Payment anomaly detection method, system, electronic device and computer readable medium

Abstract

The present disclosure provides a payment anomaly detection method, comprising obtaining multiple payment data, determining multiple local outlier factors corresponding to the multiple payment data through a local outlier factor algorithm, determining an abnormal local outlier factor among the multiple local outlier factors according to a first preset threshold, and determining abnormal payment data among the multiple payment data based on the abnormal local outlier factor. The present disclosure also provides a payment anomaly detection system, an electronic device, and a computer-readable medium.

Description

Technical Field

[0001] The present disclosure relates to the field of Internet technology, and more specifically, to a payment anomaly detection method, system, electronic device, and computer-readable medium. Background Art

[0002] With the rapid development of the Internet, online payment has become increasingly mature and perfect, and has spread to almost every corner of life. Accurately detecting abnormal payment data, analyzing the causes of abnormal payment based on the detection results, and then optimizing the online payment system are of great significance and value to the development of online payment.

[0003] In the process of implementing the concept of the present disclosure, the inventors found that there are at least the following problems in the prior art: the accuracy of the existing detection of abnormal payment data in payment data is low. Summary of the invention

[0004] In view of this, the present disclosure provides a payment anomaly detection method, system, electronic device and computer-readable medium.

[0005] One aspect of the present disclosure provides a payment anomaly detection method including obtaining multiple payment data, determining multiple local outlier factors corresponding to the multiple payment data through a local outlier factor algorithm, determining abnormal local outlier factors among the multiple local outlier factors according to a first preset threshold, and determining abnormal payment data among the multiple payment data based on the abnormal local outlier factors.

[0006] According to an embodiment of the present disclosure, the payment data includes at least one of the following: a payment success rate, which is a ratio of orders that have been successfully paid through the first channel to the total orders; a payment churn rate, which is a ratio of orders that have been paid through the first channel but failed to pay to the total orders; and a payment transfer rate, which is a ratio of orders whose payment channel is transferred from the first channel to the second channel to the total orders.

[0007] According to an embodiment of the present disclosure, obtaining multiple payment data includes obtaining multiple payment data corresponding to a time period of a specific time length from a current moment, or obtaining multiple payment data corresponding to a time period between a specific start time and the current moment.

[0008] According to an embodiment of the present disclosure, based on the abnormal local outlier factor, determining the abnormal payment data among the multiple payment data includes determining that the payment data corresponding to the abnormal local outlier factor is abnormal payment data, or determining that the payment data corresponding to the abnormal local outlier factor among the abnormal local outlier factors that meets a second preset threshold is abnormal payment data.

[0009] According to an embodiment of the present disclosure, the second preset threshold includes a second preset threshold determined based on historical local outlier factors corresponding to a plurality of historical payment data.

[0010] According to an embodiment of the present disclosure, the obtaining of multiple payment data includes obtaining multiple payment success rate data, multiple payment churn rate data and payment transfer rate data, and the determining of multiple local outlier factors corresponding to the multiple payment data through a local outlier factor algorithm includes respectively determining multiple success rate local outlier factors, multiple churn rate local outlier factors and multiple transfer rate local outlier factors corresponding to the multiple payment success rate data, multiple payment churn rate data and payment transfer rate data, and the method also includes determining an abnormal success rate local outlier factor among the multiple success rate local outlier factors, and determining the cause of the payment abnormality based on the churn rate local outlier factor and the transfer rate local outlier factor corresponding to the abnormal success rate local outlier factor.

[0011] According to an embodiment of the present disclosure, the method also includes preprocessing the multiple payment data for discarding abnormal payment data among the multiple payment data, and determining the multiple local outlier factors corresponding to the multiple payment data through a local outlier factor algorithm includes determining the multiple local outlier factors corresponding to the preprocessed multiple payment data through a local outlier factor algorithm.

[0012] Another aspect of the present disclosure provides a payment anomaly detection system including: an acquisition module for acquiring multiple payment data; a first determination module for determining multiple local outlier factors corresponding to the multiple payment data through a local outlier factor algorithm; a second determination module for determining abnormal local outlier factors among the multiple local outlier factors according to a first preset threshold; and a third determination module for determining abnormal payment data among the multiple payment data based on the abnormal local outlier factors.

[0013] According to an embodiment of the present disclosure, the payment data includes at least one of the following payment success rate, which is the ratio of orders that have been successfully paid through the first channel to the total orders, a payment churn rate, which is the ratio of orders that have been paid through the first channel but failed to pay to the total orders, and a payment transfer rate, which is the ratio of orders whose payment channel is transferred from the first channel to the second channel to the total orders.

[0014] According to an embodiment of the present disclosure, the acquisition module includes a first acquisition submodule, which is used to acquire multiple payment data corresponding to a time period of a specific time length from the current moment, or a second acquisition submodule, which is used to acquire multiple payment data corresponding to a time period between a specific start time and the current moment.

[0015] According to an embodiment of the present disclosure, the third determination module includes a first determination submodule, which is used to determine that the payment data corresponding to the abnormal local outlier factor is abnormal payment data, or a second determination submodule, which is used to determine that the payment data corresponding to the abnormal local outlier factor among the abnormal local outlier factors that meets a second preset threshold is abnormal payment data.

[0016] According to an embodiment of the present disclosure, the second preset threshold includes a second preset threshold determined based on historical local outlier factors corresponding to a plurality of historical payment data.

[0017] According to an embodiment of the present disclosure, the acquisition module includes a third acquisition sub-module for acquiring multiple payment success rate data, multiple payment churn rate data and payment transfer rate data, the first determination module includes a third determination sub-module for respectively determining multiple success rate local outlier factors, multiple churn rate local outlier factors and multiple transfer rate local outlier factors corresponding to the multiple payment success rate data, multiple payment churn rate data and payment transfer rate data, the system also includes a fourth determination module for determining an abnormal success rate local outlier factor among the multiple success rate local outlier factors, and a fifth determination module for determining the cause of the payment abnormality based on the churn rate local outlier factor and the transfer rate local outlier factor corresponding to the abnormal success rate local outlier factor.

[0018] According to an embodiment of the present disclosure, the system also includes a preprocessing module for preprocessing the multiple payment data to discard abnormal payment data among the multiple payment data, and the first determination module includes a fourth determination submodule for determining multiple local outlier factors corresponding to the preprocessed multiple payment data through a local outlier factor algorithm.

[0019] Another aspect of the present disclosure provides an electronic device, comprising one or more processors and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above method.

[0020] Another aspect of the present disclosure provides a non-volatile storage medium storing computer executable instructions, which are used to implement the above method when executed.

[0021] Another aspect of the present disclosure provides a computer program, which includes computer executable instructions, and the instructions are used to implement the method described above when executed.

[0022] According to the embodiments of the present disclosure, the problem of low accuracy in detecting abnormal payment data in payment data can be at least partially solved, and thus the technical effect of improving the accuracy of detecting abnormal payment data in payment data can be achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The above and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0024] Figure 1A and Figure 1B Schematically illustrates an application scenario in which payment anomaly detection can be applied according to an embodiment of the present disclosure;

[0025] Figure 2A The flowchart of payment anomaly detection according to an embodiment of the present disclosure is schematically shown;

[0026] Figure 2B A schematic diagram schematically shows a plurality of payment data according to an embodiment of the present disclosure;

[0027] Figure 2C Schematically showing the result of determining the local outlier factor according to the payment success rate according to an embodiment of the present disclosure;

[0028] Figure 3 Schematically shows a flow chart of payment anomaly detection according to another embodiment of the present disclosure;

[0029] Figure 4 Schematically shows a flow chart of payment anomaly detection according to another embodiment of the present disclosure;

[0030] Figure 5 A block diagram of a payment anomaly detection system according to an embodiment of the present disclosure is schematically shown;

[0031] Figure 6 A block diagram of a payment anomaly detection system according to another embodiment of the present disclosure is schematically shown;

[0032] Figure 7 A block diagram schematically shows a payment anomaly detection system 700 according to another embodiment of the present disclosure; and

[0033] Figure 8 A block diagram of an electronic device according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0034] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0035] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0036] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0037] In the case of using expressions such as "at least one of A, B, and C, etc.", it should generally be interpreted in accordance with the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but not be limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.). In the case of using expressions such as "at least one of A, B, or C, etc.", it should generally be interpreted in accordance with the meaning of the expression generally understood by those skilled in the art (for example, "a system having at least one of A, B, or C" should include but not be limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.). Those skilled in the art should also understand that any transitional conjunctions and / or phrases that substantially indicate two or more optional items, whether in the specification, claims, or drawings, should be understood to give the possibility of including one of these items, either of these items, or both of these items. For example, the phrase "A or B" should be understood to include the possibilities of "A" or "B", or "A and B".

[0038] An embodiment of the present disclosure provides a payment anomaly detection method, comprising acquiring multiple payment data, determining multiple local outlier factors corresponding to the multiple payment data through a local outlier factor algorithm, determining abnormal local outlier factors among the multiple local outlier factors according to a first preset threshold, and determining abnormal payment data among the multiple payment data based on the abnormal local outlier factors.

[0039] Figure 1A and Figure 1B The following schematically illustrates an application scenario in which payment anomaly detection can be applied according to an embodiment of the present disclosure. It should be noted that: Figure 1A and Figure 1BThe examples shown are merely examples of application scenarios to which the embodiments of the present disclosure can be applied, so as to help those skilled in the art understand the technical content of the present disclosure, but do not mean that the embodiments of the present disclosure cannot be used in other scenarios.

[0040] like Figure 1A As shown, the scenario includes a terminal device 100, on which a shopping application 101 is installed. The user selects and purchases product 1 and product 2 on the shopping application 101, and enters the checkout counter of the shopping application 101 to check out. After the user performs a series of payment operations, the checkout counter of the shopping application 101 displays a page of "payment failed", which seriously affects the shopping experience of the user 102. Figure 1A The occurrence of the scenario shown may not only cause the user 102 to give up the current shopping, but may even cause the user 102 to stop using the shopping application 101. If the management personnel of the shopping application 101 fail to promptly discover the payment anomaly and thus fail to promptly resolve the payment anomaly, it will lead to a decrease in transaction volume and the loss of a large number of users.

[0041] In the prior art, a method of analyzing specific indicators in payment data, such as the average of successful payment orders, is usually used to discover abnormal payment data. Figure 1B As shown, the total payment order data and successful payment order data of each day from March 21, 2018 to August 23, 2018 are obtained, so as to find abnormal payment data by analyzing the total payment order data and successful payment order data. For example, by analyzing and finding that the payment data on August 21, 2018 is abnormal, the cause of the payment abnormality on August 21 can be shared, so as to avoid the recurrence of payment abnormality. However, the existing abnormal payment data detection usually requires manual analysis of the data, which is difficult to meet the accuracy requirements of online payment data abnormality detection.

[0042] In order to solve the problem of low accuracy in payment data anomaly detection, the present disclosure provides a method for payment anomaly detection.

[0043] Figure 2A A flowchart of payment anomaly detection according to an embodiment of the present disclosure is schematically shown.

[0044] like Figure 2A As shown, the method includes operations S210 to S240.

[0045] In operation S210, a plurality of payment data is acquired.

[0046] In operation S220, a plurality of local outlier factors corresponding to the plurality of payment data are determined by a local outlier factor algorithm.

[0047] In operation S230 , an abnormal local outlier factor among the plurality of local outlier factors is determined according to a first preset threshold.

[0048] In operation S240, abnormal payment data among the plurality of payment data is determined based on the abnormal local outlier factor.

[0049] The method detects abnormal local outlier factors in payment data through a local outlier factor algorithm, thereby determining abnormal payment data in the payment data according to the abnormal local outlier factors, thereby improving the accuracy of payment data anomaly detection.

[0050] According to an embodiment of the present disclosure, in operation S210, the payment data may be an indicator used to characterize the payment status, such as payment success rate, payment failure rate, etc. According to an embodiment of the present disclosure, the payment data may include at least one of a payment success rate, a payment loss rate, and a payment transfer rate. The payment success rate is the ratio of orders that have been successfully paid through the first channel to the total orders, the payment loss rate is the ratio of orders that have been paid through the first channel but failed to pay to the total orders, and the payment transfer rate is the ratio of orders that have been transferred from the first channel to the second channel to the total orders. For example, in Figure 1A In the scenario shown, the shopping application 101 provides multiple payment methods, one of which is credit card payment. The payment success rate can be the ratio of orders that have been successfully paid by credit card to the total orders. The payment churn rate can be the ratio of orders that have been paid by credit card but failed to pay to the total orders. The payment transfer rate means, for example, that after choosing to pay with a credit card, the credit card is not used for payment, but other payment methods are changed.

[0051] According to an embodiment of the present disclosure, in operation S210, obtaining multiple payment data includes obtaining multiple payment data corresponding to a time period of a specific time length from the current moment. For example, obtaining multiple payment data corresponding to 100 days from the current moment August 31, 2018, wherein the specific time length is 100 days, and a time period is one day, that is, obtaining payment data for each day from May 23, 2018 to August 31, 2018. In the above scenario, if the current moment is September 1, 2018, then obtaining payment data for each day from May 24, 2018 to September 1, 2018.

[0052] According to an embodiment of the present disclosure, in operation S210, obtaining multiple payment data includes obtaining multiple payment data corresponding to a time period between a specific start time and a current time. For example, the specific start time may be March 21, 2018, and the current time is August 31, 2018, and the payment data corresponding to each day from March 21, 2018 to August 31, 2018 is obtained. In the above scenario, if the current time is September 1, 2018, the payment data corresponding to each day from March 21, 2018 to September 1, 2018 is obtained.

[0053] Figure 2B A schematic diagram schematically shows multiple payment data according to an embodiment of the present disclosure.

[0054] like Figure 2B As shown, the multiple payment data include the payment success rate, payment loss rate and payment transfer rate for each day from March 21, 2018 to August 31, 2018.

[0055] According to an embodiment of the present disclosure, in operation S220, for example, Figure 2B In the scenario shown, the payment success rate of each day from March 21, 2018 to August 31, 2018 is mapped to the same coordinate system according to preset rules, and the local outlier factor of the coordinate point corresponding to each payment success rate is determined according to the local outlier factor (LOF) algorithm.

[0056] According to an embodiment of the present disclosure, in operation S230, the first preset threshold value may be pre-set based on experience, or may be determined based on historical data. According to the LOF algorithm, if the LOF score of the coordinate point p is near 1, it indicates that the local reachable density of point p is close to that of its neighboring points, and p may belong to the same cluster as the neighboring points. If the LOF score of point p is less than 1, it indicates that the local reachable density of point p is higher than that of its neighboring points, and point p is in a relatively dense area, and point p is more likely to be a dense point. If the LOF score of point p is much greater than 1, it indicates that the distance between point p and other points is relatively far, and the local reachable density of point p is less than the local reachable density of its corresponding neighboring points, and p is very likely to be an outlier.

[0057] Figure 2C Schematically illustrates an embodiment of the present disclosure according to Figure 2B The payment success rate is determined by the local outlier factor.

[0058] like Figure 2CAs shown, the local outlier factor value of the coordinate point corresponding to the payment success rate is around 1, but there is a case where the local outlier factor is 13.79. The first preset threshold may be 2, for example, to determine that the local outlier factor 13.79 is an abnormal local outlier factor.

[0059] According to an embodiment of the present disclosure, when using the LOF algorithm to determine the LOF corresponding to each payment success rate, in order to reduce the time complexity of the LOF algorithm and improve the efficiency of the LOF algorithm, the coordinate points corresponding to all the payment success rate data can be randomly divided into multiple subsets, and then the LOF value is calculated in each subset, and the coordinate points with LOF anomaly scores less than or equal to 1 are eliminated. The remaining coordinate points search for more suitable neighborhood points in the next round and update the LOF value.

[0060] According to an embodiment of the present disclosure, in operation S240, based on the abnormal local outlier factor, determining the abnormal payment data among the plurality of payment data includes determining that the payment data corresponding to the abnormal local outlier factor is abnormal payment data. For example, the payment data corresponding to the abnormal local outlier factor 13.79 on August 31, 2018 is abnormal payment data.

[0061] According to an embodiment of the present disclosure, in operation S240, based on the abnormal local outlier factor, determining the abnormal payment data in the plurality of payment data includes determining that the payment data corresponding to the abnormal local outlier factor that satisfies the second preset threshold in the abnormal local outlier factor is abnormal payment data. The method can perform secondary screening on the detected abnormal payment data, further improving the accuracy of detection. According to an embodiment of the present disclosure, the second preset threshold includes a second preset threshold determined based on the historical local outlier factor corresponding to the plurality of historical payment data. For example, the historical payment data may be the payment success rate from January 1, 2015 to December 31, 2017, and the range of the local outlier factor of the abnormal payment data is determined according to the historical payment success rate. If the abnormal local outlier factor determined according to the plurality of payment success rates currently obtained is within the range, the payment data corresponding to the abnormal local outlier factor is determined to be abnormal payment data. For example, the range of the local outlier factor of the abnormal payment data determined according to the historical payment success rate is greater than 10, and the payment data corresponding to the abnormal local outlier factor 13.79 on August 31, 2018 is determined to be abnormal payment data. For another example, if the local outlier factor of the payment success rate on August 3, 2018 is 5, the payment data on August 3, 2018 are not necessarily abnormal payment data.

[0062] According to an embodiment of the present disclosure, after determining abnormal payment data such as payment success rate, the cause of the abnormality can be analyzed based on other payment data corresponding to the abnormal payment data, such as payment transfer rate, payment loss rate, etc.

[0063] Figure 3 A flowchart of payment anomaly detection according to another embodiment of the present disclosure is schematically shown.

[0064] like Figure 3 As shown, the method further includes operations S310 and S320 based on the above embodiment.

[0065] In operation S310 , an abnormal success rate local outlier factor among the plurality of success rate local outlier factors is determined.

[0066] In operation S320, a payment abnormality reason is determined based on a churn rate local outlier factor and a transfer rate local outlier factor corresponding to the abnormal success rate local outlier factor.

[0067] According to an embodiment of the present disclosure, obtaining multiple payment data includes: obtaining multiple payment success rate data, multiple payment churn rate data, and payment transfer rate data. Determining multiple local outlier factors corresponding to the multiple payment data through a local outlier factor algorithm includes: respectively determining multiple success rate local outlier factors, multiple churn rate local outlier factors, and multiple transfer rate local outlier factors corresponding to the multiple payment success rate data, multiple payment churn rate data, and payment transfer rate data.

[0068] According to an embodiment of the present disclosure, in operation S310, for example, Figure 2C In the scenario shown, the abnormal success rate local outlier factor in the success rate local outlier factor is determined to be 13.79.

[0069] According to an embodiment of the present disclosure, in operation S320, for example, in the scenario described in operation S310, the payment data corresponding to the abnormal success rate local outlier factor 13.79 is determined to be on August 31, 2018, and the LOFs corresponding to the payment churn rate and the payment transfer rate in the payment data on August 31, 2018 are determined. For example, the LOF corresponding to the payment churn rate is not abnormal, while the LOF corresponding to the payment transfer rate is abnormal, and it is determined that the cause of the payment abnormality may be that other payment methods have preferential activities, or that the payment method used by the user cannot allow the user to pay. For another example, the LOF corresponding to the payment churn rate is abnormal, while the LOF corresponding to the payment transfer rate is not abnormal, and it is determined that the cause of the payment abnormality may be bank system maintenance, etc. For another example, the LOFs corresponding to the payment churn rate and the payment transfer rate are both abnormal, and it is determined that the cause of the payment abnormality may be that the user actively gives up, the payment system fails, etc.

[0070] Figure 4 A flowchart of payment anomaly detection according to another embodiment of the present disclosure is schematically shown.

[0071] like Figure 4As shown, the method further includes operation S410 based on the above embodiment. Operation S220 includes operation S221.

[0072] In operation S410, the plurality of payment data are pre-processed to discard abnormal payment data among the plurality of payment data.

[0073] In operation S221, a plurality of local outlier factors corresponding to the plurality of pre-processed payment data are determined by a local outlier factor algorithm.

[0074] The method clears abnormal payment data, such as data with a total payment order of 0, etc., thereby improving calculation efficiency and further improving accuracy.

[0075] According to an embodiment of the present disclosure, in operation S410, abnormal payment data includes, for example, payment data in which the total payment order and the successful payment order are empty values, payment data in which the total payment order and the successful payment order are 0, and payment data in which the payment lost order, the payment transferred order and the successful payment order are not equal to the total payment order.

[0076] According to an embodiment of the present disclosure, determining a plurality of local outlier factors corresponding to the plurality of payment data by using a local outlier factor algorithm includes operation S221. In operation S221, the local outlier factors of the remaining payment data after the abnormal payment data are cleared are determined.

[0077] Figure 5 A block diagram of a payment anomaly detection system 500 according to an embodiment of the present disclosure is schematically shown.

[0078] like Figure 5 As shown, the payment anomaly detection system 500 includes an acquisition module 510 , a first determination module 520 , a second determination module 530 and a third determination module 540 .

[0079] The acquisition module 510, for example, executes the above reference Figure 2A The described operation S210 is used to obtain multiple payment data.

[0080] The first determination module 520, for example, executes the above reference Figure 2A The described operation S220 is used to determine a plurality of local outlier factors corresponding to the plurality of payment data by using a local outlier factor algorithm.

[0081] The second determination module 530, for example, executes the above reference Figure 2A The described operation S230 is used to determine an abnormal local outlier factor among the multiple local outlier factors according to a first preset threshold.

[0082] The third determination module 540, for example, executes the above reference Figure 2AThe described operation S240 is used to determine abnormal payment data among the plurality of payment data based on the abnormal local outlier factor.

[0083] According to an embodiment of the present disclosure, the payment data includes at least one of a payment success rate, a payment loss rate, and a payment transfer rate. The payment success rate is the ratio of orders that are successfully paid through a first channel to total orders. The payment loss rate is the ratio of orders that are paid through the first channel but fail to pay to total orders. The payment transfer rate is the ratio of orders whose payment channel is transferred from the first channel to the second channel to total orders.

[0084] According to an embodiment of the present disclosure, the acquisition module includes a first acquisition submodule, which is used to acquire multiple payment data corresponding to a time period of a specific time length from the current moment, or a second acquisition submodule, which is used to acquire multiple payment data corresponding to a time period between a specific start time and the current moment.

[0085] According to an embodiment of the present disclosure, the third determination module includes a first determination submodule for determining that the payment data corresponding to the abnormal local outlier factor is abnormal payment data, or a second determination submodule for determining that the payment data corresponding to the abnormal local outlier factor that satisfies a second preset threshold among the abnormal local outlier factors is abnormal payment data. According to an embodiment of the present disclosure, the second preset threshold includes a second preset threshold determined based on historical local outlier factors corresponding to a plurality of historical payment data.

[0086] Figure 6 A block diagram of a payment anomaly detection system 600 according to another embodiment of the present disclosure is schematically shown.

[0087] like Figure 6 As shown, the payment anomaly detection system 600 further includes a fourth determination module 610 and a fifth determination module 620 based on the above embodiment. The acquisition module 510 includes a third acquisition submodule 511 , and the first determination module 520 includes a third determination submodule 521 .

[0088] The fourth determination module 620, for example, executes the above reference Figure 3 The described operation S310 is used to determine an abnormal success rate local outlier factor among the multiple success rate local outlier factors.

[0089] The fifth determining module 620, for example, executes the above reference Figure 3 The described operation S320 is used to determine the payment abnormality reason based on the churn rate local outlier factor and the transfer rate local outlier factor corresponding to the abnormal success rate local outlier factor.

[0090] The third acquisition submodule 511 is used to acquire a plurality of payment success rate data, a plurality of payment loss rate data and a payment transfer rate data.

[0091] The third determination submodule 521 is used to respectively determine multiple success rate local outlier factors, multiple churn rate local outlier factors and multiple transfer rate local outlier factors corresponding to the multiple payment success rate data, multiple payment churn rate data and payment transfer rate data.

[0092] Figure 7 A block diagram of a payment anomaly detection system 700 according to another embodiment of the present disclosure is schematically shown.

[0093] like Figure 7 As shown, the payment anomaly detection system 700 further includes a preprocessing module 710 based on the aforementioned embodiment, wherein the first determination module 520 includes a fourth determination submodule 522 .

[0094] The preprocessing module 710, for example, performs the above reference Figure 4 The described operation S410 is used to pre-process the multiple payment data and discard abnormal payment data among the multiple payment data.

[0095] The fourth determination submodule 522, for example, executes the above reference Figure 4 The described operation S221 is used to determine a plurality of local outlier factors corresponding to the plurality of pre-processed payment data by using a local outlier factor algorithm.

[0096] According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits, or at least part of the functions of any one of them can be implemented in one module. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be split into multiple modules for implementation. According to the embodiments of the present invention, any one or more of the modules, submodules, units, and subunits can be at least partially implemented as hardware circuits, such as field programmable gate arrays (FPGAs), programmable logic arrays (PLAs), systems on chips, systems on substrates, systems on packages, application specific integrated circuits (ASICs), or can be implemented by hardware or firmware in any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware, and firmware, or in any appropriate combination of any of them. Alternatively, according to the embodiments of the present invention, one or more of the modules, submodules, units, and subunits can be at least partially implemented as computer program modules, and when the computer program modules are run, the corresponding functions can be performed.

[0097] For example, any multiple of the acquisition module 510, the first determination module 520, the second determination module 530, the third determination module 540, the fourth determination module 610 and the fifth determination module 620, the third acquisition submodule 511, the third determination submodule 521, the preprocessing module 710 and the fourth determination submodule 522 can be combined into one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the acquisition module 510, the first determination module 520, the second determination module 530, the third determination module 540, the fourth determination module 610 and the fifth determination module 620, the third acquisition submodule 511, the third determination submodule 521, the preprocessing module 710 and the fourth determination submodule 522 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or can be implemented in any one of the three implementation methods of software, hardware and firmware or in an appropriate combination of any of them. Alternatively, at least one of the acquisition module 510, the first determination module 520, the second determination module 530, the third determination module 540, the fourth determination module 610 and the fifth determination module 620, the third acquisition sub-module 511, the third determination sub-module 521, the preprocessing module 710 and the fourth determination sub-module 522 can be at least partially implemented as a computer program module, and when the computer program module is executed, the corresponding function can be performed.

[0098] Figure 8 The block diagram of a computer system suitable for implementing the method described above according to an embodiment of the present disclosure is schematically shown. Figure 8 The computer system shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0099] like Figure 8As shown, the computer system 800 according to the embodiment of the present disclosure includes a processor 801, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 802 or the program loaded from the storage part 808 to the random access memory (RAM) 803. The processor 801 may include, for example, a general-purpose microprocessor (such as a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (for example, an application-specific integrated circuit (ASIC)), etc. The processor 801 may also include an onboard memory for caching purposes. The processor 801 may include a single processing unit or multiple processing units for performing different actions of the method flow according to the embodiment of the present disclosure.

[0100] In RAM 803, various programs and data required for the operation of system 800 are stored. Processor 801, ROM 802 and RAM 803 are connected to each other through bus 804. Processor 801 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 802 and / or RAM 803. It should be noted that the program can also be stored in one or more memories other than ROM 802 and RAM 803. Processor 801 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0101] According to an embodiment of the present disclosure, the system 800 may further include an input / output (I / O) interface 805, which is also connected to the bus 804. The system 800 may further include one or more of the following components connected to the I / O interface 805: an input section 806 including a keyboard, a mouse, etc.; an output section 807 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a LAN card, a modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to the I / O interface 805 as needed. A removable medium 811, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 810 as needed, so that a computer program read therefrom is installed into the storage section 808 as needed.

[0102] According to an embodiment of the present disclosure, the method flow according to an embodiment of the present disclosure can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program contains a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 809, and / or installed from the removable medium 811. When the computer program is executed by the processor 801, the above-mentioned functions defined in the system of the embodiment of the present disclosure are executed. According to an embodiment of the present disclosure, the system, equipment, device, module, unit, etc. described above can be implemented by a computer program module.

[0103] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0104] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium. For example, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0105] For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 802 and / or the RAM 803 described above and / or one or more memories other than the ROM 802 and the RAM 803 .

[0106] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0107] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0108] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A payment anomaly detection method, comprising: Acquire multiple payment data, wherein the payment data includes: a payment success rate, a payment loss rate, and a payment transfer rate, wherein the payment success rate is a ratio of orders that are successfully paid through the first channel to the total orders, the payment loss rate is a ratio of orders that are paid through the first channel but fail to pay to the total orders, and the payment transfer rate is a ratio of orders that are transferred from the first channel to the second channel to the total orders; Determine multiple local outlier factors corresponding to the multiple payment data by using a local outlier factor algorithm, wherein the local outlier factors include: a local outlier factor of success rate, a local outlier factor of churn rate, and a local outlier factor of transfer rate, and the payment data and the local outlier factors are in one-to-one correspondence; Determining an abnormal local outlier factor among the plurality of local outlier factors according to a first preset threshold; Determining payment data corresponding to the abnormal local outlier factor among the plurality of payment data as abnormal payment data; and The cause of the payment abnormality is determined according to the abnormal conditions of the local outlier factors of the multiple other payment data corresponding to the abnormal payment data.

2. The method according to claim 1, wherein obtaining a plurality of payment data comprises: Obtain multiple payment data corresponding to a time period of a specific length from the current moment; or Get multiple payment data corresponding to the time period between a specific start time and the current time.

3. The method according to claim 1, determining abnormal payment data among the plurality of payment data based on the abnormal local outlier factor comprises: Determining that the payment data corresponding to the abnormal local outlier factor is abnormal payment data; or It is determined that payment data corresponding to an abnormal local outlier factor that meets a second preset threshold among the abnormal local outlier factors is abnormal payment data.

4. The method according to claim 3, wherein the second preset threshold comprises: A second preset threshold is determined based on historical local outlier factors corresponding to a plurality of historical payment data.

5. The method according to claim 1, wherein: The obtaining of the plurality of payment data includes: obtaining a plurality of payment success rate data, a plurality of payment loss rate data and a payment transfer rate data; Determining the multiple local outlier factors corresponding to the multiple payment data by the local outlier factor algorithm includes: respectively determining multiple success rate local outlier factors, multiple churn rate local outlier factors and multiple transfer rate local outlier factors corresponding to the multiple payment success rate data, multiple payment churn rate data and payment transfer rate data; The method further comprises: determining an abnormal success rate local outlier factor among the plurality of success rate local outlier factors; and The payment abnormality cause is determined based on the churn rate local outlier factor and the transfer rate local outlier factor corresponding to the abnormal success rate local outlier factor.

6. The method according to claim 1, wherein: The method further comprises: pre-processing the plurality of payment data to discard abnormal payment data among the plurality of payment data, wherein the abnormal payment data comprises at least one of the following: payment data in which the total payment order and the successful payment order are null values, payment data in which the total payment order and the successful payment order are 0, and payment data in which the lost payment order, the transferred payment order and the successful payment order are not equal to the total payment order; Determining the multiple local outlier factors corresponding to the multiple payment data by using the local outlier factor algorithm includes: A plurality of local outlier factors corresponding to the plurality of preprocessed payment data are determined by a local outlier factor algorithm.

7. A payment anomaly detection system, comprising: an acquisition module, configured to acquire a plurality of payment data, wherein the payment data includes: a payment success rate, a payment loss rate, and a payment transfer rate, wherein the payment success rate is a ratio of orders successfully paid through a first channel to total orders, the payment loss rate is a ratio of orders paid through the first channel but failed to pay to total orders, and the payment transfer rate is a ratio of orders whose payment channel is transferred from the first channel to the second channel to total orders; A first determination module is used to determine a plurality of local outlier factors corresponding to the plurality of payment data by using a local outlier factor algorithm, wherein the local outlier factors include: a success rate local outlier factor, a churn rate local outlier factor, and a transfer rate local outlier factor, and the payment data and the local outlier factors are in one-to-one correspondence; A second determining module, configured to determine an abnormal local outlier factor among the plurality of local outlier factors according to a first preset threshold; A third determination module is used to determine the payment data corresponding to the abnormal local outlier factor among the plurality of payment data as abnormal payment data; and The cause of the payment abnormality is determined according to the abnormal conditions of the local outlier factors of the multiple other payment data corresponding to the abnormal payment data.

8. The system according to claim 7, wherein the acquisition module comprises: The first acquisition submodule is used to acquire a plurality of payment data corresponding to a time period of a specific time length from the current moment; or The second acquisition submodule is used to acquire a plurality of payment data corresponding to a time period between a specific start time and a current time.

9. The system according to claim 7, wherein the third determining module comprises: A first determination submodule, configured to determine that the payment data corresponding to the abnormal local outlier factor is abnormal payment data; or The second determining submodule is used to determine that the payment data corresponding to the abnormal local outlier factors that meet the second preset threshold among the abnormal local outlier factors are abnormal payment data.

10. The system according to claim 9, wherein the second preset threshold comprises: A second preset threshold is determined based on historical local outlier factors corresponding to a plurality of historical payment data.

11. The system of claim 7, wherein: The acquisition module includes: a third acquisition submodule, which is used to acquire a plurality of payment success rate data, a plurality of payment loss rate data and payment transfer rate data; The first determination module includes: a third determination submodule, for respectively determining a plurality of success rate local outlier factors, a plurality of churn rate local outlier factors, and a plurality of transfer rate local outlier factors corresponding to the plurality of payment success rate data, the plurality of payment churn rate data, and the payment transfer rate data; The system further comprises: a fourth determining module, configured to determine an abnormal success rate local outlier factor among the plurality of success rate local outlier factors; and The fifth determination module is used to determine the payment abnormality reason based on the churn rate local outlier factor and the transfer rate local outlier factor corresponding to the abnormal success rate local outlier factor.

12. The system of claim 7, wherein: The system further comprises: a preprocessing module, configured to preprocess the plurality of payment data to discard abnormal payment data among the plurality of payment data, wherein the abnormal payment data comprises at least one of the following: payment data in which the total payment order and the successful payment order are null values, payment data in which the total payment order and the successful payment order are 0, and payment lost order, payment transfer order, and payment successful order are not equal to the total payment order; The first determining module comprises: The fourth determination submodule is used to determine a plurality of local outlier factors corresponding to the plurality of preprocessed payment data by using a local outlier factor algorithm.

13. An electronic device comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors execute the method according to any one of claims 1 to 6.

14. A computer-readable medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the method according to any one of claims 1 to 6.

Images