WO2021243534A1 - 一种行为控制方法及装置、存储介质 - Google Patents

一种行为控制方法及装置、存储介质 Download PDF

Info

Publication number
WO2021243534A1
WO2021243534A1 PCT/CN2020/093853 CN2020093853W WO2021243534A1 WO 2021243534 A1 WO2021243534 A1 WO 2021243534A1 CN 2020093853 W CN2020093853 W CN 2020093853W WO 2021243534 A1 WO2021243534 A1 WO 2021243534A1
Authority
WO
WIPO (PCT)
Prior art keywords
behavior
feature
model
sequence
sample
Prior art date
Application number
PCT/CN2020/093853
Other languages
English (en)
French (fr)
Inventor
聂超
Original Assignee
深圳市欢太科技有限公司
Oppo广东移动通信有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 深圳市欢太科技有限公司, Oppo广东移动通信有限公司 filed Critical 深圳市欢太科技有限公司
Priority to CN202080100085.4A priority Critical patent/CN115461740A/zh
Priority to PCT/CN2020/093853 priority patent/WO2021243534A1/zh
Publication of WO2021243534A1 publication Critical patent/WO2021243534A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication

Definitions

  • the embodiments of the present application relate to the field of electronic applications, and in particular, to a behavior control method and device, and a storage medium.
  • the existing business security risk control system mainly starts from the business characteristics, subdivides users according to the business, and formulates relevant rules to identify black production users. Specifically, first use big data tools such as Hadoop and Spark to perform statistical analysis on daily business, extract business-related user characteristics, design a rule base based on business characteristics, and use the rule base and user characteristics to rate users, according to the rating results Set the user's risk level, and open relevant permissions to the user according to the risk level, thereby rejecting certain behaviors of the user.
  • big data tools such as Hadoop and Spark
  • the embodiments of the present application provide a behavior control method, device, and storage medium, which can improve the accuracy of identifying black-produced users, and further improve the accuracy of behavior control of black-produced users.
  • An embodiment of the present application provides a behavior control method, and the method includes:
  • behavior control is performed on the target behavior according to the behavior discrimination result.
  • the autoencoder model is a noise-reducing autoencoder DAE model
  • the autoencoder model is used to perform feature extraction on the behavior feature sequence to obtain a set of features corresponding to the first identity identifier Vectors, including:
  • the time series processing model is a long and short-term memory LSTM network
  • the input of the set of feature vectors into the time series processing model to obtain the behavior discrimination result corresponding to the behavior feature sequence includes:
  • the stacked LSTM layer is composed of multiple layers of LSTM units;
  • the probability value is determined as the behavior discrimination result.
  • the method before inputting the behavior feature sequence into the DAE model, using the coding neural network in the DAE to perform feature compression on the behavior feature sequence to obtain a set of intermediate feature vectors, the method also includes:
  • Model training is performed on the initial DAE model by using the behavior characteristics of the sample to obtain the DAE model.
  • the using the sample behavior characteristics to perform model training on the initial DAE model to obtain the DAE model includes:
  • model training is performed on the initial DAE model to obtain the DAE model.
  • the method further includes:
  • the time sequence processing model is a depth sorting model
  • the input of the set of feature vectors into the time sequence processing model to obtain the behavior discrimination result corresponding to the behavior feature sequence includes:
  • the static feature vector and the set of feature vectors are input into the depth ranking model to obtain the behavior discrimination result.
  • the behavior characteristic includes at least one of an operation application, an operation type, an operation environment, and a network environment.
  • An embodiment of the present application provides a behavior control device, and the device includes:
  • the acquiring unit is configured to acquire the behavior characteristic sequence of the first identity identifier within a preset time period, and the behavior characteristics in the behavior characteristic sequence are sorted according to time;
  • a feature extraction unit configured to use an autoencoder model to perform feature extraction on the behavior feature sequence to obtain a set of feature vectors corresponding to the first identity identifier
  • a behavior discrimination unit configured to input the set of feature vectors into a time series processing model to obtain a behavior discrimination result corresponding to the behavior feature sequence
  • the behavior control unit is configured to perform behavior control on the target behavior according to the behavior discrimination result when the target behavior of the first identity is received.
  • An embodiment of the present application provides a behavior control device.
  • the device includes a processor, a memory, and a communication bus.
  • the processor executes an operating program stored in the memory, the method according to any one of the foregoing is implemented.
  • the embodiment of the present application provides a computer-readable storage medium with a program stored thereon, which is applied to a behavior control device, and when the program is executed by a processor, the method as described in any one of the above is implemented.
  • the embodiments of the present application provide a behavior control method and device, and a storage medium.
  • the method may include: acquiring a behavior characteristic sequence of a first identity within a preset time period, and the behavior characteristics in the behavior characteristic sequence are sorted according to time;
  • the auto-encoder model performs feature extraction on the behavior feature sequence to obtain a set of feature vectors corresponding to the first identity; input a set of feature vectors into the time series processing model to obtain the behavior discrimination result corresponding to the behavior feature sequence;
  • behavior control is performed on the target behavior according to the result of behavior discrimination.
  • the behavior feature sequence within a preset time period is used as input, and the autoencoder model is used to extract and enhance the behavior feature sequence in high dimensions, which can be based on the user's behavior within a period of time.
  • the feature sequence is more flexible for behavior discrimination, and then the user behavior is controlled based on the discrimination result, which greatly improves the accuracy of recognition, and further improves the accuracy of behavior control for black users.
  • Figure 1 is a schematic structural diagram of a business security risk system based on an AI model in the prior art
  • FIG. 2 is a first flowchart of a behavior control method provided by an embodiment of the application
  • FIG. 3 is a second flowchart of a behavior control method provided by an embodiment of this application.
  • Fig. 4 is a schematic structural diagram of an exemplary DAE model provided by an embodiment of the application.
  • Fig. 5 is a schematic structural diagram of an exemplary LSTM network provided by an embodiment of the application.
  • FIG. 6 is a first structural diagram of a behavior control device provided by an embodiment of this application.
  • FIG. 7 is a second structural diagram of a behavior control device provided by an embodiment of this application.
  • the existing business security risk control based on the rule base and pre-divided user risk levels has the following problems:
  • the model is composed of data storage systems, computing Cluster, rule engine, management platform, and rule library.
  • the data storage system is composed of relational and non-relational databases;
  • the computing cluster is composed of offline computing clusters and online clusters. Real-time computing clusters are used for online computing, and offline computing clusters are used for Periodically perform tasks;
  • the rule engine generates rules through the rule library to optimize rule matching and increase the efficiency of the real-time risk control system;
  • the management platform is composed of rule configuration modules and rule evaluation modules, based on indicators and model-based rules The evaluation module can ensure that the effectiveness of risk control rules is tracked in real time. Input the transaction data, device portrait and log data into the AI model to output the user discrimination result.
  • the above AI model has the following problems in achieving business security risk control:
  • FIG. 2 is a schematic diagram of the implementation flow of the behavior control method proposed in the embodiment of the present application.
  • the method may include:
  • the behavior control device each time a user generates an operation behavior, the behavior control device records the behavior characteristics corresponding to the operation behavior once, including: at least one of operation application, operation type, operation environment, and network environment, which needs to be explained Yes, the behavior characteristics are not limited to the above content, and may also include the time since the last operation, etc., which are specifically selected and added according to actual conditions, and the embodiments of the present application do not make specific limitations.
  • the above behavior characteristics constitute a user behavior.
  • the operation application may include the name of the application (APP) and the type of the APP, where the type of the APP may include: instant messaging, shopping, video viewing, etc.
  • APP application
  • type of the APP may include: instant messaging, shopping, video viewing, etc.
  • the operation type may include: download, search, click, comment, etc.
  • the operating environment may include: the current operating page, the last operating page, the source of external links, and so on.
  • the first identity identifier may be user identity document (ID) information.
  • the behavior control device sorts all the behavior characteristics of the first identity in a preset time period in chronological order to obtain the behavior characteristic sequence of the first identity in the preset time period.
  • the preset time period may be one day, a week, etc., and the specific selection is based on actual conditions, and the embodiments of the present application do not make specific limitations.
  • the behavior control device can also simultaneously use the static feature vector and the behavior feature sequence corresponding to the first identity tag to perform behavior discrimination on the first identity tag. At this time, the behavior control device obtains the static feature vector corresponding to the first identity tag. And the sequence of behavior characteristics.
  • the static feature vector corresponding to the first identity identifier may be a feature vector used to characterize features such as portrait features that are not easily changed.
  • the autoencoder model is pre-trained in the behavior control device. After the behavior control device obtains the behavior characteristic sequence of the first identity identifier within a preset time period, the behavior control device uses the autoencoder model to perform feature extraction on the behavior characteristic sequence. Obtain a set of feature vectors corresponding to the first identity identifier.
  • the behavior control device inputs the behavior feature sequence into the self-encoder model for feature extraction, and outputs a set of feature vectors corresponding to the first identity identifier.
  • the autoencoder model is a denoising autoencoder (DAE) model.
  • DAE denoising autoencoder
  • the DAE model includes an encoder (encoder) and a decoder (decoder), where the encoder is composed of an encoding neural network, and the decoder is composed of a decoding neural network corresponding to the encoding neural network.
  • the encoding neural network can be a two-layer neural network. Network or three-layer neural network, etc., are specifically selected according to actual conditions. The embodiment of this application does not make specific limitations.
  • the number of layers of the decoding neural network is the same as the number of layers of the coding neural network, that is, when the coding neural network is a two-layer In the case of a neural network, the decoding neural network is a two-layer neural network that is symmetrical to the coding neural network.
  • the behavior control device inputs the behavior feature sequence into the DAE model, and uses the coding neural network in the DAE model to perform feature compression on the behavior feature sequence to obtain a set of intermediate feature vectors, thereby realizing the initial behavior
  • the feature sequence performs the feature extraction process, after which the behavior control device normalizes a set of intermediate feature vectors to obtain a set of feature vectors.
  • the behavior control device inputs a set of intermediate feature vectors into a batch normalization (BN, Batch Normalization) layer for batch normalization, and uses the BN layer to normalize a set of intermediate feature vectors. Normalize the value while distributing the data, thereby increasing the generalization ability of the network, while avoiding gradient disappearance and explosion, and improving training efficiency.
  • BN Batch Normalization
  • the BN layer is added to the DAE model as a part of the processing logic of the intermediate hidden layer, and the learning process for the data distribution is also implemented in the DAE training process.
  • the behavior control device inputs the behavior feature sequence into the DAE model, and uses the coding neural network in the DAE model to perform feature compression on the behavior feature sequence to obtain a set of intermediate Before the feature vector, the behavior control device also uses the sample behavior characteristics to perform model training on the initial DAE model to obtain the DAE model, as shown in Fig. 3, which can specifically include the following steps:
  • the behavior control device adds random noise to the sample behavior feature to obtain the sample input behavior feature.
  • the behavior control device collects sample behavior characteristics, where the behavior control device can obtain local historical behavior characteristics as sample behavior characteristics, or obtain the user's historical behavior characteristics online from other devices, and make specific choices based on actual conditions.
  • the embodiments of this application do not make specific limitations.
  • the behavior control device inputs the sample behavior characteristics into the input layer, and randomly shields some of the input layer nodes, thereby adding random noise to the sample behavior characteristics, and the sample input behavior characteristics obtained at this time are
  • the data of behavioral features in real scenes is simulated with some fields missing and incomplete.
  • Using sample input behavioral features to train DAE models can enhance the generalization performance and robustness of DAE models, and remove them. The interference of input noise.
  • the behavior control device inputs the sample input behavior feature into the coding neural network in the initial DAE model to obtain a first sample feature vector.
  • the initial DAE model includes an encoding neural network and a decoding neural network symmetrical to the encoding neural network.
  • the behavior control device inputs the behavior characteristics of the sample input into the encoding neural network of the initial DAE model for feature compression to obtain the hidden layer The compressed first sample feature vector.
  • the behavior control device inputs the first sample feature vector into the decoding neural network corresponding to the coding neural network, and outputs the sample output behavior feature.
  • the behavior control device inputs the first sample feature vector into the decoding neural network corresponding to the coding neural network, performs decoding and restoration, and outputs the sample to output the behavior feature.
  • the behavior control device uses the sample behavior characteristics and the sample output behavior characteristics to perform model training on the DAE model to obtain the DAE model.
  • the behavior control device minimizes the root mean square error between the sample behavior characteristics and the sample output behavior characteristics to converge the initial DAE model, so the behavior control device completes the use of the sample behavior characteristics and the sample output behavior characteristics ,
  • the process of model training for the initial DAE model is the DAE model.
  • the DAE model includes an encoder and a decoder. After adding random noise to the sample behavior feature X, it is input into the encoder to obtain the sample behavior feature Z, and then the sample behavior feature Z is input to the decoder , The sample behavior characteristic X'is obtained, and the DAE model converges by minimizing the root mean square error between X and X'.
  • S103 Input a set of feature vectors into the time series processing model to obtain a behavior discrimination result corresponding to the behavior feature sequence.
  • the behavior control device is also pre-trained with a timing processing model. After the behavior control device obtains a set of feature vectors corresponding to the first identity, the behavior control device inputs a set of feature vectors into the timing processing model to obtain the behavior corresponding to the behavior feature sequence. Determine the result.
  • the time series processing model may be a long short-term memory (Long Short-Term Memory, LSTM) network.
  • LSTM Long Short-Term Memory
  • the LSTM network includes a stacked LSTM layer and a fully connected layer.
  • the BN layer After the BN layer outputs a set of feature vectors, it inputs a set of feature vectors to the stacked LSTM layer of the LSTM network, and outputs the last LSTM in the stacked LSTM layer.
  • the fully connected layer is composed of the dense layer and activation
  • the function sigmod is composed of inputting the network state into the dense layer and sigmod in turn, and outputting the probability value corresponding to a set of feature vectors; and determining the probability value as the result of behavior discrimination.
  • FIG. 5 is a schematic diagram of the structure of the LSTM network.
  • the LSTM network consists of a stacked LSTM layer and a fully connected layer.
  • the stacked LSTM layer is composed of n layers of LSTM units. Each layer of LSTM unit calls a cell_init method.
  • the fully connected layer consists of a dense layer and a fully connected layer. sigmod.
  • X1, X2,..., Xt are behavior feature sequences.
  • a set of feature vectors Z1, Z2,..., Zt are obtained, and Z1, Z2,..., Zt are input into LSTM In the layer, through the learning of multiple layers of LSTM_cell units, and the network state 0t of the nth layer of LSTM_cell (celln) as the output, the activation function sigmod is input after the dense operation, and a classification probability value of 0-1 is generated. Among them, 0 represents a normal user, and 1 represents a black product user.
  • the cross-entropy minimization is used as the loss function to optimize the model of the LTSM network.
  • the time series processing model may also be a deep sorting model, where the deep sorting model includes a wide&deep model, a deepFM model, etc.
  • the deep model is an LTSM network.
  • the static feature vector and a set of feature vectors are input into the depth sorting model, and the behavior discrimination result is obtained.
  • the static feature vector is input into the wide model
  • the behavior feature sequence is input into the deep model
  • the behavior discrimination result is output.
  • the static feature vector is input into the FM model
  • the behavior feature sequence is input into the deep model
  • the behavior discrimination criterion is output.
  • the behavior control device After the behavior control device obtains the behavior discrimination result corresponding to the behavior feature sequence, the behavior control device can determine whether the first identity is a black user according to the behavior discrimination result. When the behavior control device receives the target behavior of the first identity again, The behavior control device performs corresponding behavior control on the target behavior according to the behavior discrimination result.
  • the first identity when it is determined that the first identity is a black product user according to the behavior discrimination result, some behaviors of the first identity need to be restricted, specifically, when the target behavior of the first identity is received next time , Determine the type of target behavior, when the type of target behavior meets the type of restricted behavior, restrict the target behavior; the type of restricted behavior can include lottery, exposure, browsing and other behaviors, the specific choice is based on the actual situation, this application embodiment does not do Specific restrictions.
  • the autoencoder model and the timing processing model can be used as basic models, and further combine with the positive and unlabeled (PU) learning algorithm, the Teacher-Student network architecture and other semi-supervised algorithm frameworks to achieve the Marked risk control scenario.
  • PU positive and unlabeled
  • the behavior feature sequence within a preset period of time is used as input, and the autoencoder model is used to extract and enhance the behavior feature sequence in high dimensions, which can be more flexible according to the user's behavior feature sequence over a period of time. Discrimination, and then the behavior control of the user based on the discrimination result, which greatly improves the accuracy of recognition, and further improves the accuracy of behavior control of black-produced users.
  • FIG. 6 is a schematic diagram 1 of the composition structure of the behavior control device proposed in the embodiment of the application.
  • the behavior control device 1 proposed in the embodiment of the application can be include:
  • the acquiring unit 10 is configured to acquire the behavior characteristic sequence of the first identity identifier within a preset time period, and the behavior characteristics in the behavior characteristic sequence are sorted according to time;
  • the feature extraction unit 11 is configured to use an autoencoder model to perform feature extraction on the behavior feature sequence to obtain a set of feature vectors corresponding to the first identity identifier;
  • the behavior discrimination unit 12 is configured to input the set of feature vectors into a time series processing model to obtain a behavior discrimination result corresponding to the behavior feature sequence;
  • the behavior control unit 13 is configured to perform behavior control on the target behavior according to the behavior discrimination result when the target behavior of the first identity identifier is received.
  • the autoencoder model is a noise reduction autoencoder DAE model
  • the device further includes: a feature compression unit and a normalization unit;
  • the feature compression unit is configured to input the behavior feature sequence into the DAE model, and use the coding neural network in the DAE model to perform feature compression on the behavior feature sequence to obtain a set of intermediate feature vectors;
  • the normalization unit is used to normalize the set of intermediate feature vectors to obtain the set of feature vectors.
  • time series processing model is a long and short-term memory LSTM network
  • the behavior determination unit 12 is specifically configured to input the set of feature vectors into the stacked LSTM layer of the LSTM network, and output the network status of the last LSTM unit in the stacked LSTM layer.
  • the stacked LSTM layer is composed of multiple Layer LSTM unit composition; input the network state into the fully connected layer of the LSTM network to obtain the probability value corresponding to the set of feature vectors; determine the probability value as the behavior discrimination result.
  • the device further includes: a model training unit;
  • the model training unit is used to perform model training on the initial DAE model by using sample behavior characteristics to obtain the DAE model.
  • model training unit is specifically configured to add random noise to the sample behavior characteristics to obtain sample input behavior characteristics; input the sample input behavior characteristics into the coding neural network in the initial DAE model to obtain The first sample feature vector; the first sample feature vector is input to the decoding neural network corresponding to the coding neural network, and the sample output behavior feature is output; the sample behavior feature and the sample output behavior feature are used to compare all Model training is performed on the initial DAE model to obtain the DAE model.
  • the obtaining unit 10 is further configured to obtain the static feature vector and the behavior feature sequence corresponding to the first identity identifier respectively;
  • the behavior discrimination unit 12 is further configured to input the static feature vector and the set of feature vectors into the depth ranking model to obtain the behavior discrimination result.
  • the behavior characteristics include: at least one of an operation application, an operation type, an operation environment, and a network environment.
  • FIG. 7 is a second schematic diagram of the structure of the behavior control device proposed in the embodiment of the application.
  • the behavior control device 1 proposed in the embodiment of the application may further include a processor 110, a memory 111, and a communication bus 112.
  • the above-mentioned acquisition unit 10, feature extraction unit 11, behavior discrimination unit 12, behavior control unit 13, feature compression unit, normalization unit, and model training unit can be processed by the behavior control device 1.
  • the above-mentioned processor 110 may be an application specific integrated circuit (ASIC), a digital signal processor (Digital Signal Processor, DSP), and a digital signal processing device (Digital Signal Processor). Processing Device (DSPD), Programmable Logic Device (ProgRAMmable Logic Device, PLD), Field Programmable Gate Array (Field ProgRAMmable Gate Array, FPGA), Central Processing Unit (CPU), Controller, Microcontroller, At least one of the microprocessors.
  • the memory 111 is used to store executable program code, the program code includes computer operation instructions, the memory 111 may include a high-speed RAM memory, or may also include a non-volatile memory, for example, at least two disk memories.
  • the communication bus 112 is used to connect the processor 110, the memory 111, and the mutual communication between these devices.
  • the memory 111 is used to store instructions and data.
  • the processor 110 is configured to obtain the behavior feature sequence of the first identity in a preset time period, and the behavior features in the behavior feature sequence are sorted according to time; use the autoencoder model to perform feature extraction on the behavior feature sequence , Obtain a set of feature vectors corresponding to the first identity; input the set of feature vectors into the time series processing model to obtain the behavior discrimination result corresponding to the behavior feature sequence; when the first identity is received In the case of a target behavior, behavior control is performed on the target behavior according to the behavior discrimination result.
  • the autoencoder model is a noise-reducing autoencoder DAE model
  • the above-mentioned processor 110 is further configured to input the behavior characteristic sequence into the DAE model, and use the The coding neural network in the DAE model performs feature compression on the behavior feature sequence to obtain a set of intermediate feature vectors; normalizes the set of intermediate feature vectors to obtain the set of feature vectors.
  • the time series processing model is a long and short-term memory LSTM network
  • the processor 110 is further configured to input the set of feature vectors into the stacked LSTM layer of the LSTM network, and output all the feature vectors.
  • the network status of the last LSTM unit in the stacked LSTM layer, the stacked LSTM layer is composed of multiple LSTM units; the network status is input into the fully connected layer of the LSTM network to obtain the corresponding set of feature vectors Probability value; the probability value is determined as the behavior discrimination result.
  • the aforementioned processor 110 is further configured to perform model training on the initial DAE model by using the behavior characteristics of the sample to obtain the DAE model.
  • the above-mentioned processor 110 is further configured to add random noise to the sample behavior characteristics to obtain sample input behavior characteristics; input the sample input behavior characteristics into the initial DAE model In the coding neural network, the first sample feature vector is obtained; the first sample feature vector is input to the decoding neural network corresponding to the coding neural network, and the output sample is used to output the behavior feature; using the sample behavior feature and the Sample output behavior characteristics, and perform model training on the initial DAE model to obtain the DAE model.
  • the time series processing model is a depth sorting model
  • the above-mentioned processor 110 is further configured to obtain the static feature vector and the behavior feature sequence corresponding to the first identity respectively;
  • the static feature vector and the set of feature vectors are input into the depth ranking model to obtain the behavior discrimination result.
  • the behavior characteristics include: at least one of an operation application, an operation type, an operation environment, and a network environment.
  • the aforementioned memory 111 may be a volatile memory (volatile memory), such as a random-access memory (Random-Access Memory, RAM); or a non-volatile memory (non-volatile memory). ), such as Read-Only Memory (ROM), Flash Memory (Flash Memory), Hard Disk Drive (HDD) or Solid-State Drive (SSD); or the above types A combination of the first memory and provide instructions and data to the processor 110.
  • volatile memory such as a random-access memory (Random-Access Memory, RAM); or a non-volatile memory (non-volatile memory).
  • ROM Read-Only Memory
  • Flash Memory Flash Memory
  • HDD Hard Disk Drive
  • SSD Solid-State Drive
  • the functional modules in this embodiment may be integrated into one processing unit, or each unit may exist alone physically, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit can be realized in the form of hardware or software function module.
  • the integrated unit is implemented in the form of a software function module and is not sold or used as an independent product, it can be stored in a computer readable storage medium.
  • the technical solution of this embodiment is essentially or correct
  • the part that the prior art contributes or all or part of the technical solution can be embodied in the form of a software product.
  • the computer software product is stored in a storage medium and includes a number of instructions to enable a computer device (which can be a personal computer).
  • the aforementioned storage media include: U disk, mobile hard disk, read only memory (Read Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program codes.
  • the behavior control method, device, and storage medium proposed by the embodiments of the application obtain the behavior characteristic sequence of the first identity identifier within a preset time period, and the behavior characteristics in the behavior characteristic sequence are sorted according to time; using an autoencoder model, Perform feature extraction on the behavior feature sequence to obtain a set of feature vectors corresponding to the first identity; input a set of feature vectors into the time series processing model to obtain the behavior discrimination result corresponding to the behavior feature sequence; when the target of the first identity is received During behavior, the target behavior is controlled based on the result of behavior discrimination.
  • the behavior feature sequence within a preset time period is used as input, and the autoencoder model is used to extract and enhance the behavior feature sequence in high dimensions, which can be based on the user's behavior within a period of time.
  • the feature sequence is more flexible for behavior discrimination, and then the user behavior is controlled based on the discrimination result, which greatly improves the accuracy of recognition, and further improves the accuracy of behavior control for black users.
  • the embodiments of the present application provide a computer-readable storage medium on which a program is stored, and when the program is executed by a processor, the method described above is implemented.
  • the program instructions corresponding to a behavior control method in this embodiment can be stored on storage media such as optical disks, hard disks, and USB flash drives.
  • storage media such as optical disks, hard disks, and USB flash drives.
  • this application can be provided as a method, a system, or a computer program product. Therefore, this application may adopt the form of hardware embodiments, software embodiments, or embodiments combining software and hardware. Moreover, this application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, optical storage, etc.) containing computer-usable program codes.
  • These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing equipment to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing equipment are used to generate A device for realizing the functions specified in one process or multiple processes in the schematic flow chart and/or one block or multiple blocks in the block diagram.
  • These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device.
  • the device realizes the functions specified in one process or multiple processes in the realization process schematic diagram and/or one block or multiple blocks in the block diagram.
  • These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment.
  • the instructions provide steps for implementing functions specified in one or more processes in the schematic diagram and/or one block or more in the block diagram.
  • the embodiment of the application provides a behavior control method and device, and a storage medium.
  • the behavior feature sequence within a preset time period is used as input, and the autoencoder model is used to perform high-dimensional extraction and enhancement of the behavior feature sequence, which can be based on the user
  • the behavior feature sequence within a period of time is more flexible for behavior discrimination, and then the user behavior is controlled according to the discrimination result, which greatly improves the accuracy of recognition, and further improves the accuracy of behavior control for black users.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Image Analysis (AREA)

Abstract

本申请实施例公开了一种行为控制方法、装置及存储介质，该方法包括：获取第一身份标识在预设时间段内的行为特征序列，行为特征序列中的行为特征按照时间排序；利用自编码器模型，对行为特征序列进行特征提取，得到第一身份标识对应的一组特征向量；将一组特征向量输入时序处理模型中，得到行为特征序列对应的行为判别结果；当接收到第一身份标识的目标行为时，根据行为判别结果对目标行为进行行为控制。

Description

一种行为控制方法及装置、存储介质 技术领域
本申请实施例涉及电子应用领域，尤其涉及一种行为控制方法及装置、存储介质。
背景技术
现有的业务安全风控系统主要从业务特点出发，根据业务细分用户，并制定相关的规则识别黑产用户。具体的，先通过Hadoop、Spark等大数据工具对每日业务进行统计分析，提取和业务相关的用户特征，根据业务特点设计规则库，并利用规则库和用户特征为用户进行评级，根据评级结果设置用户的风险等级，并根据风险等级给用户开放相关权限，从而拒绝用户的某些行为。
利用上述方法识别出的黑产用户可信度较高，但在正常用户中往往存在着很多潜在的黑产用户，而这部分黑产用户靠规则库和细分用户的形式难以识别，导致对黑产用户进行行为控制的准确性变低。
发明内容
本申请实施例提供一种行为控制方法及装置、存储介质，能够提高识别黑产用户的准确性，进而提高对黑产用户进行行为控制的准确性。
本申请实施例的技术方案是这样实现的：
本申请实施例提供一种行为控制方法，所述方法包括：
获取第一身份标识在预设时间段内的行为特征序列，所述行为特征序列中的行为特征按照时间排序；
利用自编码器模型，对所述行为特征序列进行特征提取，得到所述第 一身份标识对应的一组特征向量；
将所述一组特征向量输入时序处理模型中，得到所述行为特征序列对应的行为判别结果；
当接收到所述第一身份标识的目标行为时，根据所述行为判别结果对所述目标行为进行行为控制。
在上述方法中，所述自编码器模型为降噪自编码器DAE模型，所述利用自编码器模型，对所述行为特征序列进行特征提取，得到所述第一身份标识对应的一组特征向量，包括：
将所述行为特征序列输入所述DAE模型中，利用所述DAE模型中的编码神经网络对所述行为特征序列进行特征压缩，得到一组中间特征向量；
对所述一组中间特征向量进行归一化，得到所述一组特征向量。
在上述方法中，所述时序处理模型为长短期记忆LSTM网络，所述将所述一组特征向量输入时序处理模型中，得到所述行为特征序列对应的行为判别结果，包括：
将所述一组特征向量输入所述LSTM网络的堆叠LSTM层，输出所述堆叠LSTM层中最后一层LSTM单元的网络状态，所述堆叠LSTM层由多层LSTM单元组成；
将所述网络状态输入所述LSTM网络的全连接层，得到所述一组特征向量对应的概率值；
将所述概率值确定为所述行为判别结果。
在上述方法中，所述将所述行为特征序列输入所述DAE模型中，利用所述DAE中的编码神经网络对所述行为特征序列进行特征压缩，得到一组中间特征向量之前，所述方法还包括：
利用样本行为特征对初始DAE模型进行模型训练，得到所述DAE模型。
在上述方法中，所述利用样本行为特征对初始DAE模型进行模型训练， 得到所述DAE模型，包括：
在所述样本行为特征中增加随机噪声，得到样本输入行为特征；
将所述样本输入行为特征输入所述初始DAE模型中的编码神经网络中，得到第一样本特征向量；
将所述第一样本特征向量输入所述编码神经网络对应的解码神经网络，输出样本输出行为特征；
利用所述样本行为特征和所述样本输出行为特征，对所述初始DAE模型进行模型训练，得到所述DAE模型。
在上述方法中，所述方法还包括：
分别获取所述第一身份标识对应的静态特征向量和所述行为特征序列；
相应的，所述时序处理模型为深度排序模型，所述将所述一组特征向量输入时序处理模型中，得到所述行为特征序列对应的行为判别结果，包括：
将所述静态特征向量和所述一组特征向量输入所述深度排序模型中，得到所述行为判别结果。
在上述方法中，所述行为特征包括：操作应用、操作类型、操作环境、网络环境中的至少一种。
本申请实施例提供一种行为控制装置，所述装置包括：
获取单元，用于获取第一身份标识在预设时间段内的行为特征序列，所述行为特征序列中的行为特征按照时间排序；
特征提取单元，用于利用自编码器模型，对所述行为特征序列进行特征提取，得到所述第一身份标识对应的一组特征向量；
行为判别单元，用于将所述一组特征向量输入时序处理模型中，得到所述行为特征序列对应的行为判别结果；
行为控制单元，用于当接收到所述第一身份标识的目标行为时，根据所述行为判别结果对所述目标行为进行行为控制。
本申请实施例提供一种行为控制装置，所述装置包括：处理器、存储器和通信总线，所述处理器执行存储器存储的运行程序时实现如上述任一项所述的方法。
本申请实施例提供一种计算机可读存储介质，其上存储有程序，应用于行为控制装置中，所述程序被处理器执行时实现如上述任一项所述的方法。
本申请实施例提供了一种行为控制方法及装置、存储介质，该方法可以包括：获取第一身份标识在预设时间段内的行为特征序列，行为特征序列中的行为特征按照时间排序；利用自编码器模型，对行为特征序列进行特征提取，得到第一身份标识对应的一组特征向量；将一组特征向量输入时序处理模型中，得到行为特征序列对应的行为判别结果；当接收到第一身份标识的目标行为时，根据行为判别结果对目标行为进行行为控制。由此可见，在本申请的实施例中，采用预设时间段内的行为特征序列作为输入，且利用自编码器模型对行为特征序列进行高维抽取和增强，能够根据用户一段时间内的行为特征序列更加灵活的进行行为判别，进而根据判别结果对用户进行行为控制，极大的提高了识别的准确性，进而提高对黑产用户进行行为控制的准确性。
附图说明
图1为现有技术中的基于AI模型实现业务安全风险系统的结构示意图；
图2为本申请实施例提供的一种行为控制方法的流程图一；
图3为本申请实施例提供的一种行为控制方法的流程图二；
图4为本申请实施例提供的一种示例性的DAE模型的结构示意图；
图5为本申请实施例提供的一种示例性的LSTM网络的结构示意图；
图6为本申请实施例提供的一种行为控制装置的结构示意图一；
图7为本申请实施例提供的一种行为控制装置的结构示意图二。
具体实施方式
现有的基于规则库和预先划分用户的风险等级进行业务安全风控存在以下问题：
(1)根据不同的业务场景和风控目标，需要依据业务特点结合相关的专家经验制定不同的规则，在规则的制定上面存在指定和更新成本高的问题，且主观性强，规则间的交叉协同性较弱；
(2)随着业务的深入，系统会越来越庞大，造成误拦率上升；
(3)由于制定的专家规则是和黑产用户的作弊手段强相关的，具有较强的可解释性，且考察的特征相关性较强，因此黑产用户易通过分析自身的虚假流量攻击效果来猜测和避开现有的业务安全风控系统。
为解决上述问题，还提出了一种采用人工智能(Artificial Intelligence，AI)模型进行业务安全风控建模的方法来进行业务安全风控，如图1所示，该模型由数据存储系统、计算集群、规则引擎、管理平台和规则库组成，其中，数据存储系统由关系数据库和非关系数据库组成；计算集群由离线计算集群和在线集群组成，实时计算集群用于在线计算，离线计算集群用于周期性的执行任务；规则引擎通过规则库生成规则，实现了对规则匹配的优化，增加了实时风控系统的效率；管理平台由规则配置模块和规则评价模块组成，基于指标和基于模型的规则评价模块能够保障风控规则的有效性被实时追踪。将交易数据、设备画像和日志数据输入AI模型中即可输出用户判别结果。
上述AI模型实现业务安全风控存在下述问题：
(1)用户流量数据是海量的，尤其是对于流量型数据，其特征维度比较低，存在标记困难的问题。因此，无法单独使用完全的有监督算法进行安全风控建模；
(2)在进行特征工程和模型训练过程中，原始数据集的存在大量的噪 声，这些噪声可能对模型的准确性带来极大的负面影响，而采用人工手段去噪则大大提高了建模的成本和难度；
(3)在虚假流量检测过程中，仅关系业务所关心的重点行为(如下载、点击、付费等)之外，导致判别结果的准确性低。
为解决上述问题，下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述。可以理解的是，此处所描述的具体实施例仅仅用于解释相关申请，而非对该申请的限定。另外还需要说明的是，为了便于描述，附图中仅示出了与有关申请相关的部分。
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述。
在一实施例中，本申请实施例提供了一种行为控制方法，图2本申请实施例提出的一种行为控制方法的实现流程示意图，该方法可以包括：
S101、获取第一身份标识在预设时间段内的行为特征序列，行为特征序列中的行为特征按照时间排序。
本申请实施例中，每当用户产生一次操作行为时，行为控制装置记录一次该操作行为对应的行为特征，包括：操作应用、操作类型、操作环境、网络环境中的至少一种，需要说明的是，行为特征不仅限于上述内容，还可以包括距离上一次操作的时间等，具体的根据实际情况进行选择和添加，本申请实施例不做具体的限定。上述行为特征构成了一次用户行为。
本申请实施例中，操作应用可以包括应用(Application，APP)名称和APP类型，其中，APP类型可以包括：即时通讯、购物、视频观看等。
本申请实施例中，操作类型可以包括：下载、搜索、点击、评论等。
本申请实施例中，操作环境可以包括：当前操作页面、上一次操作页面、外链来源等。
本申请实施例中，第一身份标识可以为用户身份标识号(Identity Document，ID)信息。
本申请实施例中，行为控制装置将第一身份标识在预设时间段内的所有行为特征按照时间先后顺序进行排序，得到第一身份标识在预设时间段内的行为特征序列。
本申请实施例中，预设时间段可以为一天、一周等，具体的根据实际情况进行选择，本申请实施例不做具体的限定。
进一步地，行为控制装置还可以同时利用第一身份标识对应的静态特征向量和行为特征序列，对第一身份标识进行行为判别，此时，行为控制装置分别获取第一身份标识对应的静态特征向量和行为特征序列。
本申请实施例中，第一身份标识对应的静态特征向量可以为用于表征画像特征等不易改变的特征的特征向量。
S102、利用自编码器模型，对行为特征序列进行特征提取，得到第一身份标识对应的一组特征向量。
行为控制装置中预先训练了自编码器模型，当行为控制装置获取到第一身份标识在预设时间段内的行为特征序列之后，行为控制装置利用自编码器模型对行为特征序列进行特征提取，得到第一身份标识对应的一组特征向量。
本申请实施例中，行为控制装置将行为特征序列输入自编码器模型中进行特征提取，输出第一身份标识对应的一组特征向量。
本申请实施例中，自编码器模型为降噪自编码器(Denoising Auto Encoder，DAE)模型。
本申请实施例中，DAE模型包括encoder(编码器)和decoder(解码器)，其中，encoder由编码神经网络组成，decoder由编码神经网络对应的解码神经网络组成，编码神经网络可以为双层神经网络或者三层神经网络等，具体的根据实际情况进行选择，本申请实施例不做具体的限定，解码神经网络的层数与编码神经网络的层数相同，即，当编码神经网络为双层神经网络时，解码神经网络为与编码神经网络对称的双层神经网络。
本申请实施例中，行为控制装置将行为特征序列输入DAE模型中，利用DAE模型中的编码神经网络对行为特征序列进行特征压缩，得到一组中间特征向量，由此，实现了对于初始的行为特征序列进行特征提取的过程，之后，行为控制装置对一组中间特征向量进行归一化，得到一组特征向量。
本申请实施例中，行为控制装置将一组中间特征向量输入批量归一化(BN，Batch Normalization)层进行批量归一化，利用BN层对一组中间特征向量进行归一化，可以在保留数据分布的同时将值归一化，进而增加网络的泛化能力，同时避免梯度消失和爆炸，提高训练效率。
在实际应用中，BN层被添加到DAE模型中，作为中间隐藏层处理逻辑的一部分，对于数据分布的学习过程也是在DAE的训练过程的中实现的。
进一步地，基于上述实施例一，在本申请的实施例中，在行为控制装置将行为特征序列输入DAE模型中，利用DAE模型中的编码神经网络对行为特征序列进行特征压缩，得到一组中间特征向量之前，行为控制装置还利用样本行为特征对初始DAE模型进行模型训练，得到DAE模型，如图3所示，具体的还可以包括以下步骤：
S201、行为控制装置在所述样本行为特征中增加随机噪声，得到样本输入行为特征。
本申请实施例中，行为控制装置采集样本行为特征，其中，行为控制装置可以获取本地的历史行为特征作为样本行为特征，或者在线从其他设备获取用户的历史行为特征，具体的根据实际情况进行选择，本申请实施例不做具体的限定。
本申请实施例中，行为控制装置将样本行为特征输入至输入层，并随机屏蔽其中的某些输入层节点，由此在样本行为特征中增加了随机噪声，此时得到的样本输入行为特征即为包含了一定噪声的行为特征，模拟了真实场景中行为特征的数据存在部分字段丢失和不全的情况，利用样本输入行为特征训练DAE模型可以增强DAE模型的泛化性能和鲁棒性，并去除 了输入噪声的干扰。
S202、行为控制装置将样本输入行为特征输入初始DAE模型中的编码神经网络中，得到第一样本特征向量。
本申请实施例中，初始DAE模型包括编码神经网络和与编码神经网络对称的解码神经网络，行为控制装置将样本输入行为特征输入初始DAE模型的编码神经网络中进行特征压缩，得到隐含层的压缩后的第一样本特征向量。
S203、行为控制装置将第一样本特征向量输入编码神经网络对应的解码神经网络，输出样本输出行为特征。
本申请实施例中，行为控制装置将第一样本特征向量输入编码神经网络对应的解码神经网络，进行解码还原，输出样本输出行为特征。
S204、行为控制装置利用样本行为特征和样本输出行为特征，对DAE模型进行模型训练，得到DAE模型。
本申请实施例中，行为控制装置通过最小化样本行为特征和样本输出行为特征之间的均方根误差来使得初始DAE模型收敛，由此行为控制装置完成了利用样本行为特征和样本输出行为特征，对初始DAE模型进行模型训练的过程，训练完成的初始DAE模型即为DAE模型。
示例性的，如图4所示，DAE模型包括编码器和解码器，将样本行为特征X增加随机噪声之后，输入编码器中得到样本行为特征Z，之后，将样本行为特征Z输入解码器中，得到样本行为特征X＇，DAE模型通过最小化X和X＇之间的均方根误差来使DAE模型收敛。
S103、将一组特征向量输入时序处理模型中，得到行为特征序列对应的行为判别结果。
行为控制装置中还预先训练了时序处理模型，当行为控制装置得到第一身份标识对应的一组特征向量之后，行为控制装置将一组特征向量输入时序处理模型中，得到行为特征序列对应的行为判别结果。
本申请实施例中，时序处理模型可以为长短期记忆(Long Short-Term Memory，LSTM)网络。
本申请实施例中，LSTM网络包括堆叠LSTM层和全连接层，BN层在输出一组特征向量之后，将一组特征向量输入LSTM网络的堆叠LSTM层，并输出堆叠LSTM层中最后一层LSTM单元的网络状态，其中堆叠LSTM层由多层LSTM单元组成；之后，将网络状态输入LSTM网络的全连接层，得到一组特征向量对应的概率值，具体的，全连接层由dense层和激活函数sigmod组成，依次将网络状态输入dense层和sigmod中，输出一组特征向量对应的该概率值；并将概率值确定为行为判别结果。
图5为LSTM网络的结构示意图，LSTM网络由堆叠LSTM层和全连接层组成，其中，堆叠LSTM层由n层LSTM单元组成，每一层LSTM单元调用一个cell_init方法，全连接层由dense层和sigmod组成，图5中，X1、X2、…、Xt为行为特征序列，在经过encoder和BN层之后，得到一组特征向量Z1、Z2、…、Zt，将Z1、Z2、…、Zt输入LSTM层中，经过多层LSTM_cell单元的学习，并将第n层的LSTM_cell(celln)的网络状态0t作为输出，经过dense操作之后输入激活函数sigmod，生成0-1的分类概率值。其中，0表征正常用户，1表征黑产用户。
本申请实施例中，采用交叉熵最小化作为损失函数对LTSM网络进行模型优化。
本申请实施例中，为了同时利用第一身份标识的静态特征向量和行为特征序列进行行为判别操作，时序处理模型还可以为深度排序模型，其中，深度排序模型包括wide&deep模型、deepFM模型等，其中deep模型为LTSM网络。将静态特征向量和一组特征向量输入深度排序模型中，得到行为判别结果。
在一种可选的实施例中，对于wide&deep模型，将静态特征向量输入wide模型中，将行为特征序列输入deep模型中，输出行为判别结果。
在另一种可选的实施例中，对于deepFM模型，将静态特征向量输入FM模型中，将行为特征序列输入deep模型中，输出行为判别标准。
S104、当接收到第一身份标识的目标行为时，根据行为判别结果对目标行为进行行为控制。
当行为控制装置得到行为特征序列对应的行为判别结果之后，行为控制装置可以根据行为判别结果确定第一身份标识是否为黑产用户，当行为控制装置再次接收到第一身份标识的目标行为时，行为控制装置根据行为判别结果对目标行为进行相应的行为控制。
本申请实施例中，当根据行为判别结果确定出第一身份标识为黑产用户时，就需要限制第一身份标识的某些行为，具体的，在下一次接收到第一身份标识的目标行为时，确定目标行为的类型，当目标行为的类型满足限制行为类型时，限制该目标行为；限制行为类型可以包括抽奖、曝光、浏览等行为，具体的根据实际情况进行选择，本申请实施例不做具体的限定。
进一步地，自编码器模型和时序处理模型可以作为基本模型，进一步结合正样本无标签(Positive and Unlabeled，PU)学习算法、Teacher-Student网络架构等半监督算法框架，实现适用于大流量、少标记的风控场景。
可以理解的是，采用预设时间段内的行为特征序列作为输入，且利用自编码器模型对行为特征序列进行高维抽取和增强，能够根据用户一段时间内的行为特征序列更加灵活的进行行为判别，进而根据判别结果对用户进行行为控制，极大的提高了识别的准确性，进而提高对黑产用户进行行为控制的准确性。
基于上述实施例，在本申请的又一实施例中，图6为本申请实施例提出的行为控制装置的组成结构示意图一，如图6所示，本申请实施例提出的行为控制装置1可以包括：
获取单元10，用于获取第一身份标识在预设时间段内的行为特征序列， 所述行为特征序列中的行为特征按照时间排序；
特征提取单元11，用于利用自编码器模型，对所述行为特征序列进行特征提取，得到所述第一身份标识对应的一组特征向量；
行为判别单元12，用于将所述一组特征向量输入时序处理模型中，得到所述行为特征序列对应的行为判别结果；
行为控制单元13，用于当接收到所述第一身份标识的目标行为时，根据所述行为判别结果对所述目标行为进行行为控制。
进一步地，所述自编码器模型为降噪自编码器DAE模型，所述装置还包括：特征压缩单元和归一化单元；
所述特征压缩单元，用于将所述行为特征序列输入所述DAE模型中，利用所述DAE模型中的编码神经网络对所述行为特征序列进行特征压缩，得到一组中间特征向量；
所述归一化单元，用于对所述一组中间特征向量进行归一化，得到所述一组特征向量。
进一步地，所述时序处理模型为长短期记忆LSTM网络，
所述行为判别单元12，具体用于将所述一组特征向量输入所述LSTM网络的堆叠LSTM层，输出所述堆叠LSTM层中最后一层LSTM单元的网络状态，所述堆叠LSTM层由多层LSTM单元组成；将所述网络状态输入所述LSTM网络的全连接层，得到所述一组特征向量对应的概率值；将所述概率值确定为所述行为判别结果。
进一步地，所述装置还包括：模型训练单元；
所述模型训练单元，用于利用样本行为特征对初始DAE模型进行模型训练，得到所述DAE模型。
进一步地，所述模型训练单元，具体用于在所述样本行为特征中增加随机噪声，得到样本输入行为特征；将所述样本输入行为特征输入所述初始DAE模型中的编码神经网络中，得到第一样本特征向量；将所述第一样 本特征向量输入所述编码神经网络对应的解码神经网络，输出样本输出行为特征；利用所述样本行为特征和所述样本输出行为特征，对所述初始DAE模型进行模型训练，得到所述DAE模型。
进一步地，所述获取单元10，还用于分别获取所述第一身份标识对应的静态特征向量和所述行为特征序列；
所述行为判别单元12，还用于将所述静态特征向量和所述一组特征向量输入所述深度排序模型中，得到所述行为判别结果。
进一步地，所述行为特征包括：操作应用、操作类型、操作环境、网络环境中的至少一种。
图7为本申请实施例提出的行为控制装置组成结构示意图二，如图7所示，本申请实施例提出的行为控制装置1还可以包括处理器110、存储器111和通信总线112。
在具体的实施例的过程中，上述获取单元10、特征提取单元11、行为判别单元12、行为控制单元13、特征压缩单元、归一化单元和模型训练单元可由位于行为控制装置1上的处理器110实现，在本申请的实施例中，上述处理器110可以为特定用途集成电路(Application Specific Integrated Circuit，ASIC)、数字信号处理器(Digital Signal Processor，DSP)、数字信号处理装置(Digital Signal Processing Device，DSPD)、可编程逻辑装置(ProgRAMmable Logic Device，PLD)、现场可编程门阵列(Field ProgRAMmable Gate Array，FPGA)、中央处理器(Central Processing Unit，CPU)、控制器、微控制器、微处理器中的至少一种。可以理解地，对于不同的设备，用于实现上述处理器功能的电子器件还可以为其它，本申请实施例不作具体限定。存储器111用于存储可执行程序代码，该程序代码包括计算机操作指令，存储器111可能包含高速RAM存储器，也可能还包括非易失性存储器，例如，至少两个磁盘存储器。
在本申请的实施例中，通信总线112用于连接处理器110、存储器111 以及这些器件之间的相互通信。
在本申请的实施例中，存储器111，用于存储指令和数据。
处理器110，用于获取第一身份标识在预设时间段内的行为特征序列，所述行为特征序列中的行为特征按照时间排序；利用自编码器模型，对所述行为特征序列进行特征提取，得到所述第一身份标识对应的一组特征向量；将所述一组特征向量输入时序处理模型中，得到所述行为特征序列对应的行为判别结果；当接收到所述第一身份标识的目标行为时，根据所述行为判别结果对所述目标行为进行行为控制。
进一步地，在本申请的实施例中，所述自编码器模型为降噪自编码器DAE模型，上述处理器110，还用于将所述行为特征序列输入所述DAE模型中，利用所述DAE模型中的编码神经网络对所述行为特征序列进行特征压缩，得到一组中间特征向量；对所述一组中间特征向量进行归一化，得到所述一组特征向量。
进一步地，在本申请的实施例中，所述时序处理模型为长短期记忆LSTM网络，上述处理器110，还用于将所述一组特征向量输入所述LSTM网络的堆叠LSTM层，输出所述堆叠LSTM层中最后一层LSTM单元的网络状态，所述堆叠LSTM层由多层LSTM单元组成；将所述网络状态输入所述LSTM网络的全连接层，得到所述一组特征向量对应的概率值；将所述概率值确定为所述行为判别结果。
进一步地，在本申请的实施例中，上述处理器110，还用于利用样本行为特征对初始DAE模型进行模型训练，得到所述DAE模型。
进一步地，在本申请的实施例中，上述处理器110，还用于在所述样本行为特征中增加随机噪声，得到样本输入行为特征；将所述样本输入行为特征输入所述初始DAE模型中的编码神经网络中，得到第一样本特征向量；将所述第一样本特征向量输入所述编码神经网络对应的解码神经网络，输出样本输出行为特征；利用所述样本行为特征和所述样本输出行为特征， 对所述初始DAE模型进行模型训练，得到所述DAE模型。
进一步地，在本申请的实施例中，所述时序处理模型为深度排序模型，上述处理器110，还用于分别获取所述第一身份标识对应的静态特征向量和所述行为特征序列；将所述静态特征向量和所述一组特征向量输入所述深度排序模型中，得到所述行为判别结果。
进一步地，所述行为特征包括：操作应用、操作类型、操作环境、网络环境中的至少一种。
在实际应用中，上述存储器111可以是易失性第一存储器(volatile memory)，例如随机存取第一存储器(Random-Access Memory，RAM)；或者非易失性第一存储器(non-volatile memory)，例如只读第一存储器(Read-Only Memory，ROM)，快闪第一存储器(flash memory)，硬盘(Hard Disk Drive，HDD)或固态硬盘(Solid-State Drive，SSD)；或者上述种类的第一存储器的组合，并向处理器110提供指令和数据。
另外，在本实施例中的各功能模块可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。
集成的单元如果以软件功能模块的形式实现并非作为独立的产品进行销售或使用时，可以存储在一个计算机可读取存储介质中，基于这样的理解，本实施例的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)或processor(处理器)执行本实施例方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
本申请实施例提出的一种行为控制方法及装置、存储介质，获取第一身份标识在预设时间段内的行为特征序列，行为特征序列中的行为特征按照时间排序；利用自编码器模型，对行为特征序列进行特征提取，得到第一身份标识对应的一组特征向量；将一组特征向量输入时序处理模型中，得到行为特征序列对应的行为判别结果；当接收到第一身份标识的目标行为时，根据行为判别结果对目标行为进行行为控制。由此可见，在本申请的实施例中，采用预设时间段内的行为特征序列作为输入，且利用自编码器模型对行为特征序列进行高维抽取和增强，能够根据用户一段时间内的行为特征序列更加灵活的进行行为判别，进而根据判别结果对用户进行行为控制，极大的提高了识别的准确性，进而提高对黑产用户进行行为控制的准确性。
本申请实施例提供计算机可读存储介质，其上存储有程序，该程序被处理器执行时实现如上所述的方法。
具体来讲，本实施例中的一种行为控制方法对应的程序指令可以被存储在光盘，硬盘，U盘等存储介质上，当存储介质中的与一种行为控制方法对应的程序指令被一电子设备读取或被执行时，实现如上述任一项所述的方法。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用硬件实施例、软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器和光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的实现流程示意图和/或方框图来描述的。应理解可由计算机程序指令实现流程示意图和/或方框图中的每一流程和/或方框、以及实现流程示意图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通 用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其他可编程数据处理设备的处理器执行的指令产生用于实现在实现流程示意图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
这些计算机程序指令也可存储在能引导计算机或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在实现流程示意图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其他可编程数据处理设备上，使得在计算机或其他可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其他可编程设备上执行的指令提供用于实现在实现流程示意图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
以上所述，仅为本申请的较佳实施例而已，并非用于限定本申请的保护范围。
工业实用性
本申请实施例提供了一种行为控制方法及装置、存储介质，采用预设时间段内的行为特征序列作为输入，且利用自编码器模型对行为特征序列进行高维抽取和增强，能够根据用户一段时间内的行为特征序列更加灵活的进行行为判别，进而根据判别结果对用户进行行为控制，极大的提高了识别的准确性，进而提高对黑产用户进行行为控制的准确性。

Claims (10)

  1. 一种行为控制方法，所述方法包括：
    获取第一身份标识在预设时间段内的行为特征序列，所述行为特征序列中的行为特征按照时间排序；
    利用自编码器模型，对所述行为特征序列进行特征提取，得到所述第一身份标识对应的一组特征向量；
    将所述一组特征向量输入时序处理模型中，得到所述行为特征序列对应的行为判别结果；
    当接收到所述第一身份标识的目标行为时，根据所述行为判别结果对所述目标行为进行行为控制。
  2. 根据权利要求1所述的方法，其中，所述自编码器模型为降噪自编码器DAE模型，所述利用自编码器模型，对所述行为特征序列进行特征提取，得到所述第一身份标识对应的一组特征向量，包括：
    将所述行为特征序列输入所述DAE模型中，利用所述DAE模型中的编码神经网络对所述行为特征序列进行特征压缩，得到一组中间特征向量；
    对所述一组中间特征向量进行归一化，得到所述一组特征向量。
  3. 根据权利要求1所述的方法，其中，所述时序处理模型为长短期记忆LSTM网络，所述将所述一组特征向量输入时序处理模型中，得到所述行为特征序列对应的行为判别结果，包括：
    将所述一组特征向量输入所述LSTM网络的堆叠LSTM层，输出所述堆叠LSTM层中最后一层LSTM单元的网络状态，所述堆叠LSTM层由多层LSTM单元组成；
    将所述网络状态输入所述LSTM网络的全连接层，得到所述一组特征向量对应的概率值；
    将所述概率值确定为所述行为判别结果。
  4. 根据权利要求2所述的方法，其中，所述将所述行为特征序列输入所述DAE模型中，利用所述DAE中的编码神经网络对所述行为特征序列进行特征压缩，得到一组中间特征向量之前，所述方法还包括：
    利用样本行为特征对初始DAE模型进行模型训练，得到所述DAE模型。
  5. 根据权利要求4所述的方法，其中，所述利用样本行为特征对初始DAE模型进行模型训练，得到所述DAE模型，包括：
    在所述样本行为特征中增加随机噪声，得到样本输入行为特征；
    将所述样本输入行为特征输入所述初始DAE模型中的编码神经网络中，得到第一样本特征向量；
    将所述第一样本特征向量输入所述编码神经网络对应的解码神经网络，输出样本输出行为特征；
    利用所述样本行为特征和所述样本输出行为特征，对所述初始DAE模型进行模型训练，得到所述DAE模型。
  6. 根据权利要求1所述的方法，其中，所述方法还包括：
    分别获取所述第一身份标识对应的静态特征向量和所述行为特征序列；
    相应的，所述时序处理模型为深度排序模型，所述将所述一组特征向量输入时序处理模型中，得到所述行为特征序列对应的行为判别结果，包括：
    将所述静态特征向量和所述一组特征向量输入所述深度排序模型中，得到所述行为判别结果。
  7. 根据权利要求1-6任一项所述的方法，其中，所述行为特征包括：操作应用、操作类型、操作环境、网络环境中的至少一种。
  8. 一种行为控制装置，所述装置包括：
    获取单元，用于获取第一身份标识在预设时间段内的行为特征序列，所述行为特征序列中的行为特征按照时间排序；
    特征提取单元，用于利用自编码器模型，对所述行为特征序列进行特征提取，得到所述第一身份标识对应的一组特征向量；
    行为判别单元，用于将所述一组特征向量输入时序处理模型中，得到所述行为特征序列对应的行为判别结果；
    行为控制单元，用于当接收到所述第一身份标识的目标行为时，根据所述行为判别结果对所述目标行为进行行为控制。
  9. 一种行为控制装置，所述装置包括：处理器、存储器和通信总线，所述处理器执行存储器存储的运行程序时实现如权利要求1-7任一项所述的方法。
  10. 一种计算机可读存储介质，其上存储有程序，应用于行为控制装置中，所述程序被处理器执行时实现如权利要求1-7任一项所述的方法。
PCT/CN2020/093853 2020-06-02 2020-06-02 一种行为控制方法及装置、存储介质 WO2021243534A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN202080100085.4A CN115461740A (zh) 2020-06-02 2020-06-02 一种行为控制方法及装置、存储介质
PCT/CN2020/093853 WO2021243534A1 (zh) 2020-06-02 2020-06-02 一种行为控制方法及装置、存储介质

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2020/093853 WO2021243534A1 (zh) 2020-06-02 2020-06-02 一种行为控制方法及装置、存储介质

Publications (1)

Publication Number Publication Date
WO2021243534A1 true WO2021243534A1 (zh) 2021-12-09

Family

ID=78829996

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/093853 WO2021243534A1 (zh) 2020-06-02 2020-06-02 一种行为控制方法及装置、存储介质

Country Status (2)

Country Link
CN (1) CN115461740A (zh)
WO (1) WO2021243534A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115001843A (zh) * 2022-06-24 2022-09-02 咪咕文化科技有限公司 身份验证方法、装置、电子设备及计算机可读存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103530540A (zh) * 2013-09-27 2014-01-22 西安交通大学 基于人机交互行为特征的用户身份属性检测方法
CN110096499A (zh) * 2019-04-10 2019-08-06 华南理工大学 一种基于行为时间序列大数据的用户对象识别方法及系统
CN110290466A (zh) * 2019-06-14 2019-09-27 中国移动通信集团黑龙江有限公司 楼层判别方法、装置、设备及计算机存储介质
CN110807180A (zh) * 2019-10-28 2020-02-18 支付宝(杭州)信息技术有限公司 安全认证以及训练安全认证模型的方法、装置及电子设备
US20200125394A1 (en) * 2018-10-17 2020-04-23 The Boston Consulting Group, Inc. Data analytics platform

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103530540A (zh) * 2013-09-27 2014-01-22 西安交通大学 基于人机交互行为特征的用户身份属性检测方法
US20200125394A1 (en) * 2018-10-17 2020-04-23 The Boston Consulting Group, Inc. Data analytics platform
CN110096499A (zh) * 2019-04-10 2019-08-06 华南理工大学 一种基于行为时间序列大数据的用户对象识别方法及系统
CN110290466A (zh) * 2019-06-14 2019-09-27 中国移动通信集团黑龙江有限公司 楼层判别方法、装置、设备及计算机存储介质
CN110807180A (zh) * 2019-10-28 2020-02-18 支付宝(杭州)信息技术有限公司 安全认证以及训练安全认证模型的方法、装置及电子设备

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115001843A (zh) * 2022-06-24 2022-09-02 咪咕文化科技有限公司 身份验证方法、装置、电子设备及计算机可读存储介质

Also Published As

Publication number Publication date
CN115461740A (zh) 2022-12-09

Similar Documents

Publication Publication Date Title
CN107316198B (zh) 账户风险识别方法及装置
CN111222638B (zh) 一种基于神经网络的网络异常检测方法及装置
CN111143838B (zh) 数据库用户异常行为检测方法
US8719191B2 (en) Training and verification using a correlated boosted entity model
CN110602120B (zh) 一种面向网络的入侵数据检测方法
CN113657993A (zh) 信用风险识别方法、装置、设备及存储介质
CN112052891A (zh) 机器行为识别方法、装置、设备及计算机可读存储介质
CN114548241A (zh) 被盗账户检测方法、装置、电子设备
WO2021243534A1 (zh) 一种行为控制方法及装置、存储介质
Randive et al. An efficient pattern-based approach for insider threat classification using the image-based feature representation
US20210224688A1 (en) Method of training a module and method of preventing capture of an ai module
Saaudi et al. Insider threats detection using CNN-LSTM model
Wen et al. SQL injection detection technology based on BiLSTM-attention
CN110740111B (zh) 一种数据防漏方法、装置及计算机可读存储介质
Sudha et al. Analysis and evaluation of integrated cyber crime offences
CN114912109A (zh) 一种基于图嵌入的异常行为序列识别方法及系统
CN113259369B (zh) 一种基于机器学习成员推断攻击的数据集认证方法及系统
Sulayman et al. Designing security user profiles via anomaly detection for user authentication
Hewage et al. Optimizing the trade-off between classification accuracy and data privacy in the area of data stream mining
CN112950222A (zh) 资源处理异常检测方法、装置、电子设备及存储介质
CN113469816A (zh) 基于多组学技术的数字货币识别方法、系统和存储介质
CN112738098A (zh) 一种基于网络行为数据的异常检测方法及装置
Oliseenko et al. Identification of user profiles in online social networks: a combined approach with face recognition
EP4107641A1 (en) A method of training a module and method of preventing capture of an ai module
CN110990876A (zh) 基于不变后随机响应技术的数据库敏感关联属性脱敏方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20939206

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205N DATED 24/01/2023)

122 Ep: pct application non-entry in european phase

Ref document number: 20939206

Country of ref document: EP

Kind code of ref document: A1