognition result of the recognition model is incorrect, continue to optimize the recognition model to obtain an optimized recognition model;

The determining the abnormal object in the at least one target object based on the first information, the second information and the identification model of the at least one target object includes:

Abnormal objects in the at least one target object are determined based on the first information, the second information of the at least one target object, and the optimized identification model.

The embodiment of the present application also provides an abnormal object identification device, the device includes:

A first obtaining unit, configured to obtain first information and second information of at least one target object; the first information is operation behavior information, and the second information is activity participation information;

a second obtaining unit, configured to obtain sample data based on the first information and second information of the at least one target object;

A training unit, configured to use the sample data to train a recognition model to be trained to obtain a recognition model;

A determining unit, configured to determine an abnormal object in the at least one target object based on the first information, the second information, and the recognition model of the at least one target object.

In an optional implementation manner of the present application, the sample data includes positive sample data and negative sample data; the second obtaining unit is specifically configured to: construct an input based on the first information and second information of the at least one target object An information table; matching a plurality of abnormal feature information as positive sample data in the sample data based on the input information table; matching a plurality of normal feature information as negative sample data in the sample data based on the input information table.

In an optional implementation manner of the present application, the determining unit is specifically configured to: input the input information table into the recognition model, and use the recognition model to determine abnormal objects in the at least one target object.

In an optional implementation manner of the present application, the sample data includes a plurality of characteristic indexes, and the training unit is specifically configured to: determine the correlation among the characteristic indexes in the plurality of characteristic indexes, and based on the correlation Determining at least one important indicator among the plurality of characteristic indicators; using the sample data corresponding to the at least one important indicator in the sample data to train the recognition model to be trained.

In an optional implementation manner of the present application, the recognition model to be trained includes a gradient boosting decision tree GBDT model, and the training unit is specifically used to: divide the sample data according to the characteristics of operation behavior and activity participation, and obtain An operation behavior feature set and an activity participation feature set; respectively establish a first GBDT model corresponding to the operation behavior feature and a second GBDT model corresponding to the activity participation feature; use the operation behavior feature set to traverse the first A GBDT model, obtaining a first feature output by a leaf node of the first GBDT model; traversing the second GBDT model by using the activity participation feature set to obtain a second feature output by a leaf node of the second GBDT model.

In an optional implementation manner of the present application, the recognition model to be trained further includes a logistic regression LR model, and the training unit is further specifically configured to: use the first feature and the second feature to train the LR model Performing training to obtain a trained LR model; the output of the LR model includes the identification information of the training object included in the sample data and the type identification of the training object.

In an optional implementation manner of the present application, the training unit is specifically configured to: based on the sample data, use the K-fold crossover method to train the recognition model to be trained to obtain K target recognition models with different parameters; select the Among the above K target recognition models with different parameters, the target recognition model with the largest harmonic mean is used as the recognition model.

In an optional implementation manner of the present application, the training unit uses the sample data to train the recognition model to be trained, and after obtaining the recognition model, the device further includes:

Using test sample data to test the recognition model, determine whether the indicators of the recognition model meet preset conditions; and/or, determine the recognition of the recognition model based on the third information of each object in the at least one target object whether the result is correct;

If the index of the recognition model does not meet the preset condition, and/or, the recognition result of the recognition model is incorrect, continue to optimize the recognition model to obtain an optimized recognition model;

The determining the abnormal object in the at least one target object based on the first information, the second information and the identification model of the at least one target object includes:

Abnormal objects in the at least one target object are determined based on the first information, the second information of the at least one target object, and the optimized identification model.

The embodiment of the present application also provides an electronic device. The electronic device includes: a memory and a processor, where computer-executable instructions are stored in the memory, and when the processor runs the computer-executable instructions in the memory, it can The method for identifying abnormal objects described in the above-mentioned embodiments is realized.

The embodiment of the present application also provides a computer storage medium, where executable instructions are stored on the storage medium, and when the executable instructions are executed by a processor, the methods for identifying abnormal objects described in the foregoing embodiments are implemented.

The technical solution of the embodiment of the present application obtains first information and second information of at least one target object; the first information is operation behavior information, and the second information is activity participation information; based on the at least one target object Obtain sample data from the first information and second information of the target object; use the sample data to train the recognition model to be trained to obtain the recognition model; determine based on the first information, second information and the recognition model of the at least one target object An exception object in the at least one target object. The technical solution of the embodiment of the present application can utilize the user behavior feature information to fully mine the user's behavior features, and can identify abnormal users among the website users based on the user's operation behavior information, activity participation information and other data in the website, and solve various problems. Problems such as cash-out evasion, CP self-consumption, and marketing activity audits exist in various business scenarios on the website.

Description of drawings

FIG. 1 is a schematic flowchart of a method for identifying an abnormal object provided in an embodiment of the present application;

Figure 2 is a schematic diagram of two GBDT trees provided by the embodiment of the present application;

FIG. 3 is a schematic diagram of the identification process of an abnormal object provided by the embodiment of the present application;

FIG. 4 is a schematic diagram of the structural composition of the abnormal object identification device provided by the embodiment of the present application;

FIG. 5 is a schematic diagram of the structure and composition of an electronic device provided by an embodiment of the present application.

Detailed ways

In order to understand the characteristics and technical contents of the embodiments of the present application in more detail, the implementation of the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings. The attached drawings are only for reference and description, and are not intended to limit the embodiments of the present application.

Generally speaking, abnormal users are mainly divided into three categories:

Channel arbitrage users. In channel cooperation promotion, some channels may develop a large number of zombie users and invalid users in order to achieve settlement purposes. While increasing the access load of portals and APPs, they will consume a lot of settlement expenses. Effective methods are needed to support the identification of channel arbitrage users.

For CP self-consumption users, in the process of content promotion, there may be some CPs who consume their own content in batches in order to increase revenue sharing or achieve settlement assessment goals. Using the abnormal model to identify CP self-consumption can ensure healthy promotion of content.

Users who participate in marketing activities need to use the method of abnormal user identification to check the effectiveness of online marketing activity award-winning users, which can effectively protect marketing resources and protect the rights and interests of active users, so as to better improve the perception and effect of activities.

The technical solution of the embodiment of the present application can integrate the basic attributes and behavior information of the client, CP, and users participating in the activity. After processing the above information and deriving statistics, it can be input as a recognition model, and the recognition model can be used to analyze the above-mentioned three Identify different kinds of abnormal users, tune the recognition model, and output a set of abnormal objects.

Figure 1 is a schematic flow chart of the method for identifying an abnormal object provided by the embodiment of the present application; as shown in Figure 1, the method for identifying an abnormal object provided by the embodiment of the present application includes the following steps:

Step 101: Obtain first information and second information of at least one target object; the first information is operation behavior information, and the second information is activity participation information.

In the embodiment of the present application, the target object is an Internet user, and the embodiment of the present application extracts the user's behavior information from multiple channels in advance, and the behavior information mainly includes the user's operation behavior information and activity participation information. Operational behavior information can be the user’s registration information, comment information, like information, etc., and activity participation information can be information about the user’s participation in marketing activities, such as purchase information, forwarding information, etc. The operational behavior information and activity participation information in this application are also It may be other information, and the embodiment of the present application does not specifically limit the specific content of the above two kinds of information.

Specifically, when extracting the user's behavior information, the user's operation behavior information and activity participation information for consecutive T days can be extracted using the registration number in the user information table as the unique identifier, and the extracted above-mentioned data can be used as the original data set of user behavior information.

Step 102: Obtain sample data based on the first information and second information of the at least one target object.

In an optional implementation manner of the present application, the sample data includes positive sample data and negative sample data;

The above-mentioned step 102 can specifically be realized through the following steps:

constructing an input information table based on the first information and the second information of the at least one target object;

matching a plurality of abnormal feature information based on the input information table as positive sample data in the sample data;

Matching a plurality of normal feature information as negative sample data in the sample data based on the input information table.

In the embodiment of this application, after extracting user behavior information through multiple channels to obtain the original data set of user behavior information, the original data set of user behavior information can be summarized and derived by statistical means to form the input required for the recognition model to be trained. The information table, while matching and identifying several user feature information that has been confirmed as abnormal as positive samples for training the recognition model to be trained, and using the remaining user feature information as negative samples for training the recognition model to be trained.

Step 103: using the sample data to train the recognition model to be trained to obtain the recognition model.

In an optional implementation manner of the present application, the sample data includes multiple characteristic indicators, and the above step 103 can be specifically implemented in the following manner:

Determining the correlation between each of the feature indexes in the plurality of feature indexes, and determining at least one important index in the plurality of feature indexes based on the correlation;

The identification model to be trained is trained by using the sample data corresponding to the at least one important indicator in the sample data.

Specifically, after the positive samples and negative samples in the sample data are extracted, the validity of the sample data needs to be checked and processed. In an optional implementation manner of the present application, the Pearson coefficient can be used to calculate the correlation of indicators, and important indicators can be extracted according to the correlation of indicators, so as to reduce data redundancy.

The Pearson correlation coefficient reflects the linear correlation between two variables, and the value range is [-1,1], where 1 means that the two variables are completely positively correlated, 0 means that the two variables have no linear relationship at all, and -1 means that the two variables have no linear relationship at all. The two variables are completely negatively correlated, that is, when one variable increases, the other variable decreases. The closer the correlation coefficient of two variables is to 0, the weaker the correlation between the two variables is. The correlation calculation formula is as follows:

Among them, X and Y respectively represent two pairs of continuous variables.

Relevance is judged based on the following:

Generally, |r|>0.95 represents a significant correlation between two variables, |r|>0.8 represents a high correlation between two variables, and 0.5<=|r|<0.8 represents a moderate correlation between two variables; 0.3<=|r| <0.5 means that the two variables are lowly correlated; |r|<0.3 means that the relationship between the two variables is extremely weak, which can be considered as the two variables are not correlated.

By calculating the Pearson correlation coefficient between indicator variables, indicators with relatively large correlations between variables and relatively unimportant indicators can be removed, thereby reducing the indicator redundancy of the model.

In an optional implementation manner of the present application, the recognition model to be trained includes a gradient boosting decision tree GBDT model, and the above step 103 can be specifically implemented in the following manner:

Dividing the sample data according to operational behavior characteristics and activity participation characteristics to obtain an operational behavior characteristic set and an activity participation characteristic set;

Respectively establishing a first GBDT model corresponding to the operating behavior characteristics and a second GBDT model corresponding to the activity participation characteristics;

Traverse the first GBDT model by using the operation behavior feature set to obtain the first feature output by the leaf node of the first GBDT model;

The second GBDT model is traversed by using the activity participation feature set to obtain second features output by the leaf nodes of the second GBDT model.

In the embodiment of the present application, since the input of the recognition model involves operation behavior information and activity participation information, the feature dimension of the recognition model training is very high, and the logistic regression (LR, Logistic Regression) algorithm can be used. However, due to the learning ability of the LR model Limited, a large amount of feature engineering is required to extract effective features and feature combinations to improve the nonlinear learning ability of the model. The Gradient Boosting Decision Tree (GBDT, Gradient Boosting DecisionTree) is an iterative decision tree algorithm, which is a member of the integrated learning Boosting family. It has the advantages of high classification accuracy and good generalization ability. It is a nonlinear model. Based on the boosting idea in ensemble learning, a new decision tree is built in the gradient direction of the residual error reduction in each iteration, and how many decision trees will be generated as many times as the iterations. Therefore, GBDT can discover a variety of distinguishing features and feature combinations, which greatly saves the time and labor costs of feature engineering. Therefore, the embodiment of the present application selects the fusion algorithm of GBDT and LR as the recognition model of the embodiment of the present application.

The basic idea of GBDT is: based on the forward distribution algorithm, each iterative calculation is to reduce the residual error of the previous one. In order to eliminate the residual, a new model can be built in the gradient direction of the residual reduction. Therefore, in the gradient enhancement process, the goal of each new model is to reduce the residual error of the previous model in the gradient direction, which is very different from the traditional Boost algorithm that weights correct and wrong samples. Therefore, GBDT can achieve high accuracy in a relatively small parameter adjustment time. In addition, GBDT adopts a robust loss function, which is very robust to abnormal data.

Since the input information of the model in the embodiment of the present application mainly includes user operation behavior information and user activity participation information, the features corresponding to the user activity participation information are too sparse. Therefore, it is necessary to build trees for the feature indicators corresponding to the two parts of information to avoid the situation of feature weight tilt.

In the embodiment of the present application, the training steps for the recognition model to be trained are as follows:

Preprocessing sample data _xi = (msidsn, flag, A1, A2, ..., An, B1, B2, ..., Bm), where msisdn represents the registration number, flag represents the abnormal number identification, that is, the predicted value, and A1 to An represent The user's operation behavior characteristics, B1 to Bm represent the user's activity participation behavior characteristics. Divide the sample data x _i according to the operating behavior characteristics and activity participation characteristics, and the output results are as follows:

Operational behavior feature set: x _iA , namely (msidsn, flag, A1, A2, ..., An)

Activity participation feature set: x _iB , namely (msidsn, flag, B1, B2, ..., Bm)

Through the division of the above sample data, two training sets of T1 and T2 are obtained, as shown in Figure 2, the embodiment of the present application can respectively train the operation behavior features x _iA and x _iB activity participation features in T1 according to the method shown in Figure 2 , build the corresponding GBDT tree respectively.

After the construction of the GBDT tree of the above two features is completed, the operation behavior feature set x _iA and the activity participation feature set x _iB in the sample data are respectively traversed through the corresponding GBDT tree, and each leaf node output is a feature of an LR. Use 0 and 1 to represent whether the sample falls into the leaf node, and construct the input x _input of the LR model: (msisdn1, flag, C1, C2, ..., Ck), where k is the number of GBDT leaf nodes.

Taking the establishment of the user operation behavior characteristic GBDT tree as an example, the specific steps are as follows:

损失函数：

迭代次数：M。a) Input: training sample set

Loss function:

Number of iterations: M.

Among them, x _i =(A _i1 , A _i2 ,..., A _in ), which is the feature set of the user's operation behavior; y _i ∈ {0, 1}, 0 represents a negative sample, and 1 represents a positive sample. F(x) is the predicted value of model F; N is the number of samples.

The loss function of the user operation behavior feature GBDT tree takes the following form:

b) Initialize the weak learner.

c) For the mth round of iteration:

1) Calculate the negative gradient of the loss function as an estimate of r _im :

用于训练模型h_m(x)去拟合r_im。2) The training set is updated as

Used to train the model h _m (x) to fit r _im .

3) Use linear search to estimate the area value of the leaf node, that is, optimize the following function:

Among them, R _jm is the area j of the leaf node, J _m is the number of leaves, and b _jm is the output value of the leaf node.

4) Update the model:

F _m (x) = F _m-1 (x) + γ _m h _m (x) (7)

5) Output the strong learner F _M (x) after M rounds of iterations.

In an optional implementation manner of the present application, the recognition model to be trained also includes a logistic regression LR model, and the above step 103 can be specifically implemented through the following steps:

The LR model is trained by using the first feature and the second feature to obtain a trained LR model; the output of the LR model includes the identification information of the training object included in the sample data and the training The type ID of the object.

Specifically, the features obtained according to the two GBDT trees are used as the input of the LR model, and the LR model is established to predict whether the registration number in each sample data set is an abnormal user, and the output result example is: msisdn1:flag. Wherein, flag=0 represents a non-abnormal number, and flag=1 represents an abnormal number.

In the embodiment of this application, the specific steps for establishing the LR model are as follows:

损失函数：

步长，即学习率：α，最大迭代次数：max_iter，误差限度tol。a) Input: training sample set

Loss function:

Step size, that is, learning rate: α, maximum number of iterations: max_iter, error limit tol.

Among them, x _i = (C _i1 , C _i2 ,..., C _in ), which is the fusion feature set output by GBDT; y _i ∈ {0, 1}, 0 represents negative samples, 1 represents positive samples, and N is the number of samples .

The loss function takes the form of log-likelihood loss:

in,

b) Initialization parameter θ: (θ ₀ , θ ₁ , θ ₂ ,…θ _k ), which can be set as a vector of all 1s.

c) For the jth iteration, determine whether the error is less than tol. If it is satisfied, the training is terminated, otherwise, the operation is performed:

renew

d) Output the final parameter θ of the LR model.

In an optional implementation manner of the present application, the above step 103 can be specifically implemented through the following steps:

Based on the sample data, the recognition model to be trained is trained using the K-fold crossover method to obtain K target recognition models with different parameters;

The target recognition model with the largest harmonic mean value among the K target recognition models with different parameters is selected as the recognition model.

Precision为准确率，Recall为召回率。Specifically, in the GBDT tree, the number of GBDT trees, the attribute dimension and the depth of the tree need to be adjusted manually. The K-fold crossover method (such as the ten-fold crossover method) can be used for model training, and the GBDT parameters corresponding to the classification result with the highest accuracy rate are selected as the optimization result, that is, the larger the F1, the better the model recognition effect. in

Precision is the accuracy rate, and Recall is the recall rate.

In an optional implementation manner of the present application, after performing the above step 103, the obtained recognition model can also be optimized in the following manner:

Using test sample data to test the recognition model, determine whether the indicators of the recognition model meet preset conditions; and/or, determine the recognition of the recognition model based on the third information of each object in the at least one target object whether the result is correct;

If the index of the recognition model does not meet the preset condition, and/or, the recognition result of the recognition model is incorrect, continue to optimize the recognition model to obtain an optimized recognition model;

In the embodiment of this application, test samples are used to test the optimized algorithm rules. On the one hand, the identified abnormal users can be matched and compared with known positive and negative samples to calculate the recognition error rate, accuracy rate, and recall rate of the recognition model. and other indicators; on the other hand, combined with the user's own attributes and behavior characteristics, and then verify whether the prediction of the recognition model is reasonable. Combining the two parts of the indicators, the optimal algorithm rules for the identification model are finally confirmed.

Step 104: Determine an abnormal object in the at least one target object based on the first information, the second information of the at least one target object, and the identification model.

In an optional implementation manner of the present application, the above step 104 can be specifically implemented in the following manner:

The input information table is input into the recognition model, and the abnormal objects in the at least one target object are determined by using the recognition model.

Specifically, in the embodiment of the present application, after obtaining the trained recognition model, the input information table obtained based on the operation behavior information and activity participation information of multiple users is input into the trained recognition model, and the trained recognition model can be used. The identification model identifies whether each of the plurality of users is an abnormal user.

In an optional implementation manner of the present application, when the recognition model is an optimized recognition model, the present application can determine the at least one target object based on the first information, second information and the optimized recognition model. An exception object within a target object.

Specifically, in the embodiment of the present application, after the recognition model is obtained, the recognition model can be further optimized, and the optimized recognition model can be used to predict whether multiple users are abnormal users, so as to improve the prediction accuracy.

The technical solution of the embodiment of the present application can integrate the basic attributes and behavior information of the client, CP, and users participating in the activity. After processing the above information and deriving statistics, it can be input as a model, and the identification model can be used to identify abnormal users. , and tune the algorithm to output a collection of abnormal objects.

Fig. 3 is a schematic diagram of the training process of the recognition model to be trained provided by the embodiment of the present application. As shown in Fig. 2, the training process of the recognition model to be trained includes the following steps:

Step 301: Data collection.

Determine the data collection channel, and extract the behavior information of multiple users from multiple channels.

Step 302: Obtain basic information, operation behavior information and participation activity information.

From the extracted behavior information of multiple users, the user's basic information, operation behavior information and participation activity information are extracted.

Step 303: Establish a feature index information table (ie, an input information table) required by the model.

After extracting the user's basic information, operational behavior information, and activity participation information, the original data set of user behavior information is summarized and derived by statistical means to form the information table required for the input of the recognition model to be trained.

Step 304: GBDT feature extraction.

After the characteristic index information table required by the model is established, the sample data input by the model is established according to the characteristic index information table, and the sample data is divided to obtain the sample data set used for training the operation behavior information GBDT tree, and used for A sample dataset for training the activity participation information GBDT tree.

The above two sample data sets are used to train the two GBDT trees respectively, and the output leaf nodes of the two GBDT trees are obtained.

Step 305: LR model training.

Using the feature pairs output by the leaf nodes output by the two GBDT trees as the input of the LR model, the LR model is trained.

Step 306: Model output.

The LR model can output and predict whether the registration number in each sample data set is an abnormal user, and the output result is msisdn1:flag. Wherein, flag=0 represents a non-abnormal number, and flag=1 represents an abnormal number.

Step 307: Determine whether the model is reasonable.

According to the output of the LR model, it is determined whether the prediction of the model corresponding to the abnormal user is reasonable. The way of judging whether the prediction result is correct mainly includes two ways of step 308 and step 309 .

Step 308: Verify the accuracy of abnormal user identification based on the user's basic attributes and behavior information.

The model trainer determines whether the user is an abnormal user based on the user's basic attribute behavior information, etc., and judges the result of the determination with the prediction result of the model to determine whether the prediction of the model is correct.

Step 309: Algorithm optimization.

When it is judged that the prediction result of the model has a low accuracy rate, steps 304 to 307 are executed cyclically to optimize the model.

Step 310: Determine algorithm rules.

When the algorithm model is optimized so that the accuracy of the obtained model satisfies the conditions, the final optimized algorithm model is used as the final recognition model, and the final recognition model can be used to identify abnormal users subsequently.

The embodiment of the present application also provides a device for identifying abnormal objects. FIG. 4 is a schematic diagram of the structure and composition of the device for identifying abnormal objects 400 provided in the embodiment of the present application. As shown in FIG. 4 , the device for identifying abnormal objects 400 includes :

The first obtaining unit 401 is configured to obtain first information and second information of at least one target object; the first information is operation behavior information, and the second information is activity participation information;

A second obtaining unit 402, configured to obtain sample data based on the first information and second information of the at least one target object;

A training unit 403, configured to use the sample data to train a recognition model to be trained to obtain a recognition model;

A determining unit 404, configured to determine an abnormal object in the at least one target object based on the first information, the second information, and the recognition model of the at least one target object.

In an optional implementation manner of the present application, the sample data includes positive sample data and negative sample data; the second obtaining unit 402 is specifically configured to: construct an object based on the first information and second information of the at least one target object. An input information table; matching a plurality of abnormal feature information as positive sample data in the sample data based on the input information table; matching a plurality of normal feature information as negative sample data in the sample data based on the input information table.

In an optional implementation manner of the present application, the determining unit 404 is specifically configured to: input the input information table into the recognition model, and use the recognition model to determine abnormal objects in the at least one target object.

In an optional implementation manner of the present application, the sample data includes a plurality of characteristic indexes, and the training unit 403 is specifically configured to: determine the correlation among the characteristic indexes in the plurality of characteristic indexes, and based on the correlation Consistently determine at least one important indicator among the plurality of characteristic indicators; use the sample data corresponding to the at least one important indicator in the sample data to train the recognition model to be trained.

In an optional implementation manner of the present application, the recognition model to be trained includes a gradient boosting decision tree GBDT model, and the training unit 403 is specifically configured to: divide the sample data according to operating behavior characteristics and activity participation characteristics, Obtain an operation behavior feature set and an activity participation feature set; respectively establish a first GBDT model corresponding to the operation behavior feature and a second GBDT model corresponding to the activity participation feature; use the operation behavior feature set to traverse the first GBDT model A GBDT model, obtaining the first feature output by the leaf node of the first GBDT model; traversing the second GBDT model by using the activity participation feature set to obtain the second feature output by the leaf node of the second GBDT model .

In an optional implementation manner of the present application, the recognition model to be trained further includes a logistic regression LR model, and the training unit 403 is further specifically configured to: use the first feature and the second feature to classify the LR The model is trained to obtain a trained LR model; the output of the LR model includes the identification information of the training object included in the sample data and the type identification of the training object.

In an optional implementation manner of the present application, the training unit 403 is specifically configured to: based on the sample data, use the K-fold crossover method to train the recognition model to be trained to obtain K target recognition models with different parameters; select Among the K target recognition models with different parameters, the target recognition model with the largest harmonic mean value is used as the recognition model.

In an optional implementation manner of the present application, the training unit 403 uses the sample data to train the recognition model to be trained, and after obtaining the recognition model, the device further includes:

An optimization unit 405, configured to use test sample data to test the recognition model, determine whether the indicators of the recognition model meet preset conditions; and/or determine based on the third information of each object in the at least one target object Whether the recognition result of the recognition model is correct; if the index of the recognition model does not meet the preset conditions, and/or, the recognition result of the recognition model is incorrect, continue to optimize the recognition model to obtain the optimized recognition model;

The determining unit 404 is further specifically configured to: determine an abnormal object in the at least one target object based on the first information, the second information of the at least one target object, and the optimized identification model.

Those skilled in the art should understand that the functions implemented by each unit in the abnormal object identification apparatus 400 shown in FIG. 4 can be understood with reference to the relevant description of the aforementioned abnormal object identification method. The functions of each unit in the abnormal object identification device 400 shown in FIG. 4 can be realized by a program running on a processor, or can be realized by a specific logic circuit.

The embodiment of the present application also provides an electronic device. FIG. 5 is a schematic diagram of the hardware structure of the electronic device according to the embodiment of the present application. As shown in FIG. 5 , the electronic device includes: a communication component 503 for data transmission, at least one processor 501 and a Memory 502 for running computer programs. Various components in the terminal are coupled together through the bus system 504 . It can be understood that the bus system 504 is used to realize connection and communication between these components. In addition to the data bus, the bus system 504 also includes a power bus, a control bus and a status signal bus. However, for clarity of illustration, the various buses are labeled as bus system 504 in FIG. 5 .

Wherein, when the processor 501 executes the computer program, at least the steps of the method shown in FIG. 1 are executed.

It can be understood that the memory 502 may be a volatile memory or a non-volatile memory, and may also include both volatile and non-volatile memories. Wherein, the non-volatile memory can be a read-only memory (ROM, Read Only Memory), a programmable read-only memory (PROM, Programmable Read-Only Memory), an erasable programmable read-only memory (EPROM, Erasable Programmable Read-Only Memory), Only Memory), Electrically Erasable Programmable Read-Only Memory (EEPROM, Electrically Erasable Programmable Read-Only Memory), Magnetic Random Access Memory (FRAM, ferromagnetic random access memory), Flash Memory (Flash Memory), Magnetic Surface Memory , CD, or CD-ROM (CD-ROM, Compact Disc Read-Only Memory); the magnetic surface storage can be disk storage or tape storage. The volatile memory may be random access memory (RAM, Random Access Memory), which is used as an external cache. By way of illustration and not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM, Static Random Access Memory), Synchronous Static Random Access Memory (SSRAM, Synchronous Static Random Access Memory), Dynamic Random Access Memory Memory (DRAM, Dynamic Random Access Memory), Synchronous Dynamic Random Access Memory (SDRAM, Synchronous Dynamic Random Access Memory), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM, Double Data Rate Synchronous Dynamic Random Access Memory), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM, Enhanced Synchronous Dynamic Random Access Memory), Synchronous Link Dynamic Random Access Memory (SLDRAM, SyncLink Dynamic Random Access Memory), Direct Memory Bus Random Access Memory (DRRAM, Direct Rambus Random Access Memory) . The memory 502 described in the embodiment of the present application is intended to include but not limited to these and any other suitable types of memory.

The methods disclosed in the foregoing embodiments of the present application may be applied to the processor 501 or implemented by the processor 501 . The processor 501 may be an integrated circuit chip and has signal processing capabilities. In the implementation process, each step of the above method may be completed by an integrated logic circuit of hardware in the processor 501 or instructions in the form of software. The aforementioned processor 501 may be a general processor, DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, and the like. The processor 501 may implement or execute various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the method disclosed in the embodiments of the present application may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, the storage medium is located in the memory 502, and the processor 501 reads the information in the memory 502, and completes the steps of the foregoing method in combination with its hardware.

In an exemplary embodiment, the electronic device may be implemented by one or more Application Specific Integrated Circuit (ASIC, Application Specific Integrated Circuit), DSP, Programmable Logic Device (PLD, ProgrammableLogic Device), Complex Programmable Logic Device (CPLD, Complex Programmable Logic Device), FPGA, general-purpose processor, controller, MCU, microprocessor (Microprocessor), or other electronic components to implement the aforementioned call recording method.

An embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored, wherein the program is at least used to execute the steps of the method shown in FIG. 1 when executed by a processor. The computer-readable storage medium may specifically be a memory. The memory may be the memory 502 shown in FIG. 5 .

The technical solutions described in the embodiments of the present application may be combined arbitrarily if there is no conflict.

In the several embodiments provided in this application, it should be understood that the disclosed methods and smart devices can be implemented in other ways. The device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods, such as: multiple units or components can be combined, or May be integrated into another system, or some features may be ignored, or not implemented. In addition, the coupling, or direct coupling, or communication connection between the components shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be electrical, mechanical or other forms of.

The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units; Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in each embodiment of the present application may be fully integrated into a second processing unit, or each unit may be used as a single unit, or two or more units may be integrated into one unit; The above-mentioned integrated units can be implemented in the form of hardware, or in the form of hardware plus software functional units.

The above is only a specific implementation of the application, but the scope of protection of the application is not limited thereto. Anyone familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the application. Should be covered within the protection scope of this application.

Claims (11)

1. A method for identifying an abnormal object, characterized in that the method comprises: Obtain first information and second information of at least one target object; the first information is operational behavior information, and the second information is activity participation information; obtaining sample data based on the first information and second information of the at least one target object; Using the sample data to train the recognition model to be trained to obtain the recognition model; An abnormal object in the at least one target object is determined based on the first information, the second information of the at least one target object, and the recognition model. 2. The method according to claim 1, wherein the sample data includes positive sample data and negative sample data; The obtaining sample data based on the first information and second information of the at least one target object includes: constructing an input information table based on the first information and the second information of the at least one target object; matching a plurality of abnormal feature information based on the input information table as positive sample data in the sample data; Matching a plurality of normal feature information as negative sample data in the sample data based on the input information table. 3. The method according to claim 2, wherein the determining the abnormal object in the at least one target object based on the first information, the second information and the recognition model of the at least one target object comprises : The input information table is input into the recognition model, and the abnormal objects in the at least one target object are determined by using the recognition model. 4. The method according to any one of claims 1 to 3, wherein the sample data includes a plurality of feature indicators, and using the sample data to train the recognition model to be trained includes: Determining the correlation between each of the feature indexes in the plurality of feature indexes, and determining at least one important index in the plurality of feature indexes based on the correlation; The identification model to be trained is trained by using the sample data corresponding to the at least one important indicator in the sample data. 5. The method according to any one of claims 1 to 3, wherein the recognition model to be trained comprises a gradient boosting decision tree GBDT model, and the recognition model to be trained is trained using the sample data , to obtain the recognition model, including: Dividing the sample data according to operational behavior characteristics and activity participation characteristics to obtain an operational behavior characteristic set and an activity participation characteristic set; Respectively establishing a first GBDT model corresponding to the operating behavior characteristics and a second GBDT model corresponding to the activity participation characteristics; Traverse the first GBDT model by using the operation behavior feature set to obtain the first feature output by the leaf node of the first GBDT model; The second GBDT model is traversed by using the activity participation feature set to obtain second features output by the leaf nodes of the second GBDT model. 6. The method according to claim 5, wherein the recognition model to be trained also includes a logistic regression LR model, and the recognition model to be trained is trained using the sample data to obtain a recognition model, which also includes : The LR model is trained by using the first feature and the second feature to obtain a trained LR model; the output of the LR model includes the identification information of the training object included in the sample data and the training The type ID of the object. 7. The method according to any one of claims 1 to 3, wherein said using said sample data to train a recognition model to be trained to obtain a recognition model comprises: Based on the sample data, the recognition model to be trained is trained using the K-fold crossover method to obtain K target recognition models with different parameters; The target recognition model with the largest harmonic mean value among the K target recognition models with different parameters is selected as the recognition model. 8. The method according to any one of claims 1 to 3, wherein the identification model to be trained is trained using the sample data, and after the identification model is obtained, the method further comprises: Using test sample data to test the recognition model, determine whether the indicators of the recognition model meet preset conditions; and/or, determine the recognition of the recognition model based on the third information of each object in the at least one target object whether the result is correct; If the index of the recognition model does not meet the preset condition, and/or, the recognition result of the recognition model is incorrect, continue to optimize the recognition model to obtain an optimized recognition model; The determining the abnormal object in the at least one target object based on the first information, the second information and the identification model of the at least one target object includes: Abnormal objects in the at least one target object are determined based on the first information, the second information of the at least one target object, and the optimized identification model. 9. A device for identifying abnormal objects, characterized in that the device comprises: A first obtaining unit, configured to obtain first information and second information of at least one target object; the first information is operation behavior information, and the second information is activity participation information; a second obtaining unit, configured to obtain sample data based on the first information and second information of the at least one target object; A training unit, configured to use the sample data to train a recognition model to be trained to obtain a recognition model; A determining unit, configured to determine an abnormal object in the at least one target object based on the first information, the second information, and the recognition model of the at least one target object. 10. An electronic device, characterized in that the electronic device comprises: a memory and a processor, the memory is stored with computer-executable instructions, and when the processor runs the computer-executable instructions on the memory, it can realize The method according to any one of claims 1 to 8. 11. A computer storage medium, wherein executable instructions are stored on the storage medium, and when the executable instructions are executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images