TW201835819A - Neural network model training method and device, transaction behavior risk identification method and device - Google Patents

Abstract

A neural network model training method and device, and a transaction behavior risk identification method and device. The neural network model training method comprises: inputting a plurality of pieces of pre-collected sample data into a gradient boosting decision tree (GBDT), so as to determine path information in the GBDT corresponding to each piece of sample data; and according to the path information in the GBDT corresponding to each piece of sample data and a sample label, training a neural network model. The method firstly determines the path information according to the GBDT, and then trains the neural network models according to the path information and the sample label. It is known from features of the GBDT itself that a certain piece of path information generally comprises multi-dimensional information of the sample data. Thus, the invention can improve the efficiency of training the neural network model.

Description

Neural network model training, transaction behavior risk identification method and device

The invention relates to the field of computer technology, in particular to a neural network model training, a transaction behavior risk identification method and device.

In the conventional technique, after collecting sample data, the neural network model is directly trained based on the sample data and the sample tags of the sample data. However, the sample data collected above usually includes information of multiple dimensions, which leads to the low efficiency of neural network model training.

The invention describes a neural network model training and transaction behavior risk identification method and device, which can improve the efficiency of neural network model training. The first aspect provides a neural network model training method, including: logging a plurality of pre-collected sample data into a gradient promotion decision tree GBDT to determine path information corresponding to each sample data in the GBDT; Each of the sample materials has a corresponding sample tag; and the neural network model is trained according to the path information and the sample tag corresponding to each of the sample data in the GBDT. The second aspect provides a transaction behavior risk identification method, including: acquiring a transaction behavior data of a user; logging the transaction behavior data into a gradient promotion decision tree GBDT to determine the transaction behavior data in the GBDT Corresponding path information; inputting the path information into the neural network model; and outputting the transaction behavior risk identification result. In a third aspect, a neural network model training apparatus is provided, comprising: a determining unit, configured to log a plurality of pre-collected sample data into a gradient promotion decision tree GBDT to determine each sample data in the GBDT. Corresponding path information; each of the sample data has a corresponding sample tag; a training unit, configured to: according to the path information and the sample tag of the sample data in the GBDT determined by the determining unit, The network model is trained. The fourth aspect provides a transaction behavior risk identification device, including: an obtaining unit, configured to acquire a transaction behavior data of a user; and a determining unit, configured to log the transaction behavior data acquired by the acquiring unit to a gradient promotion decision In the tree GBDT, the path information corresponding to the transaction behavior data in the GBDT is determined; the input unit is configured to input the path information determined by the determining unit into the neural network model; and the output unit is configured to: Output transaction behavior risk identification results. The neural network model training and transaction behavior risk identification method and device provided by the invention register a plurality of pre-collected sample data into the gradient promotion decision tree GBDT to determine corresponding path information of each sample data in the GBDT. The neural network model is trained according to the path information and sample tags corresponding to each sample data in the GBDT. That is, the present invention first determines the path information according to the GBDT, and then trains the neural network model according to the path information and the sample tag. According to the characteristics of the GBDT itself, one path information usually includes information of multiple dimensions in the sample data. Thus, the efficiency of neural network model training can be improved.

Embodiments of the present invention will be described below with reference to the accompanying drawings. The neural network model training method provided by the embodiment of the invention is applicable to training a neural network model such as a deep neural network (DNN) or an artificial neural network (ANN). A well-trained neural network model can be used for pattern recognition and classification, for example, to identify risks in trading behavior. FIG. 1 is a flowchart of a neural network model training method according to an embodiment of the present invention. The executor of the method may be a device with a processing capability: a server or a system or a device. As shown in FIG. 1 , the method specifically includes: Step 110: Registering a plurality of sample data collected in advance into a gradient promotion decision tree (Gradient Boosting Decision Tree, GBDT) to determine the path information corresponding to each sample data in GBDT. Before performing step 110, the GBDT model can be trained first. The specific training process will be described later. In step 110, for example, the case where the trained neural network model is used for transaction behavior risk identification, the sample data may refer to the transaction behavior data of the user. Specifically, the sample data may be collected from a background database of the Alipay system. Here, the sample data can be attributed to the following five categories of user data: 1) User's historical behavior information. For example, a, the number of user calls within a few days (eg, 180 days); b, the last time to log in to the city; c, the last time to log in; d, the number of logins in a few days (eg, 90 days). 2) User's transaction information. For example, a, the average payment amount for several days (eg, 90 days); b, the number of days paid within a few days (eg, 180 days); c, the amount paid within a few days (eg, 180 days); d, the last payment distance Waiting this time. 3) Basic information of the user. For example, a, whether the user is single; b, whether the user is decorated; c, whether the user is married; d, user age; e, user registration duration; f, user education level, and the like. 4) User's Remote Procedure Call (RPC) behavior information. The RPC behavior information here refers to the RPC call between the client and the server when the user uses the client. In one implementation, these operations for each user at a given time window may be collected. For example, the number of times of the RPC interface accessed by the user in the past 2 days can be collected. 5) User Uniform Resourc e Locator (URL) address information. For the sample data collected above, if a sample data is not related to the current user or the sample data can negatively affect the user, the sample data is classified into positive sample data. For example, if a transaction is operated by a non-user or brings a certain loss to the user's account and is reported, the transaction behavior data is marked as positive sample data. Otherwise, if a sample data is the user's normal transaction behavior data, the sample data is marked as negative sample data. It should be noted that the negative sample data is usually easier to collect. For example, it is easy to collect information on normal payment behavior from the back-end database of the Alipay system. Therefore, the negative sample data in the sample data set will account for the majority, for example, greater than 99.999%. However, when the proportion of negative sample data is relatively high, the trained neural network model tends to be biased. For example, it can only identify safe trading behaviors, but can not identify risky trading behaviors, which affects the risk identification of trading behaviors. accuracy. In order to improve the accuracy of transaction risk identification, the sample data can be preprocessed. In one implementation, the positive sample data may be upsampled; and/or the negative sample data may be downsampled. The upsampling processing of the positive sample data may include: increasing the quantity of the positive sample data by means of copying or the like. Downsampling the negative sample data may include reducing the amount of negative sample data by deleting or the like. In one example, the ratio of positive and negative sample data can be adjusted to 1:300. It should also be noted that, for the pre-processed sample data, a corresponding sample label may also be added for the positive and negative sample data. Specifically, a positive sample label is added for the positive sample data, and a negative sample label is added for the negative sample data. In step 110, the registering the plurality of sample data collected in advance into the GBDT may include: determining, for each sample data, the feature values corresponding to the plurality of features according to the sample data. The feature values of the feature are then entered into the decision tree of the GBDT. Features here can be attributed to multiple categories. In an implementation manner, some of the above features may adopt a model variable precipitated on the existing transaction behavior risk identification model, and the model variable belongs to the following three categories: 1) historical behavior information of the user. 2) User's transaction information. 3) Basic information of the user. However, the above model variables need to be determined according to the business data, and the business data usually comes from different business departments, and it takes a certain time to collect and organize the data. Therefore, the latest state of the user cannot be obtained only through the above model variables, and thus the latest information of the user cannot be obtained. Trading behavior for risk identification. To solve this problem, the present invention adds features of the RPC behavior information attributed to the user and features of the URL address information attributed to the user. In summary, the features of the present invention may be characterized by the following five categories: 1) historical behavior information of the user. 2) User's transaction information. 3) Basic information of the user. 4) User's RPC behavior information. 5) User's URL address information. Each category is as described above and will not be described here. For the feature set above, after determining the corresponding feature value according to the specific sample data, the feature value can be input into the GBDT. The GBDT here can be composed of multiple decision trees. Each decision tree includes multiple nodes, and each node corresponds to one feature. Taking a decision tree as an example, the decision tree can be as shown in FIG. 2. In FIG. 2, node 1, node 2, and node 3 respectively have characteristics: "whether the user gender is male" or "user is older than 20 years old. "and whether the transaction amount exceeds 1,000 yuan" corresponds. After the feature values of the feature are input into the decision tree, multiple path information can be determined in the decision tree. For example, if the sample data contains the user gender is male, the user age is greater than 20 years, and the transaction amount exceeds 1000 yuan, the determined path information can be as shown by the thick line in FIG. 2 . As an exemplary illustration, only one path information is shown in FIG. 2. In fact, when the sample data is registered in the GBDT, multiple path information can be determined, and the present invention will not be described herein. It should be noted that, in the present invention, before the feature value is input to the GBDT, the feature value may also be represented as a feature vector in the one-hot form. In the case that the feature vector corresponding to the feature value is also determined, the input of the feature value into the GBDT may be replaced by: inputting the feature vector corresponding to the feature value into the decision tree to determine the corresponding path information. The process of determining the feature vector of the feature value can be exemplified as follows: Taking the feature as “user gender” as an example, if the user gender is male, that is, the feature value of the feature is “male”, the feature value corresponds to The feature vector can be: [0 1]. If the user gender is female, that is, the feature value of the feature is "female", the feature vector corresponding to the feature value may be: [1 0]. Taking the RPC behavior information characterized by the user as an example, the determination of the feature vector corresponding to the feature value can be implemented in the following two ways: In the first implementation manner, the rule is first set: if it appears, the identifier is 1, Otherwise 0. Specifically, assume that the preset RPC behavior information is: a, b, and c. The sample data contains the RPC behavior information of the user within two days: a, a and b, that is, the characteristic values are: a, a and b. Then the corresponding feature vector can be: [1 1 0]. In another implementation, rules can be set: the frequency of the preset RPC behavior information is counted and then normalized. Specifically, assume that the preset RPC behavior information is: a, b, and c. A sample data contains the RPC behavior information of the user within two days: a, a, b, b, and c, that is, the characteristic values are: a, a, b, b, and c. Then the corresponding feature vector can be: 2, 2 and 1. Because of the need for normalization, the final eigenvector is: [0.4 0.4 0.2]. It should be noted that the above description of the feature value as the feature vector belongs to the conventional prior art, and will not be described herein. It should be noted that in order to improve the accuracy of the neural network model, a relatively large number of features are set in the present invention, so that a plurality of feature values are determined. For more and more eigenvalues, the processing often takes a lot of time. Due to the number of eigenvalues observed at the same time, it is difficult for people to deeply analyze the relationship between multiple eigenvalues and manually generate them. New feature value. The present invention obtains path information by logging the sample data into the GBDT, and the path information includes a plurality of feature values. Thereby, the number of feature values can be greatly reduced, whereby the manual operation can be remarkably reduced. Step 120: Train the neural network model according to the path information and the sample tag corresponding to each sample data. The neural network model here may include DNN or ANN and the like. Among them, DNN has developed rapidly in recent years. Compared with traditional shallow models (such as Logistic Regression (LR), Random Forest (RF)), DNN has its unique advancement: model expression ability. Powerful for big data and decentralized training. Therefore, in the present specification, the training DNN is taken as an example for explanation. In the present invention, the training process of the DNN can be as shown in FIG. 3. In FIG. 3, the input layer of the DNN is used to input each path information in the GBDT, and the output layer can output the first prediction result. It can be understood that, for each sample data, that is, after the path information corresponding to the sample data is input to the DNN, the DNN outputs a corresponding first prediction result. For a plurality of sample data in the sample set, if the probability that the first prediction result matches the sample label of the sample data reaches a preset threshold, the preset threshold value herein may be set according to the empirical value, and may be considered to have been obtained. Optimized DNN. It can be understood that the number of layers of the DNN in FIG. 3 can be changed as the number of path information is different. Through experimental invention, the neural network model trained by the present invention is better than other models (LR or RF). At the same time, the time for feature processing is greatly reduced, and the overall modeling process is much faster. The following describes how to train the GBDT model: After determining the feature values corresponding to the multiple features according to each sample data, the feature values corresponding to the multiple features can be input into the decision trees of the GBDT. The results of the various decision trees are then summed to determine the second prediction. It can be understood that for each sample data, the GBDT model will output a corresponding second prediction result. For a plurality of sample data in the sample set, if the probability that the second prediction result matches the sample label of the sample data reaches a preset threshold, the preset threshold value herein may be set according to the empirical value, and may be considered to have been obtained. Optimized GBDT model. If the probability that the second prediction result matches the sample label of the sample data does not reach the preset threshold, the input can be continued by adjusting the number of decision trees, the depth of the decision tree, and the regularization term (used to represent the feature). And the output operation until the preset threshold is reached. In summary, the present invention has the following advantages: 1) Since the features of the present invention include features of the user RPC behavior information, the neural network model trained by the present invention can meet the timeliness requirement, that is, can identify The user's latest trading behavior. 2) The neural network model trained by the present invention is more accurate than the conventional shallow model. 3) The path information is obtained by logging the sample data to GBDT. And a path information is composed of a plurality of feature values, that is, a path information contains information of multiple dimensions of the sample data, thereby greatly reducing the amount of data input by the DNN input layer, thereby improving the nerve The efficiency of network model training. It should be noted that after the neural network model is trained through the steps shown in FIG. 1, the neural network model can be deployed to the line, and the risk behavior of the user's transaction behavior is identified. FIG. 4 is a schematic diagram of a process of a transaction behavior risk identification method provided by the present invention. As shown in FIG. 4, the method may include: Step 410: Acquire a transaction behavior data of a user. The transaction behavior data here is the same as the definition of the above sample materials, and will not be repeated here. Step 420: Log the transaction behavior data into the gradient promotion decision tree GBDT to determine the path information corresponding to the transaction behavior data in the GBDT. The above GBDT is composed of a plurality of decision trees, each decision tree includes a plurality of nodes, and each node corresponds to one feature. In step 420, the transaction behavior data is registered in the gradient promotion decision tree GBDT, and the step of determining the path information corresponding to the transaction behavior data in the GBDT may specifically include: determining, according to the transaction behavior data, the feature values corresponding to the plurality of features; The feature value determines the path information in the decision tree. The process of determining the path information may refer to FIG. 2, and details are not described herein. In step 430, the path information is input into the neural network model. That is, the path information determined in step 420 is input into the input layer of the DNN. Step 440, outputting a transaction behavior risk identification result. Specifically, the transaction behavior risk identification result is output by the output layer of the DNN. Here, if the recognition result is a risky trading behavior, an alarm can be initiated. In the case of payment, if the recognition result is a risky payment behavior, the user account can be frozen to prevent property loss. Corresponding to the above-mentioned neural network model training method, the embodiment of the present invention further provides a neural network model training device, as shown in FIG. 5, the device includes: a determining unit 501, configured to collect a plurality of sample materials collected in advance Log in to the gradient promotion decision tree GBDT to determine the path information corresponding to each sample data in the GBDT. Here, each sample data has a corresponding sample label. The training unit 502 is configured to train the neural network model according to the path information and the sample tag corresponding to each sample data determined by the determining unit 501 in the GBDT. Optionally, the GBDT is composed of a plurality of decision trees, each decision tree includes a plurality of nodes, and each node corresponds to one feature. The determining unit 501 is specifically configured to: determine, for each sample data of the plurality of sample materials, the feature values corresponding to the plurality of features according to the sample data. Here, the feature may include: the user's remote program calls the RPC behavior information and/or the user's Uniform Resource Locator URL address information. The path information is determined in the decision tree based on the feature values. Optionally, the sample tag may include: a positive sample tag and a negative sample tag. The device may further include: a processing unit 503, configured to perform upsampling processing on the sample data whose sample label is a positive sample label; and/or perform down sampling processing on the sample data in which the sample label is a negative sample label. The functions of the functional modules of the device in the embodiments of the present invention can be implemented through the steps of the foregoing method embodiments. Therefore, the specific operation process of the device provided by the present invention is not described herein. The neural network model training device provided by the present invention, the determining unit 501 registers a plurality of sample data collected in advance into the gradient promotion decision tree GBDT to determine path information corresponding to each sample data in the GBDT. The training unit 502 trains the neural network model according to the path information and the sample tag corresponding to each sample data in the GBDT. Thereby, the efficiency of the neural network model training can be improved. Corresponding to the foregoing transaction behavior risk identification method, the embodiment of the present invention further provides a transaction behavior risk identification device. As shown in FIG. 6, the device includes: an obtaining unit 601, configured to acquire transaction behavior data of the user. The determining unit 602 is configured to log the transaction behavior data acquired by the obtaining unit 601 into the gradient promotion decision tree GBDT to determine the path information corresponding to the transaction behavior data in the GBDT. The input unit 603 is configured to input the path information determined by the determining unit 602 into the neural network model. The output unit 604 is configured to output a transaction behavior risk identification result. Optionally, the GBDT is composed of multiple decision trees, each decision tree includes multiple nodes, and each node corresponds to one feature. The determining unit 602 is specifically configured to: determine characteristics corresponding to multiple features according to transaction behavior data. value. The path information is determined in the decision tree based on the feature values. The feature may include: the remote program of the user calls the RPC behavior information and/or the uniform resource locator URL address information of the user. The functions of the functional modules of the device in the embodiments of the present invention can be implemented through the steps of the foregoing method embodiments. Therefore, the specific operation process of the device provided by the present invention is not described herein. The transaction behavior risk identification device provided by the invention can improve the efficiency and accuracy of the transaction behavior risk identification. Those skilled in the art will appreciate that in one or more of the above examples, the functions described herein can be implemented in hardware, software, firmware, or any combination thereof. When implemented using software, these functions can be stored in a computer readable medium or transmitted as one or more instructions or code on a computer readable medium. The embodiments, the technical solutions, and the beneficial effects of the present invention are further described in detail in the foregoing detailed description. It is to be understood that the foregoing description is only The scope of the protection, any modifications, equivalent substitutions, improvements, etc., which are made on the basis of the technical solutions of the present invention, are included in the scope of the present invention.

501‧‧‧Determining unit

502‧‧‧ training unit

503‧‧‧Processing unit

601‧‧‧Acquisition unit

602‧‧‧Determining unit

603‧‧‧ input unit

604‧‧‧Output unit

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly described below. It is obvious that the drawings in the following description are only some embodiments of the present invention, Those skilled in the art can also obtain other drawings based on these drawings without paying any creative work. 1 is a flowchart of a neural network model training method according to an embodiment of the present invention; FIG. 2 is a schematic diagram of a decision tree provided by the present invention; FIG. 3 is a schematic diagram of a process for training a DNN according to the present invention; FIG. 5 is a schematic diagram of a neural network model training device according to an embodiment of the present invention; FIG. 6 is a schematic diagram of a transaction behavior risk identification device according to another embodiment of the present invention.

Claims (14)

A neural network model training method, the method comprising: logging a plurality of pre-collected sample data into a gradient promotion decision tree GBDT to determine path information corresponding to each sample data in the GBDT; The sample data has corresponding sample tags; and the neural network model is trained according to the path information and the sample tags corresponding to the sample data in the GBDT. The method of claim 1, wherein the GBDT is composed of a plurality of decision trees, each decision tree includes a plurality of nodes, each node corresponding to a feature; the plurality of sample data to be collected in advance Logging into the gradient promotion decision tree GBDT to determine path information corresponding to each sample data in the GBDT, including: determining, for each sample data of the plurality of sample materials, corresponding features of the plurality of features according to the sample data a value; and determining the path information in the decision tree based on the feature value. The method of claim 1 or 2, wherein the sample tag comprises: a positive sample tag and a negative sample tag; before the plurality of sample data collected in advance is registered in the gradient promotion decision tree GBDT, The method includes: upsampling sample data whose sample label is a positive sample label; and/or downsampling sample data of the negative sample label of the sample label. The method of claim 2, wherein the feature comprises: the user's remote program calls the RPC behavior information and/or the user's Uniform Resource Locator URL address information. A transaction behavior risk identification method, the method comprising: acquiring a transaction behavior data of a user; logging the transaction behavior data into a gradient promotion decision tree GBDT to determine a path information corresponding to the transaction behavior data in the GBDT Enter the path information into the neural network model; and output the transaction behavior risk identification result. The method of claim 5, wherein the GBDT is composed of a plurality of decision trees, each decision tree includes a plurality of nodes, each node corresponding to a feature; and the transaction behavior data is registered to The gradient elevation decision tree GBDT determines the path information corresponding to the transaction behavior data in the GBDT, including: determining feature values corresponding to the plurality of features according to the transaction behavior data; and determining, according to the feature values, in the decision tree Determine the path information. The method of claim 6, wherein the feature comprises: the user's remote program calls the RPC behavior information and/or the user's Uniform Resource Locator URL address information. A neural network model training device, comprising: a determining unit, configured to log a plurality of pre-collected sample data into a gradient lifting decision tree GBDT to determine each sample data corresponding to the GBDT The path information has a corresponding sample tag; the training unit is configured to train the neural network model according to the path information and the sample tag corresponding to the sample data determined by the determining unit in the GBDT. The device according to claim 8, wherein the GBDT is composed of a plurality of decision trees, each decision tree includes a plurality of nodes, each node corresponding to a feature; the determining unit is specifically configured to: Each sample data of the plurality of sample materials determines, according to the sample data, feature values corresponding to the plurality of features; and determining the path information in the decision tree according to the feature values. The device of claim 8 or claim 9, wherein the sample tag comprises: a positive sample tag and a negative sample tag; the device further comprising: a processing unit configured to perform sample data of the sample tag as a positive sample tag Upsampling processing; and/or downsampling of sample data whose sample label is a negative sample label. The device of claim 9, wherein the feature comprises: the user's remote program calls RPC behavior information and/or the user's Uniform Resource Locator URL address information. A transaction behavior risk identification device, comprising: an obtaining unit, configured to acquire a transaction behavior data of a user; and a determining unit, configured to log the transaction behavior data acquired by the obtaining unit into a gradient promotion decision tree GBDT And determining an path information corresponding to the transaction behavior data in the GBDT; an input unit configured to input the path information determined by the determining unit into the neural network model; and an output unit configured to output a transaction behavior risk identification result . The device according to claim 12, wherein the GBDT is composed of a plurality of decision trees, each decision tree includes a plurality of nodes, each node corresponding to a feature; the determining unit is specifically configured to: The transaction behavior data determines a feature value corresponding to the plurality of features; and determining the path information in the decision tree according to the feature value. The device of claim 13, wherein the feature comprises: the user's remote program calls the RPC behavior information and/or the user's Uniform Resource Locator URL address information.