Method and device for predicting fraud risk in combination with historical behavior analysis

Abstract

The invention discloses a fraud risk prediction method and device in combination with historical behavior analysis, and relates to the technical field of transaction risk prediction.The method comprises the steps that when a user initiates a transaction, transaction state information is monitored, and the transaction state information comprises transaction behaviors, network behaviors and biological behaviors; counting accounts whose transaction frequency with the user is greater than or equal to a threshold value, and obtaining a user associated account set; if there is no risk account in the associated account set (i.e., the historical fraud frequency is lower than a threshold value), counting a fraud transaction proportion in historical transaction behaviors having the same modality as the transaction behavior and the network behavior; if the fraudulent transaction proportion is lower than a threshold value, counting historical biological behaviors of the user; and if the historical biological behavior is inconsistent with the current biological behavior, generating a fraud risk prompt and feeding back the fraud risk prompt to the user side, thereby achieving the technical effect of improving the accuracy and reliability of fraud risk prediction.

Description

Technical Field

[0001] The present invention relates to the technical field of transaction risk prediction, and particularly to a fraud risk prediction method and device combining historical behavior analysis. Background Art

[0002] Traditional fraud risk assessment methods mainly rely on simple analysis of transaction types, transaction amounts, and user behaviors, and judge whether there are abnormal transaction behaviors by setting thresholds, which have obvious deficiencies. First, it mainly analyzes the abnormal situations of user behaviors based on transaction types. Although this method can identify some obvious fraud behaviors, it is prone to misjudgment for those transaction behaviors that seemingly normal on the surface but have a certain gap with the user's standard behaviors. Second, traditional methods fail to fully consider the historical behavior characteristics of users, especially biological behavior characteristics, resulting in an incomplete and inaccurate assessment of fraud risks. Summary of the Invention

[0003] Aiming at the technical problems of insufficient accuracy and reliability in transaction risk prediction in the prior art, the present invention provides an atmospheric greenhouse gas concentration monitoring method and device based on AI technology to solve.

[0004] The technical solution of the present invention to solve the above technical problems is as follows: In a first aspect, the present invention provides a fraud risk prediction method combining historical behavior analysis, including: When a user initiates a transaction, monitor the transaction status information, where the transaction status information includes transaction behavior, network behavior, and biological behavior.

[0005] Count the accounts whose transaction frequency with the user is greater than or equal to the transaction frequency threshold to obtain a set of user-associated accounts.

[0006] When there are no risk accounts in the set of user-associated accounts, count the proportion of fraudulent transactions in the historical transaction behaviors with the same modality as the transaction behavior and the network behavior, where the risk account refers to an account whose historical fraud frequency is greater than or equal to the fraud frequency threshold.

[0007] When the proportion of fraudulent transactions is less than the fraudulent transaction proportion threshold, count the historical biological behavior of the user.

[0008] When the historical biological behavior is inconsistent with the biological behavior, generate a fraud risk prompt and feedback it to the user terminal.

[0009] In a second aspect, the present invention provides a fraud risk prediction device combining historical behavior analysis, including: A transaction status information monitoring module, configured to monitor the transaction status information when a user initiates a transaction, where the transaction status information includes transaction behavior, network behavior, and biological behavior.

[0010] An associated account acquisition module, configured to count accounts whose transaction frequency with the user is greater than or equal to a transaction frequency threshold, and obtain a set of user-associated accounts.

[0011] A proportion statistics module, configured to, when the set of user-associated accounts does not have a risky account, count the proportion of fraudulent transactions in historical transaction behaviors in the same modality as the transaction behavior and the network behavior, where the risky account refers to an account whose historical fraud frequency is greater than or equal to a fraud frequency threshold.

[0012] A biological behavior statistics module, configured to, when the proportion of fraudulent transactions is less than a fraudulent transaction proportion threshold, count the historical biological behaviors of the user.

[0013] A risk warning generation module, configured to, when the historical biological behavior is inconsistent with the biological behavior, generate a fraud risk warning and feedback it to the user terminal.

[0014] The beneficial effects of the present invention are as follows: When a user initiates a transaction, monitor transaction status information, including transaction behavior, network behavior, and biological behavior; count a set of user-associated accounts whose transaction frequency is greater than or equal to a transaction frequency threshold; if there is no risky account in the set of user-associated accounts, then count the proportion of fraudulent transactions in historical transaction behaviors in the same modality as the user's transaction behavior and network behavior. A risky account refers to an account whose historical fraud frequency is greater than or equal to a fraud frequency threshold; if the proportion of fraudulent transactions is lower than a fraudulent transaction proportion threshold, then continue to count the historical biological behaviors of the user; if the historical biological behavior is inconsistent with the current biological behavior, the device will generate a fraud risk warning and feedback it to the user terminal, achieving the technical effects of improving the accuracy and reliability of fraud risk prediction. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 It is a flowchart of a fraud risk prediction method combining historical behavior analysis according to the present invention; Figure 2 It is a structural diagram of a fraud risk prediction device combining historical behavior analysis according to the present invention.

[0016] In the drawings, the components represented by the reference numerals are described as follows: A transaction status information monitoring module 11, an associated account acquisition module 12, a proportion statistics module 13, a biological behavior statistics module 14, a risk warning generation module 15. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0017] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative efforts shall fall within the protection scope of the present invention.

[0018] In the description of the present invention, the terms "first" and "second" are only used for descriptive purposes and cannot be construed as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, the features defined with "first" and "second" may explicitly or implicitly include one or more of the described features. In the description of the present invention, "a plurality of" means two or more, unless otherwise specifically defined.

[0019] In the description of the present invention, the term "for example" is used to mean "serving as an example, illustration, or explanation". Any embodiment described as "for example" in the present invention is not necessarily construed as being more preferred or having more advantages than other embodiments. In order for any person skilled in the art to implement and use the present invention, the following description is given. In the following description, details are set forth for purposes of explanation. It should be understood that those of ordinary skill in the art can recognize that the present invention can be implemented without using these specific details. In other instances, well-known structures and processes are not described in detail to avoid obscuring the description of the present invention with unnecessary details. Therefore, the present invention is not intended to be limited to the embodiments shown, but is consistent with the broadest scope that conforms to the principles and features disclosed in the present invention.

[0020] Embodiment 1, as Figure 1 shown in the flowchart of the fraud risk prediction method combining historical behavior analysis of the present invention. Among them, the method includes: When a user initiates a transaction, monitor the transaction status information, where the transaction status information includes transaction behavior, network behavior, and biological behavior.

[0021] Specifically, the transaction status information is information reflecting various behavior conditions of the user during the transaction process, including transaction behavior, network behavior, and biological behavior; among them, the transaction behavior includes specific transaction operations executed by the user, such as payment, order confirmation, product selection, etc.; network behavior: refers to the network activities of the user during the transaction process, such as clicking, accessing pages, inputting data, etc.; biological behavior refers to the interaction behavior of the user during the transaction, such as operation speed, pointer movement trajectory, etc.

[0022] Exemplarily, when a user selects and pays for a product on an e-commerce platform, transaction operations such as "adding to cart", "settling accounts", and "paying" are recorded; user network behavior information such as access duration, page stay time, and data input frequency is collected through the log monitoring of the user device and network traffic analysis tools; through the human-computer interaction device, the user's operation speed, pointer movement trajectory, etc. are collected.

[0023] Through multi-dimensional monitoring of transaction status information, multi-dimensional data related to transactions is comprehensively collected, providing more comprehensive user behavior characteristics for risk assessment.

[0024] Accounts with a transaction frequency greater than or equal to the transaction frequency threshold for the user are counted to obtain a set of user-associated accounts.

[0025] Specifically, the transaction frequency refers to the frequency of transactions between the user and other accounts, measured by the number of transactions within a certain period; the transaction frequency threshold is a pre-set reference value used to screen accounts with frequent transactions with the user.

[0026] Specifically, the set of user-associated accounts refers to the set of all accounts whose transaction frequency with the user reaches or exceeds the threshold.

[0027] In some embodiments, counting accounts with a transaction frequency greater than or equal to the transaction frequency threshold for the user to obtain a set of user-associated accounts includes: The user includes a transaction buyer and a transaction seller; accounts with a transaction frequency greater than or equal to the transaction frequency threshold for the transaction buyer are counted to obtain a set of transaction-buyer-associated accounts; accounts with a transaction frequency greater than or equal to the transaction frequency threshold for the transaction seller are counted to obtain a set of transaction-seller-associated accounts; the set of transaction-buyer-associated accounts and the set of transaction-seller-associated accounts are added to the set of user-associated accounts.

[0028] Specifically, the transaction buyer refers to the account that initiates a purchase request, while the transaction seller refers to the account that provides goods or services; the set of associated accounts is a set of accounts with a relatively high transaction frequency with the user (buyer or seller), and can be considered to have a certain relevance to the current user.

[0029] Specifically, first, users are divided into transaction buyers and transaction sellers, and the accounts with frequent transactions with them are counted separately; then, through the background database records, the accounts of the transaction sellers and transaction buyers are counted respectively to obtain the transaction frequency of each account within a certain period. If the transaction frequency of an account reaches or exceeds the transaction frequency threshold, then the account is regarded as an active account and is correspondingly added to the transaction buyer associated account set or the transaction seller associated account set; finally, the transaction buyer associated account set and the transaction seller associated account set are merged into the user associated account set, and the merged account set contains all the accounts that are active in the buying and selling process. The above steps identify high-frequency accounts by counting the transaction frequencies of transaction buyers and transaction sellers, and merge them into the "user associated account set", providing analysis objects for subsequent user behavior analysis, risk control, market prediction, etc., which helps to more accurately predict fraud risks.

[0030] In some implementation manners, the accounts with the transaction frequency of the transaction buyers greater than or equal to the transaction frequency threshold are counted to obtain the transaction buyer associated account set, including: Count the accounts that directly trade with the transaction buyers and have a transaction frequency greater than or equal to the transaction frequency threshold, and set them as the first-level transaction buyer associated account set; count the accounts that directly trade with any transaction buyer associated account in the first-level transaction buyer associated account set and have a transaction frequency greater than or equal to the transaction frequency threshold, and set them as the second-level transaction buyer associated account set; until the accounts that directly trade with any transaction buyer associated account in the N-1 level transaction buyer associated account set and have a transaction frequency greater than or equal to the transaction frequency threshold are counted, and set them as the N-level transaction buyer associated account set, where N is a user preset value, N is an integer, and N≥2; add the first-level transaction buyer associated account set, the second-level transaction buyer associated account set until the N-level transaction buyer associated account set to the transaction buyer associated account set.

[0031] Specifically, the first-level, second-level until the N-level transaction buyer associated account sets represent accounts at different levels (degree of association). Among them, the first-level associated accounts are the accounts that directly trade with the transaction buyers, the second-level associated accounts are the accounts that trade with the first-level associated accounts, and so on. The N-level transaction buyer associated account set is the account set that directly trades with the N-1 level accounts.

[0032] Specifically, first, through database query, all accounts that have directly transacted with the transaction buyer are screened out, the transaction frequencies of these accounts are calculated, and accounts with a frequency greater than or equal to a preset threshold are screened out and output as the set of first-level transaction buyer associated accounts. Then, based on the transaction history of the first-level transaction buyer associated accounts in the set of first-level transaction buyer associated accounts, through the same method steps as above, accounts that have directly transacted with the first-level associated accounts are further screened out as second-level transaction buyer associated accounts, and the transaction frequencies are also calculated to screen out accounts with a frequency greater than or equal to the transaction frequency threshold. All accounts that meet the conditions form the set of second-level transaction buyer associated accounts.

[0033] Furthermore, the above screening process is recursively performed, that is, in each set of associated accounts, other accounts that have directly transacted with any account in the current set are continuously searched for, and their transaction frequencies are calculated. For each account that meets the conditions, it is included in the set of associated accounts at the next level (such as the third level, fourth level, etc.) until the user-prescribed N level is reached. Through such a recursive hierarchical structure, accounts directly and indirectly related to the transaction buyer's account can be deeply explored, providing rich data support for subsequent transaction analysis and risk assessment, and then searching for improper behaviors in complex transaction chains. For example, an account may transact frequently with the direct associated accounts (intermediaries or handlers) of the transaction buyer but not frequently with the transaction buyer itself. In this case, the above recursive hierarchical association analysis can provide a sufficiently in-depth data basis for identifying the potential risks of this account subsequently.

[0034] When there are no risk accounts in the set of user associated accounts, the proportion of fraudulent transactions in historical transaction behaviors with the same modality as the transaction behavior and the network behavior is statistically calculated, where the risk account refers to an account with a historical fraud frequency greater than or equal to the fraud frequency threshold.

[0035] Specifically, a risk account refers to an account with a relatively high historical fraud frequency, that is, an account with a historical fraud frequency greater than or equal to a preset fraud frequency threshold.

[0036] Exemplarily, by modeling historical transaction behaviors and network behaviors and combining data mining techniques (such as clustering analysis, classification algorithms, etc.), historical transaction records that match the current user's transaction behavior and network behavior are found. Among them, optionally, the modality includes transaction type, transaction amount, transaction frequency, network operation mode (such as click stream, access path, etc.); for example, if the proportion of fraudulent transactions in historical transaction behaviors similar to the current transaction behavior and network behavior is very high, the fraud risk of the current transaction may also be relatively high. By finding historical behaviors with the same modality as the current transaction behavior, the fraud risk of the current transaction can be more accurately evaluated.

[0037] In some embodiments, calculating the proportion of fraudulent transactions in historical transaction behaviors of the same modality as the transaction behavior and the network behavior includes: The transaction behavior includes transaction frequency, transaction amount, and transaction type, and the network behavior includes the deviation distance of the login device, IP address, operation process, login address, and transaction address; matching the standard operation process and standard transaction amount according to the transaction type to obtain the historical login device and historical IP address of the user in the preset time zone; calculating the proportion of the login device frequency of the login device in the historical login devices in the preset time zone of the user, and calculating the proportion of the IP address frequency of the IP address in the historical IP addresses in the preset time zone of the user; calculating the number of different nodes between the operation process and the standard operation process, and the difference amount between the standard transaction amount and the transaction amount; calculating the proportion of fraudulent transactions in historical transaction behaviors of the same modality as the transaction frequency, the transaction type, the proportion of the login device frequency, the proportion of the IP address frequency, the number of different nodes, and the difference amount.

[0038] Specifically, the standard operation process refers to a series of common operation steps verified in a certain type of transaction; the standard transaction amount refers to the common transaction amount range in a certain type of transaction; the proportion of the login device frequency and the proportion of the IP address frequency refer to the usage frequencies of the historical login device and IP address in the preset time zone of the user. If the historical login frequency of a certain device or IP address in this time zone is relatively high, it indicates that this device or IP address is more common under normal circumstances.

[0039] Specifically, first, preset corresponding standard operation processes and transaction amount ranges according to different transaction types (such as commodity purchase, fund transfer, etc.), such as summarized based on historical transaction data and user behavior patterns; then, identify the type of the current transaction, and match the applicable standard operation process and standard transaction amount according to this type to obtain the historical login device and historical IP address of the user in the preset time zone; next, calculate the proportion of the login device frequency of the current login device in the historical login devices in the preset time zone of the user, and the proportion of the IP address frequency of the current IP address in the historical IP addresses in the preset time zone of the user; then, compare the operation process of the current user with the standard process, calculate the number of different nodes (i.e., different operation steps) between the two, compare the current amount with the standard amount, and calculate the difference amount.

[0040] Further, using the obtained transaction frequency, transaction type, proportion of login device frequency, proportion of IP address frequency, number of different nodes, and difference amount as pattern features, extract transaction information with the same pattern (similar pattern features) from historical data, and calculate what proportion of the transactions are marked as fraudulent transactions. By calculating the proportion of fraudulent transactions, a prediction of the fraud risk of the current transaction can be made. In other words, if the proportion of fraud in similar historical transactions is high, then the risk of the current transaction may also be relatively high. Therefore, this step further improves the accuracy and reliability of fraud risk prediction.

[0041] In some implementation manners, to count the proportion of fraudulent transactions in historical transaction behaviors with the same modality as the transaction frequency, the transaction type, the proportion of login device frequency, the proportion of IP address frequency, the number of different nodes, and the difference amount, it includes: Collect a preset number of historical transaction behaviors where the historical transaction type is the same as the transaction type, the deviation between the historical transaction frequency and the transaction frequency is less than or equal to the transaction frequency deviation threshold, the deviation between the recorded proportion of login device frequency and the proportion of login device frequency is less than or equal to the first proportion deviation threshold, the deviation between the recorded IP address proportion and the proportion of IP address frequency is less than or equal to the second proportion deviation threshold, the deviation between the recorded number of different nodes and the number of different nodes is less than or equal to the different node number deviation threshold, and the deviation between the recorded difference amount and the difference amount is less than or equal to the difference amount deviation threshold, and count the proportion of fraudulent transactions in the historical transaction behaviors.

[0042] Specifically, compare one by one the transaction frequency, transaction type, proportion of login device frequency, proportion of IP address frequency, number of different nodes, and difference amount of historical transaction behaviors with the transaction frequency, transaction type, proportion of login device frequency, proportion of IP address frequency, number of different nodes, and difference amount of the current user account obtained. When these deviations are all less than or equal to the preset thresholds, the corresponding historical transaction behaviors can be considered as historical transaction behaviors with the same modality.

[0043] Further, continue to collect historical transaction behaviors that meet the conditions until the preset number is reached, and then count the proportion of transactions marked as fraudulent among these selected historical transaction behaviors.

[0044] The above steps can more comprehensively capture abnormal situations of transaction behaviors through similarity analysis of multi-dimensional features, provide a more accurate basis for fraud risk prediction, and thus help improve the fraud recognition ability.

[0045] When the proportion of fraudulent transactions is less than the fraud transaction proportion threshold, count the historical biometric behaviors of the user.

[0046] Specifically, if the proportion of fraudulent transactions is less than the fraud transaction proportion threshold, it can be considered that from the dimension of historical transaction behaviors of the same modality, there is no possibility of transaction fraud or the risk is relatively low for the current user account. At this time, the historical biometric behaviors of the user are statistically analyzed to further predict risks from the dimension of the user's biometric behaviors, so as to more accurately judge the security of the current transaction and reduce false alarms.

[0047] For example, although the transaction behavior seems normal, if the current operation speed or the pointer movement trajectory is significantly different from the user's historical biometric behaviors, it indicates that there may be an operation by someone other than the user for the current transaction, and there is a potential fraud risk.

[0048] In some embodiments, statistically analyzing the historical biometric behaviors of the user includes: Obtaining the set of historical operation speed records and the set of operation pointer movement trajectories of the user; calculating the central value of the set of historical operation speed records to obtain the historical central operation speed; calculating the central value of the set of operation pointer movement trajectories to obtain the historical central pointer movement trajectory; adding the historical central operation speed and the historical central pointer movement trajectory to the historical biometric behaviors.

[0049] Specifically, the set of historical operation speed records refers to the set of speed data of the user's operation interface (such as input, click, etc.) in historical transactions, which is represented by, for example, a markdown file; the set of operation pointer movement trajectories refers to the set of path data of the user's mouse or touch pointer moving on the interface, which is represented by, for example, G-code.

[0050] Specifically, the historical central operation speed and the historical central pointer movement trajectory are typical values obtained by calculating the central values of the historical operation speed and the pointer movement trajectory respectively, and respectively represent the central tendency of the user's operation speed data (reflecting the common speed of the user during the operation) and the central tendency of the pointer trajectory (reflecting the common movement pattern of the user during the operation) within a certain time range.

[0051] Specifically, calculating the central value of the historical operation speed data (such as calculating the mean or median) to obtain the historical central operation speed; based on geometric methods, such as calculating the average position, average path length or the most common trajectory pattern of the trajectory, to extract the common pattern of the pointer movement.

[0052] The above method steps can construct a more accurate user operation behavior model by statistically analyzing and calculating the central values of the user's operation speed and pointer trajectory, which helps to identify the differences between normal user behaviors and potential fraud behaviors, such as too fast speed or irregular trajectory, thereby reducing misjudgment or missed judgment.

[0053] In some implementations, a centralized value calculation is performed on the set of operation pointer movement trajectories to obtain a historical pointer centralized movement trajectory, including: Perform pairwise similarity calculation on the set of operation pointer movement trajectories to obtain a set of operation pointer movement trajectory similarities; based on a similarity threshold, perform clustering analysis on the set of operation pointer movement trajectories based on the set of operation pointer movement trajectory similarities to obtain a clustering result of the operation pointer movement trajectories; extract the class with the largest number of trajectories in the clustering result of the operation pointer movement trajectories to obtain a centralized class of operation pointer movement trajectories; calculate the average similarity of each trajectory in the centralized class of operation pointer movement trajectories with other trajectories within the class, and extract the trajectory with the maximum average similarity, which is set as the historical pointer centralized movement trajectory.

[0054] Specifically, first, by using similarity calculation algorithms such as the dynamic time warping (DTW) algorithm and Euclidean distance, each pair of trajectories of the operation pointer is compared, and the similarity between each pair of trajectories is calculated. The similarity between each pair of trajectories quantitatively reflects the similarity degree of their morphological, path and other characteristics; then, according to the set similarity threshold, clustering is performed on the set of operation pointer movement trajectory similarities, thereby realizing the clustering analysis of the set of operation pointer movement trajectories. In other words, when the similarity between two trajectories is higher than the threshold, they can be considered to belong to the same class; then, among all the clustering results, select the class with the largest number of trajectories as the most representative operation behavior class, which is used to reflect the most common operation mode of the user; finally, calculate the similarity between each trajectory in the centralized class of operation pointer movement trajectories and other trajectories within the class, and obtain the average value to measure the consistency between each trajectory and other trajectories within the class, so as to select the trajectory with the highest average similarity with other trajectories within the class as the most representative operation trajectory, representing the standard operation behavior of the user, and define it as the historical pointer centralized movement trajectory.

[0055] Through the similarity calculation and clustering analysis of the operation pointer trajectories, the most representative user operation trajectory can be accurately extracted, enhancing the understanding of the user behavior pattern, which helps to accurately identify the true identity of the account operator and improve the accuracy and reliability of the fraud risk assessment.

[0056] When the historical biological behavior is inconsistent with the biological behavior, a fraud risk prompt is generated and fed back to the user terminal.

[0057] Specifically, if the historical biological behavior is inconsistent with the biological behavior, such as there are significant differences between the two (such as excessive change in operation speed, abnormal fingerprint characteristics, etc.), it may indicate that a third-party user is operating. Corresponding potential fraud risks are marked and a fraud risk prompt is generated and fed back to the user terminal to remind the user to take corresponding measures.

[0058] Optionally, the generated fraud risk prompt information is displayed through the applications on the user side (such as web pages, mobile APPs, desktop clients, etc.), and is implemented in forms such as pop-up windows, prompt boxes, message pushes, etc., to ensure that users can timely understand the current risk situation.

[0059] In some embodiments, when the historical biological behavior is inconsistent with the biological behavior, it includes: The biological behavior includes the operation speed and the movement trajectory of the operation pointer; when the deviation between the speed in the historical operation set and the operation speed is greater than or equal to the operation speed deviation threshold, or the similarity between the movement trajectory of the operation pointer and the movement trajectory in the historical pointer set is less than or equal to the similarity threshold, it is regarded as the historical biological behavior being inconsistent with the biological behavior, otherwise, it is regarded as consistent.

[0060] Specifically, the biological behavior (operation speed and pointer movement trajectory) in the current transaction is compared with the historical biological behavior (the speed in the historical operation set and the movement trajectory in the historical pointer set), that is, the deviation between the current operation speed and the speed in the historical operation set, and the similarity between the current operation pointer movement trajectory and the movement trajectory in the historical pointer set are calculated respectively.

[0061] Furthermore, if the deviation is greater than or equal to the preset operation speed deviation threshold, it is considered that the operation speed is inconsistent; if the similarity is less than or equal to the preset similarity threshold, it is considered that the pointer movement trajectory is inconsistent; if the comparison results of both the operation speed and the operation pointer movement trajectory show consistency, it is judged that the biological behavior is consistent; if any one of the deviation or similarity is inconsistent, it is judged that the biological behavior is inconsistent.

[0062] The above steps provide a reliable and accurate verification mechanism for fraud risk assessment through the quantitative comparison of operation speed and pointer movement trajectory.

[0063] In some embodiments, it further includes: When there is a risk account in the user - associated account set, or the proportion of fraudulent transactions is greater than or equal to the fraudulent transaction proportion threshold, a fraud risk prompt is generated and fed back to the user side.

[0064] Specifically, when it is found that there is a risk account among the user - associated accounts, or a high proportion of the user's transactions are fraudulent transactions (exceeding the set fraudulent transaction proportion threshold), it is considered that the user account has a high fraud risk, triggering a corresponding fraud risk prompt and feeding it back to the corresponding user side to remind the user to pay attention to the security of their account; optionally, the generated fraud risk prompt includes the main types of risks, suggestions or additional security measures required for the user to take (such as changing passwords, identity verification, etc.).

[0065] Through the above steps, potential fraud risks can be identified at an early stage, warnings can be issued in a timely manner to prevent more serious losses; ensuring that users can obtain risk prompts in a timely manner, take necessary protective measures, and avoid the abuse of accounts or threats from illegal acts.

[0066] In summary, the fraud risk prediction method combining historical behavior analysis provided by the present invention has the following technical effects: By monitoring transaction status information when a user initiates a transaction, including transaction behavior, network behavior, and biometric behavior; counting the set of user-associated accounts with a transaction frequency greater than or equal to the transaction frequency threshold; if there are no risk accounts in the set of user-associated accounts, counting the proportion of fraudulent transactions in the historical transaction behavior with the same modality as the user's transaction behavior and network behavior. A risk account refers to an account with a historical fraud frequency greater than or equal to the fraud frequency threshold; if the proportion of fraudulent transactions is lower than the fraudulent transaction proportion threshold, continue to count the user's historical biometric behavior; if the historical biometric behavior is inconsistent with the current biometric behavior, the device will generate a fraud risk prompt and feedback it to the user side, thereby achieving the technical effect of improving the accuracy and reliability of fraud risk prediction.

[0067] Embodiment 2 Figure 2 It is a schematic structural diagram of the fraud risk prediction device combining historical behavior analysis of the present invention. For example, Figure 1 The flow schematic diagram of the fraud risk prediction method combining historical behavior analysis in the present invention can be implemented by a structure as shown in Figure 2 shown.

[0068] Based on the same concept as the fraud risk prediction method combining historical behavior analysis in the above embodiment, the fraud risk prediction device combining historical behavior analysis provided by the present invention further includes: A transaction status information monitoring module 11, configured to monitor transaction status information when a user initiates a transaction, wherein the transaction status information includes transaction behavior, network behavior, and biometric behavior.

[0069] An associated account acquisition module 12, configured to count the accounts with a transaction frequency greater than or equal to the transaction frequency threshold of the user to obtain a set of user-associated accounts.

[0070] A proportion statistics module 13, configured to count the proportion of fraudulent transactions in the historical transaction behavior with the same modality as the transaction behavior and the network behavior when there are no risk accounts in the set of user-associated accounts, wherein the risk account refers to an account with a historical fraud frequency greater than or equal to the fraud frequency threshold.

[0071] A biometric behavior statistics module 14, configured to count the historical biometric behavior of the user when the proportion of fraudulent transactions is less than the fraudulent transaction proportion threshold.

[0072] A risk warning generation module 15, configured to generate a fraud risk warning and feedback it to the user terminal when the historical biological behavior is inconsistent with the biological behavior.

[0073] In some embodiments, the associated account acquisition module 12 includes: A transaction buyer associated account set acquisition unit, configured to count the accounts of the transaction buyer whose transaction frequency is greater than or equal to the transaction frequency threshold, and obtain a transaction buyer associated account set.

[0074] A transaction seller associated account set acquisition unit, configured to count the accounts of the transaction seller whose transaction frequency is greater than or equal to the transaction frequency threshold, and obtain a transaction seller associated account set.

[0075] A user associated account set integration unit, configured to add the transaction buyer associated account set and the transaction seller associated account set into the user associated account set.

[0076] In some implementation manners, the transaction buyer associated account set acquisition unit in the associated account acquisition module 12 includes: A first-level transaction buyer associated account set acquisition unit, configured to count the accounts that directly transact with the transaction buyer and whose transaction frequency is greater than or equal to the transaction frequency threshold, and set it as the first-level transaction buyer associated account set.

[0077] A second-level transaction buyer associated account set acquisition unit, configured to count the accounts that directly transact with any transaction buyer associated account in the first-level transaction buyer associated account set and whose transaction frequency is greater than or equal to the transaction frequency threshold, and set it as the second-level transaction buyer associated account set.

[0078] An N-level transaction buyer associated account set acquisition unit, configured to count until the accounts that directly transact with any transaction buyer associated account in the (N - 1)-level transaction buyer associated account set and whose transaction frequency is greater than or equal to the transaction frequency threshold, and set it as the N-level transaction buyer associated account set, where N is a user-predefined value, N is an integer, and N≥2.

[0079] A transaction buyer associated account set integration unit, configured to add the first-level transaction buyer associated account set, the second-level transaction buyer associated account set until the N-level transaction buyer associated account set into the transaction buyer associated account set.

[0080] In some embodiments, the proportion statistics module 13 includes: A preset information acquisition unit, configured to match a standard operation process and a standard transaction amount according to the transaction type, and obtain the user's preset time zone historical login device and preset time zone historical IP address.

[0081] A login device and IP address frequency ratio statistical unit for statistically analyzing the login device frequency ratio of the historical login devices of the login device in the preset time zone and the IP address frequency ratio of the historical IP addresses in the preset time zone.

[0082] An operation process and transaction amount difference statistical unit for statistically analyzing the number of difference nodes between the operation process and the standard operation process, and the difference amount between the standard transaction amount and the transaction amount.

[0083] A fraudulent transaction ratio statistical unit for statistically analyzing the fraudulent transaction ratio of historical transaction behaviors with the same modalities as the transaction frequency, the transaction type, the login device frequency ratio, the IP address frequency ratio, the number of difference nodes, and the difference amount.

[0084] In some implementation manners, the execution steps of the ratio statistical module 13 include: Collecting a preset number of historical transaction behaviors whose historical transaction types are the same as the transaction type, the deviation between the historical transaction frequency and the transaction frequency is less than or equal to the transaction frequency deviation threshold, the deviation between the recorded login device frequency ratio and the login device frequency ratio is less than or equal to the first ratio deviation threshold, the deviation between the recorded IP address ratio and the IP address frequency ratio is less than or equal to the second ratio deviation threshold, the deviation between the recorded number of difference nodes and the number of difference nodes is less than or equal to the difference node number deviation threshold, and the deviation between the recorded difference amount and the difference amount is less than or equal to the difference amount deviation threshold, and statistically analyzing the fraudulent transaction ratio of the historical transaction behaviors.

[0085] In some embodiments, the biological behavior statistical module 14 includes: A historical biological behavior data acquisition unit for obtaining the historical operation speed record set and the operation pointer movement trajectory set of the user.

[0086] A historical operation centralized speed calculation unit for performing a centralized value calculation on the historical operation speed record set to obtain the historical operation centralized speed.

[0087] A historical pointer centralized movement trajectory calculation unit for performing a centralized value calculation on the operation pointer movement trajectory set to obtain the historical pointer centralized movement trajectory.

[0088] A historical biological behavior integration unit for adding the historical operation centralized speed and the historical pointer centralized movement trajectory to the historical biological behavior.

[0089] In some implementation manners, the historical pointer centralized movement trajectory calculation unit in the biological behavior statistical module 14 includes: In some embodiments, the risk prompt generation module 15 includes: An operation pointer movement trajectory similarity calculation unit is configured to calculate the pairwise similarity of the operation pointer movement trajectory set to obtain an operation pointer movement trajectory similarity set.

[0090] An operation pointer movement trajectory clustering analysis unit is configured to perform clustering analysis on the operation pointer movement trajectory set based on the similarity threshold and the operation pointer movement trajectory similarity set to obtain an operation pointer movement trajectory clustering result.

[0091] An operation pointer movement trajectory concentrated class extraction unit is configured to extract the class with the largest number of trajectories in the operation pointer movement trajectory clustering result to obtain an operation pointer movement trajectory concentrated class.

[0092] A historical pointer concentrated movement trajectory determination unit is configured to calculate the average similarity of each trajectory in the operation pointer movement trajectory concentrated class with other trajectories in the class, and extract the trajectory with the maximum average similarity as the historical pointer concentrated movement trajectory.

[0093] Furthermore, the execution steps of the risk warning generation module 15 further include: When the deviation between the historical operation concentrated speed and the operation speed is greater than or equal to the operation speed deviation threshold, or the similarity between the operation pointer movement trajectory and the historical pointer concentrated movement trajectory is less than or equal to the similarity threshold, it is regarded that the historical biological behavior is inconsistent with the biological behavior, otherwise, it is regarded as consistent.

[0094] It should be understood that the embodiments mentioned in this specification focus on their differences from other embodiments. The specific embodiments in the foregoing Embodiment 1 are equally applicable to the fraud risk prediction device combining historical behavior analysis described in Embodiment 2. For the sake of brevity of the specification, no further elaboration is made here.

[0095] It should be understood that the disclosed embodiments of the present invention and the above descriptions can enable those skilled in the art to implement the present invention using the present invention. At the same time, the present invention is not limited to the above-mentioned part of the embodiments. It should be understood that those of ordinary skill in the art can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements on some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A fraud risk prediction method combined with historical behavior analysis, characterized in that: include: When a user initiates a transaction, monitoring transaction status information, wherein the transaction status information includes transaction behavior, network behavior, and biological behavior; Counting accounts whose transaction frequency with the user is greater than or equal to a transaction frequency threshold, and obtaining a user-associated account set; When the user-associated account set does not have a risk account, the fraud transaction ratio of the historical transaction behaviors with the same modality as the transaction behavior and the network behavior is counted, wherein the risk account refers to an account with a historical fraud frequency greater than or equal to a fraud frequency threshold; When the fraudulent transaction ratio is less than the fraudulent transaction ratio threshold, counting the historical biometric behaviors of the user; When the historical biological behavior is inconsistent with the biological behavior, a fraud risk prompt is generated and fed back to the user end.

2. The fraud risk prediction method combined with historical behavior analysis as claimed in claim 1, characterized in that: Counting accounts whose transaction frequency with the user is greater than or equal to a transaction frequency threshold, and obtaining a user-associated account set, including: The users include transaction buyers and transaction sellers; Counting accounts of the transaction buyer whose transaction frequency is greater than or equal to the transaction frequency threshold, and obtaining a set of transaction buyer-associated accounts; Counting accounts of the transaction seller whose transaction frequency is greater than or equal to the transaction frequency threshold, and obtaining a set of transaction seller-associated accounts; The transaction buyer associated account set and the transaction seller associated account set are added to the user associated account set.

3. The fraud risk prediction method combined with historical behavior analysis as claimed in claim 2, characterized in that: Counting accounts of the transaction buyer whose transaction frequency is greater than or equal to the transaction frequency threshold, and obtaining a set of transaction buyer associated accounts, including: Accounts that directly trade with the transaction buyer and whose transaction frequency is greater than or equal to the transaction frequency threshold are counted and set as the first-level transaction buyer associated account set; Counting accounts that directly trade with any transaction buyer associated account in the primary transaction buyer associated account set and whose transaction frequency is greater than or equal to the transaction frequency threshold, and setting them as the secondary transaction buyer associated account set; Until the accounts that directly trade with any transaction buyer associated account in the N-1 level transaction buyer associated account set and whose transaction frequency is greater than or equal to the transaction frequency threshold are counted, the N level transaction buyer associated account set is set, where N is a user preset value, N is an integer, and N≥2; The first-level transaction buyer associated account set, the second-level transaction buyer associated account set, and finally the N-level transaction buyer associated account set are added into the transaction buyer associated account set.

4. The fraud risk prediction method combined with historical behavior analysis as claimed in claim 1, characterized in that: Count the percentage of fraudulent transactions in historical transaction behaviors with the same modality as the transaction behaviors and network behaviors, including: The transaction behavior includes transaction frequency, transaction amount and transaction type; the network behavior includes login device, IP address, operation process, and deviation distance between login address and transaction address; According to the transaction type, the standard operation process and the standard transaction amount are matched to obtain the user's preset time zone historical login device and preset time zone historical IP address; Count the proportion of the login device frequency of the login device in the historical login devices in the preset time zone, and count the proportion of the IP address frequency of the IP address in the historical IP addresses in the preset time zone; Counting the number of nodes where the operation process differs from the standard operation process, and the difference between the standard transaction amount and the transaction amount; Statistics are collected on the percentage of fraudulent transactions in historical transaction behaviors with the same modality as the transaction frequency, the transaction type, the login device frequency percentage, the IP address frequency percentage, the number of difference nodes, and the difference amount.

5. The fraud risk prediction method combined with historical behavior analysis as claimed in claim 4, characterized in that: Statistics on the percentage of fraudulent transactions in historical transaction behaviors with the same modality as the transaction frequency, the transaction type, the login device frequency percentage, the IP address frequency percentage, the number of difference nodes, and the difference amount include: Collect a preset number of historical transaction behaviors, whose historical transaction types are the same as the transaction types, and the deviation of the historical transaction frequency from the transaction frequency is less than or equal to the transaction frequency deviation threshold, and the deviation of the recorded login device frequency proportion from the login device frequency proportion is less than or equal to the first proportion deviation threshold, and the deviation of the recorded IP address proportion from the IP address frequency proportion is less than or equal to the second proportion deviation threshold, and the deviation of the recorded difference node number from the difference node number is less than or equal to the difference node number deviation threshold, and the deviation of the recorded difference amount from the difference amount is less than or equal to the difference amount deviation threshold, and count the fraudulent transaction proportion of the historical transaction behaviors.

6. The fraud risk prediction method combined with historical behavior analysis as claimed in claim 1, characterized in that: Statistics of the user's historical biological behaviors include: Obtaining a historical operation speed record set and an operation pointer movement trajectory set of the user; Performing concentrated value calculation on the historical operation speed record set to obtain the historical operation concentrated speed; Performing concentrated value calculation on the set of operation pointer movement trajectories to obtain a concentrated movement trajectory of a historical pointer; The historical operation concentrated speed and the historical pointer concentrated movement trajectory are added to the historical biological behavior.

7. The fraud risk prediction method combined with historical behavior analysis according to claim 6, characterized in that: Performing concentrated value calculation on the set of operation pointer movement trajectories to obtain the concentrated movement trajectories of historical pointers includes: Performing pairwise similarity calculation on the operation pointer movement trajectory sets to obtain an operation pointer movement trajectory similarity set; According to a similarity threshold, based on the similarity set of the operation pointer movement trajectory, cluster analysis is performed on the operation pointer movement trajectory set to obtain an operation pointer movement trajectory clustering result; Extract the class with the largest number of trajectories from the clustering result of the movement trajectory of the operation pointer, and obtain a concentrated class of the movement trajectory of the operation pointer; The mean similarity between each trajectory of the class in the operation pointer movement trajectory set and other trajectories in the class is calculated, and the trajectory with the maximum similarity mean is extracted and set as the movement trajectory in the historical pointer set.

8. The fraud risk prediction method combined with historical behavior analysis as claimed in claim 7, characterized in that: When the historical biological behavior is inconsistent with the biological behavior, including: The biological behavior includes operation speed and operation pointer movement trajectory; When the deviation between the historical operation concentrated speed and the operation speed is greater than or equal to the operation speed deviation threshold, or the similarity between the operation pointer movement trajectory and the historical pointer concentrated movement trajectory is less than or equal to the similarity threshold, the historical biological behavior is deemed to be inconsistent with the biological behavior, otherwise, it is deemed to be consistent.

9. The fraud risk prediction method combined with historical behavior analysis as claimed in claim 1, characterized in that: Also includes: When the user-associated account set has a risky account, or the fraudulent transaction ratio is greater than or equal to the fraudulent transaction ratio threshold, a fraud risk prompt is generated and fed back to the user end.

10. A fraud risk prediction device combined with historical behavior analysis, characterized in that: The device is used to execute the fraud risk prediction method combined with historical behavior analysis according to any one of claims 1 to 9, and the device includes: A transaction status information monitoring module, used to monitor transaction status information when a user initiates a transaction, wherein the transaction status information includes transaction behavior, network behavior, and biological behavior; An associated account acquisition module, used to count accounts whose transaction frequency with the user is greater than or equal to a transaction frequency threshold, and obtain a user associated account set; A proportion statistics module, used for counting the proportion of fraudulent transactions in historical transaction behaviors of the same modality as the transaction behavior and the network behavior when the user-associated account set does not have a risk account, wherein the risk account refers to an account with a historical fraud frequency greater than or equal to a fraud frequency threshold; A biometric behavior statistics module, configured to count the historical biometric behaviors of the user when the fraudulent transaction ratio is less than a fraudulent transaction ratio threshold; The risk warning generation module is used to generate a fraud risk warning feedback to the user end when the historical biological behavior is inconsistent with the biological behavior.

Images