Abnormal Object Determination Method, Apparatus, Device, and Storage Medium

Abstract

The present disclosure relates to a method, apparatus, device, and storage medium for determining abnormal objects. By using the risk value of the attribute feature information of an object to describe the risk of the object, a risk portrait of the object is generated, which can effectively represent the risk of the object and can also discover gang objects; and by using the risk portrait of the object to re-screen the first preset number of objects screened by the isolation forest algorithm, high-risk objects can be screened out, and isolated forest tail objects with potential anomalies can be discovered. Finally, by using the transaction portrait information of the object for refinement to determine abnormal objects, the accuracy of abnormal object determination can be ensured.

Description

Technical Field

[0001] The present disclosure relates to the field of data processing, and in particular, to a method, apparatus, device, and storage medium for determining abnormal objects. Background Art

[0002] The auditing of abnormal objects mainly focuses on the screening and determination of abnormal objects. For example, the screening and determination of abnormal merchants. Currently, the screening of abnormal objects and the determination of abnormal types generally require the participation of auditors, and automation cannot be achieved. Moreover, in the screening of abnormal objects, the risks of objects cannot be effectively described or quantified, which makes it difficult to determine abnormal objects among a large number of objects, and the accuracy of determining abnormal objects is not high. In addition, the existing method of using the isolation forest algorithm for abnormal classification will ignore the abnormal situations of the tail objects with later abnormal values, and there is a risk that abnormal objects are not fully mined. Based on these current situations, it is particularly important to provide a method for automatically and efficiently determining abnormal objects with high accuracy. Summary of the Invention

[0003] In view of this, the present disclosure provides a method, apparatus, device, and storage medium for determining abnormal objects.

[0004] According to one aspect of the present disclosure, a method for determining abnormal objects is provided, including:

[0005] Obtaining feature information of multiple objects, where the feature information of each object includes attribute characteristic information and violation feature information;

[0006] Determining the object corresponding to each attribute feature information and the violation feature information of the corresponding object;

[0007] Generating a risk profile corresponding to each attribute feature information according to the object corresponding to each attribute feature information and the violation feature information of the corresponding object;

[0008] Generating a risk profile of each object according to the risk profile corresponding to each attribute feature information and the attribute feature information of each object;

[0009] Screening out a first preset number of objects according to the feature information of the multiple objects and the isolation forest algorithm;

[0010] Screening out a second preset number of objects from the first preset number of objects based on the risk profile of each object;

[0011] Obtaining transaction profile information corresponding to the second preset number of objects;

[0012] If the transaction profile information meets a preset condition, determining the object corresponding to the transaction profile information as an abnormal object.

[0013] According to another aspect of the present disclosure, there is provided an abnormal object determination device, including:

[0014] A feature information acquisition module, configured to acquire the feature information of multiple objects, where the feature information of each object includes attribute characteristic information and violation feature information;

[0015] A first determination module, configured to determine the object corresponding to each attribute feature information and the violation feature information of the corresponding object;

[0016] A risk profile generation module corresponding to the attribute feature information, configured to generate a risk profile corresponding to each attribute feature information according to the object corresponding to each attribute feature information and the violation feature information of the corresponding object;

[0017] A risk profile generation module of the object, configured to generate a risk profile of each object according to the risk profile corresponding to each attribute feature information and the attribute feature information of each object;

[0018] A first screening module, configured to screen out a first preset number of objects according to the feature information of the multiple objects and the isolation forest algorithm;

[0019] A second screening module, configured to screen out a second preset number of objects from the first preset number of objects based on the risk profile of each object;

[0020] A transaction profile information acquisition module, configured to acquire the transaction profile information corresponding to the second preset number of objects;

[0021] A second determination module, configured to determine the object corresponding to the transaction profile information as an abnormal object if the transaction profile information meets a preset condition.

[0022] According to another aspect of the present disclosure, there is provided an abnormal object determination device. It includes: a processor; a memory for storing processor-executable instructions; wherein, the processor is configured to execute the above method.

[0023] According to another aspect of the present disclosure, there is provided a non-volatile computer-readable storage medium, on which computer program instructions are stored, wherein the computer program instructions, when executed by a processor, implement the above method.

[0024] Describe the risk of each object through the risk corresponding to the attribute feature information of each object, and based on the risk profile of each object, conduct a preliminary selection of the first preset number of objects screened by the isolation forest algorithm, so that the objects at the tail of the isolation forest algorithm can be fully mined; and conduct a refined selection according to the transaction profile information of each object and preset conditions to determine abnormal objects, and conduct a second screening of the preliminarily selected objects to ensure the accuracy rate of determining abnormal objects, realizing the automated audit of combining the profiling technology and the isolation forest algorithm to determine abnormal objects, achieving the purpose of automatically and efficiently determining abnormal objects with high accuracy rate, thus greatly liberating human resources, accelerating audit discovery, increasing the audit volume and the coverage range of audit targets, and effectively purifying the business ecosystem;

[0025] In addition, introducing the profiling technology into the audit field can realize the risk tagging and concretization of objects, and can effectively describe the risks of objects; and in the risk profile of objects, introducing the multi-dimensional risk assessment of objects can not only discover high-risk objects, but also discover gang objects.

[0026] Other features and aspects of the present disclosure will become clear from the following detailed description of exemplary embodiments with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The accompanying drawings, which are included in and constitute a part of this specification, illustrate exemplary embodiments, features, and aspects of the present disclosure and are used to explain the principles of the present disclosure.

[0028] Figure 1 A schematic diagram of an application system provided according to an embodiment of the present disclosure is shown.

[0029] Figure 2 A flowchart of a method for determining abnormal objects according to an embodiment of the present disclosure is shown.

[0030] Figure 3 A schematic diagram of an automated audit system according to an embodiment of the present disclosure is shown.

[0031] Figure 4 A flowchart of a method for generating a risk profile corresponding to each attribute feature information according to the object corresponding to each attribute feature information and the violation feature information of the corresponding object is shown.

[0032] Figure 5 A flowchart of a method for generating a risk profile of each object according to the risk profile corresponding to each attribute feature information and the attribute feature information of each object is shown.

[0033] Figure 6A flowchart showing a method of selecting a second preset number of objects from the first preset number of objects according to the risk profile of each object according to an embodiment of the present disclosure.

[0034] Figure 7 A flowchart showing a method for determining abnormal objects according to an embodiment of the present disclosure.

[0035] Figure 8 A flowchart showing a method of determining the abnormal type of each object according to the attribute feature information of each object and the violation feature information of each object according to an embodiment of the present disclosure.

[0036] Figure 9 A block diagram showing an abnormal object determination device according to an embodiment of the present disclosure.

[0037] Figure 10 A block diagram showing a block diagram for an abnormal object determination device 1000 according to an embodiment of the present disclosure. Detailed implementation manners

[0038] Various exemplary embodiments, features, and aspects of the present disclosure will be described in detail below with reference to the accompanying drawings. The same reference numerals in the drawings denote elements having the same or similar functions. Although various aspects of the embodiments are shown in the drawings, the drawings are not necessarily drawn to scale unless otherwise specified.

[0039] The term "exemplary" used herein means "serving as an example, embodiment, or illustration". Any embodiment described herein as "exemplary" is not necessarily to be construed as superior to or better than other embodiments.

[0040] In addition, for a better description of the present disclosure, numerous specific details are given in the following detailed implementation manners. Those skilled in the art should understand that the present disclosure can be implemented without some specific details. In some instances, methods, means, elements, and circuits well known to those skilled in the art are not described in detail so as to highlight the gist of the present disclosure.

[0041] Artificial Intelligence (AI) is a theory, method, technology, and application system that uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use knowledge to obtain the best results. Artificial intelligence software technology mainly includes several major directions such as computer vision technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0042] In recent years, with the research and progress of artificial intelligence technology, artificial intelligence technology has been widely applied in many fields. In the solution provided by the embodiments of the present disclosure, the portrait technology and the isolation forest algorithm involve technologies such as machine learning / deep learning of artificial intelligence. The portrait technology can extract feature information for describing an object from a large amount of data, and the isolation forest algorithm can be used to detect abnormal objects.

[0043] Please refer to Figure 1 , Figure 1 which shows a schematic diagram of an application system provided according to an embodiment of the present disclosure. The application system can be used for determining abnormal objects. As Figure 1 shown, the application system can at least include a server 01 and a terminal 02.

[0044] In the embodiments of the present disclosure, the server 01 can include an independent physical server, or can be a server cluster or a distributed system composed of multiple physical servers, or can also be a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0045] In the embodiments of the present disclosure, the terminal 02 can include entity devices of types such as smart phones, desktop computers, tablet computers, laptop computers, smart speakers, digital assistants, augmented reality (AR) / virtual reality (VR) devices, and smart wearable devices. The entity devices can also include software running on the entity devices, such as application programs, etc. The operating systems running on the terminal 02 in the embodiments of the present disclosure can include, but are not limited to, Android systems, IOS systems, linux, windows, etc.

[0046] In the embodiments of this specification, the above-mentioned terminal 02 and the server 01 can be directly or indirectly connected through wired or wireless communication methods, and the present disclosure does not limit this.

[0047] In the embodiments of this specification, the server 01 can be used to execute the abnormal object determination method of the present disclosure to determine abnormal objects. Optionally, the determined abnormal objects can be sent to the terminal 02 to be presented to the auditors.

[0048] It should be noted that in actual applications, the abnormal object determination method of the present disclosure can also be implemented in the terminal 02. In the embodiments of the present disclosure, preferably, the abnormal object determination method is implemented in the server 01.

[0049] The objects of the present disclosure may include merchants, network users, etc. The merchants may be merchants in different industries, and the present disclosure does not limit this.

[0050] Figure 2 The flowchart showing the method for determining abnormal objects according to an embodiment of the present disclosure is as follows. Figure 2 As shown, the method may include:

[0051] Step S11, obtaining the feature information of multiple objects, where the feature information of each object includes attribute characteristic information and violation feature information.

[0052] The feature information may be information capable of characterizing the attributes and behaviors of the object; the attribute characteristic information may be used to describe the basic information of the object. For example, when the object is a merchant, the attribute characteristic information may include registration information and other basic information, such as address, telephone, email, channel merchant, service provider, application identifier (application ID), merchant name, etc.

[0053] The violation feature information may refer to information on violations committed by the object or the object's historical violations and penalty information. The violation feature information may include violation types, violation identifiers, violation records, violation times, etc. The violation identifier may include two types: violation and non - violation. When the object is a merchant, the violation types may include gambling, cash - out, porn, and other types of violations. The present disclosure does not limit this, and the violation types may be set according to actual situations.

[0054] Optionally, the feature information of each object may further include transaction feature information, etc. The transaction feature information may refer to information during the transaction process of the object, such as transaction amount, unit price per transaction, per capita price, per capita transaction times, merchant activity, etc.

[0055] In one example, as Figure 3 shown, based on the persistence of business - related data, multiple objects' business - related data can be periodically pulled from the business database at the business side. According to the business - related data of these multiple objects, the feature information of multiple objects, such as attribute characteristic information, can be obtained. For example, the business - related data can be processed, such as cleaning, error - correcting, and merging duplicate data on the business - related data, and then the feature information of multiple objects, such as attribute characteristic information, violation feature information, and transaction feature information, can be extracted from the processed business - related data. Optionally, the feature information of multiple objects can be stored in a database, and when the method for determining abnormal objects needs to be executed, the feature information of multiple objects can be obtained from this database.

[0056] It should be noted that it is also possible to obtain the feature information of multiple objects according to the business - related data only when the method for determining abnormal objects is triggered. The present disclosure does not limit this.

[0057] Step S12: Determine the object corresponding to each attribute feature information and the violation feature information of the corresponding object.

[0058] In the embodiments of this specification, the object corresponding to each attribute feature information can be determined, and then the violation feature information of the corresponding object can be determined. For example, if the attribute feature information is address A, the object corresponding to the address A can be extracted, that is, the object with the address A (attribute feature information) can be extracted. In this way, the object corresponding to the address A can be determined as these extracted objects, and then the feature information of multiple objects can be searched to determine the violation feature information of these extracted objects.

[0059] Step S13: Generate a risk profile corresponding to each attribute feature information according to the object corresponding to each attribute feature information and the violation feature information of the corresponding object.

[0060] In the embodiments of this specification, the violation object corresponding to each attribute feature information can be determined according to the violation feature information of the corresponding object. The violation object can refer to an object with a violation flag of violation, or in other words, the violation object can refer to an object with a violation record. The risk of each attribute feature information can be quantified (i.e., the risk of each attribute feature information can be colored) by the proportion of the violation object in the corresponding object. Thus, a risk profile corresponding to each attribute feature information can be generated according to the quantified risk, the corresponding object, and the violation object, so as to describe the risk of each attribute feature information.

[0061] In the embodiments of this specification, there can be multiple types of attribute feature information, so that a feature risk profile library of multi-dimensional attribute feature information can be generated. The feature risk profile library can include risk profiles corresponding to multi-dimensional attribute feature information respectively.

[0062] Step S14: Generate a risk profile for each object according to the risk profile corresponding to each attribute feature information and the attribute feature information of each object.

[0063] In the embodiments of this specification, for each object, the risk of the object can be characterized by the risks corresponding to the attribute feature information of the object. For example, the attribute feature information of the object can be obtained, and the risks corresponding to each attribute feature information of the object can be obtained from the risk portraits corresponding to each attribute feature information. Then, the risks corresponding to each attribute feature information of the object can be processed. For example, if the risks are quantitative values, they can be added up to obtain the risk of the object. Thus, based on the risk portraits corresponding to the attribute feature information of the object and the risk of the object, the risk portrait of the object can be generated. That is to say, the risk portrait of each object can include the risk portraits corresponding to the attribute feature information of each object and the risk of each object. For multiple objects, risk portraits of multiple objects can be generated, and the risk portraits of the multiple objects can be stored in an object risk portrait library.

[0064] Optionally, steps S13 and S14 can be implemented in Figure 3 the portrait project.

[0065] Step S15, according to the feature information of the multiple objects and the isolation forest algorithm, screen out a first preset number of objects.

[0066] Since the existing isolation forest algorithm generally only focuses on the abnormal objects at the head when used for abnormal screening, in order to avoid this deficiency and discover potential abnormal objects in the middle and tail, the first preset number here can be set to include the objects in the middle and tail obtained by the isolation forest algorithm, which can be set according to the actual situation and experience, and the present disclosure does not limit this.

[0067] In the embodiments of this specification, based on the feature information of multiple objects, the isolation forest algorithm can be used to perform abnormal division on multiple objects. In this abnormal division, an abnormal value will be given for each object. According to the level of this abnormal value, a first preset number of objects can be screened out. For example, 5000 objects can be screened out according to the order of the abnormal values from high to low.

[0068] Step S16, based on the risk portrait of each object, screen out a second preset number of objects from the first preset number of objects.

[0069] In the embodiments of this specification, based on the risk profiles of each object, the risk of each object can be obtained, and the sorting of the first preset number of objects can be adjusted according to the order of the risks of each object from high to low. For example, each object among the first preset number of objects can be sorted comprehensively according to the risk of each object and the outlier value of each object. Based on this sorting, the second preset number of objects can be screened out. For example, a weighted operation can be performed on the risk of each object and the outlier value of each object among the first preset number of objects to obtain the risk weighted value of each object. Then, based on this risk weighted value, the first preset number of objects can be re-sorted from high to low, and the second preset number of objects ranked at the top of this sorting can be obtained. In one example, the 1000 objects ranked at the top of this sorting can be obtained as the initially selected abnormal objects, realizing the initial selection of abnormal objects.

[0070] Step S17: Obtain the transaction profile information corresponding to the second preset number of objects.

[0071] In the embodiments of this specification, the feature information of the second preset number of objects can be utilized. For example, the attribute feature information, violation feature information, and transaction feature information of the second preset number of objects can be utilized to generate the transaction profile information corresponding to the second preset number of objects. In one example, the violation times corresponding to each attribute feature information of the second preset number of objects can be obtained by using the attribute feature information and violation feature information of the second preset number of objects. For example, there are 5 records with violation marks in the records corresponding to phone A, and it can be determined that the violation times corresponding to phone A are 5. Then, by using the violation times corresponding to each attribute feature information and the transaction feature information of the object, each object can be profiled to generate the transaction profile information corresponding to the second preset number of objects. Optionally, the transaction profile information of the object can be stored in the transaction profile library.

[0072] The transaction profile information may refer to the information used to describe the actual transactions of the object. The transaction profile information may include the violation information corresponding to the attribute feature information of the object and the transaction feature information of the object. The transaction feature information of the object may include transaction amount, average customer price, number of transactions, transaction frequency, activity, etc. The present disclosure does not limit the transaction feature information in the transaction profile information, as long as it can effectively represent the transaction behavior of the object.

[0073] In the embodiments of this specification, the transaction profile information corresponding to the second preset number of objects can be obtained from the transaction profile library.

[0074] Step S18: If the transaction profile information meets the preset conditions, determine the object corresponding to the transaction profile information as an abnormal object.

[0075] The preset condition may be preset abnormal feature information. In one example, the preset condition may include abnormal violation information, abnormal transaction feature information, etc., that is, the preset condition mPortrait ∈ {abnormal violation information, abnormal transaction feature information,...}. The abnormal violation information may include the number of violations or the proportion of violations corresponding to the preset attribute feature information. For example, the phone violation > 1 time, the email violation > 1 time, the address violation > 40%; the abnormal transaction feature information may include low object activity, the monthly transaction times < 5 times, etc. In this way, the preset condition mPortrait can be expressed as {the phone violation > 1 time, the email violation > 1 time, the address violation > 40%, low object activity, the monthly transaction times < 5 times,...}. The preset condition here can be pre-designed by the auditor according to experience and actual situations, and the present disclosure does not limit this.

[0076] In the embodiment of this specification, for the initially selected abnormal objects, a further selection process can be performed. Based on whether the transaction portrait information of the second preset number of objects meets the preset condition, the abnormal objects can be screened out. If the transaction portrait information meets the preset condition, the object corresponding to the transaction portrait information is determined as an abnormal object, that is, the object matching the preset condition is screened out from the second preset number of objects as the abnormal object.

[0077] As mentioned above, since it is considered that the violations of objects generally occur in actual transactions and the objects are generally characterized by attribute feature information, the set transaction portrait information corresponding to the object may include the violation information corresponding to the attribute feature information of the object and the transaction feature information of the object. It should be noted that in one example, the set transaction portrait information corresponding to the object may also include the transaction feature information of the object. Then, it can be determined whether the transaction portrait information corresponding to the second preset number of objects and the violation information corresponding to the attribute feature information of the second preset number of objects meet the preset condition, and the objects that meet the preset condition can be determined as abnormal objects.

[0078] Optionally, in practical applications, it can be at Figure 3The method for implementing steps S15 - S18 in the automated audit model to obtain abnormal objects. The determined abnormal objects can also be submitted to business personnel for re - confirmation to determine the abnormal objects. An abnormal object library or a blacklist object library can be established, etc., to improve the feature information of the objects. The abnormal objects, abnormal object library, blacklist object library, etc. can be fed back to the auditors through the merchant quality management system, enabling the auditors to optimize the feature information extraction method of the objects and the method for determining abnormal objects based on the abnormal objects, abnormal object library, blacklist object library, etc., and further improving the automated audit process of the objects. Among them, the determined abnormal objects can be periodically submitted to business personnel for re - confirmation, and the length of this period can be determined according to actual needs, which is not limited in this disclosure. It should be noted that the following determination of abnormal types and marking of abnormal objects can all be performed in this automated audit model.

[0079] Describe the risk of each object through the risk corresponding to the attribute feature information of each object, and based on the risk portrait of each object, conduct a preliminary selection of the first preset number of objects screened by the isolation forest algorithm, so that the objects at the tail of the isolation forest algorithm can be fully mined; and conduct a refined selection according to the transaction portrait information of each object and preset conditions to determine abnormal objects, and conduct a secondary screening of the initially selected objects to ensure the accuracy rate of determining abnormal objects, realizing the automated audit of combining portrait technology and the isolation forest algorithm to determine abnormal objects, achieving the purpose of automatically and efficiently determining abnormal objects with a high accuracy rate, thus greatly liberating manpower, accelerating audit discovery, increasing the audit volume and the coverage of audit targets, and effectively purifying the business ecosystem;

[0080] In addition, introducing portrait technology into the audit field can realize the risk tagging and concretization of objects, and in the risk portrait of objects, introducing multi - dimensional risk assessment of objects can not only discover high - risk objects but also discover gang objects.

[0081] Figure 3 Show the method flow chart for generating the risk portrait corresponding to each attribute feature information according to the object corresponding to each attribute feature information and the violation feature information of the corresponding object according to an embodiment of the present disclosure, as Figure 3 shown. In a possible implementation manner, step S13 may include:

[0082] Step S131, determine the first quantity of the objects corresponding to each attribute feature information.

[0083] In the embodiments of this specification, taking the object as a merchant as an example, for example, one attribute feature information is address A, and there are 100 merchants corresponding to this address A. The first quantity of the merchants corresponding to address A can be determined to be 100.

[0084] Step S132: Determine the second quantity of the violation objects corresponding to each attribute feature information according to the violation feature information of the corresponding object.

[0085] In the embodiment of this specification, the violation objects corresponding to each attribute feature information can be determined according to the violation feature information of the corresponding object, and then the second quantity of the violation objects can be determined. Continuing with the above example of address A, the merchants with violations among the 100 merchants corresponding to address A can be determined according to the violation feature information of these 100 merchants. If the number of merchants with past violations is 30, then 30 can be the second quantity.

[0086] Step S133: Determine the risk value corresponding to each attribute feature information according to the first quantity and the second quantity.

[0087] In the embodiment of this specification, the violation ratio corresponding to each attribute feature information can be obtained according to the first quantity and the second quantity. For example, the ratio of the violating merchants can be used as the risk value corresponding to each attribute feature information.

[0088] In one example, the first quantity and the second quantity can be smoothed. For example, the first quantity can be smoothed using the first adjustment parameter, and the second quantity can be smoothed using the second adjustment parameter. Thus, the risk value corresponding to each attribute feature information can be determined using the smoothed first quantity and the smoothed second quantity. For example, the risk value corresponding to each attribute feature information can be determined using the following formula (1).

[0089]

[0090] where, d i represents the risk value corresponding to the i-th attribute feature information, n represents the first quantity, k represents the second quantity, α is the first adjustment parameter, and β is the second adjustment parameter. In a specific example, α can be less than β. For example, α can be 0.03 and β can be 2.

[0091] In practical applications, the α and β can be determined according to actual requirements and empirical tests. The reason for setting α and β is mainly that the first quantity and the second quantity corresponding to each attribute feature information may vary greatly and are not in the same order of magnitude. For example, for phone A, the first quantity is 100 and the second quantity is 30; for phone B, the first quantity is 2 and the second quantity is 1. In this case, the first quantity and the second quantity corresponding to phone A and the first quantity and the second quantity corresponding to phone B are not in the same order of magnitude. If no smoothing is performed using the first adjustment parameter and the second adjustment parameter, it will be considered that the risk value of phone B is much higher than that of phone A. It is unreasonable to directly compare quantities of different orders of magnitude in this way. Therefore, adjustment parameters (the first adjustment parameter and the second adjustment parameter) are introduced to eliminate the influence of different orders of magnitude on the risk value, and the calculation of the risk value can be more reasonable and effective.

[0092] Step S134: Generate a risk portrait corresponding to each attribute feature information according to the first quantity, the second quantity, and the risk value corresponding to each attribute feature information.

[0093] That is to say, the first quantity of the object corresponding to each attribute feature information, the second quantity of the non-compliant object, and the risk value corresponding to each attribute feature information can be used as the risk portrait corresponding to each attribute feature information. For example, the risk portrait of phone A may include: the first quantity of the merchants corresponding to phone A, the second quantity of the non-compliant merchants corresponding to phone A, and the risk value of phone A.

[0094] By determining the risk value corresponding to each attribute feature information according to the first quantity and the second quantity to generate a risk portrait corresponding to each attribute feature information, the risk of each attribute feature information can be effectively described.

[0095] Figure 4 The flowchart of the method for generating a risk portrait of each object according to the risk portrait corresponding to each attribute feature information and the attribute feature information of each object according to an embodiment of the present disclosure is shown. In a possible implementation, as Figure 4 shown, step S14 may include:

[0096] Step S141: Obtain a risk portrait corresponding to the attribute feature information of each object according to the risk portrait corresponding to each attribute feature information.

[0097] Step S142: Obtain the risk value corresponding to the attribute feature information of each object according to the risk portrait corresponding to the attribute feature information of each object.

[0098] In the embodiments of this specification, the risk portraits corresponding to the attribute feature information of each object can be obtained from the risk portraits corresponding to each attribute feature information, and then the risk values corresponding to the attribute feature information of each object can be obtained. For example, if the attribute feature information of a merchant includes address A, the risk portrait corresponding to address A can be searched to obtain the risk value corresponding to address A. For other attribute feature information of the merchant, the corresponding risk values can be obtained in the same way.

[0099] Step S143: Determine the risk value of each object according to the risk value corresponding to the attribute feature information of each object.

[0100] In the embodiments of this specification, the risk of each object can be quantified by using the risk value corresponding to the attribute feature information of each object, so as to determine the risk value of each object.

[0101] In one example, after obtaining the risk values corresponding to the attribute feature information of each object, these risk values can be added or otherwise calculated to obtain the risk value of each object. The specific manner of this calculation is not limited in this disclosure, as long as the calculation can effectively represent the risk of each object.

[0102] In another example, the risk value of each object can be determined by using the following formula (2).

[0103]

[0104] Among them, R m represents the risk value of object m, i represents the i-th attribute feature information of object m, h represents the number of attribute feature information of object m, and d i represents the risk value corresponding to the i-th attribute feature information of object m.

[0105] Here, the log processing is mainly considered because the log is a non-linear growth curve, which can offset the influence caused by too large differences in the risk values corresponding to each attribute feature information, and can meet the actual needs of effectively representing different risks in different violation situations.

[0106] Step S144: Generate the risk portrait of each object according to the risk portrait corresponding to the attribute feature information of each object and the risk value of each object.

[0107] In the embodiments of this specification, each object can be portrayed by using the risk portrait corresponding to the attribute feature information of each object and the risk value of each object to generate the risk portrait of each object, so as to describe the risk of each object through portrait technology.

[0108] By determining the risk value of each object based on the risk value corresponding to the attribute feature information of each object to generate a risk profile of each object, the risk of each object can be effectively described. Moreover, since gang objects, such as gang merchants, generally have the same attribute feature information, the risk values of gang merchants will be relatively close. Furthermore, based on the risk profile of each object, gang merchants can be effectively discovered.

[0109] Figure 5 The flowchart shows a method for selecting a second preset number of objects from the first preset number of objects based on the risk profile of each object according to an embodiment of the present disclosure. In a possible implementation manner, step S16 may include:

[0110] Step S161, sorting the first preset number of objects based on the risk profile of each object;

[0111] Step S162, selecting a second preset number of objects from the first preset number of objects according to the sorting.

[0112] In the embodiments of the present specification, the risk values corresponding to the first preset number of objects can be obtained based on the risk profile of each object, and the first preset number of objects can be sorted according to the risk values corresponding to the first preset number of objects. For example, the first preset number of objects can be sorted according to the order of the risk values from high to low. Then, a second preset number of objects can be selected from the first preset number of objects according to the sorting. Thus, a second preset number of objects with relatively high risk values (frontier risk values) can be initially screened (primary selection), and these second preset number of objects can be used as suspicious objects.

[0113] Based on the risk profile of each object, the first preset number of objects selected by the isolation forest algorithm is re-sorted, and then a second preset number of objects is selected according to the re-sorting. By combining the risk profile of the object with the isolation forest algorithm to initially screen suspicious objects, the abnormal objects at the tail of the isolation forest can be effectively screened out, avoiding the drawback that the existing isolation forest algorithm cannot detect the abnormal objects at the tail with relatively small abnormal values, and realizing the full mining of abnormal objects.

[0114] Figure 7 The flowchart shows the abnormal object determination method according to an embodiment of the present disclosure. As Figure 7 shown, in a possible implementation manner, the method may further include:

[0115] Step S71, determining the abnormal type of each object according to the attribute feature information of each object and the violation feature information of each object.

[0116] In one example, the violation feature information of each object may include the violation type. As Figure 7 shown, step S71 may include the following steps:

[0117] Step S711, determining the attribute feature information associated with the violation type of each object.

[0118] In the embodiments of this specification, assume that the violation types corresponding to object m1 include gambling, porn, and cash-out. The attribute feature information of object m1 associated with (corresponding to) the violation types can be obtained respectively. Specifically, assume that the attribute feature information associated with the violation types of object m1 is shown in Table 1 below. Two pieces of attribute feature information associated with gambling of object m1 can be obtained: address and phone number; two pieces of attribute feature information associated with cash-out of object m1 can be obtained: address and phone number; one piece of attribute feature information associated with porn of object m1 can be obtained: address.

[0119] Table 1

[0120] Object Violation type Attribute feature information m1 Gambling Address m1 Gambling Phone m1 Cash-out Address m1 Cash-out Phone m1 Pornography Address

[0121] Step S712, determining the violation probability corresponding to the violation type of each object according to the associated attribute feature information.

[0122] In one example, the violation ratio under a certain violation type corresponding to the attribute feature information of each object can be determined, and the violation probability corresponding to the violation type of each object can be determined through this violation ratio. For example, the following formulas (3) and (4) can be used to determine the violation probability corresponding to the violation type of each object.

[0123]

[0124]

[0125] Among them, T(m,j) represents the violation probability corresponding to the j-th violation type of object m, l is the number of pieces of attribute feature information associated with the j-th violation type of object m, q is the total number of pieces of attribute feature information associated with the violation types of object m; P(j,i) is the violation ratio of the j-th violation type corresponding to the i-th attribute feature information of object m, n is the first number of the object corresponding to the i-th attribute feature information of object m, and Kj is the number of objects belonging to the j-th violation type among the first number.

[0126] For example, taking Table 1 as an example, it is assumed that the violation types of object m1 include: gambling, cashing out and pornography. The gambling violation type of object (merchant) m1 is associated with the address and phone number, then the total number q of attribute feature information associated with the violation type of object m1 is 2. Among them, the first number n of merchants corresponding to the phone number is 100, and there are 50 gambling merchants among the 100 merchants, then the gambling violation ratio corresponding to the phone attribute feature information is 50 / 100, as shown in Table 2; the first number n of merchants corresponding to the address is 100, and there are 70 gambling merchants among the 100 merchants, then the gambling violation ratio corresponding to the address attribute feature information is 70 / 100, as shown in Table 2. Based on the same method, the results of Table 2 can be obtained. Among them, the violation ratio in Table 2 can refer to the violation ratio of a certain violation type corresponding to a certain attribute feature information. The value of the violation ratio here is only an example.

[0127] Table 2

[0128] Object Violation type Attribute feature information Violation ratio m1 Gambling Address 70％ m1 Gambling Phone 50％ m1 Cash-out Address 20％ m1 Cash-out Phone 30％ m1 Pornography Address 30％

[0129] Then, according to formula (3), the violation probability corresponding to the gambling violation type of object m1 can be determined to be (50 / 100+70 / 100) / 2=60%. Based on the same method, the violation probability corresponding to the cash-out violation type of object m1 can be determined to be (20%+30%) / 2=25%; the violation probability corresponding to the pornography violation type of object m1 can be determined to be 30% / 2=15%, as shown in Table 3.

[0130] Table 3

[0131]

[0132] Optionally, the denominator in formula (4) may be smoothed, and the smoothed formula (4) may be as follows:

[0133]

[0134] Wherein, w may be a smoothing parameter, which is used to smooth the case where the denominator is 0. The w may be 1 or other values greater than 0, which is not limited in the present disclosure.

[0135] Step S713: determining the abnormality type of each object according to the violation probability.

[0136] As shown in Table 3, assuming that the violation probability corresponding to the gambling of object m1 is 60%, the violation probability corresponding to the cash-out of object m1 is 25%, and the violation probability corresponding to the porn of object m1 is 15%, then according to the maximum probability criterion, the abnormal type of object m1 can be determined as gambling. Step S72, according to the risk profile of each object and the abnormal type of each object, determine the profile of each object.

[0137] The profile of each object here can comprehensively describe each object from the risk and abnormal type of the object, making the information described by the profile of the object more comprehensive. Further, in order to make the information included in the profile of the object more comprehensive, the isolation forest sorting of the object, the transaction profile information, and the violation probability corresponding to the violation type can also be used to describe the profile of the object. Taking object m1 as an example, the profile of m1 can be as shown in Table 4. The a1, b1, c1, d1, e1 and specific values in this Table 4 are only examples and do not limit the present disclosure.

[0138] Table 4

[0139]

[0140] Optionally, the method may further include: marking the abnormal object according to the abnormal type of each object.

[0141] It should be noted that step S71 may be performed before step S16, that is, the abnormal type of each object can be determined when generating the risk profile of each object.

[0142] By automatically determining the abnormal type of the object, not only the efficiency of determining the abnormal type is improved, but also the initially selected and carefully selected objects can be labeled with the abnormal type label, so that the violation situations of the initially selected and carefully selected objects can be more accurately grasped, and the abnormal objects with the abnormal type label can also be discovered.

[0143] Figure 9 The block diagram of the abnormal object determination device according to an embodiment of the present disclosure is shown. As Figure 9 shown, the abnormal object determination device may include:

[0144] A feature information acquisition module 11, configured to acquire the feature information of multiple objects, where the feature information of each object includes attribute characteristic information and violation feature information;

[0145] A first determination module 12, configured to determine the object corresponding to each attribute feature information and the violation feature information of the corresponding object;

[0146] The risk profile generation module 13 corresponding to the attribute feature information is used to generate a risk profile corresponding to each attribute feature information according to the object corresponding to each attribute feature information and the violation feature information of the corresponding object;

[0147] The risk profile generation module 14 of the object is used to generate a risk profile of each object according to the risk profile corresponding to each attribute feature information and the attribute feature information of each object;

[0148] The first screening module 15 is used to screen out a first preset number of objects according to the feature information of the multiple objects and the isolation forest algorithm;

[0149] The second screening module 16 is used to screen out a second preset number of objects from the first preset number of objects based on the risk profile of each object;

[0150] The transaction profile information acquisition module 17 is used to acquire the transaction profile information corresponding to the second preset number of objects;

[0151] The second determination module 18 is used to determine the object corresponding to the transaction profile information as an abnormal object if the transaction profile information meets the preset conditions.

[0152] Describe the risk of each object through the risk corresponding to the attribute feature information of each object, and based on the risk profile of each object, conduct a primary selection of the first preset number of objects screened by the isolation forest algorithm, so that the objects at the end of the isolation forest algorithm can be fully mined; and conduct a refined selection according to the transaction profile information of each object and the preset conditions to determine abnormal objects, and conduct a secondary screening of the initially selected objects to ensure the accuracy rate of determining abnormal objects, realizing the automated audit of combining the profiling technology and the isolation forest algorithm to determine abnormal objects, achieving the purpose of automatically and efficiently determining abnormal objects with a high accuracy rate, thus greatly liberating manpower, accelerating audit discovery, increasing the audit volume and the coverage of audit targets, and effectively purifying the business ecosystem;

[0153] In addition, introducing the profiling technology into the audit field can realize the risk tagging and concretization of objects, and in the risk profile of objects, introducing the multi-dimensional risk assessment of objects can not only discover high-risk objects but also discover gang objects.

[0154] In a possible implementation manner, the risk profile generation module 13 corresponding to the attribute feature information may include:

[0155] The first quantity determination unit is used to determine the first quantity of the objects corresponding to each attribute feature information;

[0156] A second quantity determination unit, configured to determine a second quantity of the violation objects corresponding to each of the attribute feature information according to the violation feature information of the corresponding object;

[0157] A first risk value determination unit, configured to determine a risk value corresponding to each of the attribute feature information according to the first quantity and the second quantity;

[0158] A first risk profile determination unit, configured to generate a risk profile corresponding to each of the attribute feature information according to the first quantity, the second quantity, and the risk value corresponding to each of the attribute feature information.

[0159] In a possible implementation manner, the risk profile generation module 14 of the object may include:

[0160] A risk profile acquisition unit, configured to acquire a risk profile corresponding to the attribute feature information of each object according to the risk profile corresponding to each of the attribute feature information;

[0161] A risk value acquisition unit, configured to acquire a risk value corresponding to the attribute feature information of each object according to the risk profile corresponding to the attribute feature information of each object;

[0162] A second risk value determination unit, configured to determine a risk value of each object according to the risk value corresponding to the attribute feature information of each object;

[0163] An object risk profile generation unit, configured to generate a risk profile of each object according to the risk profile corresponding to the attribute feature information of each object and the risk value of each object.

[0164] In a possible implementation manner, the second screening module 16 may include:

[0165] A sorting unit, configured to sort the first preset quantity of objects based on the risk profile of each object;

[0166] A screening unit, configured to select a second preset quantity of objects from the first preset quantity of objects according to the sorting.

[0167] In a possible implementation manner, the apparatus may further include:

[0168] An abnormal type determination module, configured to determine an abnormal type of each object according to the attribute feature information of each object and the violation feature information of each object;

[0169] An object profile determination module, configured to determine a profile of each object according to the risk profile of each object and the abnormal type of each object.

[0170] In one possible implementation, the device may further include:

[0171] An abnormal object marking module, configured to mark the abnormal object according to the abnormal type of each object.

[0172] In one possible implementation, the abnormal type determination module may include:

[0173] An associated attribute feature information determination unit, configured to determine the attribute feature information associated with the violation type of each object;

[0174] A violation probability determination unit, configured to determine the violation probability corresponding to the violation type of each object according to the associated attribute feature information;

[0175] An abnormal type determination unit, configured to determine the abnormal type of each object according to the violation probability.

[0176] Figure 10 A block diagram showing an abnormal object determination device 1000 according to an embodiment of the present disclosure. For example, the device 1000 may be provided as a server. Refer to Figure 10 , the device 1000 includes a processing component 1022, which further includes one or more processors, and memory resources represented by a memory 1032 for storing instructions executable by the processing component 1022, such as application programs. The application programs stored in the memory 1032 may include one or more modules each corresponding to a set of instructions. In addition, the processing component 1022 is configured to execute instructions to perform the above method.

[0177] The device 1000 may further include a power supply component 1026 configured to perform power management of the device 1000, a wired or wireless network interface 1050 configured to connect the device 1000 to a network, and an input / output (I / O) interface 1058. The device 1000 may operate based on an operating system stored in the memory 1032, such as Windows ServerTM, MacOS XTM, UnixTM, LinuxTM, FreeBSDTM or the like.

[0178] In an exemplary embodiment, a non-volatile computer-readable storage medium is further provided, such as the memory 1032 including computer program instructions, and the above computer program instructions can be executed by the processing component 1022 of the device 1000 to complete the above method.

[0179] The present disclosure may be a system, method, and / or computer program product. The computer program product may include a computer-readable storage medium having thereon computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0180] A computer-readable storage medium can be a tangible device that can hold and store instructions for use by an instruction execution device. A computer-readable storage medium may be, for example—but not limited to—an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer-readable storage medium include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disc (DVD), a memory stick, a floppy disk, a mechanically encoded device such as a punched card or raised structures in grooves having instructions stored thereon, and any suitable combination of the foregoing. The computer-readable storage medium as used herein is not construed as being a transitory signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., an optical pulse through an optical fiber cable), or an electrical signal transmitted through a wire.

[0181] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to respective computing / processing devices, or can be downloaded to an external computer or an external storage device through a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network may include a copper transmission cable, an optical fiber transmission, a wireless transmission, a router, a firewall, a switch, a gateway computer, and / or an edge server. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium in each computing / processing device.

[0182] The computer program instructions for performing the operations of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine - related instructions, microcode, firmware instructions, state - setting data, or source code or object code written in any combination of one or more programming languages, including object - oriented programming languages such as Smalltalk, C++, etc., and conventional procedural programming languages such as the "C" language or similar programming languages. The computer - readable program instructions may be executed entirely on the user's computer, partially on the user's computer, executed as a stand - alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via an Internet service provider through the Internet). In some embodiments, by using the state information of the computer - readable program instructions to customize an electronic circuit, such as a programmable logic circuit, a field - programmable gate array (FPGA), or a programmable logic array (PLA), the electronic circuit can execute the computer - readable program instructions to implement various aspects of the present disclosure.

[0183] Aspects of the present disclosure are described herein with reference to the flowchart and / or block diagram of methods, apparatus (systems), and computer program products according to embodiments of the present disclosure. It should be understood that each block of the flowchart and / or block diagram, and combinations of blocks in the flowchart and / or block diagram, can be implemented by computer - readable program instructions.

[0184] These computer - readable program instructions can be provided to a processor of a general - purpose computer, a special - purpose computer, or other programmable data - processing apparatus to produce a machine such that when the instructions are executed by the processor of the computer or other programmable data - processing apparatus, a device is created that implements the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer - readable program instructions can also be stored in a computer - readable storage medium, which causes a computer, a programmable data - processing apparatus, and / or other devices to operate in a particular manner, so that the computer - readable medium storing the instructions includes a manufacture comprising instructions for implementing various aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0185] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device, causing a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process such that the instructions executed on the computer, other programmable data processing apparatus, or other device implement the functions / acts specified in one or more boxes of the flowchart and / or block diagram.

[0186] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagram may represent a module, a segment of code, or a portion of an instruction, which contains one or more executable instructions for implementing the specified logical function. In some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two consecutive blocks may in fact be executed substantially in parallel, or they may sometimes be executed in the reverse order, depending upon the functionality involved. It should also be noted that each block of the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented by a dedicated hardware-based system that performs the specified functions or acts, or by a combination of dedicated hardware and computer instructions.

[0187] The embodiments of the present disclosure have been described above. The above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The choice of terms used herein is intended to best explain the principles of the embodiments, the practical application, or improvements made to the technology in the market, or to enable other ordinary skilled persons in the art to understand the embodiments disclosed herein.

Claims

1. An abnormal object determination method, characterized in that, Including: Obtain the feature information of multiple objects, where the feature information of each object includes attribute characteristic information and violation feature information; Determine the object corresponding to each attribute feature information and the violation feature information of the corresponding object; Generate a risk profile corresponding to each attribute feature information according to the object corresponding to each attribute feature information and the violation feature information of the corresponding object; Generate a risk profile for each object according to the risk profile corresponding to each attribute feature information and the attribute feature information of each object; Filter out a first preset number of objects according to the feature information of the multiple objects and the isolation forest algorithm; the first preset number of objects includes the objects in the middle and at the tail obtained by the isolation forest algorithm; Based on the risk profile of each object, filter out a second preset number of objects from the first preset number of objects; the second preset number of objects is in the front in the adjusted sorting, and the adjusted sorting refers to adjusting the sorting of the first preset number of objects according to the order of the risks corresponding to the risk profiles of each object; Obtain the transaction profile information corresponding to the second preset number of objects; From the second preset number of objects, filter out the objects corresponding to the transaction profile information that matches the preset conditions as abnormal objects.

2. The method according to claim 1, characterized in that, The generating a risk profile corresponding to each attribute feature information according to the object corresponding to each attribute feature information and the violation feature information of the corresponding object includes: Determine the first number of objects corresponding to each attribute feature information; Determine the second number of violating objects corresponding to each attribute feature information according to the violation feature information of the corresponding object; Determine the risk value corresponding to each attribute feature information according to the first number and the second number; Generate a risk profile corresponding to each attribute feature information according to the first number, the second number, and the risk value corresponding to each attribute feature information.

3. The method according to claim 1, wherein The generating a risk profile for each object according to the risk profile corresponding to each attribute feature information and the attribute feature information of each object includes: Obtain the risk profile corresponding to the attribute feature information of each object according to the risk profile corresponding to each attribute feature information; Obtain the risk value corresponding to the attribute feature information of each object according to the risk profile corresponding to the attribute feature information of each object; Determine the risk value of each object according to the risk value corresponding to the attribute feature information of each object; Generate a risk profile for each object according to the risk profile corresponding to the attribute feature information of each object and the risk value of each object.

4. The method according to claim 1, wherein The selecting a second preset number of objects from the first preset number of objects based on the risk profile of each object includes: Sort the first preset number of objects based on the risk profile of each object; Select a second preset number of objects from the first preset number of objects according to the sorting.

5. The method according to claim 1, wherein The method further includes: Determine the abnormal type of each object according to the attribute feature information of each object and the violation feature information of each object; A profile of each object is determined according to the risk profile of each object and the abnormality type of each object.

6. The method according to claim 5, characterized in that Also includes: According to the abnormal type of each object, the abnormal object is marked.

7. The method according to claim 5, wherein The violation feature information of each object includes a violation type; and determining the abnormality type of each object according to the attribute feature information of each object and the violation feature information of each object includes: Determining attribute feature information associated with the violation type of each object; Determining the violation probability corresponding to the violation type of each object according to the associated attribute feature information; According to the violation probability, the abnormality type of each object is determined.

8. An abnormal object determination device, characterized in that, include: A feature information acquisition module is used to acquire feature information of multiple objects, where the feature information of each object includes attribute characteristic information and violation feature information; A first determination module is used to determine the object corresponding to each attribute feature information and the violation feature information of the corresponding object; A risk profile generation module corresponding to the attribute characteristic information, used to generate a risk profile corresponding to each attribute characteristic information according to the object corresponding to each attribute characteristic information and the violation characteristic information of the corresponding object; An object risk profile generation module, used to generate a risk profile of each object according to the risk profile corresponding to each attribute feature information and the attribute feature information of each object; A first screening module, configured to screen out a first preset number of objects according to the feature information of the plurality of objects and the isolation forest algorithm; the first preset number of objects includes the middle and tail objects obtained by the isolation forest algorithm; A second screening module is used to screen out a second preset number of objects from the first preset number of objects based on the risk profile of each object; the second preset number of objects are at the front in the adjusted order, and the adjusted order refers to adjusting the order of the first preset number of objects according to the high and low order of risk corresponding to the risk profile of each object; A transaction portrait information acquisition module, used to acquire transaction portrait information corresponding to the second preset number of objects; The second determination module is used to filter out objects corresponding to the transaction portrait information that matches the preset conditions from the second preset number of objects as abnormal objects.

9. The device according to claim 8, wherein, The risk profile generation module corresponding to the attribute feature information includes: A first quantity determining unit, used to determine a first quantity of objects corresponding to each attribute feature information; A second quantity determining unit, configured to determine a second quantity of illegal objects corresponding to each attribute characteristic information according to the illegal characteristic information of the corresponding object; A first risk value determining unit, configured to determine a risk value corresponding to each attribute feature information according to the first quantity and the second quantity; The first risk profile determination unit is used to generate a risk profile corresponding to each attribute feature information according to the first quantity, the second quantity and the risk value corresponding to each attribute feature information.

10. The device according to claim 8, characterized in that, The risk profile generation module of the object includes: A risk profile acquisition unit, configured to acquire the risk profiles corresponding to the attribute feature information of each object according to the risk profiles corresponding to the attribute feature information of each object; A risk value acquisition unit, configured to acquire the risk values corresponding to the attribute feature information of each object according to the risk profiles corresponding to the attribute feature information of each object; A second risk value determination unit, configured to determine the risk values of each object according to the risk values corresponding to the attribute feature information of each object; A risk profile generation unit of an object, configured to generate the risk profiles of each object according to the risk profiles corresponding to the attribute feature information of each object and the risk values of each object.

11. The device according to claim 8, characterized in that, The second screening module includes: A sorting unit, configured to sort the first preset number of objects based on the risk profiles of each object; A screening unit, configured to select a second preset number of objects from the first preset number of objects according to the sorting.

12. The device according to claim 8, characterized in that, The apparatus further includes: An abnormal type determination module, configured to determine the abnormal type of each object according to the attribute feature information of each object and the violation feature information of each object; An object profile determination module, configured to determine the profile of each object according to the risk profile of each object and the abnormal type of each object.

13. The device according to claim 12, characterized in that, The apparatus further includes: An abnormal object marking module, configured to mark the abnormal objects according to the abnormal type of each object.

14. The device according to claim 12, characterized in that, The abnormal type determination module includes: An associated attribute feature information determination unit, configured to determine the attribute feature information associated with the violation type of each object; A violation probability determination unit, configured to determine the violation probability corresponding to the violation type of each object according to the associated attribute feature information; An abnormal type determination unit, configured to determine the abnormal type of each object according to the violation probability.

15. An abnormal object determination device, characterized in that, It includes: A processor; A memory for storing processor-executable instructions; Wherein, the processor is configured to: Implement the method according to any one of claims 1 to 7 when executing the executable instructions.

16. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that, The computer program instructions, when executed by the processor, implement the method according to any one of claims 1 to 7.

17. A computer program product, characterized in that, It includes computer instructions, which, when executed by the processor, cause the computer to execute the method according to any one of claims 1 to 7.

Images