CN116992373A

CN116992373A - Data processing method, apparatus, device, storage medium and computer program product

Info

Publication number: CN116992373A
Application number: CN202210428243.XA
Authority: CN
Inventors: 樊鹏
Original assignee: Tencent Technology Shenzhen Co Ltd
Current assignee: Tencent Technology Shenzhen Co Ltd
Priority date: 2022-04-22
Filing date: 2022-04-22
Publication date: 2023-11-03

Abstract

The application discloses a data processing method, a device, equipment, a storage medium and a computer program product, which can be applied to the field or scene of artificial intelligence, cloud technology, blockchain, intelligent platform, application software and the like for identifying abnormal operation, wherein the method comprises the following steps: acquiring basic image characteristics and business characteristics of an object to be identified, wherein the object to be identified is associated with a target application, and the business characteristics are determined based on interaction data generated by the object to be identified aiming at the target application; the basic portrait features and the business features are fused to obtain fusion features; inputting the fusion characteristics into a target abnormal operation identification model for processing to obtain an abnormal operation identification result of the object to be identified about the target application; the target abnormal operation identification model is trained by combining a pseudo tag technology. By adopting the method and the device, the identification accuracy of the abnormal operation can be improved.

Description

Data processing method, apparatus, device, storage medium and computer program product

Technical Field

The present application relates to the field of artificial intelligence technology, and in particular, to a data processing method, a data processing apparatus, a data processing device, a computer readable storage medium, and a computer program product.

Background

With the development of computer, electronic, communication and other technologies, intelligent terminals (such as mobile phones and computers) are widely used in daily life of people, and various Applications (APP) are generated to meet the functional diversity demands of people on the intelligent terminals. Various applications bring convenience to people and enrich the experience of people. Some users may also perform abnormal operations with the application, such as performing operations such as malicious requests, swipe sheets, etc. with the application. Abnormal operation may increase the load of the application server, which is unfavorable for the operation of the application server; false operational data may also be generated, which may be detrimental to the analysis of the traffic involved in the application. Therefore, it is necessary to identify whether or not there is an abnormal operation.

Disclosure of Invention

The application provides a data processing method, a device, equipment, a storage medium and a computer program product, which can improve the identification accuracy of abnormal operation.

In one aspect, the present application provides a data processing method, including:

acquiring basic image characteristics and business characteristics of an object to be identified, wherein the object to be identified is associated with a target application, and the business characteristics are determined based on interaction data generated by the object to be identified aiming at the target application;

The basic portrait features and the business features are fused to obtain fusion features;

inputting the fusion characteristics into a target abnormal operation identification model for processing to obtain an abnormal operation identification result of the object to be identified about the target application;

the target abnormal operation identification model is obtained by training based on a first training sample set and a second training sample set, wherein the first training sample set comprises first sample data marked with labels and second sample data not marked with labels; the second training sample set is constructed based on the first sample data and second sample data for determining a pseudo tag, and the pseudo tag is a prediction tag obtained by processing the second sample data by using an abnormal operation identification model after initial training; the initial abnormal operation recognition model is obtained by training the initial abnormal operation recognition model by using the first sample data, and the target abnormal operation recognition model is obtained by training the initial abnormal operation recognition model by using a second training sample set; the sample data includes feature data of an associated object of the target application, and a tag of the sample data is used to indicate whether an abnormal operation exists in the associated object.

In one aspect, the present application provides a data processing apparatus comprising:

the system comprises an acquisition unit, a target application and a processing unit, wherein the acquisition unit is used for acquiring basic image characteristics and service characteristics of an object to be identified, the object to be identified is associated with the target application, and the service characteristics are determined based on interaction data generated by the object to be identified aiming at the target application;

the processing unit is used for carrying out fusion processing on the basic portrait characteristics and the service characteristics to obtain fusion characteristics;

the processing unit is also used for inputting the fusion characteristics into the target abnormal operation identification model for processing to obtain an abnormal operation identification result of the object to be identified, which relates to the target application;

In one implementation, the target abnormal operation identification model comprises a feature extraction module, a cross covariance aggregation module and a second order characterization aggregation module which are connected in parallel; inputs of the cross covariance aggregation module and the second order characterization aggregation module are respectively connected with outputs of the initial feature extraction module.

In one implementation, the processing unit is further configured to: inputting the fusion features into the feature extraction module for processing to obtain intermediate features; inputting the intermediate features into a cross covariance aggregation module for processing to obtain cross covariance features, and inputting the intermediate features into a second order characterization aggregation module for processing to obtain second order aggregation features; performing splicing treatment on the cross covariance characteristics and the second-order aggregation characteristics to obtain splicing characteristics; and determining an abnormal operation identification result of the object to be identified on the basis of the splicing characteristics.

In one implementation manner, the obtaining unit is further configured to obtain a basic representation of the object to be identified, where the basic representation includes one or more of an object basic attribute, a device basic attribute, a network connection attribute, and a geographic location attribute, where the device basic attribute, the network connection attribute, and the geographic location attribute are determined based on related data generated during operation of the target application by the object to be identified in the first period of time; the processing unit is also used for determining the basic image characteristics of the object to be identified according to the basic image.

In one implementation manner, the obtaining unit is further configured to obtain interaction data generated in a process that the object to be identified operates the target application in the second period of time, where the interaction data includes one or more of login operation related information, click information and conversion information for a specific service, application flow information, and trigger information of a specific function; the processing unit is also used for determining the service characteristics of the object to be identified according to the interaction data.

In one implementation, the processing unit is further configured to: normalizing the numerical type features in the basic image features, and discretizing the non-numerical type features in the basic image features to obtain the processed basic image features; normalizing the numerical type features in the service features, discretizing the non-numerical type features in the service features, and obtaining the processed service features; and carrying out fusion processing on the processed basic portrait features and the processed service features to obtain fusion features.

In one implementation, the processing unit is further configured to: inputting the intermediate features into a cross covariance aggregation module for processing, and determining normalized features of the intermediate features; calculating the outer product of the intermediate feature and the normalized feature; and carrying out vectorization processing on the outer products of the intermediate features and the normalized features to obtain cross covariance features.

In one implementation, the processing unit is further configured to: inputting the intermediate features into a second-order characterization aggregation module for processing to determine a feature matrix of the intermediate features; determining a second order aggregation matrix based on the feature matrix and a transposed matrix of the feature matrix; and calculating the square root of the matrix of the second order aggregation matrix, and carrying out vectorization processing on the square root of the matrix to obtain the second order aggregation characteristic.

In one aspect, the present application provides a data processing apparatus comprising a processor adapted to implement one or more computer programs; and a computer storage medium storing one or more computer programs loaded by the processor and implementing the data processing method provided by the present application.

In one aspect, the present application provides a computer readable storage medium storing a computer program comprising program instructions which, when executed by a processor, cause the processor to implement the data processing method provided by the present application.

In one aspect, the present application provides a computer program product comprising computer instructions stored in a computer readable storage medium. The processor of the computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device implements the data processing method provided by the present application.

The abnormal operation recognition model is trained by combining the pseudo tag technology, so that when the number of the sample data marked with the tag is insufficient to train the abnormal operation recognition model, the number of the sample data with the tag can be increased by determining the pseudo tag of the sample data not marked with the tag, the abnormal operation recognition model is trained, and the recognition accuracy of the trained abnormal operation recognition model is improved. When the abnormal operation is identified, the basic image characteristics and the business characteristics of the object to be identified which are related to the target application are acquired, the basic image characteristics and the business characteristics are fused to obtain the fusion characteristics, and then the fusion characteristics are input into the abnormal operation identification model which is trained by combining the pseudo tag technology for processing, so that an accurate identification result of the abnormal operation of the object to be identified about the target application can be obtained, the automatic identification of the abnormal operation can be realized by the mode, and the identification efficiency is higher.

Drawings

In order to more clearly illustrate the application or the technical solutions of the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it being obvious that the drawings in the description below are only some embodiments of the application, and that other drawings can be obtained from them without inventive effort for a person skilled in the art.

FIG. 1 is a schematic diagram of an abnormal operation recognition scenario provided in an embodiment of the present application;

FIG. 2 is a schematic diagram of a data processing system according to an embodiment of the present application;

FIG. 3 is a schematic flow chart of a data processing method according to an embodiment of the present application;

FIG. 4 is a schematic diagram of an aggregate calculation according to an embodiment of the present application;

FIG. 5 is a schematic diagram of a target abnormal operation recognition model according to an embodiment of the present application;

FIG. 6 is a schematic diagram of an abnormal operation recognition result according to an embodiment of the present application;

FIG. 7 is a schematic structural diagram of a training method for an abnormal operation recognition model according to an embodiment of the present application;

FIG. 8 is a flowchart of a training method for an abnormal operation recognition model according to an embodiment of the present application;

fig. 9a is a schematic diagram of a residual network structure according to an embodiment of the present application;

FIG. 9b is a schematic diagram of a process for implementing maximum pooling according to an embodiment of the present application;

FIG. 9c is a schematic diagram of a domain arbiter according to an embodiment of the present application;

FIG. 10 is a schematic diagram of a data processing apparatus according to an embodiment of the present application;

fig. 11 is a schematic structural diagram of a data processing device according to an embodiment of the present application.

Detailed Description

The following description of the embodiments of the present application will be made more apparent and fully hereinafter with reference to the accompanying drawings, in which some, but not all embodiments of the application are shown. All other embodiments, which can be made by those skilled in the art based on the embodiments of the application without making any inventive effort, are intended to be within the scope of the application.

For ease of understanding, the terms involved in the present application will be first described.

1. Machine learning

Belongs to one branch of artificial intelligence (Artificial Intelligence, AI) technology. Machine learning studies computers model or implement human learning to acquire new knowledge or skills, reorganizing existing knowledge structures to continually improve their own performance. It is an artificial intelligence core, which is the fundamental way to make computers intelligent. Deep Learning (DL) is a new research direction in the field of machine Learning, and Deep Learning is an inherent rule and presentation hierarchy of Learning sample data, and information obtained in the Learning process greatly helps to explain data such as text, image and sound. The final goal of deep learning is to enable a machine to analyze learning capabilities like a person, and to recognize text, images, and sound data.

2. Cloud technology/blockchain

The cloud technology is a hosting technology for unifying serial resources such as hardware, software, network and the like in a wide area network or a local area network to realize calculation, storage, processing and sharing of data; the blockchain is a novel application mode of computer technologies such as distributed data storage, point-to-point transmission, a consensus mechanism, an encryption algorithm and the like, is essentially a decentralised database, and is a series of data blocks which are generated by correlation by using a cryptography method, and each data block contains information of a batch of network transactions and is used for verifying the validity (anti-counterfeiting) of the information and generating a next block.

3. Convolutional neural network (Convolutional Neural Networks CNN)

CNN is a type of feedforward neural network (Feedforward Neural Networks) that includes convolution computation and has a deep structure, and is one of representative algorithms of deep learning (deep learning). Convolutional neural networks have the capability of token learning (representation learning) and are capable of performing a shift-invariant classification (shift-invariant classification) on input information in their hierarchical structure.

4. Reactive domain adaptation network (Generative Adversarial Network, GAN)

The GAN contains two models, one is a generative model (discriminative model) and one is a discriminant model (discriminative model). The task of generating the model is to generate an instance that looks natural and real, similar to the original data. The task of the discriminant model is to determine whether a given instance appears to be natural and authentic or artificially counterfeited (the authentic instance originates from the dataset and the counterfeited instance originates from the generative model). GAN can learn domain invariant features efficiently.

5. Second order characterization

Since the ultimate goal of deep convolutional neural networks is to delineate complex classification boundaries in high-dimensional space, the ability to enhance network modeling nonlinearities by learning higher-order characterizations is crucial. Similar to global averaging, global second order pooling is embedded at the end of the network, which characterizes the covariance of the samples as samples, and currently achieves leading performance in various business tasks such as image classification, fine-grained recognition, and target detection.

6. Pseudo tag technology

The definition of the pseudo tag technology is from semi-supervised learning, and the core is a process of predicting unlabeled data by using a model trained through labeled data, screening samples according to a prediction result, and inputting the samples into the model again for training.

Abnormal operation refers to abnormal behaviors of an operation object when the related application is used, and the abnormal behaviors not only affect the operation of the related application, but also affect the service experience of other normal operation objects. For example, fig. 1 is a schematic diagram of an abnormal operation recognition scenario provided by the embodiment of the present application, where fig. 1 shows a usage scenario of requesting to join an online conference, after a user enters the online conference APP, the user may input a login account number, a login password, a conference number, and a conference joining password according to an "input box 1", "input box 2", "input box 3", and "input box 4" in the drawing, and may perform conference joining setting by clicking an "join conference" icon to request to join the conference, by clicking options such as "open speaker", "open microphone", "open camera", and "open beauty" in an APP page. If the target object continuously inputs the wrong meeting number for multiple times, fails to continuously log in for multiple times, switches the login device or the login address for multiple times in a short time (such as within 30 minutes), the target object may be considered as a malicious request behavior of the online meeting. As shown in fig. 1, if the user inputs the wrong meeting password a plurality of times (e.g., 5 times) consecutively, after the abnormal behavior is identified, it can be determined that the user has abnormal operation. For another example, a certain account has actions of mass-sending illegal messages (such as malicious advertisements, unreal messages and the like), adding a large number of friends, abnormal purchasing behavior and the like, which indicates that the account may have risks such as theft.

In the process of researching the problem of abnormal operation identification, the application provides the following optimization schemes:

scheme one: and summarizing rules for manually identifying abnormal operations according to service experience of related staff, and manually identifying the abnormal operations.

Scheme II: the data mining method based on non-deep learning is used for constructing multidimensional features to perform model training, and a constant operation recognition model is obtained through training and is used for predicting the probability of abnormal operation.

As can be seen from the above method, according to the first scheme, the number of rules determined based on the experience of the staff is limited, and high-dimensional feature information of interactions between rules cannot be captured, and it is also difficult to determine the optimal parameters of each rule. For example, feature a is "male", feature B is "20 to 25 years old", but the feature "young male" cannot be determined from feature a and feature B, thereby affecting the accuracy of the recognition result. According to the scheme II, abnormal operation can be identified to a certain extent, however, in some specific application scenes, such as an online conference malicious request identification scene, because the behavior characteristics in the scene are complex, the characteristic information required by the explicit expression of data characterization is difficult to construct by adopting a traditional characteristic characterization method and a non-deep learning model, so that the identification result of the abnormal operation is insufficient.

Based on the analysis, the application provides a data processing method, which is used for acquiring basic information of an object to be identified and related information about a target application, processing the related information to obtain basic image characteristics and business characteristics of the object to be identified, wherein the object to be identified is associated with the target application, and the business characteristics are determined based on interaction data generated by the object to be identified aiming at the target application; the basic portrait features and the business features are fused to obtain fusion features capable of improving the expression effect of the feature information; and inputting the fusion characteristics into a target abnormal operation identification model for processing to obtain an abnormal operation identification result of the object to be identified about the target application. The target abnormal operation model is a model constructed based on deep learning, convolutional neural network and other technologies and is obtained by training according to a first training sample set and a second training sample set, wherein the first training sample set comprises first sample data marked with labels and second sample data not marked with labels; the second training sample set is constructed based on the first sample data and the second sample data for determining the pseudo tag, and the pseudo tag is a prediction tag obtained by processing the second sample data by using an abnormal operation identification model after initial training.

The above described data processing method may be applied to a data processing system as shown in fig. 2. The data processing system shown in fig. 1 includes one or more terminals 210 and one or more servers 220, and communication connection is established between the terminals 210 and the servers 220 through a limited network or a wireless network, and data interaction is performed.

The terminal 210 may be a smart device such as a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smart watch, a vehicle-mounted terminal, a smart home appliance, and a smart voice interaction device.

The terminal 210 may be used to install and run a target application, and provide an operating environment for the target application for the object to be identified. The terminal 210 may store one or more basic representations of the object to be identified, such as data of an object basic attribute, an equipment basic attribute, a network connection attribute, a geographic location attribute, and the like, and the terminal 210 may store one or more interactive data generated during the process of operating the target application of the object to be identified, such as data of login operation related information, click information and conversion information for a specific service, application flow information, and the like. The terminal 210 can transmit the basic representation and the interactive data to the server 220 via a network.

The server 220 may be an independent physical server, a server cluster or a distributed system formed by a plurality of physical servers, or a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, basic cloud computing services such as big data and an artificial intelligence platform.

The server 220 may be configured to receive and store basic portrait and interactive data of one or more objects to be identified sent by the terminal 210, and process the basic portrait and interactive data respectively to obtain basic portrait features and business features. The server 220 may also be configured to acquire and store the basic image feature and the service feature, and perform fusion processing on the basic image feature and the service feature to obtain a fusion feature; and inputting the fusion characteristics into a target abnormal operation identification model for processing to obtain an abnormal operation identification result of the object to be identified about the target application.

The data processing method provided by the embodiment of the application is briefly described above, and a specific implementation manner of the data processing method is described in detail below.

It can be understood that, in the specific embodiment of the present application, related data such as basic images, interactive data, etc. of the objects to be identified are related, and when the above embodiments of the present application are applied to specific products or technologies, the related data needs to be licensed or agreed to the related objects, and the collection, use and processing of the related data need to comply with related laws and regulations and standards of related countries and regions.

Referring to fig. 3, fig. 3 is a flowchart of a data processing method according to an embodiment of the present application, where the method is applied to a data processing device, and the data processing device is a terminal or a server. As shown in fig. 3, the data processing method includes, but is not limited to, the following steps:

s301: and acquiring basic image characteristics and service characteristics of the object to be identified, wherein the object to be identified is associated with the target application, and the service characteristics are determined based on interaction data generated by the object to be identified aiming at the target application.

The object to be identified may be an operation object of a target application, and the target application may be any application in the terminal, for example, a mobile phone end browser, a computer end online conference application, an applet, etc. The basic portrait features of the object to be identified are used for representing relevant basic information of the object to be identified, including basic attributes (gender, age, etc.), basic attributes of equipment (mobile phone brands, computer models, etc.), geographic location attributes, etc. The business characteristics are determined based on interaction data generated when the object to be identified is used for the target application.

In one implementation manner, the method for acquiring the basic portrait features of the object to be identified may be: acquiring a basic portrait of an object to be identified, wherein the basic portrait comprises one or more of an object basic attribute, a device basic attribute, a network connection attribute and a geographic position attribute, and the device basic attribute, the network connection attribute and the geographic position attribute are determined based on related data generated in the process of operating a target application by the object to be identified in a first time period; and determining the basic image characteristics of the object to be identified according to the basic image.

For example, if the basic attribute of the device of the object to be identified has multiple different computer models or mobile phone brands in a first period (such as a day), it indicates that the object to be identified frequently changes the device to use the target application in the first period, and there may be abnormal operation, such as sharing the same account by multiple people to perform a bill. For another example, if the device basic attribute of the object to be identified is changed frequently (for example, the login address is a site a, a site B and a site C with remote geographic positions) within a first time period (for example, within 12 hours), it indicates that the object to be processed may have abnormal operation, for example, the geographic position is changed by technical means, and the purpose of illegal operation is achieved.

In one implementation manner, the method for acquiring the service characteristics of the object to be identified may be: the method comprises the steps of obtaining interaction data generated in the process of operating a target application by an object to be identified in a second time period, wherein the interaction data comprises one or more of login operation related information, click information and conversion information aiming at specific service, application flow information and triggering information of specific functions; and determining the service characteristics of the object to be identified according to the interaction data. Wherein the business characteristics include click rate and conversion rate for the specific business determined based on the click information and conversion information of the specific business.

For example, the specific service may be an advertisement service in a target application, and a merchant may put an advertisement in the target application for improving the awareness and popularizing the product. The effectiveness of a merchant in placing recommended advertisements is measured primarily by click through Rate (Click Through Rate, CTR) and Conversion Rate (CVR). The click rate refers to the ratio of the number of times of clicking the recommended advertisement to the number of times of showing the recommended advertisement when the recommended advertisement is browsed; conversion refers to the rate at which a record of the transaction is made after entering the merchant store. The object to be identified may have abnormal operations such as false traffic generated by clicking the advertisement at high frequency, and thus, the click rate of the advertisement is high. False traffic not only pulls down the actual conversion rate of the advertisement, undermining the advertiser's interests, but may also cause harm to the advertiser's brand image. Therefore, it is necessary to identify the business feature of the object to be identified using the target abnormal operation identification model, and take corresponding measures, so as to maintain the interests of merchants such as brand benefits, brand image security, and the like.

For example, the login operation related information may be the login times, login failure times and the like of the object to be identified in the second time period, and if the object to be identified is logged in at high frequency in the first time period, or the login failure times are greater than a threshold value, the possibility of abnormal operation is indicated; the click information and conversion information aiming at the specific service can be information such as the click times of advertisements displayed in the target application, purchasing behavior generated after clicking the advertisements and the like, and if the object to be identified clicks advertisements for hundreds of times or even thousands of times in the second time period, the abnormal behavior of false clicking advertisements of the object to be identified is indicated; the application flow information may be that the object to be processed sends data exceeding a threshold range to the target application within a second time period, for example, if an account login request is sent once only by sending data of a bit, and the object to be identified sends data of b bit (a and b are natural numbers, b is far greater than a), then abnormal operation behaviors may exist in the object to be processed; the triggering information of the specific function can be abnormal operation discrimination criteria obtained by summarizing service experience, for example, in an application scene aiming at an online conference malicious request, the triggering information of the specific function can be continuous entering into an N-field conference, continuous 5-time error transmission conference number and the like in a short time (such as 1 hour).

S302: and carrying out fusion processing on the basic portrait features and the business features to obtain fusion features.

The fusion characteristics can perfect the expression effect of the characteristic information, and facilitate the subsequent recognition of abnormal operation on the object to be recognized by utilizing the fusion characteristics.

In one implementation, the method can also perform normalization processing on the numerical type features in the basic image features and discretization processing on the non-numerical type features in the basic image features to obtain the processed basic image features; normalizing the numerical type features in the service features, discretizing the non-numerical type features in the service features, and obtaining the processed service features; and carrying out fusion processing on the processed basic portrait features and the processed service features to obtain fusion features.

For example, the numerical type feature may be information such as age, login number of the object to be identified, price of the device, memory of the device, and the like. According to the distribution condition of the numerical type characteristics, a proper normalization method can be selected to eliminate the dimension difference between the characteristics. For example, gaussian normalization is performed for features that meet or approximate a normal distribution. The numerical type features can be normalized by means of Gaussian normalization, so that normalization processing of the numerical type features is achieved.

For non-numerical features, discretization processing can be performed in a one-hot encoding (one-hot encoding) mode, so that the processing problem of feature data can be solved, the effect of feature expansion is achieved to a certain extent, and the rationality and feasibility of data processing are improved. For example, the sex characteristic of the basic image features is (1, 0) after monothermally encoding, and the sex characteristic is (0, 1) after monothermally encoding. For another example, the geographical location attribute includes attribute tags including, but not limited to, country, province, city, and district, and taking the geographical location attribute tag as a city as an example, the province is set to be ten kinds, which are "beijing", "Shanghai", "Guangzhou", "Shenzhen", "Changsha", "Wuhan", "Qingdao", "Datong", "Chengdu" and "Chongqing", respectively. Each category corresponds to a dimension. Illustratively, assuming that the target user's liveness is "martial arts", the one-hot encoding vector corresponding to "province" is (0,0,0,0,0,1,0,0,0,0).

For non-numeric features, discretization may also be performed by way of count encoding (count encoding), for example. For example, the interaction data may also include point of interest (Point of Information, POI) information, which represents information related to the POI, which may refer to some fixed location, such as a hotel, a restaurant, a mall, a gym, etc., including, but not limited to, the type and number of times the identified object has passed the POI, and the evaluation and consumption of the POI by the object to be identified. The POI information is encoded by counting lines, i.e. the original category is replaced by the statistical features of the category. The POI statistics information is taken as an example to describe the number of times that the object to be identified reaches a certain POI. Assume that the recognition object clicks on "food-chinese dish-chuanxi" in the target application 3 times within a second period of time (for example, within 1 month), that is, the count code feature is 3, and the count code feature is included in the business feature of the object to be recognized. Therefore, the larger the counting coding feature corresponding to a certain POI is, the higher the interest of the object to be identified in the POI is indicated, and meanwhile, the judgment of whether the object to be identified has abnormal operation or not can be facilitated based on the usage habit and the like of the object to be identified in the counting coding feature aiming at the target application. For example, if the count encoding characteristics of the object to be identified for the shopping page POI in the target application are very large, this indicates that there is a possibility of abnormal operation of "refreshing" of the object to be identified.

For non-numeric features, discretization may also be performed by combining codes (consolidation encoding), mapping different features to the same feature. For example, a plurality of values under a certain category variable can be summarized into the same information. The device base information may include, but is not limited to, a system version number of the terminal device, taking the system version number of the device base information as an example, and assuming that the terminal device is an android system version, the android system version includes a plurality of values, for example, "4.2", "4.4", and "5.0", and a variable partition rule is determined based on experience, where the variable partition rule may be to generalize the three valued android system versions to a "low-version android system". Illustratively, assuming that the system version number of the terminal device used by the target user is "4.2", the merging-coding feature corresponding to "system version number" is 0. The android system version further includes a plurality of values, such as "6.0", "7.0", "8.0", "9.0", and "10.0", and the variable partitioning rule is determined based on experience, and may be to sum up the five valued android system versions into a "high-version android system". Illustratively, assuming that the system version number of the terminal device used by the object to be identified is "9.0", the merging-coding feature corresponding to the "system version number" is 1.

In one implementation, the time dimension may be combined to aggregate base portrayal features and business features for different time spans. Such as aggregate, aggregate images of the last half year, last 3 months, last 1 month, last 1 week, etc. of the object to be identified are calculated. The method of aggregation calculation comprises summation, median and standard deviation. Illustratively, the aggregate calculation schematic can be shown in fig. 4, and the feature size can be reduced by averaging the feature points in the neighborhood, so that the calculation amount and the required storage space can be reduced.

In one implementation, after the processed basic image features and service features are fused to obtain the fused features, the fused features can be stored in a distributed file system (Hadoop Distributed File System, HDFS) offline, so that the fused features with identification objects can be quickly accessed by subsequent procedures. Alternatively, for each object to be identified, the resulting fusion feature may be an n×1 numeric vector, e.g. (1,0,31,4,0.2,9.3,8.8, …,0,0,1,2,34). Through the processing, the fusion characteristics can describe the characteristics of the object to be identified more accurately and comprehensively, and the abnormal operation identification is facilitated according to the characteristics.

S303: inputting the fusion characteristics into a target abnormal operation identification model for processing to obtain an abnormal operation identification result of the object to be identified about the target application; the target abnormal operation identification model is obtained by training based on a first training sample set and a second training sample set, wherein the first training sample set comprises first sample data marked with labels and second sample data not marked with labels; the second training sample set is constructed based on the first sample data and second sample data for determining a pseudo tag, and the pseudo tag is a prediction tag obtained by processing the second sample data by using an abnormal operation identification model after initial training; the initial abnormal operation recognition model is obtained by training the initial abnormal operation recognition model by using the first sample data, and the target abnormal operation recognition model is obtained by training the initial abnormal operation recognition model by using a second training sample set; the sample data includes feature data of an associated object of the target application, and a tag of the sample data is used to indicate whether an abnormal operation exists in the associated object.

Alternatively, the first sample data labeled in the first training sample set and the second sample data unlabeled may be one or more. The sample data comprises fusion characteristics obtained after fusion operation of basic image characteristics and business characteristics of a user object of the target application.

In one implementation, the target abnormal operation identification model comprises a feature extraction module, a cross covariance aggregation module and a second order characterization aggregation module which are connected in parallel; inputs of the cross covariance aggregation module and the second order characterization aggregation module are respectively connected with outputs of the initial feature extraction module. A schematic structure of the target abnormal operation recognition model may be shown in fig. 5.

In one implementation, as shown in the schematic model structure diagram shown in fig. 5, the fused features may be input into the feature extraction module for processing to obtain intermediate features; inputting the intermediate features into a cross covariance aggregation module for processing to obtain cross covariance features, and inputting the intermediate features into a second order characterization aggregation module for processing to obtain second order aggregation features; performing splicing treatment on the cross covariance characteristics and the second-order aggregation characteristics to obtain splicing characteristics; and determining an abnormal operation identification result of the object to be identified on the basis of the splicing characteristics.

In one implementation, the intermediate features may be input into a cross covariance aggregation module for processing to determine normalized features of the intermediate features; the outer product of the intermediate feature and the normalized feature is calculated as follows:

Where h represents the result of the outer product calculation,g represents intermediate features, < >>Representing an outer product calculator, wherein softmax is a normalization function, representing that the middle characteristic g is normalized, mapped into real numbers between 0 and 1, ensuring that the sum after processing is 1 and the sum of probabilities is 1; and carrying out vectorization processing on the outer products of the intermediate features and the normalized features to obtain cross covariance features. The cross covariance between the normalized features and the intermediate features can learn the domain invariant features with distinguishing property more effectively, and is beneficial to the recognition of abnormal operation of the model to the object to be processed.

In one implementation, the intermediate features may be globally averaged (Global Average Pooling, GAP) processed to yield the processed intermediate features, g in the above equation, before being input into the cross-covariance aggregation module for processing. Through GAP, an average value can be obtained through the whole feature diagram of the intermediate features, so that the second-order aggregation operation of the subsequent cross covariance aggregation module is facilitated. The traditional method is to perform activation classification after full connection layer processing, and the idea of GAP is to use GAP to replace the full connection layer (namely to reduce the dimension in a pooling layer mode), so that the spatial information semantic information extracted by each convolution layer and pooling layer is reserved, the effect is obviously improved in practical application, and in addition, the limitation on the input size is removed by GAP.

In one implementation, the intermediate features are input into a second-order characterization aggregation module for processing, and a feature matrix of the intermediate features is determined; determining a second order aggregation matrix based on the feature matrix and a transposed matrix of the feature matrix; and calculating the square root of the matrix of the second order aggregation matrix, and carrying out vectorization processing on the square root of the matrix to obtain the second order aggregation characteristic. Wherein the second order features are able to capture more information than the first order features.

Optionally, in order to avoid the excessively high feature dimension of the subsequent generation, a convolution kernel of 1×1 may be adopted before the intermediate feature is input into the second-order characterization aggregation module, so that the feature channel number of the intermediate feature output by the feature extraction module is subjected to dimension reduction processing, which is favorable for reducing the feature size, thereby reducing the calculation amount and the required storage space. For example, the intermediate feature dimension output by the feature extraction module is 2048 dimensions, which is reduced to 128 dimensions by a convolution kernel.

Alternatively, the second order aggregation operation of determining the second order aggregation matrix based on the feature matrix and the transpose matrix of the feature matrix may be expressed by the following formula:

wherein, the liquid crystal display device comprises a liquid crystal display device,representing the feature matrix after intermediate feature expansion, +.>Represents the matrix obtained after the second order polymerization operation, n=hw.

In one implementation, the target abnormal operation identification model further comprises a splicing module and a classification module, wherein the input of the splicing module is connected with the output of the cross covariance aggregation module and the output of the second-order representation aggregation module respectively. The splicing module is used for carrying out splicing treatment on the cross covariance characteristics and the second-order aggregation characteristics to obtain splicing characteristics; the classification module is used for determining an abnormal operation identification result of the object to be identified about the target application based on the splicing characteristics.

In one implementation manner, the type of the abnormal operation can be classified, and when the identification result of the object to be identified is that the abnormal operation exists, the specific type of the abnormal operation can be further determined, so that corresponding measures, such as limiting the use authority of the specific function of the object to be identified in the target application, are taken to prevent the object to be identified from continuing to perform the abnormal operation. For example, if it is recognized that the account number of the object to be recognized has a login in a different place, the object to be recognized may be required to perform identity verification (e.g., a specified verification code is sent through a contact way bound by the account number); for another example, if it is identified that the to-be-identified object has an abnormal operation of "brushing a bill", the account of the to-be-identified object may be subjected to a sign-sealing process; for another example, if the abnormal operation of the object to be identified is that the violation information is sent multiple times within 1 hour, the account of the object to be identified may be prohibited in a limited time (for example, prohibited for 24 hours) or permanently prohibited.

For example, referring to fig. 6, fig. 6 is a schematic diagram of an abnormal operation recognition result according to an embodiment of the present application. When the target application is an online conference, the object to be identified can sequentially input a login account number, a login password, a conference number and a conference password through the input boxes 1-4. As shown in fig. 6, if the object to be identified has continuously input the wrong meeting password multiple times, the server may input the fusion feature of the object to be identified into the target abnormal operation identification model to process, thereby determining that the object to be identified has abnormal operation, and may display a prompt box to inform that the object to be identified has continuously input the wrong meeting password multiple times, and if the target application is still needed, the server needs to try to enter the online meeting after 15 minutes.

Conventional solutions for identifying abnormal operations are usually to prepare training samples according to manual labeling of related staff and set identification rules according to business experience, and directly train a model, which causes two problems: firstly, the number of manually marked training samples and rules determined based on manual experience is limited, a large amount of labor is required to be consumed, high-dimensional characteristic information interacted between the rules cannot be captured, and meanwhile, optimal parameters of each rule are difficult to determine; secondly, in some specific application scenes, such as an online meeting malicious request recognition scene, because the behavior features in the scene are complex, the feature information required by the explicit expression of the data representation is difficult to construct by adopting a traditional feature representation method and a non-deep learning model, so that the recognition result of abnormal operation is insufficient.

Aiming at the two problems, the embodiment of the application provides a model training method based on a deep learning technology. Fig. 7 is a schematic structural diagram of an abnormal operation recognition model training method provided by an embodiment of the present application, where, as shown in fig. 7, an abnormal operation recognition model includes a feature extraction module, a cross covariance aggregation module, a second order characterization aggregation module, a stitching module, and a classification module. The specific roles of the modules will be explained in the following examples.

Referring to fig. 8, fig. 8 is a flowchart of an abnormal operation recognition model training method according to an embodiment of the present application. The execution subject of the abnormal operation recognition model training method is a data processing device, and the data processing device and the execution subject of the data processing method can be the same device or two different devices. As shown in fig. 8, the abnormal operation recognition model training method includes, but is not limited to, the following steps:

s801: a first training sample set is obtained, the first training sample set comprising first sample data labeled and second sample data unlabeled.

The first training sample set may be one or more, and each first training sample set includes one or more first sample data and second sample data, and the specific amount of data is not limited by the present application. The first sample data and the second sample data comprise fusion characteristics of an associated object of the target application, a label of the sample data is used for indicating whether the associated object has abnormal operation, the label of the sample data can be a label of a class marked by related staff based on business logic, for example, the label is 1 when the associated object has abnormal operation, and the label is 0 when the associated object does not have abnormal operation. The fusion feature is determined based on the base image feature of the associated object and the business feature, wherein the business feature is determined based on interaction data generated by the associated object for the target application.

Optionally, the associated object may be an object with strong correlation with the target application, which is screened from the usage objects of the target application based on manual annotation and business logic, and the basic portrait features and business features of the associated object may be determined according to the basic information of the associated object and the interactive data in a period of time (for example, about 3 months). In addition, the correlation object of the abnormality may be filtered based on the distribution abnormality theorem of the data, for example, the radon criterion may be used as an abnormal value judgment criterion, a group of detection data (referring to one feature of the correlation object) may be assumed to contain only random errors, a standard deviation may be obtained by performing calculation processing on the detection data, a section may be determined according to a certain probability, and it is assumed that errors exceeding the section are not random errors but coarse errors, and the data containing the errors should be removed.

In one implementation, a basic representation of an associated object corresponding to a first training sample set may be obtained, where the basic representation includes one or more of an object basic attribute, a device basic attribute, a network connection attribute, and a geographic location attribute, where the device basic attribute, the network connection attribute, and the geographic location attribute are determined based on related data generated during operation of a target application by an object to be identified in a first time period; and determining the basic image characteristics of the object to be identified according to the basic image.

In one implementation manner, interactive data generated in the process of operating the target application by the associated object in the second time period can be obtained, wherein the interactive data comprises one or more of login operation related information, click information and conversion information aiming at a specific service, application flow information and triggering information of a specific function; and determining the service characteristics of the object to be identified according to the interaction data. Wherein the business characteristics include click rate and conversion rate for the specific business determined based on the click information and conversion information of the specific business.

It should be noted that, the specific construction mode and principle of the basic portrait features and the business features may refer to the embodiment of the data processing method, and will not be described herein.

S802: and inputting the first training sample set into an abnormal operation identification model for initial training to obtain a prediction label of the second sample data.

The abnormal operation identification model is a domain adaptation model, the structure of the abnormal operation identification model is based on a condition-based correlation domain adaptation network, first sample data in a first training sample set is used as source domain data with labels, second sample data is used as target domain data without labels, the abnormal operation identification model is input into the abnormal operation identification model for training, and then a prediction label of the second sample data and a prediction probability corresponding to the prediction label of the second sample data can be obtained according to the first sample data and the labels of the first sample data. The first training sample set comprises a positive sample and a negative sample, and in the application, sample data marked with labels as having abnormal operations are taken as the positive sample, and sample data marked with labels as not having abnormal operations are taken as the negative sample.

Alternatively, a random gradient descent with momentum (Stochastic Gradient Descent, SGD) may be used as an optimizer in the abnormal operation recognition model to optimize the model training process, and a learning rate (learning rate) may be 0.001. The learning rate is a super parameter when the weight is updated in the gradient descending process, the lower the learning rate is, the slower the change speed of the loss function in model training is, and the fact that any local minimum value is not missed in the training process can be ensured.

S803: a second training sample set is acquired, wherein the second training sample set comprises first sample data of marked labels and second sample data for determining pseudo labels.

And screening out the predictive labels with high confidence coefficient, the predictive probability of which is higher than a threshold value, from the predictive labels of the second sample data in the first training samples according to the predictive probability of each predictive label, and taking the predictive labels as pseudo labels. The threshold value of the prediction probability can be set or changed according to the requirements of the service scene. Optionally, the first training sample may be trained multiple times, and the prediction tag obtained from the second sample data may be screened, so as to reduce the error. The second training sample set may be one or more, and the first sample data and the second sample data may also be one or more, which is not limited in the present application.

The pseudo tag technology can solve the problem of unbalance of positive and negative samples in the training sample set. If the number of positive samples in the first training sample set is insufficient and the number of negative samples is sufficient, only sample data with a certain number of pseudo tags indicated as positive samples can be screened for constructing second sample data; if the number of positive samples is enough and the number of negative samples is insufficient, only a certain number of sample data with pseudo tags indicating negative samples can be screened to construct second sample data; if the data amounts of the positive sample and the negative sample are insufficient, a certain amount of sample data of which the pseudo tag indicates the positive sample and a certain amount of sample data of which the pseudo tag indicates the negative sample can be screened out for constructing second sample data.

S804: and inputting the second training sample set into the abnormal operation identification model after initial training, and obtaining the intermediate features corresponding to each sample data in the second training sample set through a feature extraction module.

And inputting the fusion characteristics corresponding to the first sample data in the second training sample set and the fusion characteristics corresponding to the second sample data with the pseudo tag into an abnormal operation identification model after initial training, and processing by a characteristic extraction module to obtain each intermediate characteristic. Alternatively, the feature extraction module may be a backbone Network, and the backbone Network may select a Residual Network (Residual Network 50 ), where numeral 50 refers to that the Residual Network 50 has 50 layers, and the use of the Residual Network 50 can make the Network structure of feature extraction simpler without degrading the performance of the Network.

For example, referring to fig. 9a, fig. 9a is a schematic diagram of a residual network structure provided in an embodiment of the present application, where the first Stage (Stage 1) to the fourth Stage (Stage 4) have the same structure. As shown in fig. 9a, the input (112,112,64) refers to the input network having a channel number (channel) of 112, a height (height) of 112, and a width (width) of 64, i.e., inputs (C, H, W). In the network, the maximum pooling (max-pooling) is used, that is, a convolution kernel (filter) is extracted to a plurality of feature values, only the pooling layer with the maximum value is taken as a reserved value, after other values are discarded, the original planar structure is maintained for feature extraction, and the maximum value indicates that the strongest feature in the feature values is reserved. In fig. 9a, the convolution layer (convolution) is generally abbreviated as conv,7×7 refers to the convolution kernel size, 64 refers to the number of convolution kernels (i.e., the number of channels output by the convolution layer), s=2 refers to the step size of the convolution kernels being 2; the BN layer is English abbreviation of batch standardization (Batch Normalization), and can accelerate the convergence rate of the network; reLU represents a linear rectification activation function (Linear Rectification Function, reLU). For an example, the implementation of max-pooling may refer to fig. 9b. Fig. 9b shows that only the largest one of the small blocks of size (potential size) 2 x 2 is left, 20, 30, 112 and 37 respectively.

S805: and carrying out pooling treatment on the intermediate features and classifying the intermediate features, and determining a first classification feature and a first classification loss parameter.

Wherein, the pooling process of the intermediate features may be Global Average Pooling (GAP), and the pooled intermediate features are input into a classifier in the classification module, and then the first classification feature and the first classification loss parameter may be determined, and S806 is performed.

The present application is not limited to the execution sequence between S805 and S807, and S805 and S807 may be executed first and then S807 may be executed 605, and S805 and S807 may be executed simultaneously.

S806: and inputting the first classification characteristic into a cross covariance aggregation module for processing to obtain a cross covariance aggregation characteristic.

Cross covariance features can effectively model more complex data distributions. The intermediate features can be input into a cross covariance aggregation module for processing, and normalized features of the intermediate features are determined; the outer product of the intermediate feature and the normalized feature is calculated as follows:

wherein h represents the result of the outer product calculation,g represents a first classification feature, < >>Representing an outer product calculator, wherein softmax is a normalization function, representing normalization processing of the first classification characteristic g, mapping the first classification characteristic g into real numbers between 0 and 1, ensuring that the sum after processing is 1, and the sum of probabilities is also 1; and carrying out vectorization processing on the outer product h of the intermediate feature and the normalized feature to obtain a cross covariance feature. Wherein the cross covariance feature may be characterized by F ₁ Indicating (I)>d ₁ =c×c, C represents the number of categories of classification.

S807: and inputting the intermediate features into a second-order characterization aggregation module for processing to obtain second-order aggregation features.

The method comprises the steps of inputting intermediate features into a second-order characterization aggregation module for processing, and determining a feature matrix of the intermediate features; determining a second order aggregation matrix based on the feature matrix and a transposed matrix of the feature matrix; and calculating the square root of the matrix of the second order aggregation matrix, and carrying out vectorization processing on the square root of the matrix to obtain the second order aggregation characteristic. Wherein the second order features are able to capture more information than the first order features.

In one implementation, the second order characterization aggregation module may include three structural layers, a second order aggregation layer (SOM), a matrix square root normalization layer (m_sqrt), and an upper triangle vectorization layer (TriU). The second-order aggregation layer calculates the inner product of the intermediate feature and characterizes the correlation among channels in the intermediate feature. The second order aggregation operation of determining the second order aggregation matrix based on the feature matrix and the transposed matrix of the feature matrix may be represented by the following formula:

wherein, the liquid crystal display device comprises a liquid crystal display device,representing the feature matrix after intermediate feature expansion, +.>Represents the matrix obtained after the second order polymerization operation, n=hw. Matrix of matrix square root normalization layer outputs +. >Representing, as a symmetric matrix, a matrix obtained by vectorizing an upper triangular part of the matrix P as a second order aggregation feature corresponding to the intermediate feature +.>d ₂ ＝(d+1)×d/2。/>

In one implementation, in order to avoid the excessively high feature dimension of the subsequent generation, a convolution kernel of 1×1 may be adopted before the intermediate feature is input into the second-order representation aggregation module, so that the feature channel number of the intermediate feature output by the feature extraction module is subjected to dimension reduction processing, which is favorable for reducing the feature size, thereby reducing the calculation amount and the required storage space.

S808: and inputting the cross covariance features and the second-order aggregation features into a splicing module to obtain splicing features.

The stitching module uses cross covariance characteristicsAnd second order aggregation feature->Cascading to obtain a splice signature->

S809: and (3) carrying out gradient overturning on the spliced characteristics, inputting the spliced characteristics into a classification module, and determining a second classification loss parameter according to the processing result of the classification module and the first classification loss parameter.

A gradient inversion layer (Gradient Reversal Layer, GRL) between the feature extraction module and the classification module, during the back propagation process, the gradient of domain classification loss of the domain discriminators in the classification module automatically inverts before back propagating to the parameters of the feature extractor in the feature extraction module, thereby constructing a challenge loss similar to that of generating a challenge network (Generative Adversarial Network, GAN), and by this layer avoiding the two-stage training process of GAN. The gradient overturning process and the loss function after the gradient overturning layer treatment can be calculated according to the following formula in sequence:

The domain arbiter in the classification module may be structured as shown in FIG. 9c, with one or more modules as shown in FIG. 90 anda two classifier is formed in which the module 90 is composed of a fully connected layer and an activation function, and ReLU, dropout, sigmoid is the activation function. In the whole network of the abnormal operation identification model, the second loss parameter consists of two parts, namely a classification loss parameter epsilon (G) of the source domain classifier, and the classification performance of the model is ensured by minimizing the loss; secondly, the loss parameter epsilon (G, D) of the domain discriminator can continuously improve the identification capacity of the domain discriminator and simultaneously enable the source domain feature F by optimizing the loss parameter ^s (as first sample data) and target domain features F ^t (e.g., second sample data) becomes more and more indistinguishable, thereby enhancing the effectiveness of the abnormal operation recognition model. Epsilon (G) and epsilon (G, D) can be calculated by the following formulas, respectively:

wherein L is _CE Representing a first class loss parameter as a cross entropy loss function; g is a deep convolutional neural network (including backbone network and classifier); d represents a domain arbiter; f (F) ^s And F is equal to ^t Respectively representing the source domain features and the target domain features extracted by the model.

In one implementation, the loss parameters are considered to be assigned the same weight to all sample data, but in an actual application scenario, larger sample data is not suitable for some kinds of pre-judgment information uncertainty. Thus, to ensure feature mobility, entropy conditions may be introduced to measure the uncertainty of the sample data prediction class, giving greater weight to samples with less entropy, and vice versa. Entropy can be calculated by the following formula:

Wherein z=softmax (g); c, identifying the number of categories; z _c Representing the probability that the sample belongs to class c. The calculation formula of the weight is as follows:

based on this, the calculation formula of the loss parameter ε (G, D) of the domain arbiter can be changed to:

s810: and adjusting model parameters of the abnormal operation identification model based on the second classification loss parameters, and determining the target abnormal operation identification model.

In one implementation, the loop of S804-S810 may be repeated until the model converges to an end, each time a batch of sample data is selected from each of the first training sample set and the second training sample set to train the abnormal operation identification model and adjust the model parameters.

Therefore, according to the abnormal operation identification model training method provided by the embodiment of the application, the pseudo label of the second sample data can be determined through the first sample data based on the pseudo label technology, and the number of marked samples is increased on the basis of reducing the number of manually marked samples, so that the data enhancement of the training samples is realized, and the generalization capability of the model is improved; the effective learning of the domain invariant features can be performed by cross-covariance between the second-order aggregate features and the features and predicted values of the training samples; meanwhile, in the model training process, entropy conditions are introduced to balance uncertainty of classifier prediction so as to ensure feature mobility; in addition, the gradient turnover layer is used for constructing the countermeasure loss similar to the generation of the countermeasure network (Generative Adversarial Network, GAN), so that the complex training process in the GAN can be avoided, the generalization capability of the model is obviously improved, the recognition accuracy of the target abnormal operation recognition model is improved, and the reusability of the target abnormal operation recognition model is improved.

Referring to fig. 10, fig. 10 is a schematic structural diagram of a data processing apparatus according to an embodiment of the application. As shown in fig. 10, the data processing apparatus includes:

an obtaining unit 101, configured to obtain a basic image feature and a service feature of an object to be identified, where the object to be identified is associated with a target application, and the service feature is determined based on interaction data generated by the object to be identified for the target application;

the processing unit 102 is used for carrying out fusion processing on the basic portrait features and the service features to obtain fusion features;

the processing unit 102 is further configured to input the fusion feature into a target abnormal operation recognition model for processing, so as to obtain an abnormal operation recognition result of the object to be recognized about the target application;

In one implementation, the processing unit 102 is further configured to: inputting the fusion features into the feature extraction module for processing to obtain intermediate features; inputting the intermediate features into a cross covariance aggregation module for processing to obtain cross covariance features, and inputting the intermediate features into a second order characterization aggregation module for processing to obtain second order aggregation features; performing splicing treatment on the cross covariance characteristics and the second-order aggregation characteristics to obtain splicing characteristics; and determining an abnormal operation identification result of the object to be identified on the basis of the splicing characteristics.

In one implementation, the obtaining unit 101 is further configured to obtain a basic representation of the object to be identified, where the basic representation includes one or more of an object basic attribute, a device basic attribute, a network connection attribute, and a geographic location attribute, where the device basic attribute, the network connection attribute, and the geographic location attribute are determined based on related data generated during operation of the target application by the object to be identified in the first period of time; the processing unit 102 is further configured to determine a base image feature of the object to be identified based on the base image.

In one implementation manner, the obtaining unit 101 is further configured to obtain interaction data generated during the process of operating the target application by the object to be identified in the second period of time, where the interaction data includes one or more of login operation related information, click information and conversion information for a specific service, application flow information, and trigger information of a specific function; the processing unit 102 is further configured to determine a service characteristic of the object to be identified based on the interaction data.

In one implementation, the processing unit 102 is further configured to: normalizing the numerical type features in the basic image features, and discretizing the non-numerical type features in the basic image features to obtain the processed basic image features; normalizing the numerical type features in the service features, discretizing the non-numerical type features in the service features, and obtaining the processed service features; and carrying out fusion processing on the processed basic portrait features and the processed service features to obtain fusion features.

In one implementation, the processing unit 102 is further configured to: inputting the intermediate features into a cross covariance aggregation module for processing, and determining normalized features of the intermediate features; calculating the outer product of the intermediate feature and the normalized feature; and carrying out vectorization processing on the outer products of the intermediate features and the normalized features to obtain cross covariance features.

In one implementation, the processing unit 102 is further configured to: inputting the intermediate features into a second-order characterization aggregation module for processing to determine a feature matrix of the intermediate features; determining a second order aggregation matrix based on the feature matrix and a transposed matrix of the feature matrix; and calculating the square root of the matrix of the second order aggregation matrix, and carrying out vectorization processing on the square root of the matrix to obtain the second order aggregation characteristic.

According to one embodiment of the present application, the steps involved in the data processing method shown in fig. 3 and the model training method shown in fig. 8 may be performed by respective modules in the data processing apparatus shown in fig. 10. For example, S301 shown in fig. 3 and S801 and S803 shown in fig. 8 may be performed by the acquisition unit 101 in fig. 10, and S302, S303, S304 in fig. 3 and S802, S804, S805, S806, S807, S808, S809, S810 shown in fig. 8 may be performed by the processing unit 102 in fig. 10.

According to an embodiment of the present application, each module in the data processing apparatus shown in fig. 10 may be separately or completely combined into one or several units to form a structure, or some (some) of the units may be further split into a plurality of sub-units with smaller functions, so that the same operation may be implemented without affecting the implementation of the technical effects of the embodiment of the present application. The above modules are divided based on logic functions, and in practical applications, the functions of one module may be implemented by a plurality of units, or the functions of a plurality of modules may be implemented by one unit. In other embodiments of the application, the data processing apparatus may also comprise other units, and in practical applications, these functions may also be realized with the assistance of other units, and may be realized by cooperation of a plurality of units.

According to an embodiment of the present application, a data processing apparatus as shown in fig. 10 may be constructed by running a computer program (including program code) capable of executing the steps involved in the respective methods as shown in fig. 3 and 8 on a general-purpose computer device such as a computer including a processing element such as a central processing unit (Central Processing Unit, CPU), a random access storage medium (Random Access Memory, RAM), a Read-Only Memory (ROM), or the like, and a storage element, and implementing the data processing method of the embodiment of the present application. The computer program may be recorded on, for example, a computer-readable recording medium, and loaded into and executed by the computing device via the computer-readable recording medium.

It may be understood that the functions of each functional unit of the data processing apparatus described in the embodiments of the present application may be specifically implemented according to the method in the embodiments of the method, and the specific implementation process may refer to the relevant description of the embodiments of the method and will not be repeated herein.

Referring to fig. 11, fig. 11 is a schematic structural diagram of a data processing apparatus according to an embodiment of the present application. The data processing device described in the embodiments of the present application is used to execute the data processing method described above, and may also be used to execute the model training method described above. The data processing apparatus includes: a processor 111, a communication interface 112 and a memory 113. The processor 111, the communication interface 112, and the memory 113 may be connected by a bus or other means, which is exemplified by the present embodiment.

Among these, the processor 111 (or Central Processing Unit (CPU)) is a computing core and a control core of a computer device, which can parse various instructions within the computer device and process various data of the computer device, for example: the CPU can be used for analyzing the switching-on and switching-off instruction sent to the computer equipment and controlling the computer equipment to perform switching-on and switching-off operation; and the following steps: the CPU may transmit various types of interaction data between internal structures of the computer device, and so on. The communication interface 112 may optionally include a standard wired interface, a wireless interface (e.g., wi-Fi, mobile communication interface, etc.), controlled by the processor 111 for transceiving data. The Memory 113 (Memory) is a Memory device in the computer device for storing programs and data. It will be appreciated that the memory 113 herein may include both built-in memory of the computer device and extended memory supported by the computer device. Memory 113 provides storage space that stores the operating system of the computer device, which may include, but is not limited to: android systems, iOS systems, windows Phone systems, etc., the application is not limited in this regard.

In an embodiment of the present application, the processor 111 performs the following operations by executing executable program code in the memory 113:

In one implementation, the processor 111, by executing executable program code in the memory 113, may also perform the following operations: inputting the fusion features into the feature extraction module for processing to obtain intermediate features; inputting the intermediate features into a cross covariance aggregation module for processing to obtain cross covariance features, and inputting the intermediate features into a second order characterization aggregation module for processing to obtain second order aggregation features; performing splicing treatment on the cross covariance characteristics and the second-order aggregation characteristics to obtain splicing characteristics; and determining an abnormal operation identification result of the object to be identified on the basis of the splicing characteristics.

In one implementation, the processor 111, by executing executable program code in the memory 113, may also perform the following operations: acquiring a basic portrait of an object to be identified, wherein the basic portrait comprises one or more of an object basic attribute, a device basic attribute, a network connection attribute and a geographic position attribute, and the device basic attribute, the network connection attribute and the geographic position attribute are determined based on related data generated in the process of operating a target application by the object to be identified in a first time period; and determining the basic image characteristics of the object to be identified according to the basic image.

In one implementation, the processor 111, by executing executable program code in the memory 113, may also perform the following operations: the method comprises the steps of obtaining interaction data generated in the process of operating a target application by an object to be identified in a second time period, wherein the interaction data comprises one or more of login operation related information, click information and conversion information aiming at specific service, application flow information and triggering information of specific functions; the processing unit is also used for determining the service characteristics of the object to be identified according to the interaction data.

In one implementation, the processor 111, by executing executable program code in the memory 113, may also perform the following operations: normalizing the numerical type features in the basic image features, and discretizing the non-numerical type features in the basic image features to obtain the processed basic image features; normalizing the numerical type features in the service features, discretizing the non-numerical type features in the service features, and obtaining the processed service features; and carrying out fusion processing on the processed basic portrait features and the processed service features to obtain fusion features.

In one implementation, the processor 111, by executing executable program code in the memory 113, may also perform the following operations: inputting the intermediate features into a cross covariance aggregation module for processing, and determining normalized features of the intermediate features; calculating the outer product of the intermediate feature and the normalized feature; and carrying out vectorization processing on the outer products of the intermediate features and the normalized features to obtain cross covariance features.

In one implementation, the processor 111, by executing executable program code in the memory 113, may also perform the following operations: inputting the intermediate features into a second-order characterization aggregation module for processing to determine a feature matrix of the intermediate features; determining a second order aggregation matrix based on the feature matrix and a transposed matrix of the feature matrix; and calculating the square root of the matrix of the second order aggregation matrix, and carrying out vectorization processing on the square root of the matrix to obtain the second order aggregation characteristic.

Embodiments of the present application also provide a computer readable storage medium having instructions stored therein, which when run on a computer, cause the computer to perform a data processing method according to the embodiments of the present application. The specific implementation manner may refer to the foregoing description, and will not be repeated here.

Embodiments of the present application also provide a computer program product comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer readable storage medium, and the processor executes the computer instructions, so that the computer device performs the data processing method according to the embodiment of the present application. The specific implementation manner may refer to the foregoing description, and will not be repeated here.

The terms first, second and the like in the description and in the claims and drawings of embodiments of the application are used for distinguishing between different objects and not for describing a particular sequential order. Furthermore, the term "include" and any variations thereof is intended to cover a non-exclusive inclusion. For example, a process, method, apparatus, article, or device that comprises a list of steps or elements is not limited to the list of steps or modules but may, in the alternative, include other steps or modules not listed or inherent to such process, method, apparatus, article, or device.

Those of ordinary skill in the art will appreciate that the elements and algorithm steps described in connection with the embodiments disclosed herein may be embodied in electronic hardware, in computer software, or in a combination of the two, and that the elements and steps of the examples have been generally described in terms of function in the foregoing description to clearly illustrate the interchangeability of hardware and software. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.

The method and related apparatus provided in the embodiments of the present application are described with reference to the flowchart and/or schematic structural diagrams of the method provided in the embodiments of the present application, and each flow and/or block of the flowchart and/or schematic structural diagrams of the method may be implemented by computer program instructions, and combinations of flows and/or blocks in the flowchart and/or block diagrams. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks. These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or structural diagram block or blocks. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or structures.

The foregoing disclosure is illustrative of the present application and is not to be construed as limiting the scope of the application, which is defined by the appended claims.

Claims

1. A method of data processing, the method comprising:

carrying out fusion processing on the basic portrait features and the service features to obtain fusion features;

the target abnormal operation identification model is obtained by training based on a first training sample set and a second training sample set, wherein the first training sample set comprises first sample data marked with labels and second sample data not marked with labels; the second training sample set is constructed based on the first sample data and second sample data for determining a pseudo tag, and the pseudo tag is a prediction tag obtained by processing the second sample data by using an abnormal operation identification model after initial training; the initial trained abnormal operation recognition model is obtained by training an initial abnormal operation recognition model by using the first sample data, and the target abnormal operation recognition model is obtained by training the initial trained abnormal operation recognition model by using the second training sample set; the sample data comprises characteristic data of an associated object of the target application, and a label of the sample data is used for indicating whether the associated object has abnormal operation or not.

2. The method of claim 1, wherein the target abnormal operation identification model comprises a feature extraction module and a cross covariance aggregation module and a second order characterization aggregation module connected in parallel; and the inputs of the cross covariance aggregation module and the second-order representation aggregation module are respectively connected with the output of the initial feature extraction module.

3. The method according to claim 2, wherein the inputting the fusion feature into a target abnormal operation recognition model for processing to obtain an abnormal operation recognition result of the object to be recognized about the target application includes:

inputting the fusion features into the feature extraction module for processing to obtain intermediate features;

inputting the intermediate features into the cross covariance aggregation module for processing to obtain cross covariance features, and inputting the intermediate features into the second order characterization aggregation module for processing to obtain second order aggregation features;

performing splicing treatment on the cross covariance characteristics and the second-order aggregation characteristics to obtain splicing characteristics;

and determining an abnormal operation identification result of the object to be identified on the basis of the splicing characteristics.

4. A method according to any one of claims 1-3, wherein said obtaining a base image feature of an object to be identified comprises:

acquiring a basic portrait of the object to be identified, wherein the basic portrait comprises one or more of an object basic attribute, an equipment basic attribute, a network connection attribute and a geographic position attribute, and the equipment basic attribute, the network connection attribute and the geographic position attribute are determined based on related data generated in the process of operating the target application by the object to be identified in a first time period;

and determining the basic image characteristics of the object to be identified according to the basic image.

5. A method according to any of claims 1-3, wherein obtaining the business characteristics of the object to be identified comprises:

acquiring interaction data generated in the process of operating the target application by the object to be identified in a second time period, wherein the interaction data comprises one or more of login operation related information, click information and conversion information aiming at specific service, application flow information and triggering information of specific functions;

and determining the service characteristics of the object to be identified according to the interaction data.

6. The method according to claim 1, wherein the fusing the basic portrait features and the business features to obtain fused features includes:

normalizing the numerical type features in the basic image features, and discretizing the non-numerical type features in the basic image features to obtain the processed basic image features;

normalizing the numerical type features in the service features, and discretizing the non-numerical type features in the service features to obtain the processed service features;

and carrying out fusion processing on the processed basic portrait features and the processed service features to obtain fusion features.

7. A method according to claim 3, wherein said inputting said intermediate features into said cross covariance aggregation module for processing to obtain cross covariance features comprises:

inputting the intermediate features into the cross covariance aggregation module for processing, and determining normalized features of the intermediate features;

calculating an outer product of the intermediate feature and the normalized feature;

and carrying out vectorization processing on the outer product of the intermediate feature and the normalized feature to obtain the cross covariance feature.

8. A method according to claim 3, wherein said inputting said intermediate features into said second order characterization aggregation module for processing to obtain second order aggregated features comprises:

inputting the intermediate features into the second-order characterization aggregation module for processing, and determining a feature matrix of the intermediate features;

determining a second order aggregation matrix based on the feature matrix and a transpose of the feature matrix;

and calculating the square root of the matrix of the second order aggregation matrix, and carrying out vectorization processing on the square root of the matrix to obtain the second order aggregation characteristic.

9. A data processing apparatus, the apparatus comprising:

the system comprises an acquisition unit, a target application and a processing unit, wherein the acquisition unit is used for acquiring basic image characteristics and business characteristics of an object to be identified, the object to be identified is associated with the target application, and the business characteristics are determined based on interaction data generated by the object to be identified aiming at the target application;

the processing unit is used for carrying out fusion processing on the basic portrait characteristics and the business characteristics to obtain fusion characteristics;

the processing unit is further used for inputting the fusion characteristics into a target abnormal operation identification model for processing to obtain an abnormal operation identification result of the object to be identified, which is related to the target application;

10. A data processing apparatus, comprising:

a processor adapted to implement one or more computer programs; the method comprises the steps of,

computer storage medium storing one or more computer programs for loading by the processor and implementing a data processing method according to any of claims 1-8.

11. A computer-readable storage medium, characterized in that the computer-readable storage medium comprises a computer program for implementing the data processing method according to any of claims 1-8 when being executed by a processor.

12. A computer program product, characterized in that the computer program product comprises a computer program stored in a computer storage medium, which computer program, when being executed by a processor, is adapted to carry out the data processing method according to any one of claims 1-8.