WO2024031881A1 - Operation behavior recognition method and apparatus - Google Patents

Abstract

An operation behavior recognition method and apparatus, which are applied to the technical field of artificial intelligence. The method comprises: acquiring text description information of the current operation behavior of a target object, and converting the text description information into an image to be recognized (S201); recognizing said image by means of a trained abnormal behavior recognition model, so as to obtain preliminary risk scores of the current operation behavior in a plurality of dimensions (S202); and on the basis of the preliminary risk scores in the plurality of dimensions, obtaining a risk determination result of the current operation behavior (S203). Text description information of an operation behavior of a merchant is converted into image information, such that data is more directly observed and more relevant to a monitoring scenario, thereby making it convenient to subsequently use the abnormal behavior recognition model to perform self-supervised recognition on the operation behavior to determine whether the operation behavior is a risk behavior, and also improving the accuracy of the recognition of the operation behavior. Moreover, it is unnecessary to preset a risk operation behavior strategy to recognize the operation behavior of the merchant, thereby avoiding a waste of storage resources and improving the efficiency of the recognition of the operation behavior.

Description

An operation behavior recognition method and device

Cross-references to related applications

This application claims priority to the Chinese patent application submitted to the China Patent Office on August 12, 2022, with the application number 202210972061.9 and the application title "An operation behavior recognition method and device", the entire content of which is incorporated into this application by reference. middle.

Technical field

The present application relates to the field of artificial intelligence technology, and in particular to an operating behavior recognition method and device.

Background technique

In order to further strengthen the security environment monitoring and verification capabilities for the entire life cycle of financial terminals, and the dynamic risk monitoring capabilities for financial terminals before and during the event, it is necessary to expand a wider range of supervision methods for merchants' operational risk behaviors.

In related technologies, when judging whether a merchant's operation behavior is a risky operation behavior, it is necessary to preset a risk operation behavior strategy in advance, and then identify the risk operation behavior of the merchant's operation behavior based on the preset risk operation behavior strategy, and calculate the risk The operation score is used to determine whether the merchant's operation behavior is a risky operation behavior based on the risk operation score.

However, the above method needs to preset and save multiple risk operation behavior strategies in advance. When the amount of data is large, there may be problems of large storage resource consumption and slow calculation.

Contents of the invention

Embodiments of the present application provide an operation behavior recognition method and device, which are used to improve the efficiency of operation behavior recognition and reduce the resource consumption of operation behavior recognition.

In the first aspect, embodiments of the present application provide an operation behavior recognition method, including:

Obtain the text description information of the current operating behavior of the target object, and convert the text description information into an image to be recognized;

Recognize the image to be identified through the trained abnormal behavior recognition model, and obtain a preliminary risk score of the current operating behavior in multiple dimensions;

Based on the preliminary risk scores of the multiple dimensions, the risk judgment result of the current operating behavior is obtained.

In the embodiment of this application, the text description information of the merchant's operating behavior is converted into image information, making the data more intuitive and closer to the monitoring scene, which facilitates the subsequent use of the abnormal behavior recognition model to self-supervise and identify the operating behavior and determine the operating behavior. Whether it is a risky behavior, while improving the accuracy of identification of operational behavior. Secondly, there is no need to preset risky operation behavior policies as a benchmark for identifying whether a merchant's operation behavior is a risky operation behavior, thereby reducing storage resource consumption. Moreover, when the amount of data is large, it can effectively solve the problem of slow calculation caused by the large amount of data and improve the efficiency of operating behavior recognition.

Optionally, the text description information of the current operation behavior is obtained by the terminal device through the system application framework layer.

Optionally, the text description information includes occurrence time information and location information of the current operation behavior.

Converting the text description information into an image to be recognized includes:

Map the position information into two-dimensional space to obtain the operation trajectory:

Based on the occurrence time information, determine the color attribute of each trajectory point in the operation trajectory;

The image to be recognized is obtained based on the operation trajectory and the color attribute of each trajectory point.

Optionally, the text description information also includes pressure information;

After mapping the position information into the two-dimensional space and obtaining the operation trajectory, it also includes:

Based on the pressure information, determine the size of each trajectory point in the operation trajectory;

Determining the image to be recognized based on the operation trajectory and the color attribute of each trajectory point includes:

The image to be recognized is determined based on the operation trajectory, the color attribute of each trajectory point, and the size of each trajectory point.

Optionally, the trained abnormal behavior recognition model includes a trained feature extractor and a trained linear decision model;

The image to be identified is identified through the trained abnormal behavior recognition model, and a preliminary risk score of the multiple dimensions is obtained, including:

Using the trained feature extractor, perform feature extraction on the image to be identified to obtain target image features;

Through the trained linear decision model, the target image features are judged to obtain preliminary risk scores of the multiple dimensions.

Optionally, the trained abnormal behavior recognition model is trained in the following manner:

Use a combination of neural network and unsupervised clustering to train the feature extractor to be trained to obtain an intermediate feature extractor;

The intermediate feature extractor and the linear decision model to be trained are jointly fine-tuned and trained to obtain the trained feature extractor and the trained linear decision model.

Optionally, the feature extractor to be trained is trained using a combination of neural network and unsupervised clustering to obtain an intermediate feature extractor, including:

Using a combination of neural network and unsupervised clustering, the feature extractor to be trained is iteratively trained based on the sample image set to obtain an intermediate feature extractor. Each iterative training process includes the following steps:

Use the feature extractor to be trained to extract features from the sample image to obtain a feature set of the sample image;

Cluster the sample image feature set to obtain multi-category sample image features and pseudo labels corresponding to each category of sample image features;

Based on the obtained multi-category sample image features and the pseudo labels corresponding to each category of sample image features, the distribution loss value is determined, and the distribution loss value is used to adjust the parameters of the feature extractor to be trained through backpropagation.

Optionally, the preliminary risk scores in multiple dimensions include a first risk score and a second risk score, wherein the first risk score is used to characterize the abnormality of the current operating behavior; the second risk score is used to characterize It represents the target similarity between the current operation behavior and the historical operation behavior of the target object.

Optionally, obtaining the risk judgment result of the current operating behavior based on the preliminary risk scores of the multiple dimensions includes:

Perform a weighted sum of the first risk score and the second risk score to obtain the target risk score of the current operating behavior;

If the target risk score is greater than the preset threshold, the current operating behavior is determined to be a risky behavior;

If the target risk score is less than or equal to the preset threshold, the current operation behavior is determined to be a safe behavior.

Optionally, if within the determination period, the number of times the operation behavior of the target object is determined to be a risky behavior is greater than the risk threshold, an alarm and a risk mark for the target object are triggered.

In the second aspect, embodiments of the present application provide an operating behavior recognition device, including:

An acquisition module, used to acquire the text description information of the current operating behavior of the target object, and convert the text description information into an image to be recognized;

A processing module configured to identify the image to be identified through a trained abnormal behavior recognition model and obtain a preliminary risk score of the current operating behavior in multiple dimensions;

The processing module is also configured to obtain the risk judgment result of the current operating behavior based on the preliminary risk scores of the multiple dimensions.

Optionally, the acquisition module is specifically used to:

The text description information of the current operation behavior is collected by the terminal device through the system application framework layer.

Optionally, the processing module is specifically used to:

Map the position information into a two-dimensional space to obtain the operation trajectory;

Based on the occurrence time information, determine the color attribute of each trajectory point in the operation trajectory;

The image to be recognized is obtained based on the operation trajectory and the color attribute of each trajectory point.

Optionally, the processing module is specifically used to:

Based on the pressure information, determine the size of each trajectory point in the operation trajectory;

Determining the image to be recognized based on the operation trajectory and the color attribute of each trajectory point includes:

The image to be recognized is determined based on the operation trajectory, the color attribute of each trajectory point, and the size of each trajectory point.

Optionally, the processing module is specifically used to:

The image to be identified is recognized through the trained abnormal behavior recognition model, and the target risk score corresponding to the current operating behavior is obtained, including:

Using the trained feature extractor, perform feature extraction on the image to be identified to obtain target image features;

Through the trained linear decision model, the target image features are judged to obtain preliminary risk scores of the multiple dimensions.

Optionally, the processing module is specifically used to:

Use a combination of neural network and unsupervised clustering to train the feature extractor to be trained to obtain an intermediate feature extractor;

The intermediate feature extractor and the linear decision model to be trained are jointly fine-tuned and trained to obtain the trained feature extractor and the trained linear decision model.

Optionally, the processing module is specifically used to:

Using a combination of neural network and unsupervised clustering, the feature extractor to be trained is iteratively trained based on the sample image set to obtain an intermediate feature extractor. Each iterative training process includes the following steps:

Use the feature extractor to be trained to extract features from the sample image to obtain a feature set of the sample image;

Cluster the sample image feature set to obtain multi-category sample image features and pseudo labels corresponding to each category of sample image features;

Based on the obtained multi-class sample image features and the pseudo labels corresponding to the non-class sample image features, the distribution loss value is determined, and the distribution loss value is used to adjust the parameters of the feature extractor to be trained through backpropagation.

Optionally, the processing module is specifically used to:

The preliminary risk scores of multiple dimensions include a first risk score and a second risk score, where the first risk score is used to characterize the abnormality of the current operating behavior; the second risk score is used to characterize the current The target similarity between the operation behavior and the historical operation behavior of the target object.

Optionally, the processing module is specifically used to:

The preliminary risk score based on the multiple dimensions is used to obtain the risk judgment result of the current operating behavior, including:

Perform a weighted sum of the first risk score and the second risk score to obtain the target risk score of the current operating behavior;

If the target risk score is greater than the preset threshold, the current operating behavior is determined to be a risky behavior;

If the target risk score is less than or equal to the preset threshold, the current operation behavior is determined to be a safe behavior.

Optionally, the processing module is specifically used to:

If within the determination period, the number of times the operation behavior of the target object is determined to be a risky behavior is greater than the risk threshold, an alarm and a risk mark for the target object are triggered.

In a third aspect, embodiments of the present application provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. The processor performs any of the operations described in the first aspect. Behavior recognition methods.

In a fourth aspect, embodiments of the present application provide a computer-readable storage medium that stores a computer program that can be executed by a computer device. When the program is run on the computer device, it causes the computer device to execute the first aspect. Any described operation behavior recognition method.

By transforming the text description information of the merchant's operation behavior into image information, the data is made more intuitive and closer to the monitoring scene, which facilitates the subsequent use of the abnormal behavior recognition model to automatically analyze the operation behavior. Supervise the identification to determine whether the operation behavior is a risky behavior, and at the same time improve the accuracy of the operation behavior identification. Secondly, there is no need to preset risky operation behavior policies as a benchmark for identifying whether a merchant's operation behavior is a risky operation behavior, thereby reducing storage resource consumption. Moreover, when the amount of data is large, it can effectively solve the problem of slow calculation caused by the large amount of data and improve the efficiency of operating behavior recognition.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings needed to describe the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. Those of ordinary skill in the art can also obtain other drawings based on these drawings without exerting any creative effort.

Figure 1 is a schematic diagram of a system architecture provided by an embodiment of the present invention;

Figure 2 is a schematic flowchart of an operation behavior recognition method provided by an embodiment of the present invention;

Figure 3 is a schematic diagram of the process of converting text description information into an image to be recognized according to an embodiment of the present invention;

Figure 4 is a schematic diagram of a process of constructing an abnormal behavior recognition model provided by an embodiment of the present invention;

Figure 5 is a schematic structural diagram of an operating behavior recognition device provided by an embodiment of the present invention;

Figure 6 is a schematic structural diagram of a computing device provided by an embodiment of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the present invention clearer, the present invention will be described in further detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of the present invention.

Refer to Figure 1, which is a system architecture diagram used in an embodiment of the present application. The system architecture includes a terminal device 101 and a server 102. The terminal device 101 is used to collect text description information of the current operating behavior of the target object. The target object may be a merchant, a user, etc.; the terminal device 101 may be a smartphone, a tablet, a laptop, a desktop computer, an automatic teller machine, an acquiring device, etc., but is not limited thereto.

The server 102 receives the text description information of the current operation behavior sent by the terminal device 101, and determines the risk judgment result of the current operation behavior based on the text description information of the current operation behavior. The server 102 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or it can provide cloud services, cloud databases, cloud computing, cloud functions, cloud storage, and network services. , cloud communications, middleware services, domain name services, security services, content delivery network (Content Delivery Network, CDN), and the cloud server side of basic cloud computing services such as big data and artificial intelligence platforms. The terminal device 101 and the server 102 can be connected directly or indirectly through wired or wireless communication methods, which is not limited in this application.

Based on the above system architecture, Figure 2 exemplarily shows the process of an operation behavior recognition method. The process of the method is executed by a computer device. The computing and device can be the server shown in Figure 1, which includes the following steps:

Step S201, obtain the text description information of the current operation behavior of the target object, and convert the text description information into an image to be recognized;

Specifically, the target object may be a merchant, and the current operation behavior is the interaction operation currently being performed by the merchant with the terminal device, where the interaction operation includes but is not limited to click, double-click, interaction, etc. The text description information is a text sequence describing the interactive operation. The server converts the text description information generated by the current operation behavior to obtain the image to be recognized.

In some embodiments, the text description information includes occurrence time information and location information of the current operation behavior. Then the process of converting text description information into an image to be recognized is: mapping the position information into a two-dimensional space to obtain the operation trajectory; based on the occurrence time information, determining the color attribute of each trajectory point in the operation trajectory; based on the operation trajectory and The color attribute of each trajectory point is used to obtain the image to be recognized.

Specifically, as shown in Figure 3, the merchant triggers multiple interactive operation events on the screen of the terminal device, and the terminal device collects the text description information of the operation behavior corresponding to the interactive operation event. Each operation behavior has corresponding occurrence time information and location information. The terminal device sends the occurrence time information and location information of each operation behavior to the server. The server converts the data format of the occurrence time information and location information to obtain the specific time and location coordinate points. The server performs spatial transformation on the obtained position coordinate points to obtain the operation trajectory; it performs spatial transformation on the specific time to obtain the color attribute of each trajectory point on the operation trajectory. Combining the operation trajectory and the color attribute of each operation point on the operation trajectory, a two-dimensional image to be recognized is obtained.

In some embodiments, operational trajectories include points and/or lines. For example, if the merchant's single operation is "click", the corresponding operation trajectory of the "click" operation in the two-dimensional space is a point; if the merchant's operation is "swipe", then the "slide" operation is in The corresponding operation trajectory in the two-dimensional space is a line, which is composed of countless trajectory points.

In some embodiments, the color attribute is used to characterize the time sequence of the operation trajectory, and the color attribute may be color depth or color type.

For example, if a merchant triggers a sliding event from right to left on the screen of the acquiring device, the image to be recognized generated by the server will include a horizontal operation track, which is composed of countless track points. Define the color type of each track point to be red, and the color depth of consecutive track points from right to left gradually becomes lighter, to represent that the merchant's operation behavior is performed from right to left. You can also define the color type of each track point of the operation track to be blue, and the color depth of continuous track points from right to left gradually becomes darker, to represent that the merchant's operation behavior is performed from right to left.

In some embodiments, the text description information also includes pressure information. Map the position information into a two-dimensional space. After obtaining the operation trajectory, determine the size of each trajectory point in the operation trajectory based on the pressure information, and then based on the operation trajectory, the color attribute of each trajectory point and the size of each trajectory point, Determine the image to be recognized.

Specifically, the pressure information refers to the pressure value of pressing the screen during operation. The merchant triggers multiple interactive operation events on the screen of the terminal device, and the terminal device collects the text description information of the operation behavior corresponding to the interactive operation event. Each operation behavior has corresponding occurrence time information, location information, and pressure information. The terminal device sends the occurrence time information, location information and pressure information of each operation behavior to the server. The server converts the data format of the occurrence time information, location information and pressure information to obtain the specific time, location coordinate point and pressing pressure value. The server performs spatial transformation on the obtained position coordinate points to obtain the operation trajectory; performs spatial transformation on the specific time to obtain the color attribute of each trajectory point on the operation trajectory; performs spatial transformation on the pressing pressure value to obtain each trajectory on the operation trajectory Point size. Combining the operation track, the color attribute of each operation point on the operation track and the size of each track point on the operation track, a two-dimensional image to be recognized is obtained. Among them, the size of each track point on the operation track can reflect the merchant's operation. habit. When the operation track is a line, the sizes of multiple track points on the operation track can correspond to the thickness of the operation track. When different merchants perform the same operation behavior, if the pressure information in the text description information of the operation behavior is different, the thickness of the corresponding operation trajectories generated will also be different.

For example, if Merchant A triggers a sliding event from right to left on the screen of the acquiring device, the image to be recognized generated by the server includes a horizontal operation track, which is red and colored from right to left. Gradually becomes shallower, and the trajectory of this operation is thicker;

Merchant B triggers a sliding event from right to left on the screen of the acquiring device, and the image to be recognized generated by the server includes a horizontal operation track. The operation track is blue and gradually becomes lighter from right to left. , and the operation trajectory is thin.

In the embodiment of this application, the text description information of the merchant's operating behavior is converted into image information, making the data more intuitive and closer to the monitoring scene, which facilitates the subsequent use of the abnormal behavior recognition model to self-supervise and identify the operating behavior and determine whether the operating behavior is Risk behaviors while improving the accuracy of operational behavior identification.

In some embodiments, the text description information of the current operation behavior is obtained by the terminal device through the system application framework layer.

Specifically, the terminal device enables the data collection function by connecting to the relevant interface of the application framework layer.

For example, when a merchant operates the acquiring device, the acquiring device automatically collects the text description information of the merchant's current operation behavior, including information about the time when the operation event occurred and the location of the operation click, and then temporarily stores the collected operation information to the acquiring device. memory, and then sends the operation information to the server in the form of a message queue for data parsing and processing.

In the embodiment of this application, the operation behavior data of merchants is collected using the underlying event acquisition method of the Android system, and the data source is focused on the underlying input events. This method does not require embedding the sampling software development kit (Software Development Kit, for short) in advance. SDK), you can monitor any operation of the merchant on the device, which has wider applicability. This method includes but is not limited to system attribute setting operations, bill acquiring operations, and other App operations, etc., so it has certain feasibility for the engineering implementation of the merchant-side monitoring system.

Step S202: Recognize the image to be identified through the trained abnormal behavior recognition model, and obtain preliminary risk scores of the current operating behavior in multiple dimensions;

Specifically, the two-dimensional image to be identified is input into the abnormal behavior recognition model, and the abnormal behavior recognition model is used to identify the two-dimensional image to be recognized, and a preliminary risk score of the current operating behavior in multiple dimensions is obtained.

In some embodiments, the preliminary risk score of multiple dimensions includes a first risk score and a second risk score, wherein the first risk score is used to characterize the abnormality of the current operating behavior, and the second risk score is used to characterize the current operating behavior. Target similarity with the historical operating behavior of the target object.

Specifically, the trained abnormal behavior identification model gives a first risk score based on the abnormality degree of the current operating behavior. The higher the risk degree, the higher the risk score given by the abnormal behavior identification model. Among them, automated operations, high-frequency repetitive operations, etc. are all operational behaviors with a higher degree of risk, and will be given a higher risk score accordingly.

The trained abnormal behavior recognition model will also score based on the target similarity between the current operation behavior and the target object's historical operation behavior to obtain a second risk score. Among them, the higher the target similarity between the current operation behavior and the historical operation behavior, the higher the target similarity between the current operation behavior and the historical operation behavior. The more likely the current operating behavior is normal, the lower the second risk score given by the abnormal behavior identification model. The lower the target similarity between the current operating behavior and the historical operating behavior, it means that the current operating behavior may be abnormal, and the lower the second risk score given by the abnormal behavior identification model.

This abnormal behavior identification model establishes the connection between usage habits and operating behaviors, and can perform longitudinal identification. It can determine whether there are abnormalities in the equipment by analyzing the merchant's equipment usage habits and single operation behaviors, and make full use of the merchant's historical information. The analysis dimension can effectively identify non-personal operations and achieve the purpose of compliance control of targets.

Step S203: Obtain the risk judgment result of the current operating behavior based on the preliminary risk scores of multiple dimensions.

Specifically, if the preliminary risk scores of multiple dimensions of the current operating behavior meet the risk judgment conditions, the current operating behavior is determined to be a risky operating behavior. On the contrary, the current operating behavior is determined to be a safe operating behavior.

Convert the text description information of the merchant's operation behavior into image information, making the data more intuitive and closer to the monitoring scene, which not only facilitates the subsequent use of the abnormal behavior recognition model to self-supervise and identify the operation behavior, determine whether the operation behavior is a risky behavior, but also improves the Accuracy of operational behavior recognition. Secondly, there is no need to preset risky operation behavior policies to identify merchant operation behaviors, which avoids waste of storage resources and improves the efficiency of operation behavior identification.

In the above step S202, the trained abnormal behavior recognition model includes a trained feature extractor and a trained linear decision model. Through the trained abnormal behavior recognition model, the image to be recognized is recognized and the target risk score corresponding to the current operating behavior is obtained, including:

Through the trained feature extractor, the features of the image to be identified are extracted to obtain the target image features; through the trained linear decision model, the target image features are judged to obtain a preliminary risk score in multiple dimensions.

Specifically, the abnormal behavior recognition model includes a feature extractor and a linear decision model. The feature extractor can extract features from the two-dimensional image to be identified and obtain the target image features. The linear decision model corresponds to the specific business scenario and is used to determine and output the preliminary risk score of the current operating behavior in multiple dimensions under the corresponding business scenario.

In some embodiments, the trained abnormal behavior recognition model is trained in the following manner:

The feature extractor to be trained is trained using a combination of neural network and unsupervised clustering to obtain an intermediate feature extractor. Perform joint fine-tuning training on the intermediate feature extractor and the linear decision model to be trained to obtain a trained feature extractor and a trained linear decision model.

Specifically, a combination of neural network and unsupervised clustering is used to iteratively train the feature extractor to be trained based on the sample image set to obtain an intermediate feature extractor. Each iterative training process includes the following steps:

Use the feature extractor to be trained to extract features from the sample image to obtain a feature set of the sample image. Then cluster the sample image feature set to obtain multi-category sample image features and pseudo labels corresponding to each category of sample image features; based on the obtained multi-category sample image features and the pseudo labels corresponding to each category of sample image features, determine the distribution loss value , and use the distribution loss value to adjust the parameters of the feature extractor to be trained through backpropagation.

The above-mentioned feature extractor to be trained includes multiple feature extraction layers. After each feature extraction layer performs a feature extraction operation, the output sample image feature set is clustered to obtain multiple image feature groups. The obtained multiple image features are then grouped and input into the next feature extraction layer. Cluster the sample image feature set output by the last feature extraction layer to obtain multi-category sample image features and pseudo labels corresponding to each category of sample image features. Combine the obtained pseudo labels and distribution loss function to obtain the results of this iteration process. Distribution loss value, and then use the distribution loss value of this iteration process to adjust the parameters of the feature extractor to be trained through back propagation, and enter the next iteration process. When the distribution loss value meets the preset convergence condition, or the number of iterations reaches the preset threshold, the training ends and the intermediate feature extractor is obtained.

The above linear decision model corresponds to specific business scenarios, and different business scenarios correspond to different linear decision models. For different business scenarios, it is only necessary to perform joint fine-tuning training on the intermediate feature extractor and the corresponding linear decision model to be trained on a small batch of image samples to obtain the trained feature extractor and the trained linear decision model.

For example, as shown in Figure 4, a feature extractor to be trained is constructed. The feature extractor is an unsupervised model, defined here as model 1. Based on the text description data of the sample operation behavior, a sample image set is obtained, and the sample image set is input into the unsupervised model for feature extraction, and a sample image feature set is obtained. Then a clustering method is used to perform feature clustering on the sample image feature set to obtain a feature distribution, where the feature distribution includes multiple sample image feature categories and pseudo labels corresponding to each category. Based on the obtained pseudo labels and distribution loss function, the distribution loss value is obtained. Then use the distribution loss value to adjust the parameters of the unsupervised model and enter the next iterative training. After multiple iterations of training, an intermediate feature extractor is obtained.

For specific business scenarios, define a linear decision model to be trained on model 1, and define the linear decision model to be trained as model 2. Use small batches of image samples to conduct joint fine-tuning training on model 1 and model 2, combined with specific business The scene fine-tunes the overall recognition effect of the model to obtain the trained abnormal behavior recognition model.

The method of combining neural network and unsupervised clustering is used, and the abnormal behavior identification model is obtained by merging with the deep model, which effectively solves the problem of randomness of merchants' operating behaviors and differences in merchants' behavioral habits, and reflects it to specific situations. There are also deviations in the data and the problem of being unable to identify samples one by one. This application can realize the identification of abnormal behaviors through self-training on the premise of unlabeled data, improving the scope of application of operational behavior recognition. Secondly, pre-train an intermediate feature extractor, and then define corresponding linear decision models for different business scenarios, and use the intermediate feature extractor and linear decision model to jointly fine-tune the training to obtain an abnormal behavior recognition model, thereby improving the efficiency of model training. Efficiency also reduces the resource consumption of model training.

In some embodiments, obtaining the risk judgment result of the current operating behavior based on the preliminary risk scores of multiple dimensions includes: performing a weighted sum of the first risk score and the second risk score to obtain the target risk score of the current operating behavior; If the target risk score is greater than the preset threshold, the current operation behavior is determined to be a risky behavior; if the target risk score is less than or equal to the preset threshold, the current operation behavior is determined to be a safe behavior.

Specifically, the first risk score is defined as A and the second risk score is defined as B. The first risk score and the second risk score are weighted and summed to obtain the target risk score S for the current operating behavior. The calculation formula of S is: The following formula (1):

S＝α*A+β*B…………..(1)

Among them, α is greater than or equal to 0.7, and β is less than or equal to 0.3.

If the target risk score is greater than the preset threshold, the current operation behavior is determined to be a risky behavior; if the target risk score is less than or equal to the preset threshold, the current operation behavior is determined to be a safe behavior.

For example, set the current operation behavior of the collected merchants to operation behavior 1, and use the trained abnormal behavior recognition model to determine the first risk score of operation behavior 1 as 80 points and the second risk score as 35 points; set α is 0.7 and β is 0.3, then using the above formula (1) we can know that the target risk score S of operational behavior 1 is 66.5 points.

If the preset threshold is 65 points, since the target risk score S of operation behavior 1 is greater than the preset threshold, operation behavior 1 is determined to be a risky behavior.

In the embodiment of this application, the relationship between the merchant's operating behavior and usage habits is fully explored to identify whether the merchant's operating behavior is a risky behavior, making full use of the merchant's historical information, broadening the analysis dimension of the merchant's historical information, and improving improve the accuracy of operational behavior recognition.

In some embodiments, if within the determination period, the number of times the operation behavior of the target object is determined to be risky behavior is greater than the risk threshold, an alarm and a risk mark for the target object are triggered.

Specifically, it is preset to perform a specified number of operation behavior recognitions within the determination period. After performing a specified number of operational behavior identifications on the target object, count the number of times that the behavior is determined to be risky. If the number is greater than the risk threshold, the target object will be risk marked and warned.

For example, set the judgment period to 24 hours and the risk threshold to 3 times. If within 24 hours, the server performs 10 operational behavior identifications for Merchant 1, and four of them are determined to be risky operational behaviors, then the server will trigger an alarm and risk mark for Merchant 1.

In the embodiment of this application, by warning and risk marking merchants, the purpose of compliance control of merchants' operating behaviors is achieved, and a reference is provided for hierarchical early warning and management of merchants and institutions.

Based on the same technical concept, an embodiment of the present application provides a schematic structural diagram of an operation behavior recognition device, as shown in Figure 5. The device 500 includes:

The acquisition module 501 is used to obtain the text description information of the current operating behavior of the target object, and convert the text description information into an image to be recognized;

The processing module 502 is used to identify the image to be identified through the trained abnormal behavior recognition model, and obtain preliminary risk scores of the current operating behavior in multiple dimensions;

The processing module 502 is also configured to obtain the risk judgment result of the current operating behavior based on the preliminary risk scores of the multiple dimensions.

Optionally, the acquisition module 501 is specifically used to:

The text description information of the current operation behavior is collected by the terminal device through the system application framework layer.

Optionally, the processing module 502 is specifically used to:

Map the position information into a two-dimensional space to obtain the operation trajectory;

Based on the occurrence time information, determine the color attribute of each trajectory point in the operation trajectory;

The image to be recognized is obtained based on the operation trajectory and the color attribute of each trajectory point. Optionally, the processing module 502 is specifically used to:

The text description information also includes pressure information;

After mapping the position information into the two-dimensional space and obtaining the operation trajectory, it also includes:

Based on the pressure information, determine the size of each trajectory point in the operation trajectory;

Determining the image to be recognized based on the operation trajectory and the color attribute of each trajectory point includes:

The image to be recognized is determined based on the operation trajectory, the color attribute of each trajectory point, and the size of each trajectory point.

Optionally, the processing module 502 is specifically used to:

The image to be identified is recognized through the trained abnormal behavior recognition model, and the target risk score corresponding to the current operating behavior is obtained, including:

Using the trained feature extractor, perform feature extraction on the image to be identified to obtain target image features;

Through the trained linear decision model, the target image features are judged to obtain preliminary risk scores of the multiple dimensions.

Optionally, the processing module 502 is specifically used to:

Use a combination of neural network and unsupervised clustering to train the feature extractor to be trained to obtain an intermediate feature extractor;

The intermediate feature extractor and the linear decision model to be trained are jointly fine-tuned and trained to obtain the trained feature extractor and the trained linear decision model.

Optionally, the processing module 502 is specifically used to:

The method uses a combination of neural network and unsupervised clustering to train the feature extractor to be trained and obtain an intermediate feature extractor, including:

Using a combination of neural network and unsupervised clustering, the feature extractor to be trained is iteratively trained based on the sample image set to obtain an intermediate feature extractor. Each iterative training process includes the following steps:

Use the feature extractor to be trained to extract features from the sample image to obtain a feature set of the sample image;

Cluster the sample image feature set to obtain multi-category sample image features and pseudo labels corresponding to each category of sample image features;

Based on the obtained pseudo labels, a distribution loss value is determined, and the distribution loss value is used to adjust parameters of the feature extractor to be trained.

Optionally, the processing module 502 is specifically used to:

The preliminary risk scores of multiple dimensions include a first risk score and a second risk score, where the first risk score is used to characterize the abnormality of the current operating behavior; the second risk score is used to characterize the current The target similarity between the operation behavior and the historical operation behavior of the target object.

Optionally, the processing module 502 is specifically used to:

The preliminary risk score based on the multiple dimensions is used to obtain the risk judgment result of the current operating behavior, including:

Perform a weighted sum of the first risk score and the second risk score to obtain the target risk score of the current operating behavior;

If the target risk score is greater than the preset threshold, the current operating behavior is determined to be a risky behavior;

If the target risk score is less than or equal to the preset threshold, the current operation behavior is determined to be a safe behavior.

Optionally, the processing module 502 is specifically used to:

If within the determination period, the number of times the operation behavior of the target object is determined to be a risky behavior is greater than the risk threshold, an alarm and a risk mark for the target object are triggered.

By converting the text description information of the merchant's operating behavior into image information, the data is made more intuitive and closer to the monitoring scene, which facilitates the subsequent use of abnormal behavior identification models to self-supervise and identify the operating behavior, determine whether the operating behavior is a risky behavior, and at the same time improve improve the accuracy of operational behavior recognition. Secondly, there is no need to preset risky operation behavior policies to identify merchant operation behaviors, which avoids waste of storage resources and improves the efficiency of operation behavior identification.

Based on the same technical concept, embodiments of the present application provide a computer device. The computer device may be the terminal device or server shown in Figure 1. As shown in Figure 6, it includes at least one processor 601, and at least one processor 601. The memory 602 connected to the processor is not limited to the specific connection medium between the processor 601 and the memory 602 in the embodiment of this application. In Figure 6, the processor 601 and the memory 602 are connected through a bus as an example. The bus can be divided into address bus, data bus, control bus, etc.

In this embodiment of the present application, the memory 602 stores instructions that can be executed by at least one processor 601. By executing the instructions stored in the memory 602, at least one processor 601 can perform the steps of the above operation behavior identification method.

Among them, the processor 601 is the control center of the computer equipment. It can use various interfaces and lines to connect various parts of the computer equipment, and realize control by running or executing instructions stored in the memory 602 and calling data stored in the memory 602. Risk identification of the current operating behavior of the target object. Optionally, the processor 601 may include one or more processing units. The processor 601 may integrate an application processor and a modem processor. The application processor mainly processes the operating system, user interface, application programs, etc., and the modem processor The debug processor mainly handles wireless communications. It can be understood that the above modem processor may not be integrated into the processor 601. In some embodiments, the processor 601 and the memory 602 can be implemented on the same chip, and in some embodiments, they can also be implemented on separate chips.

The processor 601 may be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array or other programmable logic devices, discrete gates or transistors Logic devices and discrete hardware components can implement or execute the methods, steps and logical block diagrams disclosed in the embodiments of this application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in conjunction with the embodiments of the present application can be directly implemented by a hardware processor for execution, or can be executed by a combination of hardware and software modules in the processor.

As a non-volatile computer-readable storage medium, the memory 602 can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 602 may include at least one type of storage medium, for example, may include flash memory, hard disk, multimedia card, card-type memory, random access memory (Random Access Memory, RAM), static random access memory (Static Random Access Memory, SRAM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Magnetic Memory, Disk , CD, etc. Memory 602 is, but is not limited to, any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer device. The memory 602 in the embodiment of the present application can also be a circuit or any other device capable of realizing a storage function, used to store program instructions and/or data.

Based on the same inventive concept, embodiments of the present application provide a computer-readable storage medium that stores a computer program that can be executed by a computer device. When the program is run on the computer device, the computer device is caused to perform the steps of the above operation behavior recognition method. .

Those skilled in the art will understand that embodiments of the present application may be provided as methods, systems, or computer program products. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment that combines software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to the present application. It will be understood that each process and/or block in the flowchart illustrations and/or block diagrams, and combinations of processes and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the instructions executed by the processor of the computer or other programmable data processing device produce a use A device for realizing the functions specified in one process or multiple processes of the flowchart and/or one block or multiple blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory that causes a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction means, the instructions The device implements the functions specified in a process or processes of the flowchart and/or a block or blocks of the block diagram.

These computer program instructions may also be loaded onto a computer or other programmable data processing device, causing a series of operating steps to be performed on the computer or other programmable device to produce computer-implemented processing, thereby executing on the computer or other programmable device. Instructions provide steps for implementing the functions specified in a process or processes of a flowchart diagram and/or a block or blocks of a block diagram.

Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. In this way, if these modifications and variations of the present application fall within the scope of the claims of the present application and equivalent technologies, the present application is also intended to include these modifications and variations.

Claims (13)

1. An operation behavior recognition method, characterized by including:

   Obtain the text description information of the current operating behavior of the target object, and convert the text description information into an image to be recognized;

   Recognize the image to be identified through the trained abnormal behavior recognition model, and obtain a preliminary risk score of the current operating behavior in multiple dimensions;

   Based on the preliminary risk scores of the multiple dimensions, the risk judgment result of the current operating behavior is obtained.
2. The method of claim 1, wherein the text description information of the current operation behavior is obtained by the terminal device through the system application framework layer.
3. The method of claim 1, wherein the text description information includes occurrence time information and location information of the current operation behavior;

   Converting the text description information into an image to be recognized includes:

   Map the position information into a two-dimensional space to obtain the operation trajectory;

   Based on the occurrence time information, determine the color attribute of each trajectory point in the operation trajectory;

   The image to be recognized is obtained based on the operation trajectory and the color attribute of each trajectory point.
4. The method of claim 3, wherein the text description information also includes pressure information;

   After mapping the position information into the two-dimensional space and obtaining the operation trajectory, it also includes:

   Based on the pressure information, determine the size of each trajectory point in the operation trajectory;

   Determining the image to be recognized based on the operation trajectory and the color attribute of each trajectory point includes:

   The image to be recognized is determined based on the operation trajectory, the color attribute of each trajectory point, and the size of each trajectory point.
5. The method of claim 1, wherein the trained abnormal behavior recognition model includes a trained feature extractor and a trained linear decision model;

   The image to be identified is identified through the trained abnormal behavior recognition model, and a preliminary risk score of the multiple dimensions is obtained, including:

   Using the trained feature extractor, perform feature extraction on the image to be identified to obtain target image features;

   Through the trained linear decision model, the target image features are judged to obtain preliminary risk scores of the multiple dimensions.
6. The method of claim 5, wherein the trained abnormal behavior recognition model is trained in the following manner:

   Use a combination of neural network and unsupervised clustering to train the feature extractor to be trained to obtain an intermediate feature extractor;

   The intermediate feature extractor and the linear decision model to be trained are jointly fine-tuned and trained to obtain the trained feature extractor and the trained linear decision model.
7. The method of claim 6, wherein the feature extractor to be trained is trained using a combination of neural network and unsupervised clustering to obtain an intermediate feature extractor, including:

   Using a combination of neural network and unsupervised clustering, the feature extractor to be trained is iteratively trained based on the sample image set to obtain an intermediate feature extractor. Each iterative training process includes the following steps:

   Use the feature extractor to be trained to extract features from the sample image to obtain a feature set of the sample image;

   Cluster the sample image feature set to obtain multi-category sample image features and pseudo labels corresponding to each category of sample image features;

   Based on the obtained multi-category sample image features and the pseudo labels corresponding to each category of sample image features, the distribution loss value is determined, and the distribution loss value is used to adjust the parameters of the feature extractor to be trained through backpropagation.
8. The method according to any one of claims 1 to 7, wherein the preliminary risk scores in multiple dimensions include a first risk score and a second risk score, wherein the first risk score is used to characterize the current operation. Abnormal degree of behavior; the second risk score is used to characterize the target similarity between the current operating behavior and the historical operating behavior of the target object.
9. The method of claim 8, wherein obtaining the risk judgment result of the current operating behavior based on the preliminary risk scores of the multiple dimensions includes:

   Perform a weighted sum of the first risk score and the second risk score to obtain the target risk score of the current operating behavior;

   If the target risk score is greater than the preset threshold, the current operating behavior is determined to be a risky behavior;

   If the target risk score is less than or equal to the preset threshold, the current operation behavior is determined to be a safe behavior.
10. The method according to claim 9, characterized in that, if within the determination period, the number of times the operation behavior of the target object is determined to be a risky behavior is greater than the risk threshold, an alarm and a risk mark for the target object are triggered.
11. An operating behavior recognition device, characterized by including:

    An acquisition module, used to acquire the text description information of the current operating behavior of the target object, and convert the text description information into an image to be recognized;

    A processing module configured to identify the image to be identified through a trained abnormal behavior recognition model and obtain a preliminary risk score of the current operating behavior in multiple dimensions;

    The processing module is also configured to obtain the risk judgment result of the current operating behavior based on the preliminary risk scores of the multiple dimensions.
12. A computer device, including a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that when the processor executes the program, it implements any one of claims 1 to 10 Method steps.
13. A computer-readable storage medium, characterized in that it stores a computer program that can be executed by a computer device. When the program is run on the computer device, it causes the computer device to execute any one of claims 1 to 10. Method steps.

Images