CN116384370B

CN116384370B - Big data security analysis method and system for online service session interaction

Info

Publication number: CN116384370B
Application number: CN202310371622.4A
Authority: CN
Inventors: 沈鹏
Original assignee: Individual
Current assignee: Shen Peng
Priority date: 2023-04-10
Filing date: 2023-04-10
Publication date: 2024-10-22
Anticipated expiration: 2043-04-10
Also published as: CN116384370A

Abstract

The invention provides a big data security analysis method and a big data security analysis system for online business session interaction, which are used for introducing the contribution of a detection offset index of an abnormal text description set to a commonality metric value when acquiring a commonality metric value of a target session security detection text and a reference session security detection text instead of only analyzing an abnormal text description array corresponding to the abnormal text description set, so that the problem that word vectors of risk topics are difficult to accurately output by the abnormal text description array due to disturbance in the session security detection text is avoided, the accuracy of risk topic discrimination is improved, and the deviation generated during text analysis is reduced. After the target session security detection text and the reference session security detection text are determined to be similar texts, a series of security analyses can be performed on the target session security detection text by taking the relevant security analysis strategy of the reference session security detection text as a benchmark, so that the security analysis precision and efficiency of the target session security detection text are improved.

Description

Big data security analysis method and system for online service session interaction

Technical Field

The invention relates to the technical field of big data security, in particular to a big data security analysis method and a big data security analysis system for online business session interaction.

Background

The big data age comes, and the data scale of each industry is increased in TB level, and high-value data sources occupy a vital core position in the big data industry chain. With online service upgrade of various industries, service interaction is mostly realized through online session, so that the information quantity of generated session big data is not ignored, and how to ensure the security of the session big data is a problem which needs to be paid attention at present. The traditional data security analysis technology is mostly realized by analyzing the detection text, but the method has the problems of low efficiency and low precision.

Disclosure of Invention

The invention provides a big data security analysis method and a system for online service session interaction, and the invention adopts the following technical scheme for realizing the technical purposes.

The first aspect is a big data security analysis method for online business session interaction, applied to an artificial intelligence service system, the method comprising:

performing text description mining on a target session security detection text to obtain a first abnormal text description set corresponding to the target session security detection text and a first abnormal text description array corresponding to the first abnormal text description set;

Processing the first abnormal text description set to obtain a first text detection variable corresponding to the first abnormal text description set, wherein the first text detection variable is used for representing that the first abnormal text description set reflects a detection offset index of a risk subject term vector in the target session safety detection text;

Obtaining a commonality metric value between the target session security detection text and the reference session security detection text according to the first abnormal text description array, the first text detection variable and a second abnormal text description array corresponding to a second abnormal text description set of the reference session security detection text, and a second text detection variable corresponding to the second abnormal text description set, wherein the second text detection variable is used for representing a detection offset index of the second abnormal text description set reflecting a risk subject term vector in the reference session security detection text;

And on the basis that the commonality measurement value is larger than a set measurement value, determining that the target session security detection text and the reference session security detection text are similar texts, and carrying out security analysis on the target session security detection text based on the reference session security detection text.

In some optional embodiments, the performing text description mining on the target session security detection text to obtain a first abnormal text description set corresponding to the target session security detection text and a first abnormal text description array corresponding to the first abnormal text description set, including:

and performing text description mining on the target session security detection text through a text description mining subnet in the Transformer network to obtain a first abnormal text description set corresponding to the target session security detection text and a first abnormal text description array corresponding to the first abnormal text description set.

In some optional embodiments, the processing the first abnormal text description set to obtain a first text detection variable corresponding to the first abnormal text description set includes:

And processing the first abnormal text description set through a description characteristic analysis subnet in the Transformer network to obtain a first text detection variable corresponding to the first abnormal text description set.

In some optional embodiments, the text description mining subnet includes a text description mining unit and a text description projection unit, and the text description mining is performed on the target session security detection text by the text description mining subnet in the fransformer network to obtain a first abnormal text description set corresponding to the target session security detection text and a first abnormal text description array corresponding to the first abnormal text description set, including:

Performing text description mining on the target session security detection text through the text description mining unit to obtain a first abnormal text description set corresponding to the target session security detection text;

And performing text description projection on the first abnormal text description set through the text description projection unit to obtain a first abnormal text description array corresponding to the first abnormal text description set.

In some optional embodiments, before the processing, by the description feature parsing subnet in the transform network, the first abnormal text description set to obtain a first text detection variable corresponding to the first abnormal text description set, the method further includes:

according to the conversation safety detection text sample and an abnormal text description array sample corresponding to the conversation safety detection text sample, calibrating the text description mining subnet;

And on the basis of maintaining unchanged the adjusted text description mining subnet, adjusting the description characteristic analysis subnet according to the abnormal text description array sample and the key text description array of the risk subject label corresponding to the session safety detection text sample.

In some optional embodiments, the adjusting the text description mining subnet according to the session security detection text sample and the abnormal text description array sample corresponding to the session security detection text sample includes:

acquiring the session security detection text sample and an abnormal text description array sample corresponding to the session security detection text sample;

Performing text description mining on the session safety detection text sample through the text description mining subnet to obtain an abnormal text analysis description set corresponding to the session safety detection text sample and an abnormal text analysis array corresponding to the abnormal text analysis description set;

And adjusting the text description mining subnet according to the comparison result between the abnormal text analysis array and the abnormal text description array sample.

In some optional embodiments, the text description mining subnet includes a text description mining unit and a text description projecting unit, and the text description mining is performed on the session security detection text sample by the text description mining subnet to obtain an abnormal text analysis description set corresponding to the session security detection text sample and an abnormal text analysis array corresponding to the abnormal text analysis description set, including:

Performing text description mining on the session security detection text sample through the text description mining unit to obtain an abnormal text analysis description set corresponding to the session security detection text sample;

and performing text description projection on the abnormal text analysis description set through the text description projection unit to obtain an abnormal text analysis array corresponding to the abnormal text analysis description set.

In some optional embodiments, the converter network further includes a network cost generation subnet, where the network cost generation subnet includes a confidence description array corresponding to each risk topic label, and the tuning the text description mining subnet according to a comparison result between the abnormal text parsing array and the abnormal text description array sample includes:

generating a subnet through the network cost, and performing strengthening operation on the abnormal text analysis array according to a confidence description array corresponding to the risk topic label corresponding to the session security detection text sample to obtain an abnormal text description strengthening array corresponding to the abnormal text analysis array;

Acquiring a second adjustment cost index between the abnormal text description strengthening array and the abnormal text description array sample, wherein the second adjustment cost index represents a comparison result between the abnormal text description strengthening array and the abnormal text description array sample;

And according to the second adjustment cost index, adjusting the text description mining subnet and the network cost generating subnet.

In some optional embodiments, on the basis of maintaining the adjusted text description mining subnet unchanged, adjusting the description feature analysis subnet according to the abnormal text description array sample and the key text description array of the risk topic tag corresponding to the session security detection text sample, including:

Acquiring a key text description array of a risk topic label corresponding to the session security detection text sample, wherein the key text description array represents a risk topic word vector corresponding to the risk topic label;

Processing the abnormal text analysis description set through the description characteristic analysis subnet to obtain a text detection variable analysis result corresponding to the abnormal text analysis description set, wherein the text detection variable analysis result is used for representing the abnormal text analysis description set to reflect a detection offset index of a risk subject word vector in the session safety detection text sample;

acquiring a third adjustment cost index according to the abnormal text analysis array, the key text description array and the text detection variable analysis result, wherein the third adjustment cost index represents training cost of the text detection variable analysis result corresponding to the abnormal text analysis description set;

and adjusting the description characteristic analysis subnet according to the third adjustment cost index.

In some optional embodiments, the obtaining a third tuning cost indicator according to the abnormal text parsing array, the key text description array, and the text detection variable parsing result includes:

Obtaining a target text detection variable according to the difference characteristics between the abnormal text analysis array and the key text description array;

And acquiring the third adjustment cost index according to a comparison result between the target text detection variable and the text detection variable analysis result.

In some optional embodiments, the obtaining the key text description array of the risk topic tag corresponding to the session security detection text sample includes:

acquiring abnormal text description arrays corresponding to a plurality of session security detection texts of the risk subject labels corresponding to the session security detection text samples;

and determining the key text description array according to the acquired multiple abnormal text description arrays.

Acquiring a confidence description array corresponding to the risk topic label corresponding to the session security detection text sample;

and determining the confidence description array corresponding to the session security detection text sample as the key text description array.

A second aspect is an artificial intelligence service system comprising a memory and a processor; the memory is coupled to the processor; the memory is used for storing computer program codes, and the computer program codes comprise computer instructions; wherein the computer instructions, when executed by the processor, cause the artificial intelligence service system to perform the method of the first aspect.

A third aspect is a computer readable storage medium having stored thereon a computer program which, when run, performs the method of the first aspect.

According to the technical scheme provided by the embodiment of the invention, a first abnormal text description set corresponding to the target session safety detection text and a first abnormal text description array and a first text detection variable corresponding to the first abnormal text description set are obtained, a commonality metric value between the target session safety detection text and the reference session safety detection text is obtained according to the first abnormal text description array, the first text detection variable and a second abnormal text description array and a second text detection variable corresponding to a second abnormal text description set of the reference session safety detection text, and the target session safety detection text and the reference session safety detection text are determined to be similar texts on the basis that the commonality metric value is larger than a set metric value. In view of the fact that the first text detection variable represents the first abnormal text description set to reflect the detection offset index of the risk subject matter vector in the target session safety detection text, the second text detection variable represents the second abnormal text description set to reflect the detection offset index of the risk subject matter vector in the reference session safety detection text, so that when the commonality metric value of the target session safety detection text and the reference session safety detection text is obtained, the contribution of the detection offset index of the abnormal text description set to the commonality metric value is introduced instead of only analyzing the abnormal text description array corresponding to the abnormal text description set, and the problem that the abnormal text description array is difficult to accurately output the word vector of the risk subject matter due to disturbance in the session safety detection text is avoided, and therefore accuracy of judging the risk subject matter is improved, and deviation generated during text analysis is reduced. After the target session security detection text and the reference session security detection text are determined to be similar texts, a series of security analyses can be performed on the target session security detection text by taking the relevant security analysis strategy of the reference session security detection text as a benchmark, so that the security analysis precision and efficiency of the target session security detection text are improved.

In addition, in the embodiment of the invention, the text description of the target session security detection text is projected into a text scene vector relation network to obtain a first abnormal text description set corresponding to the target session security detection text. In view of the fact that compared with a traditional text vector relation network, the text scene vector relation network is matched with the vector relation network of the risk subject, text description mining is carried out on the risk subject in the text scene vector relation network, so that the extracted risk subject word vector can be as accurate and complete as possible, and the accuracy and the credibility of risk subject analysis are guaranteed.

In addition, a session safety detection text sample and an abnormal text description array sample corresponding to the session safety detection text sample are obtained, an abnormal text analysis description set and an abnormal text analysis array of the session safety detection text sample are extracted through a text description mining subnet, and the text description mining subnet is calibrated according to a comparison result between the abnormal text analysis array and the abnormal text description array sample. The method comprises the steps of obtaining a key text description array of a risk topic label corresponding to a session security detection text sample, obtaining a text detection variable analysis result corresponding to an abnormal text analysis description set through a description feature analysis subnet, obtaining a third adjustment cost index according to the abnormal text analysis array, the key text description array and the text detection variable analysis result, and adjusting the description feature analysis subnet according to the third adjustment cost index. And then, risk topic analysis can be carried out through a Transformer network comprising the text description mining sub-network and the description feature analysis sub-network, and in view of introducing the description feature analysis sub-network, the contribution of a text detection variable generated by the description feature analysis sub-network to the commonality metric value is introduced when the commonality metric value between a target session security detection text and a reference session security detection text is acquired, namely, the contribution of a detection offset index of an abnormal text description set to the commonality metric value is introduced instead of only analyzing an abnormal text description array corresponding to the abnormal text description set, so that the problem that word vectors of risk topics are difficult to be accurately output by the abnormal text description array due to disturbance in the session security detection text is avoided, the accuracy of risk topic judgment is improved, and the deviation generated during text analysis is reduced.

In addition, according to the abnormal text description array sample corresponding to the session safety detection text sample and the session safety detection text sample, the text description mining subnet is calibrated, and on the basis of maintaining the calibrated text description mining subnet unchanged, the description characteristic analysis subnet is calibrated according to the key text description array of the risk subject label corresponding to the abnormal text description array sample and the session safety detection text sample. The process of adjusting the Transformer network can be divided into an adjusting link of the text description mining subnet and an adjusting link of the description characteristic analysis subnet, so that on the basis of adjusting the text description mining subnet, only a session safety detection text sample for adjusting the text description mining subnet is needed to be obtained, the description characteristic analysis subnet is adjusted without adjusting the new text description mining subnet again or obtaining the session safety detection text sample again.

Drawings

Fig. 1 is a flow chart of a big data security analysis method for online service session interaction according to an embodiment of the present invention.

Detailed Description

Hereinafter, the terms "first," "second," and "third," etc. are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defining "a first", "a second", or "a third", etc., may explicitly or implicitly include one or more such feature.

FIG. 1 is a schematic flow diagram of a big data security analysis method for online service session interaction according to an embodiment of the present invention, where the big data security analysis method for online service session interaction may be implemented by an artificial intelligence service system, and the artificial intelligence service system may include a memory and a processor; the memory is coupled to the processor; the memory is used for storing computer program codes, and the computer program codes comprise computer instructions; wherein the processor, when executing the computer instructions, causes the artificial intelligence service system to perform steps 101-105.

Step 101, performing text description mining on the target session security detection text to obtain a first abnormal text description set corresponding to the target session security detection text and a first abnormal text description array corresponding to the first abnormal text description set.

When the artificial intelligent service system acquires the target session security detection text, text description mining is carried out on the target session security detection text to obtain a first abnormal text description set corresponding to the target session security detection text and a first abnormal text description array corresponding to the first abnormal text description set.

Wherein the first abnormal text description set is a record representing text features of the target session security detection text, such as text features of the session security detection text may include detection rule text features, session behavior text features, potential risk text features, etc. of the session security detection text. The first anomaly text description array is a linear field representing a text feature of the target session security check text, e.g., the first anomaly text description array may be a multi-dimensional linear field. In the field of artificial intelligence, those skilled in the art will appreciate that text features may be described by feature vectors, description arrays, linear fields, etc. as carriers.

Step 102, processing the first abnormal text description set to obtain a first text detection variable corresponding to the first abnormal text description set.

When the artificial intelligence service system acquires a first abnormal text description set corresponding to the target session security detection text, the first abnormal text description set is processed to obtain a first text detection variable corresponding to the first abnormal text description set. The first text detection variable is used for representing a first abnormal text description set to reflect a detection offset index of a risk subject term vector in the target session safety detection text.

The detection offset index can be understood as the possibility that the first abnormal text description set can accurately represent the risk subject term vector due to deviation in the processing process and the degree of question of the obtained result, so that the detection offset index can be further understood as a question coefficient or an uncertainty coefficient. Further, the text detection variable may be understood as a feature variable, where the smaller the first text detection variable is, the better the first abnormal text description set reflects the accuracy of the risk subject word vector in the target session safety detection text, and the larger the first text detection variable is, the worse the first abnormal text description set reflects the accuracy of the risk subject word vector in the target session safety detection text. In addition, the risk subject matter vector may be used to characterize class characteristics of different session risks, such as risk subject matter vector 1 may characterize data leakage risk, risk subject matter vector 2 may characterize fishing traps, risk subject matter vector 3 may characterize telecommunications fraud, etc.

Step 103, obtaining a commonality metric value between the target session security detection text and the reference session security detection text according to the first abnormal text description array, the first text detection variable and the second abnormal text description array corresponding to the second abnormal text description set of the reference session security detection text, and the second text detection variable corresponding to the second abnormal text description set.

The risk topic analysis task in the embodiment of the invention is to analyze a target session security detection text and a reference session security detection text to determine whether the target session security detection text is similar to the reference session security detection text, wherein the reference session security detection text is a previously recorded session security detection text, and the target session security detection text is currently acquired text data which needs to be subjected to risk topic analysis. In order to perform similarity analysis on the target session security detection text and the reference session security detection text, the artificial intelligence service system acquires a second abnormal text description array corresponding to a second abnormal text description set of the reference session security detection text and a second text detection variable corresponding to the second abnormal text description set, and acquires a commonality metric value between the target session security detection text and the reference session security detection text according to the first abnormal text description array, the first text detection variable, the second abnormal text description array and the second text detection variable.

Wherein the second set of abnormal text descriptions is a record representing text features of the reference session security check text and the second array of abnormal text descriptions is a linear field representing text features of the reference session security check text. The second text detection variable is used for representing a second abnormal text description set to reflect a detection offset index of the risk subject term vector in the reference conversation security detection text.

The larger the commonality metric value between the target session security detection text and the reference session security detection text is, the higher the possibility that the target session security detection text and the reference session security detection text are similar texts is, and the smaller the commonality metric value between the target session security detection text and the reference session security detection text is, the lower the possibility that the target session security detection text and the reference session security detection text are similar texts is. Thus, the commonality metric may also be understood as a text similarity.

And 104, determining that the target session security detection text and the reference session security detection text are similar texts on the basis that the commonality metric value is larger than the set metric value.

When the artificial intelligent service system acquires a commonality measurement value between the target session security detection text and the reference session security detection text, the commonality measurement value is compared with a set measurement value, if the commonality measurement value is larger than the set measurement value, the target session security detection text and the reference session security detection text are determined to be similar texts, and then indirect and efficient security analysis can be performed on the target session security detection text. If the commonality metric is not greater than the set metric, determining that the target session security detection text and the reference session security detection text are not similar texts, and continuously performing similarity analysis on the target session security detection text and the next reference session security detection text until the target session security detection text and a certain reference session security detection text are determined to be similar texts, performing indirect and efficient security analysis on the target session security detection text, or performing security analysis directly on the target session security detection text until the target session security detection text and each recorded reference session security detection text are determined to be not similar texts. Wherein, the person skilled in the art can adjust the setting measurement value by himself.

And 105, performing security analysis on the target session security detection text based on the reference session security detection text.

In the embodiment of the invention, the reference security analysis strategy corresponding to the reference session security detection text can be used, for example, the security analysis can be performed on the target session security detection text through the reference security analysis strategy. The reference security analysis strategy may also be a neural network model, such as a decision tree model, for example. In practical implementation, since the reference session safety detection text and the target session safety detection text are similar texts, it is reasonable to input the target session safety detection text into the decision tree model to perform judgment processing of the abnormal event text block, so that the decision tree model is put into use before, debugging and training of the decision tree model again are omitted, and since the reference session safety detection text and the target session safety detection text are similar texts, great deviation in processing of the target session safety detection text by the decision tree model can be avoided, and accuracy and reliability of the obtained abnormal event text block can be ensured.

Based on the foregoing, in some independent embodiments, the security analysis of the target session security check text based on the reference session security check text in step 105 includes steps 1051-1054.

Step 1051, the target session security detection text is transmitted into a decision tree model corresponding to the reference session security detection text, and a session text block pool for the target session security detection text generated by the decision tree model is obtained, wherein the session text block pool comprises at least two session text blocks.

Step 1052, obtaining contribution weights of each session text chunk in the session text chunk pool relative to the target session security detection text.

And 1053, according to the contribution weights corresponding to the session text blocks and the abnormal decision vectors of the session text blocks, performing text block arrangement on the session text blocks to obtain corresponding session text block queues.

Step 1054, determining a security analysis decision result set for the target session security detection text based on the session text chunk queue, the security analysis decision result set comprising at least two abnormal event probabilities.

And 1055, determining an abnormal event text block from the target session security detection text by using the abnormal event probability.

The contribution weight can be understood as the relativity of the session text blocks relative to the target session security detection text, and the abnormal event probability is used for indicating the possibility that the corresponding session text blocks are abnormal event text blocks, so that when the abnormal event text blocks are determined, the abnormal event text blocks can be realized based on a set event probability threshold, for example, the event probability threshold is set to be 0.6, and the session text blocks corresponding to the abnormal event probability higher than 0.6 are determined as the abnormal event text blocks, so that the specific security protection strategy and the customization of the risk response strategy are conducted on the abnormal event text blocks. Therefore, the abnormal event text block is determined based on the abnormal event probability, so that the flexibility of determining the abnormal event text block can be improved, the abnormal event probability can be reduced when the abnormal event text block determination standard is strict, and the abnormal event probability can be increased when the abnormal event text block determination standard is loose.

Based on the above related content, in some independent embodiments, the performing text block arrangement on each session text block according to the contribution weight corresponding to each session text block and the abnormal decision vector of each session text block to obtain a corresponding session text block queue includes: according to the contribution weight corresponding to each session text block and the abnormal decision vector of each session text block, disassembling each session text block to obtain at least two session text block clusters; and performing text block arrangement on each session text block cluster, and performing text block arrangement on each session text block in each session text block cluster to obtain the session text block queue.

Based on the above-mentioned related content, in some independent embodiments, the disassembling the each session text block according to the contribution weight corresponding to the each session text block and the abnormal decision vector of the each session text block to obtain at least two session text block clusters includes: reinforcing the abnormal decision vector of each session text block according to the contribution weight corresponding to each session text block to obtain the reinforced abnormal decision vector of each session text block; clustering the session text blocks according to the reinforced abnormal decision vector of each session text block to obtain at least two session text block clusters.

Based on the above related content, in some independent embodiments, the performing text block arrangement between each session text block cluster, and performing text block arrangement on each session text block in each session text block cluster to obtain the session text block queue respectively, includes: according to the number of the session text blocks contained in each session text block cluster, performing text block arrangement on each session text block cluster; and for each session text block cluster, respectively executing the following operations: according to the relation between the abnormal decision vector of each session text block in the session text block cluster and the session text block cluster, performing text block arrangement on each session text block in the session text block cluster; and generating the session text block queue based on the text block arrangement results among the session text block clusters and the text block arrangement results of the session text blocks in the session text block clusters.

According to the method provided by the embodiment of the invention, a first abnormal text description set corresponding to the target session safety detection text and a first abnormal text description array and a first text detection variable corresponding to the first abnormal text description set are obtained, a commonality metric value between the target session safety detection text and the reference session safety detection text is obtained according to the first abnormal text description array, the first text detection variable and a second abnormal text description array and a second text detection variable corresponding to a second abnormal text description set of the reference session safety detection text, and the target session safety detection text and the reference session safety detection text are determined to be similar texts on the basis that the commonality metric value is larger than a set metric value. In view of the fact that the first text detection variable represents the first abnormal text description set to reflect the detection offset index of the risk subject matter vector in the target session safety detection text, the second text detection variable represents the second abnormal text description set to reflect the detection offset index of the risk subject matter vector in the reference session safety detection text, when the commonality metric value between the target session safety detection text and the reference session safety detection text is obtained, the contribution of the detection offset index of the abnormal text description set to the commonality metric value is introduced instead of only analyzing the abnormal text description array corresponding to the abnormal text description set, and therefore the problem that the abnormal text description array is difficult to accurately output the word vector of the risk subject matter due to disturbance in the session safety detection text is avoided, so that the accuracy of judging the risk subject matter is improved, and deviation generated during text analysis is reduced.

After the target session security detection text and the reference session security detection text are determined to be similar texts, a series of security analyses can be performed on the target session security detection text by taking the relevant security analysis strategy of the reference session security detection text as a benchmark, so that the security analysis precision and efficiency of the target session security detection text are improved.

The big data security analysis method for online service session interaction provided by the embodiment of the invention comprises the following steps.

Step 201, the artificial intelligent service system performs text description mining on the target session security detection text through a text description mining unit in the Transformer network to obtain a first abnormal text description set corresponding to the target session security detection text.

In the embodiment of the invention, the transducer network may be a neural network that the artificial intelligence service system completes tuning in advance, or a model that is loaded into the artificial intelligence service system after tuning by other systems. The Transformer network is a neural network for performing risk topic analysis (which can also be understood as similar text analysis), and includes a text description mining subnet (feature extraction network) and a description feature analysis subnet (prediction network), the text description mining subnet is connected with the description feature analysis subnet, the text description mining subnet is used for extracting an abnormal text description set and an abnormal text description array of the session security detection text, and the description feature analysis subnet is used for acquiring text detection variables according to the abnormal text description set. The text description mining subnet comprises a text description mining unit and a text description projection unit (feature mapping layer), wherein the text description mining unit is connected with the text description projection unit, the text description mining unit is used for extracting a corresponding abnormal text description set according to a session safety detection text, and the text description projection unit is used for acquiring a corresponding abnormal text description array according to the abnormal text description set.

When the artificial intelligent service system acquires a target session security detection text to be subjected to similarity analysis, text description mining is carried out on the target session security detection text through a text description mining unit in the Transformer network, so that a first abnormal text description set corresponding to the target session security detection text is obtained. The text description mining unit in the embodiment of the invention can project the text description of the target session security detection text into the text scene vector relation network to obtain a first abnormal text description set corresponding to the target session security detection text, so that details recorded in the first abnormal text description set accord with the distribution of the text scene vector relation network (feature space with higher dimension). In view of the fact that the text scene vector relation net is more matched with the vector relation net of the risk subject compared with the traditional text vector relation net, the text description mining of the session safety detection text in the text scene vector relation net can enable the extracted risk subject term vector to be as accurate and complete as possible.

In some examples, the text description mining unit may be an AI network such as CNN, RNN, etc., and those skilled in the art may also select the text description mining unit according to actual needs.

Wherein the first abnormal text description set is a record representing text features of the target session security detection text, such as text features of the session security detection text may include detection rule text features, session behavior text features, potential risk text features, etc. of the session security detection text.

For another example, for the manner of acquiring the target session security detection text, the person skilled in the art can choose according to the actual requirement.

Step 202, the artificial intelligent service system performs text description projection on the first abnormal text description set through a text description projection unit in the Transformer network to obtain a first abnormal text description array corresponding to the first abnormal text description set.

The text description projection unit in the converter network is connected with the text description mining unit, and the text description projection unit is used for acquiring a corresponding abnormal text description array according to the abnormal text description set. The text describing the projection unit may be a fully connected layer, which may be chosen by the person skilled in the art according to the actual requirements.

When the artificial intelligent service system acquires a first abnormal text description set corresponding to the target session security detection text, text description projection is carried out on the first abnormal text description set through a text description projection unit in a Transformer network, so that a first abnormal text description array corresponding to the first abnormal text description set is obtained. The first abnormal text description array is projected by the first abnormal text description set, and is a linear field for representing the text characteristics of the target session security detection text, and may be a multi-dimensional linear field, for example, the first abnormal text description array is a 1*h-dimensional linear field, and then the first abnormal text description array includes description variables of h dimensions, where h is a positive integer.

In the embodiment of the present invention, the text description mining subnet in the Transformer network includes a text description mining unit and a text description projecting unit, so in the steps 201 and 202, taking the processing of the target session security detection text by the text description mining unit and the processing of the first abnormal text description set by the text description projecting unit as an example, the process of obtaining the first abnormal text description set corresponding to the target session security detection text and the first abnormal text description array corresponding to the first abnormal text description set is introduced. Under other design ideas, the text description mining subnet can be a subnet with other structures, and the first abnormal text description set and the first abnormal text description array can be obtained by ensuring that the text description mining is carried out on the target session security detection text through the text description mining subnet.

And 203, the artificial intelligent service system processes the first abnormal text description set through a description feature analysis subnet in the Transformer network to obtain a first text detection variable corresponding to the first abnormal text description set.

The description feature analysis sub-network in the Transformer network is connected with the text description mining sub-network, and the description feature analysis sub-network is used for processing the abnormal text description set to obtain a corresponding text detection variable. In the embodiment of the invention, the text description mining subnet comprises a text description mining unit and a text description projecting unit, and the description characteristic analysis subnet is connected with the text description mining unit in the text description mining subnet. The description feature analysis subnet may be a residual model, and may be selected by those skilled in the art according to actual requirements.

When the artificial intelligence service system acquires a first abnormal text description set corresponding to the target session security detection text, the first abnormal text description set is processed through the description feature analysis subnet, and a first text detection variable corresponding to the first abnormal text description set is obtained. The first text detection variable is used for representing a detection offset index of a risk subject word vector in a target session safety detection text reflected by the first abnormal text description set, and the detection offset index can be understood as the degree of questioning an obtained result due to deviation in the processing process and can reflect the degree of accurately representing the risk subject word vector by the first abnormal text description set. The smaller the first text detection variable is, the better the first abnormal text description set reflects the accuracy of the risk subject word vector in the target session safety detection text, and the larger the first text detection variable is, the worse the first abnormal text description set reflects the accuracy of the risk subject word vector in the first session safety detection text is. The first abnormal text description set is an abnormal text description set of a text scene vector relation network mapped by the session safety detection text, details recorded in the first abnormal text description set conform to the distribution of the text scene vector relation network, and then the first text detection variable is also a first text detection variable conforming to the distribution of the text scene vector relation network and is used for representing the first abnormal text description set of the text scene vector relation network to reflect the detection offset index of the risk subject term vector in the target session safety detection text.

And 204, the artificial intelligent service system performs text description mining on the reference session security detection text through a text description mining unit to obtain a second abnormal text description set corresponding to the reference session security detection text.

The risk topic analysis task of the embodiment of the invention is to analyze a target session security detection text and a reference session security detection text to determine whether the target session security detection text and the reference session security detection text are similar texts. The reference session security detection text is a session security detection text recorded in advance by the artificial intelligent service system, and the target session security detection text is text data which is currently acquired by the artificial intelligent service system and needs to be subjected to risk topic analysis. The target session security detection text and the reference session security detection text are similar texts, and the risk subjects in the target session security detection text are the same as or similar to the risk subjects in the reference session security detection text.

Based on the above, the artificial intelligence service system acquires a pre-recorded reference session security detection text, and performs text description mining on the reference session security detection text through a text description mining unit in the Transformer network to obtain a second abnormal text description set corresponding to the reference session security detection text, wherein the second abnormal text description set is a record representing text characteristics of the reference session security detection text. The text description mining unit in the embodiment of the invention can project the text description of the reference session security detection text into the text scene vector relation network to obtain a second abnormal text description set corresponding to the reference session security detection text. The text scene vector relationship net in step 204 is the same as the text scene vector relationship net in step 201.

And 205, the artificial intelligence service system performs text description projection on the second abnormal text description set through a text description projection unit to obtain a second abnormal text description array corresponding to the second abnormal text description set.

When the artificial intelligent service system acquires a second abnormal text description set corresponding to the reference session security detection text, text description projection is carried out on the second abnormal text description set through a text description projection unit in a Transformer network, and a second abnormal text description array corresponding to the second abnormal text description set is obtained. The second abnormal text description array is a linear field for representing the text characteristics of the reference session security detection text, and may be a multi-dimensional linear field, for example, the second abnormal text description array is a 1*h-dimensional linear field, and then the second abnormal text description array includes description variables of h dimensions. The second anomaly text description array is projected from the second anomaly text description set.

In the embodiment of the invention, the text description mining sub-network in the converter network comprises a text description mining unit and a text description projection unit, so that step 204 takes the text description mining unit for processing the reference session security detection text and the text description projection unit for processing the second abnormal text description set as an example, the process of obtaining the second abnormal text description set corresponding to the reference session security detection text and the second abnormal text description array corresponding to the second abnormal text description set is introduced, and under other design ideas, the text description mining sub-network can be a sub-network with other structures, as long as the text description mining of the reference session security detection text through the text description mining sub-network is ensured, the second abnormal text description set and the second abnormal text description array can be obtained.

And 206, the artificial intelligence service system processes the second abnormal text description set through the description characteristic analysis subnet to obtain a second text detection variable corresponding to the second abnormal text description set.

The second text detection variable is used for representing a second abnormal text description set to reflect a detection offset index of the risk subject term vector in the reference conversation security detection text.

For example, before the present round of risk topic analysis, the artificial intelligence service system may process the reference session security detection text in advance to obtain a second abnormal text description array and a second text detection variable corresponding to the reference session security detection text, and record the second abnormal text description array and the second text detection variable, so that the recorded second abnormal text description array and the second text detection variable can be directly obtained without implementing step 204-step 206. Or after the artificial intelligent service system acquires the target session safety detection text to be subjected to similarity analysis, acquiring a pre-recorded reference session safety detection text, loading the target session safety detection text and the reference session safety detection text into a Transformer network in a text binary group mode, and respectively processing the target session safety detection text and the reference session safety detection text in the Transformer network to acquire a first abnormal text description array, a first text detection variable, a second abnormal text description array and a second text detection variable. The sub-networks of the Transformer network can synchronously operate the target session safety detection text and the reference session safety detection text, for example, when a text description mining model in the Transformer network processes the target session safety detection text, a description characteristic analysis sub-network in the Transformer network can process the reference session safety detection text, so that synchronous processing of the target session safety detection text and the reference session safety detection text is achieved, and timeliness of the whole scheme is improved.

Step 207, the artificial intelligence service system obtains a commonality metric value between the target session security detection text and the reference session security detection text according to the first abnormal text description array, the first text detection variable, the second abnormal text description array corresponding to the second abnormal text description set of the reference session security detection text, and the second text detection variable corresponding to the second abnormal text description set.

When the artificial intelligence service system obtains the first abnormal text description array, the first text detection variable, the second abnormal text description array and the second text detection variable, the commonality metric value between the target session security detection text and the reference session security detection text is obtained according to the first abnormal text description array, the first text detection variable, the second abnormal text description array and the second text detection variable. The larger the commonality metric value between the target session security detection text and the reference session security detection text, the higher the possibility that the risk subject in the target session security detection text and the risk subject in the reference session security detection text are the same or similar, that is, the higher the possibility that the target session security detection text and the reference session security detection text are similar texts; the smaller the value of the commonality metric between the target session security check text and the reference session security check text, the lower the likelihood that the risk subject in the target session security check text and the risk subject in the reference session security check text are the same or similar, i.e., the lower the likelihood that the target session security check text and the reference session security check text are similar.

In some examples, the artificial intelligence service system processes the first abnormal text description array, the first text detection variable, the second abnormal text description array and the second text detection variable by adopting an operation thought of cosine similarity to obtain a commonality metric value between the target session security detection text and the reference session security detection text.

And step 208, the artificial intelligent service system determines that the target session security detection text and the reference session security detection text are similar texts on the basis that the commonality metric value is larger than the set metric value.

When the artificial intelligent service system acquires a commonality measurement value between the target session security detection text and the reference session security detection text, comparing the commonality measurement value with a set measurement value, and if the commonality measurement value is larger than the set measurement value, determining that the risk subject in the target session security detection text is the same as or similar to the risk subject in the reference session security detection text, namely that the target session security detection text and the reference session security detection text are similar texts. If the commonality measurement value is not greater than the set measurement value, determining that the risk subject in the target session security detection text and the risk subject in the reference session security detection text are different or similar, namely that the target session security detection text and the reference session security detection text are not similar texts.

The embodiment of the invention takes the analysis of the target session security detection text and a reference session security detection text by using an artificial intelligent service system as an example, and introduces the process of risk topic analysis. Under other design ideas, the artificial intelligent service system stores a plurality of reference session safety detection texts, after the artificial intelligent service system acquires the target session safety detection texts to be subjected to similarity analysis, the artificial intelligent service system sequentially processes the plurality of reference session safety detection texts, and the related technical scheme is implemented on each reference session safety detection text which is sequentially processed until the target session safety detection text is determined to be similar to one of the plurality of reference session safety detection texts, or until the target session safety detection text is determined to be dissimilar to any of the plurality of reference session safety detection texts.

It can be understood that the embodiment of the invention is described by taking an example that an artificial intelligent service system processes texts through a text description mining subnet and a description feature analysis subnet in a Transformer network. Under other design ideas, the artificial intelligence service system can realize text description mining on the target session security detection text through other ideas to obtain a first abnormal text description set corresponding to the target session security detection text and a first abnormal text description array corresponding to the first abnormal text description set, and process the first abnormal text description set to obtain a first text detection variable corresponding to the first abnormal text description set.

According to the method provided by the embodiment of the invention, a text description mining subnet and a description characteristic analysis subnet in a Transformer network are used for obtaining a first abnormal text description array and a first text detection variable corresponding to a first abnormal text description set, and a commonality metric value between a target session safety detection text and a reference session safety detection text is obtained according to the first abnormal text description array, the first text detection variable and a second abnormal text description array and a second text detection variable corresponding to a reference session safety detection text, and the target session safety detection text and the reference session safety detection text are determined to be similar texts on the basis that the commonality metric value is larger than a set metric value. In view of the fact that the first text detection variable represents the first abnormal text description set to reflect the detection offset index of the risk subject matter vector in the target session safety detection text, the second text detection variable represents the second abnormal text description set to reflect the detection offset index of the risk subject matter vector in the reference session safety detection text, when the commonality metric value between the target session safety detection text and the reference session safety detection text is obtained, the contribution of the detection offset index of the abnormal text description set to the commonality metric value is introduced instead of only analyzing the abnormal text description array corresponding to the abnormal text description set, and therefore the problem that the abnormal text description array is difficult to accurately output the word vector of the risk subject matter due to disturbance in the session safety detection text is avoided, so that the accuracy of judging the risk subject matter is improved, and deviation generated during text analysis is reduced.

In the embodiment of the invention, the text description of the target session security detection text is projected into a text scene vector relation network to obtain a first abnormal text description set corresponding to the target session security detection text. In view of the fact that compared with a traditional text vector relation network, the text scene vector relation network is matched with the vector relation network of the risk subject, text description mining is carried out on the risk subject in the text scene vector relation network, so that the extracted risk subject word vector can be as accurate and complete as possible, and the accuracy and the credibility of risk subject analysis are guaranteed.

Before the risk topic analysis (similar text analysis) is performed through the transducer network, the transducer network needs to be subjected to tuning training, and the related tuning training method comprises the following steps.

Step 301, an artificial intelligent service system acquires a session security detection text sample and an abnormal text description array sample corresponding to the session security detection text sample.

The artificial intelligent service system acquires a session security detection text sample for calibrating the converter network and an abnormal text description array sample corresponding to the session security detection text sample. The session safety detection text sample is text data comprising a risk subject, and the abnormal text description array sample corresponding to the session safety detection text sample is a linear field for representing text characteristics of the session safety detection text sample. For example, the abnormal text description array sample may be used to represent a risk topic label corresponding to the session security detection text sample, taking security risk 1 and security risk 2 as examples, where any abnormal text description array sample corresponding to any session security detection text sample including a risk topic of security risk 1 is an abnormal text description array sample1, and any abnormal text description array sample corresponding to any session security detection text sample including a risk topic of security risk 2 is an abnormal text description array sample2.

The session security detection text sample may be a session security detection text sample recorded in advance in the artificial intelligence service system, or a session security detection text sample called from other systems by the artificial intelligence service system, or may be a session security detection text sample uploaded to the artificial intelligence service system by other systems. The abnormal text description array sample corresponding to the session safety detection text sample can be an abnormal text description array sample annotated for the session safety detection text sample or an abnormal text description array sample obtained by another thought, and can be selected by a person skilled in the art according to actual requirements. The above examples may be understood as sample information for performing network training, and may also be generally understood as text examples, exemplary text, or authenticated text.

And 302, the artificial intelligent service system performs text description mining on the session security detection text sample through a text description mining unit in the Transformer network to obtain an abnormal text analysis description set corresponding to the session security detection text sample.

A Transformer network is a network for performing risk topic parsing (text similarity analysis) and includes a text description mining subnet and a description feature parsing subnet. The text description mining sub-network is connected with the description feature analysis sub-network, the text description mining sub-network is used for extracting an abnormal text description set and an abnormal text description array corresponding to the session security detection text, and the description feature analysis sub-network is used for acquiring a corresponding text detection variable according to the abnormal text description set. The text description mining subnet comprises a text description mining unit and a text description projection unit, the text description mining unit is connected with the text description projection unit, the text description mining unit is used for extracting a corresponding abnormal text description set according to the session safety detection text, and the text description projection unit is used for obtaining a corresponding abnormal text description array according to the abnormal text description set.

When the artificial intelligent service system acquires the session security detection text sample, text description mining is carried out on the session security detection text sample through a text description mining unit in a Transformer network, so that an abnormal text analysis description set corresponding to the session security detection text sample is obtained. The abnormal text parsing description set is text data representing features of the session security detection text sample.

The text description mining unit in the embodiment of the invention projects the text description of the session safety detection text sample into a text scene vector relation network to obtain an abnormal text analysis description set corresponding to the session safety detection text sample. Compared with the traditional text vector relation network, the text scene vector relation network is matched with the vector relation network of the risk subject, and the text description mining of the risk subject in the text scene vector relation network can enable the extracted risk subject word vector to be as accurate and complete as possible.

And 303, the artificial intelligent service system performs text description projection on the abnormal text analysis description set through a text description projection unit in the Transformer network to obtain an abnormal text analysis array corresponding to the abnormal text analysis description set.

The text description projection unit in the converter network is connected with the text description mining unit, and the text description projection unit is used for acquiring a corresponding abnormal text description array according to the abnormal text description set. The text description projection unit may be a fully connected layer, or may be a network of other structures, which may be selected by one skilled in the art according to actual needs.

When the artificial intelligent service system acquires an abnormal text analysis description set corresponding to the session security detection text sample, text description projection is carried out on the abnormal text analysis description set through a text description projection unit in a Transformer network, so that an abnormal text analysis array corresponding to the abnormal text analysis description set is obtained. The abnormal text analysis array is a linear field used for representing the characteristics of the session safety detection text sample, and is projected by the abnormal text analysis description set.

In the embodiment of the present invention, the text description mining subnet in the Transformer network includes a text description mining unit and a text description projecting unit, so in the steps 302 and 03, taking the processing of the session security detection text sample by the text description mining unit and the processing of the abnormal text analysis description set by the text description projecting unit as examples, the process of obtaining the abnormal text analysis description set corresponding to the session security detection text sample and the abnormal text analysis array corresponding to the abnormal text analysis description set is introduced. Under other design ideas, the text description mining subnet can be a subnet with other structures, and the abnormal text analysis description set and the abnormal text analysis array can be obtained by only ensuring that the text description mining subnet is used for text description mining of the session safety detection text sample.

And 304, the artificial intelligent service system adjusts the text description mining subnet according to the comparison result between the abnormal text analysis array and the abnormal text description array sample.

The abnormal text analysis array is a linear field which is presumed through a transducer network and represents the characteristics of the session safety detection text sample, and the abnormal text description array sample is a real linear field which represents the characteristics of the session safety detection text sample. Therefore, when the artificial intelligence service system obtains the abnormal text analysis array and the abnormal text description array sample, the text description mining subnet in the Transformer network, that is, the text description mining unit and the text description projecting unit are calibrated according to the comparison result between the abnormal text analysis array and the abnormal text description array sample, so that the comparison result (difference) between the abnormal text analysis array and the abnormal text description array sample obtained by the text description mining unit and the text description projecting unit is smaller.

In some examples, the artificial intelligence service system obtains a first tuning cost indicator between the abnormal text parsing array and the abnormal text description array sample, and the tuning text description mining subnet based on the first tuning cost indicator. The first calibration cost index represents a comparison result between the abnormal text analysis array and the abnormal text description array sample.

The artificial intelligence service system obtains a first cost function, and determines an abnormal text analysis array and an abnormal text description array sample according to the first cost function to obtain a first adjustment cost index. The first cost function is an evaluation algorithm for acquiring training cost between the abnormal text analysis array and the abnormal text description array sample.

In some examples, the transducer network further includes a network cost generation subnet coupled to the text description mining subnet. The network cost generation sub-network comprises a confidence description array corresponding to each risk subject label. The artificial intelligent service system generates a subnet through network cost, performs strengthening operation (weighting operation) on the abnormal text analysis array according to the confidence description array corresponding to the risk subject label corresponding to the session security detection text sample, obtains the abnormal text description strengthening array corresponding to the abnormal text analysis array, obtains a second calibration cost index between the abnormal text description strengthening array and the abnormal text description array sample, and mines the subnet and generates the subnet according to the second calibration cost index. The second calibration cost index represents a comparison result between the abnormal text description strengthening array and the abnormal text description array sample.

The network cost generation sub-network is used for obtaining a corresponding adjustment cost index according to the abnormal text description array, and the network cost generation sub-network is connected with the text description mining sub-network, the text-description mining subnet includes a text-description mining unit and a text-description projecting unit, and the network cost generating subnet is connected with the text-description projecting unit in the text-description mining subnet. The network cost generation sub-network can be a classification model, and can be selected by a person skilled in the art according to actual requirements.

The confidence description array corresponding to each risk topic label is used for representing the weight of the abnormal text description array corresponding to the session security detection text corresponding to the risk topic label, and in an exemplary embodiment, the abnormal text analysis array corresponding to the session security detection text sample is a 1*h-dimensional linear field, and then the abnormal text analysis array includes h-dimensional description variables. The confidence description array corresponding to the risk subject tag is also a 1*h-dimensional linear field, the confidence description array comprises h-dimensional bias coefficients, and the h-dimensional bias coefficients respectively represent the importance of the description variable of each dimension in the corresponding abnormal text analysis array.

After the artificial intelligent service system obtains the abnormal text analysis description set corresponding to the session safety detection text sample, the artificial intelligent service system determines the confidence description array corresponding to the risk subject label corresponding to the session safety detection text sample in a plurality of confidence description arrays included in the network cost generation sub-network, generates the sub-network through the network cost, and performs strengthening operation on the abnormal text analysis array according to the confidence description array corresponding to the risk subject label corresponding to the session safety detection text sample to obtain an abnormal text description strengthening array corresponding to the abnormal text analysis array. The description variable of each dimension in the abnormal text analysis array is multiplied by the corresponding bias coefficient in the confidence description array to obtain the abnormal text description strengthening array. Illustratively, the network cost generation subnet further includes a second cost function. And the artificial intelligent service system acquires a second cost function, and processes the abnormal text description strengthening array and the abnormal text description array sample according to the second cost function to obtain a second adjustment cost index. The second cost function is an evaluation algorithm for acquiring training cost between the abnormal text description reinforcement array and the abnormal text description array sample.

In some examples, the artificial intelligence service system improves text description mining subnets and network cost generation subnets based on gradient descent rules to achieve the purpose of tuning the text description mining subnets and network cost generation subnets. Wherein, the person skilled in the art can also select the gradient descent rule according to the actual requirement.

It can be understood that steps 301-304 only introduce to obtain an abnormal text parsing array according to the session security detection text sample, and calibrate the text description mining subnet and the network cost generating subnet according to the comparison result between the abnormal text parsing array and the abnormal text description array sample, so as to realize calibrating the text description mining subnet according to the session security detection text sample and the abnormal text description array sample corresponding to the session security detection text sample. Under other design ideas, the artificial intelligent service system can also adopt other ideas to realize the adjustment of text description mining subnetworks according to the conversation safety detection text sample and the abnormal text description array sample corresponding to the conversation safety detection text sample.

In the embodiment of the invention, the text description mining subnet and the network cost generating subnet are calibrated according to an abnormal text description set sample and an abnormal text description array sample corresponding to the abnormal text description set sample. In the actual tuning process, the artificial intelligent service system tunes the text description mining subnet and the network cost generating subnet according to a plurality of session safety detection text samples and abnormal text description array samples corresponding to the session safety detection text samples. The risk topic labels corresponding to any two session security detection text samples among the plurality of session security detection text samples may be consistent or inconsistent.

In some examples, the artificial intelligence service system obtains a plurality of session security detection text samples and abnormal text description array samples corresponding to the plurality of session security detection text samples, loads the plurality of session security detection text samples into a text description mining unit in a Transformer network at the same time, processes the plurality of session security detection text samples in the Transformer network respectively, and adjusts text description mining sub-networks and network cost generating sub-networks according to the obtained abnormal text analysis array and the corresponding abnormal text description array samples. The text description mining subnet and the network cost generation subnet in the Transformer network can synchronously operate a plurality of session security detection text samples. For example, the plurality of session security detection text samples include a first session security detection text sample and a second session security detection text sample, and when the network cost generation subnet in the Transformer network processes the first session security detection text sample, the text description mining subnet in the Transformer network can process the second session security detection text sample, so that synchronous processing of the plurality of session security detection text samples is achieved, and timeliness of the whole scheme is improved.

In some examples, tuning the text description mining subnet and the network cost generating subnet is completed when the number of loops of tuning the text description mining subnet and the network cost generating subnet reaches a set number of times. Or when the first adjustment cost index or the second adjustment cost index acquired by the artificial intelligence service system is smaller than the first set index value, the adjustment cost index which indicates that the text description mining subnet and the network cost generation subnet tend to be stable, and the adjustment of the text description mining subnet and the network cost generation subnet is completed.

Under other design ideas, the artificial intelligent service system is provided with a calibrated text description mining subnet and a session security detection text sample used for calibrating the text description mining subnet in advance, so that the artificial intelligent service system does not need to execute the steps 301-304, only needs to acquire the session security detection text sample used for calibrating the text description mining subnet, executes the following steps 305-307, and completes the calibration of the description feature analysis subnet.

Step 305, the artificial intelligence service system acquires a key text description array of the risk topic tag corresponding to the session security detection text sample.

Each risk topic tag corresponds to a key text description array, and the key text description array represents a risk topic word vector corresponding to the risk topic tag. After the artificial intelligent service system completes the adjustment of the text description mining subnet and the network cost generation subnet in the converter network, the artificial intelligent service system acquires a key text description array of the risk subject label corresponding to the session safety detection text sample, wherein the key text description array can be used for representing the risk subject word vector in the session safety detection text sample.

In some examples, the artificial intelligence service system obtains an abnormal text description array corresponding to a plurality of session security detection texts of a risk topic tag corresponding to the session security detection text sample, and determines a key text description array according to the obtained plurality of abnormal text description arrays. In the process of adjusting text description mining subnets and generating subnets by network cost, the artificial intelligent service system obtains abnormal text description arrays corresponding to a plurality of session safety detection texts, then the artificial intelligent service system determines a plurality of session safety detection texts of risk subject labels corresponding to the abnormal text description set samples, obtains a plurality of abnormal text description arrays corresponding to the plurality of session safety detection texts, and carries out averaging processing on the plurality of obtained abnormal text description arrays to obtain a key text description array corresponding to the risk subject labels corresponding to the session safety detection text samples.

Under some examples, the artificial intelligence service system obtains a confidence description array corresponding to the risk topic tag corresponding to the session security detection text sample, and determines the confidence description array corresponding to the session security detection text sample as a key text description array.

The network cost generation sub-network comprises a confidence description array corresponding to each risk subject label. And continuously adjusting each confidence description array in the network cost generation subnet in the process of mining the subnet and generating the subnet by the adjustment text description, wherein when the adjustment is completed, each confidence description array after the adjustment is included in the network cost generation subnet. The artificial intelligence service system can determine the risk topic label corresponding to the session security detection text sample, acquire the confidence description array corresponding to the risk topic label from a plurality of confidence description arrays in the network cost generation subnet, and determine the confidence description array as the key text description array corresponding to the risk topic label corresponding to the session security detection text sample.

And 306, the artificial intelligent service system processes the abnormal text analysis description set through the description characteristic analysis subnet to obtain a text detection variable analysis result corresponding to the abnormal text analysis description set.

The text detection variable analysis result is used for representing that the abnormal text analysis description set reflects a detection offset index of the risk subject word vector in the session safety detection text sample.

Step 307, the artificial intelligence service system obtains a third adjustment cost index according to the abnormal text analysis array, the key text description array and the text detection variable analysis result, and analyzes the subnet according to the adjustment description characteristics according to the third adjustment cost index.

When the artificial intelligent service system obtains an abnormal text analysis array, a key text description array and a text detection variable analysis result corresponding to the session security detection text sample, a third adjustment cost index is obtained according to the abnormal text analysis array, the key text description array and the text detection variable analysis result, and a description characteristic analysis subnet in a Transformer network is adjusted according to the third adjustment cost index, so that the text detection variable analysis result corresponding to the abnormal text analysis description set generated by the description characteristic analysis subnet is as accurate and complete as possible. The third calibration cost index represents the training cost of the text detection variable analysis result (the prediction result of the text detection variable) corresponding to the abnormal text analysis description set.

In some examples, the artificial intelligence service system obtains a third price function, and determines an abnormal text analysis array, a key text description array and a text detection variable analysis result according to the third price function to obtain a third tuning cost index.

In some examples, the artificial intelligence service system obtains a target text detection variable according to a difference characteristic between the abnormal text analysis array and the key text description array, and obtains a third tuning cost indicator according to a comparison result between the target text detection variable and the text detection variable analysis result.

In view of the fact that the text detection variable analysis result is used for representing an abnormal text description set sample to reflect the detection offset index of the risk subject word vector in the session safety detection text, in practical application, the artificial intelligent service system can acquire a commonality metric value between the session safety detection text according to an abnormal text description array corresponding to the abnormal text description set and the text detection variable. Therefore, the text detection variable analysis result is essentially a detection offset index that needs to indicate that the abnormal text analysis array corresponding to the session safety detection text sample matches the key text description array corresponding to the session safety detection text sample, and the smaller the difference feature between the abnormal text analysis array and the key text description array is, the more similar the abnormal text analysis array and the key text description array are, i.e. the more similar the abnormal text analysis array and the key text description array are.

The artificial intelligence service system can acquire a target text detection variable according to the difference characteristics between the abnormal text analysis array and the key text description array, and the target text detection variable can represent a detection offset index matched with the abnormal text analysis array and the key text description array. The larger the difference characteristic between the abnormal text analysis array and the key text description array is, the larger the detection offset index matched with the abnormal text analysis array and the key text description array is, namely, the larger the target text detection variable is; the smaller the difference characteristic between the abnormal text analysis array and the key text description array is, the smaller the detection offset index matched with the abnormal text analysis array and the key text description array is, namely, the smaller the target text detection variable is.

In the actual implementation process, it is difficult to obtain the risk topic label corresponding to the session security detection text to be subjected to similarity analysis, so that it is also difficult to obtain the key text description array corresponding to the session security detection text, and therefore, the artificial intelligence service system obtains the text detection variable according to the abnormal text description set. In the adjustment process of the description feature analysis subnet, the text detection variable analysis result obtained by the description feature analysis subnet can be used for representing the detection offset index of the abnormal text analysis array corresponding to the session safety detection text sample matched with the key text description array corresponding to the session safety detection text sample, namely, the comparison result between the text detection variable analysis result and the target text detection variable is required to be ensured to be smaller. Therefore, the artificial intelligence service system can acquire a third adjustment cost index according to the comparison result between the target text detection variable and the text detection variable analysis result, and adjust the description characteristic analysis subnet according to the third adjustment cost index, so that the comparison result between the target text detection variable and the text detection variable analysis result is smaller and smaller, and the text detection variable analysis result generated by the description characteristic analysis subnet is more and more accurate.

In some examples, the artificial intelligence service system optimizes the descriptive feature analysis subnet based on gradient descent rules to achieve the purpose of tuning the descriptive feature analysis subnet.

By implementing steps 305-307, the method realizes that the subnet is analyzed according to the abnormal text description array sample and the key text description array of the risk subject label corresponding to the session safety detection text sample on the basis of maintaining the text description mining subnet after adjustment unchanged. Under other design ideas, the artificial intelligence service system can also adopt other ideas to calibrate the description characteristic analysis subnet according to the abnormal text description array sample and the key text description array.

In the method provided by the embodiment of the invention, the tuning transform network is divided into a tuning link of a text description mining subnet and a tuning link of a description feature analysis subnet. In some examples, the logic for obtaining the commonality metric value is configured as a commonality metric determining unit, and the logic for comparing the commonality metric value with the set metric value is configured as a metric comparing unit, so that the artificial intelligence service system can configure the aligned text description mining subnet, the description feature analysis subnet, the commonality metric determining unit and the metric comparing unit to obtain a transform network. Exemplary design considerations include: (1) The text description mining unit and the text description projecting unit are calibrated; (2) tuning the descriptive feature analysis subnet; (3) And integrating the text description mining unit, the text description projecting unit, the description characteristic analysis subnet, the commonality measurement determining unit and the measurement comparing unit to generate a transducer network.

According to the technical scheme provided by the embodiment of the invention, the session safety detection text sample and the abnormal text description array sample corresponding to the session safety detection text sample are obtained, the abnormal text analysis description set and the abnormal text analysis array of the session safety detection text sample are extracted through the text description mining subnet, and the text description mining subnet is calibrated according to the comparison result between the abnormal text analysis array and the abnormal text description array sample. The method comprises the steps of obtaining a key text description array of a risk topic label corresponding to a session security detection text sample, obtaining a text detection variable analysis result corresponding to an abnormal text analysis description set through a description feature analysis subnet, obtaining a third adjustment cost index according to the abnormal text analysis array, the key text description array and the text detection variable analysis result, and adjusting the description feature analysis subnet according to the third adjustment cost index. And then, risk topic analysis can be carried out through a Transformer network comprising the text description mining sub-network and the description feature analysis sub-network, and in view of introducing the description feature analysis sub-network, the contribution of a text detection variable generated by the description feature analysis sub-network to the commonality metric value is introduced when the commonality metric value between a target session security detection text and a reference session security detection text is acquired, namely, the contribution of a detection offset index of an abnormal text description set to the commonality metric value is introduced instead of only analyzing an abnormal text description array corresponding to the abnormal text description set, so that the problem that word vectors of risk topics are difficult to be accurately output by the abnormal text description array due to disturbance in the session security detection text is avoided, the accuracy of risk topic judgment is improved, and the deviation generated during text analysis is reduced.

In addition, in the embodiment of the invention, the text description of the session safety detection text sample is projected into a text scene vector relation network to obtain an abnormal text analysis description set corresponding to the session safety detection text sample. In view of the fact that compared with a traditional text vector relation network, the text scene vector relation network is matched with the vector relation network of the risk subject, text description mining is carried out on the risk subject in the text scene vector relation network, so that the extracted risk subject word vector can be as accurate and complete as possible, and accuracy of the calibrated Transformer network in carrying out risk subject analysis can be improved.

The foregoing is only a specific embodiment of the present invention. Variations and alternatives will occur to those skilled in the art based on the detailed description provided herein and are intended to be included within the scope of the invention.

Claims

1. A big data security analysis method for online business session interaction, characterized in that it is applied to an artificial intelligence service system, the method comprising:

On the basis that the commonality measurement value is larger than a set measurement value, determining that the target session security detection text and the reference session security detection text are similar texts, and performing security analysis on the target session security detection text based on the reference session security detection text;

The step of performing security analysis on the target session security detection text based on the reference session security detection text includes:

The target session security detection text is transmitted into a decision tree model corresponding to the reference session security detection text, and a session text block pool which is generated by the decision tree model and aims at the target session security detection text is obtained, wherein the session text block pool comprises at least two session text blocks;

Obtaining contribution weights of all session text blocks in the session text block pool relative to the target session security detection text;

According to the contribution weight corresponding to each session text block and the abnormal decision vector of each session text block, performing text block arrangement on each session text block to obtain a corresponding session text block queue;

Determining a security analysis decision result set for the target session security detection text based on the session text chunking queue, the security analysis decision result set comprising at least two abnormal event probabilities;

and determining an abnormal event text block from the target session security detection text by using the abnormal event probability.

2. The method of claim 1, wherein the performing text description mining on the target session security detection text to obtain a first abnormal text description set corresponding to the target session security detection text and a first abnormal text description array corresponding to the first abnormal text description set includes:

3. The method according to claim 2, wherein the processing the first abnormal text description set to obtain a first text detection variable corresponding to the first abnormal text description set includes:

4. The method according to claim 2, wherein the text description mining subnet includes a text description mining unit and a text description projection unit, and the text description mining is performed on the target session security detection text by the text description mining subnet in the fransformer network to obtain a first abnormal text description set corresponding to the target session security detection text and a first abnormal text description array corresponding to the first abnormal text description set, including:

5. The method of claim 3, wherein before the processing the first abnormal text description set through the description feature parsing subnet in the fransformer network to obtain the first text detection variable corresponding to the first abnormal text description set, the method further comprises:

on the basis of maintaining unchanged the adjusted text description mining subnet, adjusting the description characteristic analysis subnet according to the abnormal text description array sample and the key text description array of the risk subject label corresponding to the session safety detection text sample;

The text description mining subnet is calibrated according to a session security detection text sample and an abnormal text description array sample corresponding to the session security detection text sample, and the method comprises the following steps:

According to the comparison result between the abnormal text analysis array and the abnormal text description array sample, calibrating the text description mining subnet;

The text description mining sub-network comprises a text description mining unit and a text description projection unit, and the text description mining is carried out on the session safety detection text sample through the text description mining sub-network to obtain an abnormal text analysis description set corresponding to the session safety detection text sample and an abnormal text analysis array corresponding to the abnormal text analysis description set, and the text description mining sub-network comprises: performing text description mining on the session security detection text sample through the text description mining unit to obtain an abnormal text analysis description set corresponding to the session security detection text sample; performing text description projection on the abnormal text analysis description set through the text description projection unit to obtain an abnormal text analysis array corresponding to the abnormal text analysis description set;

The converter network further comprises a network cost generation subnet, the network cost generation subnet comprises a confidence description array corresponding to each risk topic label, and the text description mining subnet is calibrated according to a comparison result between the abnormal text analysis array and the abnormal text description array sample, and the method comprises the following steps: generating a subnet through the network cost, and performing strengthening operation on the abnormal text analysis array according to a confidence description array corresponding to the risk topic label corresponding to the session security detection text sample to obtain an abnormal text description strengthening array corresponding to the abnormal text analysis array; acquiring a second adjustment cost index between the abnormal text description strengthening array and the abnormal text description array sample, wherein the second adjustment cost index represents a comparison result between the abnormal text description strengthening array and the abnormal text description array sample; according to the second adjustment cost index, adjusting the text description mining subnet and the network cost generating subnet;

On the basis of maintaining unchanged the calibrated text description mining subnet, calibrating the description feature analysis subnet according to the abnormal text description array sample and the key text description array of the risk topic label corresponding to the session security detection text sample, wherein the method comprises the following steps: acquiring a key text description array of a risk topic label corresponding to the session security detection text sample, wherein the key text description array represents a risk topic word vector corresponding to the risk topic label; processing the abnormal text analysis description set through the description characteristic analysis subnet to obtain a text detection variable analysis result corresponding to the abnormal text analysis description set, wherein the text detection variable analysis result is used for representing the abnormal text analysis description set to reflect a detection offset index of a risk subject word vector in the session safety detection text sample; acquiring a third adjustment cost index according to the abnormal text analysis array, the key text description array and the text detection variable analysis result, wherein the third adjustment cost index represents training cost of the text detection variable analysis result corresponding to the abnormal text analysis description set; and adjusting the description characteristic analysis subnet according to the third adjustment cost index.

6. The method of claim 5, wherein the obtaining a third tuning cost indicator based on the anomaly text parsing array, the key text description array, and the text detection variable parsing result comprises:

7. The method of claim 5, wherein the obtaining the key text description array of the risk topic tag corresponding to the session security check text sample comprises:

8. The method of claim 5, wherein the obtaining the key text description array of the risk topic tag corresponding to the session security check text sample comprises:

9. An artificial intelligence service system, comprising: a memory and a processor; the memory is coupled to the processor; the memory is used for storing computer program codes, and the computer program codes comprise computer instructions; wherein the computer instructions, when executed by the processor, cause the artificial intelligence service system to perform the method of any one of claims 1-8.

10. A computer readable storage medium, characterized in that it has stored thereon a computer program, which, when run, is a method according to any of claims 1-8.