TW201828198A - Risk identification method and apparatus capable of predicting potential risk user in advance through monitoring real time network behavior data of a user by data modeling - Google Patents

Abstract

The present provides a risk identification method and an apparatus. Through real time obtaining network behavior data of a user target object, risk identification is performed to the network behavior data according to a predetermined risk model for obtaining risk probability of the user. The present invention can automatically identify risk users through data modeling according to the network behavior data of the user, which can greatly increase the objectivity and accuracy of the user risk identification. Further, by means of data modeling, the user's real-time network behavior data can be monitored, and potential risk users can be predicted in advance, which is beneficial to improving products or services.

Description

 Risk identification method and device  

The invention relates to the technical field of data processing, in particular to a risk identification method and device.

In the process of using the products or services provided by the enterprise, users often encounter various problems such as product failure, server application time, and work order submission failure. With the accumulation of these problems, users' experience of the product or service is getting worse and worse, and the company will receive more and more complaints, which will affect the promotion of products or services, in order to further promote products or services. It is bound to require enterprises to increase costs.

At present, in order to improve the user's experience with products or services, reduce the user's complaint rate, and improve user satisfaction, enterprises can capture users with poor experience through manual periodic search, and then differentiate the treatment through active care or work orders. To improve the satisfaction of users with poor experience. The method of manually searching the user periodically is shown in Figure 1. The entire process of the method requires manual intervention, which increases labor costs.

Moreover, the prior art generally captures users who are less experienced according to the user's complaints, and performs manual appeasement or work order differentiation treatment for these users, and more focuses on the identification and remediation after the occurrence of problems, and cannot find the existing risk users in time, affecting the products. Or the promotion efficiency of the service.

The invention provides a risk identification method and device, which are used for solving the problem that the user is unable to find the risk user in time and affect the promotion efficiency of the product or the service by manually searching for the user to improve the satisfaction.

In order to achieve the above object, the present invention provides a risk identification method, including: instantly acquiring network behavior data when a user uses a target object; performing risk identification on the network behavior data according to a pre-established risk model, and obtaining the risk of the user Probability.

In order to achieve the above object, the present invention provides a risk identification apparatus, including: an acquisition module, configured to instantly acquire network behavior data when a user uses a target object; and a risk identification module, configured to use the risk model according to a pre-established risk model The network behavior data is used for risk identification to obtain the risk probability of the user.

The risk identification method and device of the present invention obtains the risk probability of the user by obtaining the risk behavior of the network behavior data according to the pre-established risk model by instantly acquiring the network behavior data when the user uses the target object. In the invention, according to the user's network behavior data, the risk user can be automatically identified through data modeling, which can greatly improve the objectivity and accuracy of the user risk identification. Further, the data modeling method is used to monitor the user's instantaneous network behavior data, which can predict potential risk users in advance, and is beneficial to improving the promotion efficiency of products or services.

11‧‧‧Get the module

12‧‧‧ Risk Identification Module

13‧‧‧ Rating Module

14‧‧‧Determining the module

15‧‧‧ training module

16‧‧‧Model Construction Module

131‧‧‧Output unit

132‧‧‧ receiving unit

133‧‧‧ rating unit

1 is a schematic flowchart of a conventional manual periodic search method; FIG. 2 is a schematic flowchart of a risk identification method according to Embodiment 1 of the present invention; FIG. 3 is a schematic flowchart of a risk model construction method according to Embodiment 1 of the present invention; FIG. 5 is a schematic flowchart of a risk rating method according to Embodiment 2 of the present invention; FIG. 6 is a schematic diagram of application of a risk identification method according to Embodiment 2 of the present invention; FIG. FIG. 8 is a schematic structural diagram of a risk identification apparatus according to a third embodiment of the present invention; FIG. 9 is a schematic structural diagram of a risk identification apparatus according to Embodiment 4 of the present invention; A schematic structural diagram of a rating module in the fourth embodiment of the invention.

The risk identification method and apparatus provided by the embodiments of the present invention are described in detail below with reference to the drawings.

 Embodiment 1  

As shown in FIG. 2, it is a schematic flowchart of a risk identification method according to Embodiment 1 of the present invention. The risk identification method includes: Step 101: Instantly acquire network behavior data when a user uses a target object.

In practice, the network behavior data of the user's target object can be immediately captured from the online application. Specifically, in this embodiment, the user can be immediately captured from the online application based on the specific communication interface. Network behavioral data in the process of using products or services provided by the enterprise. Among them, the user's online network behavior data includes: user level, user fault information, user product release information, user product retention, user work order information, user complaint information, and user's browsing information.

Step 102: Perform risk identification on the network behavior data according to a pre-established risk model, and obtain a risk probability of the user.

In this embodiment, a risk model is pre-established. After the network behavior data on the user line is obtained, the network behavior data on the user line can be directly used as the input of the risk model, and the risk model performs the input network behavior data. Risk identification, the output of the risk model is the risk probability of the user.

The pre-established risk model may be a mathematical model established based on a machine learning method in a specific implementation; wherein the machine learning method may include one or more of the following methods: Correlation learning method, boosting learning method, Bayes learning method, Eigen learning method, Vector learning method and Meta-Heuristics learning method. Of course, those skilled in the art may adopt other machine learning methods according to actual needs, or may also adopt other mathematical modeling methods, such as various linear or nonlinear modeling methods, etc., and the mathematical model of the specific risk model in this embodiment. Modeling methods are not limited.

The risk identification method provided by the embodiment obtains the risk behavior of the network behavior data according to the pre-established risk model by acquiring the network behavior data when the user uses the target object in real time, and obtaining the risk probability of the user. In this embodiment, according to the user's network behavior data, data modeling can automatically identify the risk user, which can greatly improve the objectivity and accuracy of the user risk identification, and further, through the data modeling method to the user's instant network. The monitoring of road behavior data can predict potential risk users in advance, which is conducive to improving the promotion efficiency of products or services.

Further, before the network behavior data of the user line is obtained in step 101, a risk model needs to be established in advance through the historical network behavior data of the user.

As shown in FIG. 3, it is a schematic flowchart of a risk model construction method in Embodiment 1 of the present invention, and the risk model construction method includes:

Step 201: Determine an algorithm corresponding to the risk model according to the historical network behavior data of the user.

Specifically, a connection to an Open Data Processing Service (ODPS) is established periodically or periodically through an Application Programming Interface (API), and the corresponding user is invoked by the ODPS based on the API call. The network behavior data is pushed to the API, and the network behavior data of the user from the ODPS is monitored at the API, and the network behavior data of the user obtained periodically or periodically is used as the historical network behavior data of the user.

In this embodiment, a regression analysis algorithm is preferably used as the algorithm corresponding to the risk model. The algorithm corresponding to the risk model is:

Where P denotes the probability of risk; x _i denotes the i- th influence factor; β _i denotes the coefficient of the i- th influence factor.

In this embodiment, the historical network behavior data of the user is input into the algorithm as an influence factor of the algorithm, for example, user level, user fault information, user product release information, user product retention, user work order information, user The complaint information and the user's browsing information can be used as the influence factor of the algorithm.

Step 202: Perform risk identification training on the historical network behavior data according to the algorithm, and obtain a risk identification result of the historical network behavior data.

After the initial risk model is established based on the regression analysis algorithm, the stored historical network behavior data of the user is input as input, and input into the initially established risk model for risk identification training, and the risk identification result of the historical network behavior data is obtained. In this embodiment, in order to improve the accuracy of the risk model, it is necessary to perform data training on the model based on the historical network behavior data of the user, and the accuracy of the risk model trained by the data can be more accurate.

Step 203: Construct the risk model by using the risk identification result as a model parameter.

After obtaining the risk identification result of the historical network behavior data, the risk identification result is used as the model parameter of the risk model, and the model parameter is used to complete the construction of the risk model.

In this embodiment, the user's instantaneous network behavior data is monitored by means of data modeling, and potential risk users can be predicted in advance. Before users complain or complain about products or services, early processing of users can not only improve user experience, but also avoid negative impact on corporate image, facilitate product or service promotion, and thus reduce business operations. cost.

 Embodiment 2  

As shown in FIG. 4, it is a schematic flowchart of a risk identification method according to Embodiment 2 of the present invention. The risk identification method includes: Step 301: Determine an algorithm corresponding to the risk model according to historical network behavior data of the user.

Step 302: Perform risk identification training on the historical network behavior data according to the algorithm, and obtain a risk identification result of the historical network behavior data.

Step 303: Construct the risk model by using the risk identification result as a model parameter.

Steps 301 to 303 are the procedures for establishing the risk model in advance. For details, refer to the description of related content in steps 201 to 203 of the foregoing embodiment, and details are not described herein again.

Step 304: Instantly acquire network behavior data when the user uses the target object.

In practice, the online behavior data of the user can be immediately captured from the online application. Specifically, in this embodiment, the online application can immediately capture the products or services provided by the user in the use enterprise. Network behavior data in the process. Among them, the user's online network behavior data includes: user level, user fault information, user product release information, user product retention, user work order information, user complaint information, and user's browsing information.

Step 305: Enter the network behavior data of the user into the risk model to perform risk identification, and obtain a risk probability of the user.

After obtaining the network behavior data on the user line, the network behavior data on the user line can be directly used as the input of the risk model constructed in the above step 303, and the risk model performs risk identification on the input network behavior data, and the risk model The output is the probability of the user's risk.

Step 306: Output the risk probability of the user, so that the administrator performs corresponding processing on the user according to the risk probability.

After obtaining the probability of the user's risk, the user's risk probability can be notified to the product or service administrator by SMS, email or short message (Imessage). After obtaining the risk probability of the user, the relevant administrator can communicate with the user to help the user solve the current problem.

Step 307: Receive a processing result of the administrator for the user, where the processing result includes a correction parameter that corrects a risk probability of the user.

After the relevant administrator processes the user's problem, the user's risk will be reduced. In actual application, when the user's problem is not processed for a long time, the user's dissatisfaction will be caused. As the problem accumulates, the user's emotion will be accumulated. It will become more and more violent, making the user's risk higher. Users may complain or complain about products or services. For example, complaints are made to enterprises through public methods such as Weibo and forums, which will have a very negative impact on the corporate image and increase the operating costs of the enterprise.

In order to more accurately rate the user's final dangerous gender, the administrator needs to give feedback on the processing results. The processing result includes a correction parameter that corrects the risk probability of the user.

Step 308: Correct the risk probability by using the modified parameter to obtain a final risk probability of the user.

Step 309, using the final risk probability to rate the user's risk.

After obtaining the processing result of the feedback, the risk probability of the user can be corrected according to the modified parameter, and the final risk probability of the user is obtained. Further, the risk degree of the user is rated by using the risk probability of the corrected user.

As shown in FIG. 5, it is a schematic diagram of rating the risk degree of the user in the second embodiment. The correction parameter in the processing result of the feedback includes: a first weight value corresponding to the risk probability calculated by the risk model, and an estimated risk probability obtained by the administrator performing related processing on the user and re-evaluating the risk of the user. And a second weight value corresponding to the estimated risk probability, wherein the first weight value + the second weight value=1.

Correcting the risk probability using the modified parameter to obtain the final risk probability of the user, specifically obtaining the first product of the risk probability and the first weight value, and evaluating the second product of the risk probability and the second weight value, and calculating the first product sum The sum of the second products is taken as the final risk probability.

Further, in this embodiment, a mapping relationship table between the risk probability and the risk level is set in advance, and after obtaining the final risk probability of the user, the mapping relationship table is queried, and the risk corresponding to the final risk probability is obtained therefrom. The target level.

In this embodiment, the risk level includes: high risk, danger, sub-health and health, wherein the high-risk corresponding risk probability range [70%, 100%]; the risk corresponding probability probability range [40%, 70 %]; The range of risk probabilities corresponding to sub-health [10%, 40%]; the range of health-related risk probabilities [0%, 10%]. For example, when the final risk probability of the acquired user is 38%, the target level of the user risk is the sub-health level.

The method provided in this embodiment may be implemented by the risk identification system shown in FIG. 6. The data modeling center in FIG. 6 is used to implement the process of constructing the risk model, and specifically, the related content in steps 301 to 303 may be performed. The risk identification center is configured to implement a risk identification process for the network behavior data when the user uses the target object, and specifically, the related content in steps 304 to 309 can be performed. After obtaining the risk probability of the user, the risk identification center sends the risk probability of the user to the administrator of the product or service through the notification channel, for example, the administrator can be notified by SMS, email or IM. The data modeling center in the risk identification system establishes a connection with the ODPS through the API, and the ODPS pushes the network behavior data of the corresponding user to the API periodically or periodically based on the API call, and listens to the API from the ODPS. The user's network behavior data, and the user's network behavior data obtained periodically or periodically as the user's historical network behavior data. After obtaining the final risk probability of the user, the risk identification center can monitor the trend of the user's risk probability in real time, and can display the trend of the user's risk probability on the information display platform based on the API.

As shown in FIG. 7, it is an application example diagram of the risk identification method of the second embodiment. Based on the above risk identification system, the risk degree of the user is monitored. After the user is set to the sub-health level, the user's risk probability will be linearly attenuated within a period of time after the user uses the product, thereby affecting the user's risk degree to different degrees. .

The risk identification method provided by the embodiment obtains the risk behavior of the network behavior data according to the pre-established risk model by acquiring the network behavior data when the user uses the target object, and obtains the risk probability of the user according to the risk probability. Rate the user's risk. In this embodiment, according to the user's network behavior data, data modeling can automatically identify the risk user, which can greatly improve the objectivity and accuracy of the user risk identification.

Further, the data modeling method is used to monitor the user's real-time network behavior data, and the potential risk users can be predicted in advance. Before users complain or complain about products or services, early processing of users can not only improve user experience, but also avoid negative impact on corporate image, facilitate product or service promotion, and thus reduce business operations. cost.

 Embodiment 3  

As shown in FIG. 8 , it is a schematic structural diagram of a risk identification apparatus according to a third embodiment of the present invention. The risk identification apparatus includes: an acquisition module 11 and a risk identification module 12 .

The obtaining module 11 is configured to instantly obtain network behavior data when the user uses the target object.

In an embodiment, the acquisition module 11 can automatically capture the online behavior data of the user from the online application. Specifically, in this embodiment, the acquisition module 11 can immediately capture the online application through the communication interface. The user's network behavior data during the use of products or services provided by the enterprise. Among them, the user's network behavior data includes: user level, user fault information, user product release information, user product retention, user work order information, user complaint information, and user's browsing information.

The risk identification module 12 is configured to perform risk identification on the network behavior data according to a pre-established risk model to obtain a risk probability of the user.

In this embodiment, a risk model is pre-established, and after the network behavior data of the user is obtained in real time, the risk identification module 12 can directly input the user's network behavior data as a risk model, and the risk model is input to the network. The road behavior data is used for risk identification, and the output of the risk model is the user's risk probability.

For the specific implementation, the description of related content in the foregoing embodiments may be omitted, and details are not described herein again.

The risk identification device provided by the embodiment obtains the risk behavior of the network behavior data according to the pre-established risk model by acquiring the network behavior data when the user uses the target in real time, and obtaining the risk probability of the user. In this embodiment, according to the user's network behavior data, the risk user can be automatically identified through data modeling, which can greatly improve the objectivity and accuracy of the user risk identification. Further, the data modeling method is used to monitor the user's real-time network behavior data, and the potential risk users can be predicted in advance.

 Embodiment 4  

As shown in FIG. 9 , it is a schematic structural diagram of a risk identification apparatus according to Embodiment 4 of the present invention. The risk identification apparatus includes: an acquisition module 11 and a risk identification module 12 in the third embodiment, and a rating. The module 13, the determination module 14, the training module 15, and the model building module 16.

The rating module 13 is configured to rate the user's risk according to the risk probability after the risk identification module 12 obtains the risk probability of the user.

The determining module 14 is configured to determine an algorithm corresponding to the risk model according to the historical network behavior data of the user.

Specifically, the obtaining module 11 is configured to periodically or periodically obtain the user's network behavior data before the user obtains the user's network behavior data, and store the network behavior data as historical network behavior data.

The training module 15 is configured to perform risk identification training on the historical network behavior data according to the algorithm, and obtain a risk identification result of the historical network behavior data.

The model building module 16 is configured to construct the risk model using the risk identification result as a model parameter.

Further, the algorithm corresponding to the risk model is:

Where P denotes the probability of risk; x _i denotes the i- th influence factor; β _i denotes the coefficient of the i- th influence factor; the historical network behavior data is used as the influence factor in the algorithm.

FIG. 10 is a schematic structural diagram of a rating module in the fourth embodiment. An optional structure of the rating module 13 includes an output unit 131, a receiving unit 132, and a rating unit 133.

Specifically, the output unit 131 is configured to output the risk probability of the user, so that the administrator performs corresponding processing on the user according to the risk probability.

The receiving unit 132 is configured to receive a processing result of the administrator for the user.

The rating unit 133 is configured to rate the risk of the user according to the processing result.

Further, the processing result includes a correction parameter that corrects the risk probability.

The rating unit 133 is specifically configured to use the modified parameter to modify the risk probability to obtain a final risk probability of the user, and use the final risk probability to rate the user's risk.

Optionally, the correction parameter includes: a first weight value corresponding to the risk probability, and an estimated risk probability obtained by the administrator performing related processing on the user and evaluating the risk of the user, and corresponding to the estimated risk probability. The second weight value; the first weight value + the second weight value = 1.

The rating unit 133 is specifically configured to obtain a first product of the risk probability and the first weight value, and a second product of the estimated risk probability and the second weight value, and calculate the first product and the second product. And the value as the probability of the final risk.

Further, the rating unit 133 is specifically configured to query a mapping relationship between the preset risk probability and the risk level according to the final risk probability, and obtain a target level of the risk corresponding to the final risk probability.

The function modules of the risk identification device provided in this embodiment can be used to execute the process of the risk identification method shown in FIG. 2 to FIG. 4, and the specific working principle is not described again. For details, refer to the description of the method embodiment.

The risk identification device provided by the embodiment obtains the risk behavior of the network behavior data according to the pre-established risk model by acquiring the network behavior data when the user uses the target object, and obtains the risk probability of the user according to the risk probability. Rate the user's risk. In this embodiment, according to the user's network behavior data, the risk user can be automatically identified through data modeling, which can greatly improve the objectivity and accuracy of the user risk identification.

Further, the data modeling method is used to monitor the user's real-time network behavior data, and the potential risk users can be predicted in advance. Before users complain or complain about products or services, early processing of users can not only improve user experience, but also avoid negative impact on corporate image, facilitate product or service promotion, and thus reduce business operations. cost.

One of ordinary skill in the art will appreciate that all or part of the steps of implementing the various method embodiments described above may be accomplished by hardware associated with the program instructions. The aforementioned program can be stored in a computer readable storage medium. When the program is executed, the steps including the foregoing method embodiments are performed; and the foregoing storage medium includes: a medium that can store code, such as a ROM, a RAM, a magnetic disk, or an optical disk.

Finally, it should be noted that the above embodiments are merely illustrative of the technical solutions of the present invention, and are not intended to be limiting; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art will understand that The technical solutions described in the foregoing embodiments may be modified, or some or all of the technical features may be equivalently replaced; and the modifications or substitutions do not deviate from the technical solutions of the embodiments of the present invention. range.

Claims (16)

 A risk identification method includes: instantly acquiring network behavior data when a user uses a target object; performing risk identification on the network behavior data according to a pre-established risk model, and obtaining a risk probability of the user.    According to the risk identification method described in claim 1, wherein the obtaining the online network behavior data of the user immediately includes: determining an algorithm corresponding to the risk model according to the historical network behavior data of the user; The algorithm performs risk identification training on the historical network behavior data, and obtains the risk identification result of the historical network behavior data. The risk identification result is used as a model parameter to construct the risk model.   According to the risk identification method described in claim 2, wherein the algorithm corresponding to the risk model is: Where P denotes the probability of risk; x _i denotes the i- th influence factor; β _i denotes the coefficient of the i- th influence factor; the historical network behavior data is used as the influence factor in the algorithm.  The risk identification method according to any one of claims 1-3, wherein the risk identification of the network behavior data is performed according to a pre-established risk model, and after obtaining the risk probability of the user, the method further comprises: This risk probability ranks the user's risk.    The risk identification method according to claim 4, wherein the rating the risk of the user according to the risk probability comprises: outputting the risk probability of the user, so that the administrator follows the risk probability to the user Corresponding processing; receiving the processing result of the administrator for the user; and rating the risk of the user according to the processing result.    The risk identification method according to claim 5, wherein the processing result includes a correction parameter that corrects the risk probability; and the user is rated according to the processing result, including: using the correction parameter The risk probability is corrected to obtain the final risk probability of the user; the risk probability of the user is ranked by the final risk probability.    According to the risk identification method of claim 6, wherein the correction parameter includes: a first weight value corresponding to the risk probability, and the user is related to the user, and the risk of the user is evaluated. Obtaining an estimated risk probability and a second weight value corresponding to the estimated risk probability; the first weight value + the second weight value=1; the correction probability is used to correct the risk probability to obtain the final risk of the user The probability includes: obtaining a first product of the risk probability and the first weight value, and a second product of the estimated risk probability and the second weight value; calculating a sum of the first product and the second product as the Final risk probability.    According to the risk identification method described in claim 7, wherein the risk probability is used to rate the user, including: querying the preset risk probability and the risk level according to the final risk probability Mapping table; obtaining a target level of risk corresponding to the probability of the final risk.    A risk identification device, comprising: an acquisition module, configured to instantly acquire network behavior data when a user uses a target object; and a risk identification module, configured to perform the network behavior data according to a pre-established risk model Risk identification, get the risk probability of the user.    The risk identification device according to claim 9 , further comprising: a determining module, configured to determine an algorithm corresponding to the risk model according to the historical network behavior data of the user; and the training module is configured to follow The algorithm performs risk identification training on the stored historical network behavior data, and obtains the risk identification result of the historical network behavior data; the model construction module is used to construct the risk model using the risk identification result as a model parameter.   The risk identification device according to claim 10, wherein the algorithm corresponding to the risk model is: Where P denotes the probability of risk; x _i denotes the i- th influence factor; β _i denotes the coefficient of the i- th influence factor; the historical network behavior data is used as the influence factor in the algorithm.  The risk identification device according to any one of claims 9-11, further comprising: a rating module, configured to rate the risk of the user according to the risk probability.    The risk identification device of claim 12, wherein the rating module comprises: an output unit, configured to output the risk probability of the user, so that the administrator performs corresponding processing on the user according to the risk probability. a receiving unit, configured to receive a processing result of the administrator for the user, and a rating unit, configured to rate the risk of the user according to the processing result.    The risk identification device according to claim 13, wherein the processing result includes a correction parameter that corrects the risk probability; the rating unit is specifically configured to use the correction parameter to correct the risk probability, and obtain the The user's final risk probability, using the final risk probability to rate the user's risk.    The risk identification device according to claim 14, wherein the correction parameter comprises: a first weight value corresponding to the risk probability, and the user is related to the user, and the risk of the user is evaluated. Obtaining an estimated risk probability and a second weight value corresponding to the estimated risk probability; the first weight value + the second weight value=1; the rating unit is specifically configured to acquire the risk probability and the first weight value a first product, and a second product of the estimated risk probability and the second weight value, and a sum of the first product and the second product is calculated as the final risk probability.    The risk identification device according to claim 15 , wherein the rating unit is specifically configured to query a mapping relationship between a preset risk probability and a risk level according to the final risk probability, and obtain the final risk The target level of risk corresponding to the probability.