CN116957585A

CN116957585A - Data processing method, device, equipment and storage medium

Info

Publication number: CN116957585A
Application number: CN202310151906.2A
Authority: CN
Inventors: 黄自豪
Original assignee: Tencent Technology Shenzhen Co Ltd
Current assignee: Tencent Technology Shenzhen Co Ltd
Priority date: 2023-02-10
Filing date: 2023-02-10
Publication date: 2023-10-27

Abstract

The embodiment of the application provides a data processing method, device equipment and storage medium, which are used for accurately identifying abnormal operation. Comprising the following steps: acquiring a behavior sequence of a target object, wherein the behavior sequence is used for indicating an operation sequence generated by arranging a historical operation behavior set of the target object according to a time sequence; embedding and representing the behavior sequence to obtain a behavior sequence vector; inputting the behavior sequence vector into an identification model to obtain a predicted probability value, wherein the identification model comprises LST, CNN and FC, the LSTM is used for encoding the behavior sequence vector, the behavior sequence vector is mapped into an M-dimensional vector, the value of M is larger than the dimension value of the behavior sequence vector, the CNN is used for acquiring the mutation characteristics of adjacent actions in the behavior sequence, and the FC is used for mapping the output result of the CNN into the predicted probability value; and determining the recognition result of the target object according to the predicted probability value. The technical scheme provided by the application can be applied to the fields of computers and artificial intelligence.

Description

Data processing method, device, equipment and storage medium

Technical Field

The present application relates to the field of computers, and in particular, to a data processing method, apparatus, device, and storage medium.

Background

With the development of mobile technology, mobile payment and electronic commerce occupy a large proportion of people's life transactions. In financial transactions, in order to meet the requirements of related laws and regulations, risk management and control are required for each transaction, and the situations such as resource sources, transaction purposes, transaction properties and the like in the transaction are known.

Generally, the process for fraudulent transaction control is to identify fraudulent transactions through a logistic regression model or a policy of rule combinations. The logistic regression model is essentially a simple linear model with limited ability to fit complex transaction behaviors. Whereas the policy for rule combinations is poor in stability and easy to overfit: the characteristics of rule combination learning based on the decision tree are also single, and the characteristic threshold value is easy to be fitted to the training sample.

There is a strong need for a method that can accurately identify fraudulent transactions.

Disclosure of Invention

The embodiment of the application provides a data processing method, device equipment and storage medium, which are used for accurately identifying abnormal operation.

In view of this, an aspect of the present application provides a data processing method, including: acquiring a behavior sequence of a target object, wherein the behavior sequence is used for indicating an operation sequence generated by arranging a historical operation behavior set of the target object according to a time sequence; embedding and representing the behavior sequence to obtain a behavior sequence vector; inputting the behavior sequence vector into an identification model to obtain a predicted probability value, wherein the identification model comprises a two-way long-short-term memory artificial neural network, a convolution neural network and a full-connection neural network, the long-short-term memory artificial neural network, the convolution neural network and the full-connection neural network are sequentially stacked, the long-short-term memory artificial neural network is used for encoding the behavior sequence vector, the behavior sequence vector is mapped into an M-dimensional vector, the value of M is larger than the dimension value of the behavior sequence vector, the convolution neural network is used for acquiring the mutation characteristics of adjacent actions in the behavior sequence of the target object, and the full-connection neural network is used for mapping the output result of the convolution neural network into the predicted probability value; and determining the recognition result of the target object according to the predicted probability value.

Another aspect of the present application provides a data processing apparatus comprising: the system comprises an acquisition module, a processing module and a processing module, wherein the acquisition module is used for acquiring a behavior sequence of a target object, and the behavior sequence is used for indicating an operation sequence generated by a historical operation behavior set of the target object according to time sequence arrangement;

the processing module is used for carrying out embedded representation on the behavior sequence to obtain a behavior sequence vector; inputting the behavior sequence vector into an identification model to obtain a prediction probability value, wherein the identification model comprises a two-way long-short-term memory artificial neural network, a convolution neural network and a full-connection neural network, and the long-short-term memory artificial neural network, the convolution neural network and the full-connection neural network are stacked in sequence; and determining the recognition result of the target object according to the predicted probability value.

In one possible design, in another implementation manner of another aspect of the embodiments of the present application, the obtaining module is configured to obtain a plurality of sets of feature representations corresponding to the set of historical operation behaviors within a time window, where the feature representations are used to describe the historical operation behaviors, and one of the set of historical operation behaviors corresponds to a set of feature representations;

and splicing the multiple groups of characteristic representations according to the time sequence to obtain the behavior sequence.

In one possible design, in another implementation of another aspect of the embodiments of the present application, the historical operational behavior in the set of historical operational behaviors includes at least one of a registered account number, a logout account number, a pay-as-you-go transaction, a bound transaction card object.

In one possible design, in another implementation of another aspect of the embodiments of the present application, the characteristic representation includes transaction direction, transaction scenario, transaction style, relationship between transaction objects, transaction time, and transaction amount when the historical operational behavior is receipt and payment transactions.

In one possible design, in another implementation manner of another aspect of the embodiments of the present application, the processing module is specifically configured to obtain the behavior sequence vector by performing embedded representation on the behavior sequence through a word2vec model.

In one possible design, in another implementation of another aspect of the embodiments of the present application, the processing module is specifically configured to perform one-hot encoding on the behavior sequence to obtain an N-dimensional vector representation, where N is a positive integer;

inputting the N-dimensional vector representation into an input layer of the word2vec model, and multiplying the N-dimensional vector representation with a first weight matrix to obtain a first vector representation, wherein the first weight matrix is a weight matrix from the input layer of the word2vec model to a hidden layer of the word2vec model;

Mapping the first vector representation to a hidden layer of the word2vec model to obtain a second vector representation;

multiplying the second vector representation with a second weight matrix to obtain a third vector representation, wherein the second weight matrix is a weight matrix from a hidden layer of the word2vec model to an output layer of the word2vec model;

and inputting the third vector representation into the word2vec model to perform regression processing to obtain the behavior sequence vector.

In one possible design, in another implementation manner of another aspect of the embodiments of the present application, the processing module is specifically configured to input the behavior sequence vector into the two-way long-short-term memory artificial neural network of the recognition model to perform encoding to obtain a first intermediate vector of the behavior sequence vector;

inputting the first intermediate vector into a convolutional neural network of the recognition model to obtain a second intermediate vector of the behavior sequence vector;

and obtaining the predicted probability value through the fully connected neural network by the second intermediate vector.

In one possible design, in another implementation manner of another aspect of the embodiments of the present application, the processing module is specifically configured to set a preset threshold according to a service requirement;

comparing the predicted probability value with the preset threshold value to obtain a comparison result;

And when the comparison result indicates that the predicted probability value is larger than the preset threshold value, determining that the target object is a suspicious object.

In a possible design, in another implementation manner of another aspect of the embodiments of the present application, the obtaining module is further configured to obtain a training sample and an initial recognition model, where each sample in the training sample includes a sample tag and a training behavior sequence, the sample tag is used to indicate that the training sample is a suspicious object or a normal object, and the initial recognition model includes an initial bidirectional long-short-term memory artificial neural network, an initial convolutional neural network, and an initial fully-connected neural network, where the initial bidirectional long-short-term memory artificial neural network, the initial convolutional neural network, and the initial fully-connected neural network are stacked in sequence;

the processing module is also used for inputting the training sample into the initial recognition model to obtain a training probability value;

calculating according to the training probability value and the sample label to obtain a loss value;

and learning network parameters of the initial recognition model according to the loss value to obtain the recognition model.

In one possible design, in another implementation of another aspect of the embodiments of the present application, the processing module is specifically configured to calculate the loss function using a target loss function according to the training probability value and the sample tag.

In one possible design, in another implementation of another aspect of the embodiments of the present application, the target loss function is a cross entropy loss function, a relative entropy loss function, or a normalized loss function.

In one possible design, in another implementation of another aspect of the embodiments of the present application, the processing module is further configured to send a prompt message to the target object when the identification result indicates that the target object is a suspicious object;

or alternatively, the process may be performed,

and intercepting the transaction of the target object when the identification result indicates that the target object is a suspicious object.

Another aspect of the present application provides a computer apparatus comprising: a memory, a processor, and a bus system;

wherein the memory is used for storing programs;

the processor is used for executing the program in the memory, and the processor is used for executing the method according to the aspects according to the instructions in the program code;

the bus system is used to connect the memory and the processor to communicate the memory and the processor.

Another aspect of the application provides a computer readable storage medium having instructions stored therein which, when run on a computer, cause the computer to perform the methods of the above aspects.

In another aspect of the application, a computer program product or computer program is provided, the computer program product or computer program comprising computer instructions stored in a computer readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the methods provided in the above aspects.

From the above technical solutions, the embodiment of the present application has the following advantages: the behavior sequence of the target object represents the richer characteristic information of the target object, so that the recognition accuracy of abnormal operation is improved. Meanwhile, the recognition model comprises a Long Short-Term Memory (LSTM) and a convolutional neural network (Convolutional Neural Network, CNN), so that the behavior sequence is learned based on the recognition model, the characteristics of the behavior sequence for a Long time can be learned by using the LSTM, and the characteristics of adjacent actions in the behavior sequence can be fused and extracted by using the CNN, so that the recognition accuracy of abnormal operation can be improved.

Drawings

FIG. 1 is a schematic diagram of a word2vec in an embodiment of the present application;

FIG. 2 is a schematic diagram of an architecture of an application scenario in an embodiment of the present application;

FIG. 3 is a schematic diagram of a network structure of an identification model according to an embodiment of the present application;

FIG. 4 is a schematic diagram of an execution flow of a data processing method according to an embodiment of the present application;

FIG. 5 is a schematic diagram of an embodiment of a method for processing data in an embodiment of the present application;

FIG. 6 is a schematic diagram of an embodiment of a data processing apparatus according to an embodiment of the present application;

FIG. 7 is a schematic diagram of another embodiment of a data processing apparatus according to an embodiment of the present application;

fig. 8 is a schematic diagram of another embodiment of a data processing apparatus according to an embodiment of the present application.

Detailed Description

The terms "first," "second," "third," "fourth" and the like in the description and in the claims and in the above drawings, if any, are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used may be interchanged where appropriate such that the embodiments of the application described herein may be implemented, for example, in sequences other than those illustrated or otherwise described herein. Furthermore, the terms "comprises," "comprising," and "includes" and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed or inherent to such process, method, article, or apparatus.

With the development of mobile technology, mobile payment and electronic commerce occupy a large proportion of people's life transactions. In financial transactions, in order to meet the requirements of related laws and regulations, risk management and control are required for each transaction, and the situations such as resource sources, transaction purposes, transaction properties and the like in the transaction are known. Generally, the process for fraudulent transaction control is to identify fraudulent transactions through a logistic regression model or a policy of rule combinations. The logistic regression model is essentially a simple linear model with limited ability to fit complex transaction behaviors. Whereas the policy for rule combinations is poor in stability and easy to overfit: the characteristics of rule combination learning based on the decision tree are also single, and the characteristic threshold value is easy to be fitted to the training sample. There is a strong need for a method that can accurately identify fraudulent transactions.

In order to solve the above problems, the present application provides a data processing method, which specifically includes obtaining a behavior sequence of a target object, where the behavior sequence is used to indicate an operation sequence generated by a historical operation behavior set of the target object according to a time sequence arrangement; embedding and representing the behavior sequence to obtain a behavior sequence vector; inputting the behavior sequence vector into an identification model to obtain a predicted probability value, wherein the identification model comprises a two-way long-short-term memory artificial neural network, a convolution neural network and a full-connection neural network, the long-short-term memory artificial neural network, the convolution neural network and the full-connection neural network are sequentially stacked, the long-short-term memory artificial neural network is used for encoding the behavior sequence vector, the behavior sequence vector is mapped into an M-dimensional vector, the value of M is larger than the dimensional value of the behavior sequence vector, the convolution neural network is used for acquiring the mutation characteristics of adjacent actions in the behavior sequence, and the full-connection neural network is used for mapping the output result of the convolution neural network into the predicted probability value; and determining the recognition result of the target object according to the predicted probability value. Thus, the behavior sequence of the target object represents the richer characteristic information of the target object, and the recognition accuracy of abnormal operation is improved. Meanwhile, the recognition model comprises the bidirectional LSTM and the CNN, so that the behavior sequence is learned based on the recognition model, the characteristics of the behavior sequence for a long time can be learned by utilizing the bidirectional LSTM, and the characteristics of adjacent actions in the behavior sequence can be fused and extracted by utilizing the CNN, so that the recognition accuracy of abnormal operation can be improved.

For ease of understanding, some of the terms referred to in this disclosure are described below:

artificial intelligence (Artificial Intelligence, AI), which is a theory, method, technique, and application system that simulates, extends, and extends human intelligence using a digital computer or a machine controlled by a digital computer, perceives the environment, obtains knowledge, and uses the knowledge to obtain optimal results. In other words, artificial intelligence is an integrated technology of computer science that attempts to understand the essence of intelligence and to produce a new intelligent machine that can react in a similar way to human intelligence. Artificial intelligence, i.e. research on design principles and implementation methods of various intelligent machines, enables the machines to have functions of sensing, reasoning and decision.

Neural network: the artificial neural network (Artificial Neural Networks, ANN) is formed by connecting a plurality of neurons with adjustable connection weights, and has the characteristics of large-scale parallel processing, distributed information storage, good self-organizing self-learning capacity and the like.

The convolution layers (Convolutional layer, conv) are layered structures formed by a plurality of convolution units in the convolution neural network layers, the convolution neural network (Convolutional Neural Network, CNN) is a feedforward neural network, and the convolution neural network comprises at least two neural network layers, wherein each neural network layer comprises a plurality of neurons, the neurons are arranged in layers, the neurons of the same layer are not connected with each other, and the transmission of interlayer information is only carried out along one direction.

Long Short-Term Memory artificial neural network (LSTM): the time-circulating neural network is specially designed for solving the long-term dependence problem of the common circulating neural network. LSTM can perform better in longer sequences.

The fully connected neural network (Fully Connected layer, FC) means that each node in the layered structure is connected with all nodes of the upper layer, and can be used for comprehensively processing the characteristics extracted by the neural network layer of the upper layer, and plays a role of a classifier in a neural network model.

Back propagation: forward propagation refers to the feed-forward processing of the model, and backward propagation is opposite to forward propagation, and refers to updating weight parameters of each layer of the model according to the result output by the model. For example, where the model includes an input layer, a hidden layer, and an output layer, forward propagation refers to processing in the order input layer-hidden layer-output layer, and backward propagation refers to updating the weight parameters of the layers in sequence output layer-hidden layer-input layer.

One-Hot encoding, also known as One-bit efficient encoding, uses an N-bit status register to encode N states, each of which is represented by its independent register bit, and only One of which is valid at any time. For example: the natural state code is: 000,001,010,011,100,101; its corresponding one-hot encoding is: 000001,000010,000100,001000,010000,100000.

Behavior sequence: the sequence is formed by arranging the operation behavior histories of the users according to the time occurrence sequence. Which contains the behavior event itself and the order information of the behavior event occurrence within a certain time window, etc. For example, the behavior sequence over the past 1 hour can be expressed as: "A- > B- > C- > D", wherein A-D may be used to represent the remark name of the user for a certain operational behaviour. The "B- > C- > a- > D" and "a- > B- > C- > D" both include the same behavior event, but are in two completely different behavior patterns due to different occurrence sequences. In one exemplary scenario, taking third party payment A as an example, the operational actions include registering an account number, logging out an account number, receiving a payment transaction, binding a transaction card object, and so forth. While for each operational behaviour a rich feature representation is also required to fully describe a single operational behaviour. For example, a transaction may be performed by a transaction mode (such as cash withdrawal, cash collection, or cash withdrawal), a transaction scenario (such as general transfer, face-to-face transfer, or red package), a transaction amount, a relationship between transaction objects (such as friend relationship or temporary transaction relationship or different transaction areas, etc.), and a transaction time (such as 10 am). Thus, in order to describe an operational behaviour, it is necessary to set a feature representation, and map the abstract operational behaviour to a combination of feature representations.

In one exemplary scenario, in a payment scenario, different transactions may be represented by the following features: transaction direction: dispensing, collecting money, presenting, etc.; transaction scenario: common transfer, face-to-face transfer, red-pack, commercial payment, etc.; the payment method comprises the following steps: quick, balance, change, etc.; the relation between two parties of the transaction comprises friend time, regional information of the two parties and the like; transaction time, recording hour; the transaction amount is expressed in a discrete manner by grouping according to a certain rule. Thus, an example of one specific operational behavior of a target object may be: "Cascadence_common transfer_balance_non-friend non-city_12 Point_Account 1". And then splicing the characteristic representations corresponding to different operation behaviors of the target object according to the time sequence to obtain the behavior sequence of the target object.

Meanwhile, it can be understood that, because the numerical range set by the information such as the amount and the balance is larger, and the numerical value has no practical meaning, a learnable characteristic value can be formed by characteristic embedding, and the characteristic embedding is actually equivalent to a characteristic mapping for different indexes, which can be expressed as follows:wherein, the->Raw data for indicating the ith operation action (for example, the first transaction operation action corresponding to the target object includes balance of 1500, transaction amount of 700, receipt of 3, general transfer of 1, non-friend non-city of 5, transaction time of 12 points), then this +. >A feature value (e.g., a balance 1500 is mapped to "0100", a transaction amount is mapped to "0010", a tag setting 3 of the money collection is mapped to "0011", and a tag setting 1 of the general transfer is mapped to "0001"); the χ is used to indicate the mapping parameters. When mapping the original data, the dimension of the mapped feature value may be customized by the user according to the actual service requirement, which is not limited herein.

Optionally, in this embodiment, the behavior sequence is used as an input feature, and since the behavior sequence may include remark names of operation behaviors, the remark names cannot be directly input into the computer. Thus, coding or vectorizing the sequence of actions may be considered. Specifically, a word vectorization algorithm (e.g., word2vector or cw2vec, etc.) or a text classification (fasttext) algorithm may be employed to encode or vectorize the behavior sequence.

The word2vector is essentially a three-layer neural network, and an exemplary structure thereof may be shown in fig. 1, and includes an input layer, a hidden layer, and an output layer. The dimensions of the input layer and the output layer are V, the V is the size of the corpus dictionary, and the dimensions of the hidden layer are N. The selection of N requires that the last N is determined by scaling the perception, and the model effect and the model complexity are weighted. In this configuration, the neurons of the hidden layer are not activated or an input or output identity function is used as an activation function; neurons of the output layer employ softmax as an activation function. In practical applications, the weight matrix from the input layer to the hidden layer is an embedded vector corresponding to each word, so the weight matrix is also called a word vector matrix. The embedded vector dimension of each word is determined by N of the weight matrix.

The data processing method, the device, the equipment and the storage medium provided by the embodiment of the application can improve the recognition effect on abnormal operation. An exemplary application of the electronic device provided by the embodiment of the present application is described below, where the electronic device provided by the embodiment of the present application may be implemented as various types of user terminals, and may also be implemented as a server.

The electronic equipment can improve the recognition effect of abnormal operation by running the data processing scheme provided by the embodiment of the application. Namely, the recognition effect of the electronic equipment on abnormal operation is improved, and the method can be suitable for payment scenes, and can also be applied to scenes in which other fraudulent behaviors possibly occur, such as game blackout and the like.

Referring to fig. 2, fig. 2 is a schematic diagram of an alternative architecture in an application scenario of the data processing scheme provided in the embodiment of the present application, in order to support a data processing scheme, the terminal device 100 is connected to the server 300 through the network 200, the server 300 is connected to the database 400, and the network 200 may be a wide area network or a local area network, or a combination of the two. The client for implementing the data processing scheme is disposed on the terminal device 100, where the client may run on the terminal device 100 in a browser mode, may also run on the terminal device 100 in a form of a stand-alone Application (APP), and the specific presentation form of the client is not limited herein. The server 300 according to the present application may be an independent physical server, a server cluster or a distributed system formed by a plurality of physical servers, or a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), basic cloud computing services such as big data and artificial intelligence platforms. The terminal device 100 may be, but is not limited to, a smart phone, a tablet computer, a notebook computer, a palm computer, a personal computer, a smart television, a smart watch, a vehicle-mounted device, a wearable device, etc. The terminal device 100 and the server 300 may be directly or indirectly connected through the network 200 by wired or wireless communication, and the present application is not limited herein. The number of servers 300 and terminal devices 100 is also not limited. The scheme provided by the application can be independently completed by the terminal equipment 100, can be independently completed by the server 300, and can be completed by the cooperation of the terminal equipment 100 and the server 300, so that the application is not particularly limited. The database 400 may be considered as an electronic file cabinet, i.e. a place where electronic files are stored, and a user may perform operations such as adding, querying, updating, deleting, etc. on data in the files. A "database" is a collection of data stored together in a manner that can be shared with multiple users, with as little redundancy as possible, independent of the application. The database management system (Database Management System, DBMS) is a computer software system designed for managing databases, and generally has basic functions of storage, interception, security, backup, and the like. The database management system may classify according to the database model it supports, e.g., relational, extensible markup language (Extensible Markup Language, XML); or by the type of computer supported, e.g., server cluster, mobile phone; or by classification according to the query language used, e.g. structured query language (Structured Query Language, SQL), XQuery; or by performance impact emphasis, such as maximum scale, maximum speed of operation; or other classification schemes. Regardless of the manner of classification used, some DBMSs are able to support multiple query languages across categories, for example, simultaneously. In the present application, the database 400 may be used to store the training samples and the historical operation behaviors of the target object, and of course, the storage locations of the training samples and the historical operation behaviors of the target object are not limited to the database, and may be stored in the terminal device 100, the blockchain, or the distributed file system of the server 300, for example.

In some embodiments, both the server 300 and the terminal device 100 may execute the data processing method and the training method of the recognition model in the data processing method provided in the embodiments of the present application, where the recognition model includes a multi-layer neural network. An exemplary network architecture diagram of the recognition model is shown in fig. 3, wherein the recognition model includes bidirectional LSTM, CNN, and fully connected neural network (FC), wherein the bidirectional LSTM, CNN, and fully connected neural network (FC) are cascade connected. The LSTM network is a cyclic neural network for processing sequence data, and has better performance on learning context in a long sequence; CNN is a feed-forward neural network that can extract abrupt features between neighboring operations; the fully-connected network maps the characteristics output by the CNN network from high-dimensional characteristics to characteristics convenient for classification, and meanwhile, the complexity of the model is increased, so that the complex behavior of the model fitting is facilitated. It is understood that the LSTM network may be replaced by other time-series neural networks or convolutional networks, and is not limited in this particular regard. When the training method of the recognition model is executed, the specific flow thereof can be as follows: acquiring a training sample from the terminal equipment 100 and/or the database 400 and establishing an initial recognition model; the training sample is detected through an initial recognition model to obtain probability distribution, a corresponding loss value between the probability distribution and a real label is determined according to a loss function comprising a pre-designed loss factor, and then parameters of the recognition model are adjusted according to back propagation of the loss value, so that training of the initial recognition model is achieved to obtain the recognition model.

In this embodiment, the server 300 calculates the loss value as a plurality of loss functions, such as a cross entropy loss function or a relative entropy loss function or a normalized loss function, when training the recognition model. In one exemplary scenario, a cross entropy loss function is used, and the specific calculation process may use equation 1:

wherein, the C is used for indicating the number of classification categories, and the y _i For indicating sample tags, p _i For indicating the predicted probability value. In this embodiment, the number of classification categories and the sample tag may be customized by the user according to the actual service requirement. For example, if the user labels the sample features in the training sample into two classes, i.e. suspicious objects and normal objects, then the classification class number is 2, and the sample label can be set to 0 and 1. It will be appreciated that in order to make the sample tag have the learning properties of a neural network, the tag values (e.g., 0 and 1) of the sample tag may be encoded as feature vectors using a one-hot code, i.eAt this time, the C is used to indicate the dimension of the feature vector after the sample tag is encoded. Assuming that the feature vector is a two-dimensional vector, the rest of the positions are set to 0 except for the corresponding type of position set to 1, and the tag values of the sample tags are 0 and 1, (0, 1) and (1, 0) after the one-hot encoding.

It should be understood that the sample feature labeling label of the training sample may be set by the user to a plurality of categories, such as suspicious objects under the risk of the first category of transaction, suspicious objects under the risk of the second category of transaction, suspicious objects under the risk of the third category of transaction, and so on. At this time, the number of classification categories is also adjusted accordingly, and the number of probability values in the predictive probability vector outputted by the recognition model is also adjusted accordingly.

In this embodiment, the operation of acquiring the data of the training sample may be performed by collecting the operation behavior data of the user in the application scenario, and then reporting the collected operation behavior data according to a preset reporting condition. For example, all operation behavior data is reported every 2 hours or after the number of transactions reaches the preset data.

In this embodiment, when the initial recognition model is trained according to the loss value, an optimizer may be used to reversely adjust parameters of the initial recognition model according to the loss value. It will be appreciated that the optimizer may select an ADAM optimizer, which is one of the most commonly used optimizers for deep learning, that calculates the adaptive learning rate of each parameter of the neural network based on momentum, requiring only a small amount of tuning, thereby speeding up model training efficiency.

After training the recognition model, the server 300 may save the recognition model locally, thereby providing the terminal device 100 with a remote abnormal operation recognition function. For example, the server 300 may receive the behavior sequence sent by the terminal device 100, and perform detection processing on the behavior sequence through the recognition model to obtain a predicted probability value corresponding to the classification category involved in the behavior sequence; and finally, determining an identification result of the target object according to the predicted probability value, and sending the identification result to a payment management platform so that the payment management platform performs corresponding operation on the target object. Such as displaying a prompt that there is a risk of the transaction or that the transaction is terminated, etc., in the terminal device 100 used by the target object.

The server 300 may also transmit (deploy) the trained recognition model to the terminal device 100, thereby implementing recognition of abnormal operations locally at the terminal device 100. For example, the terminal device 100 may acquire operation behavior data in real time or acquire a behavior sequence from other devices, and perform detection processing on the behavior sequence through an identification model to obtain a predicted probability value corresponding to a classification category involved in the behavior sequence; and finally, determining an identification result of the target user according to the predicted probability value, and sending the identification result to a payment management platform so that the payment management platform performs corresponding operation on the target object. Such as displaying a prompt that there is a risk of the transaction or that the transaction is terminated, etc., in the terminal device 100 used by the target object.

Based on the above system, referring specifically to fig. 4, an execution flow of the data processing method in the present application may be as follows:

step 1, acquiring a behavior sequence of a target object. Wherein the behavior sequence may be expressed as V ₁ ＝{v ₁ ,v ₂ ,…,v _N }。

And step 2, embedding and representing the behavior sequence to obtain a behavior sequence vector.

And step 3, inputting the behavior sequence vector into the recognition model to obtain a prediction probability value.

And 4, determining the identification result of the target user according to the predicted probability value.

It will be appreciated that in the specific embodiments of the present application, related data such as behavior sequences are involved, and when the above embodiments of the present application are applied to specific products or technologies, user permissions or consents need to be obtained, and the collection, use and processing of related data need to comply with related laws and regulations and standards of related countries and regions.

With reference to the foregoing description, the following describes a data processing method according to the present application with a terminal device as an execution body, and referring to fig. 5, an embodiment of the data processing method according to the present application includes:

501. and acquiring a behavior sequence of the target object, wherein the behavior sequence is used for indicating the operation sequence generated by the historical operation behavior set of the target object according to the time sequence arrangement.

The terminal equipment acquires the operation behavior data of the target object in an application scene, and then the operation behavior data are sequenced and spliced according to a time sequence in a time window to obtain a behavior sequence of the target object.

In one exemplary scenario, taking third party payment A as an example, the operational actions include registering an account number, logging out an account number, receiving a payment transaction, binding a transaction card object, and so forth. Assume thatWithin two hours of the target object, the operational behavior data within third party paymate a includes four transaction operational behaviors. The transaction operation behaviors are as follows: "Cascade_Normal transfer_balance 1500_non-friend non-Co-City_transaction time 12 Point_transaction amount 700", "Payment_Normal transfer_balance 1000_friend Co-City_transaction time 13 Point_transaction amount 500", "Payment_Normal transfer_balance 700_non-friend Co-City_transaction time 14 Point_transaction amount 300", "Cascade_Red_balance 800_friend non-Co-City_transaction time 18 Point_transaction amount 100". Then splicing the characteristic representations corresponding to different operation behaviors of the target object according to the time sequence to obtain a behavior sequence V of the target object ₁ ＝{v ₁ ,v ₂ ,v ₃ ,v ₄ }. Wherein the v is ₁ For "Cascade_Normal transfer_balance 1500_non-friend non-Co-City_transaction time 12 Point_transaction amount 700", v ₂ For "pay-ordinary transfer-balance 1000 friends co-city transaction time 13 points transaction amount 500", the v is ₃ For "Payment_common transfer_balance 700_non-friend Co-City_transaction time 14 Point_transaction amount 300", v ₄ For "collect_red_balance 800_friend not co-city_transaction time 18_transaction amount 100".

502. The behavior sequence is embedded to represent the behavior sequence to obtain a behavior sequence vector.

The terminal device takes the behavior sequence as the input characteristic of the recognition model, and the behavior sequence possibly contains remark names of operation behaviors and cannot be directly input into the computer. Thus, coding or vectorizing the sequence of actions may be considered. Specifically, a word vectorization algorithm (e.g., word2vector or cw2vec, etc.) or a text classification (fasttext) algorithm may be employed to encode or vectorize the behavior sequence. The word2vector is essentially a three-layer neural network, and includes an input layer, a hidden layer and an output layer. The dimensions of the input layer and the output layer are V, the V is the size of the corpus dictionary, and the dimensions of the hidden layer are N. The selection of N requires that the last N is determined by scaling the perception, and the model effect and the model complexity are weighted. In this configuration, the neurons of the hidden layer are not activated or an input or output identity function is used as an activation function; neurons of the output layer employ softmax as an activation function. In practical applications, the weight matrix from the input layer to the hidden layer is an embedded vector corresponding to each word, so the weight matrix is also called a word vector matrix. The embedded vector dimension of each word is determined by N of the weight matrix.

When the terminal device performs embedded representation through the word2vector model, the specific operation of the terminal device may be as follows: carrying out single-hot code encoding on the behavior sequence to obtain an N-dimensional vector representation, wherein N is a positive integer; inputting the N-dimensional vector representation into an input layer of the word2vec model, and multiplying the N-dimensional vector representation with a first weight matrix to obtain a first vector representation, wherein the first weight matrix is a weight matrix from the input layer of the word2vec model to a hidden layer of the word2vec model; mapping the first vector representation to a hidden layer of the word2vec model to obtain a second vector representation; multiplying the second vector representation with a second weight matrix to obtain a third vector representation, wherein the second weight matrix is a weight matrix from a hidden layer of the word2vec model to an output layer of the word2vec model; and inputting the third vector representation into the word2vec model to perform regression processing to obtain the behavior sequence vector. In this embodiment, in order to reduce the amount of computation, the dimension of the word2vector model hidden layer may be selected to be much smaller than the N dimension. While word2vec may make the mathematical properties of the word vector of the behavior sequence in space correspond to the nature of the operational behavior itself. For example, in practice the distances of similar actions in vector space should be similar, etc.

503. The behavior sequence vector is input into an identification model to obtain a predicted probability value, the identification model comprises a two-way long-short-term memory artificial neural network, a convolution neural network and a full-connection neural network, wherein the long-short-term memory artificial neural network, the convolution neural network and the full-connection neural network are sequentially stacked, the long-short-term memory artificial neural network is used for encoding the behavior sequence vector, the behavior sequence vector is mapped into an M-dimensional vector, the value of M is larger than the dimension value of the behavior sequence vector, the convolution neural network is used for obtaining the mutation characteristics of adjacent actions in the behavior sequence, and the full-connection neural network is used for mapping the output result of the convolution neural network into the predicted probability value.

In this embodiment, the recognition model is a network structure as shown in fig. 2, and the behavior sequence vector is input into the LSTM network first, and the high-dimensional feature of the behavior sequence is learned through the LSTM network; then the LSTM inputs the high-dimensional feature into the CNN, and learns mutation features between each adjacent operation behaviors in the behavior sequence through the CNN; and then inputting the characteristics output by the CNN into the fully-connected neural network, mapping the high-dimensional characteristics into C-dimensional characteristics through the fully-connected neural network, and classifying according to the C-dimensional characteristics to obtain the prediction probability value, wherein the C is used for indicating the classification category number. In this embodiment, a softmax layer may be added to the recognition model after the fully connected neural network, and then the result of the C-dimensional feature is normalized by using the softmax layer to obtain a normalized predicted probability value with a value of 0 to 1. In this scheme, the behavior sequence is ordered according to the time sequence, so that the behavior sequence is a time sequence sample. Thus, in this embodiment, the LSTM network, the convolutional network, or the time-series neural network may be used to better preserve the long-period characteristic, that is, a time-varying characteristic of the behavior sequence. The CNN can extract and extract the relation between adjacent operation behaviors in the behavior sequence, so that mutation characteristics among the operation behaviors are obtained, and suspicious characteristics are searched. The fully-connected neural network maps the LSTM network or the convolutional network or the time sequence neural network and the CNN learned high-dimensional features to C-dimensional features, so that the complexity of a model is increased, complex behaviors are fitted by the model, and the feature change of a behavior sequence is learned better.

504. And determining the recognition result of the target object according to the predicted probability value.

And the server compares the predicted probability value with a preset threshold value, and determines that the recognition result of the target object is a suspicious object when the predicted probability value is larger than the preset threshold value.

In this embodiment, the predicted probability value may be one value or a plurality of values. When the prediction probability value is multiple, the number of the prediction probabilities included in the prediction probability value is the number of the classification categories set in the recognition model, and the value of each prediction probability in the prediction probability vector can be set according to the actual classification category, that is, the summation result of each prediction probability is 1 or each prediction probability does not affect each other. When the predicted probability value comprises a plurality of predicted probabilities, the server compares each predicted probability in the predicted probability value with a preset threshold, and when the predicted probability corresponding to the kth classification category in the predicted probability value is greater than the preset threshold, the server determines that the recognition result of the target user is the kth classification category, and k is an integer. In this embodiment, the number of the prediction probabilities is the number of the classification categories set in the recognition model, and the values of the prediction probabilities in the prediction probability values may be set according to the actual classification categories, that is, the summation result of the prediction probabilities is 1 or the prediction probabilities do not affect each other.

In one exemplary scenario, if the predicted probability value includes two classification categories, and the classification categories are suspicious objects and normal objects, then the sum of the two probability values in the predicted probability value is 1, for example, the predicted probability value may be (0.4,0.6). At this time, assuming that the preset threshold is 0.5, if the probability value indicating the suspicious object is 0.6, determining that the target object is the suspicious object as the recognition result of the target object.

In another exemplary scenario, if the predicted probability value includes three classification categories, and the classification categories are the first class transaction risk suspicious object, the second class transaction risk suspicious object, and the third class transaction risk suspicious object, then the three probability values in the predicted probability value may not affect each other, for example, the predicted probability value may be (0.7,0.8,0.2). At this time, if the preset threshold is assumed to be 0.6 and the probability value indicating the first type transaction risk suspicious object is 0.7 and the probability value indicating the second type transaction risk suspicious object is 0.8, determining that the target object is the target object as the first type transaction risk suspicious object and the second type transaction risk suspicious object.

In this embodiment, after the server identifies the target object as a suspicious object, the server may perform a corresponding operation on the target object. Specifically, the processing of the target object includes sending a warning prompt to the target object and forcibly intercepting the transaction operation of the target object.

Referring to fig. 6, fig. 6 is a schematic diagram illustrating an embodiment of a data processing apparatus according to an embodiment of the present application, and the data processing apparatus 20 includes:

an obtaining module 201, configured to obtain a behavior sequence of a target object, where the behavior sequence is used to instruct a historical operation behavior set of the target object to arrange the generated operation sequences according to a time sequence;

a processing module 202, configured to embed the behavior sequence to obtain a behavior sequence vector; inputting the behavior sequence vector into an identification model to obtain a predicted probability value, wherein the identification model comprises a bidirectional long-short-term memory artificial neural network, a convolution neural network and a full-connection neural network, the bidirectional long-short-term memory artificial neural network, the convolution neural network and the full-connection neural network are sequentially stacked, the long-short-term memory artificial neural network is used for encoding the behavior sequence vector, the behavior sequence vector is mapped into an M-dimensional vector, the value of M is larger than the dimension value of the behavior sequence vector, the convolution neural network is used for acquiring the mutation characteristics of adjacent actions in the behavior sequence, and the full-connection neural network is used for mapping the output result of the convolution neural network into the predicted probability value; and determining the recognition result of the target object according to the predicted probability value.

The embodiment of the application provides a data processing device. By adopting the device, the behavior sequence of the target object represents the richer characteristic information of the target object, so that the recognition accuracy of abnormal operation is improved. Meanwhile, the recognition model comprises a Long Short-Term Memory (LSTM) and a convolutional neural network (Convolutional Neural Network, CNN), so that the behavior sequence is learned based on the recognition model, the characteristics of the behavior sequence for a Long time can be learned by using the LSTM, and the characteristics of adjacent actions in the behavior sequence can be fused and extracted by using the CNN, so that the recognition accuracy of abnormal operation can be improved.

Alternatively, in another embodiment of the data processing apparatus 20 according to the embodiment of the present application based on the embodiment corresponding to fig. 6,

the obtaining module 201 is specifically configured to obtain a plurality of sets of feature representations corresponding to a set of historical operation behaviors of the target object in a time window, where the feature representations are used to describe the historical operation behaviors, and one of the set of historical operation behaviors corresponds to a set of feature representations;

The embodiment of the application provides a data processing device. By adopting the device, the operation behaviors are described by utilizing various characteristic representations, so that the representations of the operation behaviors are enriched, and the reliability of data processing is improved.

Optionally, on the basis of the embodiment corresponding to fig. 6, in another embodiment of the data processing apparatus 20 provided in the embodiment of the present application, the historical operation behavior in the set of historical operation behaviors includes at least one of a registered account number, a log-off account number, a pay-for transaction, and a bound transaction card object.

The embodiment of the application provides a data processing device. By adopting the device, a specific application scene is provided, and the composition mode of the behavior sequence is intuitively displayed, so that the behavior sequence is determined to be capable of abundantly representing the operation behaviors of a user, and the recognition effect of the recognition result is further improved.

Optionally, in another embodiment of the data processing apparatus 20 according to the embodiment of fig. 6, the characteristic representation includes a transaction direction, a transaction scenario, a transaction manner, a relationship between transaction objects, a transaction time and a transaction amount when the historical operation behavior is a receipt transaction.

the processing module 202 is specifically configured to obtain the behavior sequence vector by performing embedded representation on the behavior sequence through a word2vec model.

The embodiment of the application provides a data processing device. With the device, word2vec can make the mathematical characteristics of the word vector of the behavior sequence correspond to the own properties of the operation behavior in space. For example, distances of similar actions in a vector space in practice should be similar, so that stability of a behavior sequence vector is ensured, and recognition effect of a recognition model is improved.

The processing module 202 is specifically configured to perform one-hot code encoding on the behavior sequence to obtain an N-dimensional vector representation, where N is a positive integer;

the processing module 202 is specifically configured to input the behavior sequence vector into a two-way long-short-term memory artificial neural network of the recognition model to perform encoding to obtain a first intermediate vector of the behavior sequence vector;

The embodiment of the application provides a data processing device. By adopting the device, the behavior sequence of the target object represents the richer characteristic information of the target object, so that the recognition accuracy of abnormal operation is improved. Meanwhile, the recognition model comprises a bidirectional LSTM) and a CNN, so that the behavior sequence is learned based on the recognition model, the characteristics of the behavior sequence for a long time can be learned by utilizing the bidirectional LSTM, and the characteristics of adjacent actions in the behavior sequence can be fused and extracted by utilizing the CNN, so that the recognition accuracy of abnormal operation can be improved.

the processing module 202 is specifically configured to set a preset threshold according to a service requirement;

The embodiment of the application provides a data processing device. By adopting the device, the preset threshold is set according to the actual service demand, and the recognition result of the target object is determined from the plurality of classification categories obtained by prediction according to the preset threshold, so that the recognition effect can be adjusted according to the actual service demand, the recognition model is more targeted, and the recognition effect is improved.

the obtaining module 201 is further configured to obtain a training sample and an initial recognition model, where each sample in the training sample includes a sample tag and a training behavior sequence, the sample tag is used to indicate that the training sample is a suspicious object or a normal object, and the initial recognition model includes an initial two-way long-short-term memory artificial neural network, an initial convolutional neural network, and an initial fully-connected neural network, where the initial two-way long-short-term memory artificial neural network, the initial convolutional neural network, and the initial fully-connected neural network are stacked in sequence;

The processing module 202 is further configured to input the training sample into the initial recognition model to obtain a training probability value; calculating according to the training probability value and the sample label to obtain a loss value; and learning network parameters of the initial recognition model according to the loss value to obtain the recognition model.

The embodiment of the application provides a data processing device. By adopting the device, the behavior sequence of the target object represents the richer characteristic information of the target object, so that the recognition accuracy of abnormal operation is improved. Meanwhile, the recognition model comprises the bidirectional LSTM and the CNN, so that the behavior sequence is learned based on the recognition model, the characteristics of the behavior sequence for a long time can be learned by utilizing the bidirectional LSTM, and the characteristics of adjacent actions in the behavior sequence can be fused and extracted by utilizing the CNN, so that the recognition accuracy of abnormal operation can be improved.

the processing module 202 is specifically configured to calculate the loss function according to the training probability value and the sample tag by using a target loss function.

The embodiment of the application provides a data processing device. By adopting the device, the loss value can be conveniently calculated, so that the training efficiency is improved.

Optionally, on the basis of the embodiment corresponding to fig. 6, in another embodiment of the data processing apparatus 20 provided by the embodiment of the present application, the target loss function is a cross entropy loss function, a relative entropy loss function or a normalized loss function.

The embodiment of the application provides a data processing device. With the above arrangement, a variety of loss functions are provided, thereby increasing the feasibility of the scheme.

the processing module 202 is further configured to send a prompt message to the target object when the recognition result indicates that the target object is a suspicious object;

or alternatively, the process may be performed,

The embodiment of the application provides a data processing device. By adopting the device, a plurality of modes capable of prompting the target object are provided, so that the target object is effectively prevented from transaction risk.

Referring to fig. 7, fig. 7 is a schematic diagram of a server structure according to an embodiment of the present application, where the server 300 may have a relatively large difference due to different configurations or performances, and may include one or more central processing units (central processing units, CPU) 322 (e.g., one or more processors) and a memory 332, one or more storage media 330 (e.g., one or more mass storage devices) storing application programs 342 or data 344. Wherein the memory 332 and the storage medium 330 may be transitory or persistent. The program stored on the storage medium 330 may include one or more modules (not shown), each of which may include a series of instruction operations on a server. Still further, the central processor 322 may be configured to communicate with the storage medium 330 and execute a series of instruction operations in the storage medium 330 on the server 300.

The Server 300 may also include one or more power supplies 326, one or more wired or wireless network interfaces 350, one or more input/output interfaces 358, and/or one or more operating systems 341, such as Windows Server ^TM ，Mac OS X ^TM ，Unix ^TM ,Linux ^TM ，FreeBSD ^TM Etc.

The steps performed by the server in the above embodiments may be based on the server structure shown in fig. 7.

The data processing apparatus provided by the present application may be used in a terminal device, please refer to fig. 8, which only shows a portion related to an embodiment of the present application for convenience of explanation, and specific technical details are not disclosed, please refer to a method portion of an embodiment of the present application. In the embodiment of the application, a terminal device is taken as a smart phone for example to describe:

fig. 8 is a block diagram showing a part of a structure of a smart phone related to a terminal device provided by an embodiment of the present application. Referring to fig. 8, a smart phone includes: radio Frequency (RF) circuitry 410, memory 420, input unit 430, display unit 440, sensor 450, audio circuitry 460, wireless fidelity (wireless fidelity, wiFi) module 470, processor 480, and power supply 490. Those skilled in the art will appreciate that the smartphone structure shown in fig. 8 is not limiting of the smartphone and may include more or fewer components than shown, or may combine certain components, or a different arrangement of components.

The following describes each component of the smart phone in detail with reference to fig. 8:

The RF circuit 410 may be used for receiving and transmitting signals during the process of receiving and transmitting information or communication, in particular, after receiving downlink information of the base station, the downlink information is processed by the processor 480; in addition, the data of the design uplink is sent to the base station. In general, RF circuitry 410 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier (low noise amplifier, LNA), a duplexer, and the like. In addition, the RF circuitry 410 may also communicate with networks and other devices via wireless communications. The wireless communications may use any communication standard or protocol including, but not limited to, global system for mobile communications (global system of mobile communication, GSM), general packet radio service (general packet radio service, GPRS), code division multiple access (code division multiple access, CDMA), wideband code division multiple access (wideband code division multiple access, WCDMA), long term evolution (long term evolution, LTE), email, short message service (short messaging service, SMS), and the like.

The memory 420 may be used to store software programs and modules, and the processor 480 may perform various functional applications and data processing of the smartphone by executing the software programs and modules stored in the memory 420. The memory 420 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program (such as a sound playing function, an image playing function, etc.) required for at least one function, and the like; the storage data area may store data (such as audio data, phonebooks, etc.) created according to the use of the smart phone, etc. In addition, memory 420 may include high-speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid-state storage device.

The input unit 430 may be used to receive input numeric or character information and generate key signal inputs related to user settings and function control of the smart phone. In particular, the input unit 430 may include a touch panel 431 and other input devices 432. The touch panel 431, also referred to as a touch screen, may collect touch operations thereon or thereabout by a user (e.g., operations of the user on the touch panel 431 or thereabout using any suitable object or accessory such as a finger, a stylus, etc.), and drive the corresponding connection device according to a predetermined program. Alternatively, the touch panel 431 may include two parts of a touch detection device and a touch controller. The touch detection device detects the touch azimuth of a user, detects a signal brought by touch operation and transmits the signal to the touch controller; the touch controller receives touch information from the touch detection device and converts it into touch point coordinates, which are then sent to the processor 480, and can receive commands from the processor 480 and execute them. In addition, the touch panel 431 may be implemented in various types such as resistive, capacitive, infrared, and surface acoustic wave. The input unit 430 may include other input devices 432 in addition to the touch panel 431. In particular, other input devices 432 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, mouse, joystick, etc.

The display unit 440 may be used to display information input by a user or information provided to the user and various menus of the smart phone. The display unit 440 may include a display panel 441, and optionally, the display panel 441 may be configured in the form of a liquid crystal display (liquid crystal display, LCD), an organic light-emitting diode (OLED), or the like. Further, the touch panel 431 may cover the display panel 441, and when the touch panel 431 detects a touch operation thereon or nearby, the touch operation is transmitted to the processor 480 to determine the type of the touch event, and then the processor 480 provides a corresponding visual output on the display panel 441 according to the type of the touch event. Although in fig. 8, the touch panel 431 and the display panel 441 are two separate components to implement the input and input functions of the smart phone, in some embodiments, the touch panel 431 and the display panel 441 may be integrated to implement the input and output functions of the smart phone.

The smartphone may also include at least one sensor 450, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor that may adjust the brightness of the display panel 441 according to the brightness of ambient light, and a proximity sensor that may turn off the display panel 441 and/or the backlight when the smartphone is moved to the ear. As one of the motion sensors, the accelerometer sensor can detect the acceleration in all directions (generally three axes), and can detect the gravity and direction when stationary, and can be used for identifying the application of the gesture of the smart phone (such as horizontal and vertical screen switching, related games, magnetometer gesture calibration), vibration identification related functions (such as pedometer and knocking), and the like; other sensors such as gyroscopes, barometers, hygrometers, thermometers, infrared sensors, etc. that may also be configured with the smart phone are not described in detail herein.

Audio circuitry 460, speaker 461, microphone 462 can provide an audio interface between the user and the smartphone. The audio circuit 460 may transmit the received electrical signal after the audio data conversion to the speaker 461, and the electrical signal is converted into a sound signal by the speaker 461 and output; on the other hand, microphone 462 converts the collected sound signals into electrical signals, which are received by audio circuit 460 and converted into audio data, which are processed by audio data output processor 480, and transmitted via RF circuit 410 to, for example, another smart phone, or which are output to memory 420 for further processing.

WiFi belongs to a short-distance wireless transmission technology, and a smart phone can help a user to send and receive emails, browse webpages, access streaming media and the like through a WiFi module 470, so that wireless broadband Internet access is provided for the user. Although fig. 8 shows a WiFi module 470, it is understood that it does not belong to the necessary constitution of a smart phone, and can be omitted entirely as needed within the scope of not changing the essence of the invention.

The processor 480 is a control center of the smart phone, connects various parts of the entire smart phone using various interfaces and lines, and performs various functions and processes data of the smart phone by running or executing software programs and/or modules stored in the memory 420 and invoking data stored in the memory 420, thereby performing overall monitoring of the smart phone. Optionally, the processor 480 may include one or more processing units; alternatively, the processor 480 may integrate an application processor that primarily handles operating systems, user interfaces, applications, etc., with a modem processor that primarily handles wireless communications. It will be appreciated that the modem processor described above may not be integrated into the processor 480.

The smart phone also includes a power supply 490 (e.g., a battery) for powering the various components, optionally in logical communication with the processor 480 through a power management system that performs functions such as managing charge, discharge, and power consumption.

Although not shown, the smart phone may further include a camera, a bluetooth module, etc., which will not be described herein.

The steps performed by the terminal device in the above embodiments may be based on the terminal device structure shown in fig. 8.

Embodiments of the present application also provide a computer-readable storage medium having a computer program stored therein, which when run on a computer, causes the computer to perform the method as described in the foregoing embodiments.

Embodiments of the present application also provide a computer program product comprising a program which, when run on a computer, causes the computer to perform the method described in the previous embodiments.

It will be clear to those skilled in the art that, for convenience and brevity of description, specific working procedures of the above-described systems, apparatuses and units may refer to corresponding procedures in the foregoing method embodiments, which are not repeated herein.

In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices, and methods may be implemented in other manners. For example, the apparatus embodiments described above are merely illustrative, e.g., the division of the units is merely a logical function division, and there may be additional divisions when actually implemented, e.g., multiple units or components may be combined or integrated into another system, or some features may be omitted or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or units, which may be in electrical, mechanical or other form.

The units described as separate units may or may not be physically separate, and units shown as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional unit in the embodiments of the present application may be integrated in one processing unit, or each unit may exist alone physically, or two or more units may be integrated in one unit. The integrated units may be implemented in hardware or in software functional units.

The integrated units, if implemented in the form of software functional units and sold or used as stand-alone products, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application may be embodied essentially or in part or all of the technical solution or in part in the form of a software product stored in a storage medium, including instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method according to the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a read-only memory (ROM), a random access memory (random access memory, RAM), a magnetic disk, or an optical disk, or other various media capable of storing program codes.

The above embodiments are only for illustrating the technical solution of the present application, and not for limiting the same; although the application has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical scheme described in the foregoing embodiments can be modified or some technical features thereof can be replaced by equivalents; such modifications and substitutions do not depart from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method of data processing, comprising:

acquiring a behavior sequence of a target object, wherein the behavior sequence is used for indicating an operation sequence generated by a historical operation behavior set of the target object according to time sequence arrangement;

embedding and representing the behavior sequence to obtain a behavior sequence vector;

inputting the behavior sequence vector into an identification model to obtain a predicted probability value, wherein the identification model comprises a two-way long-short-term memory artificial neural network, a convolution neural network and a full-connection neural network, the long-short-term memory artificial neural network, the convolution neural network and the full-connection neural network are sequentially stacked, the long-short-term memory artificial neural network is used for encoding the behavior sequence vector and mapping the behavior sequence vector into an M-dimensional vector, the value of M is larger than the dimensional value of the behavior sequence vector, the convolution neural network is used for obtaining the mutation characteristics of adjacent actions in the behavior sequence, and the full-connection neural network is used for mapping the output result of the convolution neural network into the predicted probability value;

and determining the recognition result of the target object according to the predicted probability value.

2. The method of claim 1, wherein the obtaining the behavior sequence of the target object comprises:

acquiring a plurality of groups of characteristic representations corresponding to a historical operation behavior set of the target object in a time window, wherein the characteristic representations are used for describing the historical operation behaviors, and one historical operation behavior in the historical operation behavior set corresponds to one group of characteristic representations;

and splicing the plurality of groups of characteristic representations according to a time sequence to obtain the behavior sequence.

3. The method of claim 2, wherein the historical operational behavior in the set of historical operational behaviors includes at least one of a registered account number, a logoff account number, a pay-as-you-go transaction, a bound transaction card object.

4. A method according to claim 3, wherein the characteristic representation includes transaction direction, transaction scenario, transaction style, relationship between transaction objects, transaction time and transaction amount when the historical operational behaviour is a receipt transaction.

5. The method of claim 1, wherein embedding the behavior sequence representation to obtain a behavior sequence vector comprises:

and embedding and representing the behavior sequence through a word2vec model to obtain the behavior sequence vector.

6. The method of claim 5, wherein the embedding the behavior sequence through word2vec to obtain the behavior sequence vector comprises:

performing one-hot code encoding on the behavior sequence to obtain an N-dimensional vector representation, wherein N is a positive integer;

7. The method of claim 1, wherein inputting the behavior sequence vector into an identification model to obtain a predictive probability value comprises:

Inputting the behavior sequence vector into a two-way long-short-term memory artificial neural network of the recognition model for coding to obtain a first intermediate vector of the behavior sequence vector;

and obtaining the prediction probability value through the fully-connected neural network by the second intermediate vector.

8. The method of claim 1, wherein determining the recognition result of the target object based on the predicted probability value comprises:

setting a preset threshold according to service requirements;

9. The method according to any one of claims 1 to 8, further comprising:

obtaining training samples and an initial recognition model, wherein each sample in the training samples comprises a sample tag and a training behavior sequence, the sample tag is used for indicating that the training samples are suspicious objects or normal objects, and the initial recognition model comprises an initial two-way long-short-term memory artificial neural network, an initial convolution neural network and an initial full-connection neural network, wherein the initial two-way long-short-term memory artificial neural network, the initial convolution neural network and the initial full-connection neural network are stacked in sequence;

Inputting the training sample into the initial recognition model to obtain a training probability value;

10. The method of claim 9, wherein the calculating a loss value from the training probability value and the sample tag comprises:

and calculating the loss function by utilizing a target loss function according to the training probability value and the sample label.

11. The method of claim 10, wherein the target loss function is a cross entropy loss function, a relative entropy loss function, or a normalized loss function.

12. The method according to any one of claims 1 to 8, wherein after determining the recognition result of the target object according to the predicted probability value, the method further comprises:

when the identification result indicates that the target object is a suspicious object, prompt information is sent to the target object;

or alternatively, the process may be performed,

13. A data processing apparatus, comprising:

the system comprises an acquisition module, a processing module and a processing module, wherein the acquisition module is used for acquiring a behavior sequence of a target object, and the behavior sequence is used for indicating an operation sequence generated by a historical operation behavior set of the target object according to time sequence arrangement;

the processing module is used for carrying out embedded representation on the behavior sequence to obtain a behavior sequence vector; inputting the behavior sequence vector into an identification model to obtain a predicted probability value, wherein the identification model comprises a bidirectional long-short-term memory artificial neural network, a convolution neural network and a fully-connected neural network, the bidirectional long-short-term memory artificial neural network, the convolution neural network and the fully-connected neural network are sequentially stacked, the long-short-term memory artificial neural network is used for encoding the behavior sequence vector and mapping the behavior sequence vector into an M-dimensional vector, the value of M is larger than the dimensional value of the behavior sequence vector, the convolution neural network is used for obtaining the mutation characteristics of adjacent actions in the behavior sequence, and the fully-connected neural network is used for mapping the output result of the convolution neural network into the predicted probability value; and determining the recognition result of the target object according to the predicted probability value.

14. A computer device, comprising: a memory, a processor, and a bus system;

wherein the memory is used for storing programs;

the processor being for executing a program in the memory, the processor being for executing the method of any one of claims 1 to 12 according to instructions in program code;

the bus system is used for connecting the memory and the processor so as to enable the memory and the processor to communicate.

15. A computer readable storage medium comprising instructions which, when run on a computer, cause the computer to perform the method of any one of claims 1 to 12.