CN117421199B - Behavior determination method and system - Google Patents
Behavior determination method and system Download PDFInfo
- Publication number
- CN117421199B CN117421199B CN202311745465.5A CN202311745465A CN117421199B CN 117421199 B CN117421199 B CN 117421199B CN 202311745465 A CN202311745465 A CN 202311745465A CN 117421199 B CN117421199 B CN 117421199B
- Authority
- CN
- China
- Prior art keywords
- behavior
- information
- error
- user behavior
- determining
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 58
- 238000012545 processing Methods 0.000 claims abstract description 88
- 230000002159 abnormal effect Effects 0.000 claims abstract description 53
- 238000007906 compression Methods 0.000 claims abstract description 15
- 230000006835 compression Effects 0.000 claims abstract description 14
- 230000006399 behavior Effects 0.000 claims description 286
- 239000011159 matrix material Substances 0.000 claims description 44
- 230000008569 process Effects 0.000 claims description 20
- 206010000117 Abnormal behaviour Diseases 0.000 claims description 16
- 238000004590 computer program Methods 0.000 claims description 16
- 230000005856 abnormality Effects 0.000 claims description 15
- 238000006243 chemical reaction Methods 0.000 claims description 6
- 238000004364 calculation method Methods 0.000 claims description 5
- 230000002547 anomalous effect Effects 0.000 claims description 2
- 230000003542 behavioural effect Effects 0.000 claims description 2
- 230000000694 effects Effects 0.000 abstract description 2
- 238000005516 engineering process Methods 0.000 abstract description 2
- 238000012544 monitoring process Methods 0.000 abstract description 2
- 238000012549 training Methods 0.000 description 17
- 230000005540 biological transmission Effects 0.000 description 5
- 238000010586 diagram Methods 0.000 description 5
- 238000012986 modification Methods 0.000 description 5
- 230000004048 modification Effects 0.000 description 5
- 238000013528 artificial neural network Methods 0.000 description 2
- 238000004891 communication Methods 0.000 description 2
- 230000006870 function Effects 0.000 description 2
- 238000011835 investigation Methods 0.000 description 2
- 230000033001 locomotion Effects 0.000 description 2
- 238000003062 neural network model Methods 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 230000002123 temporal effect Effects 0.000 description 2
- 238000011161 development Methods 0.000 description 1
- 238000011156 evaluation Methods 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 230000006698 induction Effects 0.000 description 1
- 238000010295 mobile communication Methods 0.000 description 1
- 230000000007 visual effect Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3438—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment monitoring of user actions
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3452—Performance evaluation by statistical analysis
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/22—Matching criteria, e.g. proximity measures
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/045—Combinations of networks
- G06N3/0455—Auto-encoder networks; Encoder-decoder networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
-
- H—ELECTRICITY
- H03—ELECTRONIC CIRCUITRY
- H03M—CODING; DECODING; CODE CONVERSION IN GENERAL
- H03M7/00—Conversion of a code where information is represented by a given sequence or number of digits to a code where the same, similar or subset of information is represented by a different sequence or number of digits
- H03M7/30—Compression; Expansion; Suppression of unnecessary data, e.g. redundancy reduction
- H03M7/70—Type of the data to be coded, other than image and sound
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Life Sciences & Earth Sciences (AREA)
- Data Mining & Analysis (AREA)
- Evolutionary Computation (AREA)
- Artificial Intelligence (AREA)
- Computational Linguistics (AREA)
- Bioinformatics & Computational Biology (AREA)
- Quality & Reliability (AREA)
- Health & Medical Sciences (AREA)
- Computer Hardware Design (AREA)
- Biomedical Technology (AREA)
- Biophysics (AREA)
- General Health & Medical Sciences (AREA)
- Software Systems (AREA)
- Evolutionary Biology (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Molecular Biology (AREA)
- Computing Systems (AREA)
- Mathematical Physics (AREA)
- Probability & Statistics with Applications (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The embodiment of the invention provides a behavior determination method, a system, a computer readable storage medium and an electronic device, and relates to the technical field of bank risk monitoring technology. The method comprises the following steps: acquiring initial user behavior information; performing coding compression processing on the behavior sequence according to a preset first coding rule to obtain first compressed data; performing decoding reconstruction processing on the first compressed data according to a first decoding rule to obtain reconstructed data; and carrying out matching processing on the behavior sequence and the reconstruction data, and determining that the initial user behavior information is abnormal under the condition that the matching processing result does not meet a first condition. The invention solves the problem of low user behavior recognition precision, thereby achieving the effect of improving the user behavior recognition precision and efficiency.
Description
Technical Field
The embodiment of the invention relates to the field of bank risk monitoring, in particular to a behavior determination method, a system, a storage medium and an electronic device.
Background
With the development of banking, identity impersonation has been a re-disaster area for credit anti-fraud and transaction anti-fraud in banking.
Although various means are used for preventing, the method is realized in such ways as interrupting the transaction flow and increasing the operation difficulty of the clients, and the methods have certain influence on the satisfaction degree of the clients and the service efficiency.
There is currently no better solution to the above problems.
Disclosure of Invention
The embodiment of the invention provides a behavior determination method and a behavior determination system, which are used for at least solving the problem of low recognition precision of abnormal behaviors in the related technology.
According to an embodiment of the present invention, there is provided a behavior determination method including:
acquiring initial user behavior information, wherein the initial user behavior information comprises a behavior sequence acquired through front-end buried points and obtained through unstructured data conversion processing;
performing coding compression processing on the behavior sequence according to a preset first coding rule to obtain first compressed data, wherein the first coding rule is determined based on time sequence characteristics of the behavior sequence;
performing decoding reconstruction processing on the first compressed data according to a first decoding rule to obtain reconstructed data, wherein the first decoding rule corresponds to the first coding rule;
and carrying out matching processing on the behavior sequence and the reconstruction data, and determining that the initial user behavior information is abnormal under the condition that a matching processing result does not meet a first condition, wherein the first condition comprises that a matching error between the behavior sequence and the reconstruction data is not matched with a preset first threshold value, and the matching processing at least comprises matching of an error distribution matrix and a preset threshold value distribution matrix.
In an exemplary embodiment, the matching the behavior sequence with the reconstruction data, and determining that the initial user behavior information has an abnormality if the matching result does not satisfy the first condition includes:
matching the behavior sequence with the reconstruction data to obtain an error value between the behavior sequence and the reconstruction data, wherein the matching error comprises the error value;
determining error distribution information of the error value based on the error value;
performing first comparison processing on the error value distribution matrix and a threshold value distribution matrix formed by the first threshold value, and performing distribution matching processing on the error distribution information;
and under the condition that the error value distribution matrix is not matched with the threshold value distribution matrix and the error distribution information does not meet the preset target error distribution, determining that the initial user behavior information is abnormal.
In an exemplary embodiment, after performing a matching process on the behavior sequence and the reconstructed data, and determining that the initial user behavior information has an abnormality if a result of the matching process does not satisfy a first condition, the method further includes:
determining user behavior characteristic information based on the initial user behavior information;
performing rule matching processing on the user behavior characteristic information to determine a behavior judgment rule corresponding to the user behavior characteristic information;
performing behavior judgment processing on the initial user behavior information through the behavior judgment rule;
and under the condition that the behavior judgment processing result determines that the initial user behavior information does not accord with the behavior judgment rule, determining that the initial user behavior information is abnormal.
In an exemplary embodiment, after the acquiring the initial user behavior information, the method further includes:
determining user characteristic information of a target client through the front-end buried point;
determining user operation abnormal characteristics according to the user characteristic information and the initial user behavior information, wherein the user operation abnormal characteristics are used for indicating the behavior abnormal characteristics of the target client for executing the first operation;
performing abnormal plan matching processing on the user operation abnormal characteristics to determine operation information corresponding to the user operation abnormal characteristics;
and executing a target operation based on the operation information.
In an exemplary embodiment, after the determining, by the front-end buried point, the user characteristic information of the target client, the method further includes:
determining historical behavior characteristic information of the target client based on the user characteristic information;
performing behavior feature matching processing on the historical behavior feature information and the user behavior feature information to determine behavior feature error information, wherein the user behavior feature information is determined based on initial user behavior information;
performing feature error calculation on the feature error information through a first formula to determine feature errors between the user behavior feature information and the historical behavior feature information, wherein the first formula comprises:
wherein, P is the characteristic error,scoring the behavior corresponding to the behavior characteristic information of the user, wherein the behavior score is obtained through big data statistics,/and->For user behavior characteristic information +.>The historical behavior characteristic information is n, and the number of the user characteristic information is n;
carrying out Gaussian fitting processing on the characteristic errors under the condition that the characteristic errors are larger than a second threshold value so as to determine characteristic distribution information of the characteristic errors;
and under the condition that the characteristic distribution information does not meet the preset characteristic distribution, determining that the initial user behavior information is abnormal.
According to another embodiment of the present invention, there is provided a behavior determination system including:
the information acquisition module is used for acquiring initial user behavior information, wherein the initial user behavior information comprises an obtained behavior sequence which is acquired through front-end buried points and is subjected to unstructured data conversion processing;
the first compression module is used for carrying out coding compression processing on the behavior sequence according to a preset first coding rule to obtain first compressed data, wherein the first coding rule is determined based on time sequence characteristics of the behavior sequence;
the first reconstruction module is used for carrying out decoding reconstruction processing on the first compressed data according to a first decoding rule so as to obtain reconstructed data, and the first decoding rule corresponds to the first coding rule;
the behavior determining module is used for carrying out matching processing on the behavior sequence and the reconstruction data, and determining that the initial user behavior information is abnormal under the condition that a matching processing result does not meet a first condition, wherein the first condition comprises that a matching error between the behavior sequence and the reconstruction data is not matched with a preset first threshold value, and the matching processing at least comprises matching of an error distribution matrix and a preset threshold value distribution matrix.
According to a further embodiment of the invention, there is also provided a computer readable storage medium having stored therein a computer program, wherein the computer program is arranged to perform the steps of any of the method embodiments described above when run.
According to a further embodiment of the invention, there is also provided an electronic device comprising a memory having stored therein a computer program and a processor arranged to run the computer program to perform the steps of any of the method embodiments described above.
According to the invention, the abnormal behavior can be intuitively expressed by encoding and decoding the behavior sequence of the user and comparing the result after decoding and reconstructing with the initial result, and the abnormal behavior does not need to be judged, so that the problem of low recognition precision of the abnormal behavior can be solved, and the effect of improving the recognition precision and efficiency of the abnormal behavior can be achieved.
Drawings
Fig. 1 is a block diagram of a hardware structure of a mobile terminal of a behavior determination method according to an embodiment of the present invention;
FIG. 2 is a flow chart of a behavior determination method according to an embodiment of the present invention;
FIG. 3 is a schematic diagram of an embodiment of the present invention;
fig. 4 is a block diagram of a behavior determination system according to an embodiment of the present invention.
Detailed Description
Embodiments of the present invention will be described in detail below with reference to the accompanying drawings in conjunction with the embodiments.
It should be noted that the terms "first," "second," and the like in the description and the claims of the present invention and the above figures are used for distinguishing between similar objects and not necessarily for describing a particular sequential or chronological order.
The method embodiments provided in the embodiments of the present application may be performed in a mobile terminal, a computer terminal or similar computing device. Taking the mobile terminal as an example, fig. 1 is a block diagram of a hardware structure of a mobile terminal according to an embodiment of the present invention. As shown in fig. 1, a mobile terminal may include one or more (only one is shown in fig. 1) processors 102 (the processor 102 may include, but is not limited to, a microprocessor MCU or a processing device such as a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 for communication functions and an input-output device 108. It will be appreciated by those skilled in the art that the structure shown in fig. 1 is merely illustrative and not limiting of the structure of the mobile terminal described above. For example, the mobile terminal may also include more or fewer components than shown in fig. 1, or have a different configuration than shown in fig. 1.
The memory 104 may be used to store a computer program, for example, a software program of application software and a module, such as a computer program corresponding to a behavior determining method in an embodiment of the present invention, and the processor 102 executes the computer program stored in the memory 104 to perform various functional applications and data processing, that is, implement the above-mentioned method. Memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include memory remotely located relative to the processor 102, which may be connected to the mobile terminal via a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.
The transmission device 106 is used to receive or transmit data via a network. Specific examples of the network described above may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, simply referred to as NIC) that can connect to other network devices through a base station to communicate with the internet. In one example, the transmission device 106 may be a Radio Frequency (RF) module, which is configured to communicate with the internet wirelessly.
In this embodiment, a behavior determining method is provided, fig. 2 is a flowchart of a behavior determining according to an embodiment of the present invention, and as shown in fig. 2, the flowchart includes the following steps:
step S201, obtaining initial user behavior information, wherein the initial user behavior information comprises a behavior sequence obtained by collecting through front-end buried points and performing unstructured data conversion processing;
in this embodiment, unstructured processing is performed on behavior information of a user to avoid interference of other information on behavior recognition of the user in different environments, so that accuracy of behavior recognition of the user is improved, and accuracy of overall behavior judgment is guaranteed.
The front-end embedded point comprises embedded points on a visual interface, wherein the embedded points can be used for performing behavior operation induction or information acquisition and generally comprise device equipment such as a sensor, and the front-end embedded point mainly focuses on user behaviors, such as browsing information, clicking operation information and the like of a user on a page; the initial user behavior information includes, but is not limited to, time consuming operation, error modification times, residence time, machine model, jail break, electric quantity, IP address, screen capturing behavior, equipment serial number, equipment version type, base station information and other relevant information when a user operates, and the behavior sequence is shown as an input end X1-X10 sequence in FIG. 3.
Step S202, carrying out coding compression processing on the behavior sequence according to a preset first coding rule to obtain first compressed data, wherein the first coding rule is determined based on time sequence characteristics of the behavior sequence;
in this embodiment, the encoding compression is performed according to the first encoding rule to perform unified processing on the behavior data, that is, to enable different types of behavior data to be processed in the same data format, and in this process, if there is an abnormality in the behavior data, the behavior data is identified quickly in the subsequent processing process because normal encoding cannot be performed, so that the identification accuracy of the behavior information is improved.
The first coding rule can be obtained by learning and training a neural network model through big data, and can be used for coding normal operation behaviors and not abnormal behaviors after being trained; the first compressed data comprises data obtained by encoding and compressing a sequence of actions, which data can be implemented by an encoder.
It should be noted that, since the behavior sequence has a regional nature and a temporal nature, different encoding and decoding rules can be pre-configured in advance according to the regional nature and the temporal nature of the behavior sequence, so as to perform formal encoding and decoding on different data, thereby increasing the cost of impersonation of the user behavior and improving the recognition capability of abnormal behaviors; specifically, the corresponding codec rules may be set, but are not limited to, by geographic features of user behavior (e.g., physical movement range over a period of time, coordinates of an operation location (whether the same location coordinate or coordinates), distribution of locations, etc.), operating frequency or operating speed over a period of time (specifically reflected in the number of message queues and intervals between queues), etc.
Step 203, performing decoding reconstruction processing on the first compressed data according to a first decoding rule to obtain reconstructed data, where the first decoding rule corresponds to the first encoding rule;
in this embodiment, the decoding reconstruction is performed on the first compressed data to determine whether the encoded data can be reconstructed normally, and in general, the error of the encoded data is within a certain range according to a specific rule, so if the error is out of the range, it can be explained that the data is abnormal.
Wherein the first decoding rule corresponds to the first encoding rule, and the encoding reconstruction process may be implemented by an Autoencoder that performs neural network model training, which essentially uses a neural network to produce a low-dimensional representation of the high-dimensional input. According to the Autoencoder trained by the normal data, normal samples can be rebuilt and restored, but data points which are different from normal distribution cannot be restored well, a plurality of errors are generated at the moment, and the subsequent processing can be conveniently carried out only by generating the errors.
Step S204, performing a matching process on the behavior sequence and the reconstructed data, and determining that the initial user behavior information is abnormal if the matching process result does not meet a first condition, where the first condition includes that a matching error between the behavior sequence and the reconstructed data is not matched with a preset first threshold, and the matching process includes at least matching of an error distribution matrix and a preset threshold distribution matrix.
In this embodiment, during normal encoding and decoding, there is a small amount of data distortion, so that decoding abnormality of Xu Shaoliang is allowed during decoding, the decoding abnormality is usually within a certain range, and if the decoding abnormality exceeds the range, it is indicated that the originally encoded data is abnormal, thereby comparing the decoded and reconstructed data with the original initial user behavior information, and judging whether the initial user behavior information is abnormal according to the comparison result.
The first threshold may be a threshold range of allowable anomalies obtained by performing codec training statistics on big data.
Through the steps, the behavior information is encoded and decoded, whether the behavior information is abnormal or not is judged according to the results before and after encoding and decoding, judgment and identification of the behavior information are not needed, the problem of low accuracy of the identification result caused by the judgment and identification of the behavior information in a complex environment is avoided, the problem of low accuracy of the behavior identification is solved, and the accuracy and efficiency of the behavior identification are improved.
The main execution body of the above steps may be, but not limited to, a base station, a terminal, and the like.
In an optional embodiment, the matching the behavior sequence with the reconstructed data, and determining that the initial user behavior information has an abnormality if the matching result does not satisfy the first condition includes:
step S2041, performing a matching process on the behavior sequence and the reconstruction data to obtain an error value between the behavior sequence and the reconstruction data, where the matching error includes the error value;
step S2042 of determining error distribution information of the error value based on the error value;
step S2043, performing a first comparison process on the error value distribution matrix and a threshold distribution matrix formed by the first threshold, and performing a distribution matching process on the error distribution information;
step S2044, determining that the initial user behavior information is abnormal if the error value distribution matrix is not matched with the threshold distribution matrix and the error distribution information does not satisfy a preset target error distribution.
In this embodiment, the error value is determined to determine the error magnitude of the behavior information before and after the encoding and decoding, the error distribution is determined to determine the error distribution, and the error distribution is generally distributed based on the time domain of the behavior sequence, so that a sequence-error distribution matrix based on the time domain can be obtained, and the relationship between the features can be further determined based on the distribution matrix, so that whether the error belongs to a reasonable error can be comprehensively determined.
The error value may be a difference value between data before and after encoding and decoding, or may be a difference value in other expression forms, and the matching error may include other error data generated in the matching process in addition to the error value; correspondingly, the error distribution matrix includes the distribution of error values in the behavior sequence before and after encoding and decoding, for example, the information distribution matrix before encoding is [0,1, 0], the information distribution after encoding is [0,1, 0], the error distribution matrix is [0,1, 0], and the preset and the distribution matrix is [0,1, 0], at this time, the error distribution matrix is not matched with the threshold value distribution matrix, and at the same time, the normal error distribution matrix (that is, the error of the partial sequence is allowed) should be [0,1, 0], obviously, the current error distribution matrix is not matched with the normal error distribution matrix, so that it can be known that the related information distribution is abnormal.
Of course, whether the related information is abnormal may be determined according to whether the distribution of the error value satisfies the gaussian distribution or the gaussian distribution peak value, whether the distribution section coincides with a preset gaussian distribution, whether the preset peak value and the distribution section are coincident with each other, or whether the coincidence rate is greater than a certain threshold.
In an alternative embodiment, before the encoding compression processing is performed on the behavior sequence according to a preset first encoding rule to obtain first compressed data, the method further includes:
step S2021, acquiring a training data set, wherein the training data set includes user behavior training information;
step S202, training rules on an initial learning model pair of the first encoder through the training data set to obtain a target model for executing a first coding rule, wherein the target model is used for carrying out coding compression processing on the behavior sequence according to a preset first coding rule.
In this embodiment, before encoding, training of the first encoding rule is required, and training of massive data is performed through the neural network in this process to improve encoding accuracy.
In an optional embodiment, after performing a matching process on the behavior sequence and the reconstructed data, and determining that the initial user behavior information has an abnormality if a result of the matching process does not satisfy a first condition, the method further includes:
step S205, determining user behavior characteristic information based on the initial user behavior information;
step S206, performing rule matching processing on the user behavior feature information to determine a behavior judgment rule corresponding to the user behavior feature information;
step S207, performing behavior judgment processing on the initial user behavior information through the behavior judgment rule;
step S208, when the behavior determination processing result determines that the initial user behavior information does not conform to the behavior determination rule, determining that the initial user behavior information is abnormal.
In this embodiment, for different operation behaviors, corresponding judgment rules may be preset in the database, so as to improve the judgment efficiency.
The user behavior characteristic information comprises characteristic information such as operation time, IP address, historical operation time, historical IP address and the like of a user for performing certain operation; the behavior judgment rule includes a rule stored in advance in a database.
For example, by embedding a behavior data acquisition point at the front end, relevant information characteristics of time consuming operation, error modification times, residence time, machine model, jail break, electric quantity, IP address, screen capturing behavior, equipment serial number, equipment version type, base station information and the like of a client can be acquired, and then a judgment rule is determined for the information, and information is checked according to the information characteristics and the judgment rule.
In an alternative embodiment, after said obtaining the initial user behavior information, the method further comprises:
step S2011, determining user characteristic information of a target client through the front-end buried point;
step S2012, determining a user operation abnormality feature according to the user feature information and the initial user behavior information, where the user operation abnormality feature is used to indicate a behavior abnormality feature of the target client for executing a first operation;
step S2013, carrying out abnormal plan matching processing on the abnormal user operation characteristics so as to determine operation information corresponding to the abnormal user operation characteristics;
and step S2014, executing a target operation based on the operation information.
In this embodiment, in addition to the investigation and identification of the user behavior, the investigation and identification of whether the user is himself can be performed, so that the identification accuracy is enhanced.
The user characteristic information comprises characteristic information related to the user, such as face characteristics, environment characteristics and the like of the user; the user operation abnormal characteristics include characteristics when the user performs a certain abnormal behavior, such as the number of times of performing the abnormal behavior, the IP address of the abnormal behavior, and the like; the abnormal plan may be a plan operation corresponding to an abnormal operation stored in the database in advance, and the corresponding target operation includes an operation performed in the case of judging that the user operation is abnormal, such as an alarm, an account freeze, and the like, and the operation information includes an operation instruction for instructing the execution of the target operation, and the like.
For example, the front-end data is used for collecting the face characteristics of the user, then the face characteristics are used for identifying whether the user operates the user, then the user is identified for the abnormal operation characteristics of the user, the frequent abnormal operation is identified, a corresponding alarm is given, and meanwhile, corresponding emergency plan measures are started, so that economic losses are recovered or reduced for the user in no sense, the customer transaction losses caused by counterfeiting and theft are reduced, and the satisfaction degree of the user is improved.
It should be noted that, whether the user is judged by the user characteristic information of the user, and then the operation behavior is judged (i.e. the user is determined and then the operation is tracked) is compared with whether the user is the user according to the abnormality of the operation behavior (i.e. whether the operation is tracked according to the operation), so that the situation that the user is stolen can be more accurately avoided.
In an alternative embodiment, after said determining the user characteristic information of the target client by said front-end buried point, the method further comprises:
step S20111, determining historical behavior characteristic information of the target client based on the user characteristic information;
step S20112, performing behavior feature matching processing on the historical behavior feature information and the user behavior feature information to determine behavior feature error information, wherein the user behavior feature information is determined based on initial user behavior information;
step S20113, performing feature error calculation on the feature error information through a first formula to determine a feature error between the user behavior feature information and the historical behavior feature information, where the first formula includes:
wherein, P is the characteristic error,scoring the behavior corresponding to the behavior characteristic information of the user, wherein the behavior score is obtained through big data statistics,/and->For user behavior characteristic information +.>The historical behavior characteristic information is n, and the number of the user characteristic information is n;
step S20114, carrying out Gaussian fitting processing on the characteristic errors to determine characteristic distribution information of the characteristic errors under the condition that the characteristic errors are larger than a second threshold;
step S20115, determining that the initial user behavior information is abnormal if the feature distribution information does not meet a preset feature distribution.
In this embodiment, under normal conditions, the range of motion, the operating environment, and the operating content of the user are fixed, so that the behavior characteristics when the user operates are generally changed within a certain range, and when abnormal behavior occurs, the behavior characteristics are changed greatly, so that the error at this time will increase, and thus it can be determined whether the user behavior is abnormal.
The historical behavior characteristic information comprises behavior characteristics of a user when the user performs the same operation in a past time period, such as time consumption of the operation, error modification times, stay time, machine model number, whether jail is broken, electric quantity, IP address, whether screen capturing behavior exists, equipment serial number, equipment version type, base station information and the like; setting behavioral scoresThe method is used for avoiding interference of the behaviors of the staff on the evaluation of the user behaviors; the Gaussian fitting is performed to determine whether the distribution of the characteristic errors has a large variation, so that whether the abnormal behavior is fraudulent or not can be judged more accurately.
From the description of the above embodiments, it will be clear to a person skilled in the art that the method according to the above embodiments may be implemented by means of software plus the necessary general hardware platform, but of course also by means of hardware, but in many cases the former is a preferred embodiment. Based on such understanding, the technical solution of the present invention may be embodied essentially or in a part contributing to the prior art in the form of a software product stored in a storage medium (e.g. ROM/RAM, magnetic disk, optical disk) comprising instructions for causing a terminal device (which may be a mobile phone, a computer, a server, or a network device, etc.) to perform the method according to the embodiments of the present invention.
The present embodiment also provides a behavior determination system, which is used to implement the foregoing embodiments and preferred embodiments, and is not described in detail. As used below, the term "module" may be a combination of software and/or hardware that implements a predetermined function. While the means described in the following embodiments are preferably implemented in software, implementation in hardware, or a combination of software and hardware, is also possible and contemplated.
FIG. 4 is a block diagram of a behavior determination system, as shown in FIG. 4, according to an embodiment of the present invention, comprising:
the information acquisition module 31 is configured to acquire initial user behavior information, where the initial user behavior information includes a behavior sequence acquired through front-end buried points and obtained through unstructured data conversion processing;
the first compression module 32 is configured to perform a coding compression process on the behavior sequence according to a preset first coding rule to obtain first compressed data, where the first coding rule is determined based on a time sequence feature of the behavior sequence;
a first reconstruction module 33, configured to perform decoding reconstruction processing on the first compressed data according to a first decoding rule, so as to obtain reconstructed data, where the first decoding rule corresponds to the first encoding rule;
the behavior determining module 34 is configured to perform a matching process on the behavior sequence and the reconstructed data, and determine that the initial user behavior information is abnormal if a result of the matching process does not satisfy a first condition, where the first condition includes that a matching error between the behavior sequence and the reconstructed data does not match a preset first threshold, and the matching process includes at least matching of an error distribution matrix and a preset threshold distribution matrix.
In an alternative embodiment, the behavior determination module 34 includes:
an error value determining unit, configured to perform matching processing on the behavior sequence and the reconstruction data, so as to obtain an error value between the behavior sequence and the reconstruction data, where the matching error includes the error value;
an error distribution determining unit configured to determine error distribution information of the error value based on the error value;
the error processing unit is used for performing first comparison processing on the error value distribution matrix and a threshold value distribution matrix formed by the first threshold value, and performing distribution matching processing on the error distribution information;
an anomaly determination unit, configured to determine that the initial user behavior information is anomalous when the error value distribution matrix does not match the threshold distribution matrix and the error distribution information does not satisfy a preset target error distribution.
In an alternative embodiment, the system further comprises:
the training data acquisition module is used for acquiring a training data set before carrying out coding compression processing on the behavior sequence according to a preset first coding rule to obtain first compressed data, wherein the training data set comprises user behavior training information;
the model training module is used for carrying out rule training on the initial learning model pair of the first encoder through the training data set so as to obtain a target model for executing the first coding rule, wherein the target model is used for carrying out coding compression processing on the behavior sequence according to the preset first coding rule.
In an alternative embodiment, the system further comprises:
the behavior characteristic determining module is used for performing matching processing on the behavior sequence and the reconstruction data, and determining user behavior characteristic information based on the initial user behavior information after determining that the initial user behavior information is abnormal under the condition that a matching processing result does not meet a first condition;
the rule matching module is used for carrying out rule matching processing on the user behavior characteristic information so as to determine a behavior judgment rule corresponding to the user behavior characteristic information;
the behavior judging module is used for carrying out behavior judging processing on the initial user behavior information through the behavior judging rule;
and the abnormality judgment module is used for determining that the initial user behavior information is abnormal under the condition that the behavior judgment processing result determines that the initial user behavior information does not accord with the behavior judgment rule.
In an alternative embodiment, the system further comprises:
after the initial user behavior information is acquired, determining user characteristic information of a target client through the front-end buried point;
determining user operation abnormal characteristics according to the user characteristic information and the initial user behavior information, wherein the user operation abnormal characteristics are used for indicating the behavior abnormal characteristics of the target client for executing the first operation;
performing abnormal plan matching processing on the user operation abnormal characteristics to determine operation information corresponding to the user operation abnormal characteristics;
and executing a target operation based on the operation information.
In an alternative embodiment, the system further comprises:
the historical characteristic determining module is used for determining historical behavior characteristic information of the target client based on the user characteristic information after the user characteristic information of the target client is determined through the front-end buried point;
the behavior feature matching module is used for performing behavior feature matching processing on the historical behavior feature information and the user behavior feature information to determine behavior feature error information, wherein the user behavior feature information is determined based on initial user behavior information;
the characteristic error calculation module is configured to perform characteristic error calculation on the characteristic error information through a first formula to determine a characteristic error between the user behavior characteristic information and the historical behavior characteristic information, where the first formula includes:
wherein, P is the characteristic error,scoring the behavior corresponding to the behavior characteristic information of the user, wherein the behavior score is obtained through big data statistics,/and->For user behavior characteristic information +.>The historical behavior characteristic information is n, and the number of the user characteristic information is n;
the Gaussian fitting module is used for carrying out Gaussian fitting processing on the characteristic errors under the condition that the characteristic errors are larger than a second threshold value so as to determine characteristic distribution information of the characteristic errors;
the abnormal behavior determining module is used for determining that the initial user behavior information is abnormal under the condition that the characteristic distribution information does not meet the preset characteristic distribution.
It should be noted that each of the above modules may be implemented by software or hardware, and for the latter, it may be implemented by, but not limited to: the modules are all located in the same processor; alternatively, the above modules may be located in different processors in any combination.
Embodiments of the present invention also provide a computer readable storage medium having a computer program stored therein, wherein the computer program is arranged to perform the steps of any of the method embodiments described above when run.
In one exemplary embodiment, the computer readable storage medium may include, but is not limited to: a usb disk, a Read-Only Memory (ROM), a random access Memory (Random Access Memory, RAM), a removable hard disk, a magnetic disk, or an optical disk, or other various media capable of storing a computer program.
An embodiment of the invention also provides an electronic device comprising a memory having stored therein a computer program and a processor arranged to run the computer program to perform the steps of any of the method embodiments described above.
In an exemplary embodiment, the electronic apparatus may further include a transmission device connected to the processor, and an input/output device connected to the processor.
Specific examples in this embodiment may refer to the examples described in the foregoing embodiments and the exemplary implementation, and this embodiment is not described herein.
It will be appreciated by those skilled in the art that the modules or steps of the invention described above may be implemented in a general purpose computing device, they may be concentrated on a single computing device, or distributed across a network of computing devices, they may be implemented in program code executable by computing devices, so that they may be stored in a storage device for execution by computing devices, and in some cases, the steps shown or described may be performed in a different order than that shown or described herein, or they may be separately fabricated into individual integrated circuit modules, or multiple modules or steps of them may be fabricated into a single integrated circuit module. Thus, the present invention is not limited to any specific combination of hardware and software.
The above description is only of the preferred embodiments of the present invention and is not intended to limit the present invention, but various modifications and variations can be made to the present invention by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the principle of the present invention should be included in the protection scope of the present invention.
Claims (8)
1. A method of behavioral determination comprising:
acquiring initial user behavior information, wherein the initial user behavior information comprises a behavior sequence acquired through front-end buried points and obtained through unstructured data conversion processing;
performing coding compression processing on the behavior sequence according to a preset first coding rule to obtain first compressed data, wherein the first coding rule is determined based on time sequence characteristics of the behavior sequence;
performing decoding reconstruction processing on the first compressed data according to a first decoding rule to obtain reconstructed data, wherein the first decoding rule corresponds to the first coding rule;
performing matching processing on the behavior sequence and the reconstruction data, and determining that the initial user behavior information is abnormal under the condition that a matching processing result does not meet a first condition, wherein the first condition comprises that a matching error between the behavior sequence and the reconstruction data is not matched with a preset first threshold value, and the matching processing at least comprises matching of an error distribution matrix and a preset threshold value distribution matrix;
wherein, the matching processing is performed on the behavior sequence and the reconstruction data, and when the matching processing result does not meet the first condition, determining that the initial user behavior information has an abnormality further includes:
matching the behavior sequence with the reconstruction data to obtain an error value between the behavior sequence and the reconstruction data, wherein the matching error comprises the error value;
determining error distribution information of the error values based on the error values, wherein the error distribution information comprises an error value distribution matrix;
performing first comparison processing on the error value distribution matrix and a threshold value distribution matrix formed by the first threshold value, and performing distribution matching processing on the error distribution information;
and under the condition that the error value distribution matrix is not matched with the threshold value distribution matrix and the error distribution information does not meet the preset target error distribution, determining that the initial user behavior information is abnormal.
2. The method according to claim 1, wherein after performing a matching process on the behavior sequence and the reconstructed data and determining that the initial user behavior information is abnormal if a first condition is not satisfied as a result of the matching process, the method further comprises:
determining user behavior characteristic information based on the initial user behavior information;
performing rule matching processing on the user behavior characteristic information to determine a behavior judgment rule corresponding to the user behavior characteristic information;
performing behavior judgment processing on the initial user behavior information through the behavior judgment rule;
and under the condition that the behavior judgment processing result determines that the initial user behavior information does not accord with the behavior judgment rule, determining that the initial user behavior information is abnormal.
3. The method of claim 1, wherein after the obtaining the initial user behavior information, the method further comprises:
determining user characteristic information of a target client through the front-end buried point;
determining user operation abnormal characteristics according to the user characteristic information and the initial user behavior information, wherein the user operation abnormal characteristics are used for indicating the behavior abnormal characteristics of the target client for executing the first operation;
performing abnormal plan matching processing on the user operation abnormal characteristics to determine operation information corresponding to the user operation abnormal characteristics;
and executing a target operation based on the operation information.
4. A method according to claim 3, wherein after said determining user characteristic information of a target client by said head-end point, the method further comprises:
determining historical behavior characteristic information of the target client based on the user characteristic information;
performing behavior feature matching processing on the historical behavior feature information and the user behavior feature information to determine behavior feature error information, wherein the user behavior feature information is determined based on initial user behavior information;
performing feature error calculation on the feature error information through a first formula to determine feature errors between the user behavior feature information and the historical behavior feature information, wherein the first formula comprises:
wherein, P is the characteristic error,scoring the behavior corresponding to the behavior characteristic information of the user, wherein the behavior score is obtained through big data statistics,/and->For user behavior characteristic information +.>The historical behavior characteristic information is n, and the number of the user characteristic information is n;
carrying out Gaussian fitting processing on the characteristic errors under the condition that the characteristic errors are larger than a second threshold value so as to determine characteristic distribution information of the characteristic errors;
and under the condition that the characteristic distribution information does not meet the preset characteristic distribution, determining that the initial user behavior information is abnormal.
5. A behavior determination system, comprising:
the information acquisition module is used for acquiring initial user behavior information, wherein the initial user behavior information comprises a behavior sequence acquired through front-end buried points and obtained through unstructured data conversion processing;
the first compression module is used for carrying out coding compression processing on the behavior sequence according to a preset first coding rule to obtain first compressed data, wherein the first coding rule is determined based on time sequence characteristics of the behavior sequence;
the first reconstruction module is used for carrying out decoding reconstruction processing on the first compressed data according to a first decoding rule so as to obtain reconstruction data;
the behavior determining module is used for carrying out matching processing on the behavior sequence and the reconstruction data, and determining that the initial user behavior information is abnormal under the condition that a matching processing result does not meet a first condition, wherein the first condition comprises that a matching error between the behavior sequence and the reconstruction data is not matched with a preset first threshold value, and the matching processing at least comprises matching of an error distribution matrix and a preset threshold value distribution matrix;
wherein the behavior determination module comprises:
an error value determining unit, configured to perform matching processing on the behavior sequence and the reconstruction data, so as to obtain an error value between the behavior sequence and the reconstruction data, where the matching error includes the error value;
an error distribution determining unit configured to determine error distribution information of the error value based on the error value;
the error processing unit is used for performing first comparison processing on the error value distribution matrix and a threshold value distribution matrix formed by the first threshold value, and performing distribution matching processing on the error distribution information;
an anomaly determination unit, configured to determine that the initial user behavior information is anomalous when the error value distribution matrix does not match the threshold distribution matrix and the error distribution information does not satisfy a preset target error distribution.
6. The system of claim 5, wherein the system further comprises:
the behavior characteristic determining module is used for performing matching processing on the behavior sequence and the reconstruction data, and determining user behavior characteristic information based on the initial user behavior information after determining that the initial user behavior information is abnormal under the condition that a matching processing result does not meet a first condition;
the rule matching module is used for carrying out rule matching processing on the user behavior characteristic information so as to determine a behavior judgment rule corresponding to the user behavior characteristic information;
the behavior judging module is used for carrying out behavior judging processing on the initial user behavior information through the behavior judging rule;
and the abnormality judgment module is used for determining that the initial user behavior information is abnormal under the condition that the behavior judgment processing result determines that the initial user behavior information does not accord with the behavior judgment rule.
7. A computer readable storage medium, characterized in that the computer readable storage medium has stored therein a computer program, wherein the computer program is arranged to execute the method of any of the claims 1 to 4 when run.
8. An electronic device comprising a memory and a processor, characterized in that the memory has stored therein a computer program, the processor being arranged to run the computer program to perform the method of any of the claims 1 to 4.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311745465.5A CN117421199B (en) | 2023-12-19 | 2023-12-19 | Behavior determination method and system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311745465.5A CN117421199B (en) | 2023-12-19 | 2023-12-19 | Behavior determination method and system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN117421199A CN117421199A (en) | 2024-01-19 |
| CN117421199B true CN117421199B (en) | 2024-04-02 |
Family
ID=89528841
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202311745465.5A Active CN117421199B (en) | 2023-12-19 | 2023-12-19 | Behavior determination method and system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117421199B (en) |
Citations (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108711085A (en) * | 2018-05-09 | 2018-10-26 | 平安普惠企业管理有限公司 | A kind of response method and its equipment of transaction request |
| CN109583161A (en) * | 2018-11-27 | 2019-04-05 | 咪咕文化科技有限公司 | A kind of information processing method and device, storage medium |
| CN111178523A (en) * | 2019-08-02 | 2020-05-19 | 腾讯科技（深圳）有限公司 | Behavior detection method and device, electronic equipment and storage medium |
| CN112107866A (en) * | 2020-09-28 | 2020-12-22 | 腾讯科技（深圳）有限公司 | User behavior data processing method, device, equipment and storage medium |
| CN113221104A (en) * | 2021-05-12 | 2021-08-06 | 北京百度网讯科技有限公司 | User abnormal behavior detection method and user behavior reconstruction model training method |
| CN114419528A (en) * | 2022-04-01 | 2022-04-29 | 浙江口碑网络技术有限公司 | Anomaly identification method and device, computer equipment and computer readable storage medium |
| CN115795345A (en) * | 2022-11-30 | 2023-03-14 | 中国工商银行股份有限公司 | Information processing method, device, equipment and storage medium |
| CN116185694A (en) * | 2023-03-06 | 2023-05-30 | 重庆大学 | Multi-element time sequence abnormality detection and diagnosis method based on similarity |
| CN116258991A (en) * | 2023-02-03 | 2023-06-13 | 北京集度科技有限公司 | Abnormality detection apparatus, abnormality detection system, abnormality detection method, and computer program product |
| CN116614637A (en) * | 2023-07-19 | 2023-08-18 | 腾讯科技（深圳）有限公司 | Data processing method, device, equipment and readable storage medium |
| CN116957049A (en) * | 2023-09-20 | 2023-10-27 | 南京邮电大学 | Unsupervised internal threat detection method based on countermeasure self-encoder |
Family Cites Families (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US11205121B2 (en) * | 2018-06-20 | 2021-12-21 | Disney Enterprises, Inc. | Efficient encoding and decoding sequences using variational autoencoders |
| US20220188601A1 (en) * | 2020-12-15 | 2022-06-16 | Cornell University | System implementing encoder-decoder neural network adapted to prediction in behavioral and/or physiological contexts |
| US20220207326A1 (en) * | 2020-12-31 | 2022-06-30 | Intuit Inc. | Anomaly detection, data prediction, and generation of human-interpretable explanations of anomalies |
| US20230325631A1 (en) * | 2022-04-12 | 2023-10-12 | Optum, Inc. | Combined deep learning inference and compression using sensed data |
-
2023
- 2023-12-19 CN CN202311745465.5A patent/CN117421199B/en active Active
Patent Citations (11)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108711085A (en) * | 2018-05-09 | 2018-10-26 | 平安普惠企业管理有限公司 | A kind of response method and its equipment of transaction request |
| CN109583161A (en) * | 2018-11-27 | 2019-04-05 | 咪咕文化科技有限公司 | A kind of information processing method and device, storage medium |
| CN111178523A (en) * | 2019-08-02 | 2020-05-19 | 腾讯科技（深圳）有限公司 | Behavior detection method and device, electronic equipment and storage medium |
| CN112107866A (en) * | 2020-09-28 | 2020-12-22 | 腾讯科技（深圳）有限公司 | User behavior data processing method, device, equipment and storage medium |
| CN113221104A (en) * | 2021-05-12 | 2021-08-06 | 北京百度网讯科技有限公司 | User abnormal behavior detection method and user behavior reconstruction model training method |
| CN114419528A (en) * | 2022-04-01 | 2022-04-29 | 浙江口碑网络技术有限公司 | Anomaly identification method and device, computer equipment and computer readable storage medium |
| CN115795345A (en) * | 2022-11-30 | 2023-03-14 | 中国工商银行股份有限公司 | Information processing method, device, equipment and storage medium |
| CN116258991A (en) * | 2023-02-03 | 2023-06-13 | 北京集度科技有限公司 | Abnormality detection apparatus, abnormality detection system, abnormality detection method, and computer program product |
| CN116185694A (en) * | 2023-03-06 | 2023-05-30 | 重庆大学 | Multi-element time sequence abnormality detection and diagnosis method based on similarity |
| CN116614637A (en) * | 2023-07-19 | 2023-08-18 | 腾讯科技（深圳）有限公司 | Data processing method, device, equipment and readable storage medium |
| CN116957049A (en) * | 2023-09-20 | 2023-10-27 | 南京邮电大学 | Unsupervised internal threat detection method based on countermeasure self-encoder |
Also Published As
| Publication number | Publication date |
|---|---|
| CN117421199A (en) | 2024-01-19 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107316198B (en) | Account risk identification method and device | |
| CN110781433B (en) | Data type determining method and device, storage medium and electronic device | |
| CN110827094A (en) | Anti-cheating method and system for advertisement delivery | |
| CN116112292B (en) | Abnormal behavior detection method, system and medium based on network flow big data | |
| CN110619527B (en) | Fraud early warning information generation method and device | |
| CN112669187B (en) | Identity recognition method and device, electronic equipment and related products | |
| CN113946590A (en) | Method, device and equipment for updating integral data and storage medium | |
| CN110675252A (en) | Risk assessment method and device, electronic equipment and storage medium | |
| CN112183098A (en) | Session processing method and device, storage medium and electronic device | |
| CN112437034B (en) | False terminal detection method and device, storage medium and electronic device | |
| CN110457601B (en) | Social account identification method and device, storage medium and electronic device | |
| CN106998336A (en) | User's detection method and device in channel | |
| CN117421199B (en) | Behavior determination method and system | |
| CN113065901A (en) | Wind control system and method for integral business system | |
| CN110162957B (en) | Authentication method and device for intelligent equipment, storage medium and electronic device | |
| CN116302889A (en) | Performance test method and device for functional module and server | |
| CN116151965A (en) | Risk feature extraction method and device, electronic equipment and storage medium | |
| CN111694969B (en) | User identity identification method and device | |
| CN114707420A (en) | Credit fraud behavior identification method, device, equipment and storage medium | |
| CN115439928A (en) | Operation behavior identification method and device | |
| CN112950222A (en) | Resource processing abnormity detection method and device, electronic equipment and storage medium | |
| CN111784348B (en) | Account risk identification method and device | |
| CN111723648B (en) | Identity identification method and system for electric power operation | |
| CN115811735A (en) | Information identification method, model training method, related device and electronic equipment | |
| CN118154194A (en) | Digital payment identity security verification method and system based on cloud platform |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |