Information Leakage Identification Method, Device and Readable Storage Medium Based on Clustering Algorithm

Abstract

The present invention provides a method, apparatus, system and readable storage medium for identifying information leakage based on a clustering algorithm. The method includes: obtaining fraud transaction data, creating a card-merchant sample according to the fraud transaction data; constructing multi-dimensional features of the card-merchant sample based on historical fraud transaction data within a preset time range; clustering the constructed card-merchant sample based on the DBSCAN clustering algorithm and the multi-dimensional features to identify abnormal sample classifications; analyzing the abnormal sample classifications to identify potential information leakage parties. By using the above method, information leakage events can be identified more quickly and effectively.

Description

Technical Field

[0001] The present invention belongs to the field of computer software, and particularly relates to a method, device and readable storage medium for identifying information leakage based on a clustering algorithm. Background Art

[0002] This section aims to provide background or context for the embodiments of the present invention described in the claims. The description herein is not admitted to be prior art merely by virtue of its inclusion in this section.

[0003] In recent years, fraud incidents caused by information leakage have been increasing day by day, and are diverse, showing trends such as high occurrence frequency, large scale, and industrialization of attacks. The parties related to information leakage incidents include large hotels, airlines, chain department stores, acquiring agents, unlicensed payment APPs, etc., both domestic and overseas, both core systems and peripheral systems. Hackers at home and abroad frequently attack the systems of various merchants, payment institutions, and peripheral related service providers to steal account information, and then sell it at a marked price in the "black market", causing serious losses to all parties in the industry.

[0004] In recent years, there have been multiple incidents in the payment industry suspected of information leakage leading to subsequent concentrated overseas card skimming. Peripheral cooperation institutions such as acquiring sub-agents and unlicensed payment APPs have become a disaster area for information leakage risks. Peripheral cooperation institutions are institutions that do not directly access the payment network but can access bank card transaction information. They have problems such as high concealment, connecting multiple acquirers and merchants at the same time, and little investigation information, which bring great difficulties to the detection and identification of information leakage points. The time from the occurrence of the case to the confirmation of the information leakage case is too long, and measures cannot be taken immediately after the occurrence of the case, resulting in huge losses that cannot be recovered. Information leakage incidents face problems such as the lack of a specific early warning mechanism and lag in discovery and identification.

[0005] Therefore, how to more quickly and efficiently identify information leakage cases of clearing institutions is an urgent problem to be solved. Summary of the Invention

[0006] In view of the problems existing in the above-mentioned prior art, a method, device and computer-readable storage medium for identifying information leakage based on a clustering algorithm are proposed. Using this method, device and computer-readable storage medium, the above problems can be solved.

[0007] The present invention provides the following solutions.

[0008] In a first aspect, a method for identifying information leakage based on a clustering algorithm is provided, including: obtaining fraud transaction data, and creating card-merchant samples according to the fraud transaction data; constructing multi-dimensional features of the card-merchant samples based on historical fraud transaction data within a preset time range; clustering the constructed card-merchant samples based on the DBSCAN clustering algorithm and the multi-dimensional features to identify abnormal sample classifications; analyzing the abnormal sample classifications to identify potential information leakage parties.

[0009] In one embodiment, it further includes: determining the multi-dimensional features of the card-merchant samples according to the number of fraud transactions involved by one or more dimensional objects corresponding to the card and / or merchant in the historical fraud transaction data.

[0010] In one embodiment, the multi-dimensional features of the card-merchant samples include one or more of the following: merchant dimension features, country dimension features, card-issuing institution dimension features, acquirer dimension features, card attribute dimension features, transaction date dimension features.

[0011] In one embodiment, it further includes: determining the value of the merchant dimension feature according to the number of fraud transactions corresponding to the merchant in the historical fraud transaction data; and / or determining the value of the country dimension feature according to the number of fraud transactions corresponding to the country where the merchant is located in the historical fraud transaction data; and / or determining the value of the acquirer dimension feature according to the number of fraud transactions corresponding to the acquirer corresponding to the merchant in the historical fraud transaction data; and / or determining the value of the card-issuing institution dimension feature according to the number of fraud transactions corresponding to the card-issuing institution corresponding to the card in the historical fraud transaction data.

[0012] In one embodiment, it further includes: determining the transaction date dimension feature according to the transaction time information of the fraud transaction events corresponding to the card and / or merchant in the historical fraud transaction data.

[0013] In one embodiment, it further includes: determining the transaction date dimension feature according to the mean value of the transaction time information of the fraud transaction events corresponding to the card and / or merchant in the historical fraud transaction data.

[0014] In one embodiment, the card attribute dimension feature indicates the category of the card

[0015] In one embodiment, before creating the card-merchant samples, the method further includes: preprocessing the fraud transaction data, and the preprocessing includes: duplicate removal processing and / or missing value removal processing.

[0016] In one embodiment, clustering the constructed card-merchant samples based on the DBSCAN clustering algorithm and multi-dimensional features further includes: clustering based on the constructed multi-dimensional features using the DBSCAN clustering algorithm to cluster the constructed multiple card-merchant samples into multiple sample classifications; among the multiple sample classifications, regarding one or more sample classifications whose sample quantity meets a preset condition as abnormal sample classifications; the preset abnormal conditions include: being greater than the average sample quantity of the multiple sample classifications; and / or, being among the top N in terms of the sample quantity of the multiple sample classifications, where N is an integer greater than 0.

[0017] In one embodiment, analyzing the abnormal sample classifications to obtain potential information leakage parties further includes: determining the aggregation situation of any one or more of the following objects in the abnormal sample classifications: cards, merchants, card-issuing institutions, acquiring institutions; and determining potential information leakage parties based on the aggregation situation.

[0018] In a second aspect, there is provided an information leakage identification device based on a clustering algorithm, configured to execute the method of the first aspect. The device includes: a sample creation module, configured to obtain fraud transaction data and create card-merchant samples according to the fraud transaction data; a feature construction module, configured to construct multi-dimensional features of the card-merchant samples based on historical fraud transaction data within a preset time range; a clustering module, configured to cluster the constructed card-merchant samples based on the DBSCAN clustering algorithm and multi-dimensional features to identify abnormal sample classifications; and an identification module, configured to analyze the abnormal sample classifications to identify potential information leakage parties.

[0019] In a third aspect, there is provided an information leakage identification device based on a clustering algorithm, including: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and when the instructions are executed by the at least one processor, the at least one processor is enabled to execute: the method as in the first aspect.

[0020] In a fourth aspect, there is provided a computer-readable storage medium storing a program, which when executed by a multi-core processor, enables the multi-core processor to execute the method as in the first aspect.

[0021] One of the advantages of the above embodiments is that by constructing special "card-merchant" samples, the interference of large merchants can be eliminated. By combining the historical fraud features of both "cards" and "merchants" in the samples through feature engineering, and further using the DBSCAN unsupervised clustering algorithm to find groups with similar fraud features from the constructed multiple samples, and regarding the larger-scale groups as sample classifications suspected of information leakage, potential information leakage events can be automatically detected and identified more effectively and quickly.

[0022] Other advantages of the present invention will be explained in more detail in conjunction with the following description and drawings.

[0023] It should be understood that the above description is only an overview of the technical solution of the present invention, so as to be able to more clearly understand the technical means of the present invention, and thus it can be implemented in accordance with the content of the specification. In order to make the above and other objects, features and advantages of the present invention more obvious and understandable, the following specifically illustrates the specific implementation manners of the present invention. Brief Description of the Drawings

[0024] By reading the following detailed description of the exemplary embodiments, those of ordinary skill in the art will understand the advantages and benefits herein as well as other advantages and benefits. The drawings are only for the purpose of illustrating the exemplary embodiments and are not considered to be a limitation of the present invention. Moreover, throughout the drawings, the same reference numerals are used to represent the same components. In the drawings:

[0025] Figure 1 FIG. is a schematic structural diagram of an information leakage identification device based on a clustering algorithm according to an embodiment of the present invention;

[0026] Figure 2 FIG. is a schematic flow diagram of an information leakage identification method based on a clustering algorithm according to an embodiment of the present invention;

[0027] Figure 3 FIG. is a schematic structural diagram of an information leakage identification apparatus based on a clustering algorithm according to another embodiment of the present invention.

[0028] In the drawings, the same or corresponding reference numerals represent the same or corresponding parts. Detailed Description of the Embodiments

[0029] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the drawings. Although the exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided so that the present disclosure can be more thoroughly understood and the scope of the present disclosure can be fully conveyed to those skilled in the art.

[0030] In the description of the embodiments of the present application, it should be understood that terms such as "including" or "having" are intended to indicate the presence of the features, numbers, steps, actions, components, parts, or combinations thereof disclosed in this specification, and are not intended to exclude the possibility of the presence of one or more other features, numbers, steps, actions, components, parts, or combinations thereof.

[0031] Unless otherwise specified, " / " means "or". For example, A / B can mean A or B. "And / or" in this text is merely a description of the relationship between associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, and B exists alone.

[0032] The terms "first", "second", etc. are only used for descriptive purposes and should not be construed as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, features defined with "first", "second", etc. may explicitly or implicitly include one or more such features. In the description of the embodiments of this application, unless otherwise specified, "a plurality of" means two or more.

[0033] All the codes in this application are exemplary. Those skilled in the art will think of various variations without departing from the idea of this application based on factors such as the programming language used, specific requirements, and personal habits.

[0034] To clearly illustrate the embodiments of this application, some concepts that may appear in subsequent embodiments will be introduced first.

[0035] Concept description:

[0036] DBSCAN (Density-based spatial clustering of applications with noise) refers to a density-based spatial data clustering method. This algorithm utilizes the concept of density-based clustering, that is, it requires the number of objects (points or other spatial objects) contained in a certain area of the clustering space to be not less than a given threshold (i.e., the minimum number of samples). This method can discover clusters of arbitrary shapes in a spatial database with noise, can connect adjacent regions with sufficient density, and can effectively handle abnormal data. It is mainly used for clustering spatial data.

[0037] In addition, it should be noted that, without conflict, the embodiments in the present invention and the features in the embodiments can be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in conjunction with the embodiments.

[0038] As Figure 1 shown, Figure 1 is a schematic structural diagram of the hardware operating environment involved in the embodiment solution of the present invention.

[0039] It should be noted that Figure 1 it can be a schematic structural diagram of the hardware operating environment of the information leakage recognition device based on the clustering algorithm. The information leakage recognition device based on the clustering algorithm in the embodiments of the present invention can be a terminal device such as a PC or a portable computer.

[0040] As shown in Figure 1 the information leakage identification device based on the clustering algorithm may include: a processor 1001, such as a CPU, a network interface 1004, a user interface 1003, a memory 1005, and a communication bus 1002. Among them, the communication bus 1002 is used to implement the connection and communication between these components. The user interface 1003 may include a display screen (Display) and an input unit such as a keyboard (Keyboard). Optionally, the user interface 1003 may further include a standard wired interface and a wireless interface. The network interface 1004 may optionally include a standard wired interface and a wireless interface (such as a WI-FI interface). The memory 1005 may be a high-speed RAM memory or a stable memory (non-volatile memory), such as a disk memory. Optionally, the memory 1005 may also be a storage device independent of the foregoing processor 1001.

[0041] Those skilled in the art can understand that Figure 1 the structure of the information leakage identification device based on the clustering algorithm shown in does not constitute a limitation on the information leakage identification device based on the clustering algorithm, and may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0042] As shown in Figure 1 the memory 1005, as a computer storage medium, may include an operating system, a network communication module, a user interface module, and an information leakage identification program based on the clustering algorithm. Among them, the operating system is a program that manages and controls the hardware and software resources of the information leakage identification device based on the clustering algorithm, and supports the operation of the information leakage identification program based on the clustering algorithm and other software or programs.

[0043] In Figure 1 the information leakage identification device based on the clustering algorithm shown, the user interface 1003 is mainly used to receive requests, data, etc. sent by the first terminal, the second terminal, and the supervision terminal; the network interface 1004 is mainly used to connect to the background server and perform data communication with the background server; and the processor 1001 may be used to call the information leakage identification program stored in the memory 1005 and perform the following operations:

[0044] Obtain fraud transaction data, create card-merchant samples according to the fraud transaction data; construct multi-dimensional features of the card-merchant samples based on historical fraud transaction data within a preset time range; cluster the constructed card-merchant samples based on the DBSCAN clustering algorithm and the multi-dimensional features, and identify abnormal sample classifications; analyze the abnormal sample classifications to identify potential information leakage parties.

[0045] Thus, it is possible to more effectively and quickly automatically detect and identify potential information leakage parties.

[0046] Figure 2 It is a schematic flowchart of an information leakage identification method based on a clustering algorithm according to an embodiment of the present application, which is used to identify the information leakage party. In this process, from the perspective of the device, the execution subject can be one or more electronic devices; from the perspective of the program, the execution subject can correspondingly be the program installed on these electronic devices. In this embodiment, the execution subject of the method can be Figure 1 the processor in the embodiment shown

[0047] As Figure 2 shown, the method provided in this embodiment may include the following steps:

[0048] 202. Obtain fraud transaction data and create a card-merchant sample according to the fraud transaction data;

[0049] 204. Construct multi-dimensional features of the card-merchant sample based on historical fraud transaction data within a preset time range;

[0050] 206. Cluster the constructed card-merchant sample based on the DBSCAN clustering algorithm and multi-dimensional features to identify abnormal sample classifications;

[0051] 208. Analyze the abnormal sample classifications to identify potential information leakage parties.

[0052] In one example, after receiving the reported fraud transaction data, "Card A-Merchant a" can be extracted as a sample, which indicates that there is a transaction record of Card A at Merchant a in the recent fraud data. Correspondingly, "Card B-Merchant a", "Card A-Merchant b", etc. are used as other samples for subsequent processing. After that, taking the "Card A-Merchant a" sample as an example, fraud transaction records related to the above "Card A-Merchant a" sample can be obtained from the historical fraud transaction data within a preset time range (such as in the recent few months), so as to construct multi-dimensional sample features. For example, fraud transaction records involving "Card A" and related institutions such as the issuing institution, and fraud transaction records involving "Merchant a" and related institutions such as the country of origin and the acquiring institution can be extracted from the historical fraud transaction data to construct the multi-dimensional features of the above "Card A-Merchant a" sample. After creating multiple card-merchant samples and constructing multi-dimensional features, based on the constructed features, the unsupervised DBSCAN clustering method is applied for clustering, clustering the constructed card-merchant samples into multiple categories, and then abnormal sample classifications can be screened out from these multiple categories, regarding this abnormal sample classification as a suspected abnormal classification of information leakage, that is, identifying it as a sample set suspected of information leakage. It can be understood that by analyzing the abnormal sample classifications obtained from the above classifications, the potential information leakage parties can be identified. For example, if multiple "card-merchant" samples in the abnormal sample classification are aggregately related to the same issuing institution, the potential information leakage party can be identified as the issuing institution. If they are aggregately related to the same merchant, the potential information leakage party can be identified as the merchant, and so on.

[0053] In this way, in this application, by constructing special "card-merchant" samples, the interference of large merchants can be eliminated, and the fraud characteristics of each card and each merchant in the fraud transaction database can be described through feature engineering, and the fraud characteristics of both "card" and "merchant" can be combined in the samples. Based on the constructed features, this application further uses the unsupervised DBSCAN clustering algorithm to find groups with similar fraud characteristics from the above-mentioned constructed sample set, and identifies the larger sample set as a sample classification suspected of information leakage. Since the historical fraud characteristics involved in both "card" and "merchant" are considered at the sample level, the clustering analysis effect of this application is better, and potential information leakage events can be detected and identified more effectively automatically.

[0054] In one implementation, to better measure similarity, in the above 204, the multi-dimensional features of the card-merchant samples can be determined according to the number of fraud transactions involved by one or more dimensional objects corresponding to the card and / or merchant in the historical fraud transaction data. Therefore, in this application, the number of times the feature object appears in the database is selected as the feature value when constructing the feature values, converting the qualitative variable into a variable that can be used to quantitatively describe the fraud characteristics of the card.

[0055] The multi-dimensional features of the above card-merchant samples include one or more of the following: merchant dimension features, country dimension features, issuing institution dimension features, acquiring institution dimension features, card attribute dimension features, and transaction date dimension features.

[0056] Among them, for the selection of the values of the above merchant dimension features, country dimension features, issuing institution dimension features, and acquiring institution dimension features, it can be determined according to the number of fraud transactions involved in their respective historical fraud transaction data:

[0057] (1) Determine the value of the merchant dimension feature according to the number of fraud transactions corresponding to the merchant in the historical fraud transaction data.

[0058] (2) Determine the value of the country dimension feature according to the number of fraud transactions corresponding to the country where the merchant is located in the historical fraud transaction data; the value of the acquiring institution dimension feature can be determined according to the number of fraud transactions corresponding to the acquiring institution corresponding to the merchant in the historical fraud transaction data.

[0059] (3) Determine the value of the issuing institution dimension feature according to the number of fraud transactions corresponding to the issuing institution corresponding to the card in the historical fraud transaction data.

[0060] In the selection of feature dimensions in this application, instead of directly using the original dimensions such as transaction codes, fraud types, and transaction amounts carried by the transactions, multiple new features such as merchants, countries, regions, institutions, and dates are further screened and constructed; based on this, the number of occurrences of the feature object in the database is selected as the feature value in the construction of feature values, and qualitative variables are converted into variables that can be used to quantitatively describe card fraud features.

[0061] Among them, for the above transaction date dimension feature, the transaction date dimension feature can be determined according to the transaction time information of the fraud transaction events corresponding to the card and / or merchant in the historical fraud transaction data. For example, for the sample of "Card A-Merchant a", the transaction time of the fraud transaction events corresponding to Card A and / or Merchant a in the historical fraud transaction data can be counted to determine its statistical value, such as the median time, average time, aggregation time, etc., or the transaction time itself can also be used as its transaction date dimension feature. It can be understood that after a certain information leakage occurs, fraud transaction events may occur in a concentrated manner in a subsequent period of time. Therefore, the above transaction date dimension feature can be used as a feature dimension for analyzing information leakage.

[0062] More specifically, the transaction date dimension feature can be determined according to the mean value of the transaction time information of the fraud transaction events corresponding to the card and / or merchant in the historical fraud transaction data.

[0063] Among them, for the above card attribute dimension feature, it can indicate the category of the card, such as a debit card or a credit card.

[0064] In one example, referring to the following table, it shows examples of merchant dimension features, country dimension features, card-issuing institution dimension features, acquiring institution dimension features, card attribute dimension features, and transaction date dimension features. Among them, continuous type means that as time goes by, this feature will change in a time-continuous manner.

[0065]

[0066] In one implementation, before 202, the fraud transaction data can also be preprocessed, and the preprocessing includes: duplicate removal processing and / or missing value removal processing. Thus, some duplicate and meaningless features can be screened out from the fraud transaction data.

[0067] In one implementation, the above 206 can specifically include: based on the constructed multi-dimensional features, using the DBSCAN clustering algorithm for clustering to cluster the constructed multiple card-merchant samples into multiple sample classifications; among the multiple sample classifications, taking one or more sample classifications whose sample quantity meets the preset conditions as abnormal sample classifications; the preset abnormal conditions include: being greater than the average sample quantity of the multiple sample classifications; and / or, being among the top N of the sample quantities of the multiple sample classifications, where N is an integer greater than 0.

[0068] For example, using the DBSCAN method to cluster the above constructed multiple card-merchant samples, setting the parameters of the DBSCAN algorithm eps (scanning radius) = 7 and min_samples (minimum number of included points) = 20 for clustering, all sample data clustering totals 28 classes, and the 28 classes on average contain 82 samples. Finally, 8 abnormal sample classifications are screened out by setting the preset abnormal conditions. It can be considered that the above abnormal sample classifications belong to the sample set with the same batch of leakage characteristics.

[0069] In one implementation, the above 208 can specifically include: determining the aggregation situation of any one or more of the following objects in the abnormal sample classification: card, merchant, card-issuing institution, acquiring institution; and determining the potential information leakage party according to the aggregation situation.

[0070] The information leakage party can be obtained from the abnormal sample classification by any analysis method. For example, if more than a preset proportion of abnormal samples in a certain abnormal sample classification are related to a certain merchant / card-issuing institution / acquiring institution, then it can be considered that this merchant / card-issuing institution / acquiring institution is the potential information leakage party. Further, if it is analyzed that the card numbers of more than a preset proportion of abnormal samples in a certain abnormal sample classification all belong to the users of a certain website, then it can be considered that this website is the potential information leakage party. And so on.

[0071] In the description of this specification, the descriptions with reference to terms such as "some possible embodiments", "some embodiments", "examples", "specific examples", or "some examples" etc. mean that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic expressions of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described can be combined in a suitable manner in any one or more embodiments or examples. In addition, without contradiction, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0072] In addition, the terms "first" and "second" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, the features defined with "first" and "second" can explicitly or implicitly include at least one of such features. In the description of the present invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise specifically defined.

[0073] Any process or method description shown in a flowchart or described in other ways herein can be understood as representing a module, segment, or part of code including one or more executable instructions for implementing a specific logical function or process. And the scope of the preferred embodiments of the present invention includes additional implementations, where the functions can be executed in a manner not shown or discussed, including in a substantially simultaneous manner according to the involved functions or in a reverse order, which should be understood by those skilled in the art to which the embodiments of the present invention pertain.

[0074] Regarding the method flowchart of the embodiments of this application, certain operations are described as different steps executed in a certain order. Such a flowchart is illustrative rather than restrictive. Certain steps described herein can be grouped together and executed in a single operation, certain steps can be split into multiple sub-steps, and certain steps can be executed in an order different from that shown herein. Each step shown in the flowchart can be implemented in any way by any circuit structure and / or tangible mechanism (for example, by software running on a computer device, hardware (such as a processor or chip-implemented logical function), etc., and / or any combination thereof).

[0075] Based on the same technical concept, the embodiments of the present invention further provide an information leakage identification device based on a clustering algorithm, which is used to execute the information leakage identification method based on a clustering algorithm provided in any of the above embodiments. Figure 3 It is a schematic structural diagram of an information leakage identification device based on a clustering algorithm provided by the embodiments of the present invention.

[0076] As Figure 3 shown, the apparatus 300 includes:

[0077] A sample creation module 301, configured to obtain fraud transaction data and create card - merchant samples according to the fraud transaction data;

[0078] A feature construction module 302, configured to construct multi - dimensional features of the card - merchant samples based on historical fraud transaction data within a preset time range;

[0079] A clustering module 303, configured to cluster the constructed card - merchant samples based on the DBSCAN clustering algorithm and the multi - dimensional features, and identify abnormal sample classifications;

[0080] An identification module 304, configured to analyze the abnormal sample classifications and identify potential information leakage parties.

[0081] It should be noted that the apparatus in the embodiments of the present application can implement each process of the embodiments of the foregoing method and achieve the same effects and functions, which will not be elaborated here.

[0082] According to some embodiments of the present application, a non - volatile computer storage medium for an information leakage identification method based on a clustering algorithm is provided, on which computer - executable instructions are stored, and the computer - executable instructions are configured to execute the method of the foregoing embodiments when run by a processor.

[0083] Each embodiment in the present application is described in a progressive manner. The same or similar parts among the embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments. In particular, for the embodiments of the apparatus, device, and computer - readable storage medium, since they are basically similar to the method embodiments, their descriptions are simplified, and the relevant parts can refer to the partial descriptions of the method embodiments.

[0084] The apparatus, device, and computer - readable storage medium provided in the embodiments of the present application correspond one - to - one with the method. Therefore, the apparatus, device, and computer - readable storage medium also have beneficial technical effects similar to those of the corresponding method. Since the beneficial technical effects of the method have been described in detail above, the beneficial technical effects of the apparatus, device, and computer - readable storage medium will not be elaborated here.

[0085] Those skilled in the art should understand that the embodiments of the present invention can be provided as a method, a system, or a computer program product. Therefore, the present invention can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0086] The present invention is described with reference to the flowcharts and / or block diagrams of methods, apparatuses (systems), and computer program products according to embodiments of the present invention. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of flows and / or blocks in the flowcharts and / or block diagrams, can be realized by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices generate means for realizing the functions specified in one Figure 1 one flow or multiple flows and / or blocks Figure 1 one block or multiple blocks.

[0087] Although the spirit and principles of the present invention have been described with reference to several specific embodiments, it should be understood that the present invention is not limited to the specific embodiments disclosed, and the division of each aspect does not mean that the features in these aspects cannot be combined for benefits. This division is only for the convenience of expression. The present invention aims to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

Claims

1. An information leakage identification method based on a clustering algorithm, characterized in that, Including: Obtain fraud transaction data and create a card - merchant sample according to the fraud transaction data; Determine the multi - dimensional features of the card - merchant sample according to the number of fraud transactions involved in one or more dimensional objects corresponding to the card and / or the merchant in the historical fraud transaction data, where the historical fraud transaction data is the historical fraud transaction data within a preset time range; Cluster the constructed card - merchant sample based on the DBSCAN clustering algorithm and the multi - dimensional features, and identify abnormal sample classifications; Analyze the abnormal sample classifications to identify potential information leakage parties.

2. The method according to claim 1, wherein The multi - dimensional features of the card - merchant sample include one or more of the following: Merchant dimension feature, country dimension feature, issuing institution dimension feature, acquiring institution dimension feature, card attribute dimension feature, transaction date dimension feature.

3. The method according to claim 2, wherein It also includes: Determine the value of the merchant dimension feature according to the number of fraud transactions corresponding to the merchant in the historical fraud transaction data; And / or, Determine the value of the country dimension feature according to the number of fraud transactions corresponding to the country to which the merchant belongs in the historical fraud transaction data; And / or, Determine the value of the acquiring institution dimension feature according to the number of fraud transactions corresponding to the acquiring institution corresponding to the merchant in the historical fraud transaction data; And / or, Determine the value of the issuing institution dimension feature according to the number of fraud transactions corresponding to the issuing institution corresponding to the card in the historical fraud transaction data.

4. The method according to claim 2, wherein It also includes: Determine the transaction date dimension feature according to the transaction time information of the fraud transaction events corresponding to the card and / or the merchant in the historical fraud transaction data.

5. The method according to claim 4, wherein It also includes: Determine the transaction date dimension feature according to the mean of the transaction time information of the fraud transaction events corresponding to the card and / or the merchant in the historical fraud transaction data.

6. The method according to claim 2, characterized in that The card attribute dimension feature indicates the category of the card.

7. The method according to claim 1, characterized in that, Before creating the card - merchant sample, the method further includes: Pre - process the fraud transaction data, and the pre - processing includes: duplicate removal processing and / or missing value removal processing.

8. The method according to claim 1, wherein Clustering the constructed card - merchant sample based on the DBSCAN clustering algorithm and the multi - dimensional features further includes: Based on the constructed multi - dimensional features, use the DBSCAN clustering algorithm for clustering to cluster the constructed multiple card - merchant samples into multiple sample classifications; Among the multiple sample classifications, regard one or more sample classifications whose sample quantity meets the preset abnormal conditions as the abnormal sample classifications; The preset abnormal conditions include: being greater than the average sample quantity of the multiple sample classifications; and / or, being among the top N of the sample quantities of the multiple sample classifications, where N is an integer greater than 0.

9. The method according to claim 1, wherein Analyze the abnormal sample classifications to obtain potential information leakage parties, and it further includes: Determine the aggregation situation of any one or more of the following objects in the abnormal sample classifications: card, merchant, issuing institution, acquiring institution; Determine the potential information leakage party according to the aggregation situation.

10. An information leakage recognition device based on a clustering algorithm, characterized in that Configured to execute the method according to any one of claims 1 - 9, the device includes: A sample creation module, configured to obtain fraud transaction data and create card-merchant samples according to the fraud transaction data; A feature construction module, configured to construct multi-dimensional features of the card-merchant samples based on historical fraud transaction data within a preset time range; A clustering module, configured to cluster the constructed card-merchant samples based on the DBSCAN clustering algorithm and the multi-dimensional features, and identify abnormal sample classifications; An identification module, configured to analyze the abnormal sample classifications and identify potential information leakage parties.

11. An information leakage identification device based on a clustering algorithm, characterized in that, Comprising: At least one processor; And a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute: the method according to any one of claims 1-9.

12. A computer-readable storage medium storing a program, which when executed by a multi-core processor, causes the multi-core processor to execute the method according to any one of claims 1-9.

Images