CN116523308A - Training method and device of risk prediction model and user behavior risk prediction method - Google Patents

Training method and device of risk prediction model and user behavior risk prediction method Download PDF

Info

Publication number
CN116523308A
CN116523308A CN202310478133.9A CN202310478133A CN116523308A CN 116523308 A CN116523308 A CN 116523308A CN 202310478133 A CN202310478133 A CN 202310478133A CN 116523308 A CN116523308 A CN 116523308A
Authority
CN
China
Prior art keywords
data
risk
time
interaction
label
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202310478133.9A
Other languages
Chinese (zh)
Inventor
招永锐
黄明星
王鹏程
范斯达
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Industrial Bank Co Ltd
CIB Fintech Services Shanghai Co Ltd
Original Assignee
Industrial Bank Co Ltd
CIB Fintech Services Shanghai Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Industrial Bank Co Ltd, CIB Fintech Services Shanghai Co Ltd filed Critical Industrial Bank Co Ltd
Priority to CN202310478133.9A priority Critical patent/CN116523308A/en
Publication of CN116523308A publication Critical patent/CN116523308A/en
Pending legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q10/00—Administration; Management
    • G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
    • G06Q10/063—Operations research, analysis or management
    • G06Q10/0635—Risk analysis of enterprise or organisation activities
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/01—Input arrangements or combined input and output arrangements for interaction between user and computer
    • G06F3/048—Interaction techniques based on graphical user interfaces [GUI]
    • G06F3/0487—Interaction techniques based on graphical user interfaces [GUI] using specific features provided by the input device, e.g. functions controlled by the rotation of a mouse with dual sensing arrangements, or of the nature of the input device, e.g. tap gestures based on pressure sensed by a digitiser
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/70—Software maintenance or management
    • G06F8/71—Version control; Configuration management
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/044—Recurrent networks, e.g. Hopfield networks
    • G06N3/0442—Recurrent networks, e.g. Hopfield networks characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
    • Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
    • Y04S10/00—Systems supporting electrical power generation, transmission or distribution
    • Y04S10/50—Systems or methods supporting the power network operation or management, involving a certain degree of interaction with the load-side end user applications

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Human Resources & Organizations (AREA)
  • Software Systems (AREA)
  • Strategic Management (AREA)
  • Health & Medical Sciences (AREA)
  • Mathematical Physics (AREA)
  • Computing Systems (AREA)
  • Molecular Biology (AREA)
  • General Health & Medical Sciences (AREA)
  • Evolutionary Computation (AREA)
  • Entrepreneurship & Innovation (AREA)
  • Data Mining & Analysis (AREA)
  • Computational Linguistics (AREA)
  • Economics (AREA)
  • Biophysics (AREA)
  • Biomedical Technology (AREA)
  • Artificial Intelligence (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Marketing (AREA)
  • Human Computer Interaction (AREA)
  • Development Economics (AREA)
  • Computer Security & Cryptography (AREA)
  • Educational Administration (AREA)
  • General Business, Economics & Management (AREA)
  • Game Theory and Decision Science (AREA)
  • Tourism & Hospitality (AREA)
  • Quality & Reliability (AREA)
  • Operations Research (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

The application relates to a training method and device of a risk prediction model and a user behavior risk prediction method. The method comprises the following steps: acquiring interaction data of a user and a page and interaction time corresponding to the interaction data, acquiring operation data of the user on input equipment and operation time corresponding to the operation data, and acquiring environment data of a current system; performing label division on the interaction data to obtain a first risk label, performing label division on the operation data to obtain a second risk label, performing label division on the environment data to obtain a third risk label, and generating a target risk label according to the first risk label, the second risk label and the third risk label; generating a time behavior vector according to the interaction data, the operation data, the environment data, the operation time and the interaction time; and inputting the time behavior vector and the target risk label into a risk prediction model for training to obtain a trained risk prediction model. By adopting the method, the accuracy of risk prediction can be improved.

Description

Training method and device of risk prediction model and user behavior risk prediction method
Technical Field
The present invention relates to the field of risk prediction technologies, and in particular, to a training method and apparatus for a risk prediction model, and a user behavior risk prediction method.
Background
With the development of wind control technology, a risk prediction technology appears, which can predict whether a user's operation has some directions.
In the related art, risk prediction is mostly performed by adopting service data with larger stability and interpretability. However, in the risk prediction in the financial field, the business data mostly relate to the privacy of the user, and these data platforms cannot acquire and cannot perform risk prediction according to the data related to the privacy of the user, so that the accuracy of predicting whether the risk exists in the user operation is not high.
Disclosure of Invention
In view of the foregoing, it is necessary to provide a training method and apparatus for risk prediction model, and a user behavior risk prediction method, which can improve the accuracy of risk prediction.
In a first aspect, the present application provides a method for training a risk prediction model. The method comprises the following steps:
acquiring interaction data of a user and a page and interaction time corresponding to the interaction data, acquiring operation data of the user on input equipment and operation time corresponding to the operation data, and acquiring environment data of a current system;
Performing label division on the interaction data to obtain a first risk label, performing label division on the operation data to obtain a second risk label, performing label division on the environment data to obtain a third risk label, and generating a target risk label according to the first risk label, the second risk label and the third risk label;
generating a time behavior vector according to the interaction data, the operation data, the environment data, the operation time and the interaction time;
inputting the time behavior vector and the target risk label into a risk prediction model for training to obtain a trained risk prediction model; the risk prediction model is used for predicting risk of user behaviors.
In one embodiment, the generating a time behavior vector according to the interaction data, the operation data, the environment data, the operation time and the interaction time includes:
acquiring interaction labels corresponding to the interaction data and operation labels corresponding to the operation data;
arranging the operation labels according to the operation time, and arranging the interaction labels according to the interaction time;
and generating a time behavior vector according to the arranged operation labels, the arranged interaction labels and the environment data.
In one embodiment, the obtaining operation data of the user on the input device and operation time corresponding to the operation data includes:
acquiring a sliding track, a sliding speed and sliding time of a user on first input equipment;
acquiring a pressing rate and pressing time of a user on a second input device;
generating the operation data according to the sliding track, the sliding speed and the pressing speed;
and generating the operation time according to the sliding time and the pressing time.
In one embodiment, the acquiring the environmental data of the current system includes:
acquiring system version information and system installation information of an operating system of a current system, and acquiring application version information and application installation information of an application program of the current system;
and generating the environment data according to the system version information, the system installation information, the application version information and the application installation information.
In one embodiment, the inputting the time behavior vector and the target risk tag into a risk prediction model for training, to obtain a trained risk prediction model includes:
acquiring the vector length of the time behavior vector;
Adjusting the time behavior vector according to the vector length and the preset length to obtain a target behavior vector;
and inputting the target behavior vector and the target risk label into a risk prediction model for training to obtain a trained risk prediction model.
In one embodiment, the adjusting the time behavior vector according to the vector length and the preset length to obtain a target behavior vector includes:
if the vector length is greater than the preset length, the time behavior vector is truncated according to the preset length to obtain the target behavior vector;
and if the vector length is smaller than the preset length, filling the time behavior vector according to a preset value until the vector length of the filled time behavior vector is equal to the preset length, so as to obtain the target behavior vector.
In a second aspect, the present application further provides a user behavior risk prediction method. The method comprises the following steps:
acquiring to-be-tested interaction data of a user and a page and to-be-tested interaction time corresponding to the interaction data, acquiring to-be-tested operation data of the user on input equipment and to-be-tested operation time corresponding to the to-be-tested operation data, and acquiring to-be-tested environment data of a current system;
Generating behavior time to be detected according to the interaction time to be detected and the operation time to be detected;
generating a behavior vector to be tested according to the interaction data to be tested, the operation data to be tested, the environment data to be tested and the behavior time to be tested;
inputting the behavior vector to be detected into a risk prediction model for prediction processing, and obtaining the output of the risk prediction model to obtain a prediction result; the prediction result is used for representing a risk tag of the next operation behavior of the user.
In a third aspect, the present application further provides a training device for a risk prediction model. The device comprises:
the data acquisition module is used for acquiring interaction data of a user and a page and interaction time corresponding to the interaction data, acquiring operation data of the user on input equipment and operation time corresponding to the operation data, and acquiring environment data of a current system;
the label division module is used for carrying out label division on the interaction data to obtain a first risk label, carrying out label division on the operation data to obtain a second risk label, carrying out label division on the environment data to obtain a third risk label, and generating a target risk label according to the first risk label, the second risk label and the third risk label;
The vector generation module is used for generating a time behavior vector according to the interaction data, the operation data, the environment data, the operation time and the interaction time;
the training module is used for inputting the time behavior vector and the target risk label into a risk prediction model for training to obtain a trained risk prediction model; the risk prediction model is used for predicting risk of user behaviors.
In a fourth aspect, the present application also provides a computer device. The computer device comprises a memory and a processor, wherein the memory stores a computer program, and the processor realizes the steps of the training method of the risk prediction model or the steps of the user behavior risk prediction method when executing the computer program.
In a fifth aspect, the present application also provides a computer-readable storage medium. The computer readable storage medium has stored thereon a computer program which, when executed by a processor, implements the steps of the training method of the risk prediction model described above, or implements the steps of the user behavior risk prediction method described above.
In a sixth aspect, the present application also provides a computer program product. The computer program product comprises a computer program which, when executed by a processor, implements the steps of the training method of the risk prediction model or the steps of the user behavior risk prediction method.
According to the training method and device of the risk prediction model and the user behavior risk prediction method, the interactive data of the user and the page and the interactive time corresponding to the interactive data are obtained, the operation data of the user on the input device and the operation time corresponding to the operation data are obtained, the environment data of the current system are obtained, the data of three dimensions are obtained, the type of data acquisition is expanded, the comprehensiveness of data acquisition is improved, the accuracy of subsequent risk prediction is improved, the time behavior vector is generated according to the interactive data, the operation data, the environment data, the operation time and the interactive time, and then the time behavior vector and the target risk label are input into the risk prediction model for processing, so that the internal contact information between the time behavior vector and the target risk label is mined, the risk prediction of the user behavior is conveniently realized, and the accuracy of risk prediction is improved.
Drawings
FIG. 1 is a diagram of an application environment for a training method of risk prediction models or a user behavior risk prediction method in one embodiment;
FIG. 2 is a flow chart of a training method of a risk prediction model according to one embodiment;
FIG. 3 is a flowchart illustrating a step of generating a temporal behavior vector in one embodiment;
FIG. 4 is a flow chart of steps for determining operational data and operational time in one embodiment;
FIG. 5 is a flow chart of a method for predicting risk of user behavior in one embodiment;
FIG. 6 is a block diagram of a training apparatus for a risk prediction model in one embodiment;
FIG. 7 is a block diagram of a user behavior risk prediction apparatus in one embodiment;
fig. 8 is an internal structural diagram of a computer device in one embodiment.
Detailed Description
In order to make the objects, technical solutions and advantages of the present application more apparent, the present application will be further described in detail with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the present application.
The training method of the risk prediction model and the user behavior risk prediction method provided by the embodiment of the application can be applied to an application environment shown in fig. 1. The training method of the risk prediction model and the user behavior risk prediction method may be executed by the terminal 102 or may be executed by the server 104, and here, the training method of the risk prediction model and the user behavior risk prediction method executed by the terminal 102 are described as an example. The terminal 102 communicates with the server 104 via a network. The data storage system may store data that the server 104 needs to process, such as interaction data for training, interaction time, operation data, operation time, environmental data, and the like. The data storage system may be integrated on the server 104 or may be located on a cloud or other network server. The terminal 102 obtains interaction data of a user and a page and interaction time corresponding to the interaction data, obtains operation data of the user on the input device and operation time corresponding to the operation data, and obtains environment data of a current system; performing label division on the interaction data to obtain a first risk label, performing label division on the operation data to obtain a second risk label, performing label division on the environment data to obtain a third risk label, and generating a target risk label according to the first risk label, the second risk label and the third risk label; generating a time behavior vector according to the interaction data, the operation data, the environment data, the operation time and the interaction time; inputting the time behavior vector and the target risk label into a risk prediction model for training to obtain a trained risk prediction model; the risk prediction model is used for predicting the risk of the user behavior. The terminal 102 may be, but is not limited to, various personal computers, notebook computers, smart phones, tablet computers, etc. The server 104 may be implemented as a stand-alone server or as a server cluster of multiple servers.
In one embodiment, as shown in fig. 2, a training method of a risk prediction model is provided, and the method is applied to the terminal 102 in fig. 1 for illustration, and includes the following steps:
step 202, acquiring interaction data of a user and a page and interaction time corresponding to the interaction data, acquiring operation data of the user on an input device and operation time corresponding to the operation data, and acquiring environment data of a current system.
The interaction data with the page may refer to data generated by operation interaction of a user on the page. Such interactive data may include browsing operations, querying operations, exiting operations, transferring operations, modifying operations, deleting operations, viewing operations, logging in operations, etc.
The interaction time may refer to a time corresponding to each operation interaction. Such as browsing time corresponding to browsing operation, querying time corresponding to querying operation, etc.
The input device may refer to a device for acquiring an operation of a user and inputting the user operation into a processor (processing system). Such as an input device may be, but is not limited to, a mouse, touchpad, handwriting stylus, keyboard, etc. The processor may refer to a processor that is currently operating the device, such as when operating on an ATM machine, then the processor may refer to the processing system of the ATM machine. The processor may refer to the processor of the terminal computer, such as when operating on the terminal computer.
The operation data for the input device may refer to user operations received by the input device. Such as the operation data may include a sliding operation, a sliding track, a pressing operation, a clicking rate, a sliding rate, a pressing rate, etc.
The operation time may refer to a time when a user performs an operation on the input device. The operation time may include, for example, a slide time corresponding to the slide operation (may include a start time and an end time of the slide operation), a push time corresponding to the push operation, a click time corresponding to the click operation, and the like.
The environment data of the current system may refer to the operating environment information in which the system currently operated by the user is located. Such as version information of the operating system, browser fingerprints, installation version information of an Application (APP), etc.
The terminal 102 may obtain interaction data of a user and a page and interaction time corresponding to the interaction data from a data storage system of a server, obtain operation data of the user on an input device and operation time corresponding to the operation data, and obtain environment data of a current system.
Step 204, performing label division on the interaction data to obtain a first risk label, performing label division on the operation data to obtain a second risk label, performing label division on the environment data to obtain a third risk label, and generating a target risk label according to the first risk label, the second risk label and the third risk label.
The label division may refer to a process of dividing risk labels existing in data.
The first risk tag may be used to characterize a risk corresponding to the interaction data. Such as browsing operations, viewing operations, exiting operations, etc., may be classified as low risk tags. Such as delete operations, transfer operations may be classified as medium and high risk tags.
The second risk tag may be used to characterize the risk to which the operational data corresponds. Such as when the sliding speed of the sliding operation is too high, the sliding operation may be set to be a high risk.
The third risk tag may be used to characterize the risk to which the environmental data corresponds. For example, an environment value corresponding to the environment data can be determined, and then the labels are divided according to the environment value and a preset environment threshold value.
The target risk tag may be used to characterize the risk corresponding to the interaction data, the operation data, and the environmental data.
For example, risk labels corresponding to specific operations may be obtained from a server, and then, label division is performed on the interaction data to obtain a first risk label. Such as dividing browsing, querying, viewing, exiting operations into low risk tags, transferring, modifying, deleting, into high risk tags, logging in into medium risk tags, etc.
For example, the types of operation data may be divided, for example, according to the types of input devices, into operations on a mouse and operations on a keyboard. For the operation on the mouse, the sliding speed, the sliding track and the clicking speed of the mouse can be obtained, then the sliding operation is subjected to label division according to the sliding speed and the sliding track, and the label division is performed according to the clicking speed and a preset clicking speed threshold. For operations on the keyboard, the tap rate of the keyboard and a preset tap rate threshold value can be obtained to perform label division and the like. For example, when performing slide verification code verification, if the slide speed is too high and the slide trajectory satisfies the trajectory requirement, it is classified as a high risk tag.
For example, the environmental data may be mapped according to a preset mapping relationship to obtain an environmental value, and then the environmental data is labeled according to the environmental value and a preset environmental threshold to obtain a corresponding third risk label.
For example, the first risk tag, the second risk tag, and the third risk tag may be mapped into corresponding vectors, and then the vectors may be spliced to obtain the vector of the target risk tag.
For example, the risk labels may be set to corresponding risk values, for example, the risk value of the high risk label is set to 8, the risk value of the medium risk label is set to 5, the risk value of the low risk is set to 2, then the target risk value is determined according to the risk value corresponding to the first risk label, the risk value corresponding to the second risk label, and the risk value corresponding to the third risk label (for example, weighting may be performed), and then the target risk label is determined according to the target risk value.
Step 206, generating a time behavior vector according to the interaction data, the operation data, the environment data, the operation time and the interaction time.
Wherein, the time behavior vector may refer to a vector for characterizing the development sequence of each behavior. Where behavior may refer to interaction data, operation data, etc.
For example, the interactive data and the operation data may be arranged according to the time sequence of the interactive time and the operation time, the environment data is added to the arranged data to obtain the time behavior data, and then the time behavior data is converted into the time behavior vector.
Step 208, inputting the time behavior vector and the target risk label into a risk prediction model for training to obtain a trained risk prediction model; the risk prediction model is used for predicting the risk of the user behavior.
The risk prediction model may refer to a model for performing risk prediction, among other things. The risk prediction model can adopt an LSTM model, and can also adopt an anomaly detection algorithm such as a one-class SVM, an Isolation Forest and the like so as to improve the accuracy of subsequent risk prediction.
For example, the time behavior vector and the target risk label may be input into the LSTM model for multiple iteration processing, and an AUC value corresponding to each iteration is obtained until the AUC meets a preset condition, so as to obtain a trained risk prediction model.
For example, the time behavior vector and the target risk label may be input into the LSTM model for training until the LSTM model converges to obtain the risk prediction model.
According to the technical scheme, the operation data of the input device and the operation time corresponding to the operation data are obtained through obtaining the interaction data of the user and the page and the interaction time corresponding to the interaction data, the operation time corresponding to the operation data of the user is obtained, the environment data of the current system is obtained, the data of three dimensions are obtained, the type of data obtaining is expanded, the comprehensiveness of data obtaining is improved, the accuracy of subsequent risk prediction is improved, the time behavior vector is generated according to the interaction data, the operation data, the environment data, the operation time and the interaction time, then the time behavior vector and the target risk label are input into the risk prediction model for processing, and therefore the risk prediction of the user behavior is conveniently achieved, and the accuracy of the risk prediction is improved.
Referring to FIG. 3, in some embodiments, the step of generating a temporal behavior vector from interaction data, operation data, environment data, operation time, and interaction time includes the steps of:
step 302, obtaining an interaction label corresponding to each interaction data, and obtaining an operation label corresponding to each operation data.
The interaction tag may refer to a behavior tag corresponding to the interaction data. For example, a login operation may be represented by "1", a query operation may be represented by "3", a deletion operation may be represented by "2", and an exit operation may be represented by "4".
The operation tag may refer to an operation tag corresponding to operation data. Such as a sliding track, a sliding speed, a clicking operation, etc., may be indicated by numerals. Such as when the sliding trajectory and sliding speed meet the trajectory requirement and a preset speed threshold, a "2" representation may be taken, etc.
By way of example, the interactive data is subjected to behavior label division to obtain interactive labels, and the operation data is subjected to behavior label division to obtain operation labels.
Step 304, operating the tags according to the operation time arrangement, and arranging the interactive tags according to the interactive time arrangement.
For example, the operation tags may be arranged in the order of the operation time, and the interaction tags may be arranged in the order of the interaction time.
And 306, generating a time behavior vector according to the arranged operation labels, the arranged interaction labels and the environment data.
For example, the context data may be converted to context values, and then the operation tags and interaction tags with the context values arranged may generate a temporal behavior vector.
For example, the login operation, the query operation, the deletion operation, the query operation, and the exit operation are firstly performed with action tag division, and then the vector representation of [1,3,2,3,5] is obtained according to the interaction time sequence, and similarly, the operation tags can be similarly processed, then the corresponding vectors are spliced, and then the environment value is added in the corresponding position (such as the last bit) in the vector.
According to the technical scheme, the environment data, the operation data and the interaction data are converted into the time behavior vector, so that training of a risk prediction model is facilitated, and accuracy of risk prediction is improved.
Referring to fig. 4, in some embodiments, the step of "obtaining operation data of the input device by the user and operation time corresponding to the operation data" includes the following steps:
step 402, acquiring a sliding track, a sliding speed and a sliding time of a user on a first input device.
The first input device may be a device capable of recognizing a sliding operation of a user and inputting the sliding operation. Such as a touch pad, mouse, etc.
The sliding track may refer to a track corresponding to a user performing a sliding operation on the first input device.
The slide time may refer to a time of a certain slide operation by the user, and may include a slide start time and a slide end time.
For example, the operation of the user on the first input device may be obtained, so as to obtain a sliding track, a sliding speed and a sliding time of the user on the first input device.
For example, when the system display interface is a graphic verification code, the user is required to perform a sliding operation at this time, and a sliding track, a sliding speed and a sliding time of the user for operating the mouse can be obtained.
Step 404, obtaining a pressing rate and a pressing time of the user on the second input device.
Wherein the second input device may refer to a device capable of recognizing a pressing operation by a user. The second input device may be a keyboard, for example.
Illustratively, the operation of the user on the second input device may be obtained, resulting in a pressing rate and a pressing time of the user on the second input device.
For example, the user's operation on the keyboard may be obtained, resulting in a click rate and a click time.
In step 406, operation data is generated according to the sliding track, the sliding speed and the pressing speed.
Illustratively, the sliding track, sliding rate, and pressing rate are packaged together to obtain corresponding operational data.
Step 408, generating an operation time according to the sliding time and the pressing time.
According to the technical scheme, the sliding track, the sliding speed and the sliding time of the user on the first input device are obtained through obtaining the operation of the first input device, and the pressing speed and the pressing time are obtained through obtaining the operation of the user on the second input device, so that the source of data is expanded, the types of the data are enriched when the operation interface of the system is simple, the comprehensiveness of the data is improved, and the accuracy of risk prediction is further improved.
In some embodiments, the step of "obtaining environmental data of the current system" includes the steps of: acquiring system version information and system installation information of an operating system of a current system, and acquiring application version information and application installation information of an application program of the current system; and generating environment data according to the system version information, the system installation information, the application version information and the application installation information.
An operating system may refer to a system that controls and manages the hardware and software resources of the overall device, and reasonably organizes and schedules the work of the device and the allocation of resources to provide a convenient interface and environment for users and other software. For example, the operating system of the ATM, and the operating system of a terminal.
The system version information may be for the version of the operating system currently in use. Such as Windows10, etc.
The system installation information may refer to detailed installation information of the currently used operating system. Such as what software the system is in itself, the security capabilities of the system, etc.
The application version information may be used to characterize the version of the current application. Such as a version of a browser, etc. Illustratively, a fingerprint of the application (e.g., a browser fingerprint) may be obtained to obtain application version information.
The application installation information may refer to detailed installation information of the current application program. Such as rights information required by the application, etc.
Specifically, the system version information, the system installation information, the application version information, and the application installation information may be integrated to obtain the environment data. The system version information and the system installation information can be converted into corresponding system version numbers, then corresponding system risk labels are determined based on a preset mapping relation, application version information and application installation information are converted into corresponding application version numbers, then corresponding application risk labels are determined based on the preset mapping relation, and then corresponding environment risk labels are determined according to the application risk labels and the system risk labels.
The system version information and the system installation information can be converted into corresponding system version numbers, the application version information and the application installation information are converted into corresponding application version numbers, the application version numbers and the system version numbers are processed according to a preset algorithm to obtain an environment value (the environment value can be used for representing environment data), and then the environment risk label is determined according to the environment value.
In some embodiments, the step of inputting the time behavior vector and the target risk label into the risk prediction model for training, to obtain a trained risk prediction model includes the following steps: acquiring the vector length of a time behavior vector; adjusting the time behavior vector according to the vector length and the preset length to obtain a target behavior vector; and inputting the target behavior vector and the target risk label into the risk prediction model for training to obtain a trained risk prediction model.
The preset length may refer to a preset vector length. The preset length may refer to a standard length of the risk prediction model that can be processed.
For example, the vector length of the time behavior vector may be adjusted according to a preset length, so that the vector length of the time behavior vector meets the standard length of the risk prediction model processing, and the target behavior vector is obtained. And inputting the target behavior vector and the target risk label into a risk prediction model for training treatment to obtain a trained risk prediction model.
For example, a preset value may be added at a preset position of the time behavior vector that does not satisfy the preset length until the vector length of the added vector satisfies the preset length, to obtain the target behavior vector. And cutting off the exceeding part of the time behavior vector exceeding the preset length to obtain a target behavior vector.
In some embodiments, the step of "adjusting the time behavior vector according to the vector length and the preset length to obtain the target behavior vector" includes the following steps: if the vector length is greater than the preset length, cutting off the time behavior vector according to the preset length to obtain a target behavior vector; if the vector length is smaller than the preset length, filling the time behavior vector according to the preset value until the vector length of the filled time behavior vector is equal to the preset length, and obtaining the target behavior vector.
The preset value may refer to a preset value. A value of 0 may be selected as the preset value.
For example, the target behavior vector may be obtained by directly truncating the time behavior vector having a vector length exceeding a preset length from the start position. For the time behavior vector with the vector length not meeting the preset length, the time behavior vector can be filled with 0 to obtain the target behavior vector.
According to the technical scheme, the vector lengths of all the time behavior vectors are adjusted to be the preset lengths, so that the risk prediction model is trained, and the accuracy of subsequent risk prediction is improved.
Referring to fig. 5, some embodiments of the present application further provide a method for predicting risk of user behavior, which is illustrated by applying the method to the terminal 102 in fig. 1, and includes the following steps:
step 502, obtaining to-be-tested interaction data of a user and a page and to-be-tested interaction time corresponding to the to-be-tested interaction data, obtaining to-be-tested operation data of the user on an input device and to-be-tested operation time corresponding to the to-be-tested operation data, and obtaining to-be-tested environment data of a current system.
The interaction data to be tested can refer to data generated by operation interaction of the collected user on the page, wherein the operation interaction is used for carrying out risk prediction. The interactive data to be tested can comprise browsing operation, inquiring operation, exiting operation, transferring operation, modifying operation, deleting operation, checking operation, logging operation and the like.
The interaction time to be tested can refer to the interaction corresponding time of each operation to be tested.
The operation data to be measured may refer to an operation of a user received by the input device. The operation data to be tested may include, for example, a sliding operation, a sliding track, a pressing operation, a clicking rate, a sliding rate, a pressing rate, etc.
The operation time to be measured may refer to the time when the user operates on the input device. The large yoke operation time may include a slide time corresponding to the slide operation (may include a start time and an end time of the slide operation), a push time corresponding to the push operation, a click time corresponding to the click operation, and the like, for example.
The to-be-measured environmental data of the current system may refer to the running environmental information of the system currently operated by the user. Such as version information of the operating system, browser fingerprints, installation version information of an Application (APP), etc.
The method includes the steps that operation of a user on a system interface can be obtained from log information, operation data to be detected and operation time to be detected are obtained, interaction data to be detected and interaction time to be detected of the user and the system are obtained, and environment data to be detected of the current system are extracted.
Step 504, generating the behavior time to be tested according to the interaction time to be tested and the operation time to be tested.
Step 506, generating a behavior vector to be tested according to the interaction data to be tested, the operation data to be tested, the environment data to be tested and the behavior time to be tested.
For example, the interaction data to be tested and the operation to be tested may be arranged according to the sequence of the behavior time to be tested, and then the environment data to be tested is added, so as to obtain the behavior vector to be tested.
Step 508, inputting the behavior vector to be tested into the risk prediction model for prediction processing, and obtaining the output of the risk prediction model to obtain a prediction result; the prediction results are used to characterize risk tags for the next operational behaviour of the user.
The risk prediction model may refer to a model obtained by training by the risk prediction model training method.
The predicted outcome may include high risk behavior, medium risk behavior, low risk behavior, and risk-free behavior.
The behavior vector to be tested is input into a trained risk prediction model for risk prediction, and output of the risk prediction model is obtained to obtain a prediction result.
When the predicted result is a medium risk or a high risk, early warning information can be sent out. If the early warning information can be sent to the user, the early warning information can be sent to a preset contact person, and the early warning information can be sent to a peripheral association system (such as a public security system) so as to prevent the risk event from deteriorating.
According to the technical scheme, the operation data of the input device and the operation time corresponding to the operation data are obtained through obtaining the interaction data of the user and the page and the interaction time corresponding to the interaction data, the operation time corresponding to the operation data of the user is obtained, the environment data of the current system is obtained, the data of three dimensions are obtained, the type of data obtaining is expanded, the comprehensiveness of data obtaining is improved, the accuracy of subsequent risk prediction is improved, the time behavior vector is generated according to the interaction data, the operation data, the environment data, the operation time and the interaction time, then the time behavior vector and the target risk label are input into the risk prediction model for processing, and therefore the risk prediction of the user behavior is conveniently achieved, and the accuracy of the risk prediction is improved. Moreover, when the user behavior risk prediction model of the embodiment of the application is applied to the financial wind control field, as the available direct white data in the financial wind control field is less, the technical scheme of the application can obtain the operation data of the user on the input device and the operation time corresponding to the operation data by obtaining the interaction data of the user and the page and the interaction time corresponding to the interaction data, and obtain the environment data of the current system, so that the data of three dimensions are obtained, the data acquisition type is expanded, the data acquisition comprehensiveness is improved, and the accuracy of the user behavior risk prediction in the financial wind control field is further improved.
It should be understood that, although the steps in the flowcharts related to the above embodiments are sequentially shown as indicated by arrows, these steps are not necessarily sequentially performed in the order indicated by the arrows. The steps are not strictly limited to the order of execution unless explicitly recited herein, and the steps may be executed in other orders. Moreover, at least some of the steps in the flowcharts described in the above embodiments may include a plurality of steps or a plurality of stages, which are not necessarily performed at the same time, but may be performed at different times, and the order of the steps or stages is not necessarily performed sequentially, but may be performed alternately or alternately with at least some of the other steps or stages.
Based on the same inventive concept, the embodiment of the application also provides a training device for the risk prediction model for realizing the training method of the risk prediction model. The implementation of the solution provided by the device is similar to the implementation described in the method above.
In one embodiment, as shown in fig. 6, there is provided a training apparatus of a risk prediction model, including: a data acquisition module 602, a tag partitioning module 604, a vector generation module 606, and a training module 608, wherein:
The data acquisition module 602 is configured to acquire interaction data of a user and a page and interaction time corresponding to the interaction data, acquire operation data of the user on an input device and operation time corresponding to the operation data, and acquire environmental data of a current system;
the tag division module 604 is configured to perform tag division on the interaction data to obtain a first risk tag, perform tag division on the operation data to obtain a second risk tag, perform tag division on the environment data to obtain a third risk tag, and generate a target risk tag according to the first risk tag, the second risk tag and the third risk tag;
the vector generation module 606 is configured to generate a time behavior vector according to the interaction data, the operation data, the environment data, the operation time and the interaction time;
the training module 608 is configured to input the time behavior vector and the target risk label into the risk prediction model for training, so as to obtain a trained risk prediction model; the risk prediction model is used for predicting the risk of the user behavior.
In some embodiments, the vector generation module 606 is further to: acquiring interaction labels corresponding to the interaction data and operation labels corresponding to the operation data; arranging operation labels according to the operation time, and arranging interactive labels according to the interactive time; and generating a time behavior vector according to the arranged operation labels, the arranged interaction labels and the environment data.
In some embodiments, the data acquisition module 602 is further to: acquiring a sliding track, a sliding speed and sliding time of a user on first input equipment; acquiring a pressing rate and pressing time of a user on a second input device; generating operation data according to the sliding track, the sliding speed and the pressing speed; and generating operation time according to the sliding time and the pressing time.
In some embodiments, the data acquisition module 602 is further to: acquiring system version information and system installation information of an operating system of a current system, and acquiring application version information and application installation information of an application program of the current system; and generating environment data according to the system version information, the system installation information, the application version information and the application installation information.
In some embodiments, training module 608 is further to: acquiring the vector length of a time behavior vector; adjusting the time behavior vector according to the vector length and the preset length to obtain a target behavior vector; and inputting the target behavior vector and the target risk label into the risk prediction model for training to obtain a trained risk prediction model.
In some embodiments, training module 608 is further to: if the vector length is greater than the preset length, cutting off the time behavior vector according to the preset length to obtain a target behavior vector; if the vector length is smaller than the preset length, filling the time behavior vector according to the preset value until the vector length of the filled time behavior vector is equal to the preset length, and obtaining the target behavior vector.
Based on the same inventive concept, the embodiment of the application also provides a user behavior risk prediction device for realizing the above-mentioned related user behavior risk prediction method. The implementation of the solution provided by the device is similar to the implementation described in the method above.
In one embodiment, as shown in fig. 7, there is provided a user behavior risk prediction apparatus, including: the device comprises a data to be measured acquisition module 702, a time to be measured determination module 704, a vector to be measured generation module 706 and a prediction module 708, wherein:
the to-be-tested data obtaining module 702 is configured to obtain to-be-tested interaction data of a user and a page, to obtain to-be-tested interaction time corresponding to the to-be-tested interaction data, to obtain to-be-tested operation data of the user on the input device, to obtain to-be-tested operation time corresponding to the to-be-tested operation data, and to obtain to-be-tested environment data of the current system.
The time to be measured determining module 704 is configured to generate a behavior time to be measured according to the interaction time to be measured and the operation time to be measured.
The to-be-measured vector generation module 706 is configured to generate a to-be-measured behavior vector according to the to-be-measured interaction data, the to-be-measured operation data, the to-be-measured environment data, and the to-be-measured behavior time.
The prediction module 708 is configured to input a behavior vector to be detected into the risk prediction model for prediction processing, and obtain an output of the risk prediction model to obtain a prediction result; the prediction results are used to characterize risk tags for the next operational behaviour of the user.
The training device of the risk prediction model or each module in the user behavior risk prediction device may be implemented in whole or in part by software, hardware, and a combination thereof. The above modules may be embedded in hardware or may be independent of a processor in the computer device, or may be stored in software in a memory in the computer device, so that the processor may call and execute operations corresponding to the above modules.
In one embodiment, a computer device is provided, which may be a terminal, and the internal structure thereof may be as shown in fig. 8. The computer device includes a processor, a memory, an input/output interface, a communication interface, a display unit, and an input means. The processor, the memory and the input/output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input/output interface. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The input/output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used for carrying out wired or wireless communication with an external terminal, and the wireless mode can be realized through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. The computer program, when executed by the processor, implements a training method of a risk prediction model or a user behavior risk prediction method. The display unit of the computer device is used for forming a visual picture, and can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer equipment can be a touch layer covered on the display screen, can also be a key, a track ball or a touch pad arranged on the shell of the computer equipment, and can also be an external keyboard, a touch pad or a mouse and the like.
It will be appreciated by those skilled in the art that the structure shown in fig. 8 is merely a block diagram of some of the structures associated with the present application and is not limiting of the computer device to which the present application may be applied, and that a particular computer device may include more or fewer components than shown, or may combine certain components, or have a different arrangement of components.
In one embodiment, a computer device is provided comprising a memory and a processor, the memory having stored therein a computer program, the processor when executing the computer program performing the steps of: acquiring interaction data of a user and a page and interaction time corresponding to the interaction data, acquiring operation data of the user on input equipment and operation time corresponding to the operation data, and acquiring environment data of a current system; performing label division on the interaction data to obtain a first risk label, performing label division on the operation data to obtain a second risk label, performing label division on the environment data to obtain a third risk label, and generating a target risk label according to the first risk label, the second risk label and the third risk label; generating a time behavior vector according to the interaction data, the operation data, the environment data, the operation time and the interaction time; inputting the time behavior vector and the target risk label into a risk prediction model for training to obtain a trained risk prediction model; the risk prediction model is used for predicting the risk of the user behavior.
In one embodiment, the processor when executing the computer program further performs the steps of: acquiring interaction labels corresponding to the interaction data and operation labels corresponding to the operation data; arranging operation labels according to the operation time, and arranging interactive labels according to the interactive time; and generating a time behavior vector according to the arranged operation labels, the arranged interaction labels and the environment data.
In one embodiment, the processor when executing the computer program further performs the steps of: acquiring a sliding track, a sliding speed and sliding time of a user on first input equipment; acquiring a pressing rate and pressing time of a user on a second input device; generating operation data according to the sliding track, the sliding speed and the pressing speed; and generating operation time according to the sliding time and the pressing time.
In one embodiment, the processor when executing the computer program further performs the steps of: acquiring system version information and system installation information of an operating system of a current system, and acquiring application version information and application installation information of an application program of the current system; and generating environment data according to the system version information, the system installation information, the application version information and the application installation information.
In one embodiment, the processor when executing the computer program further performs the steps of: acquiring the vector length of a time behavior vector; adjusting the time behavior vector according to the vector length and the preset length to obtain a target behavior vector; and inputting the target behavior vector and the target risk label into the risk prediction model for training to obtain a trained risk prediction model.
In one embodiment, the processor when executing the computer program further performs the steps of: if the vector length is greater than the preset length, cutting off the time behavior vector according to the preset length to obtain a target behavior vector; if the vector length is smaller than the preset length, filling the time behavior vector according to the preset value until the vector length of the filled time behavior vector is equal to the preset length, and obtaining the target behavior vector.
In one embodiment, the processor when executing the computer program further performs the steps of: acquiring to-be-detected interaction data of a user and a page and to-be-detected interaction time corresponding to the to-be-detected interaction data, acquiring to-be-detected operation data of the user on input equipment and to-be-detected operation time corresponding to the to-be-detected operation data, and acquiring to-be-detected environment data of a current system; generating behavior time to be detected according to interaction time to be detected and operation time to be detected; generating a behavior vector to be tested according to the interaction data to be tested, the operation data to be tested, the environment data to be tested and the behavior time to be tested; inputting the behavior vector to be detected into a risk prediction model for prediction processing, and obtaining the output of the risk prediction model to obtain a prediction result; the prediction results are used to characterize risk tags for the next operational behaviour of the user.
In one embodiment, a computer readable storage medium is provided having a computer program stored thereon, which when executed by a processor, performs the steps of: acquiring interaction data of a user and a page and interaction time corresponding to the interaction data, acquiring operation data of the user on input equipment and operation time corresponding to the operation data, and acquiring environment data of a current system; performing label division on the interaction data to obtain a first risk label, performing label division on the operation data to obtain a second risk label, performing label division on the environment data to obtain a third risk label, and generating a target risk label according to the first risk label, the second risk label and the third risk label; generating a time behavior vector according to the interaction data, the operation data, the environment data, the operation time and the interaction time; inputting the time behavior vector and the target risk label into a risk prediction model for training to obtain a trained risk prediction model; the risk prediction model is used for predicting the risk of the user behavior.
In one embodiment, the computer program when executed by the processor further performs the steps of: acquiring interaction labels corresponding to the interaction data and operation labels corresponding to the operation data; arranging operation labels according to the operation time, and arranging interactive labels according to the interactive time; and generating a time behavior vector according to the arranged operation labels, the arranged interaction labels and the environment data.
In one embodiment, the computer program when executed by the processor further performs the steps of: acquiring a sliding track, a sliding speed and sliding time of a user on first input equipment; acquiring a pressing rate and pressing time of a user on a second input device; generating operation data according to the sliding track, the sliding speed and the pressing speed; and generating operation time according to the sliding time and the pressing time.
In one embodiment, the computer program when executed by the processor further performs the steps of: acquiring system version information and system installation information of an operating system of a current system, and acquiring application version information and application installation information of an application program of the current system; and generating environment data according to the system version information, the system installation information, the application version information and the application installation information.
In one embodiment, the computer program when executed by the processor further performs the steps of: acquiring the vector length of a time behavior vector; adjusting the time behavior vector according to the vector length and the preset length to obtain a target behavior vector; and inputting the target behavior vector and the target risk label into the risk prediction model for training to obtain a trained risk prediction model.
In one embodiment, the computer program when executed by the processor further performs the steps of: if the vector length is greater than the preset length, cutting off the time behavior vector according to the preset length to obtain a target behavior vector; if the vector length is smaller than the preset length, filling the time behavior vector according to the preset value until the vector length of the filled time behavior vector is equal to the preset length, and obtaining the target behavior vector.
In one embodiment, the computer program when executed by the processor further performs the steps of: acquiring to-be-detected interaction data of a user and a page and to-be-detected interaction time corresponding to the to-be-detected interaction data, acquiring to-be-detected operation data of the user on input equipment and to-be-detected operation time corresponding to the to-be-detected operation data, and acquiring to-be-detected environment data of a current system; generating behavior time to be detected according to interaction time to be detected and operation time to be detected; generating a behavior vector to be tested according to the interaction data to be tested, the operation data to be tested, the environment data to be tested and the behavior time to be tested; inputting the behavior vector to be detected into a risk prediction model for prediction processing, and obtaining the output of the risk prediction model to obtain a prediction result; the prediction results are used to characterize risk tags for the next operational behaviour of the user.
In one embodiment, a computer program product is provided comprising a computer program which, when executed by a processor, performs the steps of: acquiring interaction data of a user and a page and interaction time corresponding to the interaction data, acquiring operation data of the user on input equipment and operation time corresponding to the operation data, and acquiring environment data of a current system; performing label division on the interaction data to obtain a first risk label, performing label division on the operation data to obtain a second risk label, performing label division on the environment data to obtain a third risk label, and generating a target risk label according to the first risk label, the second risk label and the third risk label; generating a time behavior vector according to the interaction data, the operation data, the environment data, the operation time and the interaction time; inputting the time behavior vector and the target risk label into a risk prediction model for training to obtain a trained risk prediction model; the risk prediction model is used for predicting the risk of the user behavior.
In one embodiment, the computer program when executed by the processor further performs the steps of: acquiring interaction labels corresponding to the interaction data and operation labels corresponding to the operation data; arranging operation labels according to the operation time, and arranging interactive labels according to the interactive time; and generating a time behavior vector according to the arranged operation labels, the arranged interaction labels and the environment data.
In one embodiment, the computer program when executed by the processor further performs the steps of: acquiring a sliding track, a sliding speed and sliding time of a user on first input equipment; acquiring a pressing rate and pressing time of a user on a second input device; generating operation data according to the sliding track, the sliding speed and the pressing speed; and generating operation time according to the sliding time and the pressing time.
In one embodiment, the computer program when executed by the processor further performs the steps of: acquiring system version information and system installation information of an operating system of a current system, and acquiring application version information and application installation information of an application program of the current system; and generating environment data according to the system version information, the system installation information, the application version information and the application installation information.
In one embodiment, the computer program when executed by the processor further performs the steps of: acquiring the vector length of a time behavior vector; adjusting the time behavior vector according to the vector length and the preset length to obtain a target behavior vector; and inputting the target behavior vector and the target risk label into the risk prediction model for training to obtain a trained risk prediction model.
In one embodiment, the computer program when executed by the processor further performs the steps of: if the vector length is greater than the preset length, cutting off the time behavior vector according to the preset length to obtain a target behavior vector; if the vector length is smaller than the preset length, filling the time behavior vector according to the preset value until the vector length of the filled time behavior vector is equal to the preset length, and obtaining the target behavior vector.
In one embodiment, the computer program when executed by the processor further performs the steps of: acquiring to-be-detected interaction data of a user and a page and to-be-detected interaction time corresponding to the to-be-detected interaction data, acquiring to-be-detected operation data of the user on input equipment and to-be-detected operation time corresponding to the to-be-detected operation data, and acquiring to-be-detected environment data of a current system; generating behavior time to be detected according to interaction time to be detected and operation time to be detected; generating a behavior vector to be tested according to the interaction data to be tested, the operation data to be tested, the environment data to be tested and the behavior time to be tested; inputting the behavior vector to be detected into a risk prediction model for prediction processing, and obtaining the output of the risk prediction model to obtain a prediction result; the prediction results are used to characterize risk tags for the next operational behaviour of the user.
Those skilled in the art will appreciate that implementing all or part of the above described methods may be accomplished by way of a computer program stored on a non-transitory computer readable storage medium, which when executed, may comprise the steps of the embodiments of the methods described above. Any reference to memory, database, or other medium used in the various embodiments provided herein may include at least one of non-volatile and volatile memory. The nonvolatile Memory may include Read-Only Memory (ROM), magnetic tape, floppy disk, flash Memory, optical Memory, high density embedded nonvolatile Memory, resistive random access Memory (ReRAM), magnetic random access Memory (Magnetoresistive Random Access Memory, MRAM), ferroelectric Memory (Ferroelectric Random Access Memory, FRAM), phase change Memory (Phase Change Memory, PCM), graphene Memory, and the like. Volatile memory can include random access memory (Random Access Memory, RAM) or external cache memory, and the like. By way of illustration, and not limitation, RAM can be in the form of a variety of forms, such as static random access memory (Static Random Access Memory, SRAM) or dynamic random access memory (Dynamic Random Access Memory, DRAM), and the like. The databases referred to in the various embodiments provided herein may include at least one of relational databases and non-relational databases. The non-relational database may include, but is not limited to, a blockchain-based distributed database, and the like. The processors referred to in the embodiments provided herein may be general purpose processors, central processing units, graphics processors, digital signal processors, programmable logic units, quantum computing-based data processing logic units, etc., without being limited thereto.
The technical features of the above embodiments may be arbitrarily combined, and all possible combinations of the technical features in the above embodiments are not described for brevity of description, however, as long as there is no contradiction between the combinations of the technical features, they should be considered as the scope of the description.
The above examples only represent a few embodiments of the present application, which are described in more detail and are not to be construed as limiting the scope of the present application. It should be noted that it would be apparent to those skilled in the art that various modifications and improvements could be made without departing from the spirit of the present application, which would be within the scope of the present application. Accordingly, the scope of protection of the present application shall be subject to the appended claims.

Claims (10)

1. A method of training a risk prediction model, the method comprising:
acquiring interaction data of a user and a page and interaction time corresponding to the interaction data, acquiring operation data of the user on input equipment and operation time corresponding to the operation data, and acquiring environment data of a current system;
performing label division on the interaction data to obtain a first risk label, performing label division on the operation data to obtain a second risk label, performing label division on the environment data to obtain a third risk label, and generating a target risk label according to the first risk label, the second risk label and the third risk label;
Generating a time behavior vector according to the interaction data, the operation data, the environment data, the operation time and the interaction time;
inputting the time behavior vector and the target risk label into a risk prediction model for training to obtain a trained risk prediction model; the risk prediction model is used for predicting risk of user behaviors.
2. The method of claim 1, wherein the generating a temporal behavior vector from the interaction data, operational data, environmental data, the operational time, and the interaction time comprises:
acquiring interaction labels corresponding to the interaction data and operation labels corresponding to the operation data;
arranging the operation labels according to the operation time, and arranging the interaction labels according to the interaction time;
and generating a time behavior vector according to the arranged operation labels, the arranged interaction labels and the environment data.
3. The method according to claim 1, wherein the obtaining operation data of the input device by the user and the operation time corresponding to the operation data includes:
acquiring a sliding track, a sliding speed and sliding time of a user on first input equipment;
Acquiring a pressing rate and pressing time of a user on a second input device;
generating the operation data according to the sliding track, the sliding speed and the pressing speed;
and generating the operation time according to the sliding time and the pressing time.
4. The method of claim 1, wherein the obtaining environmental data of the current system comprises:
acquiring system version information and system installation information of an operating system of a current system, and acquiring application version information and application installation information of an application program of the current system;
and generating the environment data according to the system version information, the system installation information, the application version information and the application installation information.
5. The method of claim 1, wherein the inputting the temporal behavior vector and the target risk tag into a risk prediction model for training, to obtain a trained risk prediction model, comprises:
acquiring the vector length of the time behavior vector;
adjusting the time behavior vector according to the vector length and the preset length to obtain a target behavior vector;
and inputting the target behavior vector and the target risk label into a risk prediction model for training to obtain a trained risk prediction model.
6. The method of claim 5, wherein the adjusting the temporal behavior vector according to the vector length and the preset length to obtain the target behavior vector comprises:
if the vector length is greater than the preset length, the time behavior vector is truncated according to the preset length to obtain the target behavior vector;
and if the vector length is smaller than the preset length, filling the time behavior vector according to a preset value until the vector length of the filled time behavior vector is equal to the preset length, so as to obtain the target behavior vector.
7. A method for predicting risk of user behavior, the method comprising:
acquiring to-be-tested interaction data of a user and a page and to-be-tested interaction time corresponding to the to-be-tested interaction data, acquiring to-be-tested operation data of the user on input equipment and to-be-tested operation time corresponding to the to-be-tested operation data, and acquiring to-be-tested environment data of a current system;
generating behavior time to be detected according to the interaction time to be detected and the operation time to be detected;
generating a behavior vector to be tested according to the interaction data to be tested, the operation data to be tested, the environment data to be tested and the behavior time to be tested;
Inputting the behavior vector to be detected into a risk prediction model for prediction processing, and obtaining the output of the risk prediction model to obtain a prediction result; the prediction result is used for representing a risk tag of the next operation behavior of the user.
8. A training device for a risk prediction model, the device comprising:
the data acquisition module is used for acquiring interaction data of a user and a page and interaction time corresponding to the interaction data, acquiring operation data of the user on input equipment and operation time corresponding to the operation data, and acquiring environment data of a current system;
the label division module is used for carrying out label division on the interaction data to obtain a first risk label, carrying out label division on the operation data to obtain a second risk label, carrying out label division on the environment data to obtain a third risk label, and generating a target risk label according to the first risk label, the second risk label and the third risk label;
the vector generation module is used for generating a time behavior vector according to the interaction data, the operation data, the environment data, the operation time and the interaction time;
The training module is used for inputting the time behavior vector and the target risk label into a risk prediction model for training to obtain a trained risk prediction model; the risk prediction model is used for predicting risk of user behaviors.
9. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that the processor, when executing the computer program, implements the steps of the training method of the risk prediction model of any one of claims 1 to 6; or the step of implementing the user behavior risk prediction method of claim 7.
10. A computer readable storage medium having stored thereon a computer program, characterized in that the computer program when executed by a processor realizes the steps of the training method of the risk prediction model of any of claims 1 to 6; or the step of implementing the user behavior risk prediction method of claim 7.
CN202310478133.9A 2023-04-28 2023-04-28 Training method and device of risk prediction model and user behavior risk prediction method Pending CN116523308A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202310478133.9A CN116523308A (en) 2023-04-28 2023-04-28 Training method and device of risk prediction model and user behavior risk prediction method

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202310478133.9A CN116523308A (en) 2023-04-28 2023-04-28 Training method and device of risk prediction model and user behavior risk prediction method

Publications (1)

Publication Number Publication Date
CN116523308A true CN116523308A (en) 2023-08-01

Family

ID=87393515

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202310478133.9A Pending CN116523308A (en) 2023-04-28 2023-04-28 Training method and device of risk prediction model and user behavior risk prediction method

Country Status (1)

Country Link
CN (1) CN116523308A (en)

Similar Documents

Publication Publication Date Title
US10977389B2 (en) Anonymity assessment system
CN112863683B (en) Medical record quality control method and device based on artificial intelligence, computer equipment and storage medium
CN109614318A (en) Automated testing method, device, electronic equipment and computer-readable medium
CN111198967A (en) User grouping method and device based on relational graph and electronic equipment
CN115795000A (en) Joint similarity algorithm comparison-based enclosure identification method and device
CN111191677B (en) User characteristic data generation method and device and electronic equipment
CN112306606A (en) Method and equipment for presenting control style
CN116523308A (en) Training method and device of risk prediction model and user behavior risk prediction method
CN105354506A (en) File hiding method and apparatus
Malik Android system call analysis for malicious application detection
CN115758271A (en) Data processing method, data processing device, computer equipment and storage medium
CN115470190A (en) Multi-storage-pool data classification storage method and system and electronic equipment
CN111049988A (en) Intimacy prediction method, system, equipment and storage medium for mobile equipment
CN117056629A (en) Cache configuration method, device, computer equipment and storage medium
CN116775186A (en) Page data processing method and device, computer equipment and storage medium
CN116866419A (en) Information pushing method, device, computer equipment and storage medium
CN118153552A (en) Data analysis method, device, computer equipment and storage medium
CN116719614A (en) Virtual machine monitor selection method, device, computer equipment and storage medium
CN117455386A (en) Resource auditing method and device, computer equipment and storage medium thereof
CN115952554A (en) Electronic signature data processing method and device, computer equipment and storage medium
CN114595120A (en) Data acquisition method, system, computer device and storage medium
CN117910008A (en) File decryption method, device, computer equipment and storage medium
CN114547066A (en) Nuclear power business data standardization method and device and computer equipment
CN116049009A (en) Test method, test device, computer equipment and computer readable storage medium
CN116643884A (en) Data computing method, device, equipment and storage medium based on rule engine

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination