Data type recognition, model training and risk recognition methods, apparatuses and devices

DATA TYPE RECOGNITION, MODEL TRAINING AND RISK RECOGNITION METHODS, APPARATUSES AND DEVICES

Technical Field

The present application relates to the technical field of data analysis, especially to data type recognition, model training and risk recognition methods, apparatuses and devices.

Technical Background

In the field of data analysis, the type of data often needs to be recognized, for example, recognizing whether a user account is stolen, recognizing whether a transaction is a risky transaction, recognizing whether a user behavior is a fraudulent behavior, etc. In the relevant art, black and white samples are usually determined according to historical data, wherein the white samples are a type of normal samples in the historical data, and the black samples are the other type of samples indicating events such as account theft, high-risk transactions or fraudulent behaviors in the historical data. After that, a classifier can be obtained by training with the black and white samples based on a classification algorithm.

However, in real life, with respect to normal events, the occurrence probability of events such as account theft, high-risk transactions or fraudulent behaviors is low; therefore, the black and white samples are seriously unbalanced in most scenarios, and the proportion of the black samples in total samples is low. Great challenges will therefore be brought to the training of a classifier, and the accuracy of recognition of the classifier may be low.

Summary of the Invention

In order to overcome the problems existing in the relevant art, the present application provides data type recognition, model training and risk recognition methods, apparatuses and devices.

PI 201 9 00 3977

JUL 2019

A data type recognition method for recognizing data as first-type data or second-type data, wherein the method comprises:

acquiring data to be recognized, and using a preset anomaly detection model to detect whether the data to be recognized is first-type data; and inputting other data than the first-type data recognized by the anomaly detection model, into a classification model for recognition, wherein the classification model classifies the other data as first-type data and second-type data.

Optionally, the anomaly detection model is obtained by pre-training in the following method:

acquiring a first sample data set, wherein an amount of first-type data in the first sample data set is greater than that of second-type data; and using the first sample data set to train the anomaly detection model.

Optionally, the classification model is obtained by training in the following method:

detecting, by the anomaly detection model, an abnormal sample data set from a second sample data set, and using the abnormal sample data set to train the classification model.

Optionally, before using the abnormal sample data set to train the classification model, the method further comprises:

optimizing the abnormal sample data set based on a feature optimization algorithm.

A model training method for training an anomaly detection model and a classification model, the anomaly detection model being used for detecting input data as first-type data, and the classification model being used for classifying other data than the first-type data detected by the anomaly detection model, wherein the method comprises:

training the anomaly detection model in the following method: acquiring a first sample data set, wherein an amount of first-type data in the first sample data set is greater than that of secondtype data; and using the first sample data set to train the anomaly detection model; and training the classification model in the following method: detecting, by the anomaly detection model, an abnormal sample data set from a second sample data set, and using the abnormal sample data set to train the classification model.

Optionally, before using the abnormal sample data set to train the classification model, the method further comprises:

optimizing the abnormal sample data set based on a feature optimization algorithm.

A risk recognition method for recognizing data as secure data or risky data, wherein the method comprises:

acquiring data to be recognized, and using a preset anomaly detection model to detect whether the data to be recognized is abnormal data;

if the data to be recognized is detected not to be abnormal, determining that the data to be recognized is secure data; and if the data to be recognized is detected to be abnormal, using a preset classification model to recognize that the data to be recognized is secure data or risky data, wherein the classification model is obtained by pre-training with an abnormal sample data set recognized by the anomaly detection model.

A data type recognition apparatus for recognizing data as first-type data or second-type data, wherein the apparatus comprises:

a data acquisition module for acquiring data to be recognized, and using a preset anomaly detection model to detect whether the data to be recognized is first-type data; and a type determination module for inputting other data than the first-type data recognized by the anomaly detection model, into a classification model for recognition, wherein the classification model classifies the other data as first-type data and second-type data.

Optionally, the apparatus further comprises an anomaly detection model training module for acquiring a first sample data set, wherein an amount of first-type data in the first sample data set is greater than that of second-type data; and using the first sample data set to train the anomaly detection model.

Optionally, the apparatus further comprises a classification model training module for detecting, by the anomaly detection model, an abnormal sample data set from a second sample data set, and using the abnormal sample data set to train the classification model.

Optionally, the apparatus further comprises an optimization module for optimizing the abnormal sample data set based on a feature optimization algorithm before using the abnormal sample data set to train the classification model.

A model training apparatus for training an anomaly detection model and a classification model, the anomaly detection model being used for detecting input data as first-type data, and the classification model being used for classifying other data than the first-type data detected by the anomaly detection model, wherein the apparatus comprises:

an anomaly detection model training module for acquiring a first sample data set, wherein an amount of first-type data in the first sample data set is greater than that of second-type data; and using the first sample data set to train the anomaly detection model; and a classification model training module for detecting, by the anomaly detection model, an abnormal sample data set from a second sample data set, and using the abnormal sample data set to train the classification model.

Optionally, the apparatus further comprises an optimization module for optimizing the abnormal sample data set based on a feature optimization algorithm before using the abnormal sample data set to train the classification model.

A risk recognition apparatus for recognizing data as secure data or risky data, wherein the apparatus comprises:

a data acquisition module for acquiring data to be recognized, and using a preset anomaly detection model to detect whether the data to be recognized is abnormal; and a risk determination module for, if the data to be recognized is detected not to be abnormal, determining that the data to be recognized is secure data, and if the data to be recognized is detected to be abnormal, using a preset classification model to recognize that the data to be recognized is secure data or risky data, wherein the classification model is obtained by pretraining with an abnormal sample data set recognized by the anomaly detection model.

A computer device, comprising:

a processor; and a memory for storing a processor executable instruction, wherein the processor is configured to:

acquire data to be recognized, and use a preset anomaly detection model to detect whether the data to be recognized is first-type data; and input other data than the first-type data recognized by the anomaly detection model, into a classification model for recognition, wherein the classification model classifies the other data as first-type data and second-type data.

A computer device, comprising:

a processor; and a memory for storing a processor executable instruction, wherein the processor is configured to:

train the anomaly detection model in the following method: acquiring a first sample data set, wherein an amount of first-type data in the first sample data set is greater than that of secondtype data; and using the first sample data set to train the anomaly detection model; and train the classification model in the following method: detecting, by the anomaly detection model, an abnormal sample data set from a second sample data set, and using the abnormal sample data set to train the classification model.

A computer device, comprising:

a processor; and a memory for storing a processor executable instruction, wherein the processor is configured to:

acquire data to be recognized, and using a preset anomaly detection model to detect whether the data to be recognized is abnormal data;

if the data to be recognized is detected not to be abnormal, determine that the data to be recognized is secure data; and if the data to be recognized is detected to be abnormal, use a preset classification model to recognize that the data to be recognized is secure data or risky data, wherein the classification model is obtained by pre-training with an abnormal sample data set recognized by the anomaly detection model.

The technical solutions provided by the embodiments of the present application can have the following beneficial effects:

In the embodiments of the present application, in a training process, an anomaly detection model is firstly obtained by training with a first sample data set; based on this, an abnormal sample data set can be screened out from a full second sample data set. Since a classification model is obtained by training with an abnormal sample data set recognized by the anomaly detection model, most first-type data can be eliminated for the classification model to quickly distinguish samples that are abnormal compared to most samples; and the remaining abnormal samples may contain most second-type data, and some first-type data. After that, the classification model is trained with the abnormal samples. Not only the amount of scoring events for the final classification model is reduced, but also relatively balanced sample data sets can be provided for training the classification model. Since the proportion of first-type data and secondtype data in the abnormal sample data set are relatively balanced, a classification model with higher accuracy can be obtained by training, and thus the data recognition capability can be improved by combining the two parts. During a particular application, an anomaly detection model and a classification model can be deployed online; and data to be recognized is firstly input to the anomaly detection model, so that whether the data to be recognized is abnormal can be quickly distinguished; if yes, then the data is further classified by the classification model.

It should be understood that the general description above and detail description later are merely exemplary and explanatory, and cannot limit the present application.

Brief Description of the Drawings

The accompanying drawings herein are incorporated into the description and constitute a part 10 of the present description, illustrating embodiments satisfying the present application and explaining the principle of the present application together with the description.

Fig. 1A shows a schematic diagram of a model training method according to an exemplary embodiment of the present application.

Fig. IB shows a schematic diagram of anomaly detection according to an exemplary 15 embodiment of the present application.

Fig. 2 shows a schematic diagram of a data type recognition method according to an exemplary embodiment of the present application.

Fig. 3A shows a schematic diagram of a risk recognition method according to an exemplary embodiment of the present application.

Fig. 3B shows a schematic diagram of an application scenario of a model training and risk recognition method according to an exemplary embodiment of the present application.

Fig. 4 is a hardware structure diagram of a computer device for a data type recognition apparatus/model training apparatus/risk recognition apparatus according to the present application is located.

Fig. 5 shows a block diagram of a data type recognition apparatus according to an exemplary embodiment of the present application.

Fig. 6 shows a block diagram of a model training apparatus according to an exemplary embodiment of the present application.

Fig. 7 shows a block diagram of a risk recognition apparatus according to an exemplary embodiment of the present application.

Detailed Description of Embodiments

Exemplary embodiments will be described in detail herein, and examples thereof are illustrated in the accompanying drawings. When the description below refers to the accompanying drawings, the same numbers denote the same or similar elements in different accompanying drawings, unless otherwise indicated. The implementations described in the exemplary embodiments below do not represent all the implementations consistent with the present application. On the contrary, they are merely examples of apparatuses and methods consistent with some aspects of the present application as detailed in the appended claims.

Terms used in the present application are only for the purpose of describing specific embodiments, and are not intended to restrict the present application. Singular forms “a(an)”, “the”, and “this” used in the present application and the appended claims are also intended to include plural forms, unless other meaning is clearly indicated in the context. It should also be understood that the term “and/or” used herein refers to and contains any or all possible combinations of one or more of the associated listed items.

It should be understood that, although terms “first”, “second”, “third”, etc., may be used to describe various information in the present application, these pieces of information should not be limited by these terms. These terms are merely used to distinguish information of the same type from one another. By way of example, without departing from the scope of the present application, first information can also be referred to as second information, and similarly second information can also be referred to as first information. Depending on the context, the word “if’ as used herein can be explained as when” or “at the time of’ or “in response to a determination”.

In the field of data analysis, the type of data often needs to be recognized, for example, recognizing whether there is a user account theft, recognizing whether a transaction is a risky transaction, recognizing whether a user behavior is a fraudulent behavior, etc.

As an example with risk recognition, risk recognition is an important constituent part of a risk control system, and is a primary basis source for risk decisions. With the popularization and progress of machine learning and data mining technologies, using a model for risk recognition has become a trend. Typical risk recognition with a model is to utilize a supervised learning algorithm to build a model and model variables according to historical behaviors and service experience knowledge, and then train the model with black and white labels. Finally, the trained model is deployed online, so as to discriminate risks in real time. Such schemes are not only more precise but also are more difficult to be broken compared to rule-based traditional recognition, but problems and challenges still exist.

On the one hand, black and white samples are seriously unbalanced in most scenarios. In real life, it can be considered to be secure or low-risk most of the time, so the amount of such normal data (white samples) is very large. In comparison, such data (black samples) of high-risk events only occupies a small proportion, such as 1/10⁴ or even a smaller proportion. Therefore, when determining samples with historical data, the black-to-white proportion of the samples will be seriously unbalanced. Though, in many solutions, the proportion of black samples in total training samples will be increased by techniques such as sampling and punishment, the challenges brought to classifiers by sample unbalance cannot be fundamentally solved, and the accuracy of the trained classifier may not be guaranteed.

On the other hand, highly concurrent and massive online data constantly raises higher requirements for the performance of classifiers. An online model should recognize a risk within a short time, such as within 200 ms, otherwise the stability of the system and user experience will be affected. Risk situations and user experience are bringing more challenges to the precision and performance of quick recognition.

Based on this, an embodiment of the present application provide a model training scheme on one aspect. By means of the model training scheme, an anomaly detection model and a classification model can be trained, wherein the anomaly detection model is used for recognizing first-type data by detecting whether input data is abnormal, and the classification model is used for classifying other data than the first-type data recognized by the anomaly detection model. The classification model according to this embodiment is obtained by training with an abnormal sample data set recognized by the anomaly detection model. The anomaly detection model can eliminate most first-type data and can quickly distinguish samples that are abnormal compared to most samples; and the remaining abnormal samples may include most second-type data, and some first-type data. After that, the classification model is trained with the abnormal samples. Not only the amount of scoring events for the final classification model can be reduced, but also relatively balanced sample data sets can be provided for training the classification model. Since the proportion of first-type data and second-type data in the abnormal sample data set are relatively balanced, a classification model with higher accuracy can be obtained by training, and thus the data recognition capability can be improved by combining the two parts. During a particular application, an anomaly detection model and a classification model can be deployed online; and data to be recognized is firstly input to an anomaly detection model, so that whether the data to be recognized is abnormal can be quickly distinguished, and abnormal data is further accurately classified by the classification model. Next, embodiments of the present application are described in detail.

First, a model training process is explained. Fig. 1A is a schematic diagram of a model training method according to an exemplary embodiment of the present application. The model training method is used for training an anomaly detection model and a classification model. The anomaly detection model is used for detecting whether input data is abnormal, so as to detect first-type data; and the classification model is used for classifying other data than the first-type data detected by the anomaly detection model.

The method includes the following steps:

in step 102, the anomaly detection model is trained in the following method: acquiring a first sample data set, wherein an amount of first-type data in the first sample data set is greater than that of second-type data; and using the first sample data set to train the anomaly detection model; and in step 104, the classification model is trained in the following method: detecting, by the anomaly detection model, an abnormal sample data set from a second sample data set, and using the abnormal sample data set to train the classification model.

In the embodiments of the present application, the first-type data and the second-type data are used to distinguish data types, wherein the first-type data refers to a type of data having a larger amount, and the second-type data refers to a type of data having a smaller amount. Under different scenarios, the first-type data and the second-type data can represent different types of data in an application scenario according to the requirement of a particular scenario. For example, as an example with a risk recognition scenario, the amount of low risk secure data is large; and the occurrence probability of high risks is low, and the amount of high-risk data is small; therefore, the first-type data can refer to low-risk secure data, and the second-type data can refer to high-risk data. As an example with an account theft scenario, the amount of normal behavior data is large; and the occurrence probability of account theft is low, and the amount of high-risk data is small; therefore, the first-type data can refer to normal behavior data, and the second-type data can refer to account theft behavior data. In practical application, this can be flexibly determined according to particular scenarios.

In the process of model training, an anomaly detection model is trained first. In particular, a historical data set can be acquired, and the historical data set contains first-type data and secondtype data; further, a feature set including multiple features can be chosen based on service experience; each combination of features represents a characteristic of each pieces of data; and appropriate features can be chosen according to service demands in different application scenarios. For example, in a risk recognition scenario, a feature set can include a historical number of payment days, a payment amount, a payment time, features of a payment device, a user's usage habit, etc. By means of the feature set, each piece of data in a historical data set can be converted into corresponding sample data represented by each feature vector, so as to obtain a sample data set. In this embodiment, for distinction, the sample data set for training an anomaly detection model is referred to as a first sample data set.

Next, the anomaly detection model is trained with the first sample data set; in particular, an initialized anomaly detection model can be determined based on an anomaly detection algorithm, and training is carried out with the first sample data set, to obtain parameter values in the anomaly detection model. In practical application, the anomaly detection algorithm can be flexibly chosen as required, for example, a support vector clustering machine, an isolation tree algorithm, etc.

Taking the support vector clustering machine as an example, support vector clustering is a non-supervised anomaly detection method; and the method can map samples in complex dimensions into a high-dimension space, so that the samples can gather in one region as far as possible. Fig. IB is a schematic diagram of anomaly detection according to an exemplary embodiment of the present application. In Fig. IB, the circle represents a hypersphere, data enclosed within the hypersphere represents normal data and is denoted by a rectangle, and data outside the hypersphere is abnormal data and is denoted by star-shaped graphs. In this embodiment, individuals, the patterns of which are more similar to each other, are closer to each other and are closer to the center, and individuals, the patterns of which are abnormal or different, will be far away from the center. Therefore, a hypersphere can be formed in a mapped highdimension space so as to enclose sample data, so that as much sample data as possible is enclosed inside the hypersphere, and the remaining samples outside the hypersphere can be considered as abnormal data. In a practical usage process, the constraint of the radius (R) of the hypersphere can be determined as required, and it only needs to ensure that normal first-type sample data having a large data amount is enclosed in the sphere; and abnormal data outside the sphere has a low similarity with the normal first-type sample data, and may be first-type data and may also be second-type data. The specific abnormal data selection proportion or the capture force of an abnormal pattern can be represented by an output score of a support vector clustering machine; and according to a practical application scenario, an appropriate size can be obtained by training with a sample data set.

In this embodiment, when an anomaly detection model is trained and is deployed for application, a full sample data set can pass through the anomaly detection model, and an abnormal sample data set therein can be screened out by the anomaly detection model, and the abnormal sample data set can be used for training a classification model. Next, the process of training a classification model is described.

Like the process of training an anomaly detection model, the training of a classification model also needs a sample data set. In this embodiment, a sample data set for training a classification model is referred to as a second sample data set. In practical application, the second sample data set may be different from the first sample data set, and may also be the same sample data set.

In particular training, an abnormal sample data set can be screened out by the anomaly detection model from the full second sample data set; since the input sample data set is not the full set when training the classification model, a large amount of normal first-type data is eliminated, and the only remaining part are abnormal samples which may be first-type data and may also be second-type data; therefore, the black and white sample data are relatively balanced, better facilitating ensuring the consistency of model training and application. After that, the classification model can be trained with the abnormal sample data set; in particular, an initialized classification model can be determined based on a classification algorithm, and training is carried out with the abnormal sample data set to obtain parameter values in the classification model. The classification algorithm can be flexibly chosen as required in practical application, for example, a decision tree, a Bayesian classification algorithm, an artificial neural network, a K-nearest neighbor algorithm or a random forest classification algorithm.

After an abnormal sample data set is screened out using the anomaly detection model, since the features of the abnormal sample data set are features in the above-described feature set, in consideration that the proportion of the first-type data and the second-type data are relatively balanced at this time, the features may be optimized, so as to increase the training speed. In an optional implementation, before using the abnormal sample data set to train the classification model, the method further includes:

optimizing the abnormal sample data set based on a feature optimization algorithm.

In this embodiment, since samples are relatively balanced, a feature optimization algorithm can be used to optimize all the features in an abnormal sample data set, so as to choose a better feature subset and obtain an optimized abnormal sample data set. As a typical method, a genetic algorithm can be used for optimization. By way of example, binary encoding is performed on all the features, wherein 1 indicates choosing to enter the model, and 0 indicates refusing to enter the model; an output score of the model can be used to balance a number of model-entering variables in a fitness function, for example, using a Beyesian Information Criterion (BIC), etc., and the feature optimization algorithm can be flexibly chosen as required in practical application.

The above-mentioned process relates to a model training process, and the application process of a model put online is described next. Fig. 2 is a schematic diagram of a data type recognition method according to an exemplary embodiment of the present application. The scheme can be used for recognizing data as first-type data or second-type data, wherein the method includes the following steps:

in step 202, data to be recognized is acquired, and a preset anomaly detection model is used to detect whether the data to be recognized is first-type data; and in step 204, other data than the first-type data recognized by the anomaly detection model, is input into a classification model for recognition, wherein the classification model classifies the other data as first-type data and second-type data.

It can be seen from the aforementioned model training process that the anomaly detection model is used for detecting whether an input is abnormal, and the classification model can be used for recognizing input abnormal data as first-type data or second-type data. Therefore, in this embodiment, when the type of data needs to be recognized, data to be recognized can be acquired, wherein the data to be recognized has features required by the anomaly detection model when performing detection. According to the features of the data to be recognized, the anomaly detection model is firstly used to detect whether the data to be recognized is abnormal; if the data to be recognized is detected not to be abnormal, the data to be recognized is determined as firsttype data; and if the data to be recognized is detected to be abnormal, then a preset classification model is used to recognize that the data to be recognized is first-type data or second-type data.

The anomaly detection model is obtained by pre-training in the following method:

acquiring a first sample data set, wherein an amount of first-type data in the first sample data set is greater than that of second-type data; and using the first sample data set to train the anomaly detection model.

The classification model is obtained by pre-training in the following method:

detecting, by the anomaly detection model, an abnormal sample data set from a second sample data set; and using the abnormal sample data set to train the classification model.

In an optional implementation, before using the abnormal sample data set to train the classification model, the method further comprises:

optimizing the abnormal sample data set based on a feature optimization algorithm.

For the processes of training the above-mentioned two models, reference can be made to the description of the embodiment shown in Fig. 1A, which will not be elaborated in this embodiment.

Next, the embodiments of the present application are described in detail by taking a risk 5 recognition scenario as an example. Fig. 3A is a risk recognition method according to an exemplary embodiment of the present application, for recognizing data as secure data or risky data, wherein the method includes:

in step 302, data to be recognized is acquired, and a preset anomaly detection model is used to detect whether the data to be recognized is abnormal;

in step 304, if the data to be recognized is detected not to be abnormal, the data to be recognized is determined as secure data; and in step 306, if the data to be recognized is detected to be abnormal, a preset classification model is used to recognize that the data to be recognized is secure data or risky data, wherein the classification model is obtained by pre-training with an abnormal sample data set recognized by 15 the anomaly detection model.

Fig. 3B is a schematic diagram of an application scenario of a model training and risk recognition method according to an exemplary embodiment of the present application. In this embodiment, a risk recognition system combining an anomaly detection model and a classification model can be built, for carrying out risk recognition on input data, so as to 20 recognize whether the input data is low-risk normal data or risky data. The scheme specifically involves anomaly detection, feature optimization and supervised classification learning. In practical application, multiple algorithms can be used in the above-mentioned three processes. In this embodiment, description is made by taking support vector clustering as an example of anomaly detection, taking a genetic algorithm as an example of feature optimization, and taking a 25 random forest as an example of supervised classification learning.

The training process includes:

acquiring historical data, wherein a feature set is firstly selected based on a service scenario to represent risks, such as a historical number of payment days, features of a payment device and a user's usage habit; and determining a sample data set including black and white samples according to the historical data; and using the sample data set to train a set anomaly detection model. In this embodiment, for anomaly detection, a support vector clustering machine is taken as an example, and a sample data set is input into the support vector clustering machine for learning. Support vector clustering is a non-supervised anomaly detection method, and can map samples in complex dimensions into a high-dimension space, so that the samples can gather in one region as far as possible. Gathered data is normal first-type data having a large data amount, and data not gathered in a central region is abnormal data.

As shown in Fig. IB, individuals, the patterns of which are more similar to each other, are closer to each other and are closer to the center, and individuals, the patterns of which are abnormal or different, will be far away from the center. Therefore, a hypersphere can be formed in a mapped high-dimension space so as to enclose samples, so that as many samples as possible are enclosed inside the hypersphere, and the remaining samples outside the hypersphere can be considered as abnormal points. In a practical usage process, the constraint of the radius (R) of the hypersphere can be flexibly set as required, and it only needs to ensure that normal samples are enclosed in the sphere; and an abnormal sample set outside the sphere may include real high-risk samples and some low-risk samples. Therefore, when the model is trained and is deployed online for application, after the full amount of samples passes through the model, non-anomalous samples are directly recognized as low-risk, and abnormal samples are input into a next stage for further analysis and discrimination. The specific abnormal data selection proportion or the capture force of an abnormal pattern can be represented by an output score of a support vector clustering machine; and according to a practical application scenario, an appropriate size can be obtained by training with a sample data set.

An anomaly detection model is used to detect an initial sample data set, and a detected abnormal sample data set can be used to train a classification model. In this embodiment, a random forest classifier is taken as an example of the classification model, and the abnormal sample data set can be input into the random forest classifier for training. Before training the classification model, since the input samples are not the full amount, the black and white samples are relatively balanced, better facilitating ensuring the consistency of model training and application. At this time, a feature optimization algorithm can be used to optimize a feature set, so as to choose a better feature set. As a typical method, a genetic algorithm can be used for optimization. By way of example, binary encoding is performed on all the features, wherein 1 indicates choosing to enter the model, and 0 indicates refusing to enter the model; an output score of the model is used to balance a number of model-entering variables in a fitness function, for example, using the Beyesian Information Criterion (BIC).

During a particular application, data to be recognized can be acquired, and according to features of the data to be recognized, whether the data to be recognized is abnormal can be firstly detected using the anomaly detection model; and if detected not to be abnormal, the data to be recognized is determined as low-risk secure data; and if the data to be recognized is detected to be abnormal, a preset classification model is used to further recognize that the data to be recognized is low-risk secure data or risky data.

Corresponding to the aforementioned embodiments of data type recognition, model training and risk recognition method, the present application also provides embodiments of a data type recognition apparatus, a model training apparatus, a risk recognition apparatus and computer devices applied thereby.

The embodiments of the data type recognition apparatus/model training apparatus/risk recognition apparatus according to the present application can all be applied to a computer device. Apparatus embodiments can be implemented by software, and can also be implemented by hardware or by a combination of software and hardware. As an example of implementing by software, an apparatus in a logical sense, is formed by a processor for data type recognition/model training/risk recognition reading, into a memory, a corresponding computer program instruction in a non-volatile storage. From the hardware level, Fig. 4 is a hardware structure diagram of a computer device for the data type recognition apparatus/model training apparatus/risk recognition apparatus according to the present application. Besides a processor 410, a memory 430, a network interface 420, and a non-volatile storage 440 shown in Fig. 4, apparatuses 431 in the computer device in the embodiments usually can further include other hardware according to actual functions of the computer device, which will not be elaborated.

As shown in Fig. 5, Fig. 5 is a block diagram of a data type recognition apparatus according to an exemplary embodiment of the present application, wherein the apparatus is used for recognizing data as first-type data or second-type data. The apparatus includes:

a data acquisition module 51 for acquiring data to be recognized, and using a preset anomaly detection model to detect whether the data to be recognized is first-type data; and a type determination module 52 for inputting other data than the first-type data recognized by the anomaly detection model, into a classification model for recognition, wherein the classification model classifies the other data as first-type data and second-type data.

Optionally, the apparatus further includes an anomaly detection model training module for acquiring a first sample data set, wherein an amount of first-type data in the first sample data set is greater than that of second-type data; and using the first sample data set to train the anomaly detection model.

Optionally, the apparatus further includes a classification model training module for detecting, by the anomaly detection model, an abnormal sample data set from a second sample data set, and using the abnormal sample data set to train the classification model.

Optionally, the apparatus further includes an optimization module for optimizing the abnormal sample data set based on a feature optimization algorithm before using the abnormal sample data set to train the classification model.

As shown in Fig. 6, Fig. 6 is a block diagram of a model training apparatus according to an exemplary embodiment of the present application, wherein the apparatus is used for training an anomaly detection model and a classification model, the anomaly detection model is used for detecting first-type data, and the classification model is used for classifying other data than the first-type data detected by the anomaly detection model.

The apparatus includes:

an anomaly detection model training module 61 for acquiring a first sample data set, wherein an amount of first-type data in the first sample data set is greater than that of second-type data; and using the first sample data set to train the anomaly detection model; and a classification model training module 62 for detecting, by the anomaly detection model, an abnormal sample data set from a second sample data set, and using the abnormal sample data set to train the classification model.

Optionally, the apparatus further includes an optimization module for optimizing the abnormal sample data set based on a feature optimization algorithm before using the abnormal sample data set to train the classification model.

As shown in Fig. 7, Fig. 7 is a block diagram of a risk recognition apparatus according to an exemplary embodiment of the present application, wherein the apparatus includes:

a data acquisition module 71 for acquiring data to be recognized, and using a preset anomaly detection model to detect whether the data to be recognized is abnormal; and a risk determination module 72 for, if the data to be cognized is detected not to be abnormal, determining that the data to be recognized is secure data; and if the data to be recognized is detected to be abnormal, using a preset classification model to recognize that the data to be recognized is secure data or risky data, wherein the classification model is obtained by pretraining with an abnormal sample data set recognized by the anomaly detection model.

Correspondingly, a computer device is also provided in the present application, including: a processor; and a memory for storing a processor executable instruction, wherein the processor is configured to:

acquire data to be recognized, and use a preset anomaly detection model to detect whether the data to be recognized is first-type data; and input other data than the first-type data recognized by the anomaly detection model, into a classification model for recognition, wherein the classification model classifies the other data as first-type data and second-type data.

Correspondingly, a computer device is also provided in the present application, including a processor; and a memory for storing a processor executable instruction, wherein the processor is configured to:

train the anomaly detection model in the following method: acquiring a first sample data set, wherein an amount of first-type data in the first sample data set is greater than that of secondtype data; and determining an initialized anomaly detection model based on an anomaly detection algorithm, and training with the first sample data set to obtain parameter values in the anomaly detection model; and train the classification model in the following method: detecting, by the anomaly detection model, an abnormal sample data set from a second sample data set; and determining an initialized classification model based on a classification algorithm, and training with the abnormal sample data set to obtain parameter values in the classification model.

Correspondingly, a computer device is also provided in the present application, including a processor; and a memory for storing a processor executable instruction, wherein the processor is configured to:

acquire data to be recognized, and use a preset anomaly detection model to detect whether the data to be recognized is abnormal data; and if the data to be recognized is detected not to be abnormal, determine that the data to be recognized is secure data, and if the data to be recognized is detected to be abnormal, use a preset classification model to recognize that the data to be recognized is secure data or risky data, wherein the classification model is obtained by pre-training with an abnormal sample data set recognized by the anomaly detection model.

For specific details of the process of implementing the function and role of each module in the above-mentioned apparatus, please refer to the process of implementing corresponding steps in the method mentioned above, which will not be elaborated.

For the apparatus embodiments, since they substantially correspond to the method embodiments, the description for the part of the method embodiments can be referred to for relevant content. The apparatus embodiments described above are merely illustrative, wherein the modules described as separate components may or may not be physically separated; and components displayed as modules may or may not be physical modules, i.e., can either be at the same place or be distributed on multiple network modules. The purpose of the solutions of the present application can be realized by choosing some or all of the modules according to actual requirements, and can be understood and embodied by those of ordinary skill in the art without paying any inventive effort.

Those skilled in the art would easily conceive of other implementation solutions of the present applications after contemplating the description and practicing the invention applied herein. The present application is intended to cover any variation, usage or adaptive change of the present application, and these variations, usage and adaptive changes follow the general principle of the present application and include common knowledge or customary technical means in the art not applied by the present application. The description and embodiments are only considered as exemplary, and the real scope of the present application is indicated by the appended claims.

It should be understood that the present application is not limited to the precise structure already described above and shown in the accompanying drawings, and various modifications and changes can be made thereto without departing from the scope of the present application. The scope of the present application is only restricted by the appended claims.

Described above are only preferred embodiments of the present application, and are not used for limiting the present application; and any modification, equivalent replacement, improvement, etc. made within the principle of the present application should fall within the scope of protection of the present application.