A method and device for monitoring abnormal behavior in prepaid transaction scenarios

Abstract

The present application provides a method and device for monitoring abnormal behavior in a prepaid transaction scenario, which relates to the field of big data and can be used in the financial field. The method includes: obtaining real transaction data of a regulated account for a set period of time; predicting the predicted transaction data of the set period of time using a pre-constructed abnormal behavior monitoring model based on historical transaction data of a set period; and monitoring the regulated account for abnormal behavior based on a pre-set abnormal behavior threshold, the predicted transaction data, and the real transaction data. The present application can monitor the abnormal behavior of a regulated account based on the real transaction data of the regulated account by constructing an abnormal behavior monitoring model.

Description

Technical Field

[0001] The present application relates to the fields of big data and artificial intelligence and can be used in the financial field. Specifically, it is a method and device for monitoring abnormal behavior in a prepaid transaction scenario. Background Art

[0002] At present, the country implements full-chain and comprehensive supervision on the operation and capital flow of prepaid transaction scenarios, so as to avoid or reduce operational risks and financial risks as much as possible, and manually control a series of predetermined processes such as project establishment, application for fund transfer, execution of fund transfer, and consumer payment.

[0003] The existing traditional regulatory methods are relatively rigid in rules and procedures, which makes it easy for participants in the process to see through the regulatory methods, thereby exploiting system loopholes to falsify information and data, circumventing normal regulatory procedures, and achieving a series of purposes that are not allowed under supervision, such as fund withdrawal, early transfer, and arbitrary transfer.

[0004] Problems like these cannot be discovered in advance due to the limitations of existing regulatory processes and regulatory system functions, and the risks brought about by non-compliant business operations cannot be identified in a timely manner. Although these problems can also be handled through post-audit accountability, the timeliness is too poor and many have become established facts. Therefore, more advanced means are needed to control business risks and financial risks during the process to avoid abnormal business behavior. Summary of the invention

[0005] In response to the problems in the prior art, the present application provides a method and device for monitoring abnormal behavior in a prepaid transaction scenario, which can monitor the abnormal behavior of a regulated account based on the real transaction data of the regulated account by constructing an abnormal behavior monitoring model.

[0006] In order to solve the above technical problems, this application provides the following technical solutions:

[0007] In a first aspect, the present application provides a method for monitoring abnormal behavior in a prepaid transaction scenario, comprising:

[0008] Obtain the real transaction data of the regulated account during the set period;

[0009] Based on the historical transaction data of a set period, a pre-built abnormal behavior monitoring model is used to predict the predicted transaction data of the set period;

[0010] The regulated account is monitored for abnormal behavior based on a preset abnormal behavior threshold, the predicted transaction data, and the actual transaction data.

[0011] Furthermore, the step of pre-building an abnormal behavior monitoring model includes:

[0012] An abnormal behavior monitoring model is constructed based on the basic account information of the regulated account and the historical transaction data used for model training.

[0013] Furthermore, the historical transaction data used for model training includes historical transaction dimension features, and the abnormal behavior monitoring model is constructed according to the basic account information of the regulated account and the historical transaction data used for model training, including:

[0014] Obtaining the basic account information and the historical transaction dimension features; wherein the historical transaction dimension features at least include time dimension features and amount dimension features;

[0015] The basic account information and the historical transaction dimension features are input into a gradient boosting decision tree model to obtain the abnormal behavior monitoring model.

[0016] Furthermore, the historical transaction data used for model training includes historical transaction statistical features, and the abnormal behavior monitoring model is constructed according to the basic account information of the regulated account and the historical transaction data used for model training, including:

[0017] Obtaining the basic account information and the historical transaction statistical features; wherein the historical transaction statistical features at least include the average value, maximum value, minimum value and median of the historical transaction dimension features;

[0018] The basic account information and the historical transaction statistical features are input into a gradient boosting decision tree model to obtain the abnormal behavior monitoring model.

[0019] Furthermore, the predicted transaction data includes a fitting dimension feature, and the predicted transaction data for the set period is predicted based on the historical transaction data of the set period using a pre-built abnormal behavior monitoring model, including:

[0020] According to the historical transaction dimensional features of the set period, the fitting dimensional features of the set period are determined using the abnormal behavior monitoring model.

[0021] Furthermore, the predicted transaction data includes fitting statistical features, and the predicted transaction data for the set period is predicted based on the historical transaction data of the set period using a pre-built abnormal behavior monitoring model, including:

[0022] According to the historical transaction statistical characteristics of a set period, the abnormal behavior monitoring model is used to determine the fitting statistical characteristics of the set period.

[0023] Furthermore, the abnormal behavior monitoring of the regulated account according to the preset abnormal behavior threshold, the predicted transaction data and the real transaction data includes:

[0024] Determining whether the transaction behavior is abnormal based on a preset abnormal behavior threshold, the fitting dimension characteristics of the set time period, and the real transaction data;

[0025] When transaction behavior is abnormal, an abnormal behavior warning will be issued.

[0026] Furthermore, the abnormal behavior monitoring of the regulated account according to the preset abnormal behavior threshold, the predicted transaction data and the real transaction data includes:

[0027] Determining whether the transaction behavior is abnormal based on a preset abnormal behavior threshold, the fitting statistical characteristics of the set time period, and the real transaction data;

[0028] When transaction behavior is abnormal, an abnormal behavior warning will be issued.

[0029] In a second aspect, the present application provides an abnormal behavior monitoring device in a prepaid transaction scenario, comprising:

[0030] A real data acquisition unit, used to acquire real transaction data of the regulated account during a set period of time;

[0031] A prediction data generating unit, configured to predict the predicted transaction data for a set period of time based on the historical transaction data of a set period of time using a pre-built abnormal behavior monitoring model;

[0032] The abnormal behavior monitoring unit is used to monitor the abnormal behavior of the regulated account according to a preset abnormal behavior threshold, the predicted transaction data and the real transaction data.

[0033] Furthermore, the abnormal behavior monitoring device in the prepaid transaction scenario is also specifically used for:

[0034] An abnormal behavior monitoring model is constructed based on the basic account information of the regulated account and the historical transaction data used for model training.

[0035] Furthermore, in the abnormal behavior monitoring device in the prepaid transaction scenario, the historical transaction data used for model training includes historical transaction dimension features, and further includes:

[0036] A dimension feature acquisition unit, used to acquire the basic account information and the historical transaction dimension features; wherein the historical transaction dimension features at least include a time dimension feature and an amount dimension feature;

[0037] The monitoring model building unit is used to input the basic account information and the historical transaction dimension features into the gradient boosting decision tree model to obtain the abnormal behavior monitoring model.

[0038] Furthermore, in the abnormal behavior monitoring device in the prepaid transaction scenario, the historical transaction data used for model training includes historical transaction statistical features, and further includes:

[0039] A statistical feature acquisition unit, used to acquire the basic account information and the historical transaction statistical features; wherein the historical transaction statistical features at least include the average value, maximum value, minimum value and median of the historical transaction dimension features;

[0040] The monitoring model building unit is used to input the basic account information and the historical transaction statistical features into the gradient boosting decision tree model to obtain the abnormal behavior monitoring model.

[0041] Furthermore, in the abnormal behavior monitoring device in the prepaid transaction scenario, the predicted transaction data includes a fitting dimension feature, and the predicted data generating unit is further specifically used for:

[0042] According to the historical transaction dimensional features of the set period, the fitting dimensional features of the set period are determined using the abnormal behavior monitoring model.

[0043] Furthermore, in the abnormal behavior monitoring device in the prepaid transaction scenario, the predicted transaction data includes fitting statistical features, and the predicted data generating unit is further specifically used for:

[0044] According to the historical transaction statistical characteristics of a set period, the abnormal behavior monitoring model is used to determine the fitting statistical characteristics of the set period.

[0045] Furthermore, the abnormal behavior monitoring unit includes:

[0046] An abnormal behavior judgment module, used to determine whether the transaction behavior is abnormal based on a preset abnormal behavior threshold, the fitting dimension characteristics of the set time period and the real transaction data;

[0047] The abnormal behavior warning module is used to issue abnormal behavior warning when transaction behavior is abnormal.

[0048] Furthermore, the abnormal behavior monitoring unit includes:

[0049] An abnormal behavior judgment module, used to determine whether the transaction behavior is abnormal based on a preset abnormal behavior threshold, the fitting statistical characteristics of the set time period and the real transaction data;

[0050] The abnormal behavior warning module is used to issue abnormal behavior warning when transaction behavior is abnormal.

[0051] In a third aspect, the present application provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the abnormal behavior monitoring method in the prepaid transaction scenario are implemented.

[0052] In a fourth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the abnormal behavior monitoring method in the prepaid transaction scenario.

[0053] In response to the problems in the prior art, the abnormal behavior monitoring method and device in the prepaid transaction scenario provided by the present application can monitor the abnormal behavior of the regulated account according to the real transaction data of the regulated account by constructing an abnormal behavior monitoring model; by introducing an improved optimized supervised learning algorithm and related supporting solutions, it is possible to realize intelligent monitoring of business and funds in the prepaid transaction scenario, predict abnormal transaction behavior before risks occur, further enhance the security of prepaid funds, and provide regulatory agencies with better and more reliable funds supervision solutions. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0055] Figure 1 This is a flow chart of the abnormal behavior monitoring method in the prepaid transaction scenario in the embodiment of the present application;

[0056] Figure 2 One of the flowcharts of the steps of pre-building an abnormal behavior monitoring model in an embodiment of the present application;

[0057] Figure 3 This is a second flowchart of the steps of pre-building an abnormal behavior monitoring model in an embodiment of the present application;

[0058] Figure 4 This is one of the flow charts for monitoring abnormal behavior of a regulated account in an embodiment of the present application;

[0059] Figure 5 This is the second flow chart of abnormal behavior monitoring of a regulated account in an embodiment of the present application;

[0060] Figure 6 This is one of the structural diagrams of the abnormal behavior monitoring device in the prepaid transaction scenario in the embodiment of the present application;

[0061] Figure 7 This is the second structural diagram of the abnormal behavior monitoring device in the prepaid transaction scenario in the embodiment of the present application;

[0062] Figure 8 This is the third structural diagram of the abnormal behavior monitoring device in the prepaid transaction scenario in the embodiment of the present application;

[0063] Fig. 9 This is one of the structural diagrams of the abnormal behavior monitoring unit in the embodiment of the present application;

[0064] Fig.10 This is the second structural diagram of the abnormal behavior monitoring unit in the embodiment of the present application;

[0065] Fig.11 It is a schematic diagram of the structure of an electronic device in an embodiment of the present application;

[0066] Fig.12 A flow chart of the traditional supervision method in the prior art;

[0067] Fig.13 This is a schematic diagram of the implementation of the abnormal behavior monitoring method in the prepaid transaction scenario in the embodiment of the present application. DETAILED DESCRIPTION

[0068] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0069] It should be noted that the abnormal behavior monitoring method and device in the prepaid transaction scenario provided by the present application can be used in the financial field, and can also be used in any field other than the financial field. The application field of the abnormal behavior monitoring method and device in the prepaid transaction scenario provided by the present application is not limited.

[0070] See also Figure 1 In order to build an abnormal behavior monitoring model and monitor abnormal behavior of a regulated account according to the real transaction data of the regulated account, the present application provides an abnormal behavior monitoring method in a prepaid transaction scenario, including:

[0071] S101: Obtaining real transaction data of the regulated account during a set period;

[0072] S102: predicting the predicted transaction data for the set period using a pre-built abnormal behavior monitoring model based on the historical transaction data for the set period;

[0073] S103: Monitoring abnormal behavior of the regulated account according to a preset abnormal behavior threshold, the predicted transaction data and the real transaction data.

[0074] It is understandable that with the development of my country's economy, economic transactions in people's daily lives are becoming more frequent. In order to attract customers, some industries often suggest or require customers to pre-deposit a certain amount of money in a membership card account opened by a merchant, and then use the account to consume in the merchant. The above application scenario is referred to as a prepaid transaction scenario in the embodiment of the present application.

[0075] In prepaid transaction scenarios, if there is a lack of supervision, unscrupulous merchants may conduct abnormal transactions for profit, causing consumers to suffer unnecessary economic losses. Although there are regulatory rules and procedures for merchants in prepaid transaction scenarios in the prior art, since these rules and procedures have been established for some time, the participants have often found the rules and are prone to exploiting system loopholes to falsify information and data, thereby evading normal supervision and carrying out a series of behaviors that are not allowed in supervision, such as fund withdrawal, early transfer, and arbitrary transfer. Traditional regulatory rules and procedures can be found in Fig.12 shown.

[0076] To further illustrate the application scenario of the method provided by this application, the prepaid education and training industry is taken as an example. Assume that the training institution originally has 1 million yuan of funds in a normal transfer cycle every 3 months. However, in order to obtain funds in advance, the training institution adds a small amount (1,000 yuan) and a short cycle (completed in 1 week) course to affect the original 1 million yuan fund transfer cycle, attempting to complete the fund transfer a week in advance. If Fig.12 If the existing regulatory rules and procedures shown are used to supervise the training institution, the regulatory agency must manually review and determine the risk of abnormal behavior such as early transfer. This is not only a large workload, but also easy to fail to approve due to human negligence. In addition, in the existing application scenarios, the regulated merchants may also use the funds for special purposes without the regulatory agency knowing.

[0077] There are many more scenarios and problems like this. Due to the limitations of existing regulatory rules and processes, it is impossible to identify the corresponding risks before abnormal trading behaviors occur. Although it is possible to hold people accountable through post-audit, the timeliness is poor. Many abnormal behaviors have become established facts and the losses are difficult to recover. Therefore, more advanced means are needed to warn of business risks and financial risks before and during the event to avoid abnormal behaviors.

[0078] For this purpose, see Fig.13, the present application provides an abnormal behavior monitoring method in a prepaid transaction scenario. When it is necessary to supervise a merchant (supervised account), the real transaction data of the supervised account for a set period of time can be obtained first; then, based on the historical transaction data of the set period, the predicted transaction data of the set period can be predicted using a pre-built abnormal behavior monitoring model; finally, the supervised account can be monitored for abnormal behavior based on the pre-set abnormal behavior threshold, predicted transaction data, and real transaction data.

[0079] It should be noted that the so-called real transaction data of the set period refers to the real transaction data of the period to be regulated; the predicted transaction data calculated subsequently also corresponds to this period; the historical transaction data of the set period refers to the historical transaction data within a set period before the set period selected in order to calculate the predicted transaction data of the set period. For example, if the transaction situation in April (this set period) needs to be regulated, it can be completed using the historical transaction data from January to March (this set period).

[0080] From the above description, it can be seen that the abnormal behavior monitoring method in the prepaid transaction scenario provided by this application can monitor the abnormal behavior of the regulated account according to the real transaction data of the regulated account by constructing an abnormal behavior monitoring model; by introducing the improved optimized supervised learning algorithm and related supporting solutions, it can realize intelligent monitoring of business and funds in prepaid transaction scenarios, predict abnormal transaction behavior before risks occur, further enhance the security of prepaid funds, and provide regulators with better and more reliable funds supervision solutions.

[0081] In one embodiment, the step of pre-building an abnormal behavior monitoring model includes: building an abnormal behavior monitoring model based on basic account information of the regulated account and historical transaction data used for model training.

[0082] It can be understood that when conducting model training, the overall idea adopted by the embodiment of the present application is to use previous historical transaction data to construct an initial abnormal behavior monitoring model, and then use subsequent historical transaction data to verify the availability of the initial abnormal behavior monitoring model. If the availability is high, the initial abnormal behavior monitoring model is determined as the abnormal behavior monitoring model.

[0083] For example, assuming that it is April of this year, the so-called previous historical transaction data can be the full-year transaction data of the previous year, and the subsequent historical transaction data can be the transaction data from January to March of this year. In addition, the basic account information of the regulated account can be the institution number, institution name, etc., which mainly serves as a transaction carrier and identifier to distinguish different institutions and different transactions.

[0084] It can be seen from the above description that the abnormal behavior monitoring method in the prepaid transaction scenario provided by the present application can pre-build an abnormal behavior monitoring model.

[0085] See also Figure 2 The historical transaction data used for model training includes historical transaction dimension features. An abnormal behavior monitoring model is built based on the basic account information of the regulated account and the historical transaction data used for model training, including:

[0086] S201: Obtaining basic account information and historical transaction dimension features; wherein the historical transaction dimension features at least include time dimension features and amount dimension features;

[0087] S202: Input the basic account information and historical transaction dimension features into the gradient boosting decision tree model to obtain an abnormal behavior monitoring model.

[0088] It is understandable that in order to build an abnormal behavior monitoring model, it is necessary to obtain basic account information and historical transaction dimension characteristics, and after obtaining them, perform data preprocessing to fill in missing values ​​and balance the data.

[0089] The so-called missing values ​​refer to the situation where transaction data records are missing due to network failures and business system failures. The appearance of missing values ​​will lead to incomplete data, which will affect the subsequent feature extraction and modeling. Therefore, it is necessary to fill the missing values ​​before model training to minimize the subsequent data processing errors. The embodiments of the present application can use the mean method, median method, random value method, etc. to fill the missing values.

[0090] Here are some examples:

[0091] Table 1

[0092] Serial number Regulatory Account Course Information Payment personnel Payment amount illustrate 1 Regulatory Account A Spring Chinese Zhang San 1000 2 Regulatory Account A Spring Chinese Li Si 1000 3 Regulatory Account A Spring Chinese Wang Wu 1000 4 Regulatory Account B Spring Mathematics Zhang San 2000 5 Regulatory Account B Spring Mathematics Li Si 2000 6 Regulatory Account B Spring English Wang Wu 4000 7 Regulatory Account B Spring English Zhang San 4000 8 Regulatory Account B Spring English Li Si 4000 9 Regulatory Account C Spring Music Wang Wu 5000 Randomly add personnel information 10 Regulatory Account C Spring Music Li Si 5000 Mean Supplementary Course Information … … … … …

[0093] Table 2

[0094]

[0095]

[0096] Among them, Table 1 is an example of using the random value method to fill in missing values, and Table 2 is an example of using the average value method to fill in missing values.

[0097] The so-called data balancing processing refers to balancing the positive sample data and negative sample data used for model training before model training.

[0098] During monitoring, it was found that the model obtained by directly training the model without data balancing can also obtain prediction results, but the recall rate of the prediction results is extremely low. The reason is that the negative samples in the data samples used for model training only account for a very small proportion, and the positive samples are far more than the negative samples, resulting in the model not fully learning the negative samples in machine learning. In this case, the trained model is invalid. Because those skilled in the art know that many machine learning algorithms have a basic assumption, that is, the distribution of data samples should be as uniform as possible.

[0099] There are two ways to solve this problem:

[0100] The first method is to undersample the normal samples, so that the ratio of positive and negative samples in the final training samples is 1:1. However, this method has a serious overfitting effect, resulting in insufficient generalization ability of the model.

[0101] The second is oversampling of abnormal samples. Similarly, by oversampling negative samples, the ratio of positive and negative samples in the final training samples is made 1:1.

[0102] The embodiment of the present application selects oversampling of abnormal samples to solve the problem of sample imbalance. For example, as shown in Table 3:

[0103] Table 3

[0104]

[0105]

[0106] After completing the two-step data preprocessing, the basic account information and historical transaction dimension features can be input into the gradient boosting decision tree model, and the abnormal behavior monitoring model can be obtained using the machine learning algorithm. Among them, the historical transaction dimension features at least include time dimension features and amount dimension features. The time dimension feature can refer to a certain set period; the amount dimension feature can refer to the transfer amount of each transaction. In addition, the historical transaction dimension features can also include the transfer period, etc.

[0107] From the above description, it can be seen that the abnormal behavior monitoring method in the prepaid transaction scenario provided by the present application can build an abnormal behavior monitoring model based on the basic account information of the regulated account and the historical transaction data used for model training.

[0108] See also Figure 3 The historical transaction data used for model training includes historical transaction statistical features. An abnormal behavior monitoring model is constructed based on the basic account information of the regulated account and the historical transaction data used for model training, including:

[0109] S301: Obtaining basic account information and historical transaction statistical features; wherein the historical transaction statistical features at least include the average value, maximum value, minimum value and median of historical transaction dimension features;

[0110] S302: Input the basic account information and historical transaction statistical features into the gradient boosting decision tree model to obtain an abnormal behavior monitoring model.

[0111] It can be understood that, similar to the data preprocessing process described in the above embodiment, after completing the data preprocessing of the basic account information and historical transaction statistical features, the basic account information and historical transaction statistical features can be input into the gradient boosting decision tree model, and the abnormal behavior monitoring model can be obtained using the machine learning algorithm. Among them, the historical transaction statistical features at least include the average value, maximum value, minimum value and median of the historical transaction dimension features, that is, the average value, maximum value, minimum value and median of the historical transaction dimension features used for model training within a certain period of time.

[0112] From the above description, it can be seen that the abnormal behavior monitoring method in the prepaid transaction scenario provided by the present application can build an abnormal behavior monitoring model based on the basic account information of the regulated account and the historical transaction data used for model training.

[0113] In one embodiment, the predicted transaction data includes fitting dimension features, and based on the historical transaction data of a set period, the predicted transaction data of a set period is predicted using a pre-built abnormal behavior monitoring model, including:

[0114] According to the historical transaction dimension characteristics of the set period, the abnormal behavior monitoring model is used to determine the fitting dimension characteristics of the set period.

[0115] It should be noted that the “set period” in this embodiment has the same meaning as the “set period” recorded in step S101 .

[0116] Taking the prepaid transaction scenario of a training institution as an example, through the research on the full-link monitoring business of prepaid transaction scenarios, the main monitored data currently include user payment information, institution course information, fund transfer information and basic account information. There is a certain correlation between these information. By collecting the above data, proofing abnormal data labels on the final transfer data, and then inputting them into the supervised learning model training, an abnormal behavior monitoring model can be obtained.

[0117] The embodiments of the present application do not limit the machine learning algorithm, and the Random Forest algorithm, XGBost algorithm and LightGBM algorithm can be used for machine learning. These machine learning algorithms can perform data prediction, and if data outside the prediction range appears, an alarm can be triggered. For example, for the allocation of funds for a certain course, the funds allocated in each of the previous periods were about 100,000 yuan, but suddenly the allocation amount in one period suddenly changed to 1 million yuan, then this 1 million yuan can be used as data outside the prediction range to trigger an alarm.

[0118] Through verification, the classification effect of the random forest algorithm is poor, and the evaluation results of the XGBost algorithm and the LightGBM algorithm are similar, but the classification effect of the XGBost algorithm is slightly better, and the LightGBM algorithm is faster in training.

[0119] It should be noted that feature extraction is the most critical link in learning data sampling. The embodiment of the present application adopts a sliding window method (see Table 4) to extract features in three aspects: statistical features (which can correspond to the above-mentioned historical transaction statistical features), decomposition features (which can correspond to the above-mentioned historical transaction dimensional features) and fitting features (which can correspond to the above-mentioned fitting dimensional features and fitting statistical features). Among them, the statistical features describe some statistical values ​​that need to be paid attention to during the model training process (see the above-mentioned example data: number of payments, payment amount, number of courses, number of transfers and transfer amount, etc.). If these statistical values ​​have irregular changes such as maximum or minimum values, it indicates that anomalies may have occurred in the corresponding data. The decomposition features are detected from each dimension that constitutes the monitoring sequence (example data include: course time, transfer cycle (period) and transfer time, etc.). If a dimension has irregular changes such as maximum or minimum values, it is possible that anomalies have occurred at the corresponding time point. The fitting feature fits the original monitoring sequence. If the fitting value is very different from the true value (which can correspond to the real transaction data), it is possible that abnormal behavior has occurred.

[0120] Table 4

[0121] name illustrate property cur_win_max Current sliding window maximum value Current window statistics cur_win_min Current sliding window minimum value Current window statistics cur_win_mean Current sliding window mean Current window statistics cur_win_median Current sliding window median Current window statistics cur_win_var Current sliding window variance Current window statistics diff_t Difference from the previous moment Contrast features diff_win_max Maximum value of two-window difference statistics Comparison of statistical features between two windows diff_win_min Minimum of two-window difference statistics Comparison of statistical features between two windows diff_win_mean Two-window difference statistical mean Comparison of statistical features between two windows diff_win_median Median of two-window difference statistics Comparison of statistical features between two windows diff_win_var Two-window difference statistical variance Comparison of statistical features between two windows

[0122] From the above description, it can be seen that the abnormal behavior monitoring method in the prepaid transaction scenario provided by the present application predicts the predicted transaction data of the set period based on the historical transaction data of the set period using a pre-built abnormal behavior monitoring model.

[0123] In one embodiment, the predicted transaction data includes fitting statistical features, and based on the historical transaction data of a set period, a pre-built abnormal behavior monitoring model is used to predict the predicted transaction data of a set period, including:

[0124] According to the historical transaction statistical characteristics of the set period, the abnormal behavior monitoring model is used to determine the fitting statistical characteristics of the set period.

[0125] From the above description, it can be seen that the abnormal behavior monitoring method in the prepaid transaction scenario provided by the present application can predict the predicted transaction data of the set period based on the historical transaction data of the set period using a pre-built abnormal behavior monitoring model.

[0126] See also Figure 4 , the abnormal behavior monitoring method in the prepaid transaction scenario monitors the abnormal behavior of the regulated account according to the pre-set abnormal behavior threshold, predicted transaction data and real transaction data, including:

[0127] S401: Determine whether the transaction behavior is abnormal based on a preset abnormal behavior threshold, the fitting dimension characteristics of the set time period, and the real transaction data;

[0128] S402: When the transaction behavior is abnormal, an abnormal behavior warning is issued.

[0129] It is understandable that by acquiring transaction data in the big data platform, abnormal data can be detected through model construction, and then quasi-real-time warning can be issued through alarm equipment. Among them, the abnormal behavior threshold can be set according to the actual application scenario.

[0130] From the above description, it can be seen that the abnormal behavior monitoring method in the prepaid transaction scenario provided by the present application can monitor the abnormal behavior of the regulated account based on the pre-set abnormal behavior threshold, predicted transaction data and real transaction data.

[0131] See also Figure 5 , monitor the abnormal behavior of the regulated accounts based on the pre-set abnormal behavior threshold, predicted transaction data and real transaction data, including:

[0132] S501: Determine whether the transaction behavior is abnormal based on a preset abnormal behavior threshold, fitting statistical characteristics of a set time period, and real transaction data;

[0133] S502: When the transaction behavior is abnormal, an abnormal behavior warning is issued.

[0134] From the above description, it can be seen that the abnormal behavior monitoring method in the prepaid transaction scenario provided by the present application can monitor the abnormal behavior of the regulated account based on the pre-set abnormal behavior threshold, predicted transaction data and real transaction data.

[0135] Based on the same inventive concept, the embodiments of the present application also provide an abnormal behavior monitoring device in a prepaid transaction scenario, which can be used to implement the method described in the above embodiments, as described in the following embodiments. Since the principle of solving the problem by the abnormal behavior monitoring device in the prepaid transaction scenario is similar to that of the abnormal behavior monitoring method in the prepaid transaction scenario, the implementation of the abnormal behavior monitoring device in the prepaid transaction scenario can refer to the implementation of the method based on the software performance benchmark determination, and the repeated parts will not be repeated. As used below, the term "unit" or "module" can be a combination of software and / or hardware that implements a predetermined function. Although the system described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0136] See also Figure 6 In order to build an abnormal behavior monitoring model and monitor abnormal behavior of a regulated account according to the real transaction data of the regulated account, the present application provides an abnormal behavior monitoring device in a prepaid transaction scenario, including:

[0137] The real data acquisition unit 601 is used to acquire the real transaction data of the supervised account during a set period of time;

[0138] The prediction data generating unit 602 is used to predict the predicted transaction data of the set period based on the historical transaction data of the set period using the pre-built abnormal behavior monitoring model;

[0139] The abnormal behavior monitoring unit 603 is used to monitor the abnormal behavior of the regulated account according to a preset abnormal behavior threshold, the predicted transaction data and the real transaction data.

[0140] In one embodiment, the abnormal behavior monitoring device in the prepaid transaction scenario is further specifically used for:

[0141] An abnormal behavior monitoring model is constructed based on the basic account information of the regulated account and the historical transaction data used for model training.

[0142] See also Figure 7 , the abnormal behavior monitoring device in the prepaid transaction scenario, the historical transaction data used for model training includes historical transaction dimension features, and also includes:

[0143] The dimension feature acquisition unit 701 is used to acquire the basic account information and the historical transaction dimension features; wherein the historical transaction dimension features at least include a time dimension feature and an amount dimension feature;

[0144] The monitoring model building unit 702 is used to input the basic account information and the historical transaction dimension features into the gradient boosting decision tree model to obtain the abnormal behavior monitoring model.

[0145] See also Figure 8 , the abnormal behavior monitoring device in the prepaid transaction scenario, the historical transaction data used for model training includes historical transaction statistical features, and also includes:

[0146] The statistical feature acquisition unit 801 is used to acquire the basic account information and the historical transaction statistical features; wherein the historical transaction statistical features at least include the average value, maximum value, minimum value and median of the historical transaction dimension features;

[0147] The monitoring model building unit 802 is used to input the basic account information and the historical transaction statistical features into a gradient boosting decision tree model to obtain the abnormal behavior monitoring model.

[0148] In one embodiment, the predicted transaction data includes a fitting dimension feature, and the predicted data generating unit is further specifically used for:

[0149] According to the historical transaction dimensional features of the set period, the fitting dimensional features of the set period are determined using the abnormal behavior monitoring model.

[0150] In one embodiment, the predicted transaction data includes fitting statistical features, and the predicted data generating unit is further specifically used for:

[0151] According to the historical transaction statistical characteristics of a set period, the abnormal behavior monitoring model is used to determine the fitting statistical characteristics of the set period.

[0152] See also Fig. 9 , the abnormal behavior monitoring unit 603 includes:

[0153] The abnormal behavior judgment module 901 is used to determine whether the transaction behavior is abnormal according to a preset abnormal behavior threshold, the fitting dimension characteristics of the set time period and the real transaction data;

[0154] The abnormal behavior warning module 902 is used to issue an abnormal behavior warning when the transaction behavior is abnormal.

[0155] See also Fig.10 , the abnormal behavior monitoring unit 603 includes:

[0156] The abnormal behavior judgment module 1001 is used to determine whether the transaction behavior is abnormal according to a preset abnormal behavior threshold, the fitting statistical characteristics of the set time period and the real transaction data;

[0157] The abnormal behavior warning module 1002 is used to issue an abnormal behavior warning when the transaction behavior is abnormal.

[0158] From the hardware level, in order to be able to monitor abnormal behavior of a regulated account based on the real transaction data of the regulated account by building an abnormal behavior monitoring model, the present application provides an embodiment of an electronic device for implementing all or part of the content of the abnormal behavior monitoring method in the prepaid transaction scenario, and the electronic device specifically includes the following content:

[0159] Processor, memory, communication interface and bus; wherein the processor, memory and communication interface communicate with each other through the bus; the communication interface is used to realize the information transmission between the abnormal behavior monitoring device in the prepaid transaction scenario and the core business system, user terminal and related database and other related equipment; the logic controller can be a desktop computer, a tablet computer and a mobile terminal, etc., but the present embodiment is not limited thereto. In the present embodiment, the logic controller can be implemented with reference to the embodiment of the abnormal behavior monitoring method in the prepaid transaction scenario and the embodiment of the abnormal behavior monitoring device in the prepaid transaction scenario in the embodiment, and the contents thereof are incorporated herein, and the repeated parts are not repeated.

[0160] It is understandable that the user terminal may include a smart phone, a tablet electronic device, a network set-top box, a portable computer, a desktop computer, a personal digital assistant (PDA), a vehicle-mounted device, a smart wearable device, etc. Among them, the smart wearable device may include smart glasses, a smart watch, a smart bracelet, etc.

[0161] In practical applications, part of the abnormal behavior monitoring method in the prepaid transaction scenario can be executed on the electronic device side as described above, or all operations can be completed in the client device. The specific selection can be based on the processing capability of the client device and the limitations of the user's usage scenario. This application does not limit this. If all operations are completed in the client device, the client device may also include a processor.

[0162] The client device may have a communication module (i.e., a communication unit) that can communicate with a remote server to achieve data transmission with the server. The server may include a server on the task scheduling center side, and other implementation scenarios may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, or a server cluster consisting of multiple servers, or a server structure of a distributed device.

[0163] Fig.11 FIG. 9 is a schematic block diagram of the system structure of the electronic device 9600 according to an embodiment of the present application. Fig.11 As shown, the electronic device 9600 may include a central processor 9100 and a memory 9140; the memory 9140 is coupled to the central processor 9100. It is worth noting that Fig.11 is exemplary; other types of structures may also be used to supplement or replace this structure to implement telecommunication functions or other functions.

[0164] In one embodiment, the abnormal behavior monitoring method function in the prepaid transaction scenario can be integrated into the central processor 9100. The central processor 9100 can be configured to perform the following control:

[0165] S101: Obtaining real transaction data of the regulated account during a set period;

[0166] S102: predicting the predicted transaction data for the set period using a pre-built abnormal behavior monitoring model based on the historical transaction data for the set period;

[0167] S103: Monitoring abnormal behavior of the regulated account according to a preset abnormal behavior threshold, the predicted transaction data and the real transaction data.

[0168] From the above description, it can be seen that the abnormal behavior monitoring method and device in the prepaid transaction scenario provided by this application can monitor the abnormal behavior of the regulated account according to the real transaction data of the regulated account by constructing an abnormal behavior monitoring model; by introducing the improved optimized supervised learning algorithm and related supporting solutions, it can realize intelligent monitoring of business and funds in prepaid transaction scenarios, predict abnormal transaction behavior before risks occur, further enhance the security of prepaid funds, and provide regulatory agencies with better and more reliable funds supervision solutions.

[0169] In another embodiment, the abnormal behavior monitoring device in the prepaid transaction scenario can be configured separately from the central processor 9100. For example, the abnormal behavior monitoring device in the prepaid transaction scenario of the data composite transmission device can be configured as a chip connected to the central processor 9100, and the function of the abnormal behavior monitoring method in the prepaid transaction scenario is realized through the control of the central processor.

[0170] like Fig.11 As shown, the electronic device 9600 may also include: a communication module 9110, an input unit 9120, an audio processor 9130, a display 9160, and a power supply 9170. It is worth noting that the electronic device 9600 does not necessarily have to include Fig.11 In addition, the electronic device 9600 may also include Fig.11 For components not shown, reference may be made to the prior art.

[0171] like Fig.11 As shown, the central processing unit 9100 is sometimes also referred to as a controller or an operation control, and may include a microprocessor or other processor device and / or logic device, which receives input and controls the operation of various components of the electronic device 9600.

[0172] The memory 9140 may be, for example, one or more of a cache, a flash memory, a hard drive, a removable medium, a volatile memory, a non-volatile memory or other suitable devices. The above-mentioned information related to the failure may be stored, and a program for executing the relevant information may also be stored. The CPU 9100 may execute the program stored in the memory 9140 to implement information storage or processing, etc.

[0173] The input unit 9120 provides input to the central processing unit 9100. The input unit 9120 is, for example, a key or a touch input device. The power supply 9170 is used to provide power to the electronic device 9600. The display 9160 is used to display display objects such as images and texts. The display may be, for example, an LCD display, but is not limited thereto.

[0174] The memory 9140 may be a solid-state memory, such as a read-only memory (ROM), a random access memory (RAM), a SIM card, etc. It may also be a memory that saves information even when the power is off, can be selectively erased, and is provided with more data, examples of which are sometimes referred to as EPROMs, etc. The memory 9140 may also be some other type of device. The memory 9140 includes a buffer memory 9141 (sometimes referred to as a buffer). The memory 9140 may include an application / function storage unit 9142, which is used to store application programs and function programs or processes for executing the operation of the electronic device 9600 through the central processor 9100.

[0175] The memory 9140 may also include a data storage unit 9143 for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. The driver storage unit 9144 of the memory 9140 may include various drivers for communication functions of the electronic device and / or for executing other functions of the electronic device (such as messaging applications, address book applications, etc.).

[0176] The communication module 9110 is a transmitter / receiver 9110 that sends and receives signals via an antenna 9111. The communication module (transmitter / receiver) 9110 is coupled to the central processor 9100 to provide input signals and receive output signals, which may be the same as the case of a conventional mobile communication terminal.

[0177] Based on different communication technologies, multiple communication modules 9110 may be provided in the same electronic device, such as a cellular network module, a Bluetooth module and / or a wireless LAN module. The communication module (transmitter / receiver) 9110 is also coupled to a speaker 9131 and a microphone 9132 via an audio processor 9130 to provide an audio output via the speaker 9131 and receive an audio input from the microphone 9132, thereby realizing a common telecommunication function. The audio processor 9130 may include any suitable buffer, decoder, amplifier, etc. In addition, the audio processor 9130 is also coupled to the central processor 9100, so that recording can be performed on the local machine through the microphone 9132, and the sound stored on the local machine can be played through the speaker 9131.

[0178] The embodiments of the present application also provide a computer-readable storage medium capable of implementing all steps of the abnormal behavior monitoring method in a prepaid transaction scenario where the execution subject is a server or a client in the above embodiments. The computer-readable storage medium stores a computer program. When the computer program is executed by a processor, all steps of the abnormal behavior monitoring method in a prepaid transaction scenario where the execution subject is a server or a client in the above embodiments are implemented. For example, when the processor executes the computer program, the following steps are implemented:

[0179] S101: Obtaining real transaction data of the regulated account during a set period;

[0180] S102: predicting the predicted transaction data for the set period using a pre-built abnormal behavior monitoring model based on the historical transaction data for the set period;

[0181] S103: Monitoring abnormal behavior of the regulated account according to a preset abnormal behavior threshold, the predicted transaction data and the real transaction data.

[0182] From the above description, it can be seen that the abnormal behavior monitoring method and device in the prepaid transaction scenario provided by this application can monitor the abnormal behavior of the regulated account according to the real transaction data of the regulated account by constructing an abnormal behavior monitoring model; by introducing the improved optimized supervised learning algorithm and related supporting solutions, it can realize intelligent monitoring of business and funds in prepaid transaction scenarios, predict abnormal transaction behavior before risks occur, further enhance the security of prepaid funds, and provide regulatory agencies with better and more reliable funds supervision solutions.

[0183] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, devices, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0184] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (apparatus), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0185] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0186] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0187] The present invention uses specific embodiments to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A method for monitoring abnormal behavior in a prepaid transaction scenario, characterized in that: include: Obtain the real transaction data of the regulated account during the set period; Based on the historical transaction data of a set period, a pre-built abnormal behavior monitoring model is used to predict the predicted transaction data of the set period; Perform abnormal behavior monitoring on the regulated account according to a preset abnormal behavior threshold, the predicted transaction data and the real transaction data; The steps of pre-building an abnormal behavior monitoring model include: Building an abnormal behavior monitoring model based on the basic account information of the regulated account and the historical transaction data used for model training; The historical transaction data used for model training includes historical transaction dimension features, and the abnormal behavior monitoring model is constructed according to the basic account information of the regulated account and the historical transaction data used for model training, including: Obtaining the basic account information and the historical transaction dimension features; wherein the historical transaction dimension features at least include time dimension features and amount dimension features; The basic account information and the historical transaction dimension features are input into a gradient boosting decision tree model to obtain the abnormal behavior monitoring model.

2. The abnormal behavior monitoring method in a prepaid transaction scenario according to claim 1 is characterized in that: The historical transaction data used for model training includes historical transaction statistical features, and the abnormal behavior monitoring model is constructed according to the basic account information of the regulated account and the historical transaction data used for model training, including: Obtaining the basic account information and the historical transaction statistical features; wherein the historical transaction statistical features at least include the average value, maximum value, minimum value and median of the historical transaction dimension features; The basic account information and the historical transaction statistical features are input into a gradient boosting decision tree model to obtain the abnormal behavior monitoring model.

3. The abnormal behavior monitoring method in a prepaid transaction scenario according to claim 1 is characterized in that: The predicted transaction data includes fitting dimension features, the historical transaction data of a set period is used, and the predicted transaction data of the set period is predicted by using a pre-built abnormal behavior monitoring model, including: According to the historical transaction dimensional features of the set period, the fitting dimensional features of the set period are determined using the abnormal behavior monitoring model.

4. The abnormal behavior monitoring method in a prepaid transaction scenario according to claim 2 is characterized in that: The predicted transaction data includes fitting statistical features, and the predicted transaction data for the set period is predicted based on the historical transaction data of the set period using a pre-built abnormal behavior monitoring model, including: According to the historical transaction statistical characteristics of a set period, the abnormal behavior monitoring model is used to determine the fitting statistical characteristics of the set period.

5. The abnormal behavior monitoring method in a prepaid transaction scenario according to claim 3 is characterized in that: The abnormal behavior monitoring of the regulated account according to the preset abnormal behavior threshold, the predicted transaction data and the real transaction data includes: Determining whether the transaction behavior is abnormal based on a preset abnormal behavior threshold, the fitting dimension characteristics of the set time period, and the real transaction data; When transaction behavior is abnormal, an abnormal behavior warning will be issued.

6. The abnormal behavior monitoring method in a prepaid transaction scenario according to claim 4 is characterized in that: The abnormal behavior monitoring of the regulated account according to the preset abnormal behavior threshold, the predicted transaction data and the real transaction data includes: Determining whether the transaction behavior is abnormal based on a preset abnormal behavior threshold, the fitting statistical characteristics of the set time period, and the real transaction data; When transaction behavior is abnormal, an abnormal behavior warning will be issued.

7. An abnormal behavior monitoring device in a prepaid transaction scenario, characterized in that: include: A real data acquisition unit, used to acquire real transaction data of the regulated account during a set period of time; A prediction data generating unit, configured to predict the predicted transaction data for a set period of time based on the historical transaction data of a set period of time using a pre-built abnormal behavior monitoring model; An abnormal behavior monitoring unit, used to monitor the abnormal behavior of the regulated account according to a preset abnormal behavior threshold, the predicted transaction data and the real transaction data; The abnormal behavior monitoring device in the prepaid transaction scenario is characterized by being further specifically used for: Building an abnormal behavior monitoring model based on the basic account information of the regulated account and the historical transaction data used for model training; The historical transaction data used for model training includes historical transaction dimension features, and also includes: A dimension feature acquisition unit, used to acquire the basic account information and the historical transaction dimension features; wherein the historical transaction dimension features at least include a time dimension feature and an amount dimension feature; The monitoring model building unit is used to input the basic account information and the historical transaction dimension features into the gradient boosting decision tree model to obtain the abnormal behavior monitoring model.

8. The abnormal behavior monitoring device in a prepaid transaction scenario according to claim 7, characterized in that: The historical transaction data used for model training includes historical transaction statistical features, and also includes: A statistical feature acquisition unit, used to acquire the basic account information and the historical transaction statistical features; wherein the historical transaction statistical features at least include the average value, maximum value, minimum value and median of the historical transaction dimension features; The monitoring model building unit is used to input the basic account information and the historical transaction statistical features into the gradient boosting decision tree model to obtain the abnormal behavior monitoring model.

9. The abnormal behavior monitoring device in a prepaid transaction scenario according to claim 7, characterized in that: The predicted transaction data includes a fitting dimension feature, and the predicted data generating unit is further specifically used for: According to the historical transaction dimensional features of the set period, the fitting dimensional features of the set period are determined using the abnormal behavior monitoring model.

10. The abnormal behavior monitoring device in a prepaid transaction scenario according to claim 8, characterized in that: The predicted transaction data includes fitting statistical features, and the predicted data generating unit is further specifically used for: According to the historical transaction statistical characteristics of a set period, the abnormal behavior monitoring model is used to determine the fitting statistical characteristics of the set period.

11. The abnormal behavior monitoring device in a prepaid transaction scenario according to claim 9, characterized in that: The abnormal behavior monitoring unit comprises: An abnormal behavior judgment module, used to determine whether the transaction behavior is abnormal based on a preset abnormal behavior threshold, the fitting dimension characteristics of the set time period and the real transaction data; The abnormal behavior warning module is used to issue abnormal behavior warning when transaction behavior is abnormal.

12. The abnormal behavior monitoring device in a prepaid transaction scenario according to claim 10, characterized in that: The abnormal behavior monitoring unit further includes: An abnormal behavior judgment module, used to determine whether the transaction behavior is abnormal based on a preset abnormal behavior threshold, the fitting statistical characteristics of the set time period and the real transaction data; The abnormal behavior warning module is used to issue abnormal behavior warning when transaction behavior is abnormal.

13. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the abnormal behavior monitoring method in a prepaid transaction scenario according to any one of claims 1 to 6 are implemented.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the abnormal behavior monitoring method in a prepaid transaction scenario described in any one of claims 1 to 6 are implemented.

Images