Behavior determination method and device, storage medium, and electronic device

Abstract

The present invention discloses a method and device for determining behavior, a storage medium, and an electronic device. The method obtains historical transaction behavior information of a target object; determines the transaction behavior characteristics of the target object's historical transaction behavior according to the historical transaction behavior information; uses a first model to analyze the transaction behavior characteristics, and determines whether there are any illegal transaction behaviors in the historical transaction behaviors corresponding to the transaction behavior characteristics, thereby solving the technical problem of low efficiency and low accuracy in identifying illegal behaviors in related technologies, and achieving the technical effect of improving the efficiency of identifying the behavior of the target object.

Description

Technical Field

[0001] The present invention relates to the field of behavior analysis, and in particular to a behavior determination method and device, a storage medium, and an electronic device. Background Art

[0002] Bank employees have their own code of conduct, but it is still possible that some employees may violate regulations. This requires the identification of bank employees' violations. In current technology, the main identification channel comes from customer reports, or through simple rule screening (such as the operation amount exceeds a certain amount) and then manually checking the transaction details to find suspicious violations, and then further confirm whether the behavior is illegal. This method is not only inefficient, but also has a low accuracy rate.

[0003] There is no good solution in the relevant technology on how to efficiently identify whether the target object has violated the regulations. Summary of the invention

[0004] The embodiments of the present invention provide a behavior determination method and device, a storage medium, and an electronic device to at least solve the technical problem of how to efficiently identify whether a target object has any illegal behavior in the related art.

[0005] According to one aspect of an embodiment of the present invention, a method for determining a behavior is provided, comprising:

[0006] Obtain historical transaction behavior information of the target object;

[0007] Determining transaction behavior characteristics of the target object's historical transaction behavior based on the historical transaction behavior information;

[0008] The transaction behavior characteristics are analyzed using a first model to determine whether there are any illegal transaction behaviors in the historical transaction behaviors corresponding to the transaction behavior characteristics, wherein the first model is obtained by training using multiple groups of data, and each group of the multiple groups of data includes: sample transaction behavior characteristics and violation identifiers of the sample transaction behavior characteristics, wherein the sample transaction behavior characteristics are determined based on sample transaction behavior information of a sample object, and the violation identifier is used to indicate whether the sample transaction behavior corresponding to the sample transaction behavior information is an illegal transaction behavior.

[0009] According to another aspect of an embodiment of the present invention, a behavior determination device is provided, including:

[0010] The acquisition module is used to obtain the historical transaction behavior information of the target object;

[0011] A determination module, configured to determine the transaction behavior characteristics of the historical transaction behavior of the target object according to the historical transaction behavior information;

[0012] An analysis module is used to use a first model to analyze the transaction behavior characteristics to determine whether there are any illegal transaction behaviors in the historical transaction behaviors corresponding to the transaction behavior characteristics, wherein the first model is obtained by training using multiple groups of data, and each group of the multiple groups of data includes: sample transaction behavior characteristics and violation identifiers of the sample transaction behavior characteristics, wherein the sample transaction behavior characteristics are determined based on sample transaction behavior information of a sample object, and the violation identifier is used to indicate whether the sample transaction behavior corresponding to the sample transaction behavior information is an illegal transaction behavior.

[0013] According to another aspect of the embodiments of the present invention, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the determination method of the above-mentioned behavior when running.

[0014] According to another aspect of an embodiment of the present invention, there is provided an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the above-mentioned behavior determination method through the computer program.

[0015] In an embodiment of the present invention, historical transaction behavior information of a target object is obtained; transaction behavior characteristics of the target object's historical transaction behavior are determined based on the historical transaction behavior information; the transaction behavior characteristics are analyzed using a first model to determine whether there are any illegal transaction behaviors in the historical transaction behaviors corresponding to the transaction behavior characteristics, thereby solving the technical problem of low efficiency and low accuracy in identifying illegal behaviors in related technologies, and achieving the technical effect of improving the efficiency of identifying the target object's behavior. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0017] Figure 1 is a flow chart of a method for determining a behavior according to an embodiment of the present invention;

[0018] Figure 2 is a structural block diagram of a behavior determination device according to an embodiment of the present invention;

[0019] Figure 3 is a flowchart of a method for determining a behavior according to an exemplary embodiment of the present invention;

[0020] Figure 4 It is a schematic diagram of the structure of an optional electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0022] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0023] According to one aspect of an embodiment of the present invention, a method for determining a behavior is provided. Optionally, as an optional implementation, the method for determining a behavior in this embodiment can be executed by a computer program, and can be applied to a terminal or a server or a similar computing device or electronic device. Exemplarily, the computing device or electronic device may include one or more processors (the processor may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory for storing data, and may also include a transmission device and an input / output device for a communication function. It may also include more or less components than the aforementioned, or have a configuration different from that shown above. The memory may be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the method for determining a behavior in the embodiment of the present invention. The processor executes various functional applications and data processing by running the computer program stored in the memory, that is, implementing the above method. The memory may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the mobile terminal via a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. The transmission device is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device can be a radio frequency (Radio Frequency, referred to as RF) module, which is used to communicate with the Internet wirelessly.

[0024] Exemplarily, as an optional implementation, Figure 1 is a flow chart of a method for determining a behavior according to an embodiment of the present invention. Figure 1 As shown, the methods for determining behavior include:

[0025] Step S101, obtaining historical transaction behavior information of the target object;

[0026] Step S103, determining the transaction behavior characteristics of the target object's historical transaction behavior according to the historical transaction behavior information;

[0027] Step S105, using the first model to analyze the transaction behavior feature to determine whether there is any illegal transaction behavior in the historical transaction behavior corresponding to the transaction behavior feature, wherein the first model is obtained by training using multiple groups of data, and each group of the multiple groups of data includes: a sample transaction behavior feature and a violation flag of the sample transaction behavior feature, wherein the sample transaction behavior feature is determined based on the sample transaction behavior information of the sample object, and the violation flag is used to indicate whether the sample transaction behavior corresponding to the sample transaction behavior information is an illegal transaction behavior.

[0028] Through the above steps, the historical transaction behavior information of the target object is obtained; the transaction behavior characteristics of the historical transaction behavior of the target object are determined based on the historical transaction behavior information; the transaction behavior characteristics are analyzed using the first model to determine whether there are any illegal transaction behaviors in the historical transaction behaviors corresponding to the transaction behavior characteristics, thereby solving the technical problem of low efficiency and low accuracy in identifying illegal behaviors in related technologies, and achieving the technical effect of improving the efficiency of behavior recognition of the target object.

[0029] It should be noted that, in this embodiment, the method for determining the sample transaction behavior characteristics is consistent with the method for determining the transaction behavior characteristics of the target object's historical transaction behavior, and will not be repeated here.

[0030] In an exemplary embodiment, determining the transaction behavior characteristics of the target object's historical transaction behavior according to the historical transaction behavior information includes:

[0031] A first transaction behavior feature and a second transaction behavior feature of the historical transaction behavior of the target object are determined based on the historical transaction behavior information, wherein the first transaction behavior feature is used to indicate the difference between the transfer-in transaction amount and the transfer-out transaction amount in the historical transaction behavior, and the second transaction behavior feature is used to indicate the relationship between the transfer-out transaction amount and the transaction balance in the historical transaction behavior.

[0032] In an exemplary embodiment, determining the first transaction behavior feature and the second transaction behavior feature of the target object's historical transaction behavior according to the historical transaction behavior information includes:

[0033] Determine, according to the historical transaction behavior information, a first transaction behavior sub-feature and a second transaction behavior sub-feature of each transfer-out transaction after the first transfer-in transaction in the historical transaction behavior, wherein the first transaction behavior feature includes a plurality of first transaction behavior sub-features, the second transaction behavior feature includes a plurality of second transaction behavior sub-features, and each transfer-out transaction after the first transfer-in transaction in the historical transaction behavior information corresponds to a first transaction behavior sub-feature and a second transaction behavior sub-feature, respectively;

[0034] For the first designated transfer-out transaction in the historical transaction behavior information, the first transaction behavior sub-feature of the first designated transfer-out transaction is the ratio of the first transfer-out transaction amount to the first transfer-in transaction amount, and the second transaction behavior sub-feature of the first designated transfer-out transaction is the ratio of the first transfer-out transaction amount to the first transaction balance;

[0035] Among them, the first designated transfer-out transaction is any transfer-out transaction in each transfer-out transaction after the first transfer-in transaction in the historical transaction behavior, the first transfer-out transaction amount is the sum of the first amount and the second amount, the first amount is the transfer-out transaction amount of all transfer-out transactions that are continuous in time with the first designated transfer-out transaction before the first designated transfer-out transaction in the historical transaction behavior information, the second amount is the transfer-out transaction amount of the first designated transfer-out transaction, and when there is no transfer-out transaction that is continuous in time with the first designated transfer-out transaction before the first designated transfer-out transaction, the first amount is zero; the first transfer-in transaction amount is the total transfer-in transaction amount of one or more transfer-in transactions that are continuous in time in the previous period of the first designated transfer-out transaction; the first transaction balance is the transaction balance before all transfer-in transactions that are continuous in time in the previous period of the first designated transfer-out transaction.

[0036] It should be noted that the expressions "a section", "previous section" and the like described in this embodiment may refer to a section of transactions of the same nature that occur continuously in time. The following example illustrates this: in historical transaction behaviors, there are some transfer-out transactions or transfer-in transactions that occur continuously in time. For example, in chronological order, two transfer-in transactions occur continuously, followed by three transfer-out transactions, and then one transfer-in transaction occurs; then, the two transfer-in transactions that are consecutive in time, or the three transfer-out transactions that are consecutive in time, can be referred to as "a section" of transactions, and the previous section of transactions of the latter three transfer-out transactions is the two transfer-in transactions.

[0037] In an exemplary embodiment, the first model is used to analyze the transaction behavior characteristics to determine whether there are any illegal transaction behaviors in the historical transaction behaviors corresponding to the transaction behavior characteristics, including: using a classification model to analyze the transaction behavior characteristics to obtain a violation probability score for each transfer transaction behavior in the historical transaction behaviors corresponding to the transaction behavior characteristics; when the violation probability score corresponding to a specified transfer transaction behavior exceeds a pre-set score threshold, determining that the specified transfer transaction behavior is a violation transaction behavior.

[0038] In an exemplary embodiment, after the classification model is used to analyze the transaction behavior characteristics and obtain the violation probability score of each transfer-out transaction behavior in the historical transaction behavior corresponding to the transaction behavior characteristics, the method also includes: using the model risk differentiation ability index to screen the violation probability score of each transfer-out transaction behavior; and using the violation probability score corresponding to the model risk differentiation ability index that meets pre-set conditions as the score threshold.

[0039] In an exemplary embodiment, the historical transaction behavior information of the target object includes target object identification information of the transaction behavior and transaction behavior identification information, wherein the target object identification information is used to identify the target object of the transaction behavior, and the transaction behavior identification information is used to uniquely identify a transaction behavior;

[0040] After analyzing the transaction behavior feature using the first model to determine whether there is any illegal transaction behavior in the historical transaction behavior corresponding to the transaction behavior feature, the behavior determination method further includes:

[0041] When it is determined that there is a violation of the transaction behavior in the historical transaction behavior, the target object and the transaction behavior corresponding to the violation of the transaction behavior are respectively determined according to the target object identification information and the transaction behavior identification information of the determined violation of the transaction behavior.

[0042] In an exemplary embodiment, before determining the transaction behavior characteristics of the target object's historical transaction behavior based on the historical transaction behavior information, the method further includes: performing information preprocessing on the acquired historical transaction behavior information, wherein the information preprocessing is used to correct the historical transaction behavior information.

[0043] In this embodiment, a behavior determination device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0044] Figure 2 is a structural block diagram of a behavior determination device according to an embodiment of the present invention, such as Figure 2 As shown, the device comprises:

[0045] An acquisition module 22 is used to acquire historical transaction behavior information of a target object;

[0046] A determination module 24, configured to determine the transaction behavior characteristics of the historical transaction behavior of the target object according to the historical transaction behavior information;

[0047] The analysis module 26 is used to use the first model to analyze the transaction behavior feature to determine whether there is any illegal transaction behavior in the historical transaction behavior corresponding to the transaction behavior feature, wherein the first model is obtained by training using multiple groups of data, and each group of the multiple groups of data includes: a sample transaction behavior feature and a violation flag of the sample transaction behavior feature, wherein the sample transaction behavior feature is determined based on the sample transaction behavior information of the sample object, and the violation flag is used to indicate whether the sample transaction behavior corresponding to the sample transaction behavior information is an illegal transaction behavior.

[0048] Through the above steps, the historical transaction behavior information of the target object is obtained; the transaction behavior characteristics of the historical transaction behavior of the target object are determined based on the historical transaction behavior information; the transaction behavior characteristics are analyzed using the first model to determine whether there are any illegal transaction behaviors in the historical transaction behaviors corresponding to the transaction behavior characteristics, thereby solving the technical problem of low efficiency and low accuracy in identifying illegal behaviors in related technologies, and achieving the technical effect of improving the efficiency of behavior recognition of the target object.

[0049] It should also be noted that other implementations of this embodiment are the same as the above embodiment and will not be described in detail here.

[0050] Example Implementations

[0051] The embodiments of the present invention are further explained below in conjunction with specific scenarios. For example, a risk management department of a bank wants to find an employee account to transfer money on behalf of the employee, including accepting funds from others (public or private accounts) into the employee account, and then transferring the funds to a third party by the employee. This behavior usually has three typical characteristics: 1) the interval between transfers is short, 2) the difference between the transfer amounts is small, and 3) the difference from the usual transaction amount is large.

[0052] This solution uses data mining technology to mine the transaction behavior characteristics of employees who have violated regulations based on their transaction data over the past period of time and their violation transaction identification, and forms a violation scoring model for employee violation discovery. Considering that the violation involves both transfer-in and transfer-out transactions and ends with a transfer-out transaction, this technical solution focuses on each transfer-out transaction of the employee. It is divided into the following steps:

[0053] Data acquisition:

[0054] Obtain the basic information of all employees of the bank (including employee ID, age, ID number, branch, etc.), and the corresponding employee transaction details, including employee ID, transaction ID, transaction time, transaction amount, post-transaction balance, transaction account number, transaction type, loan method, counterparty name, counterparty account number, transaction notes and employee managed asset balance data, as well as the transaction record identification of the violating employee.

[0055] Data processing:

[0056] Perform a quality check on the above data, discard data with a missing rate of more than 50% and data with extremely unbalanced distribution, and delete transactions that are not related to customers, such as employee financial management and interest settlement.

[0057] Feature processing:

[0058] Based on the screened data, employee transaction features are processed. The features include two categories: one is obtained directly or through simple calculations, and the other is obtained through iterative algorithms.

[0059] Features obtained through simple calculations: including employee age, gender, outgoing transaction amount, balance after outgoing transaction, whether there are sensitive words in the outgoing transaction notes, ratio of last month's transaction times to this month's transaction times, ratio of last month's transaction amount to this month's transaction amount, difference between the current trading day balance and the previous day's balance, current trading day balance and the previous three trading days' balance, last month's non-identical transfer-in transaction amount, last month's non-identical transfer-in times, last month's managed assets, last month's monthly daily average, and the interval between the last transaction;

[0060] Features obtained through iterative algorithm processing:

[0061] (a) The difference index between the outgoing transaction amount and the incoming transaction amount = the cumulative outgoing transaction amount in each session up to the current time / the incoming transaction amount; wherein, the difference index between the outgoing transaction amount and the incoming transaction amount is equivalent to the first transaction behavior feature in the above embodiment, and this index is used to explore the difference between the employee's current outgoing transaction amount and the last incoming transaction amount. The specific algorithm is described as follows: Arrange the data in ascending order by employee and transaction time (accurate to seconds), and generate a sequence of transaction direction and transaction amount, such as the data corresponding to employee ID1 is shown in Table 1 below:

[0062]

[0063] Table 1

[0064] The transfer-in transaction amount between every two adjacent transfer-out transactions in Table 1 above is summed up as the processed transfer-in transaction amount; the continuous transfer-out transaction amount up to the current time is summed up as the processed transfer-out transaction amount. Each continuous transfer-out transaction and the last continuous transfer-in transaction are regarded as a session, and the results shown in Table 2 below are obtained:

[0065]

[0066] Table 2

[0067] Then calculate the ratio of each processed outgoing transaction amount to the processed incoming transaction amount in the session. The results are shown in Table 3 below:

[0068]

[0069] Table 3

[0070] (b) Difference index between outgoing transaction amount and usual transaction amount = cumulative outgoing transaction amount in each session up to the current time / balance after the last outgoing transaction in the previous session; wherein, the difference index between outgoing transaction amount and usual transaction amount is equivalent to the second transaction behavior feature in the above embodiment, and the index is used to explore the ratio of the employee's outgoing transaction to the usual balance, and the results are shown in Table 4 below:

[0071]

[0072] Table 4

[0073] To understand how the above two difference indices are calculated, the following is a further example:

[0074] For example, employee 001 has transaction details as shown in Table 5 below:

[0075]

[0076]

[0077] Table 5

[0078] Then, the difference index between each outgoing transaction amount and the incoming transaction amount and the difference index between each outgoing transaction amount and the usual transaction amount are shown in Table 6 below:

[0079]

[0080] Table 6

[0081] Model training and application:

[0082] The processed data (including employee ID, employee transfer transaction ID, the above processed features, and the violation mark of the transaction) are divided into a training set and a test set. The training set is trained with a supervised learning model. The model can be a classification model, such as logistic regression, xgboost, xgboost+logic regression, etc. The trained model is applied to the test set to score the probability of violation for each transfer transaction.

[0083] For the score, the mining model ks (Kolmogorov-Smirnov) indicator is used for threshold screening, and the score corresponding to the maximum ks value is selected as the threshold R0. At this point, the model training process is completed.

[0084] By applying the above model to the data to be scored that has been processed according to the above feature engineering, the violation probability score of each transfer transaction can be obtained. The transaction data with a score greater than R0 is considered a suspicious violation transaction.

[0085] Compared with the current method of screening by simple rules, the embodiment of the present invention can more comprehensively cover the transaction behaviors of employees and scientifically mine the employee behavior characteristics corresponding to the illegal behaviors. This method can identify more suspicious illegal behaviors and at the same time rely on the computing efficiency of computers, which will greatly improve the efficiency of identifying suspicious illegal behaviors.

[0086] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described action sequence, because according to the present invention, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0087] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0088] According to another aspect of the embodiments of the present invention, an electronic device for implementing the above-mentioned behavior determination method is also provided. Figure 4is a schematic diagram of the structure of an optional electronic device according to an embodiment of the present invention, such as Figure 4 As shown, the electronic device includes a memory 402 and a processor 404. The memory 402 stores a computer program, and the processor 404 is configured to execute the steps in any of the above method embodiments through the computer program.

[0089] Optionally, in this embodiment, the electronic device may be located in at least one network device among a plurality of network devices of a computer network.

[0090] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

[0091] S1, obtain the historical transaction behavior information of the target object;

[0092] S2, determining the transaction behavior characteristics of the historical transaction behavior of the target object according to the historical transaction behavior information;

[0093] S3, using a first model to analyze the transaction behavior feature to determine whether there is any illegal transaction behavior in the historical transaction behavior corresponding to the transaction behavior feature, wherein the first model is obtained by training using multiple sets of data, and each set of data in the multiple sets of data includes: a sample transaction behavior feature and a violation flag of the sample transaction behavior feature, wherein the sample transaction behavior feature is determined based on the sample transaction behavior information of the sample object, and the violation flag is used to indicate whether the sample transaction behavior corresponding to the sample transaction behavior information is an illegal transaction behavior.

[0094] Through the above steps, the historical transaction behavior information of the target object is obtained; the transaction behavior characteristics of the historical transaction behavior of the target object are determined based on the historical transaction behavior information; the transaction behavior characteristics are analyzed using the first model to determine whether there are any illegal transaction behaviors in the historical transaction behaviors corresponding to the transaction behavior characteristics, thereby solving the technical problem of low efficiency and low accuracy in identifying illegal behaviors in related technologies, and achieving the technical effect of improving the efficiency of behavior recognition of the target object.

[0095] Alternatively, a person skilled in the art may understand that: Figure 4 The structure shown is for illustration only, and the electronic device may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (MID), a PAD, a server, or other terminal devices. Figure 4 It does not limit the structure of the above-mentioned electronic device or electronic equipment. For example, the electronic device or electronic equipment may also include Figure 4More or fewer components (such as network interfaces, etc.) as shown in, or with Figure 4 Different configurations are shown.

[0096] Among them, the memory 402 can be used to store software programs and modules, such as program instructions / modules corresponding to the behavior determination method and device in the embodiment of the present invention. The processor 404 executes various functional applications and data processing by running the software programs and modules stored in the memory 402, that is, realizing the above-mentioned behavior determination method. The memory 402 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 402 may further include a memory remotely arranged relative to the processor 404, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof. Among them, the memory 402 may be specifically used, but not limited to, for storing information such as sample characteristics of items and target virtual resource accounts.

[0097] Optionally, the transmission device 406 is used to receive or send data via a network. Specific examples of the network may include a wired network and a wireless network. In one example, the transmission device 406 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices and routers via a network cable so as to communicate with the Internet or a local area network. In one example, the transmission device 406 is a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0098] In addition, the electronic device further comprises: a display 408 for displaying the order information to be processed; and a connection bus 410 for connecting the various module components in the electronic device.

[0099] In other embodiments, the terminal device or server may be a node in a distributed system, wherein the distributed system may be a blockchain system, and the blockchain system may be a distributed system formed by connecting the multiple nodes through network communication. Among them, the nodes may form a peer-to-peer (P2P, Peer To Peer) network, and any form of computing device, such as a server, terminal and other electronic devices, may become a node in the blockchain system by joining the peer-to-peer network.

[0100] According to another aspect of the embodiments of the present invention, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when run.

[0101] Optionally, in this embodiment, the computer-readable storage medium may be configured to store a computer program for performing the following steps:

[0102] S1, obtain the historical transaction behavior information of the target object;

[0103] S2, determining the transaction behavior characteristics of the historical transaction behavior of the target object according to the historical transaction behavior information;

[0104] S3, using a first model to analyze the transaction behavior feature to determine whether there is any illegal transaction behavior in the historical transaction behavior corresponding to the transaction behavior feature, wherein the first model is obtained by training using multiple sets of data, and each set of data in the multiple sets of data includes: a sample transaction behavior feature and a violation flag of the sample transaction behavior feature, wherein the sample transaction behavior feature is determined based on the sample transaction behavior information of the sample object, and the violation flag is used to indicate whether the sample transaction behavior corresponding to the sample transaction behavior information is an illegal transaction behavior.

[0105] Through the above steps, the historical transaction behavior information of the target object is obtained; the transaction behavior characteristics of the historical transaction behavior of the target object are determined based on the historical transaction behavior information; the transaction behavior characteristics are analyzed using the first model to determine whether there are any illegal transaction behaviors in the historical transaction behaviors corresponding to the transaction behavior characteristics, thereby solving the technical problem of low efficiency and low accuracy in identifying illegal behaviors in related technologies, and achieving the technical effect of improving the efficiency of behavior recognition of the target object.

[0106] Optionally, in this embodiment, a person of ordinary skill in the art may understand that all or part of the steps in the various methods of the above embodiments may be completed by instructing hardware related to the terminal device through a program, and the program may be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc.

[0107] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0108] If the integrated units in the above embodiments are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above computer-readable storage medium. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling one or more computer devices (which can be personal computers, servers or network devices, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention.

[0109] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0110] In the several embodiments provided in the present application, it should be understood that the device embodiments described above are only schematic, for example, the division of the units is only a logical function division, and there may be other division methods in actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0111] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0112] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0113] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for determining a behavior, comprising: Obtain historical transaction behavior information of the target object; Determining transaction behavior characteristics of the target object's historical transaction behavior based on the historical transaction behavior information; Using a first model to analyze the transaction behavior feature, determine whether there is any illegal transaction behavior in the historical transaction behavior corresponding to the transaction behavior feature, wherein the first model is obtained by training using multiple sets of data, and each set of data in the multiple sets of data includes: a sample transaction behavior feature and a violation mark of the sample transaction behavior feature, wherein the sample transaction behavior feature is determined based on the sample transaction behavior information of the sample object, and the violation mark is used to indicate whether the sample transaction behavior corresponding to the sample transaction behavior information is an illegal transaction behavior; The determining the transaction behavior characteristics of the historical transaction behavior of the target object according to the historical transaction behavior information includes: Determine a first transaction behavior feature and a second transaction behavior feature of the target object's historical transaction behavior according to the historical transaction behavior information, wherein the first transaction behavior feature is used to indicate the difference between the outgoing transaction amount and the incoming transaction amount in the historical transaction behavior, and the second transaction behavior feature is used to indicate the relationship between the outgoing transaction amount and the transaction balance in the historical transaction behavior; The determining of the first transaction behavior feature and the second transaction behavior feature of the target object's historical transaction behavior according to the historical transaction behavior information includes: Determine, according to the historical transaction behavior information, a first transaction behavior sub-feature and a second transaction behavior sub-feature of each transfer-out transaction after the first transfer-in transaction in the historical transaction behavior, wherein the first transaction behavior feature includes a plurality of first transaction behavior sub-features, the second transaction behavior feature includes a plurality of second transaction behavior sub-features, and each transfer-out transaction after the first transfer-in transaction in the historical transaction behavior information corresponds to a first transaction behavior sub-feature and a second transaction behavior sub-feature, respectively; For the first designated transfer-out transaction in the historical transaction behavior information, the first transaction behavior sub-feature of the first designated transfer-out transaction is a ratio of the first transfer-out transaction amount to the first transfer-in transaction amount, and the second transaction behavior sub-feature of the first designated transfer-out transaction is a ratio of the first transfer-out transaction amount to the first transaction balance; The first designated transfer-out transaction is any transfer-out transaction in each transfer-out transaction after the first transfer-in transaction in the historical transaction behavior; the first transfer-out transaction amount is the sum of the first amount and the second amount; the first amount is the transfer-out transaction amount of all transfer-out transactions that are continuous in time with the first designated transfer-out transaction before the first designated transfer-out transaction in the historical transaction behavior information; the second amount is the transfer-out transaction amount of the first designated transfer-out transaction; if there is no transfer-out transaction that is continuous in time with the first designated transfer-out transaction before the first designated transfer-out transaction, the first amount is zero; the first transfer-in transaction amount is the total transfer-in transaction amount of one or more transfer-in transactions that are continuous in time in the previous section of the first designated transfer-out transaction; the first transaction balance is the transaction balance before all transfer-in transactions that are continuous in time in the previous section of the first designated transfer-out transaction; the use of the first model to analyze the transaction behavior characteristics to determine whether there is any illegal transaction behavior in the historical transaction behavior corresponding to the transaction behavior characteristics includes: Analyze the transaction behavior characteristics using a classification model to obtain a violation probability score for each outgoing transaction behavior in the historical transaction behavior corresponding to the transaction behavior characteristics; When the violation probability score corresponding to the designated transfer-out transaction behavior exceeds a preset score threshold, determining that the designated transfer-out transaction behavior is a violation transaction behavior; After analyzing the transaction behavior characteristics using the classification model to obtain a violation probability score for each outgoing transaction behavior in the historical transaction behaviors corresponding to the transaction behavior characteristics, the method further includes: Use the model risk differentiation capability index to screen the violation probability score of each transfer-out transaction; The violation probability score corresponding to the model risk differentiation capability indicator that meets the preset conditions is used as the score threshold.

2. The method for determining a behavior according to claim 1, characterized in that: The historical transaction behavior information of the target object includes target object identification information of the transaction behavior and transaction behavior identification information, wherein the target object identification information is used to identify the target object of the transaction behavior, and the transaction behavior identification information is used to uniquely identify a transaction behavior; After analyzing the transaction behavior characteristics using the first model to determine whether there is any illegal transaction behavior in the historical transaction behaviors corresponding to the transaction behavior characteristics, the behavior determination method further includes: In the case where it is determined that there is a violation of the transaction behavior in the historical transaction behavior, the target object and the transaction behavior corresponding to the violation of the transaction behavior are respectively determined according to the target object identification information and the transaction behavior identification information of the determined violation of the transaction behavior.

3. The method for determining a behavior according to claim 1, characterized in that: Before determining the transaction behavior characteristics of the historical transaction behavior of the target object according to the historical transaction behavior information, the behavior determination method further includes: The acquired historical transaction behavior information is subjected to information preprocessing, wherein the information preprocessing is used to correct the historical transaction behavior information.

4. A computer-readable storage medium, the computer-readable storage medium comprising a stored program, wherein: When the program is executed, the method described in any one of claims 1 to 3 is executed.

5. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to execute the method according to any one of claims 1 to 3 through the computer program.

Images