Abnormal subject detection method, device, computer equipment and storage medium

Abstract

The present application relates to a method, apparatus, computer device, and storage medium for detecting abnormal subjects. The method comprises: in response to an abnormal type confirmation operation, displaying a target abnormal type corresponding to a target abnormal subject; displaying candidate subjects with which the target abnormal subject has interaction records, and corresponding to the candidate subjects, displaying an automatic detection result of the candidate subject corresponding to the target abnormal type; in response to a first selection operation for a candidate subject whose automatic detection result is a match, adding the candidate subject selected by the first selection operation to an abnormal subject group corresponding to the target abnormal subject, wherein the abnormal subject group is a subject group corresponding to the target abnormal type. The use of this method can improve the efficiency of abnormal subject detection.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a method, apparatus, computer device, and storage medium for detecting abnormal subjects. Background Art

[0002] With the development of the financial industry, many unusual transactions have emerged, such as money laundering. Money laundering is the practice of legalizing the proceeds of unusual transactions. It primarily involves disguising and concealing the source and nature of illegal proceeds and the resulting profits through various means, thereby giving them the appearance of legality. Unusual transactions pose a serious threat to social and economic stability.

[0003] In traditional technology, when identifying criminals who engage in abnormal transactions, manual testing of relevant data is usually used to manually determine suspicious persons who have engaged in abnormal transactions. Since manual testing takes a long time, the efficiency of detecting users with abnormal behavior is low. Summary of the Invention

[0004] Based on this, it is necessary to provide an abnormal subject detection method, device, computer equipment and storage medium that can improve the efficiency of detecting users with abnormal behavior in order to address the above technical problems.

[0005] A method for detecting abnormal subjects, the method comprising: in response to an abnormal type confirmation operation, displaying a target abnormal type corresponding to a target abnormal subject; displaying candidate subjects having interaction records with the target abnormal subject, and, corresponding to the candidate subjects, displaying an automatic detection result of the candidate subjects corresponding to the target abnormal type; in response to a first selection operation for a candidate subject whose automatic detection result is a match, adding the candidate subject selected by the first selection operation to an abnormal subject group corresponding to the target abnormal subject, the abnormal subject group being a subject group corresponding to the target abnormal type.

[0006] An abnormal subject detection device, the device comprising: a target abnormal type display module, for displaying a target abnormal type corresponding to a target abnormal subject in response to an abnormal type confirmation operation; an automatic detection result display module, for displaying candidate subjects having interaction records with the target abnormal subject, and, corresponding to the candidate subjects, displaying automatic detection results of the candidate subjects corresponding to the target abnormal type; a candidate subject adding module, for adding the candidate subject selected by the first selection operation to an abnormal subject group corresponding to the target abnormal subject in response to a first selection operation on a candidate subject whose automatic detection result is a match, the abnormal subject group being a subject group corresponding to the target abnormal type.

[0007] In some embodiments, the device further includes: a subject information adding area display module, used to display the group subject in the abnormal subject group and the subject information adding area corresponding to the group subject; and a subject information acquisition module, used to acquire the subject information corresponding to the group subject through the subject information adding area.

[0008] In some embodiments, the subject information adding area includes a group role selection control, and the subject information acquisition module includes: a group role selection operation receiving unit, which is used to receive the group role selection operation corresponding to the group subject through the group role selection control; a group role selection operation response unit, which is used to respond to the group role selection operation and use the target group role selected by the group role selection operation as the role of the group subject in the abnormal subject group.

[0009] In some embodiments, the apparatus is further configured to report the abnormal subject group in response to an abnormal subject group reporting operation, where the abnormal subject group includes the target abnormal subject and the candidate subject selected by the first selection operation.

[0010] In some embodiments, the automatic detection result display module includes: a subject group detection entrance display unit, used to display the subject group detection entrance corresponding to the target abnormal subject; a subject group detection operation receiving unit, used to receive the subject group detection operation corresponding to the target abnormal subject through the subject group detection entrance; an automatic detection result display unit, used to respond to the subject group detection operation, display a candidate subject that has an interaction record with the target abnormal subject, and corresponding to the candidate subject, display the automatic detection result of the candidate subject corresponding to the target abnormal type.

[0011] In some embodiments, the automatic detection result display unit is also used to display a set of interactive subjects that have interaction records with the target abnormal subject in response to the subject group detection operation; in response to a second selection operation on a subject in the interactive subject set, display the candidate subject selected by the second selection operation, and corresponding to the candidate subject, display the automatic detection result of the candidate subject corresponding to the target abnormal type.

[0012] In some embodiments, the automatic detection result display unit is also used to respond to the subject group detection operation and send a subject group detection request for the target abnormal subject on the target abnormal type to the server, so that the server responds to the subject group detection request, obtains a candidate subject that has an interaction record with the target abnormal subject, performs an abnormality detection on the candidate subject through the abnormality detection method corresponding to the target abnormality type, and obtains an automatic detection result corresponding to the target abnormality type; receives the automatic detection result returned by the server, displays the candidate subject, and displays the automatic detection result of the candidate subject corresponding to the target abnormality type corresponding to the candidate subject.

[0013] In some embodiments, the automatic detection result is a resource transfer anomaly detection result, the candidate subject is a subject that has a resource transfer record with the target anomaly subject, and the automatic detection result display module includes: a viewing entry display unit, which is used to display the candidate subject that has an interaction record with the target anomaly subject, and corresponding to the candidate subject, displays the automatic detection result of the candidate subject and the target anomaly type, and displays a viewing entry for the resource transfer record set corresponding to the automatic detection result; a resource transfer record set display unit, which is used to display the resource transfer record set in response to a trigger operation on the viewing entry.

[0014] In some embodiments, the target exception type display module includes: a target exception subject confirmation unit, which is used to confirm the target exception subject in response to the exception subject confirmation operation; a target exception type display unit, which is used to display the exception type selection control corresponding to the target exception subject, and display the target exception type corresponding to the target exception subject in response to the exception type confirmation operation received through the exception type selection control.

[0015] A computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented: in response to an exception type confirmation operation, displaying a target exception type corresponding to a target exception subject; displaying candidate subjects having interaction records with the target exception subject, and corresponding to the candidate subjects, displaying an automatic detection result of the candidate subjects corresponding to the target exception type; in response to a first selection operation for a candidate subject whose automatic detection result is a match, adding the candidate subject selected by the first selection operation to an exception subject group corresponding to the target exception subject, wherein the exception subject group is a subject group corresponding to the target exception type.

[0016] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the following steps: in response to an exception type confirmation operation, displays a target exception type corresponding to a target exception subject; displays candidate subjects having interaction records with the target exception subject, and, corresponding to the candidate subjects, displays an automatic detection result of the candidate subjects corresponding to the target exception type; in response to a first selection operation on a candidate subject whose automatic detection result is a match, adds the candidate subject selected by the first selection operation to an exception subject group corresponding to the target exception subject, where the exception subject group is a subject group corresponding to the target exception type.

[0017] In some embodiments, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps of each of the above method embodiments.

[0018] The above-mentioned abnormal subject detection method, apparatus, computer equipment and storage medium, in response to an abnormal type confirmation operation, display the target abnormal type corresponding to the target abnormal subject, display the candidate subjects that have interaction records with the target abnormal type, and display the automatic detection results of the candidate subjects corresponding to the target abnormal type, in response to the candidate subjects, display the automatic detection results of the candidate subjects corresponding to the target abnormal type, and in response to the first selection operation for the candidate subject whose automatic detection result is a match, add the candidate subject selected by the first selection operation to the abnormal subject group corresponding to the target abnormal subject, the abnormal subject group being the subject group corresponding to the target abnormal type, thereby automatically obtaining the abnormal subject group belonging to the same abnormal type as the target abnormal subject, realizing group detection of abnormal behavior, and improving the detection efficiency of abnormal subjects.

[0019] A method for detecting an abnormal subject, the method comprising: when a terminal receives an abnormal type confirmation operation for a target abnormal subject, obtaining the target abnormal type confirmed by the abnormal type confirmation operation; obtaining a candidate subject having an interaction record with the target abnormal subject, performing abnormality detection on the candidate subject through an abnormality detection method corresponding to the target abnormal type, and obtaining an automatic detection result corresponding to the target abnormal type; sending the automatic detection result to the terminal so that the terminal displays the candidate subject and, corresponding to the candidate subject, displays the automatic detection result of the candidate subject corresponding to the target abnormal type; in response to a first selection operation for a candidate subject whose automatic detection result is a match, adding the candidate subject selected by the first selection operation to an abnormal subject group corresponding to the target abnormal subject, the abnormal subject group being a subject group corresponding to the target abnormal type.

[0020] An abnormal subject detection device, the device comprising: a target abnormal type acquisition module, for obtaining the target abnormal type confirmed by the abnormal type confirmation operation when a terminal receives an abnormal type confirmation operation for a target abnormal subject; an automatic detection result acquisition module, for obtaining a candidate subject having an interaction record with the target abnormal subject, performing abnormality detection on the candidate subject through an abnormality detection method corresponding to the target abnormal type, and obtaining an automatic detection result corresponding to the target abnormal type; an automatic detection result sending module, for sending the automatic detection result to the terminal, so that the terminal displays the candidate subject and, corresponding to the candidate subject, displays the automatic detection result of the candidate subject corresponding to the target abnormal type, and in response to a first selection operation for a candidate subject whose automatic detection result is a match, adding the candidate subject selected by the first selection operation to an abnormal subject group corresponding to the target abnormal subject, the abnormal subject group being a subject group corresponding to the target abnormal type.

[0021] In some embodiments, the automatic detection result is a resource transfer anomaly detection result, and the candidate subject having an interaction record with the target abnormal subject is obtained, and the automatic detection result obtaining module includes: a resource transfer related data obtaining unit, which is used to obtain the candidate subject having a resource transfer record with the target abnormal subject, and obtain the resource transfer related data corresponding to the candidate subject; an anomaly detection score obtaining unit, which is used to obtain the anomaly detection score corresponding to the resource transfer related data and the target data weight set corresponding to the target anomaly type; an anomaly detection comprehensive score obtaining unit, which is used to obtain the anomaly detection comprehensive score by weighting the anomaly detection score with the corresponding data weight in the target data weight set; an automatic detection result obtaining unit, which is used to obtain the automatic detection result of the candidate subject corresponding to the target anomaly type according to the anomaly detection comprehensive score.

[0022] In some embodiments, the device also includes a target data weight set acquisition module, and the target data weight set acquisition module includes: a training resource transfer related data acquisition unit, which is used to obtain the standard comprehensive score corresponding to the training abnormality subject and the training resource transfer related data corresponding to the training abnormality subject; a training abnormality detection score acquisition unit, which is used to obtain the training abnormality detection score corresponding to the training resource transfer related data; a current data weight set acquisition unit, which is used to obtain the current data weight set; a training detection comprehensive score acquisition unit, which is used to weight the training abnormality detection score with the corresponding data weight in the current data weight set to obtain a training detection comprehensive score; a weight updating unit, which is used to update the weights in the current data weight set according to the difference between the training detection comprehensive score and the standard comprehensive score, and return to the step of weighting the training abnormality detection score with the corresponding data weight in the current data weight set to obtain a training detection comprehensive score, until the difference between the training detection comprehensive score and the standard comprehensive score is less than the score threshold or the number of returns reaches the number threshold, and the current data weight set is used as the target data weight set.

[0023] A computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented: when a terminal receives an exception type confirmation operation for a target exception subject, obtaining the target exception type confirmed by the exception type confirmation operation; obtaining a candidate subject having an interaction record with the target exception subject, performing an exception detection on the candidate subject using an exception detection method corresponding to the target exception type, and obtaining an automatic detection result corresponding to the target exception type; sending the automatic detection result to the terminal so that the terminal displays the candidate subject and, corresponding to the candidate subject, displays the automatic detection result of the candidate subject corresponding to the target exception type; in response to a first selection operation for a candidate subject whose automatic detection result is a match, adding the candidate subject selected by the first selection operation to an exception subject group corresponding to the target exception subject, wherein the exception subject group is a subject group corresponding to the target exception type.

[0024] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the following steps: when a terminal receives an exception type confirmation operation for a target exception subject, obtains the target exception type confirmed by the exception type confirmation operation; obtains a candidate subject having an interaction record with the target exception subject, performs an exception detection on the candidate subject using an exception detection method corresponding to the target exception type, and obtains an automatic detection result corresponding to the target exception type; sends the automatic detection result to the terminal so that the terminal displays the candidate subject and, corresponding to the candidate subject, displays the automatic detection result of the candidate subject corresponding to the target exception type; in response to a first selection operation for a candidate subject whose automatic detection result is a match, adds the candidate subject selected by the first selection operation to an exception subject group corresponding to the target exception subject, where the exception subject group is a subject group corresponding to the target exception type.

[0025] In some embodiments, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps of each of the above method embodiments.

[0026] The above-mentioned abnormal subject detection method, apparatus, computer device and storage medium, when a terminal receives an abnormal type confirmation operation for a target abnormal subject, obtains the target abnormal type confirmed by the abnormal type confirmation operation, obtains candidate subjects with interaction records with the target abnormal subject, performs abnormal detection on the candidate subjects using the abnormal detection method corresponding to the target abnormal type, obtains an automatic detection result corresponding to the target abnormal type, and sends the automatic detection result to the terminal so that the terminal displays the candidate subjects and, corresponding to the candidate subjects, displays the automatic detection result corresponding to the target abnormal type of the candidate subjects. In response to a first selection operation for a candidate subject whose automatic detection result is a match, the candidate subject selected by the first selection operation is added to the abnormal subject group corresponding to the target abnormal subject, the abnormal subject group being the subject group corresponding to the target abnormal type, thereby automatically obtaining an abnormal subject group belonging to the same abnormal type as the target abnormal subject, realizing group detection of abnormal behavior, and improving the detection efficiency of abnormal subjects. In addition, by performing abnormal detection on the candidate subjects using the abnormal detection method corresponding to the target abnormal type, automatic detection of the candidate subjects can be achieved, thereby improving the detection efficiency of abnormal subjects. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1A A diagram of an application environment of an abnormal subject detection method in some embodiments;

[0028] Figure 1B A schematic diagram of a blockchain in some embodiments;

[0029] Figure 1C A schematic diagram illustrating how blocks in a blockchain are generated in some embodiments;

[0030] Figure 1D A diagram of an application environment of an abnormal subject detection method in some embodiments;

[0031] Figure 2 Schematic diagram of a flow chart of an abnormal subject detection method in some embodiments;

[0032] Figure 3 This is an interface diagram for determining a target anomaly type in some embodiments;

[0033] Figure 4 A schematic diagram of a subject information acquisition interface in some embodiments;

[0034] Figure 5 This is an interface diagram showing the subject group reporting portal in some embodiments;

[0035] Figure 6 A schematic diagram of an exception type confirmation interface in some embodiments;

[0036] Figure 7 Schematic diagram of a flow chart of an abnormal subject detection method in some embodiments;

[0037] Figure 8 A flowchart for reporting suspicious transaction subjects in some embodiments;

[0038] Figure 9 A flowchart for reporting suspicious transaction subjects in some embodiments;

[0039] Figure 10 is a structural block diagram of an abnormal subject detection device in some embodiments;

[0040] Figure 11 is a structural block diagram of an abnormal subject detection device in some embodiments;

[0041] Figure 12 is a diagram of the internal structure of a computer device in some embodiments;

[0042] Figure 13 1 is a diagram of the internal structure of a computer device in some embodiments. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0044] The abnormal subject detection method provided in this application can be applied to Figure 1AIn the application environment shown. The application environment includes a data sharing system 100, a subject push server 102, a subject audit terminal 104, a subject detection server 106, and a subject supervision server 108. Among them, the data sharing system 100, the subject push server 102, the subject audit terminal 104, the subject detection server 106, and the subject supervision server 108 communicate through a network. The subject push server 102 can obtain interaction records corresponding to multiple subjects, and the interaction records corresponding to the subjects can be stored in the data sharing system 100. The subject push server 102 can detect the interaction records corresponding to multiple subjects, and when it is determined that there is an abnormality in the interaction record of the subject, the subject is pushed to the subject audit terminal 104. The subject audit terminal 104 can audit the subject. When it is determined that the subject reported by the subject reporting terminal 102 is an abnormal subject, the subject detection server 106 is used to determine the subject group corresponding to the abnormal subject, and the subject group corresponding to the abnormal subject is reported to the supervision server 108. Specifically, the subject audit terminal 104 can, in response to the exception type confirmation operation, display the target exception type corresponding to the target exception subject and display candidate subjects with which the target exception subject has interaction records. The subject audit terminal 104 can display a subject group detection portal corresponding to the target exception subject, receive a subject group detection operation corresponding to the target exception subject through the subject group detection portal, and, in response to the subject group detection operation, send a subject group detection request for the target exception subject on the target exception type to the subject detection server 106. In response to the subject group detection request, the subject detection server 106 can obtain candidate subjects with which the target exception subject has interaction records, obtain resource transfer-related data corresponding to the candidate subjects from the data sharing system 100, and perform anomaly detection on the candidate subjects based on the resource transfer-related data corresponding to the candidate subjects using the anomaly detection method corresponding to the target anomaly type, obtain an automatic detection result corresponding to the target anomaly type, and send the automatic detection result to the subject audit terminal 104. The subject audit terminal 104 can display the automatic detection results of the candidate subjects corresponding to the target abnormal type. In response to the first selection operation for the candidate subject whose automatic detection result is a match, the candidate subject selected by the first selection operation is added to the abnormal subject group corresponding to the target abnormal subject, and the abnormal subject group is the subject group corresponding to the target abnormal type. The subject audit terminal 104 can respond to the abnormal subject group reporting operation to report the abnormal subject group to the subject supervision server 108. The abnormal subject group includes the target abnormal subject and the candidate subject selected by the first selection operation.

[0045] See also Figure 1A The data sharing system 100 shown in FIG. 1 is a system for sharing data between nodes. The data sharing system may include multiple nodes, such as Figure 1A101a, 101b, 101c, and 101d, the multiple nodes may refer to individual clients in the data sharing system. Each node may receive input information during normal operation and maintain the shared data within the data sharing system based on the received input information. To ensure information intercommunication within the data sharing system, an information connection may exist between each node in the data sharing system, and information may be transmitted between nodes through the above information connection. For example, when any node in the data sharing system receives input information, the other nodes in the data sharing system obtain the input information according to the consensus algorithm and store the input information as data in the shared data, so that the data stored on all nodes in the data sharing system are consistent.

[0046] Each node in the data sharing system has a corresponding node identifier, and each node in the data sharing system can store the node identifiers of other nodes in the data sharing system so that the generated blocks can be broadcast to other nodes in the data sharing system based on the node identifiers of other nodes. Each node can maintain a node identifier list as shown in the table below, and store the node name and node identifier in the node identifier list accordingly. The node identifier can be an IP (Internet Protocol, a protocol for interconnecting networks) address or any other information that can be used to identify the node. Table 1 only uses the IP address as an example for explanation.

[0047] Table 1 Node identification list

[0048] Node Name Node ID Node 1 117.114.151.174 Node 2 117.116.189.145 … … Node N 119.123.789.258

[0049] Each node in the data sharing system stores the same blockchain. The blockchain consists of multiple blocks, see Figure 1B The blockchain consists of multiple blocks. The genesis block includes a block header and a block body. The block header stores the input information feature value, version number, timestamp and difficulty value, and the block body stores the input information; the next block of the genesis block uses the genesis block as the parent block, and the next block also includes a block header and a block body. The block header stores the input information feature value of the current block, the block header feature value, version number, timestamp and difficulty value of the parent block, and so on, so that the number of blocks stored in each block in the blockchain is associated with the block data stored in the parent block, ensuring the security of the input information in the block.

[0050] When generating each block in the blockchain, see Figure 1CWhen the node where the blockchain is located receives the input information, it verifies the input information. After the verification is completed, the input information is stored in the memory pool and the hash tree used to record the input information is updated. After that, the update timestamp is updated to the time when the input information is received, and different random numbers are tried to calculate the eigenvalue multiple times so that the calculated eigenvalue can satisfy the following formula (1):

[0051] SHA256(SHA256(version+prev_hash+merkle_root+ntime+nbits+x))<TARGET(1)

[0052] Among them, SHA256 is the eigenvalue algorithm used to calculate the eigenvalue; version (version number) is the version information of the relevant block protocol in the blockchain; prev_hash is the block header eigenvalue of the parent block of the current block; merkle_root is the eigenvalue of the input information; ntime is the update time of the update timestamp; nbits is the current difficulty, which is a fixed value within a period of time and is determined again after exceeding the fixed time period; x is a random number; TARGET is the eigenvalue threshold, which can be determined based on nbits.

[0053] In this way, when a random number that satisfies the above formula is calculated, the information can be stored accordingly, and the block header and block body can be generated to obtain the current block. Subsequently, the blockchain node sends the newly generated block to other nodes in the data sharing system based on the node identifiers of other nodes in the data sharing system. The other nodes verify the newly generated block and, after verification, add the newly generated block to their stored blockchain.

[0054] The terminals may be, but are not limited to, various personal computers, laptops, smart phones, tablet computers, and portable wearable devices, and the server may be implemented as an independent server or a server cluster consisting of multiple servers.

[0055] It can be understood that the above application scenario is only an example and does not constitute a limitation on the code detection method provided in the embodiment of the present application. The method provided in the embodiment of the present application can also be applied in other application scenarios. For example, the step of obtaining the automatic detection result can be performed by the subject audit terminal 104, that is, the subject audit terminal 104 can obtain a candidate subject that has an interaction record with the target abnormal subject, and perform abnormal detection on the candidate subject through the abnormal detection method corresponding to the target abnormal type to obtain an automatic detection result corresponding to the target abnormal type.

[0056] In some embodiments, as Figure 1D As shown, Figure 1DThe node 101b in the example may be a subject supervision server, and the subject audit terminal 104 may report abnormal subject groups to the node 101b, thereby ensuring the security of the reported data.

[0057] In some embodiments, as Figure 2 As shown, a method for detecting abnormal subjects is provided, which is applied to Figure 1A Taking the subject audit terminal 104 in the example as an example, the following steps are included:

[0058] S202 : In response to the exception type confirmation operation, display the target exception type corresponding to the target exception subject.

[0059] Among them, the subject can be a person or an organization, for example, it can be an enterprise. An abnormal subject refers to a subject with abnormal behavior. Abnormal events can be used to determine whether the subject has abnormal behavior. Abnormal events include but are not limited to abnormal resource transfer events, abnormal behavior events or abnormal public information events. Abnormal resource transfer events can be, for example, suspicious transactions, including but not limited to online gambling or money laundering. When the abnormal event is a suspicious transaction, the abnormal subject can also be called a suspicious transaction subject. The abnormal type refers to the type of abnormal behavior, such as online gambling. The target abnormal type refers to the abnormal type corresponding to the target abnormal subject, such as online gambling. The target abnormal subject refers to the subject whose abnormal type is to be determined. The abnormal type confirmation operation is used to confirm the abnormal type corresponding to the target abnormal subject, that is, to confirm the target abnormal type. When the abnormal event is a criminal event, such as online gambling, the abnormal type can also be called a crime-related type.

[0060] Specifically, the subject audit terminal can display an exception type confirmation interface corresponding to the target exception subject, receive an exception type confirmation operation through the exception type confirmation interface, and display the target exception type corresponding to the target exception subject in response to the exception type confirmation operation. The exception type confirmation interface can display an exception type confirmation area, and the subject audit terminal can receive the exception type confirmation operation through the exception type confirmation area.

[0061] In some embodiments, the subject audit terminal can display the push exception subject in the subject audit interface. The push exception subject can be a subject pushed by the subject push server. When the subject audit terminal obtains the push exception subject reporting operation for the push exception subject, it determines the push exception subject corresponding to the push exception subject reporting operation, obtains the target exception subject, and displays the exception type confirmation interface corresponding to the target exception subject. The push exception subject reporting is used to trigger the reporting of the push exception subject to the subject supervision server. The push exception subject reporting control corresponding to the push exception subject can be displayed in the subject audit interface. When the trigger operation of the push exception subject reporting control is obtained, it is determined that the push exception subject reporting operation is obtained.

[0062] For example, the subject review interface can be Figure 3 (a) in the figure shows the "Suspicious Transaction Subject Review" interface. The "Suspicious Transaction Subject Review" interface displays the abnormal push subjects "Zhang San", "Li Si" and "Wang Wu", and also displays the "Transaction Details" button and "Report" button corresponding to each abnormal push subject. The "Report" button is the abnormal push subject reporting control. When the subject review terminal obtains the click operation on the "Report" button corresponding to the abnormal push subject "Zhang San", it is determined that the abnormal push subject reporting operation corresponding to "Zhang San" is obtained, and the target abnormal subject is determined to be "Zhang San", and the abnormal type confirmation interface corresponding to the target abnormal subject "Zhang San" is displayed. The abnormal type confirmation interface can be, for example, Figure 3 The interface shown in (b). Figure 3 (b) in the figure shows an exception type confirmation area 302, which includes an "exception type list display button" 304. When a trigger operation is obtained for the "list display button", an exception type list 306 is displayed. When an exception type selection operation is obtained for an exception type in the exception type list, the exception type confirmation operation is confirmed, and the exception type selected by the selection operation is used as the target exception type corresponding to the target exception subject, and the target exception type corresponding to the target exception subject is displayed. The target exception type can be, for example, Figure 3 “Online gambling” shown in (c) of the figure.

[0063] In some embodiments, the subject push server can obtain a set of push subjects, perform type identification on the push subjects in the push subject set through an abnormal type identification model, determine the type identification results corresponding to each push subject, and determine the push abnormal subject based on the type identification results. The type identification result can include any one of a normal identification result or an abnormal identification result. When it is an abnormal identification result, it can also include an abnormal type. The subject push server can select each push subject whose type identification result is an abnormal identification result from the push subject set as a push abnormal subject, and push the push abnormal subject to the subject review terminal. There are multiple abnormal type identification models, and each abnormal type identification model can be used to detect different abnormal types respectively. For example, abnormal type identification model 1 is used to identify abnormal type a, and abnormal type identification model 2 is used to identify abnormal type b. The subject push server can obtain multiple subjects from the data sharing system to obtain a push subject set.

[0064] S204 , displaying candidate subjects that have interaction records with the target abnormal subject, and corresponding to the candidate subjects, displaying automatic detection results of the candidate subjects corresponding to the target abnormal type.

[0065] There can be multiple candidate entities. Candidate entities can be selected from a set of interacting entities. For example, all interacting entities in the set can be selected as candidates. Alternatively, multiple interacting entities can be selected from the set according to preset entity selection rules to obtain multiple candidate entities. The set of interacting entities can include multiple interacting entities. An interacting entity refers to an entity that has interaction records with the target abnormal entity, such as an entity that has resource transfer records with the target abnormal entity. Preset entity selection rules include, but are not limited to, selecting interacting entities whose interaction records are within a preset time period and selecting interacting entities whose number of interactions exceeds a threshold. The preset time period can be pre-set as needed, for example, a time period whose interval with the current time is less than a preset interval. The preset time interval can be, for example, 24 hours. The interaction threshold can be set as needed or pre-set, for example, 10 times. When the interaction record is a resource transfer record, the interacting entity can also be referred to as a counterparty.

[0066] The automatic detection result of the candidate subject corresponding to the target anomaly type can be used to represent the matching relationship between the predicted type corresponding to the candidate subject and the target anomaly type. It can be any of the following: the predicted type matches the target anomaly type, that is, the predicted type is consistent with the target anomaly type, or the predicted type does not match the target anomaly type, that is, the predicted type is inconsistent with the target anomaly type. The predicted type refers to the result of detecting the candidate subject using the anomaly detection method corresponding to the target anomaly type. The predicted type can be either the target anomaly type or the non-target anomaly type. When the predicted type is the target anomaly type, it can be determined that the predicted type matches the target anomaly type. When the predicted type is the non-target anomaly type, it can be determined that the predicted type does not match the target anomaly type. The automatic detection result of the candidate subject corresponding to the target anomaly type can also be used to represent the probability that the candidate subject is a subject of the target anomaly type. For example, the probability that the candidate subject is a subject of the target anomaly type can be calculated using the anomaly detection method corresponding to the target anomaly type as the automatic detection result of the candidate subject corresponding to the target anomaly type. The anomaly detection method corresponding to the target anomaly type refers to the detection method used to detect whether the subject is of the target anomaly type, or the probability that the subject is of the target anomaly type. Through the anomaly detection method corresponding to the target anomaly type, it can be determined whether the subject is of the target anomaly type, and the probability that the subject is of the target anomaly type can also be determined.

[0067] Specifically, when the subject review terminal receives a subject group detection operation, it can respond to the subject group detection operation, obtain candidate subjects that have interaction records with the target abnormal subject, and the automatic detection results corresponding to the candidate subjects, and display the candidate subjects and the automatic detection results accordingly. A subject group refers to a group composed of multiple subjects, which can also be called a multi-subject. When the group subjects in the subject group are persons involved in crimes, the subject group can also be called a gang, and subject group detection can also be called multi-subject detection. The subject group detection operation refers to an operation for triggering subject group detection of candidate subjects, which can be triggered through a subject group detection entrance. For example, the subject review terminal can display the subject group detection entrance corresponding to the target abnormal subject in the abnormal type confirmation interface, and when the trigger operation on the subject group detection entrance is obtained, it is confirmed that the subject group detection operation has been obtained.

[0068] In some embodiments, the subject audit terminal can respond to the subject group detection operation, display the interactive subject set corresponding to the target abnormal subject in the interactive subject display interface, obtain the selection operation of the interactive subject in the displayed interactive subject set through the interactive subject display interface, use the interactive subject selected by the selection operation as the candidate subject, obtain the automatic detection result corresponding to the candidate subject, and display the automatic detection result of the candidate subject corresponding to the target abnormal type corresponding to the candidate subject. When displaying the automatic detection result, the automatic detection result can be displayed in the interactive subject display interface, or the candidate subject and the automatic detection result can be displayed in an independent interface. Among them, the interactive subject display interface can display a detection result acquisition control. When a trigger operation is obtained for the detection result acquisition control, the subject audit terminal can obtain the automatic detection result corresponding to the candidate subject and display the automatic detection result in the interactive subject display interface, or when a trigger operation is obtained for the detection result acquisition control, display the detection result display interface, and display the candidate subject and the automatic detection result on the detection result display interface.

[0069] For example, the subject group detection entrance can be Figure 3 In (c), the "Confirm" control 308 in FIG. 3 is displayed. When the subject audit terminal obtains the click operation on the "Confirm" control 308, the interactive subject display interface 310 can be displayed, and the interactive subject set 312 can be displayed in the interactive subject display interface 310. The interactive subject set 312 includes 5 interactive subjects, namely "Zhang XX", "Wang XX", "Yang XX", "Zhou XX" and "Chen XX". The interactive subject display interface 310 also displays the payment account corresponding to each interactive subject. The detection result acquisition control can be, for example, Figure 3 The "Confirm" control 314 in (d) is displayed when a click operation on the "Confirm" control 314 is obtained. Figure 3In the detection result display interface 316 in (e), "hit" and "miss" in the detection result display interface 316 correspond to the automatic detection results. "Hit" indicates that the abnormality type of the candidate subject is the target abnormality type, and "miss" indicates that the abnormality type of the candidate subject is different from the target abnormality type, or the candidate subject is a normal subject.

[0070] In some embodiments, when a trigger operation for a control to obtain detection results is obtained, the subject audit terminal may send a type detection request to the subject detection server, and the type detection request may carry a candidate subject identifier and a target exception type. The candidate subject identifier refers to the subject identifier corresponding to the candidate subject. The subject identifier is used to uniquely identify the subject, including but not limited to the subject's mobile phone number or ID number. The subject detection server may extract the target exception type in the type detection request, select the exception detection method corresponding to the target exception type from the exception detection method set, perform type detection on the candidate subject using the exception detection method, obtain the automatic detection result corresponding to the candidate subject, and return the automatic detection result to the subject audit terminal. The subject audit terminal may display the automatic detection result returned by the subject detection server in the detection result display interface. Among them, the exception detection method set may include exception detection methods corresponding to different exception types.

[0071] S206 , in response to a first selection operation on a candidate subject whose automatic detection result is a match, adding the candidate subject selected by the first selection operation to an abnormal subject group corresponding to the target abnormal subject, where the abnormal subject group is a subject group corresponding to the target abnormal type.

[0072] The "subject group" refers to a group consisting of multiple subjects, where "multiple" refers to at least two subjects, especially when the subjects in the subject group are individuals suspected of committing a crime. The "abnormal subject group" refers to the subject group to which the target abnormal subject belongs. The abnormal type corresponding to each subject in the abnormal subject group is the target abnormal type. The abnormal subject group includes the target abnormal subject and the candidate subjects selected by the first selection operation. The first selection operation refers to the selection of candidate subjects that are automatically detected as matching.

[0073] The automatic detection result is a match, which means that the abnormal type corresponding to the candidate subject matches the target abnormal type, or the probability that the candidate subject is the target abnormal type is greater than the probability threshold. The probability threshold can be set as needed, for example, it can be 0.9. When the probability that the candidate subject is the target abnormal type is greater than the probability threshold, it can be determined that the abnormal type corresponding to the candidate subject matches the target abnormal type. Figure 3 As shown, “hit” in the detection result display interface 316 indicates that the automatic detection result is a match, and “miss” indicates that the automatic detection result is a mismatch.

[0074] Specifically, the subject audit terminal can obtain a first selection operation for a candidate subject whose automatic detection result is a match through the detection result display interface, and use the candidate subject selected by the first selection operation as a group subject in the abnormal subject group. For example, when the subject audit terminal obtains a selection operation for the candidate subject "Zhang XX" corresponding to the "hit" in the detection result display interface 316, the candidate subject "Zhang XX" is used as a group subject in the abnormal subject group.

[0075] In some embodiments, the subject review terminal responds to the first selection operation for the candidate subject whose automatic detection result is a match, and displays the candidate subject selected by the first selection operation in the candidate subject information adding interface. The subject information corresponding to the candidate subject can be obtained through the candidate subject information adding interface, such as the account information or identity information of the candidate subject. The candidate subject information adding interface can display a subject information adding control corresponding to the candidate subject. When the subject information adding control is obtained, the subject information obtaining interface can be displayed, and the subject information input by the user can be obtained through the subject information obtaining interface to obtain the subject information corresponding to the candidate subject. Among them, the subject adding control corresponding to the candidate subject can be displayed in the detection result display interface. When the subject review terminal obtains the triggering operation of the subject adding control, it is determined that the first selection operation is obtained. For example, if Figure 4 As shown, the detection result display interface 400 displays a subject adding control 402, i.e., an "add" control, corresponding to the candidate subject. When the subject review terminal receives a click operation on the subject adding control 402, the candidate subject "Zhang XX" can be displayed in the candidate subject information adding interface 404. When the subject review terminal receives a click operation on the subject information adding control 406, the subject information obtaining interface 408 can be displayed, and the subject information of the candidate subject "Zhang XX", such as the ID number, can be obtained through the subject information obtaining interface 408.

[0076] In some embodiments, a subject group reporting portal may be displayed in the candidate subject information adding interface. When a trigger operation is obtained for the subject group reporting portal, the subject group reporting interface is displayed, such as Figure 5 As shown, the candidate subject information addition interface displays a subject group reporting entry 502, namely a "Report" control. When the subject review terminal receives a click on the "Report" control, a subject group reporting interface 504 may be displayed. The subject review terminal may display each group subject in the abnormal subject group in the subject group reporting interface, and may access an abnormal subject group reporting operation through the subject group reporting interface. In response to the abnormal subject group reporting operation, the abnormal subject group is reported. The abnormal subject group reporting operation is used to trigger the reporting of the abnormal subject group.

[0077] In some embodiments, the subject audit terminal can report the abnormal subject group to the subject supervision server. For example, it can generate subject group reporting information corresponding to the abnormal subject group and send the subject group reporting information to the subject supervision server. The subject group reporting information can include the subject identification of each group subject in the abnormal subject group. The group subject refers to the subject in the abnormal subject group. The subject group reporting information can also include at least one of the group role corresponding to the group subject or the group subject acquisition method. The group role refers to the role of the group subject in the abnormal subject group. The group role can reflect the group subject's influence within the abnormal subject group and can include group roles of varying degrees of influence. For example, it can include primary and secondary roles, with the primary role having greater influence than the secondary role. The primary role can be, for example, an organizer, and the secondary role can be, for example, a participant. When the group subject in the abnormal subject group is a person involved in a crime and the corresponding group role is a primary role, it indicates that the group subject played a major role in the criminal activities of the abnormal subject group. The group subject acquisition method refers to the method of acquiring the group subject. Subject acquisition methods can be divided into active acquisition methods and passive acquisition methods based on the method of determining the abnormality type corresponding to the group subject. The active acquisition method refers to a method of confirming the exception type through an exception type confirmation operation, and the passive acquisition method refers to a method of confirming the exception type through automatic detection results.

[0078] In the above-mentioned abnormal subject detection method, in response to the abnormal type confirmation operation, the target abnormal type corresponding to the target abnormal subject is displayed, the candidate subjects with interaction records with the target abnormal type are displayed, and the automatic detection results of the candidate subjects corresponding to the target abnormal type are displayed corresponding to the candidate subjects. In response to the first selection operation for the candidate subject whose automatic detection result is a match, the candidate subject selected by the first selection operation is added to the abnormal subject group corresponding to the target abnormal subject. The abnormal subject group is the subject group corresponding to the target abnormal type, thereby automatically obtaining the abnormal subject group belonging to the same abnormal type as the target abnormal subject, realizing group detection of abnormal behavior, and improving the detection efficiency of abnormal subjects.

[0079] In some embodiments, the method further includes: displaying a group subject in the abnormal subject group and a subject information adding area corresponding to the group subject; and acquiring subject information corresponding to the group subject through the subject information adding area.

[0080] The subject information addition area is used to add subject information. Subject information refers to information related to the group subject, including but not limited to the group role, the method for obtaining the group subject, the group subject's identity information, or the group subject's account information. The group subject's account information may include a bank account number, and the group subject's identity information may include but is not limited to the subject's name, phone number, or ID number. The subject information addition area includes but is not limited to a group role selection control, an identity information addition control, or an account information addition control. The method for obtaining the group subject may be automatically displayed in the subject information addition area.

[0081] Specifically, the subject audit terminal can display each group subject in the abnormal subject group and the subject information adding area in the subject group reporting interface, obtain the content edited by the user through the subject information adding area, and obtain the subject information corresponding to the group subject. Figure 5 As shown, three group entities are displayed: "Zhang XX," "Li XX," and "Huang XX." The entity information adding area includes a group role adding area 506 and a group entity acquisition method adding area 508. Group role adding area 506 includes a group role selection control 510. When the entity review terminal receives a selection operation on group role selection control 510, the group role corresponding to the group entity can be determined. Among them, "System Push Personnel" and "Add Suspicious Personnel" in the group entity acquisition method adding area 508 refer to the group entity acquisition methods corresponding to the group entity. "System Push Personnel" is an active acquisition method, and "Add Suspicious Personnel" is a passive acquisition method.

[0082] In this embodiment, the group subject in the abnormal subject group and the subject information adding area corresponding to the group subject are displayed, and the subject information corresponding to the group subject is obtained through the subject information adding area, which provides convenience for users to add subject information and improves user experience.

[0083] In some embodiments, the subject information adding area includes a group role selection control, and obtaining the subject information corresponding to the group subject through the subject information adding area includes: receiving the group role selection operation corresponding to the group subject through the group role selection control; in response to the group role selection operation, using the target group role selected by the group role selection operation as the role of the group subject in the abnormal subject group.

[0084] The target group character refers to the group character selected by the group character selection operation. The group character selection control refers to the control used to trigger the group character selection operation. The group character selection operation can be, for example, a mouse operation on the group character selection control, including but not limited to a click operation, a double-click operation, or a slide operation. Of course, the group character selection operation can also be a manual operation on the group character selection control, such as a finger touch operation on the group character selection control.

[0085] Specifically, the subject audit terminal can receive a group role selection operation corresponding to a group subject through a group role selection control. In response to the group role selection operation, the target group role selected by the group role selection operation is used as the role of the group subject in the abnormal subject group. For example, when the subject audit terminal receives a click operation on the group role selection control 510, "Participant" is used as the role of the group subject "Zhang XX" in the abnormal subject group.

[0086] In some embodiments, the subject review terminal can display the reporting selection controls and non-reporting selection controls corresponding to each group subject in the subject group reporting interface. When a selection operation of the reporting selection control for the group subject is obtained, the reporting of the group subject is confirmed. When a selection operation of the non-reporting selection control for the group subject is obtained, the reporting of the group subject is refused.

[0087] In this embodiment, a group role selection operation corresponding to a group subject is received through a group role selection control. In response to the group role selection operation, the target group role selected by the group role selection operation is used as the role of the group subject in the abnormal subject group. Since the group role can reflect the degree of influence of the group subject in the subject group, the group role corresponding to each group subject in the abnormal subject group is determined, and the degree of influence of each group subject in the abnormal subject group can be determined, which provides a data basis for the subject supervision server to process the group subject in the abnormal subject group, so that the subject supervision server can process the group subject according to the group role.

[0088] In some embodiments, the method further includes: reporting an abnormal subject group in response to an abnormal subject group reporting operation, where the abnormal subject group includes the target abnormal subject and the candidate subject selected by the first selection operation.

[0089] The abnormal subject group reporting operation is used to trigger the reporting of the abnormal subject group. Reporting the abnormal subject group refers to sending the abnormal subject group to a device of a subject supervision department, such as a subject supervision server.

[0090] Specifically, a subject group reporting control can be displayed in the subject group reporting interface. The subject audit terminal can receive abnormal subject group reporting operations through the subject group reporting control, and can report the abnormal subject group to the subject supervision server in response to the abnormal subject group reporting operation. For example, the subject audit terminal can obtain a group subject whose group role is a preset group role from the abnormal subject group, obtain the target group subject, and report the target group subject. The preset group role can be set as needed, for example, it can be a main role. The subject group reporting control can be, for example, Figure 5 The "Confirm" control 512 in.

[0091] In some embodiments, the subject audit terminal can, in response to an abnormal subject group reporting operation, obtain subject information corresponding to each group subject in the abnormal subject group, generate an abnormal subject group reporting message based on the subject information corresponding to each group subject in the abnormal subject group, and send the abnormal subject group reporting message to the subject supervision server to implement the abnormal subject group reporting. When the interaction record includes a resource transfer record, the abnormal subject group reporting message can also be referred to as a suspicious transaction message.

[0092] In some embodiments, the abnormal subject group reporting message carries verification data. The verification data can be determined based on at least one of the number of group subjects or the group subject number. For example, the number of group subjects can be used as verification data, or the group subject number corresponding to each group subject can be used as verification data. The number of group subjects refers to the number of group subjects included in the abnormal subject group. The group subject number refers to the coding of each group subject in the abnormal subject group. The subject audit terminal can also generate information to be coded based on at least one of the number of group subjects or the group subject number, encode the generated information to be coded using a preset coding method, and use the coded data as verification information. The number of group subjects can also be called the number of suspicious subjects, and the group subject number can also be called the suspicious subject number. In the abnormal subject group reporting message, the verification data can be represented by two fields, one field represents the number of suspicious subjects, for example, it can be represented by "SCTN", and one field represents the suspicious subject number, for example, it can be represented by "CTIFs". When the number of group subjects is 3, the verification data can include <sctn> 3< / sctn> 、<CTIF seqno="1"> 、<CTIF seqno="2> as well as<CTIF seqno="3"> . The group subject number can be a consecutive number, and different group subjects have different corresponding group subject numbers. For example, when the number of group subjects is 3, the group subject numbers can be 1, 2 and 3 respectively, so as to avoid group subject counting errors or repeated counting, and ensure the accuracy of the verification data. In this embodiment, in response to the abnormal subject group reporting operation, the abnormal subject group is reported, and the abnormal subject group includes the target abnormal subject and the candidate subject selected by the first selection operation. Since the abnormal types corresponding to the candidate subject and the target abnormal subject are both the target abnormal type, and there is an interaction record between the candidate subject and the target abnormal subject, it is more likely that the candidate subject and the target abnormal subject belong to the same group. Therefore, reporting the abnormal subject group can be realized in a group manner, and the efficiency of abnormal subject reporting can be improved.

[0093] In some embodiments, displaying candidate subjects having interaction records with the target abnormal subject, and displaying automatic detection results of the candidate subjects corresponding to the target abnormal type corresponding to the candidate subjects include: displaying a subject group detection entrance corresponding to the target abnormal subject; receiving a subject group detection operation corresponding to the target abnormal subject through the subject group detection entrance; in response to the subject group detection operation, displaying candidate subjects having interaction records with the target abnormal subject, and displaying automatic detection results of the candidate subjects corresponding to the target abnormal type corresponding to the candidate subjects.

[0094] Specifically, the subject group detection entry is used to trigger the subject group detection operation, for example, it can be a subject group reporting method selection control, which is used to select the subject group reporting method for reporting the subject. The subject group reporting method selection control can be displayed in the abnormality type confirmation interface, such as Figure 6 As shown, an exception type confirmation interface 600 is displayed. The exception type confirmation interface 600 displays a subject group reporting method selection control 602, i.e., a "multi-subject reporting" control, and a single subject reporting method selection control 604, i.e., a "single subject reporting" control. The subject group reporting method selection control can also be displayed in the reporting method acquisition interface. For example, the exception type confirmation interface can display a reporting method acquisition interface entry. When the subject review terminal receives a trigger operation on the reporting method acquisition interface entry, the reporting method acquisition interface can be displayed, and the subject group reporting method selection control can be displayed in the reporting method acquisition interface.

[0095] In some embodiments, when a trigger operation on the subject group detection entrance is obtained, the subject audit terminal can determine that a subject group detection operation corresponding to the target abnormal subject is obtained, and display an interactive subject display interface in response to the subject group detection operation. Figure 6 As shown, when the subject audit terminal obtains the trigger operation of the subject group reporting method selection control 602, it displays Figure 6 The interactive subject display interface in (b).

[0096] In this embodiment, a subject group detection entrance corresponding to the target abnormal subject is displayed, and a subject group detection operation corresponding to the target abnormal subject is received through the subject group detection entrance. In response to the subject group detection operation, candidate subjects with interaction records with the target abnormal subject are displayed, and corresponding to the candidate subjects, the automatic detection results of the candidate subjects corresponding to the target abnormal type are displayed, so that users can intuitively obtain the automatic detection results, thereby improving the user experience.

[0097] In some embodiments, in response to a subject group detection operation, displaying candidate subjects that have interaction records with a target abnormal subject, and corresponding to the candidate subjects, displaying the automatic detection result that the candidate subjects correspond to the target abnormal type includes: in response to the subject group detection operation, displaying a set of interactive subjects that have interaction records with the target abnormal subject; in response to a second selection operation for a subject in the interactive subject set, displaying the candidate subject selected by the second selection operation, and corresponding to the candidate subject, displaying the automatic detection result that the candidate subject corresponds to the target abnormal type.

[0098] Specifically, the second selection operation refers to a selection operation of an interactive subject in the interactive subject set. The subject audit terminal may use the interactive subject selected by the second selection operation as a candidate subject. In response to the subject group detection operation, the subject audit terminal may obtain the interactive subject set corresponding to the target abnormal subject and display the interactive subject set in the interactive subject display interface.

[0099] In some embodiments, the subject audit terminal can respond to the subject group detection operation by sending an interactive subject acquisition request to the subject storage device. The interactive subject acquisition request can carry the target subject identifier of the target abnormal subject, and the target subject identifier is the subject identifier of the target abnormal subject. The subject storage device can obtain the interactive subject set corresponding to the target abnormal subject based on the target subject identifier and return the interactive subject set to the subject audit terminal. The subject audit terminal can display the interactive subject set in the interactive subject display interface. The subject storage device refers to a device where the subject is stored, such as a subject push server or a data sharing system, and of course, it can also be a subject audit terminal.

[0100] In this embodiment, the automatic detection result corresponding to the interactive subject selected by the second selection operation is displayed, and can be flexibly displayed according to the user's selection, thereby improving the flexibility of displaying the automatic detection result.

[0101] In some embodiments, in response to a subject group detection operation, displaying candidate subjects that have interaction records with a target abnormal subject, and displaying automatic detection results of the candidate subjects corresponding to a target abnormal type corresponding to the candidate subjects include: in response to the subject group detection operation, sending a subject group detection request for the target abnormal subject on a target abnormal type to a server, so that the server obtains candidate subjects that have interaction records with the target abnormal subject in response to the subject group detection request, performs abnormality detection on the candidate subjects through an abnormality detection method corresponding to the target abnormal type, and obtains automatic detection results corresponding to the target abnormal type; receiving the automatic detection results returned by the server, displaying the candidate subjects, and displaying automatic detection results of the candidate subjects corresponding to the target abnormal type corresponding to the candidate subjects.

[0102] The subject group detection request may carry a candidate subject identifier and a target anomaly type. The server may be any server capable of performing anomaly detection on the candidate subject using an anomaly detection method corresponding to the target anomaly type, such as a subject detection server.

[0103] Specifically, the subject audit terminal can respond to the subject group detection operation, generate a subject group detection request based on the target anomaly type and the candidate subject identifier, and send the subject group detection request to the subject detection server. The subject detection server can obtain the corresponding candidate subject's interaction record based on the candidate subject identifier, such as a resource transfer record. The resource transfer record may include resource transfer-related data. Based on the interaction record, the candidate subject is detected using the anomaly detection method corresponding to the target anomaly type. For example, the resource transfer-related data can be processed using the anomaly detection method to obtain the automatic detection result of the candidate subject. The candidate interaction record refers to the interaction record related to the candidate subject, for example, it can be the resource transfer record corresponding to the candidate subject. The resource transfer record may include resource transfer-related data.

[0104] In some embodiments, the target anomaly type is a resource transfer anomaly type, such as online gambling. The anomaly detection method corresponding to the target anomaly type corresponds to a target data weight set, which can include multiple data weights. The automatic detection result corresponding to the candidate entity can be obtained by weighting the resource transfer-related data of the candidate entity using the data weights in the target data weight set.

[0105] In this embodiment, in response to the subject group detection operation, a subject group detection request for the target abnormal subject on the target abnormal type is sent to the server, so that the server responds to the subject group detection request, obtains a candidate subject that has an interaction record with the target abnormal subject, performs abnormality detection on the candidate subject through the abnormality detection method corresponding to the target abnormal type, obtains an automatic detection result corresponding to the target abnormal type, receives the automatic detection result returned by the server, displays the candidate subject, and displays the automatic detection result of the candidate subject corresponding to the target abnormal type, which can be automatically detected through the server and the abnormality detection method, thereby improving the detection efficiency.

[0106] In some embodiments, the automatic detection result is a resource transfer anomaly detection result, the candidate subject is a subject that has a resource transfer record with the target abnormal subject, and the candidate subject that has an interaction record with the target abnormal subject is displayed, and the automatic detection result corresponding to the candidate subject and the target abnormal type is displayed, including: displaying the candidate subject that has an interaction record with the target abnormal subject, and the automatic detection result corresponding to the candidate subject, displaying the candidate subject and the target abnormal type, and displaying a viewing entrance for the resource transfer record set corresponding to the automatic detection result; in response to a trigger operation on the viewing entrance, displaying the resource transfer record set.

[0107] The resource transfer anomaly detection result refers to the detection result of an anomaly in the candidate entity's resource transfer. When the target anomaly type is a resource transfer anomaly, such as online gambling, the resource transfer anomaly detection result is online gambling. The resource transfer record set viewing entry is used to point to the resource transfer record set. The resource transfer record set can include multiple resource transfer records. The resource transfer record can include resource transfer-related data, including but not limited to the resource transfer account, resource transferee, resource transferor, resource transfer time, or resource transfer amount.

[0108] Specifically, the subject audit terminal can display the candidate subject, the automatic detection result corresponding to the candidate subject, and the viewing entry of the resource transfer record set corresponding to the candidate subject in the detection result display interface. When the subject audit terminal obtains the trigger operation for the viewing entry, the resource transfer record set corresponding to the candidate subject can be displayed. The viewing entry of the resource transfer record set can be, for example Figure 3 318 in the View Transaction control.

[0109] In this embodiment, candidate subjects that have interaction records with the target abnormal subject are displayed, and corresponding to the candidate subjects, the automatic detection results of the candidate subjects and the target abnormal type are displayed, and the viewing entrance of the resource transfer record set corresponding to the automatic detection result is displayed. In response to the triggering operation of the viewing entrance, the resource transfer record set is displayed, which enables the user to view the resource transfer record while obtaining the automatic detection result, so that the user can further manually review the automatic detection result according to the resource transfer record, ensure the correctness of the abnormal type of the candidate subject, and improve the accuracy of the detection.

[0110] In some embodiments, in response to an exception type confirmation operation, displaying a target exception type corresponding to a target exception subject includes: confirming the target exception subject in response to the exception subject confirmation operation; displaying an exception type selection control corresponding to the target exception subject, and displaying the target exception type corresponding to the target exception subject in response to the exception type confirmation operation received through the exception type selection control.

[0111] Specifically, the abnormal subject confirmation operation is used to confirm the target abnormal subject. The abnormal subject confirmation operation can be, for example, Figure 3 Click the "Report" control in the interface of (a). The exception type selection control is used to select the exception type corresponding to the target exception subject. The exception type selection control can be, for example, Figure 3 The "Please select the crime type" control 302 in the interface of (b). The abnormal type confirmation operation is used to confirm the abnormal type corresponding to the target abnormal subject, that is, to confirm the target abnormal type. The abnormal type confirmation operation can be, for example, Figure 3 The selection operation of "Online Gambling" in the interface of (b).

[0112] In this embodiment, in response to the exception subject confirmation operation, the target exception subject is confirmed, and the exception type selection control corresponding to the target exception subject is displayed. In response to the exception type confirmation operation received through the exception type selection control, the target exception type corresponding to the target exception subject is displayed.

[0113] In some embodiments, as Figure 7 As shown, a method for detecting abnormal subjects is provided, which is applied to Figure 1A Taking the subject detection server 106 in FIG. 1 as an example, the following steps are included:

[0114] S702: When the terminal receives an exception type confirmation operation for a target exception subject, it obtains the target exception type confirmed by the exception type confirmation operation.

[0115] S704: Acquire candidate subjects that have interaction records with the target abnormal subject, perform abnormality detection on the candidate subjects using an abnormality detection method corresponding to the target abnormality type, and obtain an automatic detection result corresponding to the target abnormality type.

[0116] S706, sending the automatic detection result to the terminal so that the terminal displays the candidate subject and, corresponding to the candidate subject, displays the automatic detection result of the candidate subject corresponding to the target abnormal type. In response to the first selection operation for the candidate subject whose automatic detection result is a match, the candidate subject selected by the first selection operation is added to the abnormal subject group corresponding to the target abnormal subject, and the abnormal subject group is the subject group corresponding to the target abnormal type.

[0117] In the above-mentioned abnormal subject detection method, when the terminal receives an abnormal type confirmation operation for the target abnormal subject, the target abnormal type confirmed by the abnormal type confirmation operation is obtained, a candidate subject with an interaction record with the target abnormal subject is obtained, an abnormality detection is performed on the candidate subject using the abnormality detection method corresponding to the target abnormal type, an automatic detection result corresponding to the target abnormal type is obtained, and the automatic detection result is sent to the terminal so that the terminal displays the candidate subject and, corresponding to the candidate subject, the automatic detection result corresponding to the target abnormal type of the candidate subject is displayed. In response to a first selection operation for a candidate subject whose automatic detection result is a match, the candidate subject selected by the first selection operation is added to the abnormal subject group corresponding to the target abnormal subject, the abnormal subject group being the subject group corresponding to the target abnormal type, thereby automatically obtaining an abnormal subject group belonging to the same abnormal type as the target abnormal subject, thereby realizing group detection of abnormal behavior and improving the detection efficiency of abnormal subjects. In addition, by performing abnormality detection on the candidate subject using the abnormality detection method corresponding to the target abnormal type, automatic detection of the candidate subject can be achieved, thereby improving the detection efficiency of abnormal subjects.

[0118] In some embodiments, the automatic detection result is a resource transfer anomaly detection result, and a candidate subject that has an interaction record with the target abnormal subject is obtained. The candidate subject is subjected to anomaly detection by the anomaly detection method corresponding to the target anomaly type to obtain the automatic detection result corresponding to the target anomaly type, including: obtaining a candidate subject that has a resource transfer record with the target abnormal subject, and obtaining resource transfer-related data corresponding to the candidate subject; obtaining an anomaly detection score corresponding to the resource transfer-related data and a target data weight set corresponding to the target anomaly type; weighting the anomaly detection score with the corresponding data weight in the target data weight set to obtain an anomaly detection comprehensive score; and obtaining the automatic detection result of the candidate subject corresponding to the target anomaly type based on the anomaly detection comprehensive score.

[0119] The resource transfer-related data may include multiple types, such as at least one of a resource transfer rate for a preset amount, a resource transfer rate for a preset transfer method, a resource transfer rate for a preset time period, or a resource transfer amount ratio for a preset time period. The server may count the number of resource transfers by the candidate entity with a preset amount during a historical time period, obtain the number of transfers for the preset amount, and calculate the ratio of the number of transfers for the preset amount to the total number of transfers to obtain the resource transfer rate for the preset amount. The total number of transfers refers to the total number of resource transfers by the candidate entity during the historical time period. The historical time period may be set as needed. The server may count the number of resource transfers by the candidate entity with a preset transfer method during a historical time period, obtain the number of transfers for the preset method, and calculate the ratio of the number of transfers for the preset method to the total number of transfers to obtain the resource transfer rate for the preset transfer method. The server may count the number of resource transfers by the candidate entity during a preset time period during a historical time period, obtain the number of transfers for the preset time period, and calculate the ratio of the number of transfers for the preset time period to the total number of transfers to obtain the resource transfer rate for the preset time period. The server can calculate the ratio of the resource transfer amount during a preset period to the total transfer amount for each candidate entity within a historical time period to obtain the resource transfer amount percentage for the preset period. The total transfer amount refers to the total amount of resource transfers by the candidate entity during the historical time period. The resource transfer rate for the preset amount can be, for example, the "percentage of round-ten amounts to the total number of transactions" in Table 1. The resource transfer rate for the preset transfer method can be, for example, the "percentage of transactions using a certain transfer method to the total number of transactions" in Table 1.

[0120] The target data weight set can include data weights corresponding to various resource transfer-related data. Data weights refer to the weights corresponding to resource transfer-related data. The data weights corresponding to different resource transfer-related data can be the same or different. The target data weight set can be calculated using the resource transfer-related information of the subject with the target anomaly type. The data weights corresponding to the resource transfer rate for the preset amount and the resource transfer rate for the preset transfer method can be, for example, A1 and A2 in Table 1, respectively.

[0121] Various resource transfer-related data may each be assigned an anomaly detection score. The anomaly detection score is determined based on the resource transfer-related data. When the resource transfer-related data is the resource transfer rate for a preset amount, the resource transfer rate for a preset transfer method, the resource transfer rate for a preset time period, or the percentage of resource transfer amounts for a preset time period, the anomaly detection score may be positively correlated with the resource transfer-related data. For example, the anomaly detection score may be determined based on the magnitude relationship between the resource transfer-related data and a resource transfer-related data threshold. When the resource transfer-related data is greater than the resource transfer-related data threshold, the anomaly detection score is determined to be a first anomaly score. Conversely, the anomaly detection score is determined to be a second anomaly score, with the first anomaly score being greater than the second anomaly score. The resource transfer-related data threshold is calculated based on the resource transfer-related data of the subject corresponding to the target anomaly type. For example, when the resource transfer-related data is the resource transfer rate of a preset amount, multiple subjects of the target anomaly type reported during a historical time period can be obtained, and the payment accounts corresponding to each of these subjects can be obtained. The percentage of transactions of the preset amount in each payment account relative to the total number of transactions can be calculated. For example, the percentage of transactions of the ten-digit amount in each payment account relative to the total number of transactions can be calculated to obtain the resource transfer-related data threshold corresponding to the resource transfer rate of the preset amount. When the resource transfer-related data is the resource transfer rate of a preset time period, the percentage of transactions of the preset time period in each payment account relative to the total number of transactions can be calculated to obtain the resource transfer-related data threshold corresponding to the resource transfer rate of the preset time period. The anomaly detection scores corresponding to the resource transfer rate of the preset amount and the resource transfer rate of the preset transfer method can be, for example, B1 and B2 in Table 1, respectively, and the corresponding resource transfer-related data thresholds can be, for example, A% and B% in Table 1, respectively.

[0122] A positive correlation means that, with other conditions remaining unchanged, the two variables change in the same direction. When one variable changes from large to small, the other also changes from large to small. It's understandable that a positive correlation here means the direction of change is consistent, but it doesn't require that when one variable changes slightly, the other also changes. For example, you could set variable b to 100 when variable a is between 10 and 20, and 120 when variable a is between 20 and 30. In this way, both a and b change in the same direction: when a increases, b also increases. However, when a is between 10 and 20, b can remain unchanged.

[0123] Specifically, the server can calculate the anomaly detection score and data weight corresponding to the resource transfer-related data, calculate the product of the anomaly detection score and the data weight, and obtain a first score corresponding to the resource transfer-related data. Based on the first scores corresponding to each piece of resource transfer-related data, a comprehensive anomaly detection score can be obtained. The first scores corresponding to the resource transfer rate of the preset amount and the resource transfer rate of the preset transfer method can be, for example, C1 and C2 in Table 1, respectively, where C1 = A1 * B1 and C2 = A2 * B2. The server can perform statistical operations on each first score to obtain a first dimension score, and obtain a comprehensive anomaly detection score based on the first dimension score. For example, the first dimension score can be used as the comprehensive anomaly detection score. The statistical operation includes, but is not limited to, a weighted operation or a mean operation. The server can compare the comprehensive anomaly detection score with a comprehensive score threshold. When the comprehensive anomaly detection score is greater than the comprehensive score threshold, the server determines that the automatic detection result matches the target anomaly type. When the comprehensive anomaly detection score is less than the comprehensive score threshold, the server determines that the automatic detection result does not match the target anomaly type. The comprehensive score threshold can be pre-set or calculated based on the comprehensive anomaly detection scores of reported subjects corresponding to the target anomaly type. For example, multiple reported subjects with the target anomaly type can be obtained, and the statistical value of the comprehensive anomaly detection scores of each reported subject can be calculated to serve as the comprehensive score threshold. The statistical value can be, for example, a mean. The probability that a candidate subject's anomaly type is the target anomaly type is positively correlated with the comprehensive anomaly detection score. That is, the higher the comprehensive anomaly detection score, the greater the probability that the candidate subject's anomaly type is the target anomaly type.

[0124] In some embodiments, the target data weight set may include data weights corresponding to data related to the interacting subject, and the data related to the interacting subject may include at least one of a gender ratio, a number of regional categories, or a total number of interacting subjects. The server may obtain each subject that has a resource transfer record with the candidate subject, obtain a set of candidate interacting subjects corresponding to the candidate subject, count the number of interacting subjects of the first gender in the set of candidate interacting subjects to obtain the first gender number, and the number of interacting subjects of the second gender to obtain the second gender number, and calculate the ratio of the first gender number to the second gender number to obtain the gender ratio. The first gender and the second gender may be determined as needed, for example, the first gender is male and the second gender is female. The server may count the categories of the regions to which the interacting subjects in the set of candidate interacting subjects belong to obtain the number of regional categories. The server may count the number of interacting subjects in the set of candidate interacting subjects to obtain the total number of interacting subjects. The gender ratio may be, for example, the "male-female ratio of counterparties" in Table 1, and the number of regional categories may be, for example, the "place of residence of counterparties" in Table 1. Various interactive subject-related data may correspond to first detection scores, respectively. The data weights corresponding to the gender ratio and the number of regional categories may be, for example, D1 and D2 in Table 1, respectively. The first detection scores corresponding to the gender ratio and the number of regional categories may be, for example, E1 and E2 in Table 1, respectively. The first detection score is determined based on the interactive subject-related data. When the interactive subject-related data is the gender ratio, the number of regional categories, or the total number of interactive subjects, the first detection score may be positively correlated with the interactive subject-related data. For example, the anomaly detection score may be determined based on the relationship between the interactive subject-related data and the interactive subject-related data threshold. When the interactive subject-related data is greater than the interactive subject-related data threshold, the first detection score is determined to be the third anomaly score. Otherwise, the anomaly detection score is determined to be the fourth anomaly score, and the third anomaly score is greater than the fourth anomaly score. The interaction subject related data threshold can be calculated based on the interaction subject related data of the interaction subject corresponding to the subject of the reported target abnormal type. For example, when the interaction subject related data is the gender ratio, the payment account numbers of multiple subjects of the reported target abnormal type in the historical time period can be obtained, and the ratio of the number of male subjects to the number of female subjects in the transaction subjects corresponding to each payment account can be calculated. The average value of each ratio is calculated to obtain the interaction subject related data threshold corresponding to the gender ratio. The interaction subject related data thresholds corresponding to the gender ratio and the number of regional categories can be, for example, E% and I in Table 1, respectively.

[0125] In some embodiments, the server can obtain a first detection score corresponding to the interactive subject-related data, calculate the product of the first detection score and the corresponding data weight, and obtain a second score corresponding to the interactive subject-related data. Based on the second scores corresponding to each interactive subject-related data, a second dimension score can be obtained. For example, a statistical operation can be performed on each second score to obtain the second dimension score. The second scores corresponding to the gender ratio and the number of regional categories can be, for example, K1 and K2 in Table 1, respectively, where K1 = D1 * E1 and K2 = D2 * E2. The server can obtain a comprehensive anomaly detection score based on the first dimension score and the second dimension score. For example, a weighted calculation can be performed on the first dimension score and the second dimension score to obtain the comprehensive anomaly detection score.

[0126] In some embodiments, the target data weight set may include data weights corresponding to public information-related data. The public information-related data may include at least one of first-category public information-related data or second-category public information-related data. The first-category public information-related data refers to the public information of a candidate entity. The second-category public information-related data refers to the public information of entities with which the candidate entity has a resource transfer record. The public information-related data may be associated with a second detection score. The second detection score is determined based on the public information-related data. When preset sensitive terms are present in the public information-related data, the second detection score is the first information score; when the preset sensitive terms are absent, the second detection score is the second information score; the first information score is greater than the second information score. Preset sensitive terms refer to terms that indicate anomalies in a subject's resource transfer and may also be referred to as risk terms. The first information score being greater than the second information score may be predetermined as needed. The server may obtain the second detection score corresponding to the public information-related data, calculate the product of the second detection score and the corresponding data weight, and obtain a third score corresponding to the public information-related data. Based on the third scores corresponding to the respective public information-related data, for example, a statistical operation may be performed on each third score to obtain a third dimension score. The first category of public information related data can be, for example, the "subject public information hit risk vocabulary" in Table 1, the first category of public information related data can be, for example, the "counterparty public information hit risk vocabulary" in Table 1, the first category of public information related data and the data weights corresponding to the first category of public information related data can be, for example, F1 and F2 in Table 1 respectively, the first category of public information related data and the second detection scores corresponding to the first category of public information related data can be, for example, G1 and G2 in Table 1 respectively, the first category of public information related data and the third scores corresponding to the first category of public information related data can be, for example, H1 and H2 in Table 1 respectively, where H1=F1*G1, H2=F2*G2.

[0127] In some embodiments, the server can calculate based on the first dimension score, the second dimension score and the third dimension score to obtain an anomaly detection comprehensive score. For example, the first dimension score, the second dimension score and the third dimension score can be weighted to obtain an anomaly detection comprehensive score. For example, the calculation formula of the anomaly detection comprehensive score can be formula (2): R = (C1+C2+…)*W1+(K1+K2+…)*W2+(H1+H2+…)*W3 = (A1*B1+A2*B2+…)*W1+(D1*E1+D2*E2+…)*W2+(F1*G1+F2*G2+…)*W3 (2). Wherein, R is the anomaly detection comprehensive score, which can also be called the total risk score. The total score of each risk sub-item in each dimension is 100 points, that is, B1+B2+…+Bn=100, K1+K2+…+Kn=100, G1+G2+…+Gn=100, and n is greater than or equal to 1. The total risk score (R) is the sum of the scores for each risk sub-item. Each dimension sub-item score is calculated by multiplying the weight by the risk score. W1, W2, and W3 represent the weights corresponding to the first, second, and third dimension scores, respectively.

[0128] Table 1: Risk dimensions and risk sub-items of a certain crime type

[0129]

[0130] In some embodiments, the data weights An, Dn, and Fn can be obtained by linear regression, for example, using the formula (3) A=(X T *X) -1 *X T *Y(3) is calculated. Where A is a matrix formed by the data weights An, Dn, and Fn. X is a matrix formed by multiple sets of real data, B1, B2…Bn, E1, E2…En, and G1, G2…Gn. Y is a matrix formed by the total risk score R.

[0131] In this embodiment, a candidate subject having a resource transfer record with the target abnormal subject is obtained, resource transfer related data corresponding to the candidate subject is obtained, the abnormality detection score corresponding to the resource transfer related data and the data weight set corresponding to the target abnormality type are obtained, and the abnormality detection score is weighted with the corresponding data weight in the data weight set to obtain a comprehensive abnormality detection score. According to the comprehensive abnormality detection score, an automatic detection result of the candidate subject corresponding to the target abnormality type is obtained, which realizes the use of resource transfer related data to determine the automatic detection result. Since the resource transfer related data can reflect the resource transfer situation of the candidate subject, the detection accuracy is improved.

[0132] In some embodiments, the step of obtaining a target data weight set includes: obtaining a standard comprehensive score corresponding to a training anomaly subject and training resource transfer-related data corresponding to the training anomaly subject; obtaining a training anomaly detection score corresponding to the training resource transfer-related data; obtaining a current data weight set; weighting the training anomaly detection score with the corresponding data weight in the current data weight set to obtain a training detection comprehensive score; updating the weights in the current data weight set according to the difference between the training detection comprehensive score and the standard comprehensive score, and returning to the step of weighting the training anomaly detection score with the corresponding data weight in the current data weight set to obtain a training detection comprehensive score, until the difference between the training detection comprehensive score and the standard comprehensive score is less than a score threshold or the number of returns reaches a number threshold, and the current data weight set is used as the target data weight set.

[0133] The training anomaly subject refers to the anomaly subject used to determine the data weight set. The anomaly type corresponding to the training anomaly subject is the target anomaly type. The standard comprehensive score refers to the actual comprehensive score of the training anomaly subject. The standard comprehensive score can be pre-set as needed. The training resource transfer-related data refers to the resource transfer-related data of the training anomaly subject. The training anomaly detection score refers to the anomaly detection score corresponding to the training resource transfer-related data. The current data weight set refers to the data weight set at the current moment. The training detection comprehensive score is calculated by weighting the training anomaly detection score with the corresponding data weight in the current data weight set.

[0134] Specifically, the server can multiply the training anomaly detection score with the corresponding data weight in the current data weight set to obtain the first training scores corresponding to each training resource transfer-related data, and sum up each training first score to obtain a comprehensive training detection score.

[0135] In some embodiments, the server can calculate the difference between the training detection comprehensive score and the standard comprehensive score to obtain a comprehensive difference value, adjust the current data weight set in the direction of reducing the comprehensive difference value, obtain the current data weight set for the next round, calculate the comprehensive difference value corresponding to the abnormal subject of training in the next round, and adjust the current data weight set in the direction of reducing the comprehensive difference value, and repeat until the comprehensive difference value is less than the score threshold or the number of repetitions reaches the number threshold. The score threshold can be pre-set as needed. The number threshold can be pre-set as needed. The server can use the current data weight set corresponding to the time when the comprehensive difference value is less than the score threshold or the number of repetitions reaches the number threshold as the target data weight set.

[0136] In some embodiments, when the target data weight set corresponding to the anomaly detection method is determined, the server can use the anomaly detection method to detect the verification subjects of the verification number, obtain the verification detection results corresponding to each verification subject, obtain the true anomaly type corresponding to each verification subject, count the number of verification detection results that are consistent with the corresponding true anomaly type in each verification detection result, obtain the correct number, calculate the ratio of the correct number to the verification number, and obtain the accuracy of the anomaly detection method. The quantity ratio is positively correlated with the accuracy of the anomaly detection method. For example, the number j of suspicious persons hit by the model can be recorded, and the number of suspicious persons actually added after manual analysis is k. The closer the value of k / j=m is to 1, the higher the model accuracy. If it is too low, the dimension, indicator or corresponding threshold can be re-determined or adjusted.

[0137] In this embodiment, the weights in the current data weight set are updated multiple times based on the difference between the training test comprehensive score and the standard comprehensive score, so that the training test comprehensive score calculated based on the current data weight set continuously approaches the standard comprehensive score, thereby improving the accuracy of the data weight set.

[0138] The abnormal subject detection method provided in this application can be applied to the suspicious transaction subject reporting process, which can be, for example, a multi-subject suspicious transaction reporting process for anti-money laundering, such as Figure 8 As shown, the reporting process for suspicious transaction entities consists of four steps: task push, task analysis, task review, and message submission. In the task review step, a module is embedded to capture suspicious individuals and add suspicious entities using big data. For example, this module uses anomaly detection to detect transaction counterparties and identify suspicious counterparties. Suspicious individuals captured by big data are manually reviewed, such as those detected through anomaly detection. Suspicious individuals meeting reporting criteria are screened, basic information about the counterparties to be added is imported, and newly added suspicious counterparties are generated. These suspicious counterparties are then added to the group and reported together. When a single entity is identified as being involved in a specific crime, its counterparties are run through a machine model. Finally, counterparties that match the model undergo manual review and analysis. If the counterparty is determined to be involved in the same type of crime as the single entity, the counterparty is added as a suspicious individual. Running the machine model refers to detecting the counterparty through anomaly detection. A hit on the model refers to the fact that the anomaly detection method detects that the counterparty and the single entity are involved in the same type of crime. When adding a suspicious counterparty, you can generate a case by referring to the channel for supplementary case recording. The generated case and the fields required for the message also meet the reporting requirements. Figure 8 In the original suspicious transaction subject reporting process, in the task review link, add the function of capturing suspicious persons with big data and adding other gang members that meet the reporting crime type, so as to realize multi-subject reporting. Figure 9 As shown, Figure 8 The machine model for counterparties in the transaction can be executed in the background. Specifically, when a single entity is identified as suspicious and needs to be reported, the counterparty is run against the corresponding crime model as the reporting entity. Big data is used to identify suspicious individuals suspected of committing similar crimes. Finally, manual analysis is performed to identify those suspected of committing the same crimes as the principal. When adding a suspicious counterparty, the basic information fields retrieved are consistent with those of the reporting entity.

[0139] In the above-mentioned multi-subject reporting process of suspicious transactions, the application of the abnormal subject detection method provided in this application can optimize the multi-subject reporting process of suspicious transactions, increase the reporting of risk groups involved in the same type of crimes, broaden the coverage of risk groups, improve the scope of risk coverage, and accurately discover multi-subject gangs to improve the quality of reporting. Based on actual transaction analysis, suspicious transaction counterparties that meet the multi-subject reporting conditions are added to the reporting subjects. Multi-subject reporting refers to the reporting of multiple suspicious subjects in a gang manner in anti-money laundering suspicious transactions, where the reporting subjects involve the same type of crime.

[0140] In some embodiments, a method for detecting abnormal subjects is provided, comprising the following steps:

[0141] 1. In response to the abnormal subject confirmation operation, confirm the target abnormal subject.

[0142] 2. Display an exception type selection control corresponding to the target exception subject, and in response to an exception type confirmation operation received through the exception type selection control, display a target exception type corresponding to the target exception subject.

[0143] 3. Display the subject group detection entrance corresponding to the target abnormal subject; receive the subject group detection operation corresponding to the target abnormal subject through the subject group detection entrance.

[0144] 4. In response to the subject group detection operation, display the set of interactive subjects that have interaction records with the target abnormal subject; in response to the second selection operation for the subject in the interactive subject set, display the candidate subject selected by the second selection operation; receive the automatic detection results returned by the server, display the candidate subject, and corresponding to the candidate subject, display the automatic detection results of the candidate subject corresponding to the target abnormal type.

[0145] Specifically, the terminal can respond to the subject group detection operation and send a subject group detection request for the target abnormal subject on the target abnormal type to the server. The server can respond to the subject group detection request, obtain candidate subjects that have interaction records with the target abnormal subject, and perform abnormality detection on the candidate subjects through the abnormality detection method corresponding to the target abnormal type to obtain an automatic detection result corresponding to the target abnormal type; and send the automatic detection result to the terminal.

[0146] 5. Display the viewing entrance of the resource transfer record set corresponding to the automatic detection result, and display the resource transfer record set in response to the triggering operation of the viewing entrance.

[0147] 6. Display the group subject in the abnormal subject group and the subject information adding area corresponding to the group subject; the subject information adding area includes a group role selection control.

[0148] 7. Receive a group role selection operation corresponding to the group subject through the group role selection control; in response to the group role selection operation, use the target group role selected by the group role selection operation as the role of the group subject in the abnormal subject group.

[0149] 8. In response to the abnormal subject group reporting operation, report the abnormal subject group, where the abnormal subject group includes the target abnormal subject and the candidate subjects selected by the first selection operation.

[0150] It should be understood that although Figure 2-9 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. In addition, Figure 2-9 At least part of the steps may include multiple steps or multiple stages. These steps or stages are not necessarily performed at the same time, but can be performed at different times. The order of execution of these steps or stages is not necessarily one by one, but can be performed in turn or alternately with other steps or at least part of the steps or stages in other steps.

[0151] In some embodiments, as Figure 10 As shown, an abnormal subject detection device is provided. The device can be a software module or a hardware module, or a combination of the two to form a part of a computer device. The device specifically includes: a target abnormality type display module 1002, an automatic detection result display module 1004 and a candidate subject addition module 1006, wherein:

[0152] The target exception type display module 1002 is configured to display the target exception type corresponding to the target exception subject in response to the exception type confirmation operation.

[0153] The automatic detection result display module 1004 is used to display candidate subjects that have interaction records with the target abnormal subject, and display the automatic detection results of the candidate subjects corresponding to the target abnormal type corresponding to the candidate subjects.

[0154] The candidate subject adding module 1006 is configured to, in response to a first selection operation on a candidate subject whose automatic detection result is a match, add the candidate subject selected by the first selection operation to an abnormal subject group corresponding to the target abnormal subject, where the abnormal subject group is a subject group corresponding to the target abnormal type.

[0155] In some embodiments, the apparatus further comprises:

[0156] The subject information adding area display module is used to display the group subject in the abnormal subject group and the subject information adding area corresponding to the group subject.

[0157] The subject information acquisition module is used to obtain the subject information corresponding to the group subject through the subject information adding area.

[0158] In some embodiments, the subject information adding area includes a group role selection control, and the subject information acquisition module includes:

[0159] The group role selection operation receiving unit is used to receive the group role selection operation corresponding to the group subject through the group role selection control.

[0160] The group role selection operation response unit is configured to respond to the group role selection operation and use the target group role selected by the group role selection operation as the role of the group subject in the abnormal subject group.

[0161] In some embodiments, the apparatus is further configured to report an abnormal subject group in response to an abnormal subject group reporting operation, where the abnormal subject group includes a target abnormal subject and a candidate subject selected by the first selection operation.

[0162] In some embodiments, the automatic detection result display module 1004 includes:

[0163] The subject group detection entrance display unit is used to display the subject group detection entrance corresponding to the target abnormal subject.

[0164] The subject group detection operation receiving unit is used to receive the subject group detection operation corresponding to the target abnormal subject through the subject group detection entrance.

[0165] The automatic detection result display unit is used to display candidate subjects that have interaction records with the target abnormal subject in response to the subject group detection operation, and display the automatic detection results of the candidate subjects corresponding to the target abnormal type corresponding to the candidate subjects.

[0166] In some embodiments, the automatic detection result display unit is also used to display a set of interactive subjects that have interaction records with the target abnormal subject in response to a subject group detection operation; in response to a second selection operation on a subject in the interactive subject set, display the candidate subject selected by the second selection operation, and corresponding to the candidate subject, display the automatic detection result of the candidate subject corresponding to the target abnormal type.

[0167] In some embodiments, the automatic detection result display unit is also used to respond to the subject group detection operation and send a subject group detection request for the target abnormal subject on the target abnormal type to the server, so that the server responds to the subject group detection request, obtains a candidate subject that has an interaction record with the target abnormal subject, performs abnormality detection on the candidate subject through the abnormality detection method corresponding to the target abnormal type, and obtains an automatic detection result corresponding to the target abnormal type; receives the automatic detection result returned by the server, displays the candidate subject, and displays the automatic detection result of the candidate subject corresponding to the target abnormal type corresponding to the candidate subject.

[0168] In some embodiments, the automatic detection result is a resource transfer anomaly detection result, and the candidate subject is a subject that has a resource transfer record with the target anomaly subject. The automatic detection result display module 1004 includes:

[0169] The viewing entry display unit is used to display candidate subjects that have interaction records with the target abnormal subject, and corresponding to the candidate subject, display the automatic detection results of the candidate subject and the target abnormal type, and display the viewing entry of the resource transfer record set corresponding to the automatic detection result.

[0170] The resource transfer record set display unit is used to respond to the trigger operation of the viewing entrance and display the resource transfer record set.

[0171] In some embodiments, the target exception type display module 1002 includes:

[0172] The target abnormal subject confirmation unit is used to confirm the target abnormal subject in response to the abnormal subject confirmation operation.

[0173] The target exception type display unit is used to display the exception type selection control corresponding to the target exception subject, and in response to the exception type confirmation operation received through the exception type selection control, display the target exception type corresponding to the target exception subject.

[0174] In some embodiments, as Figure 11As shown, an abnormal subject detection device is provided. The device can be a software module or a hardware module, or a combination of the two to form a part of a computer device. The device specifically includes: a target abnormality type acquisition module 1102, an automatic detection result acquisition module 1104 and an automatic detection result sending module 1106, wherein:

[0175] The target exception type acquisition module 1102 is configured to acquire the target exception type confirmed by the exception type confirmation operation when the terminal receives an exception type confirmation operation for a target exception subject.

[0176] The automatic detection result obtaining module 1104 is used to obtain candidate subjects that have interaction records with the target abnormal subject, perform abnormality detection on the candidate subjects using the abnormality detection method corresponding to the target abnormality type, and obtain an automatic detection result corresponding to the target abnormality type.

[0177] The automatic detection result sending module 1106 is used to send the automatic detection result to the terminal so that the terminal displays the candidate subject and, corresponding to the candidate subject, displays the automatic detection result of the candidate subject corresponding to the target abnormal type. In response to the first selection operation for the candidate subject whose automatic detection result is a match, the candidate subject selected by the first selection operation is added to the abnormal subject group corresponding to the target abnormal subject, and the abnormal subject group is the subject group corresponding to the target abnormal type.

[0178] In some embodiments, the automatic detection result is a resource transfer anomaly detection result, and a candidate subject having an interaction record with a target abnormal subject is obtained. The automatic detection result obtaining module 1104 includes:

[0179] The resource transfer related data acquisition unit is used to acquire candidate subjects that have resource transfer records with the target abnormal subject and acquire resource transfer related data corresponding to the candidate subjects.

[0180] The anomaly detection score acquisition unit is used to obtain the anomaly detection score corresponding to the resource transfer related data and the target data weight set corresponding to the target anomaly type.

[0181] The anomaly detection comprehensive score obtaining unit is used to obtain the anomaly detection comprehensive score by weighting the anomaly detection score with the corresponding data weight in the target data weight set.

[0182] The automatic detection result obtaining unit is used to obtain the automatic detection result of the candidate subject corresponding to the target anomaly type according to the anomaly detection comprehensive score.

[0183] In some embodiments, the target data weight set obtaining module includes:

[0184] The training resource transfer related data acquisition unit is used to obtain the standard comprehensive score corresponding to the training abnormal subject and the training resource transfer related data corresponding to the training abnormal subject.

[0185] The training anomaly detection score acquisition unit is used to obtain the training anomaly detection score corresponding to the training resource transfer related data.

[0186] The current data weight set acquisition unit is used to acquire the current data weight set.

[0187] The training detection comprehensive score obtaining unit is used to obtain the training detection comprehensive score by weighting the training anomaly detection score with the corresponding data weight in the current data weight set.

[0188] The weight updating unit is used to update the weights in the current data weight set according to the difference between the training detection comprehensive score and the standard comprehensive score, and return the step of weighting the training anomaly detection score with the corresponding data weight in the current data weight set to obtain the training detection comprehensive score, until the difference between the training detection comprehensive score and the standard comprehensive score is less than the score threshold or the number of returns reaches the number threshold, and the current data weight set is used as the target data weight set.

[0189] For the specific definition of the abnormal subject detection device, please refer to the definition of the abnormal subject detection method above and will not be repeated here. The various modules in the above-mentioned abnormal subject detection device can be implemented in whole or in part through software, hardware, or a combination thereof. The above-mentioned modules can be embedded in or independent of the processor of the computer device in hardware form, or can be stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each of the above modules.

[0190] In some embodiments, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 12As shown. The computer device includes a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, an abnormal subject detection method is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad provided on the computer device housing, or an external keyboard, touchpad or mouse.

[0191] In some embodiments, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 13 As shown. The computer device includes a processor, a memory, and a network interface connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store data involved in the abnormal subject detection method. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, it implements an abnormal subject detection method.

[0192] Those skilled in the art will understand that Figure 12 and 13 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0193] In some embodiments, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0194] In some embodiments, a computer-readable storage medium is provided, storing a computer program, which implements the steps in the above-mentioned method embodiments when executed by a processor.

[0195] In some embodiments, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps of each of the above method embodiments.

[0196] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0197] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0198] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art could make various modifications and improvements without departing from the spirit of the present application, all of which fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. A method for detecting abnormal subjects, characterized in that: The method comprises: Displaying a push exception subject identified by the exception type identification model, and determining the push exception subject as a target exception subject in response to a reporting operation on the push exception subject; In response to the exception type confirmation operation, displaying a target exception type corresponding to the target exception subject; Display candidate subjects that have interaction records with the target abnormal subject, and corresponding to the candidate subjects, display the automatic detection results obtained by performing abnormality detection on the candidate subjects using the abnormality detection method corresponding to the target abnormality type; In response to a first selection operation on a candidate subject whose automatic detection result is a match, the candidate subject selected by the first selection operation is added to an abnormal subject group corresponding to the target abnormal subject, where the abnormal subject group is a subject group corresponding to the target abnormal type.

2. The method according to claim 1, characterized in that The method further comprises: Displaying the group subject in the abnormal subject group and the subject information adding area corresponding to the group subject; The subject information corresponding to the group subject is obtained through the subject information adding area.

3. The method according to claim 2, characterized in that The subject information adding area includes a group role selection control, and obtaining the subject information corresponding to the group subject through the subject information adding area includes: Receiving a group role selection operation corresponding to the group subject through the group role selection control; In response to the group role selection operation, the target group role selected by the group role selection operation is used as the role of the group subject in the abnormal subject group.

4. The method according to claim 1, wherein The method further comprises: In response to an abnormal subject group reporting operation, the abnormal subject group is reported, where the abnormal subject group includes the target abnormal subject and the candidate subjects selected by the first selection operation.

5. The method according to claim 1, wherein The displaying of candidate subjects having interaction records with the target abnormal subject, and corresponding to the candidate subjects, displaying the automatic detection results of the candidate subjects corresponding to the target abnormal type include: Display the subject group detection entrance corresponding to the target abnormal subject; Receiving a subject group detection operation corresponding to the target abnormal subject through the subject group detection entrance; In response to the subject group detection operation, candidate subjects having interaction records with the target abnormal subject are displayed, and corresponding to the candidate subjects, automatic detection results obtained by performing abnormality detection on the candidate subjects using the abnormality detection method corresponding to the target abnormality type are displayed.

6. The method according to claim 5, characterized in that In response to the subject group detection operation, displaying candidate subjects having interaction records with the target abnormal subject, and displaying, corresponding to the candidate subjects, automatic detection results obtained by performing abnormality detection on the candidate subjects using the abnormality detection method corresponding to the target abnormality type, include: In response to the subject group detection operation, displaying a set of interacting subjects that have interaction records with the target abnormal subject; In response to a second selection operation on a subject in the set of interactive subjects, the candidate subject selected by the second selection operation is displayed, and corresponding to the candidate subject, an automatic detection result obtained by performing anomaly detection on the candidate subject using an anomaly detection method corresponding to the target anomaly type is displayed.

7. The method according to claim 5, characterized in that In response to the subject group detection operation, displaying candidate subjects having interaction records with the target abnormal subject, and displaying, corresponding to the candidate subjects, automatic detection results obtained by performing abnormality detection on the candidate subjects using the abnormality detection method corresponding to the target abnormality type, include: In response to the subject group detection operation, sending a subject group detection request for the target abnormal subject on the target abnormal type to a server, so that the server obtains candidate subjects having interaction records with the target abnormal subject in response to the subject group detection request, performs abnormality detection on the candidate subjects using an abnormality detection method corresponding to the target abnormal type, and obtains an automatic detection result corresponding to the target abnormal type; Receive the automatic detection result returned by the server, display the candidate subject, and, corresponding to the candidate subject, display the automatic detection result obtained by performing anomaly detection on the candidate subject using the anomaly detection method corresponding to the target anomaly type.

8. The method according to claim 1, characterized in that The automatic detection result is a resource transfer anomaly detection result, the candidate subject is a subject that has a resource transfer record with the target anomaly subject, and the candidate subject that has an interaction record with the target anomaly subject is displayed, and the automatic detection result obtained by performing anomaly detection on the candidate subject using the anomaly detection method corresponding to the target anomaly type is displayed for the candidate subject includes: Display candidate entities that have interaction records with the target abnormal entity, and corresponding to the candidate entities, display the automatic detection results of the candidate entities and the target abnormal type, and display the viewing entrance of the resource transfer record set corresponding to the automatic detection results; In response to a triggering operation on the viewing portal, the resource transfer record set is displayed.

9. The method according to claim 1, characterized in that In response to the exception type confirmation operation, displaying the target exception type corresponding to the target exception subject includes: An exception type selection control corresponding to the target exception subject is displayed, and in response to an exception type confirmation operation received through the exception type selection control, a target exception type corresponding to the target exception subject is displayed.

10. A method for detecting abnormal subjects, characterized in that: The method comprises: Sending the push exception subject obtained by the exception type identification model to the terminal, and after the terminal obtains the reporting operation of the push exception subject, determining the push exception subject as the target exception subject; When the terminal receives an exception type confirmation operation for a target exception subject, obtaining the target exception type confirmed by the exception type confirmation operation; Acquire candidate subjects that have interaction records with the target abnormal subject, perform abnormality detection on the candidate subjects using an abnormality detection method corresponding to the target abnormality type, and obtain an automatic detection result corresponding to the target abnormality type; The automatic detection result is sent to the terminal so that the terminal displays the candidate subject and, corresponding to the candidate subject, displays the automatic detection result obtained by performing anomaly detection on the candidate subject through the anomaly detection method corresponding to the target anomaly type; in response to a first selection operation for a candidate subject whose automatic detection result is a match, the candidate subject selected by the first selection operation is added to the anomaly subject group corresponding to the target anomaly subject, and the anomaly subject group is the subject group corresponding to the target anomaly type.

11. The method according to claim 10, characterized in that The automatic detection result is a resource transfer anomaly detection result. The step of obtaining a candidate subject having an interaction record with the target anomaly subject and performing anomaly detection on the candidate subject using an anomaly detection method corresponding to the target anomaly type, and obtaining an automatic detection result corresponding to the target anomaly type includes: Acquire a candidate subject that has a resource transfer record with the target abnormal subject, and acquire resource transfer related data corresponding to the candidate subject; Obtaining anomaly detection scores corresponding to the resource transfer related data and a target data weight set corresponding to the target anomaly type; Obtaining a comprehensive anomaly detection score by weighting the anomaly detection score with the corresponding data weight in the target data weight set; An automatic detection result obtained by performing anomaly detection on the candidate subject using an anomaly detection method corresponding to the target anomaly type is obtained according to the anomaly detection comprehensive score.

12. An abnormal subject detection device, characterized in that: The device comprises: A module for displaying a push exception subject identified by an exception type identification model, and determining the push exception subject as a target exception subject in response to a reporting operation on the push exception subject; A target exception type display module is used to display a target exception type corresponding to a target exception subject in response to an exception type confirmation operation; An automatic detection result display module is used to display candidate subjects that have interaction records with the target abnormal subject, and corresponding to the candidate subjects, display the automatic detection results obtained by performing abnormality detection on the candidate subjects using the abnormality detection method corresponding to the target abnormality type; The candidate subject adding module is used to respond to a first selection operation on a candidate subject whose automatic detection result is a match, and add the candidate subject selected by the first selection operation to the abnormal subject group corresponding to the target abnormal subject, and the abnormal subject group is the subject group corresponding to the target abnormal type.

13. The abnormal subject detection device according to claim 12, characterized in that: The device further comprises: A subject information adding area display module is used to display the group subjects in the abnormal subject group and the subject information adding area corresponding to the group subjects; The subject information acquisition module is used to acquire the subject information corresponding to the group subject through the subject information adding area.

14. The abnormal subject detection device according to claim 13, characterized in that: The subject information adding area includes a group role selection control, and the subject information acquisition module includes: A group role selection operation receiving unit, configured to receive a group role selection operation corresponding to the group subject through the group role selection control; The group role selection operation response unit is configured to respond to the group role selection operation and use the target group role selected by the group role selection operation as the role of the group subject in the abnormal subject group.

15. The abnormal subject detection device according to claim 12, characterized in that: The device is further configured to report the abnormal subject group in response to an abnormal subject group reporting operation, where the abnormal subject group includes the target abnormal subject and the candidate subject selected by the first selection operation.

16. The abnormal subject detection device according to claim 12, characterized in that: The automatic detection result display module includes: A subject group detection entry display unit, used to display the subject group detection entry corresponding to the target abnormal subject; a subject group detection operation receiving unit, configured to receive a subject group detection operation corresponding to the target abnormal subject through the subject group detection entrance; An automatic detection result display unit is used to display candidate subjects that have interaction records with the target abnormal subject in response to the subject group detection operation, and corresponding to the candidate subject, display the automatic detection result obtained by performing abnormality detection on the candidate subject through the abnormality detection method corresponding to the target abnormality type.

17. The abnormal subject detection device according to claim 16, characterized in that: The automatic detection result display unit is also used to display a set of interactive subjects that have interaction records with the target abnormal subject in response to the subject group detection operation; in response to a second selection operation on a subject in the interactive subject set, display the candidate subject selected by the second selection operation, and corresponding to the candidate subject, display the automatic detection result obtained by performing anomaly detection on the candidate subject through the anomaly detection method corresponding to the target anomaly type.

18. The abnormal subject detection device according to claim 16, characterized in that: The automatic detection result display unit is further used to respond to the subject group detection operation and send a subject group detection request for the target abnormal subject on the target abnormal type to the server, so that the server responds to the subject group detection request, obtains a candidate subject that has an interaction record with the target abnormal subject, performs abnormality detection on the candidate subject through the abnormality detection method corresponding to the target abnormal type, and obtains an automatic detection result corresponding to the target abnormal type; receives the automatic detection result returned by the server, displays the candidate subject, and displays the automatic detection result obtained by performing abnormality detection on the candidate subject through the abnormality detection method corresponding to the target abnormal type, corresponding to the candidate subject.

19. The abnormal subject detection device according to claim 12, characterized in that: The automatic detection result is a resource transfer anomaly detection result, the candidate subject is a subject that has a resource transfer record with the target abnormal subject, and the automatic detection result display module includes: A viewing entry display unit is used to display candidate subjects that have interaction records with the target abnormal subject, and corresponding to the candidate subjects, display the automatic detection results of the candidate subjects and the target abnormal type, and display the viewing entry of the resource transfer record set corresponding to the automatic detection result; The resource transfer record set display unit is used to display the resource transfer record set in response to a triggering operation on the viewing entrance.

20. The abnormal subject detection device according to claim 12, characterized in that: The target exception type display module is further configured to display an exception type selection control corresponding to the target exception subject, and in response to an exception type confirmation operation received through the exception type selection control, display a target exception type corresponding to the target exception subject.

21. An abnormal subject detection device, characterized in that: The device comprises: A module for sending a push exception subject obtained by identifying the exception type identification model to a terminal, and determining the push exception subject as a target exception subject after the terminal obtains a reporting operation on the push exception subject; A target exception type acquisition module is configured to, when the terminal receives an exception type confirmation operation for a target exception subject, acquire the target exception type confirmed by the exception type confirmation operation; An automatic detection result obtaining module is used to obtain candidate subjects that have interaction records with the target abnormal subject, perform abnormality detection on the candidate subjects using the abnormality detection method corresponding to the target abnormality type, and obtain an automatic detection result corresponding to the target abnormality type; An automatic detection result sending module is used to send the automatic detection result to the terminal so that the terminal displays the candidate subject and, corresponding to the candidate subject, displays the automatic detection result obtained by performing abnormal detection on the candidate subject through the abnormal detection method corresponding to the target abnormal type. In response to a first selection operation for a candidate subject whose automatic detection result is a match, the candidate subject selected by the first selection operation is added to the abnormal subject group corresponding to the target abnormal subject, and the abnormal subject group is the subject group corresponding to the target abnormal type.

22. The abnormal subject detection device according to claim 21, characterized in that: The automatic detection result is a resource transfer anomaly detection result, and the candidate subject having interaction records with the target abnormal subject is obtained. The automatic detection result obtaining module includes: a resource transfer related data acquisition unit, configured to acquire a candidate subject having a resource transfer record with the target abnormal subject, and acquire resource transfer related data corresponding to the candidate subject; an anomaly detection score acquisition unit, configured to acquire an anomaly detection score corresponding to the resource transfer related data and a target data weight set corresponding to the target anomaly type; an anomaly detection comprehensive score obtaining unit, configured to obtain an anomaly detection comprehensive score by weighting the anomaly detection score with the corresponding data weight in the target data weight set; The automatic detection result obtaining unit is used to obtain, according to the anomaly detection comprehensive score, an automatic detection result obtained by performing anomaly detection on the candidate subject using an anomaly detection method corresponding to the target anomaly type.

23. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 9 or 10 to 11 are implemented.

24. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 or 10 to 11 are implemented.

25. A computer program product comprising computer instructions, characterized in that When the computer instructions are executed by a processor, the method of any one of claims 1 to 9 or 10 to 11 is implemented.

Images