Methods, devices, and electronic equipment for determining anti-fraud strategies

Abstract

This disclosure provides a method, apparatus, and electronic device for determining anti-fraud strategies, relating to the field of artificial intelligence technology, particularly deep learning, cloud computing, and natural language processing technology. The solution involves: identifying multiple object identifiers to be processed, object data corresponding to each object identifier, and a feature vector sequence corresponding to each object identifier; clustering the multiple object identifiers based on the feature vector sequence to obtain at least one object identifier group; for each object identifier group, obtaining labels corresponding to at least a portion of the object identifiers in the group, and determining the label of the object identifier group based on the labels corresponding to at least a portion of the object identifiers; and determining an anti-fraud strategy for the object identifiers based on the labels of at least one object identifier group and the object data corresponding to the object identifiers in each object identifier group, thereby further improving the accuracy of the anti-fraud strategy and further improving the accuracy and efficiency of anti-fraud detection.

Description

Technical Field

[0001] This disclosure relates to the field of artificial intelligence technology, and more particularly to the fields of deep learning, cloud computing, and natural language processing technology, and especially to methods, apparatus, and electronic devices for determining anti-fraud strategies. Background Technology

[0002] Currently, a significant number of fraudulent activities occur among participants in service activities organized by service platforms. To address this, corresponding anti-fraud strategies need to be developed to identify fraudulent activities. Current technologies primarily rely on manually labeling fraudulent activity based on extensive object data from the service platform, followed by analysis to determine appropriate anti-fraud strategies. This approach is costly, time-consuming, and yields low accuracy and inefficient fraud detection. Summary of the Invention

[0003] This disclosure provides a method, apparatus, and electronic device for determining an anti-fraud strategy.

[0004] According to one aspect of this disclosure, a method for determining an anti-fraud strategy is provided, comprising: determining a plurality of object identifiers to be processed, object data corresponding to each object identifier, and a feature vector sequence corresponding to each object identifier; performing clustering processing on the plurality of object identifiers according to the feature vector sequence corresponding to the plurality of object identifiers to obtain at least one object identifier group; for each object identifier group, obtaining labels corresponding to at least some object identifiers in the object identifier group, and determining a label for the object identifier group according to the labels corresponding to the at least some object identifiers; wherein the label represents whether fraud exists; and determining an anti-fraud strategy for the object identifiers according to the labels of the at least one object identifier group and the object data corresponding to the object identifiers in each object identifier group.

[0005] According to another aspect of this disclosure, an apparatus for determining an anti-fraud strategy is provided, comprising: a first determining module, configured to determine a plurality of object identifiers to be processed, object data corresponding to each object identifier, and a feature vector sequence corresponding to each object identifier; a clustering module, configured to perform clustering processing on the plurality of object identifiers according to the feature vector sequence corresponding to the plurality of object identifiers to obtain at least one object identifier group; a processing module, configured to, for each object identifier group, obtain tags corresponding to at least some object identifiers in the object identifier group, and determine a tag for the object identifier group according to the tags corresponding to the at least some object identifiers; wherein the tag indicates whether fraud exists; and a second determining module, configured to determine an anti-fraud strategy for the object identifiers according to the tags of the at least one object identifier group and the object data corresponding to the object identifiers in each object identifier group.

[0006] According to another aspect of this disclosure, an electronic device is provided, comprising:

[0007] At least one processor; and

[0008] A memory communicatively connected to the at least one processor; wherein,

[0009] The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method for determining the anti-fraud strategy proposed in this disclosure.

[0010] According to another aspect of this disclosure, a non-transitory computer-readable storage medium is provided that stores computer instructions for causing the computer to execute the method for determining the anti-fraud strategy proposed in this disclosure.

[0011] According to another aspect of this disclosure, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the method for determining the anti-fraud strategy proposed above in this disclosure.

[0012] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0013] The accompanying drawings are provided to better understand this solution and do not constitute a limitation of this disclosure. Wherein:

[0014] Figure 1 This is a schematic diagram based on the first embodiment of the present disclosure;

[0015] Figure 2 This is a schematic diagram according to the second embodiment of the present disclosure;

[0016] Figure 3 This is a schematic diagram of the process for determining anti-fraud strategies;

[0017] Figure 4 This is a schematic diagram according to the third embodiment of the present disclosure;

[0018] Figure 5 This is a block diagram of an electronic device used to implement embodiments of the present disclosure. Detailed Implementation

[0019] The exemplary embodiments of this disclosure are described below with reference to the accompanying drawings, including various details of the embodiments to aid understanding, and should be considered merely exemplary. Therefore, those skilled in the art will recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this disclosure. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0020] It should be noted that the acquisition, storage, and application of user personal information involved in the technical solution disclosed herein comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0021] Currently, a significant number of fraudulent activities occur among participants in service activities organized by service platforms. To address this, corresponding anti-fraud strategies need to be developed to identify fraudulent activities. Current technologies primarily rely on manually labeling fraudulent activity based on extensive object data from the service platform, followed by analysis to determine appropriate anti-fraud strategies. This approach is costly, time-consuming, and yields low accuracy and inefficient fraud detection.

[0022] To address the aforementioned issues, this disclosure proposes a method, apparatus, and electronic device for determining anti-fraud strategies.

[0023] Figure 1 This is a schematic diagram based on the first embodiment of the present disclosure. It should be noted that the method for determining the anti-fraud strategy in the embodiments of the present disclosure can be applied to an anti-fraud strategy determination device, which can be configured in an electronic device so that the electronic device can perform the function of determining the anti-fraud strategy.

[0024] Among them, electronic devices can be any device with computing capabilities, such as personal computers (PCs), mobile terminals, servers, etc. Mobile terminals can be hardware devices with various operating systems, touch screens and / or displays, such as in-vehicle devices, mobile phones, tablets, personal digital assistants, wearable devices, etc.

[0025] like Figure 1 As shown, the method for determining this anti-fraud strategy may include the following steps:

[0026] Step 101: Determine the multiple object identifiers to be processed, the object data corresponding to each object identifier, and the feature vector sequence corresponding to each object identifier.

[0027] In this embodiment of the disclosure, the multiple object identifiers to be processed can be from a service platform, such as an internet platform, like Mall A or Mall B. Taking Mall A as an example, the service activities organized by Mall A can be promotional activities jointly organized by Mall A and its merchants, such as discount activities or promotional activities.

[0028] In this embodiment of the disclosure, the objects corresponding to the multiple object identifiers to be processed can be users who have successfully participated in the service activity. Taking a promotional activity of Mall A as an example, a user who has successfully participated in the promotional activity is a user who purchases goods from the merchant organizing the promotion and uses the coupons provided by the promotion.

[0029] In this embodiment of the disclosure, object data may include at least one of the following: basic data, business data, operational behavior information, and device information. For example, taking an object identifier corresponding to an object in Mall A as an example, the basic data may be the object's basic personal information, such as age, account, and gender.

[0030] In this embodiment, the business data can be data generated from conducting business on Mall A, such as order-related information, payment-related information, and investment-related information. Order-related information may include: the type of goods ordered, the price of the goods, the account used to place the order, the IP address used to place the order, the order time, and any applicable discounts. Payment-related information may include: the account used to place the payment, the amount paid, the IP address used to place the payment, and the payment time. Investment-related information may include: the type of investment, the amount invested, the investment account, the IP address used to invest, and the time of the investment-related operation.

[0031] In this embodiment of the disclosure, the operation behavior information may include multiple object behavior information, such as login behavior information, click behavior information, browsing behavior information, and dwell behavior information. Login behavior information may include: login behavior, login time, login account, and IP address at the time of login. Click behavior information may include: click behavior, click time, page-related information, click location on the page, account at the time of click, and IP address at the time of click. Dwell behavior information may include: account, IP address, page-related information at the time of dwell, and dwell duration.

[0032] In this embodiment, the device information can be the identification information of the hardware device used by the object to log in to the service platform. The hardware device can be, for example, a smartphone, personal computer, or tablet. Taking the service platform as Mall A as an example, the device information can be the identification information of the hardware device, such as a smartphone or personal computer, used by the object to log in to Mall A. The identification information of the hardware device can be a unique identifier such as a serial number, which can be set according to actual needs.

[0033] In this embodiment of the disclosure, it should be noted that the IP address is determined based on the hardware device used by the object and the network to which the hardware device belongs. Different hardware devices will have different IP addresses; different networks will also have different IP addresses.

[0034] It should be noted that the device for determining the anti-fraud strategy in this embodiment can obtain the object data in various public, legal and compliant ways. For example, it can obtain the object data from a public dataset, or it can obtain the object data from the user after authorization. This disclosure does not limit this.

[0035] In this embodiment of the disclosure, for each object identifier, the anti-fraud strategy determination device can determine the feature vector sequence corresponding to the object identifier based on the object data corresponding to the object identifier. The feature vector sequences corresponding to each object identifier can have the same dimension to facilitate clustering of multiple object identifiers.

[0036] Step 102: Based on the feature vector sequences corresponding to multiple object identifiers, perform clustering processing on the multiple object identifiers to obtain at least one object identifier group.

[0037] In this embodiment of the disclosure, the process of the anti-fraud strategy determination device performing step 102 can be, for example, determining the similarity between any two feature vector sequences among multiple feature vector sequences; and performing clustering processing on multiple object identifiers based on the similarity to obtain clustering results. The number of object identifier groups can be preset, and correspondingly, the clustering results include that number of object identifier groups. The clustering algorithm can be, for example, K-Means clustering algorithm, spatial clustering algorithm, Gaussian mixture model-based clustering algorithm, etc., and can be set according to actual needs.

[0038] Step 103: For each object identifier group, obtain the tags corresponding to at least some of the object identifiers in the object identifier group, and determine the tags of the object identifier group based on the tags corresponding to at least some of the object identifiers; wherein, the tags indicate whether fraud exists.

[0039] In one example of this disclosure, the anti-fraud strategy determination device can randomly select at least a portion of the object identifiers in each object identifier group, push the object data corresponding to the at least a portion of the object identifiers to the reviewer, and have the reviewer manually label the data and return it to the anti-fraud strategy determination device.

[0040] In another example, when determining multiple object identifiers to be processed, the anti-fraud strategy determining device selects at least some object identifiers that carry tags, thereby making at least some object identifiers in the object identifier group carry corresponding tags.

[0041] In embodiments of this disclosure, the label may include a first label and a second label. In one example, the first label indicates that fraud exists, and the second label indicates that no fraud exists. In another example, the first label indicates that no fraud exists, and the second label indicates that fraud exists. The first label and the second label may be represented by different symbols. For example, the first label may be represented by the number 0, and the second label may be represented by the number 1.

[0042] In this embodiment of the disclosure, the label includes a first label and a second label, wherein the first label indicates that fraud exists, and the second label indicates that no fraud exists. Correspondingly, the process of the anti-fraud strategy determination device performing step 103 can be, for example, as follows: for each object identifier group, obtain the labels corresponding to at least a portion of the object identifiers in the object identifier group; determine the fraud ratio of the object identifier group based on the number of first labels and the number of second labels among the labels corresponding to at least a portion of the object identifiers; when the fraud ratio is greater than or equal to a preset ratio threshold, determine the label of the object identifier group as the first label; when the fraud ratio is less than the ratio threshold, determine the label of the object identifier group as the second label.

[0043] In one embodiment of this disclosure, the process by which the anti-fraud strategy determining device determines the fraud ratio of an object identifier group can be, for example, determining the ratio of the number of first tags to the number of second tags as the fraud ratio. In another embodiment, the process by which the anti-fraud strategy determining device determines the fraud ratio of an object identifier group can also be, for example, determining the total number of first tags and second tags, and determining the ratio of the number of first tags to the total number as the fraud ratio.

[0044] In this embodiment of the disclosure, the fraud ratio is determined by the number of first and second tags in the tags corresponding to at least some object identifiers. Based on the relationship between the fraud ratio and the ratio threshold, the tag of the object identifier group is determined to be the first tag or the second tag, thereby filtering out the object identifier groups with fraudulent situations so as to extract anti-fraud strategies. Here, only at least some object identifiers are labeled, the amount of labeling is small, the cost is low, and the efficiency of determining anti-fraud strategies is further improved.

[0045] Step 104: Determine an anti-fraud strategy for object identifiers based on the labels of at least one object identifier group and the object data corresponding to the object identifiers in each object identifier group.

[0046] In this embodiment of the disclosure, the process of the anti-fraud strategy determination device performing step 104 may be as follows: determining a decision tree model based on the labels of at least one object identifier group and the object data corresponding to the object identifier in each object identifier group, wherein the decision tree model includes multiple nodes and the splitting conditions of each node; the nodes represent data in the object data, or statistical features on a specified dimension determined based on the object data; and updating the existing anti-fraud strategy according to the multiple nodes in the decision tree model and the splitting conditions of each node to obtain an anti-fraud strategy for the object identifier.

[0047] In this embodiment of the disclosure, after determining the decision tree model, multiple nodes in the decision tree model and the splitting conditions of each node can be fed back to the reviewer to determine whether to use the decision tree model to update the existing anti-fraud strategy; after receiving the confirmation instruction, the existing anti-fraud strategy is updated according to the multiple nodes in the decision tree model and the splitting conditions of each node.

[0048] In this embodiment of the disclosure, anti-fraud rules applicable to objects within a recent time period are obtained based on the nodes of the decision tree model and the splitting conditions of the nodes, and existing anti-fraud strategies are updated in a timely manner, thereby further improving the accuracy of the anti-fraud strategies.

[0049] In this embodiment of the disclosure, after determining the anti-fraud strategy for the object identifier, the anti-fraud strategy determining device may further perform the following steps: determining the object identifier to be identified and the object data corresponding to the object identifier to be identified; and determining whether the object corresponding to the object identifier to be identified is fraudulent based on the anti-fraud strategy and the object data corresponding to the object identifier to be identified.

[0050] In this embodiment of the disclosure, because the updated anti-fraud strategy is highly accurate, it can promptly identify and determine newly emerging fraud cases in the recent period, thereby further improving the efficiency of anti-fraud detection and enhancing the risk control effect.

[0051] In summary, by identifying multiple object identifiers to be processed, the object data corresponding to each object identifier, and the feature vector sequence corresponding to each object identifier; clustering the multiple object identifiers based on the feature vector sequences corresponding to the multiple object identifiers to obtain at least one object identifier group; for each object identifier group, obtaining the labels corresponding to at least some of the object identifiers in the object identifier group, and determining the label of the object identifier group based on the labels corresponding to at least some of the object identifiers; wherein, the label represents whether fraud exists. Based on the labels of at least one object identifier group and the object data corresponding to the object identifiers in each object identifier group, an anti-fraud strategy for the object identifier is determined, further improving the accuracy of the anti-fraud strategy and further improving the accuracy and efficiency of anti-fraud detection.

[0052] To further improve the accuracy of anti-fraud strategies, the accuracy of feature vector sequences can be enhanced. This involves extracting statistical and behavioral feature vectors from the object data and concatenating them to obtain a feature vector sequence, such as... Figure 2 As shown, Figure 2 This is a schematic diagram according to the second embodiment of the present disclosure. Figure 2 The illustrated embodiment may include the following steps:

[0053] Step 201: Determine the multiple object identifiers to be processed, and the object data corresponding to each object identifier.

[0054] Step 202: For each object identifier, perform statistical feature extraction processing on at least one specified dimension on the object data corresponding to the object identifier to obtain a partial feature vector sequence corresponding to the object identifier.

[0055] In this embodiment of the disclosure, the process of the anti-fraud strategy determination device performing step 202 can be, for example, performing statistical feature extraction processing on the object data corresponding to each object identifier in at least one specified dimension to obtain a statistical feature data sequence; and performing vectorization and dimensionality reduction processing on the statistical feature data sequence to obtain a partial feature vector sequence.

[0056] In this embodiment of the disclosure, the statistical characteristics of a specified dimension may include at least one of the following statistical characteristics: the number of times an object logs in, the number of IPs used by the object to log in, the number of objects that use the same IP as the object within the same time period, the number of objects that use the same IP as the object and participate in the same service activities within the same time period, the number of times a payment is made, etc.

[0057] The object login count can be at least one of the following: the number of object logins per hour, the number of object logins per day, the number of object logins per N days, etc., where N is a positive integer greater than 1. The number of object login IPs can be at least one of the following: the number of object login IPs per hour, the number of object login IPs per day, the number of object login IPs per N days, etc.

[0058] The number of objects using the same IP address as the target within the same time period can be at least one of the following: the number of objects using the same IP address as the target per hour, the number of objects using the same IP address as the target per day, the number of objects using the same IP address as the target every N days, etc. The number of objects using the same IP address and participating in the same service activities as the target within the same time period can be per hour, per day, or per N days, etc. The number of payments can be at least one of the following: the number of payments per hour, the number of payments per day, the number of payments per N days, etc.

[0059] In this embodiment of the disclosure, by extracting statistical features on at least one specified dimension, a statistical feature data sequence is obtained, which can increase the number of statistical features in the statistical feature data sequence; by processing the statistical feature data sequence, a partial feature vector sequence is obtained, which can accurately characterize the object features, further improving the accuracy of the feature vector sequence, thereby further improving the accuracy of the determined anti-fraud strategy.

[0060] In this embodiment of the disclosure, the process of vectorization and dimensionality reduction of the statistical feature data sequence by the anti-fraud strategy determination device can be as follows: vectorizing the statistical feature data sequence to obtain a statistical feature vector sequence; performing dimensionality reduction on the statistical feature vector sequence according to at least one dimensionality reduction strategy to obtain at least one dimensionality-reduced feature vector sequence; and concatenating the at least one dimensionality-reduced feature vector sequence to obtain a partial feature vector sequence.

[0061] The dimensionality reduction strategy may include at least one of the following strategies: Principal Component Analysis (PCA), Auto Encoder (AE), and nonlinear dimensionality reduction strategy (t-distributed stochastic neighbor embedding, t-SNE).

[0062] In this embodiment, since the statistical feature vector sequence contains a large number of collinear or multicollinear statistical features, if clustering is performed directly without dimensionality reduction, the clustering results will be biased towards features that are collinear but are not important features for downstream tasks, resulting in poor clustering performance. Dimensionality reduction of the statistical feature vector sequence can filter out collinear or multicollinear statistical features, ensuring that there are no collinear features among the features in the dimensionality-reduced feature vector sequence. Therefore, during clustering, there will be no bias towards non-important features for downstream tasks, thereby improving the clustering effect, increasing the accuracy of the determined anti-fraud strategy, and ultimately improving anti-fraud detection efficiency. Furthermore, dimensionality reduction of the statistical feature data sequence can also significantly reduce the computational load and increase computational speed.

[0063] Step 203: Vectorize the object behavior data corresponding to the object identifier to obtain the behavior feature vector corresponding to the object identifier.

[0064] In this embodiment of the disclosure, the process of the anti-fraud strategy determination device performing step 203 may be as follows: the multiple object behavior information in the object behavior data corresponding to the object identifier are vectorized sequentially to obtain a sequence of behavior feature vectors; the maximum value or average value of the multiple behavior feature vectors in the sequence of behavior feature vectors is taken bit by bit to obtain the behavior feature vector corresponding to the object identifier.

[0065] In this embodiment of the disclosure, the vectorization processing algorithm, such as the Word2Vec algorithm or the DeepWalk algorithm, can be set according to actual needs.

[0066] In this embodiment of the disclosure, the maximum value is taken bit by bit, that is, for the same bit among multiple behavioral feature vectors, the maximum value is taken as the value of that bit in the behavioral feature vector corresponding to the object identifier. Alternatively, the average value is taken bit by bit, that is, for the same bit among multiple behavioral feature vectors, the average value is taken as the value of that bit in the behavioral feature vector corresponding to the object identifier.

[0067] In this embodiment of the disclosure, by taking the maximum value and average value of the same bits in multiple behavioral feature vectors as the value of that bit in the behavioral feature vector corresponding to the object identifier, the number of feature vectors is reduced while retaining important features, thereby improving the accuracy of feature extraction.

[0068] Step 204: Concatenate the partial feature vector sequence and the behavioral feature vector to obtain the feature vector sequence.

[0069] Step 205: Based on the feature vector sequences corresponding to multiple object identifiers, perform clustering processing on the multiple object identifiers to obtain at least one object identifier group.

[0070] Step 206: For each object identifier group, obtain the tags corresponding to at least some of the object identifiers in the object identifier group, and determine the tags of the object identifier group based on the tags corresponding to at least some of the object identifiers; wherein, the tags indicate whether fraud exists.

[0071] Step 207: Determine an anti-fraud strategy for object identifiers based on the labels of at least one object identifier group and the object data corresponding to the object identifiers in each object identifier group.

[0072] It should be noted that for details regarding steps 205, 206, and 207, please refer to [the relevant documentation / reference]. Figure 1 Steps 102, 103, and 104 in the illustrated embodiment will not be described in detail here.

[0073] In summary, the process involves identifying multiple object identifiers to be processed, along with the corresponding object data for each identifier. For each object identifier, statistical feature extraction is performed on the corresponding object data across at least one specified dimension to obtain a partial feature vector sequence. The corresponding object behavior data is then vectorized to obtain a behavior feature vector. The partial feature vector sequence and the behavior feature vector are concatenated to obtain a feature vector sequence. Based on the feature vector sequences corresponding to multiple object identifiers, the identifiers are clustered to obtain at least one object identifier group. For each object identifier group, labels are obtained for at least a portion of the object identifiers within that group, and the labels for the object identifier group are determined based on these labels. These labels represent the presence or absence of fraud. Based on the labels of at least one object identifier group and the corresponding object data for each object identifier within that group, an anti-fraud strategy is determined to further improve the efficiency and accuracy of fraud rule extraction.

[0074] For example, Figure 3 A diagram illustrating the process of determining anti-fraud strategies, such as... Figure 3As shown, the anti-fraud strategy determination device extracts statistical features and behavioral feature vectors based on customer basic data, customer business data, and customer behavior data (operational behavior information), obtaining an original feature wide table and a sequence of behavioral feature vectors. Dimensionality reduction is then performed using a dimensionality reduction strategy to obtain a low-dimensional feature wide table (partial feature vector sequence). For multiple behavioral feature vectors in the sequence, either maximum value (MaxPooling) or meanpooling is used to obtain the behavioral feature vector corresponding to the object identifier. The partial feature vector sequence and the behavioral feature vectors are concatenated to obtain a feature vector sequence. Based on the feature vector sequences corresponding to multiple object identifiers, multiple object identifiers are clustered to obtain multiple object identifier groups. Random sampling is performed on each object identifier group, and reviewers manually label the samples to obtain the fraud rate for each object identifier group. The object identifier groups with high fraud rates are then trained using a decision tree binary classification system to extract anti-fraud strategies.

[0075] Combination Figure 4 The apparatus for determining the anti-fraud strategy provided in this disclosure will be described.

[0076] Figure 4 This is a schematic diagram according to the third embodiment of the present disclosure.

[0077] like Figure 4 As shown, the anti-fraud strategy determination device 400 provided in this disclosure includes: a first determination module 410, a clustering module 420, a processing module 430, and a second determination module 440.

[0078] The first determining module 410 is used to determine multiple object identifiers to be processed, object data corresponding to each object identifier, and feature vector sequence corresponding to each object identifier.

[0079] Clustering module 420 is used to perform clustering processing on the multiple object identifiers based on the feature vector sequences corresponding to the multiple object identifiers to obtain at least one object identifier group;

[0080] Processing module 430 is configured to, for each object identifier group, obtain tags corresponding to at least a portion of the object identifiers in the object identifier group, and determine the tags of the object identifier group based on the tags corresponding to the at least a portion of the object identifiers; wherein, the tags indicate whether fraud exists;

[0081] The second determining module 440 is used to determine an anti-fraud strategy for an object identifier based on the tags of the at least one object identifier group and the object data corresponding to the object identifier in each object identifier group.

[0082] It should be noted that the anti-fraud strategy determination device provided in this embodiment can execute the anti-fraud strategy determination method of the aforementioned embodiment to achieve more accurate extraction of anti-fraud strategies.

[0083] It should be noted that the foregoing description of the embodiments of the method for determining anti-fraud strategies also applies to the apparatus for determining anti-fraud strategies provided in this disclosure, and will not be repeated here.

[0084] As one possible implementation of this disclosure, the object data includes object behavior data. The first determining module 410 is further configured to: determine multiple object identifiers to be processed, and object data corresponding to each object identifier; for each object identifier, perform statistical feature extraction processing on the object data corresponding to the object identifier in at least one specified dimension to obtain a partial feature vector sequence corresponding to the object identifier; perform vectorization processing on the object behavior data corresponding to the object identifier to obtain a behavior feature vector corresponding to the object identifier; and concatenate the partial feature vector sequence and the behavior feature vector to obtain the feature vector sequence.

[0085] As one possible implementation of this disclosure, the first determining module 410 is further configured to: for each object identifier, perform statistical feature extraction processing on the object data corresponding to the object identifier in at least one specified dimension to obtain a statistical feature data sequence; and perform vectorization processing and dimensionality reduction processing on the statistical feature data sequence to obtain the partial feature vector sequence.

[0086] As one possible implementation of this disclosure, the first determining module 410 is further configured to: perform vectorization processing on the statistical feature data sequence to obtain a statistical feature vector sequence; perform dimensionality reduction processing on the statistical feature vector sequence according to at least one dimensionality reduction processing strategy to obtain at least one dimensionality-reduced feature vector sequence; and perform concatenation processing on the at least one dimensionality-reduced feature vector sequence to obtain the partial feature vector sequence.

[0087] As one possible implementation of this disclosure, the dimensionality reduction strategy includes at least one of the following strategies: principal component analysis strategy, autoencoder strategy, and nonlinear dimensionality reduction strategy.

[0088] As one possible implementation of this disclosure, the first determining module 410 is further configured to: sequentially vectorize the plurality of object behavior information in the object behavior data corresponding to the object identifier to obtain a behavior feature vector sequence; and take the maximum value or average value of the plurality of behavior feature vectors in the behavior feature vector sequence to obtain the behavior feature vector corresponding to the object identifier.

[0089] As one possible implementation of this disclosure, the tag includes a first tag and a second tag, wherein the first tag indicates that fraud exists and the second tag indicates that no fraud exists; the processing module 430 is further configured to: for each object identifier group, obtain tags corresponding to at least a portion of the object identifiers in the object identifier group; determine the fraud ratio of the object identifier group based on the number of first tags and the number of second tags among the tags corresponding to the at least a portion of the object identifiers; when the fraud ratio is greater than or equal to a preset ratio threshold, determine the tag of the object identifier group as a first tag; when the fraud ratio is less than the ratio threshold, determine the tag of the object identifier group as a second tag.

[0090] As one possible implementation of this disclosure, the second determining module 440 is further configured to: determine a decision tree model based on the labels of the at least one object identifier group and the object data corresponding to the object identifier in each object identifier group; wherein the decision tree model includes multiple nodes and a splitting condition for each node; the node represents data in the object data, or statistical features on a specified dimension determined based on the object data; and update the existing anti-fraud strategy according to the multiple nodes in the decision tree model and the splitting condition of each node to obtain an anti-fraud strategy for the object identifier.

[0091] As one possible implementation of this disclosure, the apparatus further includes: a third determining module and a fourth determining module; the third determining module is used to determine an identifier of an object to be identified and object data corresponding to the identifier of the object to be identified; the fourth determining module is used to determine whether the object corresponding to the identifier of the object to be identified is involved in fraud based on the anti-fraud strategy and the object data corresponding to the identifier of the object to be identified.

[0092] The anti-fraud strategy determination apparatus of this disclosure determines multiple object identifiers to be processed, object data corresponding to each object identifier, and feature vector sequence corresponding to each object identifier; it performs clustering processing on the multiple object identifiers according to the feature vector sequence corresponding to the multiple object identifiers to obtain at least one object identifier group; for each object identifier group, it obtains the labels corresponding to at least some object identifiers in the object identifier group, and determines the label of the object identifier group according to the labels corresponding to at least some object identifiers; it determines the anti-fraud strategy for the object identifiers according to the label of at least one object identifier group and the object data corresponding to the object identifiers in each object identifier group, thereby further improving the efficiency of fraud rule extraction and further improving the accuracy of fraud rule extraction.

[0093] In the technical solutions disclosed herein, the collection, storage, use, processing, transmission, provision, and disclosure of users' personal information are all carried out with the consent of the users, and all comply with the provisions of relevant laws and regulations, and do not violate public order and good morals.

[0094] According to embodiments of this disclosure, this disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0095] Figure 5 A schematic block diagram of an example electronic device 500 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0096] like Figure 5 As shown, device 500 includes a computing unit 501, which can perform various appropriate actions and processes based on a computer program stored in read-only memory (ROM) 502 or a computer program loaded from storage unit 508 into random access memory (RAM) 503. RAM 503 may also store various programs and data required for the operation of device 500. The computing unit 501, ROM 502, and RAM 503 are interconnected via bus 504. Input / output (I / O) interface 505 is also connected to bus 504.

[0097] Multiple components in device 500 are connected to I / O interface 505, including: input unit 506, such as keyboard, mouse, etc.; output unit 507, such as various types of monitors, speakers, etc.; storage unit 508, such as disk, optical disk, etc.; and communication unit 509, such as network card, modem, wireless transceiver, etc. Communication unit 509 allows device 500 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0098] The computing unit 501 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 501 performs the various methods and processes described above, such as the method for determining an anti-fraud strategy. For example, in some embodiments, the method for determining an anti-fraud strategy may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 508. In some embodiments, part or all of the computer program may be loaded and / or installed on device 500 via ROM 502 and / or communication unit 509. When the computer program is loaded into RAM 503 and executed by the computing unit 501, one or more steps of the method for determining an anti-fraud strategy described above may be performed. Alternatively, in other embodiments, the computing unit 501 may be configured to perform the method for determining an anti-fraud strategy by any other suitable means (e.g., by means of firmware).

[0099] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0100] The program code used to implement the methods of this disclosure may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus, such that when executed by the processor or controller, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0101] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0102] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0103] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as a data server), or computing systems that include middleware components (e.g., an application server), or computing systems that include frontend components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with embodiments of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., a communication network). Examples of communication networks include local area networks (LANs), wide area networks (WANs), and the Internet.

[0104] Computer systems can include clients and servers. Clients and servers are generally located far apart and typically interact via communication networks. Client-server relationships are created by computer programs running on the respective computers and having a client-server relationship with each other. Servers can be cloud servers, servers in distributed systems, or servers incorporating blockchain technology.

[0105] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0106] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for determining an anti-fraud strategy, comprising: A plurality of object identifiers to be processed are identified, and object data corresponding to each object identifier is provided. The objects corresponding to the plurality of object identifiers to be processed are users who have successfully participated in the service activity. The object data includes: object behavior data. For each object identifier, perform statistical feature extraction processing on the object data corresponding to the object identifier in at least one specified dimension to obtain a partial feature vector sequence corresponding to the object identifier; The object behavior data corresponding to the object identifier is vectorized to obtain the behavior feature vector corresponding to the object identifier; The partial feature vector sequence and the behavior feature vector are concatenated to obtain the feature vector sequence corresponding to each object identifier; Based on the feature vector sequences corresponding to the multiple object identifiers, the multiple object identifiers are clustered to obtain at least one object identifier group; For each object identifier group, obtain the tags corresponding to at least some of the object identifiers in the object identifier group, and determine the tags of the object identifier group based on the tags corresponding to the at least some object identifiers; wherein, the tags indicate whether fraud exists; A decision tree model is determined based on the labels of the at least one object identifier group and the object data corresponding to the object identifier in each object identifier group, wherein the decision tree model includes multiple nodes and the splitting condition of each node; the node represents the data in the object data, or, statistical features on a specified dimension determined based on the object data; Based on the multiple nodes in the decision tree model and the splitting conditions of each node, the existing anti-fraud strategy is updated to obtain an anti-fraud strategy for the object identifier.

2. The method according to claim 1, wherein, For each object identifier, the step involves performing statistical feature extraction processing on the object data corresponding to the object identifier in at least one specified dimension to obtain a partial feature vector sequence corresponding to the object identifier, including: For each object identifier, the object data corresponding to the object identifier is subjected to statistical feature extraction processing on at least one specified dimension to obtain a statistical feature data sequence; The statistical feature data sequence is vectorized and dimensionality reduced to obtain the partial feature vector sequence.

3. The method according to claim 2, wherein, The vectorization and dimensionality reduction processing of the statistical feature data sequence to obtain the partial feature vector sequence includes: The statistical feature data sequence is vectorized to obtain a statistical feature vector sequence; The statistical feature vector sequence is subjected to dimensionality reduction processing according to at least one dimensionality reduction processing strategy to obtain at least one dimensionality-reduced feature vector sequence. The at least one dimensionality-reduced feature vector sequence is concatenated to obtain the partial feature vector sequence.

4. The method according to claim 3, wherein, The dimensionality reduction strategy includes at least one of the following strategies: principal component analysis strategy, autoencoder strategy, and nonlinear dimensionality reduction strategy.

5. The method according to claim 1, wherein, The step of vectorizing the object behavior data corresponding to the object identifier to obtain the behavior feature vector corresponding to the object identifier includes: The multiple object behavior information in the object behavior data corresponding to the object identifier are sequentially vectorized to obtain a sequence of behavior feature vectors. For multiple behavioral feature vectors in the behavioral feature vector sequence, the maximum value or average value is taken by position to obtain the behavioral feature vector corresponding to the object identifier.

6. The method according to claim 1, wherein, The label includes a first label and a second label, wherein the first label indicates that fraud has occurred, and the second label indicates that no fraud has occurred; The step of obtaining tags corresponding to at least a portion of the object identifiers in each object identifier group, and determining the tags of the object identifier group based on the tags corresponding to the at least a portion of the object identifiers, includes: For each object identifier group, obtain the tags corresponding to at least some of the object identifiers in the object identifier group; The fraud ratio of the object identifier group is determined based on the number of first tags and the number of second tags in the tags corresponding to at least some of the object identifiers; When the fraud ratio is greater than or equal to a preset ratio threshold, the label of the object identification group is determined as the first label; When the fraud ratio is less than the ratio threshold, the label of the object identification group is determined to be the second label.

7. The method according to claim 1, wherein, After determining the anti-fraud strategy for the object identifier, the method further includes: Determine the identifier of the object to be identified, and the object data corresponding to the identifier of the object to be identified; Based on the anti-fraud strategy and the object data corresponding to the object identifier to be identified, it is determined whether the object corresponding to the object identifier to be identified is involved in fraud.

8. A device for determining an anti-fraud strategy, comprising: The first determining module is used to determine multiple object identifiers to be processed, and object data corresponding to each object identifier. The objects corresponding to the multiple object identifiers to be processed are users who have successfully participated in the service activity. The object data includes: object behavior data; for each object identifier, performing statistical feature extraction processing on the object data corresponding to the object identifier in at least one specified dimension to obtain a partial feature vector sequence corresponding to the object identifier; performing vectorization processing on the object behavior data corresponding to the object identifier to obtain a behavior feature vector corresponding to the object identifier; and concatenating the partial feature vector sequence and the behavior feature vector to obtain a feature vector sequence corresponding to each object identifier. The clustering module is used to perform clustering processing on the multiple object identifiers based on the feature vector sequences corresponding to the multiple object identifiers, so as to obtain at least one object identifier group; The processing module is configured to, for each object identifier group, obtain tags corresponding to at least a portion of the object identifiers in the object identifier group, and determine the tags of the object identifier group based on the tags corresponding to the at least a portion of the object identifiers; wherein, the tags indicate whether fraud exists; The second determining module is used to determine a decision tree model based on the labels of the at least one object identifier group and the object data corresponding to the object identifier in each object identifier group. The decision tree model includes multiple nodes and splitting conditions for each node. The nodes represent data in the object data or statistical features on a specified dimension determined based on the object data. Based on the multiple nodes in the decision tree model and the splitting conditions of each node, the existing anti-fraud strategy is updated to obtain an anti-fraud strategy for the object identifier.

9. The apparatus according to claim 8, wherein, The first determining module is also used to, For each object identifier, the object data corresponding to the object identifier is subjected to statistical feature extraction processing on at least one specified dimension to obtain a statistical feature data sequence; The statistical feature data sequence is vectorized and dimensionality reduced to obtain the partial feature vector sequence.

10. The apparatus according to claim 9, wherein, The first determining module is also used to, The statistical feature data sequence is vectorized to obtain a statistical feature vector sequence; The statistical feature vector sequence is subjected to dimensionality reduction processing according to at least one dimensionality reduction processing strategy to obtain at least one dimensionality-reduced feature vector sequence. The at least one dimensionality-reduced feature vector sequence is concatenated to obtain the partial feature vector sequence.

11. The apparatus according to claim 10, wherein, The dimensionality reduction strategy includes at least one of the following strategies: principal component analysis strategy, autoencoder strategy, and nonlinear dimensionality reduction strategy.

12. The apparatus according to claim 8, wherein, The first determining module is also used to, The multiple object behavior information in the object behavior data corresponding to the object identifier are sequentially vectorized to obtain a sequence of behavior feature vectors. For multiple behavioral feature vectors in the behavioral feature vector sequence, the maximum value or average value is taken by position to obtain the behavioral feature vector corresponding to the object identifier.

13. The apparatus according to claim 8, wherein, The label includes a first label and a second label, wherein the first label indicates that fraud has occurred, and the second label indicates that no fraud has occurred; The processing module is also used for, For each object identifier group, obtain the tags corresponding to at least some of the object identifiers in the object identifier group; The fraud ratio of the object identifier group is determined based on the number of first tags and the number of second tags in the tags corresponding to at least some of the object identifiers; When the fraud ratio is greater than or equal to a preset ratio threshold, the label of the object identification group is determined as the first label; When the fraud ratio is less than the ratio threshold, the label of the object identification group is determined to be the second label.

14. The apparatus according to claim 8, wherein, The device further includes: a third determining module and a fourth determining module; The third determining module is used to determine the identifier of the object to be identified, and the object data corresponding to the identifier of the object to be identified; The fourth determining module is used to determine whether the object corresponding to the object identifier to be identified is involved in fraud based on the anti-fraud strategy and the object data corresponding to the object identifier to be identified.

15. An electronic device comprising: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-7.

16. A non-transitory computer-readable storage medium storing computer instructions, wherein, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-7.

17. A computer program product comprising a computer program that, when executed by a processor, implements the steps of the method according to any one of claims 1-7.

Images