CN112967134B

CN112967134B - Network training method, risk user identification method, device, equipment and medium

Info

Publication number: CN112967134B
Application number: CN202110545327.7A
Authority: CN
Inventors: 张翼; 温佳豪; 尤鸣宇; 韩煊
Original assignee: Beijing Qingsongchou Information Technology Co ltd
Current assignee: Beijing Easy Yikang Information Technology Co ltd
Priority date: 2021-05-19
Filing date: 2021-05-19
Publication date: 2021-09-21
Anticipated expiration: 2041-05-19
Also published as: CN112967134A

Abstract

The application provides a network training method, a risk user identification device, an electronic device and a storage medium, wherein the training method comprises the following steps: acquiring a plurality of pieces of low-risk user information; vector coding is carried out on the low-risk user information to obtain a plurality of low-risk user vectors; carrying out vector splicing and vector replacement on a plurality of low-risk user vectors to construct a first normal user matrix, a second normal user matrix and an abnormal user matrix; and training a preset pre-training network based on the first normal user matrix, the second normal user matrix and the abnormal user matrix until a loss function of the pre-training network reaches a preset convergence condition, so as to obtain a risk characteristic extraction network. According to the method, the abnormal user matrix with the high risk characteristics is constructed based on the low risk user information, so that the training sample set of the risk characteristic extraction network is constructed, the network training difficulty is reduced, and the network training accuracy is improved.

Description

Network training method, risk user identification method, device, equipment and medium

Technical Field

The present application relates to the field of data processing technologies, and in particular, to a network training method, a risk user identification method, an apparatus, an electronic device, and a storage medium.

Background

With the rapid development of internet technology, more and more financial services conduct online transactions through channels, but the online transactions are accompanied by online financial fraud risks, so that risk identification is used as an important guarantee means for the security of the online financial services, and is of great importance in online financial fraud crime prevention.

At present, a risk identification method mainly adopts a statistical model and a machine learning model to perform risk assessment, such as a support vector machine, a random forest, a gradient boosting decision tree, and the like. With the increasing computer power, deep learning networks are also applied to risk identification. The main purpose of risk identification is to identify high-risk users, so high-risk features of a large amount of high-risk user data need to be learned during network training. However, in practical application scenarios such as project fund crowd funding or loan application, a large number of users belong to low-risk users who pay money on time and pay money for a project loan on time, and high-risk users who may have fraud events are very few, so that network training is extremely difficult.

Disclosure of Invention

An embodiment of the application aims to provide a network training method, a risk user identification device, an electronic device and a storage medium, and aims to solve the problem that the current risk identification network training difficulty is high.

In a first aspect, an embodiment of the present application provides a network training method, including:

acquiring training sample information, wherein the training sample information comprises a plurality of pieces of low-risk user information;

vector coding is carried out on the low-risk user information to obtain a plurality of low-risk user vectors;

carrying out vector splicing and vector replacement on a plurality of low-risk user vectors to construct a first normal user matrix, a second normal user matrix and an abnormal user matrix;

and training a preset pre-training network based on the first normal user matrix, the second normal user matrix and the abnormal user matrix until a loss function of the pre-training network reaches a preset convergence condition, so as to obtain a risk characteristic extraction network.

In the embodiment, training sample information comprising a plurality of pieces of low-risk user information is obtained, vector coding is performed on the plurality of pieces of low-risk user information to obtain a plurality of low-risk user vectors, vector splicing and vector replacement are performed on the plurality of low-risk user vectors, a first normal user matrix, a second normal user matrix and an abnormal user matrix are constructed, and an abnormal user matrix with high-risk characteristics is constructed based on the low-risk user information, so that a training sample set of a risk characteristic extraction network is constructed, the network training difficulty is reduced, and the network training accuracy is improved; and finally, training a preset pre-training network based on the first normal user matrix, the second normal user matrix and the abnormal user matrix until the loss function of the pre-training network reaches a preset convergence condition to obtain a risk characteristic extraction network, thereby realizing network training.

In an embodiment, the low-risk user information includes numerical information and category information, and vector-coding the low-risk user information to obtain a plurality of low-risk user vectors includes:

for each low-risk user information, carrying out one-hot coding on the category type information to obtain a category vector;

if the numerical information is preset information, determining the value of the numerical information based on a preset numerical determination function to obtain a numerical vector;

and connecting the category vector with the numerical vector to obtain the low-risk user vector.

In an implementation manner, when the numerical information is preset information, the numerical information is valued, so that the pertinence to different service scenes is improved, and the user information under different service scenes is subjected to difference analysis.

In an embodiment, the vector splicing and vector replacement are performed on a plurality of low-risk user vectors, and a first normal user matrix, a second normal user matrix and an abnormal user matrix are constructed, including:

selecting a plurality of first user vectors from the low-risk user vectors, and performing vector splicing and vector replacement on the first user vectors to obtain a first normal user matrix and a second normal user matrix;

and replacing the preset numerical vectors with the numerical vectors in the second user vectors to obtain the abnormal user matrix, wherein the second user vectors are one or more first user vectors in the second normal user matrix.

In the implementation mode, a normal user matrix is constructed through vector splicing and vector replacement, and then the numerical vector in the second normal user matrix is replaced by the preset numerical vector, so that the normal numerical value of the low-risk user information is changed into an abnormal numerical value, the low-risk user information is changed into the high-risk user information, and the construction of the high-risk user matrix is realized.

Further, the number of the low-risk user vectors is M, a plurality of first user vectors are selected from the low-risk user vectors, vector splicing and vector replacement are performed on the first user vectors, and a first normal user matrix and a second normal user matrix are obtained, including:

selecting M first user vectors from the M low-risk user vectors, and carrying out vector splicing on the M first user vectors to obtain a first normal user matrix;

selecting 1 third user vector from M-M low-risk user vectors;

and replacing 1 first user vector in the first normal user matrix with a third user vector to obtain a second normal user matrix.

In the implementation mode, the first normal user matrix is constructed through vector splicing, the second normal user matrix is constructed through vector replacement, so that the risk characteristics of the low-risk user information and the risk characteristic difference between the low-risk user information and the high-risk user information can be conveniently learned through the network, and the learning precision of the network is improved.

In an embodiment, training a pre-training network based on a first normal user matrix, a second normal user matrix, and an abnormal user matrix until a loss function of the pre-training network reaches a preset convergence condition to obtain a risk feature extraction network includes:

extracting a first feature vector of a first normal user matrix, a second feature vector of a second normal user matrix and a third feature vector of an abnormal user matrix based on a pre-training network;

determining a first feature distance between the first feature vector and the second feature vector and a second feature distance between the first feature vector and the third feature vector;

determining a loss value of the loss function based on the first characteristic distance and the second characteristic distance;

and updating the network parameters of the pre-training network based on the loss value until the loss function reaches a preset convergence condition, so as to obtain the risk user extraction network.

In the implementation mode, the loss function is constructed through the characteristic distance, so that the risk characteristic extraction network is trained, and the problem of high difficulty in relevant network training is solved.

Further, the formula for the calculation of the loss function is:

where loss is the loss value of the loss function,

is the first characteristic distance, and is,

is the second characteristic distance, and is,

is a preset hyper-parameter.

In this embodiment, through a first feature distance between the low-risk user feature and a second feature distance between the low-risk user feature and the high-risk user feature, the network can learn feature information between different risk user features, and network training is achieved.

In a second aspect, an embodiment of the present application provides a method for identifying a risky user, including:

carrying out vector coding on target user information to be identified to obtain a target user vector;

constructing a reference matrix and a target matrix based on the target user vector and a plurality of preset user vectors, wherein the target matrix comprises the target user vector;

extracting a fourth feature vector of the reference matrix and a fifth feature vector of the target matrix based on a preset risk feature extraction network, wherein the risk feature extraction network is obtained by training based on the training method;

and determining the risk state of the target user information based on a third feature distance between the fourth feature vector and the fifth feature vector.

In the implementation, a reference matrix and a target matrix are constructed based on a target user vector and a plurality of preset user vectors, a fourth feature vector of the reference matrix and a fifth feature vector of the target matrix are extracted by using risk features obtained by training with the training method of the first aspect, and a risk state of target user information is determined based on a third feature distance between the fourth feature vector and the fifth feature vector, so that risk identification of the target user information is realized.

In an embodiment, the target user information includes category type information and numerical type information, and vector coding is performed on the target user information to be identified to obtain a target user vector, including:

for each target user information, carrying out one-hot coding on the category type information to obtain a category vector;

and connecting the category vector with the numerical vector to obtain a target user vector.

In the implementation manner, when the numerical information is preset information, the numerical information is valued, so that the pertinence to different service scenes is improved, and the user information under different service scenes is subjected to difference analysis.

In one embodiment, constructing the reference matrix and the target matrix based on the target user vector and a plurality of preset user vectors includes:

carrying out vector splicing on a plurality of preset user vectors to obtain a reference matrix;

and replacing one preset user vector in the reference matrix with a target user vector to obtain a target matrix.

In the implementation manner, one preset user vector in the reference matrix is replaced by the target user vector, so that the difference between the target matrix and the reference matrix is analyzed subsequently, and the risk state of the target user information is determined according to the difference.

In an embodiment, determining the risk status of the target user information based on the third feature distance between the fourth feature vector and the fifth feature vector includes:

calculating a third feature distance between the fourth feature vector and the fifth feature vector based on a preset distance function;

if the third characteristic distance is larger than a preset risk threshold value, determining that the risk state of the target user information is high risk;

and if the third characteristic distance is not larger than the preset risk threshold, determining that the risk state of the target user information is low risk.

In the implementation manner, risk identification of the target user information is realized based on the characteristic distance between the reference matrix and the target matrix.

Further, before determining the risk status of the target user information, the method further includes:

and extracting the hyperparameter and the convergence value of the loss function of the network according to the risk characteristics, and determining a preset risk threshold.

In the implementation mode, the preset risk threshold is associated with the hyperparameter and the convergence value of the loss function, so that the value of the preset risk threshold is more reasonable.

In a third aspect, an embodiment of the present application provides a network training apparatus, including:

the acquisition module is used for acquiring training sample information, and the training sample information comprises a plurality of pieces of low-risk user information;

the first coding module is used for carrying out vector coding on the low-risk user information to obtain a plurality of low-risk user vectors;

the first construction module is used for carrying out vector splicing and vector replacement on a plurality of low-risk user vectors to construct a first normal user matrix, a second normal user matrix and an abnormal user matrix;

and the training module is used for training a preset pre-training network based on the first normal user matrix, the second normal user matrix and the abnormal user matrix until a loss function of the pre-training network reaches a preset convergence condition, so as to obtain a risk feature extraction network.

In a fourth aspect, an embodiment of the present application provides an apparatus for identifying a risky user, including:

the second coding module is used for carrying out vector coding on target user information to be identified to obtain a target user vector;

the second construction module is used for constructing a reference matrix and a target matrix based on the target user vector and a plurality of preset user vectors, wherein the target matrix comprises the target user vector;

the extraction module is used for extracting a network based on preset risk characteristics, extracting a first characteristic vector of a reference matrix and a second characteristic vector of a target matrix, and obtaining the risk characteristic extraction network based on the training method;

and the determining module is used for determining the risk state of the target user information based on the characteristic distance between the first characteristic vector and the second characteristic vector.

In a fifth aspect, an embodiment of the present application provides an electronic device, which includes a memory and a processor, where the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to perform the network training method of the first aspect or the risky user identification method of the second aspect.

In a sixth aspect, an embodiment of the present application provides a computer-readable storage medium, which stores a computer program, and the computer program, when executed by a processor, implements the network training method of the first aspect or the risky user identification method of the second aspect.

It should be noted that, for the beneficial effects of the third aspect to the sixth aspect, reference is made to the description of the first aspect or the second aspect, and details are not repeated here.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings that are required to be used in the embodiments of the present application will be briefly described below, it should be understood that the following drawings only illustrate some embodiments of the present application and therefore should not be considered as limiting the scope, and that those skilled in the art can also obtain other related drawings based on the drawings without inventive efforts.

Fig. 1 is a schematic flow chart illustrating an implementation of a network training method according to an embodiment of the present application;

fig. 2 is a schematic diagram of a training process of a risk feature extraction network according to an embodiment of the present application;

fig. 3 is a schematic flow chart illustrating an implementation of a risk user identification method according to an embodiment of the present application;

fig. 4 is a schematic diagram of an identification process of a risky user according to an embodiment of the present application;

fig. 5 is a schematic structural diagram of a network training apparatus according to an embodiment of the present application;

fig. 6 is a schematic structural diagram of a risk user identification method according to an embodiment of the present application;

fig. 7 is a schematic structural diagram of an electronic device according to an embodiment of the present application.

Detailed Description

The technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application.

It should be noted that: like reference numbers and letters refer to like items in the following figures, and thus, once an item is defined in one figure, it need not be further defined and explained in subsequent figures. Meanwhile, in the description of the present application, the terms "first", "second", and the like are used only for distinguishing the description, and are not to be construed as indicating or implying relative importance.

As described in the related art, as computer computing power is increasing, deep learning networks are also applied to risk identification. The main purpose of risk identification is to identify high-risk users, so high-risk features of a large amount of high-risk user data need to be learned during network training. However, in practical application scenarios such as project fund crowd funding or loan application, a large number of users belong to low-risk users who pay money on time and pay money for a project loan on time, and high-risk users who may have fraud events are very few, so that network training is extremely difficult.

In order to solve the problems in the prior art, the application provides a network training method, which comprises the steps of obtaining training sample information comprising a plurality of pieces of low-risk user information, carrying out vector coding on the plurality of pieces of low-risk user information to obtain a plurality of low-risk user vectors, carrying out vector splicing and vector replacement on the plurality of low-risk user vectors, constructing a first normal user matrix, a second normal user matrix and an abnormal user matrix, constructing an abnormal user matrix with high-risk characteristics based on the low-risk user information, adding a sample of a high-risk user, constructing a training sample set of a risk characteristic extraction network, reducing the difficulty of network training and improving the accuracy of network training; and finally, training a preset pre-training network based on the first normal user matrix, the second normal user matrix and the abnormal user matrix until the loss function of the pre-training network reaches a preset convergence condition to obtain a risk characteristic extraction network, thereby realizing network training. Moreover, when the data for network training only comprises sample data of the low-risk user, the network training for high-risk user identification can be effectively realized, and the training process has effectiveness.

Referring to fig. 1, fig. 1 shows a flowchart of an implementation of a network training method provided in an embodiment of the present application. The network training method described in the embodiments of the present application may be applied to electronic devices, including but not limited to computer devices such as smart phones, tablet computers, desktop computers, supercomputers, personal digital assistants, physical servers, and cloud servers. The network training method of the embodiment of the application comprises steps S101 to S104, which are detailed as follows:

step S101, training sample information is obtained, wherein the training sample information comprises a plurality of pieces of low-risk user information.

In this step, the low-risk user information is user information with low risk of network behavior, for example, in practical application scenarios such as project fund crowd funding or loan application, a user who repays or repays project loan funds on time is a low-risk user. Illustratively, the low risk user information includes, but is not limited to, the user's occupation, education, payroll amount, bank card number, credit card amount of an up bill, and credit card amount of an up trade. It can be understood that, in different service scenarios, the specific information content of the low-risk user information is different, and the specific information content may be determined according to the service information of the actual service scenario, which is not limited herein.

And step S102, carrying out vector coding on the low-risk user information to obtain a plurality of low-risk user vectors.

In this step, vector encoding is a process of vectorizing information by a preset encoding technique. The low-risk user information may include category type information and numerical type information, wherein the information such as the occupation and education degree of the user is category type information, for example, the occupation of the user is a chef, and the education degree is a subject; the information such as the amount of payroll income and the number of bank cards is numerical information, for example, the amount of payroll income is 3000 yuan, and the number of bank cards is 3.

Optionally, the category-type information may be vector-coded in a unique hot coding manner, the numerical value information may be directly used as a vector, and the specific information of each piece of low-risk user information is vector-coded and then connected to obtain a low-risk user vector. It is understood that the type information may be vector-encoded by a tag encoding method, and the like, but is not limited thereto.

In an embodiment, the step S102 includes: for each low-risk user information, carrying out one-hot coding on the category type information to obtain a category vector; if the numerical information is preset information, determining the value of the numerical information based on a preset numerical determination function to obtain a numerical vector; and connecting the category vector with the numerical vector to obtain the low-risk user vector.

In this embodiment, there may be population variability due to numerical information, such as different payroll levels for different professional populations. Therefore, it is necessary to consider whether the numerical information has a certain population difference, and if the numerical information has a certain population difference, the numerical information is utilized

、

And the maximum value and the minimum value of the i items of information in the group corresponding to the target user in the training sample information are represented.

For example, in the vector encoding process, if the numerical information is preset information (for example, the numerical information is payroll information), the numerical information has population diversity, and thus the numerical information has population diversity

、

The maximum value and the minimum value of the amount of payroll income which is the same as the occupation of the target user in the training sample information. If the numerical information is preset information (for example, the numerical information is the number of bank cards), the information has no group difference, so that the information has no group difference

、

And the maximum value and the minimum value of the number of the bank cards in the training sample information are represented.

Illustratively, the numerical determination function may be:

wherein the content of the first and second substances,

is the value of numerical information. Alternatively,

。

and S103, carrying out vector splicing and vector replacement on the low-risk user vectors to construct a first normal user matrix, a second normal user matrix and an abnormal user matrix.

In this step, vector stitching is a process of connecting a plurality of vectors into one matrix, and a certain vector or some vectors are replaced with other vectors. The first normal user matrix is a matrix constructed after vector splicing is carried out on the basis of the low-risk user vector, so that the first normal user matrix is a low-risk user matrix and is used as a basis for subsequent comparison with other matrices; the second normal user matrix is obtained after vector replacement is carried out on the basis of the first normal user matrix and can be used for comparing with the first normal user matrix subsequently, so that the network can learn the characteristic difference between the low-risk user matrices, and the network can identify the low-risk user information; the abnormal user matrix is a matrix obtained after vector replacement is performed on the basis of the second normal user matrix, specifically, a vector in the second normal user matrix is a preset abnormal vector, so that the second normal user matrix is changed into an abnormal user matrix with abnormal information, and the abnormal user matrix can be used for comparison with the first normal user matrix subsequently, so that a network can learn characteristic differences between the low-risk user matrix and the high-risk user matrix, and the network can recognize the high-risk user information.

Optionally, vector splicing and vector replacement are performed on the multiple low-risk user vectors to obtain a first normal user matrix and a second normal user matrix, and one or more vectors in the first normal user matrix or the second normal user matrix are replaced by abnormal vectors to obtain an abnormal user matrix. It can be understood that the first normal user matrix and the second normal user matrix both include low-risk user vectors corresponding to a plurality of user information, and when vector replacement is performed, one or more low-risk user vectors may be replaced with abnormal vectors, one or more numerical vectors in one low-risk user vector may also be replaced with abnormal vectors, and one or more numerical vectors in a plurality of low-risk user vectors may also be replaced with abnormal vectors.

In an embodiment, the step S103 includes: selecting a plurality of first user vectors from the low-risk user vectors, and performing vector splicing and vector replacement on the first user vectors to obtain a first normal user matrix and a second normal user matrix; and replacing the preset numerical vectors with the numerical vectors in the second user vectors to obtain the abnormal user matrix, wherein the second user vectors are one or more first user vectors in the second normal user matrix.

In this embodiment, vector splicing is performed based on a plurality of first user vectors to obtain a first normal user matrix, and one or more low-risk user vectors other than the first user vectors are used to replace the corresponding number of first user vectors in the first normal user matrix to obtain a second normal user matrix. It can be understood that, for the step of selecting a plurality of first user vectors from a plurality of low-risk user vectors, the step may be performed a plurality of times, and the first user vectors selected each time are different, so as to obtain a plurality of first normal user matrices, thereby performing vector replacement to obtain a plurality of second normal user matrices and abnormal user matrices, so as to achieve the purpose of increasing the number of training samples.

Further, M first user vectors are selected from the M low-risk user vectors, and the M first user vectors are subjected to vector splicing to obtain a first normal user matrix; selecting 1 third user vector from M-M low-risk user vectors; and replacing 1 first user vector in the first normal user matrix with a third user vector to obtain a second normal user matrix.

Exemplarily, the M low-risk user information for training are encoded and processed as described above to obtain M first user vectors

And n represents a vector length. Vector a plurality of first users

Splicing and adopting different processing modes to obtain a group of training data for training, wherein each group of data comprises three first normal user matrixes with the size of M multiplied by n (M first user vectors are selected from the M first user vectors, the M first user vectors form a matrix, M represents the number of vectors in the matrix, and n represents the length of the vectors in the matrix)

Second normal user matrix

And abnormal user matrix

. Wherein the first normal user matrix

The method is obtained by randomly extracting M low-risk user vectors during each training and splicing, and a first normal user matrix can be expressed as:

second normal user matrix

Is the first normal user matrix

The vector replacement is carried out to obtain the vector, and one of the other M-M low-risk user vectors is randomly selected

By using

In that

M first user vectors of

In randomly selecting a first user vector

Make a replacement, k tableThe kth of the M-M low-risk user vectors is shown. If randomly selected

The second first user vector of (1), then

Expressed as:

optionally, one numerical vector in the second user vector may replace the corresponding preset numerical vector to obtain an abnormal user matrix; or replacing a plurality of numerical vectors in the second user vector with preset numerical vectors to obtain an abnormal user matrix.

Illustratively, an abnormal user matrix

For the second normal user matrix

Second user vector in

Is obtained after exception handling, specifically selecting

At least one value vector, and setting the value corresponding to the value vector as the value

，

The information of the type in (1) is not changed. After exception handling

Indicating, then abnormal user matrix

Expressed as:

and step S104, training a preset pre-training network based on the first normal user matrix, the second normal user matrix and the abnormal user matrix until a loss function of the pre-training network reaches a preset convergence condition, and obtaining a risk feature extraction network.

In this embodiment, the pre-training network may be a convolutional neural network, such as a neural network structure like VGG, ResNet, or DenseNet. And (3) obtaining a pre-training network by using the network parameters trained in the large data set by the convolutional neural network. Alternatively, the convolutional neural network does not require a fully connected layer, and only the parameters on the first channel of the convolutional kernel are needed in the first layer convolutional layer, so that the eigenvector of the user matrix can be obtained using the pre-training network.

And training the pre-training network by using the first normal user matrix, the second normal user matrix and the abnormal user matrix until the pre-training network reaches a preset convergence condition, thereby obtaining a risk characteristic extraction network. The preset convergence condition is a condition indicating that the model training is completed, for example, if a loss value (expected error) obtained by the loss function is smaller than a preset loss threshold, convergence is indicated, or the number of network iterations reaches a preset number. It can be understood colloquially that a smaller loss value indicates a more accurate feature vector is extracted by the model. Exemplarily, a first normal user matrix, a second normal user matrix and an abnormal user matrix are input into a pre-training network for processing, and a risk feature vector is output; calculating loss values between the risk feature vector and a first normal user matrix, a second normal user matrix or an abnormal user matrix, adjusting network parameters in a pre-training network when the loss values are greater than or equal to a preset loss threshold value, returning to execute the steps of inputting the first normal user matrix, the second normal user matrix and the abnormal user matrix into the pre-training network for processing and outputting the risk feature vector; and when the loss value is smaller than the preset loss threshold value, representing that the training of the pre-training network is finished, and obtaining the trained risk feature extraction network.

Referring to fig. 2, fig. 2 is a schematic diagram illustrating a training process of the risk feature extraction network provided in the present embodiment. On the basis of the embodiment shown in fig. 1, the step S104 includes: extracting a first feature vector of a first normal user matrix, a second feature vector of a second normal user matrix and a third feature vector of an abnormal user matrix based on a pre-training network; determining a first feature distance between the first feature vector and the second feature vector and a second feature distance between the first feature vector and the third feature vector; determining a loss value of the loss function based on the first characteristic distance and the second characteristic distance; and updating the network parameters of the pre-training network based on the loss value until the loss function reaches a preset convergence condition, so as to obtain the risk user extraction network.

In this embodiment, a set of data is obtained

And

then, will

And

inputting a pre-training network to obtain

And

respective first feature vector

The second feature vector

And a third feature vector

. Optionally, training is performed on the basis of a pre-training network, and a triplet loss is used as a loss function, and a calculation formula of the loss function is as follows:

where loss is the loss value of the loss function,

is the first characteristic distance, and is,

is the second characteristic distance, and is,

is a preset hyper-parameter.

Optionally, the first feature distance and the second feature distance may be calculated by using functions such as an L1 norm, an L2 norm, or cosine similarity. When the network is trained to a preset iteration number or the loss value of the loss function is reduced to a convergence value

And then completing the training process to obtain a risk feature extraction network.

Referring to fig. 3, fig. 3 is a flowchart illustrating an implementation of a risk user identification method according to an embodiment of the present application. The risk user identification method described in the embodiments of the present application may be applied to electronic devices, including but not limited to computer devices such as smart phones, tablet computers, desktop computers, supercomputers, personal digital assistants, physical servers, and cloud servers. The method for identifying the risk user in the embodiment of the application comprises the following steps S301 to S304:

step S301, vector coding is carried out on target user information to be identified, and a target user vector is obtained.

In this step, the target user information is user information that needs risk identification in an actual application scenario. Optionally, for each target user information, performing one-hot coding on the category type information to obtain a category vector; if the numerical information is preset information, determining the value of the numerical information based on a preset numerical determination function to obtain a numerical vector; and connecting the category vector with the numerical vector to obtain a target user vector.

It is understood that the step description of step S301 can refer to the related description of step S102. In addition, in this embodiment, if the value of the numerical information is greater than 1, the value of the numerical information is set to 1, and if the value of the numerical information is less than 0, the value is set to zero. After processing various numerical information, connecting the category vector and the numerical vector of the target user information according to a certain sequence to obtain a row vector after the target user information is coded

。

Step S302, a reference matrix and a target matrix are constructed based on the target user vector and a plurality of preset user vectors, wherein the target matrix comprises the target user vector.

In this step, the preset user vector is a low-risk user vector, and may be a low-risk user vector obtained by training sample information during network extraction for training risk features. The reference matrix is obtained by constructing a low-risk user vector and is used as a reference factor of the low-risk characteristic; the target matrix is a matrix containing target user vectors.

Optionally, vector splicing is performed on a plurality of preset user vectors to obtain a reference matrix; and replacing one preset user vector in the reference matrix with a target user vector to obtain a target matrix. It is understood that the description of the step of building the matrix in step S302 may refer to the related description of step S103, and will not be described herein again.

Step S303, extracting a network based on the preset risk characteristics, and extracting a fourth characteristic vector of the reference matrix and a fifth characteristic vector of the target matrix, wherein the network for extracting the risk characteristics is obtained by training based on the training method.

In this step, the description of the step of extracting the features in step S303 may refer to the related description of step S104, and will not be described herein again.

Step S304, determining the risk state of the target user information based on the third characteristic distance between the fourth characteristic vector and the fifth characteristic vector.

In this step, the risk status includes high risk and low risk. The third characteristic distance is calculated by adopting functions of L1 norm, L2 norm or cosine similarity and the like. It should be understood that the calculated function of the third feature distance should be consistent with the calculated functions of the first and second feature distances.

According to the risk user identification method, a reference matrix and a target matrix are constructed based on a target user vector and a plurality of preset user vectors, a fourth feature vector of the reference matrix and a fifth feature vector of the target matrix are extracted by utilizing risk features obtained through training by the network training method, and a risk state of target user information is determined based on a third feature distance between the fourth feature vector and the fifth feature vector, so that risk identification of the target user information is realized. In addition, network training is often difficult when a large portion of the data used for network training is low-risk user data. In the risk user identification method, the network training method is used for network training, so that the risk user identification method can still be effectively used for risk identification under the condition that data used for network training only comprise sample data of low-risk users, and the effectiveness of risk identification is improved.

As shown in fig. 4, fig. 4 is a schematic diagram illustrating a process of identifying target user information provided in an embodiment of the present application. On the basis of the embodiment shown in fig. 3, the step S304 includes: calculating a third feature distance between the fourth feature vector and the fifth feature vector based on a preset distance function; if the third characteristic distance is larger than a preset risk threshold value, determining that the risk state of the target user information is high risk; and if the third characteristic distance is not larger than the preset risk threshold, determining that the risk state of the target user information is low risk.

In this embodiment, m pieces of low-risk user information and 1 piece of target user information to be identified are randomly extracted from training sample information. Splicing the low-risk user vectors of the m pieces of low-risk user information to obtain a reference matrix with the size of mxn

(ii) a Randomly selecting one vector from m low-risk user vectors of the reference matrix, and replacing the selected vector by using a target user vector to be identified to obtain a target matrix with the size of m multiplied by n

If the second low-risk user vector is randomly selected from the reference matrix, the matrix

. Reference matrix

And an object matrix

Respectively inputting the trained risk feature extraction networks to obtain corresponding fourth feature vectors

And a fifth feature vector

Calculating a fourth feature vector

And a fifth feature vector

A third characteristic distance therebetween. If the third characteristic distance

If the risk is greater than the set risk threshold, the target user is judged to be a high-risk user; if the third characteristic distance

And if the risk is smaller than the set risk threshold, the target user is judged to be a low-risk user.

Optionally, extracting a hyperparameter and a convergence value of a loss function of the network according to the risk features, and determining a preset risk threshold:

；

wherein

In order to pre-set the risk threshold value,

for the hyper-parameter of the loss function,

for the convergence value of the loss function,

defaults to 1.

The value of (a) can be changed according to the severity of the recognition. Illustratively, if it is desired that the detection be as stringent as possible, and the recall rate for high-risk user identification be as high as possible, then one may be looking at the detection as stringent as possible

Is set as

。

In order to implement the network training method corresponding to the above method embodiment to achieve corresponding functions and technical effects, a network training apparatus is provided below. Referring to fig. 5, fig. 5 is a block diagram of a network training apparatus according to an embodiment of the present disclosure. For convenience of explanation, only a part related to the present embodiment is shown, and the network training apparatus provided in the embodiment of the present application includes:

an obtaining module 501, configured to obtain training sample information, where the training sample information includes information of multiple low-risk users;

a first encoding module 502, configured to perform vector encoding on multiple pieces of low-risk user information to obtain multiple low-risk user vectors;

a first constructing module 503, configured to perform vector splicing and vector replacement on the multiple low-risk user vectors, and construct a first normal user matrix, a second normal user matrix, and an abnormal user matrix;

the training module 504 is configured to train a preset pre-training network based on the first normal user matrix, the second normal user matrix, and the abnormal user matrix until a loss function of the pre-training network reaches a preset convergence condition, so as to obtain a risk feature extraction network.

In one embodiment, the low-risk user information includes numerical type information and classification type information, and the first encoding module 502 includes:

the first coding unit is used for carrying out one-hot coding on the category type information to obtain a category vector for each piece of low-risk user information;

the first determining unit is used for determining the value of the numerical information based on a preset numerical determination function to obtain a numerical vector if the numerical information is preset information;

and the first connecting unit is used for connecting the category vector with the numerical vector to obtain a low-risk user vector.

In one embodiment, the first building block 503 includes:

the first splicing unit is used for selecting a plurality of first user vectors from the low-risk user vectors, and carrying out vector splicing and vector replacement on the first user vectors to obtain a first normal user matrix and a second normal user matrix;

and the first replacing unit is used for replacing the numerical vectors in the second user vectors with preset numerical vectors to obtain the abnormal user matrix, wherein the second user vectors are one or more first user vectors in the second normal user matrix.

Further, the number of the low risk user vectors is M, and the splicing unit includes:

the splicing subunit is used for selecting M first user vectors from the M low-risk user vectors, and performing vector splicing on the M first user vectors to obtain a first normal user matrix;

the selecting subunit is used for selecting 1 third user vector from the M-M low-risk user vectors;

and the replacing subunit is used for replacing 1 first user vector in the first normal user matrix with a third user vector to obtain a second normal user matrix.

In one embodiment, the training module 504 includes:

the extraction unit is used for extracting a first feature vector of the first normal user matrix, a second feature vector of the second normal user matrix and a third feature vector of the abnormal user matrix based on the pre-training network;

a second determining unit, configured to determine a first feature distance between the first feature vector and the second feature vector, and a second feature distance between the first feature vector and the third feature vector;

a third determining unit configured to determine a loss value of the loss function based on the first characteristic distance and the second characteristic distance;

and the updating unit is used for updating the network parameters of the pre-training network based on the loss value until the loss function reaches a preset convergence condition, so as to obtain the risk user extraction network.

Further, the formula for the calculation of the loss function is:

where loss is the loss value of the loss function,

is the first characteristic distance, and is,

is the second characteristic distance, and is,

is a preset hyper-parameter.

The network training device can implement the network training method of the method embodiment. The alternatives in the above-described method embodiments are also applicable to this embodiment and will not be described in detail here. The rest of the embodiments of the present application may refer to the contents of the above method embodiments, and in this embodiment, details are not described again.

In order to implement the method for identifying a risky user corresponding to the above method embodiment to achieve corresponding functions and technical effects, a device for identifying a risky user is provided below. Referring to fig. 6, fig. 6 is a block diagram of a risky user identification apparatus according to an embodiment of the present application. For convenience of explanation, only the parts related to the present embodiment are shown, and the risk user identification apparatus provided in the embodiment of the present application includes:

the second encoding module 601 is configured to perform vector encoding on target user information to be identified to obtain a target user vector;

a second constructing module 602, configured to construct a reference matrix and a target matrix based on a target user vector and a plurality of preset user vectors, where the target matrix includes the target user vector;

an extraction module 603, configured to extract a network based on a preset risk feature, and extract a first feature vector of a reference matrix and a second feature vector of a target matrix, where the risk feature extraction network is obtained by training based on the training method;

a determining module 604, configured to determine a risk status of the target user information based on a feature distance between the first feature vector and the second feature vector.

In one embodiment, the target user information includes a type information and a value information, and the second encoding module 601 includes:

the second coding unit is used for carrying out one-hot coding on the category type information to obtain a category vector for each target user information;

a fourth determining unit, configured to determine, based on a preset numerical value determining function, a value of the numerical value information to obtain a numerical value vector if the numerical value information is preset information;

and the second connecting unit is used for connecting the category vector with the numerical vector to obtain a target user vector.

In an embodiment, the second building block 602 includes:

the second splicing unit is used for carrying out vector splicing on a plurality of preset user vectors to obtain a reference matrix;

and the second replacing unit is used for replacing one preset user vector in the reference matrix with the target user vector to obtain the target matrix.

In one embodiment, the determining module 604 includes:

the calculating unit is used for calculating a third characteristic distance between the fourth characteristic vector and the fifth characteristic vector based on a preset distance function;

a fifth determining unit, configured to determine that the risk state of the target user information is a high risk if the third feature distance is greater than a preset risk threshold;

and the sixth determining unit is used for determining that the risk state of the target user information is low risk if the third characteristic distance is not greater than the preset risk threshold.

Further, the above-mentioned risky user identification apparatus further includes:

and the second determining module is used for extracting the hyperparameter and the convergence value of the loss function of the network according to the risk characteristics and determining the preset risk threshold.

The risk user identification device can implement the risk user identification method of the method embodiment. The alternatives in the above-described method embodiments are also applicable to this embodiment and will not be described in detail here. The rest of the embodiments of the present application may refer to the contents of the above method embodiments, and in this embodiment, details are not described again.

Fig. 7 is a schematic structural diagram of an electronic device according to an embodiment of the present application. As shown in fig. 7, the electronic apparatus 7 of this embodiment includes: at least one processor 70 (only one shown in fig. 7), a memory 71, and a computer program 72 stored in the memory 71 and executable on the at least one processor 70, the processor 70 implementing the steps of any of the method embodiments described above when executing the computer program 72.

The electronic device 7 may be a computing device such as a smart phone, a tablet computer, a desktop computer, a supercomputer, a personal digital assistant, a physical server, and a cloud server. The electronic device may include, but is not limited to, a processor 70, a memory 71. Those skilled in the art will appreciate that fig. 7 is merely an example of the electronic device 7, and does not constitute a limitation of the electronic device 7, and may include more or less components than those shown, or combine some of the components, or different components, such as an input-output device, a network access device, etc.

The Processor 70 may be a Central Processing Unit (CPU), and the Processor 70 may be other general purpose Processor, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), an off-the-shelf Programmable Gate Array (FPGA) or other Programmable logic device, discrete Gate or transistor logic, discrete hardware components, etc. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

The memory 71 may in some embodiments be an internal storage unit of the electronic device 7, such as a hard disk or a memory of the electronic device 7. The memory 71 may also be an external storage device of the electronic device 7 in other embodiments, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash memory Card (Flash Card), and the like, which are provided on the electronic device 7. Further, the memory 71 may also include both an internal storage unit and an external storage device of the electronic device 7. The memory 71 is used for storing an operating system, an application program, a Boot Loader (Boot Loader), data, and other programs, such as program codes of the computer programs. The memory 71 may also be used to temporarily store data that has been output or is to be output.

In addition, an embodiment of the present application further provides a computer-readable storage medium, where a computer program is stored, and when the computer program is executed by a processor, the computer program implements the steps in any of the method embodiments described above.

The embodiments of the present application provide a computer program product, which when running on an electronic device, enables the electronic device to implement the steps in the above method embodiments when executed.

In the embodiments provided in the present application, it should be understood that the disclosed apparatus and method can be implemented in other ways. The apparatus embodiments described above are merely illustrative, and for example, the flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods and computer program products according to various embodiments of the present application. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

In addition, functional modules in the embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

The functions, if implemented in the form of software functional modules and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present application or portions thereof that substantially contribute to the prior art may be embodied in the form of a software product stored in a storage medium and including instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing program codes.

The above description is only an example of the present application and is not intended to limit the scope of the present application, and various modifications and changes may be made by those skilled in the art. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application shall be included in the protection scope of the present application. It should be noted that: like reference numbers and letters refer to like items in the following figures, and thus, once an item is defined in one figure, it need not be further defined and explained in subsequent figures.

The above description is only for the specific embodiments of the present application, but the scope of the present application is not limited thereto, and any person skilled in the art can easily conceive of the changes or substitutions within the technical scope of the present application, and shall be covered by the scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

It is noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.

Claims

1. A method of network training, comprising:

carrying out vector splicing and vector replacement on the low-risk user vectors to construct a first normal user matrix, a second normal user matrix and an abnormal user matrix;

training a preset pre-training network based on the first normal user matrix, the second normal user matrix and the abnormal user matrix until a loss function of the pre-training network reaches a preset convergence condition to obtain a risk feature extraction network;

wherein the vector splicing and vector replacement are performed on the low-risk user vectors to construct a first normal user matrix, a second normal user matrix and an abnormal user matrix, and the method comprises the following steps:

and replacing a preset numerical vector with a numerical vector in a second user vector to obtain the abnormal user matrix, wherein the second user vector is one or more first user vectors in the second normal user matrix.

2. The method of claim 1, wherein the low-risk user information comprises numerical information and classification information, and the vector-coding the low-risk user information to obtain a plurality of low-risk user vectors comprises:

3. The network training method according to claim 1, wherein the number of the low-risk user vectors is M, and the selecting a plurality of first user vectors from the low-risk user vectors, performing vector splicing and vector replacement on the first user vectors to obtain the first normal user matrix and the second normal user matrix comprises:

selecting 1 third user vector from the M-M low-risk user vectors;

and replacing 1 first user vector in the first normal user matrix with the third user vector to obtain the second normal user matrix.

4. The network training method according to claim 1, wherein the training a pre-training network based on the first normal user matrix, the second normal user matrix, and the abnormal user matrix until a loss function of the pre-training network reaches a preset convergence condition to obtain a risk feature extraction network comprises:

extracting a first feature vector of the first normal user matrix, a second feature vector of the second normal user matrix and a third feature vector of the abnormal user matrix based on the pre-training network;

determining a first feature distance between the first feature vector and the second feature vector, and a second feature distance between the first feature vector and the third feature vector;

and updating the network parameters of the pre-training network based on the loss value until the loss function reaches the preset convergence condition, so as to obtain the risk user extraction network.

5. The network training method of claim 4, wherein the loss function is calculated by the formula:

wherein

Is the loss value of the loss function,

is the first characteristic distance, and is,

is the second characteristic distance, and is,

is a preset hyper-parameter.

6. A method for identifying an at-risk user, comprising:

constructing a reference matrix and a target matrix based on the target user vector and a plurality of preset user vectors, wherein the target matrix comprises the target user vector, and the preset user vectors are low-risk user vectors;

extracting a fourth feature vector of the reference matrix and a fifth feature vector of the target matrix based on a preset risk feature extraction network, wherein the risk feature extraction network is obtained by training based on the training method of claim 1;

determining a risk status of the target user information based on a third feature distance between the fourth feature vector and the fifth feature vector;

wherein the constructing a reference matrix and a target matrix based on the target user vector and a plurality of preset user vectors comprises:

carrying out vector splicing on the preset user vectors to obtain the reference matrix;

replacing one preset user vector in the reference matrix with the target user vector to obtain the target matrix.

7. The method for identifying a risky user according to claim 6, wherein the target user information includes category type information and numerical type information, and the vector encoding of the target user information to be identified to obtain a target user vector comprises:

and connecting the category vector with the numerical vector to obtain the target user vector.

8. The method of claim 6, wherein the determining the risk status of the target user information based on a third feature distance between the fourth feature vector and the fifth feature vector comprises:

if the third characteristic distance is larger than a preset risk threshold, determining that the risk state of the target user information is a high risk;

and if the third characteristic distance is not greater than the preset risk threshold, determining that the risk state of the target user information is low risk.

9. The method of claim 8, wherein before determining the risk status of the target user information, the method further comprises:

and extracting the hyperparameter and the convergence value of the loss function of the network according to the risk characteristics, and determining the preset risk threshold.

10. A network training apparatus, comprising:

the first construction module is used for carrying out vector splicing and vector replacement on the low-risk user vectors to construct a first normal user matrix, a second normal user matrix and an abnormal user matrix;

the training module is used for training a preset pre-training network based on the first normal user matrix, the second normal user matrix and the abnormal user matrix until a loss function of the pre-training network reaches a preset convergence condition, so as to obtain a risk feature extraction network;

the first building module specifically comprises:

and the first replacing unit is used for replacing a preset numerical vector with a numerical vector in a second user vector to obtain the abnormal user matrix, wherein the second user vector is one or more first user vectors in the second normal user matrix.

11. An apparatus for identifying an at-risk user, comprising:

a second construction module, configured to construct a reference matrix and a target matrix based on the target user vector and a plurality of preset user vectors, where the target matrix includes the target user vector, and the preset user vectors include low-risk user vectors;

an extraction module, configured to extract a first feature vector of the reference matrix and a second feature vector of the target matrix based on a preset risk feature extraction network, where the risk feature extraction network is obtained by training based on the training method according to claim 1;

a determining module, configured to determine a risk state of the target user information based on a feature distance between the first feature vector and the second feature vector;

wherein the second building block comprises:

the second splicing unit is used for carrying out vector splicing on the preset user vectors to obtain the reference matrix;

12. An electronic device, comprising a memory for storing a computer program and a processor for executing the computer program to cause the electronic device to perform the network training method according to any one of claims 1 to 5 or the at risk user identification method according to any one of claims 6 to 9.

13. A computer-readable storage medium, characterized in that it stores a computer program which, when executed by a processor, implements the network training method of any one of claims 1 to 5, or the risky user identification method of any one of claims 6 to 9.