技术领域Technical field
本申请实施例涉及计算机技术领域，尤其涉及一种模型训练方法、异常信息检测方法及装置。The embodiments of the present application relate to the field of computer technology, and in particular, to a model training method, anomaly information detection method and device.
背景技术Background technique
金融场景下的异常检测，主要包括识别金融网络下的注册用户为正常用户还是异常用户。在此场景下，可以获得用户的基本信息、交易记录以及用户之间的关联信息等，如何通过用户的交易记录以及用户之间的关联信息来判断用户是否异常是至关重要。Anomaly detection in financial scenarios mainly includes identifying whether registered users under the financial network are normal users or abnormal users. In this scenario, the user's basic information, transaction records, and related information between users can be obtained. How to determine whether the user is abnormal through the user's transaction records and related information between users is crucial.
相关技术下，通常是使用已知标签的样本用户数据作为模型学习的输入数据，输入数据分为训练集和测试集，训练集均为已经带有标注的样本用户数据，用于建立模型发现规律；测试集是将已经带有标注的样本用户数据的标签隐藏后，再将测试集数据输入模型，比较结果和标签，从而评估模型的学习能力。训练结束后，采用训练好的模型预测用户是否异常。In related technologies, sample user data with known labels are usually used as input data for model learning. The input data is divided into training sets and test sets. The training sets are all labeled sample user data, which is used to establish model discovery rules. ; The test set is to hide the labels of the sample user data that have been labeled, and then input the test set data into the model, and compare the results and labels to evaluate the learning ability of the model. After training, the trained model is used to predict whether the user is abnormal.
然而，在实际应用中，金融网络往往是一种图网络结构，采用上述模型训练方法获得的模型难以捕捉到图网络结构中异常用户节点的结构，从而导致异常检测结果的准确性较低。However, in practical applications, financial networks are often a graph network structure, and the model obtained using the above model training method is difficult to capture the structure of abnormal user nodes in the graph network structure, resulting in low accuracy of anomaly detection results.
发明内容Contents of the invention
本申请实施例提供了一种模型训练方法、异常信息检测方法及装置，实现了有效捕捉图网络结构中异常用户节点的结构，提高了异常检测结果的准确性。Embodiments of the present application provide a model training method, anomaly information detection method and device, which realize the structure of effectively capturing abnormal user nodes in the graph network structure and improve the accuracy of anomaly detection results.
第一方面，本申请实施例提供了一种模型训练方法，包括：In the first aspect, embodiments of the present application provide a model training method, including:
获取样本数据集；Get sample data set;
采用所述样本数据集迭代执行异常检测任务和图预训练任务，并在每次迭代过程中，获得所述异常检测任务和所述图预训练任务之间的一致性指标，并基于所述一致性指标调整用于执行所述异常检测任务的异常检测模型的模型参数；The sample data set is used to iteratively execute the anomaly detection task and the graph pre-training task, and in each iteration process, the consistency index between the anomaly detection task and the graph pre-training task is obtained, and based on the consistency The performance index adjusts the model parameters of the anomaly detection model used to perform the anomaly detection task;
在所述一致性指标满足预设条件时停止迭代，获得初步训练的异常检测模型；Stop iteration when the consistency index meets the preset conditions to obtain a preliminary trained anomaly detection model;
对所述初步训练的异常检测模型和初始化的分类器进行微调训练，获得目标异常检测模型和目标分类器。Fine-tune the initially trained anomaly detection model and initialized classifier to obtain a target anomaly detection model and a target classifier.
本申请实施例中，通过采用样本数据集迭代执行异常检测任务和图预训练任务，并在每次迭代过程中，获得异常检测任务和图预训练任务之间的一致性指标，再基于一致性指标调整用于执行异常检测任务的异常检测模型的模型参数，得到初步训练的异常检测模型，使得异常检测任务从图预训练任务中获益，故进一步对初步训练的异常检测模型和初始化的分类器进行微调训练，获得目标异常检测模型和目标分类器时，目标异常检测模型和目标分类器能够有效识别图网络结构中异常节点的结构，准确分辨正常用户和异常用户，有效提高了异常检测结果的准确性。In the embodiment of this application, the anomaly detection task and the graph pre-training task are iteratively executed by using the sample data set, and in each iteration process, the consistency index between the anomaly detection task and the graph pre-training task is obtained, and then based on the consistency The index adjusts the model parameters of the anomaly detection model used to perform the anomaly detection task to obtain the initially trained anomaly detection model, so that the anomaly detection task benefits from the graph pre-training task, so the classification of the initially trained anomaly detection model and initialization is further When the machine is fine-tuned and trained to obtain the target anomaly detection model and target classifier, the target anomaly detection model and target classifier can effectively identify the structure of abnormal nodes in the graph network structure, accurately distinguish between normal users and abnormal users, and effectively improve the anomaly detection results. accuracy.
一种可选实施方式中，所述在每次迭代过程中，获得所述异常检测任务和所述图预训练任务之间的一致性指标，包括：In an optional implementation, obtaining the consistency index between the anomaly detection task and the graph pre-training task during each iteration includes:
在每次迭代过程中，获取执行所述异常检测任务获得的多个用户节点对的第一标签分布；以及，执行所述图预训练任务获得的多个用户节点对的第二标签分布；In each iteration process, obtain the first label distribution of multiple user node pairs obtained by executing the anomaly detection task; and, obtain the second label distribution of the multiple user node pairs obtained by executing the graph pre-training task;
基于所述第一标签分布和所述第二标签分布之间的差异，获得所述异常检测任务和所述图预训练任务之间的一致性指标。Based on the difference between the first label distribution and the second label distribution, a consistency index between the anomaly detection task and the graph pre-training task is obtained.
一种可选实施方式中，所述一致性指标满足预设条件指：所述第一标签分布和所述第二标签分布之间的差异达到最小值。In an optional implementation, the consistency index satisfying the preset condition means that the difference between the first label distribution and the second label distribution reaches a minimum value.
上述实施方式下，通过迭代使得异常检测任务的第一标签分布和图预训练任务的第二标签分布之间的差异达到最小值，能够使异常检测任务从图预训练任务中获得增益，更加准确识别出异常用户和正常用户节点结构差异，进而提高异常检测模型的检测准确性。In the above embodiment, the difference between the first label distribution of the anomaly detection task and the second label distribution of the graph pre-training task is minimized through iteration, so that the anomaly detection task can gain from the graph pre-training task and be more accurate. The difference in node structure between abnormal users and normal users is identified, thereby improving the detection accuracy of the anomaly detection model.
一种可选实施方式中，所述对所述初步训练的异常检测模型和初始化的分类器进行微调训练，获得目标异常检测模型和目标分类器，包括：In an optional implementation, the fine-tuning training is performed on the initially trained anomaly detection model and the initialized classifier to obtain the target anomaly detection model and the target classifier, including:
采用所述初步训练的异常检测模型，对不包含标签的候选样本进行标签预测，获得所述候选样本对应异常用户标签的置信度；Using the initially trained anomaly detection model, perform label prediction on candidate samples that do not contain labels, and obtain the confidence of the abnormal user labels corresponding to the candidate samples;
将置信度大于第一阈值的候选样本添加至所述样本数据集，获得扩充样本集；Add candidate samples with confidence greater than the first threshold to the sample data set to obtain an expanded sample set;
采用所述扩充样本集对所述初步训练的异常检测模型和初始化的分类器进行微调训练，获得目标异常检测模型和目标分类器。The expanded sample set is used to perform fine-tuning training on the initially trained anomaly detection model and initialized classifier to obtain a target anomaly detection model and a target classifier.
上述实施方式下，通过采用初步训练的异常检测模型，对不包含标签的候选样本进行标签预测，获得候选样本对应异常用户标签的置信度，将置信度大于第一阈值的候选样本添加至样本数据集，获得扩充样本集，然后基于扩充样本集对初步训练的异常检测模型和初始化的分类器进行微调训练，获得目标异常检测模型和目标分类器，有效扩充了用户标签，仅使用少量已标注标签的样本数据，就能够使异常检测模型更加准确识别出异常用户和正常用户节点结构差异。In the above embodiment, by using the initially trained anomaly detection model, label prediction is performed on candidate samples that do not contain labels, the confidence of the candidate samples corresponding to the abnormal user labels is obtained, and the candidate samples with confidence greater than the first threshold are added to the sample data. Set, obtain an expanded sample set, and then perform fine-tuning training on the initially trained anomaly detection model and initialized classifier based on the expanded sample set to obtain the target anomaly detection model and target classifier, which effectively expands user labels and only uses a small number of labeled labels With the sample data, the anomaly detection model can more accurately identify the differences in node structure between abnormal users and normal users.
一种可选实施方式中，所述采用所述扩充样本集对所述初步训练的异常检测模型和初始化的分类器进行微调训练，获得目标异常检测模型和目标分类器，包括：In an optional implementation, the expanded sample set is used to perform fine-tuning training on the initially trained anomaly detection model and initialized classifier to obtain the target anomaly detection model and target classifier, including:
按照所述扩充样本集中各个样本的第一样本权重，迭代从所述扩充样本集选取样本数据，并采用选取的样本数据对所述初步训练的异常检测模型和初始化的分类器进行微调训练，获得微调训练的异常检测模型和微调训练的分类器；Iteratively select sample data from the expanded sample set according to the first sample weight of each sample in the expanded sample set, and use the selected sample data to perform fine-tuning training on the initially trained anomaly detection model and initialized classifier, Obtain the fine-tuned trained anomaly detection model and the fine-tuned trained classifier;
按照所述扩充样本集中各个样本的第二样本权重，迭代从所述扩充样本集合选取样本数据，并采用选取的样本数据对所述微调训练的异常检测模型和所述微调训练的分类器进行微调训练，获得所述目标异常检测模型和所述目标分类器。Iteratively select sample data from the expanded sample set according to the second sample weight of each sample in the expanded sample set, and use the selected sample data to fine-tune the fine-tuned trained anomaly detection model and the fine-tuned trained classifier. Train to obtain the target anomaly detection model and the target classifier.
一种可选实施方式中，还包括：An optional implementation also includes:
将所述扩充样本集中原本的训练样本以及所述置信度大于等于第二阈值的候选样本的第一样本权重设置为第一数值；Set the first sample weight of the original training samples in the expanded sample set and the candidate samples whose confidence level is greater than or equal to the second threshold to a first value;
将所述置信度大于所述第一阈值，且小于所述第二阈值的候选样本的第一样本权重设置为第二数值，其中，所述第一数值大于所述第二数值。The first sample weight of the candidate sample whose confidence level is greater than the first threshold and less than the second threshold is set to a second value, where the first value is greater than the second value.
一种可选实施方式中，还包括：An optional implementation also includes:
将所述置信度大于所述第一阈值，且小于所述第二阈值的候选样本的第二样本权重设置为第一数值；Set the second sample weight of the candidate sample whose confidence level is greater than the first threshold and less than the second threshold as a first value;
将所述扩充样本集合中原本的训练样本以及所述置信度大于等于第二阈值的候选样本的第一样本权重设置为第二数值，其中，所述第一数值大于所述第二数值。The first sample weights of the original training samples and the candidate samples whose confidence level is greater than or equal to the second threshold in the expanded sample set are set to a second value, where the first value is greater than the second value.
上述实施方式下，在训练初期，将扩充样本集中原本的训练样本以及置信度大于等于第二阈值的候选样本的第一样本权重设置为较大数值，将置信度大于第一阈值，且小于第二阈值的候选样本的第一样本权重设置为较小数值，故有效扩充了训练样本集，提高了模型检测结果的准确性。In the above embodiment, in the early stage of training, the first sample weights of the original training samples in the expanded sample set and the candidate samples whose confidence is greater than or equal to the second threshold are set to larger values, and the confidence is greater than the first threshold and less than The first sample weight of the candidate sample of the second threshold is set to a smaller value, so the training sample set is effectively expanded and the accuracy of the model detection result is improved.
随着模型的优化，将置信度大于第一阈值，且小于第二阈值的候选样本的第二样本权重设置为较大数值，将扩充样本集合中原本的训练样本以及置信度大于等于第二阈值的候选样本的第一样本权重设置为较小数值，不仅有效扩充了训练样本集，而且有利于模型检测出难以分辨的异常用户，提高了模型检测的精度。As the model is optimized, the second sample weight of candidate samples whose confidence is greater than the first threshold and less than the second threshold is set to a larger value, and the original training samples in the expanded sample set and whose confidence is greater than or equal to the second threshold are Setting the first sample weight of candidate samples to a smaller value not only effectively expands the training sample set, but also helps the model detect abnormal users that are difficult to distinguish, improving the accuracy of model detection.
根据异常检测模型训练的优化程度选择最适合作为优化的样本数据，通过细粒度处理样本数据，便于异常检测模型的快速优化。Select the most suitable sample data for optimization according to the optimization degree of the anomaly detection model training, and process the sample data in a fine-grained manner to facilitate the rapid optimization of the anomaly detection model.
第二方面，本申请实施例提供了一种异常信息检测方法，包括：In the second aspect, embodiments of the present application provide an abnormal information detection method, including:
获取待识别用户信息；Obtain user information to be identified;
采用目标异常检测模型和目标分类器，对所述待识别用户信息进行分类，确定所述待识别用户信息的目标类别标签，所述目标类别标签为异常用户标签或正常用户标签，所述目标异常检测模型和所述目标分类器是采用如前任一所述的模型训练方法获得的。Using a target anomaly detection model and a target classifier, the user information to be identified is classified, and the target category label of the user information to be identified is determined. The target category label is an abnormal user label or a normal user label. The target abnormality The detection model and the target classifier are obtained using the model training method as described in the previous one.
第三方面，本申请实施例提供了一种模型训练装置，包括：In a third aspect, embodiments of the present application provide a model training device, including:
获取模块，用于获取样本数据集；Acquisition module, used to obtain sample data sets;
参数调整模块，用于采用所述样本数据集迭代执行异常检测任务和图预训练任务，并在每次迭代过程中，获得所述异常检测任务和所述图预训练任务之间的一致性指标，并基于所述一致性指标调整用于执行所述异常检测任务的异常检测模型的模型参数；A parameter adjustment module for iteratively executing anomaly detection tasks and graph pre-training tasks using the sample data set, and obtaining consistency indicators between the anomaly detection tasks and the graph pre-training tasks during each iteration. , and adjust the model parameters of the anomaly detection model used to perform the anomaly detection task based on the consistency index;
初始模型模块，用于在所述一致性指标满足预设条件时停止迭代，获得初步训练的异常检测模型；An initial model module, used to stop iteration when the consistency index meets the preset conditions and obtain a preliminary trained anomaly detection model;
目标模型模块，用于对所述初步训练的异常检测模型和初始化的分类器进行微调训练，获得目标异常检测模型和目标分类器。The target model module is used to fine-tune the initially trained anomaly detection model and the initialized classifier to obtain the target anomaly detection model and the target classifier.
一种可选实施方式中，所述参数调整模块具体用于：In an optional implementation, the parameter adjustment module is specifically used to:
在每次迭代过程中，获取执行所述异常检测任务获得的多个用户节点对的第一标签分布；以及，执行所述图预训练任务获得的多个用户节点对的第二标签分布；In each iteration process, obtain the first label distribution of multiple user node pairs obtained by executing the anomaly detection task; and, obtain the second label distribution of the multiple user node pairs obtained by executing the graph pre-training task;
基于所述第一标签分布和所述第二标签分布之间的差异，获得所述异常检测任务和所述图预训练任务之间的一致性指标。Based on the difference between the first label distribution and the second label distribution, a consistency index between the anomaly detection task and the graph pre-training task is obtained.
一种可选实施方式中，所述目标模型模块具体用于：In an optional implementation, the target model module is specifically used to:
采用所述初步训练的异常检测模型，对不包含标签的候选样本进行标签预测，获得所述候选样本对应异常用户标签的置信度；Using the initially trained anomaly detection model, perform label prediction on candidate samples that do not contain labels, and obtain the confidence of the abnormal user labels corresponding to the candidate samples;
将置信度大于第一阈值的候选样本添加至所述样本数据集，获得扩充样本集；Add candidate samples with confidence greater than the first threshold to the sample data set to obtain an expanded sample set;
采用所述扩充样本集对所述初步训练的异常检测模型和初始化的分类器进行微调训练，获得目标异常检测模型和目标分类器。The expanded sample set is used to perform fine-tuning training on the initially trained anomaly detection model and initialized classifier to obtain a target anomaly detection model and a target classifier.
一种可选实施方式中，所述目标模型模块具体用于：In an optional implementation, the target model module is specifically used to:
按照所述扩充样本集中各个样本的第一样本权重，迭代从所述扩充样本集选取样本数据，并采用选取的样本数据对所述初步训练的异常检测模型和初始化的分类器进行微调训练，获得微调训练的异常检测模型和微调训练的分类器；Iteratively select sample data from the expanded sample set according to the first sample weight of each sample in the expanded sample set, and use the selected sample data to perform fine-tuning training on the initially trained anomaly detection model and initialized classifier, Obtain the fine-tuned trained anomaly detection model and the fine-tuned trained classifier;
按照所述扩充样本集中各个样本的第二样本权重，迭代从所述扩充样本集合选取样本数据，并采用选取的样本数据对所述微调训练的异常检测模型和所述微调训练的分类器进行微调训练，获得所述目标异常检测模型和所述目标分类器。Iteratively select sample data from the expanded sample set according to the second sample weight of each sample in the expanded sample set, and use the selected sample data to fine-tune the fine-tuned trained anomaly detection model and the fine-tuned trained classifier. Train to obtain the target anomaly detection model and the target classifier.
一种可选实施方式中，还包括第一优化样本模块；In an optional implementation, it also includes a first optimized sample module;
所述第一优化样本模块具体用于：The first optimized sample module is specifically used for:
将所述扩充样本集中原本的训练样本以及所述置信度大于等于第二阈值的候选样本的第一样本权重设置为第一数值；Set the first sample weight of the original training samples in the expanded sample set and the candidate samples whose confidence level is greater than or equal to the second threshold to a first value;
将所述置信度大于所述第一阈值，且小于所述第二阈值的候选样本的第一样本权重设置为第二数值，其中，所述第一数值大于所述第二数值。The first sample weight of the candidate sample whose confidence level is greater than the first threshold and less than the second threshold is set to a second value, where the first value is greater than the second value.
一种可选实施方式中，还包括第二优化样本模块；In an optional implementation, it also includes a second optimized sample module;
所述第二优化样本模块具体用于：The second optimized sample module is specifically used for:
将所述置信度大于所述第一阈值，且小于所述第二阈值的候选样本的第二样本权重设置为第一数值；Set the second sample weight of the candidate sample whose confidence level is greater than the first threshold and less than the second threshold as a first value;
将所述扩充样本集合中原本的训练样本以及所述置信度大于等于第二阈值的候选样本的第一样本权重设置为第二数值，其中，所述第一数值大于所述第二数值。The first sample weights of the original training samples and the candidate samples whose confidence level is greater than or equal to the second threshold in the expanded sample set are set to a second value, where the first value is greater than the second value.
第四方面，本申请实施例提供了一种异常信息检测装置，包括：In the fourth aspect, embodiments of the present application provide an abnormal information detection device, including:
获取模块，用于获取待识别用户信息；Acquisition module, used to obtain user information to be identified;
检测模块，用于采用目标异常检测模型和目标分类器，对所述待识别用户信息进行分类，确定所述待识别用户信息的目标类别标签，所述目标类别标签为异常用户标签或正常用户标签，所述目标异常检测模型和所述目标分类器是采用如前任一所述的模型训练方法获得的。A detection module, configured to use a target anomaly detection model and a target classifier to classify the user information to be identified and determine the target category label of the user information to be identified, where the target category label is an abnormal user label or a normal user label. , the target anomaly detection model and the target classifier are obtained by using the model training method as described in the previous one.
第五方面，本申请实施例提供了一种计算机设备，包括存储器、处理器及存储在存储器上并可在处理器上运行的计算机程序，所述处理器执行所述程序时实现上述模型训练方法以及异常信息检测方法的步骤。In a fifth aspect, embodiments of the present application provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the above model training method is implemented. and the steps of the anomaly information detection method.
第六方面，本申请实施例提供了一种计算机可读存储介质，其存储有可由计算机设备执行的计算机程序，当所述程序在计算机设备上运行时，使得所述计算机设备执行上述模型训练方法以及异常信息检测方法的步骤。In a sixth aspect, embodiments of the present application provide a computer-readable storage medium that stores a computer program that can be executed by a computer device. When the program is run on the computer device, it causes the computer device to execute the above model training method. and the steps of the anomaly information detection method.
附图说明Description of drawings
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简要介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域的普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。In order to more clearly illustrate the technical solutions in the embodiments of the present invention, a brief introduction will be given below to the drawings needed to be used in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. Those of ordinary skill in the art can also obtain other drawings based on these drawings without exerting any creative effort.
图1为本申请实施例提供的一种系统架构的结构示意图；Figure 1 is a schematic structural diagram of a system architecture provided by an embodiment of the present application;
图2为本申请实施例提供的一种模型训练方法的流程示意图；Figure 2 is a schematic flow chart of a model training method provided by an embodiment of the present application;
图3为本申请实施例提供的一种模型训练方法的流程示意图；Figure 3 is a schematic flow chart of a model training method provided by an embodiment of the present application;
图4为本申请实施例提供的一种异常信息检测方法的流程示意图；Figure 4 is a schematic flow chart of an abnormal information detection method provided by an embodiment of the present application;
图5为本申请实施例提供的一种模型训练装置的结构示意图；Figure 5 is a schematic structural diagram of a model training device provided by an embodiment of the present application;
图6为本申请实施例提供的一种异常信息检测装置的结构示意图；Figure 6 is a schematic structural diagram of an abnormal information detection device provided by an embodiment of the present application;
图7为本申请实施例提供的一种计算机设备的结构示意图。Figure 7 is a schematic structural diagram of a computer device provided by an embodiment of the present application.
具体实施方式Detailed ways
为了使本发明的目的、技术方案及有益效果更加清楚明白，以下结合附图及实施例，对本发明进行进一步详细说明。应当理解，此处所描述的具体实施例仅仅用以解释本发明，并不用于限定本发明。In order to make the purpose, technical solutions and beneficial effects of the present invention more clear, the present invention will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described here are only used to explain the present invention and are not intended to limit the present invention.
金融场景下的异常检测，主要包括识别金融网络下注册用户是否为正常用户或是欺诈用户。在此场景下，用户自愿完成基本个人资料等信息，金融网络平台基于用户信息评估注册用户对于金融产品的购买能力等，从而制定合适的用户服务策略。所以，如何通过用户的交易记录以及用户之间的关联信息来判断用户是否异常是至关重要。Anomaly detection in financial scenarios mainly includes identifying whether registered users under the financial network are normal users or fraudulent users. In this scenario, users voluntarily complete basic personal information and other information, and the financial network platform evaluates registered users' purchasing ability for financial products based on user information, so as to formulate appropriate user service strategies. Therefore, it is crucial to determine whether a user is abnormal through the user's transaction record and the related information between users.
基于此，本申请实施例提供一种模型训练方法，通过基于一致性指标的图微调策略，最终获得目标异常检测模型和目标分类器，使用目标异常检测模型和目标分类器有效识别图网络结构中异常节点的结构，准确分辨正常用户和异常用户。Based on this, embodiments of this application provide a model training method. Through a graph fine-tuning strategy based on consistency indicators, a target anomaly detection model and a target classifier are finally obtained, and the target anomaly detection model and target classifier are used to effectively identify the graph network structure. The structure of abnormal nodes accurately distinguishes normal users from abnormal users.
参见图1，其为本申请实施例适用的一种系统架构图。该架构至少包括终端设备101以及服务器102。终端设备101的数量可以是一个或多个，服务器102的数量也可以是一个或多个，本申请对终端设备101和服务器102的数量不做具体限定。Refer to Figure 1, which is a system architecture diagram applicable to the embodiment of the present application. The architecture includes at least a terminal device 101 and a server 102. The number of terminal devices 101 may be one or more, and the number of servers 102 may also be one or more. This application does not specifically limit the number of terminal devices 101 and servers 102 .
终端设备101中可以安装有目标应用，其中，目标应用可以是客户端应用、网页版应用、小程序应用等。在实际应用场景中，目标应用可以是任意具备异常检测功能的应用。终端设备101可以是智能手机、平板电脑、笔记本电脑、台式计算机、智能语音交互设备、智能家电、智能音箱、智能手表、智能车载设备等，但并不局限于此。本申请实施例可应用于各种场景，包括但不限于金融异常检测领域。The terminal device 101 may be installed with a target application, where the target application may be a client application, a web version application, a small program application, etc. In actual application scenarios, the target application can be any application with anomaly detection capabilities. The terminal device 101 may be a smart phone, a tablet computer, a notebook computer, a desktop computer, an intelligent voice interaction device, a smart home appliance, a smart speaker, a smart watch, a smart vehicle-mounted device, etc., but is not limited thereto. The embodiments of this application can be applied to various scenarios, including but not limited to the field of financial anomaly detection.
服务器102可以是目标应用的后台服务器，为目标应用提供相应的服务，服务器102可以是独立的物理服务器，也可以是多个物理服务器构成的服务器集群或者分布式系统，还可以是提供云服务、云数据库、云计算、云函数、云存储、网络服务、云通信、中间件服务、域名服务、安全服务、内容分发网络(Content Delivery Network，CDN)、以及大数据和人工智能平台等基础云计算服务的云服务器。终端设备101与服务器102可以通过有线或无线通信方式进行直接或间接地连接，本申请在此不做限制。The server 102 can be a background server for the target application, providing corresponding services for the target application. The server 102 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or it can provide cloud services, Basic cloud computing such as cloud database, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, Content Delivery Network (CDN), and big data and artificial intelligence platforms. Service cloud server. The terminal device 101 and the server 102 can be connected directly or indirectly through wired or wireless communication methods, which is not limited in this application.
本申请实施例中的模型训练方法可以是终端设备101执行，也可以是服务器102执行，也可以由终端设备101与服务器102交互执行。The model training method in the embodiment of the present application may be executed by the terminal device 101, or may be executed by the server 102, or may be executed interactively by the terminal device 101 and the server 102.
参见图2，本申请实施例提供的一种模型训练方法主要包括以下步骤：Referring to Figure 2, a model training method provided by the embodiment of the present application mainly includes the following steps:
步骤201，获取样本数据集。Step 201: Obtain a sample data set.
具体地，为了统一的讨论图预训练任务和异常检测任务的差异，本申请定义用户的节点对标签空间内的标签为y*(vi,vj)＝1y(vi)＝y(vj)，其中，vi和vj为样本数据集中的两个用户节点，y(vi)和y(vj)为两个用户节点对应的标签(正常用户标签或是异常用户标签)，1代表指示函数，若两个用户节点的标签相同，即y(vi)和y(vj)都是正常用户标签或者都是异常用户标签，则指示函数为1；若两个用户节点的标签不同，则指示函数为0。Specifically, in order to uniformly discuss the differences between graph pre-training tasks and anomaly detection tasks, this application defines the label of the user's node pair label space as y*(vi,vj)=1y(vi)=y(vj), where , vi and vj are the two user nodes in the sample data set, y(vi) and y(vj) are the labels corresponding to the two user nodes (normal user label or abnormal user label), 1 represents the indicator function, if two If the labels of the user nodes are the same, that is, y(vi) and y(vj) are both normal user labels or abnormal user labels, the indicator function is 1; if the labels of the two user nodes are different, the indicator function is 0.
步骤202，采用样本数据集迭代执行异常检测任务和图预训练任务，并在每次迭代过程中，获得异常检测任务和图预训练任务之间的一致性指标，并基于一致性指标调整用于执行异常检测任务的异常检测模型的模型参数。Step 202: Use the sample data set to iteratively execute the anomaly detection task and the graph pre-training task, and in each iteration process, obtain the consistency index between the anomaly detection task and the graph pre-training task, and adjust it based on the consistency index. Model parameters of the anomaly detection model that performs the anomaly detection task.
一种可选实施方式中，在每次迭代过程中，获取执行异常检测任务获得的多个用户节点对的第一标签分布；以及，执行图预训练任务获得的多个用户节点对的第二标签分布；In an optional implementation, in each iteration process, the first label distribution of multiple user node pairs obtained by executing the anomaly detection task is obtained; and the second label distribution of the multiple user node pairs obtained by executing the graph pre-training task is obtained. label distribution;
基于第一标签分布和第二标签分布之间的差异，获得异常检测任务和图预训练任务之间的一致性指标。Based on the difference between the first label distribution and the second label distribution, a consistency index between the anomaly detection task and the graph pre-training task is obtained.
具体地，在每次迭代过程中，首先分别将图预训练任务和异常检测任务转化到同一个节点对标签空间，即统一任务空间，转化方法可以是欧式距离算法、余弦距离算法等。然后，比较异常检测任务中多个用户节点对的第一标签分布和图预训练任务中多个用户节点对的第二标签分布之间的差异，此时，这个差异就是图预训练任务和异常检测任务之间的距离。Specifically, in each iteration process, the graph pre-training task and the anomaly detection task are first transformed into the same node pair label space, that is, the unified task space. The transformation method can be the Euclidean distance algorithm, the cosine distance algorithm, etc. Then, compare the difference between the first label distribution of multiple user node pairs in the anomaly detection task and the second label distribution of multiple user node pairs in the graph pre-training task. At this time, this difference is the graph pre-training task and anomaly Detect the distance between tasks.
通过计算获得异常检测任务和图预训练任务之间的一致性指标，其中，n为节点对，D代表异常检测任务,P为预训练任务，/>和/>为两个用户对应的节点对标签空间，/>和/>同属于同一标签或者不同标签。via caculation Obtain the consistency index between the anomaly detection task and the graph pre-training task, where n is the node pair, D represents the anomaly detection task, and P is the pre-training task, /> and/> It is the label space of node pairs corresponding to two users,/> and/> belong to the same label or different labels.
上述实施方式下，通过构建统一任务空间，能够适应多种预训练模型的微调训练要求，有效减少图预训练任务的负面迁移效果。Under the above implementation, by constructing a unified task space, it can adapt to the fine-tuning training requirements of multiple pre-training models, and effectively reduce the negative transfer effects of graph pre-training tasks.
步骤203，在一致性指标满足预设条件时停止迭代，获得初步训练的异常检测模型。Step 203: Stop iteration when the consistency index meets the preset conditions to obtain a preliminary trained anomaly detection model.
一种可选实施方式中，一致性指标满足预设条件指：第一标签分布和第二标签分布之间的差异达到最小值。In an optional implementation, the consistency index satisfying the preset condition means that the difference between the first label distribution and the second label distribution reaches a minimum value.
具体地，每次迭代过程中，以使一致性指标减小为基准，调整用于执行异常检测任务的异常检测模型的模型参数。在多次迭代后，异常检测任务中多个用户节点对的第一标签分布和图预训练任务中多个用户节点对的第二标签分布之间的差异逐渐减小，当差异达到最小值时，说明一致性指标满足预设条件，故停止迭代，最后一次迭代过程更新的异常检测模型即为初步训练的异常检测模型。也就是说，异常检测任务和图预训练任务的一致性越高，异常检测模型越能够区分异常用户节点结构和正常用户节点的差异。Specifically, during each iteration, the model parameters of the anomaly detection model used to perform the anomaly detection task are adjusted based on the reduction of the consistency index. After multiple iterations, the difference between the first label distribution of multiple user node pairs in the anomaly detection task and the second label distribution of multiple user node pairs in the graph pre-training task gradually decreases, when the difference reaches the minimum value , indicating that the consistency index meets the preset conditions, so the iteration is stopped, and the anomaly detection model updated in the last iteration process is the initially trained anomaly detection model. That is to say, the higher the consistency between the anomaly detection task and the graph pre-training task, the more capable the anomaly detection model is in distinguishing the differences between abnormal user node structures and normal user nodes.
上述实施方式下，通过迭代使得异常检测任务的第一标签分布和图预训练任务的第二标签分布之间的差异达到最小值，能够使异常检测任务从图预训练任务中获得增益，更加准确识别出异常用户和正常用户节点结构差异，进而提高异常检测模型的检测结果准确性。In the above embodiment, the difference between the first label distribution of the anomaly detection task and the second label distribution of the graph pre-training task is minimized through iteration, so that the anomaly detection task can gain from the graph pre-training task and be more accurate. The difference in node structure between abnormal users and normal users is identified, thereby improving the accuracy of the detection results of the anomaly detection model.
步骤204，对初步训练的异常检测模型和初始化的分类器进行微调训练，获得目标异常检测模型和目标分类器。Step 204: Perform fine-tuning training on the initially trained anomaly detection model and initialized classifier to obtain the target anomaly detection model and target classifier.
本申请实施例中，通过采用样本数据集迭代执行异常检测任务和图预训练任务，并在每次迭代过程中，获得异常检测任务和图预训练任务之间的一致性指标，再基于一致性指标调整用于执行异常检测任务的异常检测模型的模型参数，得到初步训练的异常检测模型，使得异常检测任务从图预训练任务中获益，故进一步对初步训练的异常检测模型和初始化的分类器进行微调训练，获得目标异常检测模型和目标分类器时，目标异常检测模型和目标分类器能够有效识别图网络结构中异常节点的结构，准确分辨正常用户和异常用户，有效提高了异常检测结果的准确性。In the embodiment of this application, the anomaly detection task and the graph pre-training task are iteratively executed by using the sample data set, and in each iteration process, the consistency index between the anomaly detection task and the graph pre-training task is obtained, and then based on the consistency The index adjusts the model parameters of the anomaly detection model used to perform the anomaly detection task to obtain the initially trained anomaly detection model, so that the anomaly detection task benefits from the graph pre-training task, so the classification of the initially trained anomaly detection model and initialization is further When the machine is fine-tuned and trained to obtain the target anomaly detection model and target classifier, the target anomaly detection model and target classifier can effectively identify the structure of abnormal nodes in the graph network structure, accurately distinguish between normal users and abnormal users, and effectively improve the anomaly detection results. accuracy.
一种可选实施方式中，采用初步训练的异常检测模型，对不包含标签的候选样本进行标签预测，获得候选样本对应异常用户标签的置信度；In an optional implementation, a preliminary trained anomaly detection model is used to perform label prediction on candidate samples that do not contain labels, and obtain the confidence of the candidate samples corresponding to the abnormal user labels;
将置信度大于第一阈值的候选样本添加至样本数据集，获得扩充样本集；Add candidate samples with confidence greater than the first threshold to the sample data set to obtain an expanded sample set;
采用扩充样本集对初步训练的异常检测模型和初始化的分类器进行微调训练，获得目标异常检测模型和目标分类器。The expanded sample set is used to fine-tune the initially trained anomaly detection model and initialized classifier to obtain the target anomaly detection model and target classifier.
具体地，在异常检测任务的训练过程中，仅有少量的样本数据存在标签。为了扩充样本数据的标签以更好的构建统一的任务空间，对每个没有标签的候选样本分别使用初步训练的异常检测模型进行异常用户概率检测，计算每个候选样本的置信度，并将置信度大于第一阈值的候选样本纳入样本数据集，获得扩充样本集。基于扩充样本集构建统一任务空间，计算一致性指标，同时在初步训练的异常检测模型后接入分类器，分类器用于分辨异常检测数据中的正常用户信息和异常用户信息，对初步训练的异常检测模型和初始化的分类器进行微调训练，获得目标异常检测模型和目标分类器。Specifically, during the training process of anomaly detection tasks, only a small amount of sample data has labels. In order to expand the labels of the sample data to better construct a unified task space, each unlabeled candidate sample is used to detect abnormal user probability using the initially trained anomaly detection model, calculate the confidence of each candidate sample, and add the confidence Candidate samples with degrees greater than the first threshold are included in the sample data set to obtain an expanded sample set. Build a unified task space based on the expanded sample set, calculate the consistency index, and access the classifier after the preliminary training of the anomaly detection model. The classifier is used to distinguish normal user information and abnormal user information in the anomaly detection data, and the initially trained anomalies are The detection model and initialized classifier are fine-tuned and trained to obtain the target anomaly detection model and target classifier.
上述实施方式下，通过采用初步训练的异常检测模型，对不包含标签的候选样本进行标签预测，获得候选样本对应异常用户标签的置信度，将置信度大于第一阈值的候选样本添加至样本数据集，获得扩充样本集，然后基于扩充样本集对初步训练的异常检测模型和初始化的分类器进行微调训练，获得目标异常检测模型和目标分类器，有效扩充了用户标签，仅使用少量已标注标签的样本数据，就能够使异常检测模型更加准确识别出异常用户和正常用户节点结构差异。In the above embodiment, by using the initially trained anomaly detection model, label prediction is performed on candidate samples that do not contain labels, the confidence of the candidate samples corresponding to the abnormal user labels is obtained, and the candidate samples with confidence greater than the first threshold are added to the sample data. Set, obtain an expanded sample set, and then perform fine-tuning training on the initially trained anomaly detection model and initialized classifier based on the expanded sample set to obtain the target anomaly detection model and target classifier, which effectively expands user labels and only uses a small number of labeled labels With the sample data, the anomaly detection model can more accurately identify the differences in node structure between abnormal users and normal users.
一种可选实施方式中，按照扩充样本集中各个样本的第一样本权重，迭代从扩充样本集选取样本数据，并采用选取的样本数据对初步训练的异常检测模型和初始化的分类器进行微调训练，获得微调训练的异常检测模型和微调训练的分类器；In an optional implementation, sample data is iteratively selected from the expanded sample set according to the first sample weight of each sample in the expanded sample set, and the selected sample data is used to fine-tune the initially trained anomaly detection model and initialized classifier. Train to obtain the fine-tuned trained anomaly detection model and the fine-tuned trained classifier;
按照扩充样本集中各个样本的第二样本权重，迭代从扩充样本集合选取样本数据，并采用选取的样本数据对微调训练的异常检测模型和微调训练的分类器进行微调训练，获得目标异常检测模型和目标分类器。According to the second sample weight of each sample in the expanded sample set, iteratively select sample data from the expanded sample set, and use the selected sample data to fine-tune the fine-tuned trained anomaly detection model and the fine-tuned trained classifier to obtain the target anomaly detection model and target classifier.
一种可选实施方式中，将扩充样本集中原本的训练样本以及置信度大于等于第二阈值的候选样本的第一样本权重设置为第一数值；In an optional implementation, the first sample weights of the original training samples in the expanded sample set and the candidate samples whose confidence level is greater than or equal to the second threshold are set to the first value;
将置信度大于第一阈值，且小于第二阈值的候选样本的第一样本权重设置为第二数值，其中，第一数值大于第二数值。The first sample weight of the candidate sample whose confidence level is greater than the first threshold and less than the second threshold is set to a second value, where the first value is greater than the second value.
一种可选实施方式中，将置信度大于第一阈值，且小于第二阈值的候选样本的第二样本权重设置为第一数值；In an optional implementation, the second sample weight of the candidate sample whose confidence is greater than the first threshold and less than the second threshold is set to the first value;
将扩充样本集中原本的训练样本以及置信度大于等于第二阈值的候选样本的第一样本权重设置为第二数值，其中，第一数值大于第二数值。The first sample weights of the original training samples in the expanded sample set and the candidate samples whose confidence level is greater than or equal to the second threshold are set to a second value, where the first value is greater than the second value.
具体地，在异常检测模型训练初期，由于异常检测模型的预测性能不高，故将扩充样本集中原本的训练样本以及置信度大于等于第二阈值的候选样本设置较高权重，将置信度大于第一阈值，且小于第二阈值的候选样本设置较低权重，迭代从扩充样本集选取样本数据，并采用选取的样本数据对初步训练的异常检测模型和初始化的分类器进行微调训练，获得微调训练的异常检测模型和微调训练的分类器。也就是采用准确性更高的训练样本指导异常检测模型训练，从而提升模型训练效果。Specifically, in the early stage of anomaly detection model training, since the prediction performance of the anomaly detection model is not high, higher weights are set for the original training samples in the expanded sample set and candidate samples with confidence levels greater than or equal to the second threshold, and the confidence level is greater than the second threshold. A threshold, and candidate samples smaller than the second threshold are given lower weights, iteratively select sample data from the expanded sample set, and use the selected sample data to perform fine-tuning training on the initially trained anomaly detection model and initialized classifier to obtain fine-tuning training Anomaly detection model and fine-tuned trained classifier. That is to say, more accurate training samples are used to guide anomaly detection model training, thereby improving the model training effect.
随着异常检测模型得到优化后，为了使异常检测模型能够识别难以分辨的异常用户，在训练后期，将扩充样本集中原本的训练样本以及置信度大于等于第二阈值的候选样本设置较低权重，将置信度大于第一阈值，且小于第二阈值的候选样本设置较高权重，迭代从扩充样本集选取样本数据，并采用选取的样本数据对微调训练的异常检测模型和微调训练的分类器进行微调训练，获得目标异常检测模型和目标分类器。也就是采用精度更高的训练样本指导异常检测模型训练，从而提升模型训练效果。As the anomaly detection model is optimized, in order to enable the anomaly detection model to identify difficult-to-distinguish abnormal users, in the later stage of training, the original training samples in the expanded sample set and the candidate samples with a confidence level greater than or equal to the second threshold are set with lower weights. Set higher weights for candidate samples whose confidence is greater than the first threshold and less than the second threshold, iteratively select sample data from the expanded sample set, and use the selected sample data to perform fine-tuning training on the anomaly detection model and fine-tuning training classifier. Fine-tune the training to obtain the target anomaly detection model and target classifier. That is to say, higher-precision training samples are used to guide anomaly detection model training, thereby improving the model training effect.
上述实施方式下，在训练初期，将扩充样本集中原本的训练样本以及置信度大于等于第二阈值的候选样本的第一样本权重设置为较大数值，将置信度大于第一阈值，且小于第二阈值的候选样本的第一样本权重设置为较小数值，故有效扩充了训练样本集，提高了模型训练结果的准确性。In the above embodiment, in the early stage of training, the first sample weights of the original training samples in the expanded sample set and the candidate samples whose confidence is greater than or equal to the second threshold are set to larger values, and the confidence is greater than the first threshold and less than The first sample weight of the candidate sample for the second threshold is set to a smaller value, so the training sample set is effectively expanded and the accuracy of the model training results is improved.
随着模型的优化，将置信度大于第一阈值，且小于第二阈值的候选样本的第二样本权重设置为较大数值，将扩充样本集合中原本的训练样本以及置信度大于等于第二阈值的候选样本的第一样本权重设置为较小数值，不仅有效扩充了训练样本集，而且有利于模型检测出难以分辨的异常用户，提高了模型训练结果的精度。As the model is optimized, the second sample weight of candidate samples whose confidence is greater than the first threshold and less than the second threshold is set to a larger value, and the original training samples in the expanded sample set and whose confidence is greater than or equal to the second threshold are The first sample weight of the candidate sample is set to a smaller value, which not only effectively expands the training sample set, but also helps the model detect abnormal users that are difficult to distinguish, and improves the accuracy of the model training results.
根据异常检测模型训练的优化程度选择最适合作为优化的样本数据，通过细粒度处理样本数据，便于异常检测模型的快速优化。Select the most suitable sample data for optimization according to the optimization degree of the anomaly detection model training, and process the sample data in a fine-grained manner to facilitate the rapid optimization of the anomaly detection model.
此外，参见图3，以金融异常检测的应用场景为例，本申请实施例提供了一种模型训练方法，具体如下：In addition, referring to Figure 3, taking the application scenario of financial anomaly detection as an example, embodiments of the present application provide a model training method, as follows:
采用金融检测样本数据集，迭代执行异常检测任务和图预训练任务，并在每次迭代过程中，获取金融检测任务中多个用户的节点对标签空间，和图预训练任务中多个用户的节点对标签空间，将金融检测任务中多个用户的节点对标签空间和图预训练任务中多个用户的节点对标签空间转化到统一任务空间，在统一任务空间中，通过计算金融检测任务中的节点对标签分布和图预训练任务中的节点对标签分布之间的差异，获得一致性指标，根据一致性指标调整用于执行金融检测任务的异常检测模型的模型参数，直到一致性指标满足预设条件时停止迭代，获得初步训练的异常检测模型。Using the financial detection sample data set, iteratively executes the anomaly detection task and the graph pre-training task, and in each iteration process, obtains the node pair label space of multiple users in the financial detection task, and the node pair label space of multiple users in the graph pre-training task. The node pair label space converts the node pair label space of multiple users in the financial detection task and the node pair label space of multiple users in the graph pre-training task into a unified task space. In the unified task space, by calculating the financial detection task The difference between the node pair label distribution and the node pair label distribution in the graph pre-training task is used to obtain the consistency index, and the model parameters of the anomaly detection model used to perform the financial detection task are adjusted according to the consistency index until the consistency index meets Stop the iteration when the preset conditions are met and obtain the initially trained anomaly detection model.
采用初步训练的异常检测模型，对不包含标签的候选样本进行标签预测，获得候选样本对应异常用户标签的置信度，将置信度大于第一阈值的候选样本纳入高置信度数据集，添加至样本数据集，获得扩充样本集。Use the initially trained anomaly detection model to perform label prediction on candidate samples that do not contain labels, obtain the confidence of the candidate samples corresponding to the abnormal user label, and include candidate samples with confidence greater than the first threshold into the high-confidence data set and add them to the sample Data set to obtain an expanded sample set.
在训练初期，将扩充样本集中原本的训练样本以及置信度大于等于第二阈值的候选样本作为较高置信度的训练样本，并设置较高权重，将置信度大于第一阈值，且小于第二阈值的候选样本作为较低置信度的训练样本，并设置较低权重，迭代从扩充样本集选取样本数据，并采用选取的样本数据对初步训练的异常检测模型和初始化的分类器进行微调训练，获得微调训练的异常检测模型和微调训练的分类器。In the early stage of training, the original training samples in the expanded sample set and the candidate samples with confidence levels greater than or equal to the second threshold are used as training samples with higher confidence, and higher weights are set to ensure that the confidence level is greater than the first threshold and less than the second threshold. The threshold candidate samples are used as lower confidence training samples, and lower weights are set. Sample data are iteratively selected from the expanded sample set, and the selected sample data are used to fine-tune the initially trained anomaly detection model and initialized classifier. Get a fine-tuned trained anomaly detection model and a fine-tuned trained classifier.
具体地，从扩充样本集选取样本数据，并采用选取的样本数据迭代执行金融检测任务和图预训练任务，并在每次迭代过程中，获得金融检测任务和图预训练任务之间的一致性指标，并基于一致性指标调整初步训练的异常检测模型和初始化的分类器，获得微调训练的异常检测模型和微调训练的分类器。Specifically, sample data is selected from the expanded sample set, and the selected sample data is used to iteratively execute the financial detection task and the graph pre-training task, and in each iteration process, the consistency between the financial detection task and the graph pre-training task is obtained indicators, and adjust the initially trained anomaly detection model and initialized classifier based on the consistency indicator to obtain a fine-tuned trained anomaly detection model and a fine-tuned trained classifier.
随着模型训练优化的进行，在训练后期，将扩充样本集中较高置信度的训练样本设置较低权重，将较低置信度的训练样本设置较高权重，迭代从扩充样本集选取样本数据，并采用选取的样本数据对微调训练的异常检测模型和微调训练的分类器进行微调训练，获得金融图预训练模型和目标分类器，实现分辨异常用户。As the model training optimization proceeds, in the later stage of training, training samples with higher confidence in the expanded sample set are set to lower weights, training samples with lower confidence are set to higher weights, and sample data are iteratively selected from the expanded sample set. And use the selected sample data to conduct fine-tuning training on the fine-tuned trained anomaly detection model and fine-tuned trained classifier, and obtain the financial graph pre-trained model and target classifier to identify abnormal users.
具体地，从扩充样本集选取样本数据，并采用选取的样本数据迭代执行金融检测任务和图预训练任务，并在每次迭代过程中，获得金融检测任务和图预训练任务之间的一致性指标，并基于一致性指标调整微调训练的异常检测模型和微调训练的分类器，获得金融图预训练模型和目标分类器。Specifically, sample data is selected from the expanded sample set, and the selected sample data is used to iteratively execute the financial detection task and the graph pre-training task, and in each iteration process, the consistency between the financial detection task and the graph pre-training task is obtained indicators, and adjust the fine-tuned trained anomaly detection model and fine-tuned trained classifier based on the consistency indicator to obtain the financial graph pre-trained model and target classifier.
可见，金融异常检测任务用途广泛，随着交易量增加，用户节点数量也在增加，而本申请提供的异常检测模型训练方法仅需加入增加节点以进行模型更新，进而可以在增量数据集上进行延伸，提高了模型的训练效率。It can be seen that the financial anomaly detection task is widely used. As the transaction volume increases, the number of user nodes is also increasing. The anomaly detection model training method provided by this application only needs to add additional nodes for model update, and then it can be used on incremental data sets. Extended to improve the training efficiency of the model.
基于相同的技术构思，参见图4，本申请实施例提供了一种异常信息检测方法，包括以下步骤：Based on the same technical concept, see Figure 4, an embodiment of the present application provides an anomaly information detection method, including the following steps:
步骤401，获取待识别用户信息。Step 401: Obtain user information to be identified.
步骤402，采用目标异常检测模型和目标分类器，对待识别用户信息进行分类，确定待识别用户信息的目标类别标签，目标类别标签为异常用户标签或正常用户标签，目标异常检测模型和目标分类器是采用如前任一模型训练方法训练获得的。Step 402: Use the target anomaly detection model and the target classifier to classify the user information to be identified, and determine the target category label of the user information to be identified. The target category label is an abnormal user label or a normal user label. The target anomaly detection model and target classifier It is obtained by training using any of the previous model training methods.
基于相同的技术构思，参见图5，本申请实施例提供了一种模型训练装置，包括：Based on the same technical concept, see Figure 5, an embodiment of the present application provides a model training device, including:
获取模块501，用于获取样本数据集；Acquisition module 501, used to obtain sample data sets;
参数调整模块502，用于采用样本数据集迭代执行异常检测任务和图预训练任务，并在每次迭代过程中，获得异常检测任务和图预训练任务之间的一致性指标，并基于一致性指标调整用于执行异常检测任务的异常检测模型的模型参数；The parameter adjustment module 502 is used to iteratively execute the anomaly detection task and the graph pre-training task using the sample data set, and in each iteration process, obtain the consistency index between the anomaly detection task and the graph pre-training task, and based on the consistency Metrics adjust model parameters of an anomaly detection model used to perform anomaly detection tasks;
初始模型模块503，用于在一致性指标满足预设条件时停止迭代，获得初步训练的异常检测模型；The initial model module 503 is used to stop iteration when the consistency index meets the preset conditions and obtain a preliminary trained anomaly detection model;
目标模型模块504，用于对初步训练的异常检测模型和初始化的分类器进行微调训练，获得目标异常检测模型和目标分类器。The target model module 504 is used to fine-tune the initially trained anomaly detection model and the initialized classifier to obtain the target anomaly detection model and target classifier.
一种可选实施方式中，参数调整模块502具体用于：In an optional implementation, the parameter adjustment module 502 is specifically used to:
在每次迭代过程中，获取执行异常检测任务获得的多个用户节点对的第一标签分布；以及，执行图预训练任务获得的多个用户节点对的第二标签分布；During each iteration, obtain the first label distribution of multiple user node pairs obtained by executing the anomaly detection task; and, obtain the second label distribution of multiple user node pairs obtained by executing the graph pre-training task;
基于第一标签分布和第二标签分布之间的差异，获得异常检测任务和图预训练任务之间的一致性指标。Based on the difference between the first label distribution and the second label distribution, a consistency index between the anomaly detection task and the graph pre-training task is obtained.
一种可选实施方式中，目标模型模块504具体用于：In an optional implementation, the target model module 504 is specifically used to:
采用初步训练的异常检测模型，对不包含标签的候选样本进行标签预测，获得候选样本对应异常用户标签的置信度；Use the initially trained anomaly detection model to predict labels for candidate samples that do not contain labels, and obtain the confidence of candidate samples corresponding to abnormal user labels;
将置信度大于第一阈值的候选样本添加至样本数据集，获得扩充样本集；Add candidate samples with confidence greater than the first threshold to the sample data set to obtain an expanded sample set;
采用扩充样本集对初步训练的异常检测模型和初始化的分类器进行微调训练，获得目标异常检测模型和目标分类器。The expanded sample set is used to fine-tune the initially trained anomaly detection model and initialized classifier to obtain the target anomaly detection model and target classifier.
一种可选实施方式中，目标模型模块504具体用于：In an optional implementation, the target model module 504 is specifically used to:
按照扩充样本集中各个样本的第一样本权重，迭代从扩充样本集选取样本数据，并采用选取的样本数据对初步训练的异常检测模型和初始化的分类器进行微调训练，获得微调训练的异常检测模型和微调训练的分类器；According to the first sample weight of each sample in the expanded sample set, iteratively select sample data from the expanded sample set, and use the selected sample data to fine-tune the initially trained anomaly detection model and initialized classifier to obtain the anomaly detection of fine-tuned training. Models and fine-tuned trained classifiers;
按照扩充样本集中各个样本的第二样本权重，迭代从扩充样本集合选取样本数据，并采用选取的样本数据对微调训练的异常检测模型和微调训练的分类器进行微调训练，获得目标异常检测模型和目标分类器。According to the second sample weight of each sample in the expanded sample set, iteratively select sample data from the expanded sample set, and use the selected sample data to fine-tune the fine-tuned trained anomaly detection model and the fine-tuned trained classifier to obtain the target anomaly detection model and target classifier.
一种可选实施方式中，还包括第一优化样本模块505；In an optional implementation, it also includes a first optimized sample module 505;
第一优化样本模块505具体用于：The first optimization sample module 505 is specifically used for:
将扩充样本集中原本的训练样本以及置信度大于等于第二阈值的候选样本的第一样本权重设置为第一数值；Set the first sample weight of the original training samples in the expanded sample set and the candidate samples whose confidence level is greater than or equal to the second threshold to the first value;
将置信度大于第一阈值，且小于第二阈值的候选样本的第一样本权重设置为第二数值，其中，第一数值大于第二数值。The first sample weight of the candidate sample whose confidence level is greater than the first threshold and less than the second threshold is set to a second value, where the first value is greater than the second value.
一种可选实施方式中，还包括第二优化样本模块506；In an optional implementation, it also includes a second optimized sample module 506;
第二优化样本模块506具体用于：The second optimization sample module 506 is specifically used for:
将置信度大于第一阈值，且小于第二阈值的候选样本的第二样本权重设置为第一数值；Set the second sample weight of the candidate sample whose confidence is greater than the first threshold and less than the second threshold as the first value;
将扩充样本集合中原本的训练样本以及置信度大于等于第二阈值的候选样本的第一样本权重设置为第二数值，其中，第一数值大于第二数值。The first sample weights of the original training samples and candidate samples with confidence levels greater than or equal to the second threshold in the expanded sample set are set to a second value, where the first value is greater than the second value.
基于相同的技术构思，参见图6，本申请实施例提供了一种异常信息检测装置，包括：Based on the same technical concept, see Figure 6, an embodiment of the present application provides an abnormal information detection device, including:
获取模块601，用于获取待识别用户信息；Acquisition module 601, used to obtain user information to be identified;
检测模块602，用于采用目标异常检测模型和目标分类器，对待识别用户信息进行分类，确定待识别用户信息的目标类别标签，目标类别标签为异常用户标签或正常用户标签，目标异常检测模型和目标分类器是采用如前任一模型训练方法训练获得的。The detection module 602 is used to use the target anomaly detection model and the target classifier to classify the user information to be identified and determine the target category label of the user information to be identified. The target category label is an abnormal user label or a normal user label. The target anomaly detection model and The target classifier is trained using either model training method as described above.
基于相同的技术构思，本申请实施例提供了一种计算机设备，该计算机设备可以是图1所示的终端设备和/或异常检测系统，如图7所示，包括至少一个处理器701，以及与至少一个处理器连接的存储器702，本申请实施例中不限定处理器701与存储器702之间的具体连接介质，图7中处理器701和存储器702之间通过总线连接为例。总线可以分为地址总线、数据总线、控制总线等。Based on the same technical concept, embodiments of the present application provide a computer device. The computer device may be the terminal device and/or anomaly detection system shown in Figure 1. As shown in Figure 7, it includes at least one processor 701, and The memory 702 is connected to at least one processor. In the embodiment of this application, the specific connection medium between the processor 701 and the memory 702 is not limited. In FIG. 7 , the processor 701 and the memory 702 are connected through a bus as an example. The bus can be divided into address bus, data bus, control bus, etc.
在本申请实施例中，存储器702存储有可被至少一个处理器701执行的指令，至少一个处理器701通过执行存储器702存储的指令，可以执行上述模型训练方法以及异常信息检测方法的步骤。In this embodiment of the present application, the memory 702 stores instructions that can be executed by at least one processor 701. By executing the instructions stored in the memory 702, at least one processor 701 can perform the steps of the above model training method and anomaly information detection method.
其中，处理器701是计算机设备的控制中心，可以利用各种接口和线路连接计算机设备的各个部分，通过运行或执行存储在存储器702内的指令以及调用存储在存储器702内的数据，从而实现异常信息检测。可选的，处理器701可包括一个或多个处理单元，处理器701可集成应用处理器和调制解调处理器，其中，应用处理器主要处理操作系统、用户界面和应用程序等，调制解调处理器主要处理无线通信。可以理解的是，上述调制解调处理器也可以不集成到处理器701中。在一些实施例中，处理器701和存储器702可以在同一芯片上实现，在一些实施例中，它们也可以在独立的芯片上分别实现。Among them, the processor 701 is the control center of the computer equipment. It can use various interfaces and lines to connect various parts of the computer equipment, and realize exceptions by running or executing instructions stored in the memory 702 and calling data stored in the memory 702. Information detection. Optionally, the processor 701 may include one or more processing units. The processor 701 may integrate an application processor and a modem processor. The application processor mainly processes the operating system, user interface, application programs, etc., and the modem processor The debug processor mainly handles wireless communications. It can be understood that the above-mentioned modem processor may not be integrated into the processor 701. In some embodiments, the processor 701 and the memory 702 can be implemented on the same chip, and in some embodiments, they can also be implemented on separate chips.
处理器701可以是通用处理器，例如中央处理器(CPU)、数字信号处理器、专用集成电路(Application Specific Integrated Circuit，ASIC)、现场可编程门阵列或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件，可以实现或者执行本申请实施例中公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。The processor 701 may be a general processor, such as a central processing unit (CPU), a digital signal processor, an application specific integrated circuit (ASIC), a field programmable gate array or other programmable logic devices, discrete gates or transistors. Logic devices and discrete hardware components can implement or execute the methods, steps and logical block diagrams disclosed in the embodiments of this application. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in conjunction with the embodiments of the present application can be directly implemented by a hardware processor for execution, or can be executed by a combination of hardware and software modules in the processor.
存储器702作为一种非易失性计算机可读存储介质，可用于存储非易失性软件程序、非易失性计算机可执行程序以及模块。存储器702可以包括至少一种类型的存储介质，例如可以包括闪存、硬盘、多媒体卡、卡型存储器、随机访问存储器(Random AccessMemory，RAM)、静态随机访问存储器(Static Random Access Memory，SRAM)、可编程只读存储器(Programmable Read Only Memory，PROM)、只读存储器(Read Only Memory，ROM)、带电可擦除可编程只读存储器(Electrically Erasable Programmable Read-Only Memory，EEPROM)、磁性存储器、磁盘、光盘等等。存储器702是能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机设备存取的任何其他介质，但不限于此。本申请实施例中的存储器702还可以是电路或者其它任意能够实现存储功能的装置，用于存储程序指令和/或数据。As a non-volatile computer-readable storage medium, the memory 702 can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 702 may include at least one type of storage medium, for example, may include flash memory, hard disk, multimedia card, card-type memory, random access memory (Random Access Memory, RAM), static random access memory (Static Random Access Memory, SRAM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), magnetic memory, disk, CDs etc. Memory 702 is, but is not limited to, any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer device. The memory 702 in the embodiment of the present application can also be a circuit or any other device capable of realizing a storage function, used to store program instructions and/or data.
基于同一发明构思，本申请实施例提供了一种计算机可读存储介质，其存储有可由计算机设备执行的计算机程序，当程序在计算机设备上运行时，使得计算机设备执行上述模型训练方法以及异常信息检测方法的步骤。Based on the same inventive concept, embodiments of the present application provide a computer-readable storage medium that stores a computer program that can be executed by a computer device. When the program is run on the computer device, it causes the computer device to execute the above model training method and abnormal information. Steps of the detection method.
基于同一发明构思，本申请实施例提供了一种计算机程序产品，所述计算机程序产品包括存储在计算机可读存储介质上的计算机程序，所述计算机程序包括程序指令，当所述程序指令被计算机设备执行时，使所述计算机设备执行上述模型训练方法以及异常信息检测方法的步骤。Based on the same inventive concept, embodiments of the present application provide a computer program product. The computer program product includes a computer program stored on a computer-readable storage medium. The computer program includes program instructions. When the program instructions are processed by a computer, When the device is executed, the computer device is caused to execute the steps of the above model training method and anomaly information detection method.
本领域内的技术人员应明白，本发明的实施例可提供为方法、或计算机程序产品。因此，本发明可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本发明可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。Those skilled in the art will understand that embodiments of the present invention may be provided as methods, or computer program products. Thus, the invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.
本发明是参照根据本发明实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其他可编程数据处理设备的处理器以产生一个机器，使得通过计算机设备或其他可编程数据处理设备的处理器执行的指令产生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。The invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each process and/or block in the flowchart illustrations and/or block diagrams, and combinations of processes and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the instructions executed by the processor of the computer device or other programmable data processing device produce Means for implementing the functions specified in a process or processes of a flowchart and/or a block or blocks of a block diagram.
这些计算机程序指令也可存储在能引导计算机设备或其他可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能。These computer program instructions may also be stored in a computer-readable memory that causes a computer device or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction means, The instruction means implements the functions specified in a process or processes of the flowchart and/or a block or blocks of the block diagram.
这些计算机程序指令也可装载到计算机设备或其他可编程数据处理设备上，使得在计算机设备或其他可编程设备上执行一系列操作步骤以产生计算机设备实现的处理，从而在计算机设备或其他可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。These computer program instructions may also be loaded onto a computer device or other programmable data processing device, such that a series of operating steps are performed on the computer device or other programmable device to produce processing implemented by the computer device, thereby causing the computer device or other programmable data processing device to perform a process on the computer device or other programmable data processing device. The instructions executed on the device provide steps for implementing the functions specified in the process or processes of the flow diagrams and/or the block or blocks of the block diagrams.
尽管已描述了本发明的优选实施例，但本领域内的技术人员一旦得知了基本创造性概念，则可对这些实施例作出另外的变更和修改。所以，所附权利要求意欲解释为包括优选实施例以及落入本发明范围的所有变更和修改。Although the preferred embodiments of the invention have been described, those skilled in the art will be able to make additional changes and modifications to these embodiments once the basic inventive concepts are apparent. Therefore, it is intended that the appended claims be construed to include the preferred embodiments and all changes and modifications that fall within the scope of the invention.
显然，本领域的技术人员可以对本发明进行各种改动和变型而不脱离本发明的精神和范围。这样，倘若本发明的这些修改和变型属于本发明权利要求及其等同技术的范围之内，则本发明也意图包含这些改动和变型在内。Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the invention. In this way, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and equivalent technologies, the present invention is also intended to include these modifications and variations.
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311667105.8ACN117743916A (en) | 2023-12-06 | 2023-12-06 | Model training method, abnormal information detection method and device |
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202311667105.8ACN117743916A (en) | 2023-12-06 | 2023-12-06 | Model training method, abnormal information detection method and device |
| Publication Number | Publication Date |
|---|---|
| CN117743916Atrue CN117743916A (en) | 2024-03-22 |
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202311667105.8APendingCN117743916A (en) | 2023-12-06 | 2023-12-06 | Model training method, abnormal information detection method and device |
| Country | Link |
|---|---|
| CN (1) | CN117743916A (en) |
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN119622568A (en)* | 2024-11-20 | 2025-03-14 | 武汉捷沃科技信息服务有限公司 | A method, platform and system for processing automobile industry financial data based on big data |
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN119622568A (en)* | 2024-11-20 | 2025-03-14 | 武汉捷沃科技信息服务有限公司 | A method, platform and system for processing automobile industry financial data based on big data |
| Publication | Publication Date | Title |
|---|---|---|
| CN114187112B (en) | Training method of account risk model and determining method of risk user group | |
| US20220253856A1 (en) | System and method for machine learning based detection of fraud | |
| CN110852447B (en) | Meta learning method and apparatus, initializing method, computing device, and storage medium | |
| WO2021089013A1 (en) | Spatial graph convolutional network training method, electronic device and storage medium | |
| CN111222976B (en) | Risk prediction method and device based on network map data of two parties and electronic equipment | |
| CN112231592B (en) | Graph-based network community discovery method, device, equipment and storage medium | |
| CN111199474B (en) | Risk prediction method and device based on network map data of two parties and electronic equipment | |
| CN114565807B (en) | Method and device for training target image retrieval model | |
| CN112633426B (en) | Method and device for processing data class imbalance, electronic equipment and storage medium | |
| CN112862093A (en) | Graph neural network training method and device | |
| CN111611390B (en) | Data processing method and device | |
| CN118467793B (en) | Heterogeneous graph-oriented graph matching method, device and medium | |
| CN110163378A (en) | Characteristic processing method, apparatus, computer readable storage medium and computer equipment | |
| CN115423040A (en) | User portrait recognition method and AI system for interactive marketing platform | |
| CN114511037A (en) | Automatic feature screening method and device, electronic equipment and storage medium | |
| CN116542673B (en) | Fraud identification method and system applied to machine learning | |
| CN112214402B (en) | Method, device and storage medium for selecting a code verification algorithm | |
| CN117743916A (en) | Model training method, abnormal information detection method and device | |
| CN111259975B (en) | Method and device for generating classifier and method and device for classifying text | |
| CN112257959A (en) | User risk prediction method and device, electronic equipment and storage medium | |
| CN115730234A (en) | User behavior prediction method, device, equipment and medium based on artificial intelligence | |
| CN118097293A (en) | Small sample data classification method and system based on residual graph convolutional network and self-attention | |
| CN111091198A (en) | Data processing method and device | |
| CN117350887A (en) | Method and device for analyzing wax deposition degree of oil pumping unit shaft based on machine learning | |
| CN112861115B (en) | Encryption strategy calling method based on block chain security authentication and cloud authentication server |
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |