Transaction data processing method and device

Abstract

The invention provides a transaction data processing method and device, and the method comprises the steps: constructing a transaction directed graph based on online transaction data in a preset time period; based on the transaction directed graph, determining an initial dealer set and an initial target dealer set, and calculating an abnormal behavior score of each node in the dealer set; determining a node with the lowest abnormal behavior score in the dealer set, moving the node from the dealer set to the excluder set, deleting the node from the transaction directed graph, and recalculating the abnormal behavior score of each node in the dealer set; if the abnormal behavior overall score of the target trader set is smaller than the abnormal behavior overall score of the trader set, updating the target trader set into the trader set; and repeating the above steps until the trader set is empty, and determining that the nodes in the target trader set are abnormal traders, so that the abnormal traders which may perform market abnormal transactions in the preset time period can be quickly and effectively identified.

Description

Technical Field

[0001] The present invention relates to the technical field of financial data management, and in particular to a transaction data processing method and device. Background Art

[0002] As a place for buying and selling financial instruments (such as stocks, bonds, currencies, futures, etc.), financial markets provide a channel for capital flow for enterprises, governments and investors, and are a core part of the global economy. With the advancement of technology, online trading platforms have gradually become the mainstream of the market, providing the convenience of real-time trading and data acquisition, allowing investors to easily participate in the global financial market through the Internet. Online trading has the advantages of high liquidity, good transparency, and low cost, but it also increases the risk of market volatility and abnormal trading behavior.

[0003] It can be seen that identifying abnormal trading behaviors and traders with abnormal trading behaviors is an important means to maintain the stability of financial markets. Therefore, a trading data processing solution can be provided to detect abnormal trading behaviors and traders by analyzing online trading data. Summary of the invention

[0004] The present invention provides a transaction data processing method and device, which are used to solve the defect in the prior art that it is difficult to identify abnormal traders with abnormal market behaviors.

[0005] The present invention provides a transaction data processing method, comprising: Step 110, constructing a transaction directed graph based on the online transaction data within a preset time period; wherein a node of the transaction directed graph corresponds to a trader, an edge corresponds to a transaction, and edge attributes include transaction submission time, transaction time, submitted transaction volume, transaction volume, submitted transaction price, and transaction price; Step 120, based on the transaction directed graph, determining an initial trader set and an initial target trader set, and calculating an abnormal behavior score of each node in the trader set; Step 130, determining the node with the lowest abnormal behavior score in the trader set and moving it from the trader set to the excluder set and deleting it from the transaction directed graph, and recalculating the abnormal behavior score of each node in the trader set; Step 140: if the overall score of abnormal behavior of the target trader set is less than the overall score of abnormal behavior of the trader set, then the target trader set is updated to the trader set; Step 150, repeating steps 130 and 140 until the trader set is empty, and determining that the node in the target trader set is an abnormal trader.

[0006] According to a transaction data processing method provided by the present invention, the abnormal behavior score of each node in the trader set is determined based on the following method: Based on the directed transaction graph, determining a suspicious transaction score of each transaction corresponding to an outgoing edge of any node and a suspicious transaction score of each transaction corresponding to an incoming edge of any node; The sum of the suspicious transaction scores of each transaction corresponding to the outgoing edge of any node and the suspicious transaction scores of each transaction corresponding to the incoming edge of any node is determined as the abnormal behavior score of any node.

[0007] According to a transaction data processing method provided by the present invention, the transaction suspicion score of a transaction corresponding to any edge in the transaction directed graph is determined based on the following method: Determine the sum of the node suspicion degrees of the two nodes connected by any one edge and the transaction suspicion degree of the transaction corresponding to any one edge as the transaction suspicion score of the transaction corresponding to any one edge; Among them, the node suspicion degree of any node is determined based on the transaction frequency of any node in a preset time period, the transaction frequency of any node in a trading outbreak period, and the transaction correlation between any node and the nodes in the target trader set; the transaction suspicion degree of any transaction is determined based on the difference between the submission time and the transaction time of any transaction, the difference between the submitted transaction volume and the transaction volume, and the difference between the submitted transaction price and the transaction price.

[0008] According to a transaction data processing method provided by the present invention, the transaction frequency of any node in any time period is calculated based on the following formula:

[0009] Where T(A) is the transaction frequency of node A, d is the number of time slices after dividing any time period, and X j is the number of transactions performed by node A in the jth time slice.

[0010] According to a transaction data processing method provided by the present invention, the transaction relevance between any node and the nodes in the target trader set is determined based on the following method: Based on the transaction directed graph, determine the number of edges between any node and each node in the target trader set and the number of edges between any node and each node in the excluded trader set; The difference between the number of edges between any node and each node in the target trader set and the number of edges between any node and each node in the excluder set is determined as the transaction relevance between any node and the nodes in the target trader set.

[0011] According to a transaction data processing method provided by the present invention, the transaction suspicion of any transaction is determined based on the following method: If the difference between the submission time and the transaction time of any transaction is greater than the preset time difference, or the difference between the submission transaction price and the transaction price of any transaction is greater than the preset price difference, then the transaction suspicion degree of any transaction is determined to be the preset value; Otherwise, the transaction suspicion of any transaction is determined based on the difference between the submission time and the transaction time of any transaction, the difference between the submission transaction volume and the transaction volume, and the ratio between the submission transaction price and the transaction price.

[0012] According to a transaction data processing method provided by the present invention, the target trader set or the overall abnormal behavior score of the trader set is an average value of the abnormal behavior scores of each node in the corresponding set.

[0013] The present invention also provides a transaction data processing device, comprising: A graph construction unit, configured to construct a directed transaction graph based on online transaction data within a preset time period; wherein a node of the directed transaction graph corresponds to a trader, an edge corresponds to a transaction, and edge attributes include a submission time, a transaction time, a submission transaction volume, a transaction volume, a submission transaction price, and a transaction price; An initialization unit, used to determine an initial trader set and an initial target trader set based on the transaction directed graph, and calculate an abnormal behavior score of each node in the trader set; A first set updating unit, configured to determine the node with the lowest abnormal behavior score in the trader set and move it from the trader set to the excluder set and delete it from the transaction directed graph, and recalculate the abnormal behavior score of each node in the trader set; A second set updating unit, configured to update the target trader set to the trader set when the overall score of the abnormal behavior of the target trader set is less than the overall score of the abnormal behavior of the trader set; The iteration unit is used to repeatedly call the first set updating unit and the second set updating unit until the trader set is empty, and determine that the node in the target buyer and seller set is an abnormal trader.

[0014] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, any of the transaction data processing methods described above is implemented.

[0015] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the transaction data processing method described in any one of the above is implemented.

[0016] The present invention also provides a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the transaction data processing method described above is implemented.

[0017] The present invention provides a transaction data processing method and device, which construct a transaction directed graph based on online transaction data within a preset time period; determine an initial trader set and an initial target trader set based on the transaction directed graph, and calculate the abnormal behavior score of each node in the trader set; determine the node with the lowest abnormal behavior score in the trader set and move it from the trader set to the excluder set and delete it from the transaction directed graph, and recalculate the abnormal behavior score of each node in the trader set; if the overall abnormal behavior score of the target trader set is less than the overall abnormal behavior score of the trader set, update the target trader set to the trader set; repeat the above steps until the trader set is empty, and determine that the nodes in the target buyer and seller set are abnormal traders, so as to quickly and effectively identify abnormal traders who may conduct abnormal market transactions within the preset time period, and help improve the stability of financial market transactions. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 It is a flowchart of the transaction data processing method provided by the present invention; Figure 2 It is a flowchart of a method for determining an abnormal behavior score of any node provided by the present invention; Figure 3 It is a structural schematic diagram of the transaction data processing device provided by the present invention; Figure 4 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] Figure 1 It is a flow chart of the transaction data processing method provided by the present invention, such as Figure 1 As shown, the method includes: Step 110, constructing a transaction directed graph based on the online transaction data within a preset time period; wherein a node of the transaction directed graph corresponds to a trader, an edge corresponds to a transaction, and edge attributes include transaction submission time, transaction time, submitted transaction volume, transaction volume, submitted transaction price, and transaction price; Step 120, based on the transaction directed graph, determining an initial trader set and an initial target trader set, and calculating an abnormal behavior score of each node in the trader set; Step 130, determining the node with the lowest abnormal behavior score in the trader set and moving it from the trader set to the excluder set and deleting it from the transaction directed graph, and recalculating the abnormal behavior score of each node in the trader set; Step 140: if the overall score of abnormal behavior of the target trader set is less than the overall score of abnormal behavior of the trader set, then the target trader set is updated to the trader set; Step 150, repeating steps 130 and 140 until the trader set is empty, and determining that the node in the target trader set is an abnormal trader.

[0022] Here, the preset time period may include one or more trading days. After obtaining the online transaction data within the preset time period, a transaction directed graph may be constructed based on the trader, submission time (i.e., the time when the seller proposes the transaction), transaction time, submitted transaction volume (i.e., the transaction volume desired by the seller when proposing the transaction), transaction volume, submitted transaction price (i.e., the transaction price desired by the seller when proposing the transaction), and transaction price of each transaction contained in the online transaction data. Each node of the transaction directed graph corresponds to a trader, who may be a seller or a buyer in different transactions. Between two nodes, if there is a transaction between the traders corresponding to the two nodes, the two nodes are connected by a directed edge, and the direction of the directed edge is from the seller to the buyer. The edge attributes of each edge include information such as the submission time, transaction time, submitted transaction volume, transaction volume, submitted transaction price, and transaction price of the corresponding transaction.

[0023] According to the transaction directed graph, an initial set of traders and an initial set of target traders can be constructed, wherein the initial set of traders and the initial set of target traders are the same, and both contain all the nodes in the transaction directed graph. Subsequently, based on the transaction directed graph, the abnormal behavior scores of each node in the trader set can be calculated, and the overall abnormal behavior score of the current trader set can be calculated. It should be noted that, since the initial set of traders and the initial set of target traders are the same, the overall abnormal behavior score of the current target set of traders is also equal to the overall abnormal behavior score of the current set of traders. Here, the higher the abnormal behavior score of a node, the higher the possibility that the trader corresponding to the node has conducted abnormal market transactions.

[0024] In some embodiments, Figure 2 As shown, the abnormal behavior score of each node in the trader set can be determined based on the following method: Step 210, based on the transaction directed graph, determining the transaction suspicion score of each transaction corresponding to the outgoing edge of any node and the transaction suspicion score of each transaction corresponding to the incoming edge of any node; Step 220: Determine the sum of the suspicious transaction scores of each transaction corresponding to the outgoing edge of any node and the suspicious transaction scores of each transaction corresponding to the incoming edge of any node as the abnormal behavior score of any node.

[0025] Specifically, the suspicious transaction score of each transaction corresponding to each edge in the directed transaction graph can be calculated. For any node, the suspicious transaction scores of each transaction corresponding to all outgoing edges and all incoming edges of the node are obtained, and the accumulated sum is used as the abnormal behavior score of the node.

[0026] Among them, the transaction suspicion score of the transaction corresponding to any edge is the sum of the node suspicion of the two nodes connected by the edge and the transaction suspicion of the transaction corresponding to the edge. In some embodiments, the node suspicion of any node is determined based on the transaction frequency of the node in a preset time period, the transaction frequency of the node during the transaction outbreak period, and the transaction correlation between the node and the nodes in the target trader set. Among them, the transaction correlation between any node and the nodes in the target trader set characterizes the difference in the number of transactions between the trader corresponding to the node and the suspicious trader relative to the number of transactions between the trader and the ordinary trader. The transaction suspicion of any transaction is determined based on the difference between the submission time and the transaction time of the transaction, the difference between the submitted transaction volume and the transaction volume, and the difference between the submitted transaction price and the transaction transaction price.

[0027] In other embodiments, the transaction frequency of any node in any time period is calculated based on the following formula:

[0028] Among them, T(A) is the transaction frequency of node A in the time period, d is the number of time slices after the time period is divided, and X j is the number of transactions performed by node A in the jth time slice.

[0029] Secondly, in order to calculate the transaction correlation between any node and the nodes in the target trader set, the number of edges (including incoming edges and outgoing edges) between the node and each node in the target trader set and the number of edges (including incoming edges and outgoing edges) between the node and each node in the excluder set (the nodes in the excluder set are traders with less suspicious levels screened out in the cyclic process, which will be described in detail later) can be determined based on the transaction directed graph, and then the difference between the number of edges between the node and each node in the target trader set and the number of edges between the node and each node in the excluder set is determined as the transaction correlation between the node and the nodes in the target trader set.

[0030] Regarding the transaction suspicion of any transaction, if the difference between the submission time and the transaction time of the transaction is greater than the preset time difference, or the difference between the submission transaction price and the transaction price of the transaction is greater than the preset price difference, the transaction suspicion of the transaction is determined to be a preset value (a lower value, for example, 0); otherwise, the transaction suspicion of the transaction is determined based on the difference between the submission time and the transaction time of the transaction, the difference between the submission transaction volume and the transaction volume, and the ratio between the submission transaction price and the transaction price. In some embodiments, when the difference between the submission time and the transaction time of the transaction is not greater than the preset time difference, and the difference between the submission transaction price and the transaction price of the transaction is not greater than the preset price difference, the transaction suspicion of the transaction can be calculated based on the following formula:

[0031] Among them, C is the transaction suspicion of the transaction, ti and tj are the submission time and transaction time of the transaction, pi and pj are the submission transaction price and transaction price of the transaction, vi and vj are the submission transaction price and transaction price of the transaction, is the preset time difference, The preset price difference.

[0032] After obtaining the abnormal behavior scores of each node in the initial trader set, determine the node with the lowest abnormal behavior score in the trader set (i.e., the node with the least suspicious degree in the current trader set), move it from the trader set to the excluder set and delete it from the transaction directed graph to obtain a new transaction directed graph. Subsequently, based on the method provided in the above embodiment, recalculate the abnormal behavior scores of each node in the trader set based on the updated transaction directed graph, and recalculate the overall abnormal behavior score of the current trader set. If the overall abnormal behavior score of the current target trader set is less than the overall abnormal behavior score of the current trader set, update the current target trader set to the current trader set, and update the overall abnormal behavior score of the current target trader set to the overall abnormal behavior score of the current trader set. Among them, the overall abnormal behavior score of the target trader set or the trader set is the average of the abnormal behavior scores of each node in the corresponding set. Repeat the above steps 130 and 140 until the trader set is empty. At this time, the trader corresponding to the node in the target buyer and seller set is an abnormal trader, and can be monitored intensively to ensure the transaction stability of the financial market.

[0033] In summary, the method provided by the embodiment of the present invention constructs a transaction directed graph based on online transaction data within a preset time period; based on the transaction directed graph, determines an initial trader set and an initial target trader set, and calculates the abnormal behavior score of each node in the trader set; determines the node with the lowest abnormal behavior score in the trader set and moves it from the trader set to the excluder set and deletes it from the transaction directed graph, and recalculates the abnormal behavior score of each node in the trader set; if the overall abnormal behavior score of the target trader set is less than the overall abnormal behavior score of the trader set, the target trader set is updated to the trader set; repeats the above steps until the trader set is empty, and determines that the nodes in the target buyer and seller set are abnormal traders, which can quickly and effectively identify abnormal traders who may conduct abnormal market transactions within the preset time period, and help improve the stability of financial market transactions.

[0034] The transaction data processing device provided by the present invention is described below. The transaction data processing device described below and the transaction data processing method described above can be referenced to each other.

[0035] Based on any of the above embodiments, Figure 3 is a schematic diagram of the structure of the transaction data processing device provided by the present invention, such as Figure 3 As shown, the device comprises: A graph construction unit 310 is used to construct a transaction directed graph based on online transaction data within a preset time period; wherein a node of the transaction directed graph corresponds to a trader, an edge corresponds to a transaction, and edge attributes include a transaction submission time, a transaction transaction time, a submitted transaction volume, a transaction volume, a submitted transaction price, and a transaction transaction price; An initialization unit 320, configured to determine an initial trader set and an initial target trader set based on the transaction directed graph, and calculate an abnormal behavior score of each node in the trader set; A first set updating unit 330, configured to determine the node with the lowest abnormal behavior score in the trader set and move it from the trader set to the excluder set and delete it from the transaction directed graph, and recalculate the abnormal behavior score of each node in the trader set; The second set updating unit 340 is configured to update the target trader set to the trader set when the overall score of the abnormal behavior of the target trader set is less than the overall score of the abnormal behavior of the trader set; The iteration unit 350 is used to repeatedly call the first set updating unit and the second set updating unit until the trader set is empty, and determine that the node in the target trader set is an abnormal trader.

[0036] The device provided by the embodiment of the present invention constructs a transaction directed graph based on online transaction data within a preset time period; determines an initial trader set and an initial target trader set based on the transaction directed graph, and calculates the abnormal behavior score of each node in the trader set; determines the node with the lowest abnormal behavior score in the trader set and moves it from the trader set to the excluder set and deletes it from the transaction directed graph, and recalculates the abnormal behavior score of each node in the trader set; if the overall abnormal behavior score of the target trader set is less than the overall abnormal behavior score of the trader set, the target trader set is updated to the trader set; repeats the above steps until the trader set is empty, and determines that the nodes in the target buyer and seller set are abnormal traders, so that abnormal traders who may conduct abnormal market transactions within the preset time period can be quickly and effectively identified, which helps to improve the stability of financial market transactions.

[0037] Based on any of the above embodiments, the abnormal behavior score of each node in the trader set is determined based on the following method: Based on the directed transaction graph, determining a suspicious transaction score of each transaction corresponding to an outgoing edge of any node and a suspicious transaction score of each transaction corresponding to an incoming edge of any node; The sum of the suspicious transaction scores of each transaction corresponding to the outgoing edge of any node and the suspicious transaction scores of each transaction corresponding to the incoming edge of any node is determined as the abnormal behavior score of any node.

[0038] Based on any of the above embodiments, the transaction suspicion score of a transaction corresponding to any edge in the transaction directed graph is determined based on the following method: Determine the sum of the node suspicion degrees of the two nodes connected by any one edge and the transaction suspicion degree of the transaction corresponding to any one edge as the transaction suspicion score of the transaction corresponding to any one edge; Among them, the node suspicion degree of any node is determined based on the transaction frequency of any node in a preset time period, the transaction frequency of any node in a trading outbreak period, and the transaction correlation between any node and the nodes in the target trader set; the transaction suspicion degree of any transaction is determined based on the difference between the submission time and the transaction time of any transaction, the difference between the submitted transaction volume and the transaction volume, and the difference between the submitted transaction price and the transaction price.

[0039] Based on any of the above embodiments, the transaction frequency of any node in any time period is calculated based on the following formula:

[0040] Where T(A) is the transaction frequency of node A, d is the number of time slices after dividing any time period, and X j is the number of transactions performed by node A in the jth time slice.

[0041] Based on any of the above embodiments, the transaction relevance between any node and the nodes in the target trader set is determined based on the following method: Based on the transaction directed graph, determine the number of edges between any node and each node in the target trader set and the number of edges between any node and each node in the excluded trader set; The difference between the number of edges between any node and each node in the target trader set and the number of edges between any node and each node in the excluder set is determined as the transaction relevance between any node and the nodes in the target trader set.

[0042] Based on any of the above embodiments, the transaction suspicion of any transaction is determined based on the following method: If the difference between the submission time and the transaction time of any transaction is greater than the preset time difference, or the difference between the submission transaction price and the transaction price of any transaction is greater than the preset price difference, then the transaction suspicion degree of any transaction is determined to be the preset value; Otherwise, the transaction suspicion of any transaction is determined based on the difference between the submission time and the transaction time of any transaction, the difference between the submission transaction volume and the transaction volume, and the ratio between the submission transaction price and the transaction price.

[0043] Based on any of the above embodiments, the target trader set or the overall abnormal behavior score of the trader set is an average value of the abnormal behavior scores of each node in the corresponding set.

[0044] Figure 4 is a schematic diagram of the structure of the electronic device provided by the present invention, such as Figure 4 As shown, the electronic device may include: a processor 410, a memory 420, a communications interface 430 and a communications bus 440, wherein the processor 410, the memory 420 and the communications interface 430 communicate with each other through the communications bus 440. The processor 410 may call the logic instructions in the memory 420 to execute the transaction data processing method, which includes: step 110, constructing a transaction directed graph based on the online transaction data within a preset time period; wherein the nodes of the transaction directed graph correspond to traders, an edge corresponds to a transaction, and the edge attributes include the submission time, transaction time, submission transaction volume, transaction volume, submission transaction price and transaction transaction price of the transaction; step 120, based on the transaction directed graph, determining the initial trader set and the initial target trader set, and calculating the abnormal behavior of each node in the trader set. score; step 130, determining the node with the lowest abnormal behavior score in the trader set and moving it from the trader set to the excluder set and deleting it from the transaction directed graph, recalculating the abnormal behavior score of each node in the trader set; step 140, if the overall abnormal behavior score of the target trader set is less than the overall abnormal behavior score of the trader set, updating the target trader set to the trader set; step 150, repeating steps 130 and 140 until the trader set is empty, determining that the node in the target trader set is an abnormal trader.

[0045] In addition, the logic instructions in the above-mentioned memory 420 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0046] On the other hand, the present invention also provides a computer program product, the computer program product includes a computer program stored on a non-transitory computer-readable storage medium, the computer program includes program instructions, when the program instructions are executed by a computer, the computer can execute the transaction data processing method provided by the above methods, the method comprising: step 110, based on the online transaction data within a preset time period, constructing a transaction directed graph; wherein the nodes of the transaction directed graph correspond to traders, an edge corresponds to a transaction, and the edge attributes include the submission time, transaction time, submission transaction volume, transaction volume, submission transaction price and transaction transaction price of the transaction; step 120, based on the transaction directed graph, determining the initial The trader set and the initial target trader set are determined, and the abnormal behavior score of each node in the trader set is calculated; step 130, determining the node with the lowest abnormal behavior score in the trader set and moving it from the trader set to the excluder set and deleting it from the transaction directed graph, and recalculating the abnormal behavior score of each node in the trader set; step 140, if the overall abnormal behavior score of the target trader set is less than the overall abnormal behavior score of the trader set, then updating the target trader set to the trader set; step 150, repeating steps 130 and 140 until the trader set is empty, and determining that the node in the target trader set is an abnormal trader.

[0047] In another aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which is implemented when the processor executes the above-mentioned transaction data processing method, the method comprising: step 110, constructing a transaction directed graph based on online transaction data within a preset time period; wherein the nodes of the transaction directed graph correspond to traders, an edge corresponds to a transaction, and the edge attributes include the submission time, transaction time, submission transaction volume, transaction volume, submission transaction price and transaction transaction price of the transaction; step 120, determining an initial set of traders and an initial set of target traders based on the transaction directed graph, and calculating Calculate the abnormal behavior score of each node in the trader set; step 130, determine the node with the lowest abnormal behavior score in the trader set and move it from the trader set to the excluder set and delete it from the transaction directed graph, and recalculate the abnormal behavior score of each node in the trader set; step 140, if the overall abnormal behavior score of the target trader set is less than the overall abnormal behavior score of the trader set, update the target trader set to the trader set; step 150, repeat steps 130 and 140 until the trader set is empty, and determine that the node in the target trader set is an abnormal trader.

[0048] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0049] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0050] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A transaction data processing method, characterized in that: include: Step 110, constructing a transaction directed graph based on the online transaction data within a preset time period; wherein a node of the transaction directed graph corresponds to a trader, an edge corresponds to a transaction, and edge attributes include transaction submission time, transaction time, submitted transaction volume, transaction volume, submitted transaction price, and transaction price; Step 120, based on the transaction directed graph, determining an initial trader set and an initial target trader set, and calculating an abnormal behavior score of each node in the trader set; Step 130, determining the node with the lowest abnormal behavior score in the trader set and moving it from the trader set to the excluder set and deleting it from the transaction directed graph, and recalculating the abnormal behavior score of each node in the trader set; Step 140: if the overall score of abnormal behavior of the target trader set is less than the overall score of abnormal behavior of the trader set, then the target trader set is updated to the trader set; Step 150, repeating steps 130 and 140 until the trader set is empty, and determining that the node in the target trader set is an abnormal trader.

2. A transaction data processing method according to claim 1, characterized in that: The abnormal behavior score of each node in the trader set is determined based on the following method: Based on the directed transaction graph, determining a suspicious transaction score of each transaction corresponding to an outgoing edge of any node and a suspicious transaction score of each transaction corresponding to an incoming edge of any node; The sum of the suspicious transaction scores of each transaction corresponding to the outgoing edge of any node and the suspicious transaction scores of each transaction corresponding to the incoming edge of any node is determined as the abnormal behavior score of any node.

3. A transaction data processing method according to claim 2, characterized in that: The transaction suspicion score of a transaction corresponding to any edge in the transaction directed graph is determined based on the following method: Determine the sum of the node suspicion degrees of the two nodes connected by any one edge and the transaction suspicion degree of the transaction corresponding to any one edge as the transaction suspicion score of the transaction corresponding to any one edge; Among them, the node suspicion degree of any node is determined based on the transaction frequency of any node in a preset time period, the transaction frequency of any node in a trading outbreak period, and the transaction correlation between any node and the nodes in the target trader set; the transaction suspicion degree of any transaction is determined based on the difference between the submission time and the transaction time of any transaction, the difference between the submitted transaction volume and the transaction volume, and the difference between the submitted transaction price and the transaction price.

4. A transaction data processing method according to claim 3, characterized in that: The transaction frequency of any node in any time period is calculated based on the following formula: Where T(A) is the transaction frequency of node A, d is the number of time slices after dividing any time period, and X j is the number of transactions performed by node A in the jth time slice.

5. A transaction data processing method according to claim 3, characterized in that: The transaction relevance between any node and the nodes in the target trader set is determined based on the following method: Based on the transaction directed graph, determine the number of edges between any node and each node in the target trader set and the number of edges between any node and each node in the excluded trader set; The difference between the number of edges between any node and each node in the target trader set and the number of edges between any node and each node in the excluder set is determined as the transaction relevance between any node and the nodes in the target trader set.

6. A transaction data processing method according to claim 3, characterized in that: The transaction suspicion of any transaction is determined based on the following: If the difference between the submission time and the transaction time of any transaction is greater than the preset time difference, or the difference between the submission transaction price and the transaction price of any transaction is greater than the preset price difference, then the transaction suspicion degree of any transaction is determined to be the preset value; Otherwise, the transaction suspicion of any transaction is determined based on the difference between the submission time and the transaction time of any transaction, the difference between the submission transaction volume and the transaction volume, and the ratio between the submission transaction price and the transaction price.

7. A transaction data processing method according to any one of claims 1 to 6, characterized in that: The overall abnormal behavior score of the target trader set or the trader set is the average of the abnormal behavior scores of each node in the corresponding set.

8. A transaction data processing method, characterized in that: include: A graph construction unit, configured to construct a directed transaction graph based on online transaction data within a preset time period; wherein a node of the directed transaction graph corresponds to a trader, an edge corresponds to a transaction, and edge attributes include a submission time, a transaction time, a submission transaction volume, a transaction volume, a submission transaction price, and a transaction price; An initialization unit, used to determine an initial trader set and an initial target trader set based on the transaction directed graph, and calculate an abnormal behavior score of each node in the trader set; A first set updating unit, configured to determine the node with the lowest abnormal behavior score in the trader set and move it from the trader set to the excluder set and delete it from the transaction directed graph, and recalculate the abnormal behavior score of each node in the trader set; A second set updating unit, configured to update the target trader set to the trader set when the overall score of the abnormal behavior of the target trader set is less than the overall score of the abnormal behavior of the trader set; The iteration unit is used to repeatedly call the first set updating unit and the second set updating unit until the trader set is empty, and determine that the node in the target buyer and seller set is an abnormal trader.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, a transaction data processing method as described in any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, a transaction data processing method as described in any one of claims 1 to 7 is implemented.

Images