CN109727058B - User behavior anomaly detection method, device, electronic device, and readable storage medium - Google Patents
User behavior anomaly detection method, device, electronic device, and readable storage mediumInfo
- Publication number
- CN109727058B CN109727058B CN201811379243.5A CN201811379243A CN109727058B CN 109727058 B CN109727058 B CN 109727058B CN 201811379243 A CN201811379243 A CN 201811379243A CN 109727058 B CN109727058 B CN 109727058B
- Authority
- CN
- China
- Prior art keywords
- image
- preset
- user
- shooting
- similarity value
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Landscapes
- Image Analysis (AREA)
Abstract
本公开的实施例提供了一种用户行为异常检测方法、装置、电子设备及可读存储介质，所述方法包括：检测到用户访问商家时发起的预设业务行为，向用户发起针对所述业务行为的拍摄请求；获取用户针对所述拍摄请求拍摄的第一图像；获取对应所述第一图像的预置模板图像；根据预置模板图像与所述第一图像的所述图像特征，获取所述第一图像与所述预置模板图像之间的相似度值；在所述相似度值低于预设相似度阈值时，确定所述用户的访问行为存在异常。能够根据用户访问商家时的拍摄数据与预置模板图像之间的相似度，判断用户的访问行为是否存在异常，提高异常排查的效率。
Embodiments of the present disclosure provide a method, apparatus, electronic device, and readable storage medium for detecting abnormal user behavior. The method comprises: detecting a preset business behavior initiated by a user when visiting a merchant, initiating a capture request to the user for the business behavior; obtaining a first image captured by the user in response to the capture request; obtaining a preset template image corresponding to the first image; obtaining a similarity value between the preset template image and the first image based on the image features of the preset template image and the first image; and determining that the user's access behavior is abnormal when the similarity value is lower than a preset similarity threshold. The method can determine whether the user's access behavior is abnormal based on the similarity between the captured data when the user visits the merchant and the preset template image, thereby improving the efficiency of abnormality detection.
Description
Technical Field
The embodiment of the disclosure relates to the technical field of detection, in particular to a method and a device for detecting abnormal user behaviors, electronic equipment and a readable storage medium.
Background
In the technical field of detection, verification of authenticity of merchant evaluation is often performed through access records made by a customer manager for merchant visits. For example, the manager checks the authenticity of the merchant evaluation through the access records of the client manager, and discovers the problems and the places to be improved.
However, according to the method for checking the authenticity of the merchant evaluation, the problems are that the data base is large during manual checking, whether the records recorded by a client manager into a system are real and effective or not is difficult to check, real feedback is difficult to obtain if a store visit is not available, and the checking efficiency is low.
Disclosure of Invention
The embodiment of the disclosure provides a user behavior abnormality detection method, a device, electronic equipment and a readable storage medium, which are used for improving the efficiency of abnormality detection.
According to a first aspect of embodiments of the present disclosure, there is provided a user behavior anomaly detection method, the method including:
Detecting a preset business behavior initiated when a user accesses a merchant, and initiating a shooting request aiming at the business behavior to the user;
Acquiring a first image shot by a user aiming at the shooting request;
Acquiring a preset template image corresponding to the first image;
Obtaining a similarity value between a first image and a preset template image according to the image characteristics of the preset template image and the first image;
and when the similarity value is lower than a preset similarity threshold value, determining that the access behavior of the user is abnormal.
According to a second aspect of embodiments of the present disclosure, there is provided a user behavior abnormality detection apparatus including:
The shooting request initiating module is used for detecting preset business behaviors initiated when a user accesses a merchant and initiating shooting requests aiming at the business behaviors to the user
The first image acquisition module is used for acquiring a first image shot by a user aiming at the shooting request;
the preset template image acquisition module is used for acquiring a preset template image corresponding to the first image;
the similarity value acquisition module is used for acquiring a similarity value between the first image and the preset template image according to the image characteristics of the preset template image and the first image;
the first abnormality determination module is used for determining that the access behavior of the user is abnormal when the similarity value is lower than a preset similarity threshold value.
According to a third aspect of embodiments of the present disclosure, there is provided an electronic device comprising:
the system comprises a processor, a memory and a computer program stored in the memory and capable of running on the processor, and is characterized in that the processor executes the program to realize the method for detecting the abnormal user behavior.
According to a fourth aspect of embodiments of the present disclosure, there is provided a readable storage medium, which when executed by a processor of an electronic device, enables the electronic device to perform the aforementioned user behavior anomaly detection method.
The embodiment of the disclosure provides a method, a device, electronic equipment and a readable storage medium for detecting abnormal user behaviors, wherein the method comprises the steps of detecting preset business behaviors initiated when a user accesses a business, initiating a shooting request for the business behaviors to the user, acquiring a first image shot by the user for the shooting request, acquiring a preset template image corresponding to the first image, acquiring a similarity value between the first image and the preset template image according to the image characteristics of the preset template image and the first image, and determining that the access behaviors of the user are abnormal when the similarity value is lower than a preset similarity threshold. According to shooting data when a user accesses a merchant, whether the access behavior of the user is abnormal or not can be monitored, and the efficiency of abnormality investigation is improved.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings that are required to be used in the description of the embodiments of the present disclosure will be briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present disclosure, and other drawings may be obtained according to these drawings without inventive effort to a person of ordinary skill in the art.
FIG. 1 illustrates a flow chart of steps of a user behavior anomaly detection method in one embodiment of the present disclosure;
FIG. 2 illustrates a flow chart of steps of a user behavior anomaly detection method in another embodiment of the present disclosure;
FIG. 3 illustrates a block diagram of a user behavior anomaly detection device in one embodiment of the present disclosure;
FIG. 4 illustrates a block diagram of a user behavior anomaly detection device in another embodiment of the present disclosure;
Fig. 5 shows a block diagram of an electronic device provided by an embodiment of the present disclosure.
Detailed Description
The technical solutions of the embodiments of the present disclosure will be clearly and completely described below with reference to the drawings in the embodiments of the present disclosure, and it is apparent that the described embodiments are some embodiments of the present disclosure, but not all embodiments. All other embodiments, which can be made by one of ordinary skill in the art without inventive effort, based on the embodiments of the present disclosure are intended to be within the scope of the embodiments of the present disclosure.
Example 1
Referring to fig. 1, which shows a flowchart of steps of a user behavior anomaly detection method in one embodiment of the present disclosure, comprising:
step 101, detecting a preset business behavior initiated when a user accesses a merchant, and initiating a shooting request aiming at the business behavior to the user.
In the embodiment of the disclosure, in a user-to-store authenticity detection scenario, when a user performs a business operation to a store, an application platform may issue a verification task to the user of a store access behavior, and the verification task requests the user to shoot image data of a specified scene in the store of the store, for example, when the user performs an ordering, payment and evaluation operation to the store, real image data of a corresponding ordering, payment and evaluation object is sent to the user, the user can shoot according to a prompt, for example, the shooting scene corresponding to the ordering operation is dish image data, the shooting scene corresponding to the payment operation is bill and ticket image data, the shooting scene corresponding to the evaluation operation is image data of an evaluation object, for example, the in-store environment, dish quality, the image data of a top of the store, the image data paved by a star poster in the store, the label check image data and the like.
Of course, in practical applications, the preset business behavior and the corresponding shooting scenario are not limited to the above description, and the embodiments of the present disclosure are not limited thereto.
102, Acquiring a first image shot by a user aiming at the shooting request;
According to the embodiments of the present disclosure, according to the above description, after a user receives a photographing request, image data of a corresponding scene is photographed as a first image according to the photographing request and uploaded. Of course, the first image is a designation as pointer image data, regardless of the order.
The user can select the preset scene tag to mark the first image when shooting the image, so that the first image can be screened later.
The first image that requires the user to upload may be a static first image or a dynamic first image, which is not limited in the embodiments of the present disclosure.
In the embodiment of the disclosure, after the first image uploaded by the user is acquired, the image meta information can be acquired from the first image as detection information to determine whether the access behavior of the user is abnormal.
Specifically, the image meta information generally includes image capturing time, positioning information, capturing device information, fingerprint information, and the like.
Of course, the image meta information is not limited to the above description, and the embodiments of the present disclosure are not limited thereto.
And step 103, acquiring a preset template image corresponding to the first image.
In the embodiment of the disclosure, the first image of the template preset in the system is searched according to the label in the first image shot by the user according to the corresponding scene, for example, the first image of the shop front, the first image of the shop star poster, the first image of the desk poster, and the like, which are taken as the template image, can be taken as the real first image of the shop uploaded by the shop in advance.
Of course, the template image is not limited to the above description, which is not limited by the embodiments of the present disclosure.
Step 104, obtaining a similarity value between the first image and the preset template image according to the image characteristics of the preset template image and the first image.
In the embodiment of the disclosure, comparing a first image uploaded by a user in real time with a template image of a corresponding scene, obtaining similarity data, and judging whether the first image shot by the user is a real first image aiming at the same scene or not according to the similarity data.
Of course, the template data may be provided by a merchant or may be set by a system, for example, a star poster of a daycare, and the template data provided by the merchant is also screened by the system through a unified rule, after setting, the template data cannot be modified by the merchant at will, and the setting mode and the source of the template data are not limited by the embodiment of the disclosure.
Preferably, step 104 specifically includes:
Sub-step A1, splitting the preset template image into a plurality of first image partitions with preset sizes;
A sub-step A2 of marking the weight value of each first image partition in the preset template image according to the image characteristics;
Specifically, taking a preset template image as a star poster as an example, splitting the template photo into 3*3 blocks, artificially setting the weight W [ 1..9 ] of each region, and recording the size of the ith region as R [ W/3, h/3], wherein the region with higher recognition degree is provided with higher weight, such as a star face region on the poster and a product region or a brand region of a substitution language, the region with lower relative recognition degree is provided with a lower-level weight value, and the like is provided with a weight value for each region.
It can be appreciated that, regarding the size of the dividing area of the template image, the size of the dividing area may be adjusted according to the recognition accuracy, if the recognition result with high accuracy is to be obtained, the template image is divided into a small area and a large area and a small area, so the manner of dividing the area is not limited to the above-described 3*3 block, and the embodiments of the present disclosure are not limited thereto.
A sub-step A3 of matching the first image with the preset template image through affine transformation to obtain a matched first image;
Specifically, because the angle of the shot photo may be inclined and stretched, the photo is far from the preset template photo, and affine transformation is needed for better processing. If the material photo (preset template image) has obvious yellow, firstly, edge detection is needed to judge the largest yellow rectangular area, then, positioning is carried out according to three points of the upper left corner, the upper right corner and the lower left corner, the material photo corresponds to the yellow in the template, and affine transformation is used for solving a transformation matrix of the material photo.
And sequentially corresponding the three points of the upper left corner, the upper right corner and the left corner to the template, solving the matrixes A and B, carrying out affine transformation on the whole picture, and stretching the picture to be close to the size of the template picture.
And a sub-step A4 of splitting the matched first image into a plurality of second image partitions with preset sizes according to the mapping relation of the first image partitions on the matched first image.
Specifically, the areas corresponding to the dividing areas of the template images are subjected to moving comparison on the image areas shot by the matched users, namely, the preset template images are subjected to moving comparison with the photos shot by the users through a sliding window method, so that the areas corresponding to the first dividing areas form dividing areas on the matched first images, the matched first images are correspondingly divided into a plurality of second image dividing areas with preset sizes, for example, the template images are divided into 3*3 blocks, and then the corresponding first images are also divided into 3*3 blocks so as to be compared one by one.
A sub-step A5 of obtaining each first similarity between each first image partition and each second image partition;
Specifically, for the divided template image and the first image shot by the user, the first image shot by the user is grayed according to the self-adaptive Otsu method, and the maximum similarity S [ i ] between the template image and the shot image is calculated by using a template matching algorithm.
The template matching algorithm is specifically as follows:
For the store photo taken by the user, a template photo S [1] S [9] of the category to which the photo belongs is found, and the similarity S [ i, j ] of the two images at the window moving position [ i, j ] is calculated.
Wherein SD represents the gray value of the template gray photo minus the average value, OD represents the gray value of the user gray photo minus the average value, x epsilon [0,3/w ], y epsilon [0, h/3], finally finding max (S [ i, j ]) as the similarity of the template and the user taken photo.
The adaptive Otsu method is also called as an Otsu method, and is a method for segmenting an image threshold, and is a method for adaptively searching a binarized threshold, dividing the image into a background and a target 2 part according to the gray characteristic of the image, wherein the larger the inter-class variance between the background and the target is, the larger the difference of the 2 parts forming the image is, and the smaller the difference of the 2 parts is caused when part of the target is divided into the background or part of the background is divided into the target in a wrong way. After the fast gray value of each region of the template image and the shot first image is obtained by the method, the template image is taken as a background image, the shot image is taken as a foreground image, and the inter-class variance S [ i ] of each region is respectively obtained and is taken as the maximum similarity between the template image and the shot image.
Of course, in practical applications, the method of calculating the similarity between the two first images is not limited to the above description, and the embodiments of the present disclosure do not calculate this.
It will be appreciated that for different similarity calculation methods, the requirements for the template image and capturing the first image are different, such as image characteristics of resolution, format, etc., as the embodiments of the present disclosure are not limited in this regard.
And a sub-step A6 of obtaining the similarity value between the first image and the preset template image according to the weighted sum of the first similarity and the weight value of each first image partition.
Specifically, after obtaining the maximum similarity S [ i ] between the template picture and the photographed picture, calculating the final similarity between the template picture and the photographed picture according to the specific weight value of each template region corresponding to S [ i ], that is, finally, weighting and summing the similarity and the weight value of all the template pictures to obtain w=w [ i ] S [ i ], wherein W is the final similarity.
Preferably, the number of the first images is a plurality, each first image corresponds to one preset template image, and the step 104 includes:
A substep C1, for each first image, obtaining a first similarity between the first image and the preset template image according to the preset template image corresponding to the first image and the image characteristics of the first image;
Specifically, according to the description of the above steps, the user may be requested to respond to a plurality of requested first images in a store, each first image or each requested first image corresponding to a preset template image, when the user accesses the store.
And comparing the image features of the first image with a preset template image to obtain the first similarity. Of course, the image features are determined by an image processing method according to the kind of the template image, for example, the preset template image is a portrait image, and then the image features are face features. Therefore, the embodiment of the present invention is not limited as to the kind of image features.
Step C2, calculating the first similarity value corresponding to each first image according to a preset proportion to obtain a comprehensive similarity value;
Specifically, the method for calculating the comprehensive similarity may be simple accumulation of a plurality of similarities, or may be to set a similarity duty ratio for the first images according to importance degrees of different first images, and accumulate products of the first similarities and the similarity duty ratios of the plurality of first images to obtain a comprehensive similarity value.
And 105, determining that the access behavior of the user is abnormal when the similarity value is lower than a preset similarity threshold value.
In the embodiment of the disclosure, when the similarity value between the first image and the preset template image is lower than the preset threshold, the photographed first image is considered to be suspected to be false, and then the access behavior of the user is considered to be abnormal.
Preferably, step 105, according to sub-steps C1-C2, comprises in particular:
and D1, determining that the access behavior of the user is abnormal when the comprehensive similarity value is lower than a preset similarity threshold value.
Specifically, according to the description of the substep C1, when the number of the first images is plural, a comprehensive similarity value including plural first similarities is calculated according to the first similarity value obtained by comparing each of the first images with the corresponding preset template image, and when the comprehensive similarity value is lower than the preset similarity threshold, it is determined that the access behavior of the user is abnormal.
In summary, the embodiment of the disclosure provides a method for detecting abnormal user behaviors, which comprises the steps of detecting preset business behaviors initiated when a user accesses a business, initiating a shooting request for the business behaviors to the user, acquiring a first image shot by the user for the shooting request, acquiring a preset template image corresponding to the first image, acquiring a similarity value between the first image and the preset template image according to the image characteristics of the preset template image and the first image, and determining that the abnormal user accesses behaviors exist when the similarity value is lower than a preset similarity threshold. According to the similarity between the shooting data and the preset template image when the user accesses the merchant, whether the access behavior of the user is abnormal or not can be judged, and the efficiency of abnormality investigation is improved.
Example two
Referring to fig. 2, a flowchart illustrating steps of a user behavior anomaly detection method in another embodiment of the present disclosure is shown, in particular as follows.
Step 201, detecting a preset business behavior initiated when a user accesses a merchant, and initiating a shooting request aiming at the business behavior to the user;
This step is the same as step 101 and will not be described in detail here.
Step 202, acquiring a first image shot by a user aiming at the shooting request;
this step is the same as step 102 and will not be described in detail here.
Step 203, acquiring shooting time and positioning information of the first image.
In the embodiment of the disclosure, the geographic position of shooting of the first image is determined through positioning information in the image meta-information, and shooting time information in the image meta-information is acquired.
It will be appreciated that the point in time at which a record was entered is considered to be suspected as false if a number of records were included for a short period of time.
It will be appreciated that in the presence of a chain merchant, using the same portal first image or poster data, it is not possible to determine whether the user actually accesses the storefront specified therein, so that a determination by geographic location is required.
Step 204, determining the shooting frequency and/or the shooting position of the first image according to the shooting time and the positioning information;
Specifically, the shooting frequency of the first image may be calculated by shooting time, and if a plurality of uploading records of the first image of the user are contained in a short time, the access behavior of the suspected user is abnormal.
And step 205, determining that the access behavior of the user is abnormal when the shooting frequency or the shooting position exceeds a preset threshold.
Specifically, by the specific position of the first image, the frequency of shooting is determined to determine whether the shot first image is actually shot from the user to the shop front, and if any information is within a set threshold, it is determined that the access behavior of the user is abnormal, that is, unreal.
It can be appreciated that, by the distance between the shooting location of the user and the shop registration address of the shop, if the distance exceeds the preset distance, it can be determined that the first image is not a real shooting of the user to the shop, and the access behavior of the user is abnormal.
Of course, in practical application, the abnormality detection of the first image may be determined in combination with various information, which is not limited to the above description, and the embodiments of the present disclosure are not limited thereto.
And judging whether the distance between the geographic position and the labeling position of the store on the platform is smaller than a set distance threshold value, and if the distance is smaller than the set distance threshold value, considering that the access behavior of the user is abnormal.
Preferably, the method further comprises:
And step B1, acquiring the picture attribute information of the first image.
Specifically, after a first image shot by a user is acquired, judging the authenticity of the image according to the attribute information of the first image.
It may be understood that the attribute information may be information specific to the shooting requirement, such as fingerprint information of the first image, and shooting device information of the first image, and may be different for different shooting requirements, which is not limited by the embodiments of the present disclosure.
Step B2, determining the Hamming distance and shooting equipment information of the first image according to the picture attribute information;
Specifically, after capturing device information in the first image is acquired, historical capturing device information in the historical first image uploaded by the user is acquired.
The first image includes an Exchangeable IMAGE FILE format, is set for a photo of a digital camera, and can record shooting device information of the digital photo.
Preferably, step B2 comprises:
Step B21, the detection information comprises fingerprint data, and the current fingerprint vector of the first image is obtained by adopting the data fingerprint;
specifically, in the photographed first images, each first image has a uniquely identifiable code at the time of device production, and the code is calculated as pHash fingerprint data of the first image using the value pHash as the current fingerprint vector of the first image.
Wherein pHash is a perceptual hash algorithm, which is a type of hash algorithm, and is used for searching similar pictures mainly by calculating pHash values of the first image codes.
Step B22, acquiring a history fingerprint vector of a preset history first image;
Specifically, a historical first image uploaded by the user for the current merchant is obtained, and a unique identifiable code of the historical first image is also obtained, and pHash fingerprint data of the unique identifiable code is calculated and used as a historical fingerprint vector of the historical first image.
Step B23, calculating the Hamming distance between the first image and a preset historical first image according to the current fingerprint vector and the historical fingerprint vector;
Specifically, the hamming distance between the current fingerprint vector and the historical fingerprint vector is calculated, wherein the hamming distance represents the number of different bits corresponding to two (same length) words, and we represent the hamming distance between the two words x, y by d (x, y). And performing exclusive OR operation on the two character strings, and counting the number of which is 1, wherein the number is the Hamming distance.
And B3, determining that the access behavior of the user is abnormal when the Hamming distance is smaller than a preset distance threshold value and/or the shooting equipment information is inconsistent with the historical shooting equipment information.
Specifically, when the calculated hamming distance is smaller than a preset distance threshold, the access behavior of the user is suspected to be abnormal.
Specifically, obtaining EXIF information of the current first image, and if the EXIF information is changed from historical equipment information, namely, historical EXIF information, considering that the access behavior of a merchant of a user is abnormal.
For example, by a change in EXIF information, it can be determined that the user may ask other person to take a picture of a store.
Of course, in practical applications, the user may also cause variations in EXIF information if the device is replaced. Therefore, a time threshold may be set for the detection, that is, after the number of times the user uses the new configuration to take a photograph is greater than a certain number, the new device is considered to be a default device of the user, and the user is identified that the first image taken by the user using the device is true.
It may be understood that obtaining meta information, attribute information, and image features of the first image to perform similarity calculation are all determination bases used in the embodiments of the disclosure, where the above factors may be used as a layer-by-layer determination method, or only one of them may be used as a determination base, and the determination method is not limited to the foregoing description in practical application, and the embodiments of the disclosure are not limited thereto.
It will be appreciated that the accuracy of detection may be higher when anomaly detection is performed in combination with a plurality of the above-described ways.
In summary, the embodiment of the disclosure provides a method for detecting abnormal user behavior, which comprises the steps of detecting preset business behavior initiated when a user accesses a business, initiating a shooting request for the business behavior to the user, and acquiring a first image shot by the user for the shooting request. The method comprises the steps of obtaining shooting time and positioning information of a first image, determining shooting frequency and/or shooting position of the first image according to the shooting time and the positioning information, and determining that the access behavior of a user is abnormal when the shooting frequency or the shooting position exceeds a preset threshold. According to the method and the device, whether the access behavior of the user is abnormal or not can be judged according to the information obtained from the shooting data when the user accesses the merchant, so that the efficiency of abnormality detection is improved, in addition, abnormality detection can be performed in a mode of combining multiple first image information, and the detection accuracy is improved.
Example III
Referring to fig. 3, a block diagram of a user behavior abnormality detection apparatus in one embodiment of the present disclosure is shown, specifically as follows.
The shooting request initiating module 301 is configured to detect a preset service behavior initiated when a user accesses a merchant, and initiate a shooting request for the service behavior to the user;
a first image obtaining module 302, configured to obtain a first image that is captured by a user for the capturing request;
a preset template image obtaining module 303, configured to obtain a preset template image corresponding to the first image;
a similarity value obtaining module 304, configured to obtain a similarity value between a preset template image and the first image according to the image features of the preset template image and the first image;
Preferably, the similarity value obtaining module 304 includes:
The first splitting module is used for splitting the preset template image into a plurality of first image partitions with preset sizes;
the weight marking sub-module is used for marking the weight value of each first image partition in the preset template image according to the image characteristics;
a matching first image obtaining sub-module, configured to match the first image with the preset template image through affine transformation, to obtain a matching first image;
The second splitting sub-module is used for splitting the matched first image into a plurality of second image partitions with preset sizes according to the mapping relation of the first image partitions on the matched first image;
a first similarity obtaining sub-module, configured to obtain each first similarity between each first image partition and each second image partition;
and the similarity value obtaining sub-module is used for obtaining the similarity value between the first image and the preset template image according to the weighted sum of the first similarity and the weight value of each first image partition.
Preferably, the number of the first images is a plurality, each first image corresponds to one preset template image, and the similarity value obtaining module 304 includes:
The first similarity value acquisition sub-module is used for acquiring a first similarity value between each first image and a preset template image according to the preset template image corresponding to the first image and the image characteristics of the first image;
The first anomaly determination module 305 is configured to determine that an anomaly exists in the access behavior of the user when the similarity value is lower than a preset similarity threshold.
Preferably, the first anomaly determination module 305 includes:
And the first abnormality determination submodule is used for determining that the access behavior of the user is abnormal when the comprehensive similarity value is lower than a preset similarity threshold value.
In summary, the embodiment of the disclosure provides a device for detecting abnormal user behaviors, which comprises a shooting request initiating module, a first image acquiring module, a preset template image acquiring module, a similarity value acquiring module and a first abnormality determining module, wherein the shooting request initiating module is used for detecting preset business behaviors initiated when a user accesses a business, the shooting request aiming at the business behaviors is initiated to the user, the first image acquiring module is used for acquiring a first image shot by the user aiming at the shooting request, the preset template image acquiring module is used for acquiring a preset template image corresponding to the first image, the similarity value acquiring module is used for acquiring a similarity value between the first image and the preset template image according to the image characteristics of the preset template image and the first image, and the first abnormality determining module is used for determining that the access behaviors of the user are abnormal when the similarity value is lower than a preset similarity threshold. According to the similarity between the shooting data and the preset template image when the user accesses the merchant, whether the access behavior of the user is abnormal or not can be judged, and the efficiency of abnormality investigation is improved.
The detailed description of the third embodiment of the apparatus corresponding to the first embodiment of the method may refer to the first embodiment, and will not be repeated herein.
Example IV
Referring to fig. 4, a block diagram of a user behavior abnormality detection apparatus in another embodiment of the present disclosure is shown, concretely as follows.
The shooting request initiating module 401 is configured to detect a preset service behavior initiated when a user accesses a merchant, and initiate a shooting request for the service behavior to the user;
A first image obtaining module 402, configured to obtain a first image that is captured by a user for the capturing request;
A capturing time and positioning information obtaining module 403, configured to obtain capturing time and positioning information of the first image.
A shooting frequency calculation module 404, configured to determine a shooting frequency and/or a shooting position of the first image according to the shooting time and the positioning information;
and a second abnormality determination module 405, configured to determine that an abnormality exists in the access behavior of the user when the shooting frequency or the shooting position exceeds a preset threshold.
Preferably, the method further comprises:
The picture attribute information acquisition module is used for acquiring picture attribute information of the first image;
The Hamming distance determining module is used for determining the Hamming distance of the first image and shooting equipment information according to the picture attribute information;
preferably, the picture attribute information includes fingerprint data, and the hamming distance determining module includes:
a fingerprint vector obtaining sub-module, configured to obtain a current fingerprint vector of the first image by using the data fingerprint;
the historical fingerprint vector acquisition sub-module is used for acquiring a historical fingerprint vector of a preset historical first image;
And the Hamming distance calculating sub-module is used for calculating the Hamming distance between the first image and a preset historical first image according to the current fingerprint vector and the historical fingerprint vector.
And the third abnormality determination module is used for determining that the access behavior of the user is abnormal when the Hamming distance is smaller than a preset distance threshold value and/or the shooting equipment information is inconsistent with the historical shooting equipment information.
In summary, the embodiment of the disclosure provides a device for detecting abnormal user behaviors, which comprises a shooting request initiating module, a first image acquiring module, a shooting time and positioning information acquiring module and a first image acquiring module, wherein the shooting request initiating module is used for detecting preset business behaviors initiated when a user accesses a business, the shooting request aiming at the business behaviors is initiated to the user, the first image acquiring module is used for acquiring a first image shot by the user aiming at the shooting request, and the shooting time and positioning information acquiring module is used for acquiring the shooting time and positioning information of the first image. The system comprises a shooting time calculation module, a shooting frequency calculation module and a second abnormality determination module, wherein the shooting time calculation module is used for determining the shooting frequency and/or the shooting position of the first image according to the shooting time and the positioning information, and the second abnormality determination module is used for determining that the access behavior of the user is abnormal when the shooting frequency or the shooting position exceeds a preset threshold value. According to the method and the device, whether the access behavior of the user is abnormal or not can be judged according to the information obtained from the shooting data when the user accesses the merchant, so that the efficiency of abnormality detection is improved, in addition, abnormality detection can be performed in a mode of combining multiple first image information, and the detection accuracy is improved.
The details of the method embodiment two corresponding to the device embodiment four may refer to embodiment two, and will not be described herein.
The embodiment of the disclosure further provides an electronic device, referring to fig. 5, including a processor 501, a memory 502, and a computer program 5021 stored on the memory and executable on the processor, where the processor implements the method for detecting user behavior anomalies in the foregoing embodiment when executing the program.
Embodiments of the present disclosure also provide a readable storage medium, which when executed by a processor of an electronic device, enables the electronic device to perform the user behavior anomaly detection method of the foregoing embodiments.
For the device embodiments, since they are substantially similar to the method embodiments, the description is relatively simple, and reference is made to the description of the method embodiments for relevant points.
The algorithms and displays presented herein are not inherently related to any particular computer, virtual system, or other apparatus. Various general-purpose systems may also be used with the teachings herein. The required structure for a construction of such a system is apparent from the description above. In addition, embodiments of the present disclosure are not directed to any particular programming language. It will be appreciated that the contents of the embodiments of the present disclosure described herein may be implemented using various programming languages, and the above description of specific languages is provided for disclosure of enablement and best mode of the embodiments of the present disclosure.
In the description provided herein, numerous specific details are set forth. However, it is understood that embodiments of the disclosure may be practiced without these specific details. In some instances, well-known methods, structures and techniques have not been shown in detail in order not to obscure an understanding of this description.
Similarly, it should be appreciated that in the foregoing description of exemplary embodiments of the disclosure, various features of embodiments of the disclosure are sometimes grouped together in a single embodiment, figure, or description thereof for the purpose of streamlining the disclosure and aiding in the understanding of one or more of the various inventive aspects. This method of disclosure, however, is not to be interpreted as reflecting an intention that the claimed embodiments of the disclosure require more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive aspects lie in less than all features of a single foregoing disclosed embodiment. Thus, the claims following the detailed description are hereby expressly incorporated into this detailed description, with each claim standing on its own as a separate embodiment of this disclosure.
Those skilled in the art will appreciate that the modules in the apparatus of the embodiments may be adaptively changed and disposed in one or more apparatuses different from the embodiments. The modules or units or components of the embodiments may be combined into one module or unit or component and, furthermore, they may be divided into a plurality of sub-modules or sub-units or sub-components. Any combination of all features disclosed in this specification (including any accompanying claims, abstract and drawings), and all of the processes or units of any method or apparatus so disclosed, may be used in combination, except insofar as at least some of such features and/or processes or units are mutually exclusive. Each feature disclosed in this specification (including any accompanying claims, abstract and drawings), may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise.
Various component embodiments of the present disclosure may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that some or all of the functions of some or all of the components in a sorting device according to embodiments of the present disclosure may be implemented in practice using a microprocessor or Digital Signal Processor (DSP). Embodiments of the present disclosure may also be implemented as a device or apparatus program for performing part or all of the methods described herein. Such a program implementing embodiments of the present disclosure may be stored on a computer readable medium or may have the form of one or more signals. Such signals may be downloaded from an internet website, provided on a carrier signal, or provided in any other form.
It should be noted that the above-mentioned embodiments illustrate rather than limit the embodiments of the disclosure, and that those skilled in the art will be able to design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. The word "comprising" does not exclude the presence of elements or steps not listed in a claim. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. Embodiments of the present disclosure may be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by one and the same item of hardware. The use of the words first, second, third, etc. do not denote any order. These words may be interpreted as names.
It will be clear to those skilled in the art that, for convenience and brevity of description, specific working procedures of the above-described systems, apparatuses and units may refer to corresponding procedures in the foregoing method embodiments, and are not repeated herein.
The foregoing description of the preferred embodiments of the present disclosure is not intended to limit the embodiments of the present disclosure, but is intended to cover any modifications, equivalents, and improvements made within the spirit and principles of the embodiments of the present disclosure.
The foregoing is merely a specific implementation of the embodiments of the disclosure, but the protection scope of the embodiments of the disclosure is not limited thereto, and any person skilled in the art can easily think about changes or substitutions within the technical scope of the embodiments of the disclosure, and the changes or substitutions are intended to be covered by the protection scope of the embodiments of the disclosure. Therefore, the protection scope of the embodiments of the present disclosure shall be subject to the protection scope of the claims.
Claims (12)
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811379243.5A CN109727058B (en) | 2018-11-19 | 2018-11-19 | User behavior anomaly detection method, device, electronic device, and readable storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811379243.5A CN109727058B (en) | 2018-11-19 | 2018-11-19 | User behavior anomaly detection method, device, electronic device, and readable storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN109727058A CN109727058A (en) | 2019-05-07 |
| CN109727058B true CN109727058B (en) | 2025-08-08 |
Family
ID=66295480
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811379243.5A Active CN109727058B (en) | 2018-11-19 | 2018-11-19 | User behavior anomaly detection method, device, electronic device, and readable storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109727058B (en) |
Families Citing this family (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110110704A (en) * | 2019-05-21 | 2019-08-09 | 北京首汽智行科技有限公司 | A kind of vehicle sanitation monitoring method and system |
| CN110716817B (en) * | 2019-09-10 | 2024-06-25 | 中国平安财产保险股份有限公司 | System operation fault processing method and device, storage medium and electronic equipment |
| CN113011449B (en) * | 2019-12-20 | 2024-10-25 | 中移(上海)信息通信科技有限公司 | Behavior determination method, device, equipment and storage medium |
| CN116503815B (en) * | 2023-06-21 | 2024-01-30 | 宝德计算机系统股份有限公司 | A computer vision processing system based on big data |
| CN121389119A (en) * | 2024-07-22 | 2026-01-23 | 云智能资产控股（新加坡）私人股份有限公司 | Operation behavior recognition method and system, computing device and storage medium |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1926575A (en) * | 2004-03-03 | 2007-03-07 | 日本电气株式会社 | Image similarity calculation system, image search system, image similarity calculation method, and image similarity calculation program |
| CN101719216A (en) * | 2009-12-21 | 2010-06-02 | 西安电子科技大学 | Movement human abnormal behavior identification method based on template matching |
| CN104333694A (en) * | 2014-11-05 | 2015-02-04 | 厦门雅迅网络股份有限公司 | Method for preventing store visiting photo from being counterfeited |
| CN105912652A (en) * | 2016-04-08 | 2016-08-31 | 华南师范大学 | Abnormal behavior detection method and system based on association rules and user attributes |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105989599A (en) * | 2015-02-15 | 2016-10-05 | 西安酷派软件科技有限公司 | Image processing method and apparatus, and terminal |
-
2018
- 2018-11-19 CN CN201811379243.5A patent/CN109727058B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1926575A (en) * | 2004-03-03 | 2007-03-07 | 日本电气株式会社 | Image similarity calculation system, image search system, image similarity calculation method, and image similarity calculation program |
| CN101719216A (en) * | 2009-12-21 | 2010-06-02 | 西安电子科技大学 | Movement human abnormal behavior identification method based on template matching |
| CN104333694A (en) * | 2014-11-05 | 2015-02-04 | 厦门雅迅网络股份有限公司 | Method for preventing store visiting photo from being counterfeited |
| CN105912652A (en) * | 2016-04-08 | 2016-08-31 | 华南师范大学 | Abnormal behavior detection method and system based on association rules and user attributes |
Also Published As
| Publication number | Publication date |
|---|---|
| CN109727058A (en) | 2019-05-07 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109727058B (en) | User behavior anomaly detection method, device, electronic device, and readable storage medium | |
| US12125074B2 (en) | Computer vision systems and methods for automatically detecting, classifying, and pricing objects captured in images or videos | |
| CN111737522B (en) | Video matching method, and block chain-based infringement evidence-saving method and device | |
| US9805331B2 (en) | Smartphone-based asset management system | |
| CN106650662B (en) | Object occlusion detection method and device | |
| US11748401B2 (en) | Generating congruous metadata for multimedia | |
| CN107679475B (en) | Store monitoring and evaluating method and device and storage medium | |
| CN111428743B (en) | Commodity identification method, commodity processing device and electronic equipment | |
| CN110569878A (en) | A method for clustering photo background similarity based on convolutional neural network and computer | |
| CN109685528A (en) | System and method based on deep learning detection counterfeit product | |
| US20130251273A1 (en) | System and method for using an image to provide search results | |
| WO2014197111A1 (en) | Evaluating image sharpness | |
| CN113627411A (en) | A method and system for product identification and price matching based on super-resolution | |
| JP2015504215A (en) | Method and system for comparing images | |
| JP2015504215A5 (en) | ||
| CN102144245A (en) | Image analysis method and system | |
| WO2021110174A1 (en) | Image recognition method and device, electronic device, and storage medium | |
| CN107918767B (en) | Target detection method, device, electronic device and computer readable medium | |
| CN110110110A (en) | One kind is to scheme to search drawing method, device, electronic equipment and storage medium | |
| CN114663871A (en) | Image recognition method, training method, device, system and storage medium | |
| CN115374517B (en) | Testing methods, devices, electronic equipment, and storage media for cabling software. | |
| CN114971443B (en) | A processing method and imaging device for logistics objects | |
| CN113837026B (en) | Method and device for detecting authenticity of certificate | |
| US11657649B2 (en) | Classification of subjects within a digital image | |
| CN112396551A (en) | Watermark embedding method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |