Training risky transaction identification model, method and device for identifying risky transactions

Abstract

The embodiments of this specification provide a method and apparatus for training a risky transaction identification model, and a method and apparatus for identifying risky transactions, wherein a specific implementation of the method for training a risky transaction identification model includes: obtaining historical transaction records, the above historical transaction records include: risky transactions marked with risk labels, normal transactions marked with non-risk labels, and other transactions without labels; judging whether the terminal-side behavior sequence corresponding to each transaction in the above historical transaction records has a preset high-risk subsequence, and obtaining a first judgment result; judging whether the link characteristics corresponding to each transaction in the above historical transaction records conform to a preset high-risk mode, and obtaining a second judgment result; constructing each transaction sample based on the first judgment result, the second judgment result, and the basic transaction information corresponding to each transaction; and training the risky transaction identification model based on each transaction sample and its label annotation.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of computer technology, and more particularly to a method and device for training a risky transaction identification model, and a method and device for identifying risky transactions. Background Art

[0002] Illegal financial activities are extremely harmful to society and have been highly valued by regulatory authorities. At the same time, illegal financial activities are also the key prevention and control targets of the payment platform management system. Taking online gambling as an example, the online gambling black industry uses the services provided by the payment platform to build deposit channels and collect gambling funds. Here, the deposit channel can refer to the channel provided by the gambling black industry for gamblers to complete the gambling fund recharge. Generally, gambling risks can be divided into active gambling risks and passive gambling risks. Compared with active gambling risks, the main challenge in perceiving and preventing passive gambling risks is that the payee is generally a large merchant with a certain transaction volume, and its own user information and historical transaction behavior hardly provide gambling risk characteristics. It is difficult to judge whether the payment made by the gambler to the large merchant is a gambling recharge based solely on the gambler's user information and historical transaction behavior. Therefore, how to identify risky transactions with passive gambling risks has important practical significance and value. Summary of the invention

[0003] The embodiments of this specification describe a method and apparatus for training a risky transaction identification model, as well as a method and apparatus for identifying risky transactions. In the process of training the risky transaction identification model, the method constructs transaction samples based on the end-side behavior sequence, link characteristics and basic transaction information corresponding to the transaction, and trains the risky transaction identification model based on the transaction samples. As a result, the trained risky transaction identification model can comprehensively analyze the end-side behavior sequence, link characteristics and transaction information corresponding to the transaction when identifying risky transactions, thereby making the identification more accurate.

[0004] According to a first aspect, a method for training a risky transaction identification model is provided, comprising: obtaining historical transaction records, the historical transaction records including: risky transactions marked with risk labels, normal transactions marked with non-risk labels, and other transactions without labels; judging whether the terminal-side behavior sequence corresponding to each transaction in the historical transaction records has a preset high-risk subsequence, and obtaining a first judgment result; judging whether the link feature corresponding to each transaction in the historical transaction records conforms to a preset high-risk mode, and obtaining a second judgment result; constructing each transaction sample based on the first judgment result, the second judgment result, and the basic transaction information corresponding to each transaction; and training the risky transaction identification model based on each transaction sample and its label annotation.

[0005] According to the second aspect, a method for identifying risky transactions is provided, including: judging whether an end-side behavior sequence corresponding to a target transaction has a preset high-risk subsequence to obtain a third judgment result; judging whether a link feature corresponding to the target transaction conforms to a preset high-risk mode to obtain a fourth judgment result; inputting the third judgment result, the fourth judgment result and the basic transaction information of the target transaction into a pre-trained risk transaction identification model; judging whether the target transaction is a transaction of a preset risk type according to an output result of the risk transaction identification model.

[0006] According to a third aspect, a device for training a risky transaction identification model is provided, comprising: an acquisition unit, configured to acquire historical transaction records, wherein the historical transaction records include: risky transactions marked with risk labels, normal transactions marked with risk-free labels, and other transactions without labels; a first judgment unit, configured to judge whether the terminal-side behavior sequence corresponding to each transaction in the historical transaction records has a preset high-risk subsequence, and obtain a first judgment result; a second judgment unit, configured to judge whether the link feature corresponding to each transaction in the historical transaction records conforms to a preset high-risk mode, and obtain a second judgment result; a construction unit, configured to construct each transaction sample based on the first judgment result, the second judgment result, and the basic transaction information corresponding to each transaction; and a training unit, configured to train the risky transaction identification model based on each transaction sample and its label annotation.

[0007] According to a fourth aspect, a device for identifying risky transactions is provided, comprising: a third judgment unit, configured to judge whether the terminal-side behavior sequence corresponding to the target transaction has a preset high-risk subsequence, and obtain a third judgment result; a fourth judgment unit, configured to judge whether the link characteristics corresponding to the target transaction conform to the preset high-risk mode, and obtain a fourth judgment result; an input unit, configured to input the third judgment result, the fourth judgment result and the basic transaction information of the target transaction into a pre-trained risk transaction identification model; the risk transaction judgment unit, configured to judge whether the target transaction is a transaction of a preset risk type according to the output result of the risk transaction identification model.

[0008] According to a fifth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the above-mentioned computer program is executed in a computer, the computer is caused to execute the method described in any implementation manner of the first aspect or the second aspect.

[0009] According to the sixth aspect, a computing device is provided, comprising a memory and a processor, wherein an executable code is stored in the memory, and when the processor executes the executable code, the method described in any implementation manner in the first aspect or the second aspect is implemented.

[0010] According to the method and device for training a risky transaction identification model, and the method and device for identifying risky transactions provided in the embodiments of this specification, in the process of training the risky transaction identification model, a transaction sample is constructed based on the end-side behavior sequence, link characteristics and basic transaction information corresponding to the transaction, and the risky transaction identification model is trained based on the transaction sample. As a result, the trained risky transaction identification model can comprehensively analyze the end-side behavior sequence, link characteristics and transaction information corresponding to the transaction when identifying risky transactions, thereby making the identification more accurate. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 A schematic diagram showing an application scenario in which the method for identifying risky transactions according to an embodiment of this specification can be applied;

[0012] Figure 2 A schematic diagram of a process for training a risky transaction identification model according to an embodiment is shown;

[0013] Figure 3 A schematic flow chart of a method for identifying risky transactions according to an embodiment is shown;

[0014] Figure 4 A schematic block diagram of an apparatus for training a risky transaction identification model according to an embodiment is shown;

[0015] Figure 5 A schematic block diagram of an apparatus for identifying risky transactions according to an embodiment is shown. DETAILED DESCRIPTION

[0016] The technical solution provided in this specification is further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant inventions, rather than to limit the inventions. It should also be noted that, for ease of description, only the parts related to the relevant inventions are shown in the accompanying drawings. It should be noted that, in the absence of conflict, the embodiments of this specification and the features in the embodiments can be combined with each other.

[0017] The embodiments of this specification provide a method for training a risky transaction identification model, and a method for identifying risky transactions based on the trained risky transaction identification model, so that risky transactions can be accurately identified. Figure 1 The schematic diagram shows an application scenario in which the method for identifying risky transactions according to the embodiment of this specification can be applied. Figure 1As shown, the target transaction in this application scenario is a transaction in which a user 101 pays a merchant 102. After determining the target transaction, it is determined whether the end-side behavior sequence corresponding to the target transaction has a preset high-risk subsequence to obtain an end-side judgment result. At the same time, it is determined whether the link characteristics corresponding to the target transaction meet the preset high-risk mode to obtain a link judgment result. Afterwards, the end-side judgment result, the link judgment result, and the basic transaction information of the target transaction (for example, user information, user historical transaction behavior information, etc.) are input into the pre-trained risk transaction identification model 103. Finally, according to the output result of the risk transaction identification model 103, it is determined whether the target transaction is a transaction of a preset risk type, where the preset risk type can be a passive gambling risk.

[0018] Continue to see Figure 2 , Figure 2 The flowchart of the method for training a risky transaction identification model according to one embodiment is shown. It can be understood that the method can be executed by any device, equipment, platform, or device cluster with computing and processing capabilities. Figure 2 As shown, the method for training a risky transaction identification model may include the following steps:

[0019] Step 201, obtaining historical transaction records.

[0020] In this embodiment, at least one historical transaction record of at least one merchant can be obtained, and the historical transaction records may include risky transactions marked with risk labels, normal transactions marked with risk-free labels, and other transactions without labels. Here, risky transactions can be determined in a variety of ways. For example, transactions that are complained as illegal transactions such as online gambling can be determined as risky transactions. For another example, high-precision gambling transactions identified by existing prevention and control measures can be determined as risky transactions. Normal transactions can be transactions determined as non-risky transactions. For example, transactions completed by creating orders through the merchant's official APP (Application) can be determined as normal transactions. Other transactions may refer to transactions other than risky transactions and normal transactions.

[0021] Here, each historical transaction record may include various information related to the transaction, for example, it may include the terminal-side behavior sequence corresponding to the transaction, link characteristics, basic transaction information, etc.

[0022] Among them, the end-side behavior sequence is a sequence formed by the user operation behavior performed on the user end. The end-side behavior sequence can be generated based on at least one of the following logs: Super Position Model (SPM) log, Remote Procedure Call (RPC) log, and end-side security system log. In practice, all resources on the client of the payment platform (for example, icons, pictures, text blocks, interactive elements, etc. on the page) obtain a unique identifier according to the super position model. When the resources are exposed to the user or clicked by the user, a log will be left. Therefore, the SPM log can reflect the browsing, clicking and other behaviors of the end-side user. The RPC request sent by the client of the payment platform to the server will generate a log, some of which are generated by the user's operation, so the RPC log can also reflect part of the end-side user's behavior. In addition, the request to jump to the payment platform client or the payment platform applet will initiate a security consultation to the end-side security system and leave the end-side security system log. These logs record the technical links. At the same time, since some jumps are generated by the end-side user behavior, they can also reflect part of the end-side user behavior.

[0023] Take online gambling as an example. Usually, the orders created by the black industry obtained by gamblers have different end-side user behaviors from the orders created by users through formal channels. For example, when a user creates an order on the merchant's official APP and clicks on payment, the payment interface of the payment platform can be directly pulled up, while gamblers may first use the photo album to scan the order QR code on the webpage or APP of the black industry or payment platform. Therefore, through the collected super location model log, remote procedure call log, end-side security system log and other information, the end-side behavior sequence of the user in a short period of time before the payment event can be restored. Analyzing the end-side behavior sequence can help identify online gambling.

[0024] The technical link may refer to the jumps between various APPs, web pages and payment platform mini-programs during the call-up process. Here, the call-up may refer to the process of pulling up the payment interface using the services provided by the payment platform, after which the user can use his or her payment platform account to complete the payment. The link features corresponding to the transaction may include at least one of the following: the features of each jump position of the transaction, the number of jumps, the payment channel, the payment product, the order product name, the magnitude of the number of times the payee information appears within a preset time period, etc. Here, the features of each jump position may include the features of the source of the jump (i.e., where it comes from) and the features of the destination (i.e., where it goes). The features of the source may include various features related to the source. For example, according to the name of the source of the jump, the source can be divided into multiple types such as APP, mini-program, H5 page, etc., and the type of the source can be used as one of the features of the source. For another example, the ID (identification) of the source can be used as one of the features of the source. For another example, if the source is an APP, the judgment result of whether the APP is an APP in the preset list can also be used as one of the features of the source. Similarly, the features of the destination can also include the type and ID of the destination. Here, the payment channels may include multiple payment channels such as H5 web payment provided by the payment platform, APP-activated local payment interface, etc. Payment products may refer to products adopted by the exchange, such as transfer to account, transfer to card, AA collection, payment on behalf of others, etc. Here, the payee information may include the payee's account number, phone number, etc. The magnitude of the number of times the payee information appears within a preset time period may refer to the magnitude of the number of times the payee's account number, phone number, etc. appears in all transactions in the recent period (e.g., one day, one week, etc.).

[0025] Continuing with the example of online gambling, there is a call-end process from obtaining an order to completing payment. The technical links of black market orders and normal orders in this process are obviously different. For example, normal orders mostly jump from the merchant APP to the payment platform, while black market orders may jump from the H5 browser or black market APP to the payment platform. Therefore, analyzing the link characteristics can help identify online gambling.

[0026] Basic transaction information may include the user information of the transaction initiator, historical transaction behavior, etc.

[0027] Step 202 , determining whether the terminal-side behavior sequence corresponding to each transaction in the historical transaction record has a preset high-risk subsequence, and obtaining a first determination result.

[0028] In this embodiment, a high-risk subsequence can be pre-determined in various ways. For example, a technician can analyze the terminal-side behavior sequence of an existing risky transaction to obtain a high-risk subsequence. After determining the high-risk subsequence, it can be determined whether the terminal-side behavior sequence corresponding to each transaction in the above historical transaction record has the high-risk subsequence, thereby obtaining a first judgment result. The first judgment result can be whether the high-risk subsequence exists or does not exist.

[0029] In some optional implementations, the above method for training a risky transaction identification model may further include the following step of determining a high-risk subsequence, specifically:

[0030] Step S1, forming a risk sequence and a normal sequence based on the terminal-side behavior sequences corresponding to the risky transactions and the normal transactions respectively.

[0031] In this implementation, the terminal-side behavior sequence corresponding to the risky transaction may be used as the risk sequence, and the terminal-side behavior sequence corresponding to the normal transaction may be used as the normal sequence.

[0032] Step S2: perform sequence mining on the risk sequence to obtain at least one frequent subsequence.

[0033] In this implementation, various sequence mining algorithms can be used to perform sequence mining on risk sequences to obtain at least one frequent subsequence. Here, the sequence mining algorithm may include but is not limited to the AprioriAll algorithm, the GSP (Generalized Sequential Pattern Mining) algorithm, the FreeSpan algorithm, the PrefixSpan algorithm, and the like.

[0034] Step S3: determining a frequent subsequence as a high-risk subsequence from at least one frequent subsequence according to the occurrence ratio of each frequent subsequence in the risk sequence and the normal sequence.

[0035] In this implementation, at least one frequent subsequence can be determined as a high-risk subsequence from at least one frequent subsequence based on the proportion of each frequent subsequence in the risk sequence and the normal sequence. For example, for each frequent subsequence, the number of times the frequent subsequence appears in the risk sequence and the normal sequence, respectively, can be determined in a statistical manner, and the frequent subsequences that appear more frequently in the risk sequence (for example, the number of occurrences exceeds a preset threshold) and rarely appear in the normal sequence (for example, the number of occurrences is less than a preset threshold) are determined as high-risk subsequences associated with risky transactions. In practice, high-risk subsequences can be regarded as abnormal end-side user behaviors associated with risky transactions. Through this implementation, high-risk subsequences can be determined based on sequence mining methods, so that the obtained high-risk subsequences are more accurate.

[0036] Optionally, the above step S3 can also be specifically performed as follows: first, determine the information value of each frequent subsequence according to the occurrence ratio of each frequent subsequence in the risk sequence and the normal sequence. Then, take the frequent subsequence whose corresponding information value is greater than a preset threshold as a high-risk subsequence.

[0037] In this implementation, for each frequent subsequence in at least one frequent subsequence, the IV value (Importance Value, information value) of the frequent subsequence can be calculated based on the number of risk sequences, the number of risk sequences containing the frequent subsequence in the risk sequence, the number of normal sequences, and the number of normal sequences containing the frequent subsequence in the normal sequence. In the binary classification problem of machine learning, the IV value can be used to encode the input variables and evaluate the predictive ability. The size of the IV value of the feature variable can indicate the strength of the predictive ability of the variable. After calculating the IV value corresponding to each frequent subsequence, the IV value can be compared with a pre-set threshold, and the frequent subsequences greater than the threshold are regarded as high-risk subsequences. Here, the threshold can be set manually according to actual needs.

[0038] Step 203, determining whether the link characteristics corresponding to each transaction in the historical transaction record conform to a preset high-risk mode, and obtaining a second determination result.

[0039] In this embodiment, at least one high-risk mode can be pre-determined in various ways. For example, a technician can analyze the link characteristics of existing risky transactions to obtain a high-risk mode. After determining the high-risk mode, it can be determined whether the link characteristics corresponding to each transaction in the above historical transaction record conform to the high-risk mode, thereby obtaining a second judgment result, which can be conforming to the high-risk mode or not conforming to the high-risk mode.

[0040] In some optional implementations, the above method for training a risky transaction identification model may further include the following step of determining a high-risk model, specifically:

[0041] 1) Obtain the link characteristics corresponding to each transaction in the historical transaction records.

[0042] In this implementation, the link characteristics corresponding to each transaction in multiple historical transactions can be obtained.

[0043] 2) Perform attribution analysis on the link features corresponding to each transaction and identify at least one transaction pattern as a high-risk pattern.

[0044] In this implementation, various attribution analysis algorithms can be used to perform attribution analysis on the link features corresponding to the transaction, so as to determine at least one transaction mode as a high-risk mode. Here, the number of transactions corresponding to the high-risk mode is higher than the preset quantity threshold, and the concentration of risky transactions is higher than the preset concentration threshold. The concentration of risky transactions may refer to the ratio of risky transactions to all transactions. Here, the attribution analysis algorithms include but are not limited to the MicroHECL (High-Efficient Root Cause Localization in Large-Scale Microservice Systems) algorithm, the Squeeze algorithm, and the like. Among them, the Squeeze algorithm is a multi-dimensional abnormal root cause analysis method, which comes from the paper "Generic and Robust Localization of Multi-Dimensional Root Causes". Through this implementation, the high-risk mode can be determined based on the attribution analysis method, so that the obtained high-risk mode is more accurate.

[0045] Step 204, constructing each transaction sample based on the first judgment result, the second judgment result, and the basic transaction information corresponding to each transaction.

[0046] In this embodiment, based on the first judgment result, the second judgment result and the basic transaction information corresponding to each transaction in the historical transaction record, a transaction sample corresponding to each transaction can be constructed.

[0047] Step 205: training a risky transaction identification model based on each transaction sample and its label annotation.

[0048] In this embodiment, the risk transaction identification model can be trained based on the transaction samples and their label annotations obtained in step 204. As an example, the risk transaction identification model can be trained in various ways such as semi-supervised learning and supervised learning. For example, the risk transaction identification model can be trained based on GBDT (Gradient Boosting Decision Tree) as the basic model. For example, LightGBM (Light Gradient Boosting Machine) can be used for training, where LightGBM is a framework for implementing the GBDT algorithm. The risk transaction identification model obtained by training is a classification model, and the risk transaction identification model can be used to identify whether a transaction is a risky transaction.

[0049] In some optional implementations, the risk identification model can be trained by semi-supervised learning. Specifically, the label value of the risk label can be set to a first value, and the label value of the risk-free label can be set to a second value. The first value can be greater than the second value. For example, the first value can be 1, and the second value can be 0. And the above step 205 can be specifically performed as follows:

[0050] ①, select some samples from the risk samples corresponding to risky transactions as disguised unlabeled samples.

[0051] In this implementation, transaction samples constructed based on risky transactions can be used as risk samples, and some samples can be selected (for example, randomly selected) from multiple risk samples to obtain disguised unlabeled samples, which can also be called "spy" samples.

[0052] ②, train and obtain the first model based on at least the residual risk samples and the normal samples corresponding to normal transactions.

[0053] In this implementation, the first model can be trained in a variety of ways. For example, the first model can be trained based on the remaining risk samples and the normal samples corresponding to the normal transactions. The remaining risk samples can refer to the samples in the risk samples other than the samples selected as espionage samples. The label value of the remaining risk samples is the first value, and the label value of the normal samples is the second value. Based on this, the first model can be trained in a supervised learning manner.

[0054] Optionally, the above step ② can also be specifically performed as follows: multiple rounds (for example, 2 to 3 rounds) of self-training are performed based on the remaining risk samples, normal samples and unlabeled samples to obtain the first model.

[0055] Here, during the self-training process, the labels of risk samples and normal samples are not changed. For example, the first model can be trained in the following manner: a), the model is trained based on the remaining risk samples and normal samples, and then the following steps b) and c) are repeated multiple times, each repetition counts as one round of self-training; b), the model obtained by the latest training is used to predict the unlabeled samples, and the predicted values ​​are used as the labels of the unlabeled samples; C), the model is further trained based on all samples (including risk samples, normal samples and unlabeled samples with the predicted values ​​as labels) to obtain the latest trained model.

[0056] ③. Use the first model to predict the disguised unlabeled samples and determine the minimum score obtained by the prediction.

[0057] In this implementation, the first model trained in ② is used to predict the disguised unlabeled samples determined in ①, and the predicted values ​​of each disguised unlabeled sample are obtained, and the smallest predicted value is determined as the lowest score. Since the label value of the risky label is the first value, the label value of the risk-free label is the second value, and the first value is greater than the second value, for example, the first value is 1 and the second value is 0, the smaller the predicted value of a certain sample, the greater the possibility that the sample is a normal sample. In fact, the disguised unlabeled samples are risky samples. Therefore, it can be assumed that if the predicted value of an unlabeled sample is smaller than the lowest score, then the sample is likely to be a normal sample.

[0058] ④. Use the first model to predict the unlabeled samples corresponding to other transactions, set the label values ​​of the unlabeled samples whose prediction values ​​are greater than or equal to the minimum score to the minimum score, and set the label values ​​of the remaining unlabeled samples to the second value.

[0059] In this implementation, samples constructed based on other transactions can be used as unlabeled samples, and the first model can be used to predict the unlabeled samples. The label values ​​of the unlabeled samples whose prediction values ​​are greater than or equal to the above-mentioned minimum score are set to the above-mentioned minimum score, and the label values ​​of the remaining unlabeled samples (i.e., unlabeled samples whose prediction values ​​are less than the above-mentioned minimum score) are set to the second value.

[0060] ⑤. Use risk samples, normal samples, and unlabeled samples with label values ​​to further train the first model to obtain a risky transaction identification model.

[0061] In this implementation, the first model can be further trained using risk samples with a label value of the first value, normal samples with a label value of the second value, and unlabeled samples with label values ​​to obtain a risky transaction identification model. For example, the first model can be self-trained for multiple rounds (for example, 4 to 5 rounds) using risk samples, normal samples, and unlabeled samples with label values ​​to obtain a risky transaction identification model. Here, during the self-training process, the labels of the risk samples and normal samples are not changed. Through this implementation, a risky transaction identification model can be trained using a semi-supervised learning method.

[0062] In some other optional implementations, the risk identification model may be trained by supervised learning. Specifically, step 205 may be performed as follows:

[0063] I), based on the probability value of risky transactions being marked, the weight values ​​of transaction samples in positive samples and negative samples are set.

[0064] In this implementation, the probability value of risky transactions being marked can be determined in advance, and then the weight values ​​of transaction samples in positive samples and negative samples are set based on the probability value. Here, positive samples can include transaction samples corresponding to risky transactions, and negative samples include transaction samples corresponding to risky transactions, normal transactions, and other transactions.

[0065] For example, assuming that the label of the positive sample is 1, the label of the negative sample is 0, and the probability value of the risky transaction being marked is e(x), then the positive sample includes the transaction samples corresponding to the risky transaction, with a weight of 1 / e(x); the negative sample includes the transaction samples corresponding to the risky transaction, normal transaction, and other samples, with weights of 1-1 / e(x), 1, and 1, respectively, that is, the sample weight corresponding to the risky transaction in the negative sample is 1-1 / e(x), and the sample weight corresponding to the normal transaction and other transactions is 1. In other words, the transaction samples corresponding to the risky transaction have one copy each in the positive sample and the negative sample, with different weights. Taking the probability value of a risky transaction A being marked as e(x)=0.1 as an example, e(x)=0.1 means that only 1 / 10 of the risky transactions are actually marked, that is, in addition to A, there are 9 risky transactions that are not marked. Since these risky transactions are not marked, they are classified into other transactions. Since other transactions are set as negative samples with a weight of 1, it means that there are 9 negative samples with a weight of 1, which should actually be counted as positive samples. Therefore, using A as a negative sample with a weight of 1-1 / 0.1=-9 can offset the effects of the above 9 samples, thereby reducing the error.

[0066] Optionally, the above probability value can be determined in a variety of ways. For example, it can be a value manually set by a technician based on actual conditions. For another example, it can be obtained based on the statistics of the complaint results of risky transactions. For example, if 40 risky transactions out of 100 risky transactions are complained as risky transactions, the probability value can be set to 40 / 100. For another example, it can also be obtained by using a preset risky transaction complaint prediction model to perform statistical analysis on the prediction results of risky transactions (for example, calculating the mean of the prediction results). Here, the risky transaction complaint prediction model can be various existing models for predicting the probability of a transaction being complained as a risky transaction.

[0067] II), using weighted positive and negative samples, supervised learning training is used to obtain a risky transaction identification model.

[0068] In this implementation, positive samples and negative samples with weights can be used to train a risky transaction identification model using supervised learning. For example, when calculating the loss function, the weights of the positive samples and negative samples are added. Through this implementation, a risky transaction identification model can be trained using supervised learning.

[0069] Reviewing the above process, the method for training a risk transaction identification model in the embodiments of this specification constructs a transaction sample based on the end-side behavior sequence, link characteristics and basic transaction information corresponding to the transaction, and trains the risk transaction identification model based on the transaction sample. As a result, the trained risk transaction identification model can comprehensively analyze the end-side behavior sequence, link characteristics and transaction information corresponding to the transaction when identifying risky transactions, thereby making the identification more accurate.

[0070] Continue to see Figure 3 , Figure 3 A method for identifying risky transactions according to an embodiment is shown. The risky transaction identification model used in the method is based on Figure 2 It is understood that Figure 3 The method shown can be executed by any device, equipment, platform, or device cluster with computing and processing capabilities. Figure 3 As shown, the method for identifying risky transactions may include the following steps:

[0071] Step 301: determine whether the terminal-side behavior sequence corresponding to the target transaction has a preset high-risk subsequence to obtain a third determination result.

[0072] In this embodiment, the target transaction is a transaction that needs to be judged as a risky transaction. For example, the target transaction can be a transaction generated by a merchant in real time. First, the terminal-side behavior sequence of the target transaction can be determined, and then it is determined whether the terminal-side behavior sequence corresponding to the target transaction has a preset high-risk subsequence, thereby obtaining a third judgment result. Among them, the third judgment result can be a high-risk subsequence or a non-high-risk subsequence.

[0073] Step 302, determining whether the link feature corresponding to the target transaction meets the preset high-risk mode, and obtaining a fourth determination result.

[0074] In this embodiment, the link characteristics corresponding to the target transaction may also be determined, and it may be determined whether the link characteristics corresponding to the target transaction conform to a preset high-risk mode to obtain a fourth determination result, wherein the fourth determination result may be conforming to the high-risk mode or not conforming to the high-risk mode.

[0075] Step 303: input the third judgment result, the fourth judgment result and the basic transaction information of the target transaction into a pre-trained risky transaction identification model.

[0076] In this embodiment, the third judgment result, the fourth judgment result and the basic transaction information of the target transaction can be input into the Figure 2 The risky transaction identification model obtained by training the method is described, thereby obtaining the output result of the risky transaction identification model. Here, the basic transaction information may include but is not limited to the user information of the transaction initiator, historical transaction behavior, etc.

[0077] Step 304: determine whether the target transaction is a transaction of a preset risk type based on the output result of the risk transaction identification model.

[0078] In this embodiment, the output result of the risky transaction identification model may be a probability value, which may indicate the probability that the target transaction is a transaction of a preset risk type (e.g., online gambling). At this time, it may be determined whether the target transaction is a transaction of the preset risk type based on the probability value. For example, the probability value may be compared with a preset threshold value, and if it is greater than the threshold value, the target transaction is determined to be a transaction of the preset risk type.

[0079] Reviewing the above process, the method for identifying risky transactions in the embodiments of this specification, when using the risky transaction identification model to identify risky transactions, comprehensively analyzes the end-side behavior sequence, link characteristics, basic transaction information and other information corresponding to the target transaction, thereby making the identification more accurate.

[0080] According to another embodiment, a device for training a risky transaction identification model is provided. The device for training a risky transaction identification model can be deployed in any device, platform or device cluster with computing and processing capabilities.

[0081] Figure 4 FIG. 1 is a schematic block diagram of an apparatus for training a risky transaction identification model according to an embodiment. Figure 4 As shown, the device 400 for training the risk transaction identification model includes: an acquisition unit 401, configured to acquire historical transaction records, wherein the above historical transaction records include: risk transactions marked with risk labels, normal transactions marked with non-risk labels, and other transactions without labels; a first judgment unit 402, configured to judge whether the terminal-side behavior sequence corresponding to each transaction in the above historical transaction records has a preset high-risk subsequence, and obtain a first judgment result; a second judgment unit 403, configured to judge whether the link feature corresponding to each transaction in the above historical transaction records conforms to a preset high-risk mode, and obtain a second judgment result; a construction unit 404, configured to construct each transaction sample based on the first judgment result, the second judgment result, and the basic transaction information corresponding to each transaction; a training unit 405, configured to train the risk transaction identification model based on each transaction sample and its label annotation.

[0082] In some optional implementations of the present embodiment, the above-mentioned device 400 also includes: a forming unit (not shown in the figure), configured to form a risk sequence and a normal sequence respectively based on the end-side behavior sequences corresponding to the risk transactions and the normal transactions; a frequent subsequence determination unit (not shown in the figure), configured to perform sequence mining on the risk sequence to obtain at least one frequent subsequence; a high-risk subsequence determination unit (not shown in the figure), configured to determine a frequent subsequence from the above-mentioned at least one frequent subsequence as the above-mentioned high-risk subsequence according to the occurrence proportion of each frequent subsequence in the risk sequence and the normal sequence.

[0083] In some optional implementations of this embodiment, the above-mentioned high-risk subsequence determination unit is further configured to: determine the information value of each frequent subsequence according to the occurrence ratio of each frequent subsequence in the risk sequence and the normal sequence; and use the frequent subsequence whose corresponding information value is greater than a preset threshold as the above-mentioned high-risk subsequence.

[0084] In some optional implementations of this embodiment, the terminal-side behavior sequence is generated based on at least one of the following logs: a super location model log, a remote procedure call log, and a terminal-side security system log.

[0085] In some optional implementations of the present embodiment, the above-mentioned device 400 also includes: a link feature acquisition unit (not shown in the figure), configured to obtain the link features corresponding to each transaction in the historical transaction records; a high-risk pattern determination unit (not shown in the figure), configured to perform attribution analysis on the link features corresponding to each transaction, and determine at least one transaction pattern as the above-mentioned high-risk pattern, wherein the number of risky transactions and the concentration of risky transactions corresponding to the high-risk pattern are respectively higher than the corresponding preset thresholds.

[0086] In some optional implementations of this embodiment, the link characteristics corresponding to the transaction include at least one of the following: characteristics of each jump position of the transaction, number of jumps, payment channels, payment products, order product names, and the magnitude of the number of times the payee information appears within a preset time period.

[0087] In some optional implementations of the present embodiment, the label value of the risk label is a first value, the label value of the risk-free label is a second value, and the first value is greater than the second value; and the training unit 405 is further configured to: select some samples from the risk samples corresponding to the risk transactions as disguised unlabeled samples; train a first model based on at least the remaining risk samples and normal samples corresponding to normal transactions; use the first model to predict the disguised unlabeled samples to determine the minimum score obtained by the prediction; use the first model to predict the unlabeled samples corresponding to other transactions, set the label value of the unlabeled samples whose prediction value is greater than or equal to the minimum score to the minimum score, and set the label value of the remaining unlabeled samples to the second value; use risk samples, normal samples, and unlabeled samples with label values ​​to further train the first model to obtain a risky transaction identification model.

[0088] In some optional implementations of the present embodiment, the first model is trained at least based on the residual risk samples and the normal samples corresponding to the normal transactions, including: performing self-training based on the residual risk samples, the normal samples and the unlabeled samples to obtain the first model.

[0089] In some optional implementations of the present embodiment, the training unit 405 is further configured to: set weight values ​​of transaction samples in positive samples and negative samples based on the probability value of risky transactions being marked, wherein positive samples include transaction samples corresponding to risky transactions, and negative samples include transaction samples corresponding to risky transactions, normal transactions and other transactions; use positive samples and negative samples with weights to obtain a risky transaction identification model through supervised learning training.

[0090] In some optional implementations of the present embodiment, the above-mentioned probability value is obtained based on statistics of complaint results of risky transactions, or is obtained by statistically analyzing the prediction results of risky transactions using a preset risky transaction complaint prediction model.

[0091] In some optional implementations of this embodiment, the above-mentioned normal transactions are transactions completed through the merchant's official application, and the above-mentioned other transactions are transactions other than risky transactions and normal transactions.

[0092] According to another embodiment, a device for identifying risky transactions is provided. The device for identifying risky transactions can be deployed in any device, platform or device cluster with computing and processing capabilities.

[0093] Figure 5 FIG. 1 is a schematic block diagram of an apparatus for identifying risky transactions according to an embodiment. Figure 5As shown, the device 500 for identifying risky transactions includes: a third judgment unit 501, configured to judge whether the terminal-side behavior sequence corresponding to the target transaction has a preset high-risk subsequence, and obtain a third judgment result; a fourth judgment unit 502, configured to judge whether the link characteristics corresponding to the target transaction conform to the preset high-risk mode, and obtain a fourth judgment result; an input unit 503, configured to input the above-mentioned third judgment result, the fourth judgment result and the basic transaction information of the above-mentioned target transaction into a pre-trained risk transaction identification model; a risk transaction judgment unit 504, configured to judge whether the above-mentioned target transaction is a transaction of a preset risk type according to the output result of the above-mentioned risk transaction identification model.

[0094] According to another embodiment, there is also provided a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute Figure 2 or Figure 3 The method described.

[0095] According to another embodiment, there is also provided a computing device, comprising a memory and a processor, wherein the memory stores an executable code, and when the processor executes the executable code, Figure 2 or Figure 3 The method described.

[0096] Those of ordinary skill in the art should further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0097] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented by hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0098] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for training a risky transaction identification model, comprising: Acquire historical transaction records, wherein the historical transaction records include: risky transactions marked with risk labels, normal transactions marked with non-risk labels, and other transactions without labels; Determine whether the terminal-side behavior sequence corresponding to each transaction in the historical transaction record has a predetermined high-risk subsequence, and obtain a first judgment result, wherein the terminal-side behavior sequence is a sequence formed by user operation behaviors performed on the user terminal; the high-risk subsequence indicates abnormal terminal-side user behaviors related to risky transactions; Determine whether the link characteristics corresponding to each transaction in the historical transaction record conform to a preset high-risk mode, and obtain a second judgment result, wherein the link characteristics refer to the characteristics of the technical link, including at least one of the following: the characteristics of each jump position of the transaction, the number of jumps, the payment channel, the payment product, the order product name, and the magnitude of the number of times the payee information appears within a preset time period; Constructing each transaction sample based on the first judgment result, the second judgment result, and the basic transaction information corresponding to each transaction; Based on each transaction sample and its label annotation, a risky transaction identification model is trained.

2. The method according to claim 1, wherein: The method further comprises: Based on the end-side behavior sequences corresponding to risky transactions and normal transactions, risk sequences and normal sequences are formed respectively; Perform sequence mining on the risk sequence to obtain at least one frequent subsequence; According to the occurrence ratio of each frequent subsequence in the risk sequence and the normal sequence, a frequent subsequence is determined from the at least one frequent subsequence as the high-risk subsequence.

3. The method according to claim 2, wherein: The determining, from the at least one frequent subsequence according to the occurrence ratio of each frequent subsequence in the risk sequence and the normal sequence, a frequent subsequence as the high-risk subsequence comprises: Determine the information value of each frequent subsequence according to its occurrence ratio in the risk sequence and the normal sequence; The frequent subsequences whose corresponding information values ​​are greater than a preset threshold are regarded as the high-risk subsequences.

4. The method according to claim 1, wherein: The end-side behavior sequence is generated based on at least one of the following logs: a super location model log, a remote procedure call log, and an end-side security system log.

5. The method according to claim 1, wherein: The method further comprises: Obtaining link features corresponding to each transaction in the historical transaction record; Attribution analysis is performed on the link features corresponding to each transaction, and at least one transaction mode is determined as the high-risk mode, wherein the number of risky transactions and the concentration of risky transactions corresponding to the high-risk mode are respectively higher than the corresponding preset thresholds.

6. The method according to claim 1, wherein: The label value of the risk label is a first value, the label value of the risk-free label is a second value, and the first value is greater than the second value; as well as The risk transaction identification model is trained based on each transaction sample and its label annotation, including: Select some samples from the risk samples corresponding to risky transactions as disguised unlabeled samples; A first model is obtained by training based on at least the residual risk sample and the normal sample corresponding to the normal transaction; Use the first model to predict the disguised unlabeled samples and determine the lowest score obtained by the prediction; Using the first model to predict the unlabeled samples corresponding to other transactions, setting the label values ​​of the unlabeled samples whose prediction values ​​are greater than or equal to the minimum score to the minimum score, and setting the label values ​​of the remaining unlabeled samples to the second value; The first model is further trained using risk samples, normal samples, and unlabeled samples with label values ​​to obtain a risky transaction identification model.

7. The method according to claim 6, wherein: The training of a first model based at least on the residual risk samples and the normal samples corresponding to the normal transactions comprises: The first model is obtained by performing self-training based on the remaining risk samples, normal samples and unlabeled samples.

8. The method according to claim 1, wherein: The risk transaction identification model is trained based on each transaction sample and its label annotation, including: Based on the probability value of risky transactions being marked, weight values ​​of transaction samples in positive samples and negative samples are set, wherein positive samples include transaction samples corresponding to risky transactions, and negative samples include transaction samples corresponding to risky transactions, normal transactions, and other transactions; Using weighted positive and negative samples, a risky transaction identification model is obtained through supervised learning training.

9. The method according to claim 8, wherein: The probability value is obtained based on statistics of the complaint results of risky transactions, or obtained by statistically analyzing the prediction results of risky transactions using a preset risky transaction complaint prediction model.

10. The method according to claim 1, wherein: The normal transactions are transactions completed through the merchant's official application, and the other transactions are transactions other than risky transactions and normal transactions.

11. A method for identifying risky transactions, comprising: Determine whether the terminal-side behavior sequence corresponding to the target transaction has a predetermined high-risk subsequence, and obtain a third judgment result, wherein the terminal-side behavior sequence is a sequence formed by user operation behaviors performed on the user terminal; the high-risk subsequence indicates abnormal terminal-side user behaviors related to risky transactions; Determine whether the link characteristics corresponding to the target transaction meet the preset high-risk mode, and obtain a fourth judgment result, wherein the link characteristics refer to the characteristics of the technical link, including at least one of the following: the characteristics of each jump position of the transaction, the number of jumps, the payment channel, the payment product, the order product name, and the magnitude of the number of times the payee information appears within a preset time period; Inputting the third judgment result, the fourth judgment result and the basic transaction information of the target transaction into a pre-trained risky transaction identification model; According to the output result of the risky transaction identification model, it is determined whether the target transaction is a transaction of a preset risk type.

12. A device for training a risky transaction identification model, comprising: an acquisition unit configured to acquire historical transaction records, wherein the historical transaction records include: risky transactions marked with risk labels, normal transactions marked with risk-free labels, and other transactions without labels; A first judgment unit is configured to judge whether the terminal-side behavior sequence corresponding to each transaction in the historical transaction record has a preset high-risk subsequence, and obtain a first judgment result, wherein the terminal-side behavior sequence is a sequence formed by user operation behaviors performed on the user terminal; the high-risk subsequence represents abnormal terminal-side user behaviors related to risky transactions; A second judgment unit is configured to judge whether the link characteristics corresponding to each transaction in the historical transaction record conform to a preset high-risk mode, and obtain a second judgment result, wherein the link characteristics refer to the characteristics of the technical link, including at least one of the following: the characteristics of each jump position of the transaction, the number of jumps, the payment channel, the payment product, the order product name, and the magnitude of the number of times the payee information appears within a preset time period; A construction unit configured to construct each transaction sample based on the first judgment result, the second judgment result, and the basic transaction information corresponding to each transaction; The training unit is configured to train a risky transaction identification model based on each transaction sample and its label annotation.

13. A device for identifying risky transactions, comprising: A third judgment unit is configured to judge whether the terminal-side behavior sequence corresponding to the target transaction has a preset high-risk subsequence, and obtain a third judgment result, wherein the terminal-side behavior sequence is a sequence formed by user operation behaviors performed on the user terminal; the high-risk subsequence represents abnormal terminal-side user behaviors related to risky transactions; The fourth judgment unit is configured to judge whether the link characteristics corresponding to the target transaction meet the preset high-risk mode, and obtain a fourth judgment result, wherein the link characteristics refer to the characteristics of the technical link, including at least one of the following: the characteristics of each jump position of the transaction, the number of jumps, the payment channel, the payment product, the order product name, and the magnitude of the number of times the payee information appears within a preset time period; An input unit, configured to input the third judgment result, the fourth judgment result and the basic transaction information of the target transaction into a pre-trained risk transaction identification model; The risky transaction judging unit is configured to judge whether the target transaction is a transaction of a preset risk type according to an output result of the risky transaction identification model.

14. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 11.

15. A computing device comprising a memory and a processor, characterized in that: The memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 11 is implemented.

Images