Abnormal Account Detection System

Abstract

An abnormal account detection system includes a processing unit and a communication unit and a storage unit electrically connected to the processing unit. The processing unit extracts at least one transaction feature from a historical transaction database, and generates and stores another detection task in the storage unit based on a transaction request from a user terminal device that includes transaction data. The processing unit reads and executes a priority task from the storage unit, extracts a real-time transaction feature from the transaction data, and inputs the real-time transaction feature and the at least one transaction feature into an abnormal transaction detection model to generate a risk identification result. When the processing unit determines that the risk identification result indicates a high risk, it intercepts another transaction request involving a transaction account.

Claims

1. An abnormal account detection system, applicable to a user terminal device, comprising: a communication unit for providing network connectivity; a storage unit storing a preprocessing cycle, an abnormal transaction detection model completed by machine learning, a historical transaction database, a priority algorithm, and multiple detection tasks, the historical transaction database including an attribute status and at least one transaction data for each account within multiple time intervals, each detection task corresponding to a priority value; and a processing unit electrically connected to the communication unit and the storage unit, and communicating with the user terminal device through the communication unit; wherein, The processing unit extracts at least one transaction feature from the attribute status of each account and the at least one transaction data within the time interval included in the historical transaction database according to the preprocessing cycle; the processing unit generates another detection task based on a transaction request received from the user terminal device within a fixed time interval, calculates another priority value corresponding to the other detection task according to the priority algorithm, and stores the other detection task and the other priority value corresponding to the other detection task in the storage unit, the transaction request including transaction data including a transaction account; the processing unit reads a priority execution task from the storage unit, wherein the priority execution task is the detection task corresponding to the highest priority value; the processing unit executes the priority execution task, extracts real-time transaction features corresponding to the transaction request from the transaction data, and inputs the real-time transaction features and the at least one transaction feature into the abnormal transaction detection model, so that the abnormal transaction detection model generates a risk identification result corresponding to the transaction request based on the real-time transaction features and the at least one transaction feature.

2. The abnormal account detection system as described in claim 1, wherein, The storage unit also stores a risk threshold. The abnormal transaction detection model generates a threshold based on the real-time transaction characteristics and the at least one transaction characteristic, and compares the risk threshold with the threshold to generate the risk identification result.

3. The abnormal account detection system as described in claim 2, wherein, The storage unit also stores a historical abnormal transaction database, a sampling strategy, and a training schedule. The historical abnormal transaction database contains multiple historical abnormal transaction records, each corresponding to a transaction time. The processing unit samples from these historical abnormal transaction records according to the sampling strategy to generate multiple training records, and weights these training records according to the corresponding transaction times. The weighted training records are then input into the abnormal transaction detection model according to the training schedule to perform and complete machine learning training. The weight of the training record whose transaction time is closest to the current time is higher than the weight of the training record whose transaction time is second closest to the current time.

4. The abnormal account detection system as described in claim 1, wherein, The storage unit also stores a transaction count, an alarm list, and an abnormal transaction threshold. The alarm list includes several other high-risk transaction accounts within the fixed time interval. When the processing unit determines that the risk identification result indicates a high risk, it adds the transaction account to the alarm list and calculates an abnormal account count based on the number of such transaction accounts currently included in the alarm list. When the processing unit determines that the proportion of the abnormal account count to the transaction count is less than the abnormal transaction threshold, it blocks another transaction request from any of the transaction accounts included in the alarm list.

5. The abnormal account detection system as described in claim 4 is also applicable to a management terminal device, wherein, When the processing unit determines that the proportion of the number of abnormal accounts to the number of transactions is greater than or equal to the abnormal transaction threshold, it sends an abnormal notification to the management terminal device.

Images