Abnormal transaction identification method, device, equipment and medium

Abstract

The present application discloses an abnormal transaction identification method, device, equipment and medium, which belongs to the field of data processing. The method includes: obtaining expenditure card transaction data and income card transaction data within a preset time period, the expenditure card transaction data is used to represent expenditure details, and the income card transaction data is used to represent income details; according to the expenditure details represented by the expenditure card transaction data and the income details represented by the income card transaction data, the expenditure card transaction data and the income card transaction data are matched to obtain a matching data group, and the expenditure details represented by the expenditure card transaction data in the matching data group and the income details of the income card transaction data are the same or approximately the same; based on the matching data group, identify at least part of the transactions indicated by the matching data group as abnormal transactions. According to the embodiment of the present application, it is possible to realize the identification of abnormal transactions for illegal purposes.

Description

Technical Field

[0001] The present application relates to the field of data processing, and in particular to an abnormal transaction identification method, device, equipment and medium. Background Art

[0002] With the popularity of bank cards such as debit cards and credit cards, some criminals use bank card fund transactions to achieve illegal purposes. Transactions used to achieve illegal purposes are abnormal transactions. For example, credit card overdraft funds or debit card loan funds for legitimate purposes are used in illegal areas such as real estate and investment. Another example is that criminals use bank cards to transfer funds illegally obtained through gambling, fraud, etc.

[0003] At present, there is a lack of a method that can identify abnormal transactions with illegal purposes. Summary of the invention

[0004] The embodiments of the present application provide a method, apparatus, device and medium for identifying abnormal transactions, which can identify abnormal transactions for illegal purposes.

[0005] In a first aspect, an embodiment of the present application provides a method for identifying abnormal transactions, including: obtaining expenditure card transaction data and income card transaction data within a preset time period, the expenditure card transaction data being used to characterize expenditure details, and the income card transaction data being used to characterize income details; matching the expenditure card transaction data and the income card transaction data according to the expenditure details represented by the expenditure card transaction data and the income details represented by the income card transaction data to obtain a matching data group, wherein the expenditure details represented by the expenditure card transaction data in the matching data group and the income details of the income card transaction data are identical or approximately identical; based on the matching data group, identifying transactions indicated by at least part of the matching data group as abnormal transactions.

[0006] In a second aspect, an embodiment of the present application provides an abnormal transaction identification device, including: a data acquisition module, used to acquire expenditure card transaction data and income card transaction data within a preset time period, the expenditure card transaction data is used to characterize expenditure details, and the income card transaction data is used to characterize income details;

[0007] A matching module is used to match the expenditure card transaction data and the income card transaction data according to the expenditure details represented by the expenditure card transaction data and the income details represented by the income card transaction data to obtain a matching data group, wherein the expenditure details represented by the expenditure card transaction data and the income details of the income card transaction data in the matching data group are the same or approximately the same; an identification module is used to identify, based on the matching data group, transactions indicated by at least part of the matching data group as abnormal transactions.

[0008] In a third aspect, an embodiment of the present application provides an abnormal transaction identification device, comprising: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the abnormal transaction identification method of the first aspect is implemented.

[0009] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processor, the abnormal transaction identification method of the first aspect is implemented.

[0010] The embodiments of the present application provide an abnormal transaction identification method, device, equipment and medium, which can match the expenditure card transaction data and the income card transaction data according to the expenditure details represented by the acquired expenditure card transaction data and the income details represented by the income card transaction data to obtain a matching data group. In abnormal transactions, the flow of funds is very fast. Regardless of whether the transaction funds are circulated in two cards or in more cards, the expenditure details and the income details are very similar. The matching data group obtained by matching the expenditure card transaction data and the income card transaction data includes a group of expenditure card transaction data and a group of income card transaction data whose expenditure details and income details are the same or approximately the same. Therefore, the possibility that the transaction indicated by the matching data group is an abnormal transaction is very high. Based on the matching data group, the abnormal transaction indicated by the matching data group can be identified to achieve the identification of abnormal transactions for illegal purposes. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the technical solution of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0012] Figure 1 A flowchart of an embodiment of the abnormal transaction identification method provided by the present application;

[0013] Figure 2 A flowchart of another embodiment of the abnormal transaction identification method provided by the present application;

[0014] Figure 3 A flowchart of another embodiment of the abnormal transaction identification method provided by the present application;

[0015] Figure 4 A schematic diagram of the structure of an embodiment of the abnormal transaction identification device provided by the present application;

[0016] Figure 5 A schematic diagram of the structure of another embodiment of the abnormal transaction identification device provided by the present application;

[0017] Figure 6A schematic diagram of the structure of another embodiment of the abnormal transaction identification device provided by the present application;

[0018] Figure 7 A schematic diagram of the structure of another embodiment of the abnormal transaction identification device provided by the present application;

[0019] Figure 8 A schematic diagram of the structure of an embodiment of the abnormal transaction identification device provided in this application. DETAILED DESCRIPTION

[0020] The features and exemplary embodiments of various aspects of the present application will be described in detail below. In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain the present application, rather than to limit the present application. For those skilled in the art, the present application can be implemented without the need for some of these specific details. The following description of the embodiments is only to provide a better understanding of the present application by illustrating the examples of the present application.

[0021] With the popularity of bank cards such as debit cards and credit cards, some criminals use bank card fund transactions to achieve illegal purposes. Transactions used to achieve illegal purposes are abnormal transactions. For example, credit card overdraft funds or debit card loan funds for legitimate purposes are used in illegal areas such as real estate and investment. Another example is that criminals use bank cards to transfer funds illegally obtained through gambling, fraud, etc. Abnormal transactions will bring great security risks to acquiring institutions, clearing institutions and legitimate users. At present, there is a lack of a method to identify abnormal transactions for illegal purposes.

[0022] The present application provides an abnormal transaction identification method, device, equipment and medium, which can match the expenditure card transaction data and the income card transaction data according to the expenditure card transaction data and the income card transaction data in the acquired transaction, and obtain a matching data group in which the expenditure details represented by the expenditure card transaction data and the income details represented by the income card transaction data are the same or approximately the same. Since in an abnormal transaction, whether the transaction funds are circulated in two cards or in more cards, the expenditure details and the income details are very similar, the transaction indicated by the matching data group is very likely to be an abnormal transaction, and the abnormal transaction can be identified based on the matching data group.

[0023] The present application provides an abnormal transaction identification method, which can be applied to an abnormal transaction identification device or equipment, that is, the abnormal transaction identification method can be executed by the abnormal transaction identification device or equipment, which is not limited here. Figure 1 This is a flow chart of an embodiment of the abnormal transaction identification method provided by this application. Figure 1As shown, the abnormal transaction identification method may include steps S101 to S103.

[0024] In step S101, the expenditure card transaction data and the income card transaction data within a preset time period are obtained.

[0025] The expenditure card transaction data and income card transaction data within the preset time period are the expenditure card transaction data and income card transaction data corresponding to the transactions occurring within the preset time period. The preset time period can be set according to the scenario, demand, etc., and is not limited here. For example, the preset time period can be one month. For another example, the preset time period can be three months.

[0026] The spending card transaction data may include multiple data that can represent spending details, and can be used to represent spending details. A set of spending card transaction data can represent spending details of a transaction in which a bank card is the payee.

[0027] In some examples, the expenditure card transaction data may include one or more of the following: expenditure card number, expenditure card nature, expenditure card issuer identification, transaction acquirer identification, transaction merchant identification, expenditure time, expenditure amount, transaction fee, and transaction response identification, etc., which are not limited here. For example, if the expenditure card transaction data includes the expenditure card number, transaction acquirer identification, expenditure time, and expenditure amount, then a set of expenditure card transaction data may include the expenditure card number, transaction acquirer identification, expenditure time, and expenditure amount in a transaction in which a certain bank card is used as an expenditure card.

[0028] The expense card number is used to identify the bank card used as an expense card. The expense card properties can characterize the properties of the expense card, for example, the expense card properties can characterize whether the expense card is a debit card or a credit card. The expense card issuer identifier can be used to identify the issuer of the expense card. The transaction acquirer identifier is used to identify the acquirer of this transaction of the expense card. The transaction merchant identifier can be used to identify the merchant of this transaction of the expense card. The expense time is the time when the expense card is spent in this transaction, that is, the time when the expense funds are transferred from the expense card, which can be specifically a timestamp, and the form of the expense time is not limited here. The expense amount is the amount spent by the expense card in this transaction. The transaction fee is the corresponding fee spent by the expense card in this transaction. The transaction response identifier is used to characterize whether this transaction of the expense card is successful.

[0029] The income card transaction data may include multiple data that can represent income details, and can be used to represent income details. A set of income card transaction data can represent the income details of a transaction in which a bank card is the income party.

[0030] In some examples, the income card transaction data may include one or more of the income card number, income card nature, income card issuer identification, transaction acquirer identification, income time, income amount, and transaction response identification, etc., which are not limited here. For example, if the income card transaction data includes the income card number, transaction acquirer identification, income time, and income amount, then a set of income card transaction data may include the income card number, transaction acquirer identification, income time, and income amount in a transaction in which a certain bank card is used as an income card.

[0031] The income card number is used to identify the bank card used as the income card. The income card property can characterize the property of the income card. For example, the income card property can characterize whether the income card is a debit card or a credit card. The income card issuer identifier can be used to identify the issuer of the income card. The transaction acquirer identifier is used to identify the acquirer of this transaction of the income card. The income time is the time when the income card is collected in this transaction, that is, the time when the income funds are credited to the account. It can be specifically a timestamp, and the form of the income time is not limited here. The income amount is the amount collected by the income card in this transaction. The transaction response identifier is used to characterize whether this transaction of the income card is successful.

[0032] The expenditure card transaction data and the income card transaction data can be represented by fields, and the expenditure card transaction data and the income card transaction data with the same attribute can use the same field name to facilitate subsequent matching. For example, the expenditure card number and the income card number are both card numbers, and the same field name can be used to record them in the expenditure card transaction data and the income card transaction data.

[0033] In some examples, when the expenditure card transaction data includes the expenditure amount and the income card transaction data includes the income amount, after obtaining the expenditure card transaction data and the income card transaction data within a preset time period, the obtained expenditure card transaction data and the income card transaction data may also be cleaned. For example, it may be determined whether the expenditure amount in the expenditure card transaction data is less than the small payment threshold, and it may be determined whether the income amount in the income card transaction data is less than the small payment threshold; if the expenditure amount in the expenditure card transaction data is less than the small payment threshold, the expenditure card transaction data is removed; if the income amount in the income card transaction data is less than the small payment threshold, the income card transaction data is removed. The small payment threshold is a threshold value for determining small payments. The small payment threshold may be set according to scenarios, needs, experience, etc., and is not limited here. For example, the small payment threshold may be 100 yuan. If the expenditure amount is less than the small payment threshold, the transaction corresponding to the set of expenditure card transaction data where the payment amount is located may be determined as a small payment transaction; if the income amount is less than the small payment threshold, the transaction corresponding to the set of income card transaction data where the income amount is located may be determined as a small payment transaction. Normally, the amount of an abnormal transaction is greater than the small payment threshold. The small payment threshold can be used to eliminate the expenditure card transaction data and income card transaction data corresponding to normal transactions to reduce the workload of subsequent data matching and further improve the matching efficiency, thereby further improving the efficiency of identifying abnormal transactions.

[0034] In some examples, when the expenditure card transaction data includes a transaction response identifier and the income card transaction data includes a transaction response identifier, after the expenditure card transaction data and the income card transaction data within the preset time period are obtained, the expenditure card transaction data and the income card transaction data may be cleaned. For example, it may be determined whether the transaction response identifier in the expenditure card transaction data indicates a transaction failure, and it may be determined whether the transaction response identifier in the income card transaction data indicates a transaction failure; if the transaction response identifier in the expenditure card transaction data indicates a transaction failure, the expenditure card transaction data is removed; if the transaction response identifier in the income card transaction data indicates a transaction failure, the income card transaction data is removed. The expenditure card transaction data and the income card transaction data corresponding to the failed transaction cannot be abnormal transactions, and the transaction response identifier may be used to remove the expenditure card transaction data and the income card transaction data corresponding to the failed transaction, so as to reduce the workload of subsequent data matching, further improve the matching efficiency, and thus further improve the recognition efficiency of abnormal transactions.

[0035] In step S102, the expenditure card transaction data and the income card transaction data are matched according to the expenditure details represented by the expenditure card transaction data and the income details represented by the income card transaction data to obtain a matching data group.

[0036] A matching data group includes a group of successfully matched expenditure card transaction data and a group of income card transaction data. The expenditure details represented by the expenditure card transaction data in the same matching data group are the same or approximately the same as the income details of the income card transaction data. For example, the expenditure time in the successfully matched expenditure card transaction data is approximately the same as the income time in the income card transaction data. For another example, the expenditure amount in the successfully matched expenditure card transaction data is the same or approximately the same as the income amount in the income card transaction data. Among them, the "approximately the same" of the expenditure details represented by the expenditure card transaction data and the income details of the income card transaction data means that there is a gap between the expenditure details represented by the expenditure card transaction data and the income details of the income card transaction data, but the gap is within an acceptable range.

[0037] In some examples, multiple groups of spending card transaction data and multiple groups of income card transaction data may be matched in sequence until each matching data group is obtained. This example is suitable for scenarios where the amount of spending card transaction data and income card transaction data is small.

[0038] In other examples, the expenditure card transaction data and income card transaction data can be divided into regions first, and the expenditure card transaction data and income card transaction data with the same or similar value range can be matched, thereby reducing the resources and time occupied by matching and improving the matching efficiency. This example is particularly suitable for scenarios with large amounts of expenditure card transaction data and income card transaction data, which can greatly improve the matching efficiency, thereby further improving the efficiency of identifying abnormal transactions.

[0039] In step S103, based on the matching data set, transactions indicated by at least part of the matching data set are identified as abnormal transactions.

[0040] In some examples, all transactions indicated by the matching data group may be determined as abnormal transactions. In other examples, the matching data group may be screened according to further screening conditions, and the transactions indicated by the matching data group obtained after the screening may be determined as abnormal transactions.

[0041] In some embodiments, before executing step S103, matching data groups with matching errors or representing normal transactions may be eliminated from the obtained matching data groups according to some screening conditions.

[0042] In some examples, the expenditure card transaction data includes the expenditure time, and the income card transaction data includes the income time. Before executing step S103, if the expenditure time in the matching data group is later than or equal to the income time, the matching data group is eliminated, and / or if the duration between the expenditure time and the income time in the matching data group is greater than an abnormal duration threshold, the matching data group is eliminated.

[0043] In the same transaction, the expenditure time should be earlier than the income time. Therefore, if the expenditure time in the matching data group is later than or equal to the income time, it means that the expenditure card transaction data and the income card transaction data in the matching data group do not correspond to the same transaction, and the matching data group needs to be eliminated to improve the accuracy of abnormal transaction identification. The abnormal time threshold is a threshold used to assist in determining the duration between the expenditure time and the income time of abnormal transactions. It can be set according to scenarios, needs, experience, etc., and is not limited here. The duration between the expenditure time and the income time of normal transactions is generally greater than the abnormal time threshold; the duration between the expenditure time and the income time of abnormal transactions is generally less than or equal to the abnormal time threshold. Therefore, the duration between the expenditure time and the income time in the matching data group is greater than the abnormal time threshold, indicating that the transaction indicated by the matching data group is likely to be a normal transaction, and the matching data group needs to be eliminated to improve the accuracy of abnormal transaction identification.

[0044] In some examples, the expenditure card transaction data includes the expenditure amount and the transaction fee, and the income card transaction data includes the income amount. Before executing step S103, if the difference between the expenditure amount and the income amount in the matching data group is less than or equal to the transaction fee, the matching data group is eliminated.

[0045] The transaction fee in the spending card transaction data is a legitimate transaction fee. In a normal transaction, the difference between the spending amount and the transaction fee should be less than or equal to the income amount. Therefore, the difference between the spending amount and the income amount in the matching data group is less than or equal to the transaction fee, that is, the difference between the spending amount and the transaction fee should be less than or equal to the income amount, indicating that the transaction indicated by the matching data group is likely to be a normal transaction, and the matching data group needs to be eliminated to improve the accuracy of abnormal transaction identification.

[0046] In an embodiment of the present application, the expenditure card transaction data and the income card transaction data are matched according to the expenditure details represented by the acquired expenditure card transaction data and the income details represented by the income card transaction data to obtain a matching data group. In abnormal transactions, the flow of funds is very fast. Regardless of whether the transaction funds are circulated in two cards or in more cards, the expenditure details and the income details are very similar. The matching data group obtained by matching the expenditure card transaction data and the income card transaction data includes a group of expenditure card transaction data and a group of income card transaction data whose expenditure details and income details are the same or approximately the same. Therefore, the possibility that the transaction indicated by the matching data group is an abnormal transaction is very high. Based on the matching data group, the abnormal transaction indicated by the matching data group can be identified to achieve the identification of abnormal transactions for illegal purposes.

[0047] Moreover, in the embodiment of the present application, not only can abnormal transactions between two cards without other intermediary cards be identified, but also abnormal transactions between two cards passing through one or more intermediary cards can be identified, thereby achieving penetrating deep identification of abnormal transactions and further improving the security of bank card funds.

[0048] In some embodiments, the expenditure card transaction data includes the expenditure time, expenditure amount and transaction acquirer identification, and the income card transaction data includes the income time, income amount and transaction acquirer identification. The matching data group can be determined by the expenditure time, income time, expenditure amount, income amount and transaction acquirer identification. Figure 2 This is a flowchart of another embodiment of the abnormal transaction identification method provided by the present application. Figure 2 and Figure 1 The difference is that Figure 1 Step S102 in the above example can be specifically broken down into the following steps: Figure 2 Steps S1021 to S1025 in .

[0049] In step S1021, it is determined whether the spending time of the spending card transaction data and the income time of the income card transaction data belong to the same time period.

[0050] The time taken for abnormal transactions between two cards directly and between two cards through an intermediary card is very short. The expenditure time and income time can be used to help determine whether the transaction indicated by the expenditure card transaction data and the transaction indicated by the income card transaction data are the same transaction and whether the transaction is an abnormal transaction.

[0051] In order to improve the matching efficiency and thus the abnormal transaction identification efficiency, the time dimension can be partitioned and the matching can be performed using the area where the expenditure time and income time fall. According to the preset time step, multiple expenditure time intervals, multiple settlement time intervals and multiple income time intervals can be obtained; according to the expenditure time, income time and the upper limit of business processing time, the first expenditure time interval, the first settlement time interval and the first income time interval are determined; if the first expenditure time interval is associated with the first income time interval, or the second expenditure time interval is associated with the first income time interval, it is determined that the expenditure card income time and income time belong to the same period.

[0052] The duration of each expenditure time interval, a settlement time interval and an income time interval is equal, and the duration of each interval can be consistent with the time step. Multiple expenditure time intervals, multiple settlement time intervals and multiple income time intervals have a one-to-one correlation and correspondence, and the interval ranges of the corresponding expenditure time intervals, settlement time intervals and income time intervals are the same. The time step can be set according to the scenario, demand, experience, etc., and is not limited here. The expenditure time interval, settlement time interval and income time interval can be set according to the time step. For example, the time step can be set to 10 seconds, and the time starting point is 0 seconds. Then the first expenditure time interval, the first settlement time interval and the first income time interval are all [0, 10), the second expenditure time interval, the second settlement time interval and the second income time interval are all [10, 20), and so on.

[0053] The first expenditure time interval is the expenditure time interval to which the expenditure time belongs, that is, the first expenditure time interval is the expenditure time interval in the expenditure card transaction data. For example, if the time step is 10 seconds, if the expenditure time is represented by a timestamp, the timestamp of the expenditure time can be divided by 10 and then rounded down. The calculated value can be used as the identifier of the first expenditure time interval.

[0054] The first settlement time interval is the settlement time interval to which the sum of the expenditure time and the upper limit of the business processing time belongs. The upper limit of the business processing time is the upper limit of the time required to process the transaction business, which can be set according to the scenario, demand, experience, etc., and is not limited here. For example, the upper limit of the business processing time can be 10 seconds. If the time step is 10 seconds and the expenditure time is represented by a timestamp, the timestamp of the expenditure time can be added by 10 seconds and divided by 10, and then rounded down. The calculated value can be used as the identifier of the first settlement time interval.

[0055] The first income time interval is the income time interval to which the income time belongs, that is, the first income time interval is the income time interval to which the income time in the income card transaction data belongs. For example, if the time step is 10 seconds, if the income time is represented by a timestamp, the timestamp of the income time can be divided by 10 and then rounded down. The calculated value can be used as the identifier of the first income time interval.

[0056] The first expenditure time interval is associated with the first income time interval, that is, the first expenditure time interval and the first income time interval have the same range, indicating that the expenditure time is the same or approximately the same as the income time. The first settlement time interval is associated with the first income time interval, that is, the first settlement time interval and the first income time interval have the same range, that is, based on the time required to process the transaction, the expenditure time is the same or approximately the same as the income time.

[0057] For example, Table 1 below shows the first expenditure time interval, the first settlement time interval, and the first income time interval to which some payment times and income times belong.

[0058] Table 1

[0059] Timestamp of payment time 1634022942 1634775329 …… Identifier of the first spending time interval 163402294 163477532 …… Identifier of the first settlement time interval 163402295 163477533 …… Timestamp of the income time 1634022945 634775331 …… Identification of the first income time period 163402294 63477533 ……

[0060] As shown in Table 1, the timestamp of the payment time is divided by 10 and rounded down to obtain the identifier of the first expenditure time interval. The timestamp after adding 10 to the payment time (this 10 is the upper limit of the business processing time) is divided by 10 and rounded down to obtain the identifier of the first settlement time interval. The timestamp of the income time is divided by 10 and rounded down to obtain the identifier of the first income time interval. In Table 1, the payment time "1634022942" and the income time "1634022945" belong to the same time period, and the payment time "1634775329" and the income time "634775331" belong to the same time period.

[0061] The expenditure time is the same or approximately the same as the income time, that is, the expenditure time of the expenditure card transaction data and the income time of the income card transaction data belong to the same time period. If the first expenditure time interval is not associated with the first income time interval and the first settlement time interval is not associated with the first income time interval, it can be determined that the expenditure time of the expenditure card transaction data and the income time of the income card transaction data do not belong to the same time period.

[0062] In some examples, the determination of whether the spending time of the spending card transaction data and the income time of the income card transaction data belong to the same time period can be implemented using the data warehouse tool Hive, which is not limited here.

[0063] Through time partitioning, it is possible to match the expenditure card transaction data and income card transaction data whose expenditure time and payment time belong to the same period, thereby reducing the amount of data in the data matching process, reducing the resources occupied by data matching, improving the matching efficiency, and also improving the efficiency of identifying abnormal transactions.

[0064] In step S1022, it is determined whether the expenditure amount of the expenditure card transaction data and the income amount of the income card transaction data belong to the same amount range.

[0065] The amounts involved in abnormal transactions directly between two cards and abnormal transactions between two cards through intermediary cards are very similar. The expenditure amount and income amount can be used to help determine whether the transaction indicated by the expenditure card transaction data and the transaction indicated by the income card transaction data are the same transaction and whether the transaction is an abnormal transaction.

[0066] In order to improve the matching efficiency and thus improve the efficiency of identifying abnormal transactions, partitioning can be performed based on the amount dimension, and matching can be performed using the areas where the expenditure amount and income amount fall. Multiple expenditure amount intervals and multiple income amount intervals can be obtained according to the preset amount step; multiple income reduction amount intervals can be obtained according to the expenditure amount interval and the preset legal fee upper limit information; the first expenditure amount interval, the first income amount interval and the first income reduction amount interval are determined according to the expenditure amount, income amount and transaction fee; if the first expenditure amount interval is associated with the first income amount interval, or the first expenditure amount interval is associated with the first income reduction amount interval, it is determined that the expenditure amount and the income amount belong to the same amount range.

[0067] The amounts in the respective ranges of an expenditure amount interval and an income amount interval are equal and consistent. Multiple expenditure amount intervals and multiple income amount intervals have a one-to-one associated correspondence, and the associated corresponding expenditure amount intervals have the same interval range as the income amount interval. The amount step can be set according to the scenario, demand, experience, etc., and is not limited here. The expenditure amount interval and the income amount interval can be set according to the amount step. The upper limit of the income reduction amount interval associated with the expenditure amount interval is the same as the lower limit of the expenditure amount interval, and the length of the income reduction amount interval associated with the expenditure amount interval is the product of the lower limit of the expenditure amount interval and the legal fee rate indicated by the legal fee upper limit information. The legal fee upper limit information is used to characterize the upper limit of the fee for legal transactions. For example, the legal fee upper limit information may include the legal fee rate. The legal fee upper limit information can be set according to the scenario, demand, experience, etc., and is not limited here. For example, the amount step can be set to 100 yuan, the legal handling fee rate indicated by the legal handling fee upper limit information is 0.7%, and the starting point of the amount is 100 yuan. The first expenditure amount interval and the first income amount interval are both [100, 200), the first income reduction amount interval is [99.3, 100), the second expenditure amount interval and the second income amount interval are both [200, 300), the second income reduction amount interval is [198.6, 200), and so on.

[0068] The first expenditure amount interval is the expenditure amount interval to which the expenditure amount belongs, that is, the first expenditure amount interval is the expenditure amount interval to which the expenditure amount in the expenditure card transaction data belongs. For example, if the amount step is 100 yuan, the expenditure amount can be divided by 100 and then rounded down. The calculated value can be used as the identifier of the first expenditure amount interval.

[0069] The first income amount interval is the income amount interval to which the income amount belongs, that is, the first income amount interval is the income amount interval to which the income amount in the income card transaction data belongs. For example, if the amount step is 100 yuan, the income amount can be divided by 100 and then rounded down. The calculated value can be used as the identifier of the first income amount interval.

[0070] The first income reduction amount interval is the income reduction amount interval to which the income amount belongs, that is, the first income reduction amount interval is the income reduction amount interval to which the income amount in the income card transaction data belongs.

[0071] The first expenditure amount interval and the first income amount interval, that is, the first expenditure amount interval and the first income amount interval have the same interval range, indicating that the expenditure amount is the same or approximately the same as the income amount. The first expenditure amount interval is associated with the first income reduction amount interval, that is, the first expenditure amount interval includes the first income time interval, that is, on the basis of considering the legitimate fees in the transaction business, the expenditure amount is the same or approximately the same as the income amount.

[0072] In some examples, all amounts exceeding a certain amount value may be classified into one amount range, for example, expenditure amounts exceeding RMB 10,000 may be classified into one expenditure amount range, and income amounts exceeding RMB 10,000 may be classified into one income amount range.

[0073] The expenditure amount is the same or approximately the same as the income amount, that is, the expenditure amount of the expenditure card transaction data and the income amount of the income card transaction data belong to the same quota range. If the first expenditure amount interval is not associated with the first income amount interval and the first expenditure amount interval is not associated with the first income reduction amount interval, it can be determined that the expenditure amount of the expenditure card transaction data and the income amount of the income card transaction data do not belong to the same quota range.

[0074] In some examples, the determination of whether the expenditure amount of the expenditure card transaction data and the income amount of the income card transaction data belong to the same amount range can be implemented using the data warehouse tool Hive, which is not limited here.

[0075] Through amount partitioning, it is possible to match the expenditure card transaction data and income card transaction data whose expenditure amount and payment amount fall within the same amount range, thereby reducing the amount of data in the data matching process, reducing the resources occupied by data matching, improving matching efficiency, and also improving the efficiency of identifying abnormal transactions.

[0076] In step S1023, it is determined whether the transaction acquirer identifier of the expenditure card transaction data is consistent with the transaction acquirer identifier of the income card transaction data.

[0077] The acquiring institutions involved in abnormal transactions between two cards directly and abnormal transactions between two cards through intermediary cards are basically the same. The acquiring institution identification can be used to assist in determining whether the transaction indicated by the expenditure card transaction data and the transaction indicated by the income card transaction data are the same transaction and whether the transaction is an abnormal transaction.

[0078] In step S1024, when the expenditure time of the expenditure card transaction data and the income time of the income card transaction data belong to the same time period, the expenditure amount of the expenditure card transaction data and the income amount of the income card transaction data belong to the same amount range, and the transaction acquiring institution identifier of the expenditure card transaction data and the transaction acquiring institution identifier of the income card transaction data are consistent, the expenditure card transaction data and the income card transaction data are divided into the same candidate data group.

[0079] A candidate data set includes a set of spending card transaction data and a set of income card transaction data. A set of spending card transaction data includes relevant data of a bank card used as a spending card for a transaction. A set of income card transaction data includes relevant data of a bank card used as an income card for a transaction.

[0080] In step S1025, at least part of the candidate data set is selected as a matching data set.

[0081] There may be mismatched expenditure card transaction data and income card transaction data in the candidate data set, and screening can be performed according to certain conditions to eliminate the mismatched candidate data set, and the remaining candidate data set after elimination is determined as the matching data set. The mismatched candidate data set may include a candidate data set with repeated matching expenditure card transaction data and / or repeated matching income card transaction data.

[0082] In some embodiments, the expenditure card transaction data also includes the expenditure card number, and the income card transaction data also includes the income card number. Feature information of each candidate data group can be obtained; based on the feature information of the candidate data group, the similarity between the expenditure card transaction data and the income card transaction data in the candidate data group is calculated; the candidate data groups with similarity lower than a preset similarity threshold are removed; if the number of candidate data groups including the same expenditure card transaction data is more than two, the one with the highest similarity is selected from the more than two candidate data groups as the matching data group; if the number of candidate data groups including the same income card transaction data is more than two, the one with the highest similarity is selected from the more than two candidate data groups as the matching data group.

[0083] The feature information may include one or more of the first feature information, the second feature information and the third feature information.

[0084] The first characteristic information is used to characterize whether the user of the expenditure card indicated by the expenditure card number and the user of the income card indicated by the income card number are the same user. For example, the first characteristic information can be obtained according to the following formula (1):

[0085]

[0086] Among them, x is a transaction of the expenditure card, y is a transaction of the income card, and T1(x,y) is the first characteristic information.

[0087] The second characteristic information is used to characterize the number of successful matches between the historical expenditure card transaction data of the expenditure card indicated by the expenditure card number and the historical income card transaction data of the income card indicated by the income card number. The historical expenditure card transaction data of the expenditure card is the historical data of the transaction of the expenditure card, and the historical income card transaction data of the income card is the historical data of the transaction of the income card. For example, the expenditure card transaction data and the income card transaction data within a period of time before the preset time period can be obtained as the historical expenditure card transaction data and the historical income card transaction data. For example, the second characteristic information can be obtained according to the following formula (2):

[0088] T2(x,y)=m (2)

[0089] Among them, x is a transaction of an expenditure card, y is a transaction of an income card, m is the number of successful pairings of the historical expenditure card transaction data of the expenditure card represented by the transaction x within the past three months with the historical income card transaction data of the income card represented by the transaction y within the past three months, and T2(x,y) is the second characteristic information.

[0090] The third characteristic information is used to characterize the difference between the handling fee between the expenditure amount and the income amount and the preset abnormal handling fee. The abnormal handling fee can be set according to the scenario, demand, experience, etc., and is not limited here. For example, the third characteristic information can be obtained according to the following formula (3):

[0091]

[0092] Where x is a transaction of the spending card, y is a transaction of the income card, A(x) is the spending amount of the spending card, and A(y) is the income amount of the income card. is the rate of abnormal handling fee, and T3(x,y) is the third characteristic information. The rate of abnormal handling fee can be set according to the scenario, demand, experience, etc., and is not limited here. In order to identify abnormal transactions more comprehensively, the abnormal handling fee can be set to the average of the abnormal handling fees in the real abnormal transaction data collected, or the rate of abnormal handling fee can be set to the average of the rate of abnormal handling fees in the real abnormal transaction data collected. The rate of abnormal handling fee for cards of different natures may be different. For example, the rate of abnormal handling fee for credit cards may be 0.0057, and the rate of abnormal handling fee for debit cards may be 0.0048.

[0093] The similarity between the expenditure card transaction data and the income card transaction data is obtained based on the feature information of the candidate data set. The similarity between the expenditure card transaction data and the income card transaction data indicates the similarity between the expenditure details represented by the expenditure card transaction data and the income details represented by the income card transaction data.

[0094] The user of the expenditure card indicated by the expenditure card number and the user of the income card indicated by the income card number are the same user, which means that the expenditure details represented by the expenditure card transaction data and the income details represented by the income card transaction data are relatively similar, which is equivalent to increasing the similarity between the expenditure card transaction data and the income card transaction data. The user of the expenditure card indicated by the expenditure card number and the user of the income card indicated by the income card number are different users, which means that the expenditure details represented by the expenditure card transaction data and the income details represented by the income card transaction data are relatively dissimilar, which is equivalent to reducing the similarity between the expenditure card transaction data and the income card transaction data.

[0095] The more successful matches there are between the historical expenditure card transaction data of the expenditure card indicated by the expenditure card number and the historical income card transaction data of the income card indicated by the income card number, the more similar the expenditure details represented by the expenditure card transaction data are to the income details represented by the income card transaction data, and the higher the similarity between the expenditure card transaction data and the income card transaction data. The fewer successful matches there are between the historical expenditure card transaction data of the expenditure card indicated by the expenditure card number and the historical income card transaction data of the income card indicated by the income card number, the less similar the expenditure details represented by the expenditure card transaction data are to the income details represented by the income card transaction data, and the lower the similarity between the expenditure card transaction data and the income card transaction data.

[0096] The smaller the difference between the handling fee and the abnormal handling fee between the expenditure amount and the income amount, the more similar the expenditure details represented by the expenditure card transaction data are to the income details represented by the income card transaction data, and the higher the similarity between the expenditure card transaction data and the income card transaction data. The larger the difference between the handling fee and the abnormal handling fee between the expenditure amount and the income amount, the more similar the expenditure details represented by the expenditure card transaction data are to the income details represented by the income card transaction data, and the higher the similarity between the expenditure card transaction data and the income card transaction data.

[0097] In some embodiments, the feature information includes first feature information, second feature information, and third feature information. The first feature function value can be obtained according to the first feature information; the second feature function value can be obtained according to the second feature information; the third feature function value can be obtained according to the third feature information; the similarity between the expenditure card transaction data and the income card transaction data in the candidate data group can be calculated according to the first feature function value, the first weight corresponding to the first feature function value, the second feature function value, the second weight corresponding to the second feature function value, the third feature function value, and the third weight corresponding to the third feature function value. The higher the similarity, the higher the possibility that the candidate data group is a matching data group, that is, the higher the possibility that the expenditure card transaction data and the income card transaction data in the candidate data group are successfully matched.

[0098] In some examples, if the first characteristic information indicates that the user of the expenditure card indicated by the expenditure card number and the user of the income card indicated by the income card number are the same user, the first characteristic function value is 1; if the first characteristic information indicates that the user of the expenditure card indicated by the expenditure card number and the user of the income card indicated by the income card number are not the same user, the first characteristic function value is 0. That is, the first characteristic function value can be obtained according to the following formula (4):

[0099] p(x,y)=T1(x,y) (4)

[0100] Wherein, x is a transaction of an expenditure card, y is a transaction of an income card, p(x, y) is the value of the first characteristic function, T1(x, y) is the first characteristic information, and the calculation of the first characteristic information can refer to the above formula (1).

[0101] In some examples, the second characteristic function value is positively correlated with the number of successful matches. If the number of successful matches is 0, the second characteristic function value is 0. For example, the second characteristic function value can be obtained according to the following formula (5):

[0102]

[0103] Where x is a transaction of the expenditure card, y is a transaction of the income card, q(x,y) is the value of the second characteristic function, T2(x,y) is the second characteristic information, and the calculation of the second characteristic information can refer to the above formula (2). The logistic function can be taken for the second characteristic information through formula (5). In order to reduce the large difference between the second characteristic information being 0 and the second characteristic information being 1 or above, it is set that when T2(x,y)=0, the value of the second characteristic function is 0.

[0104] The third characteristic function value is negatively correlated with the gap. The gap here refers to the gap between the handling fee between the expenditure amount and the income amount and the preset abnormal handling fee. For example, the second characteristic function value can be obtained according to the following formula (6):

[0105]

[0106] Among them, max(T3(x,y)) is the maximum value in the third feature information, min(T3(x,y)) is the minimum value in the third feature information, r(x,y) is the third feature function value, T3(x,y) is the third feature information, and the calculation of the third feature information can refer to the above formula (3). The third feature information can be standardized by formula (6) to make it easier to calculate the similarity.

[0107] The first weight, the second weight, and the third weight can be set according to the scenario, demand, experience, etc., and are not determined here. The sum of the first weight, the second weight, and the third weight is 1. For example, the first weight is 1 / 2, the second weight is 1 / 3, and the third weight is 1 / 6. The similarity between the expenditure card transaction data and the income card transaction data in the candidate data set can be obtained according to the following formula (7).

[0108] f(x,y)=α·p(x,y)+β·q(x,y)+γ·r(x,y) (7)

[0109] Wherein, f(x, y) is the similarity, α is the first weight, p(x, y) is the first characteristic function value, β is the second weight, q(x, y) is the second characteristic function value, γ is the third weight, and r(x, y) is the third characteristic function value. The calculation of the first characteristic function value, the second characteristic function value, and the third characteristic function value can refer to the above formulas (4) to (6). In some examples, the value range of the similarity can be [0, 1].

[0110] The preset similarity threshold is a threshold value used to determine the similarity of the matching data group. It can be obtained by measuring the optimal solution based on the collected positive samples and negative samples, and can also be adjusted based on the experience of transaction history data. The specific method for obtaining the preset similarity threshold is not limited here. For example, the preset similarity threshold can be set to 0.4. If the similarity of the candidate data group is higher than or equal to the preset similarity threshold, the candidate data group can be retained. If the similarity of the candidate data group is lower than the preset similarity threshold, the candidate data group can be removed.

[0111] In the two or more candidate data groups obtained, the same expenditure card transaction data may exist in different candidate data groups. Similarly, in the two or more candidate data groups obtained, the same income card transaction data may exist in different candidate data groups.

[0112] If the number of candidate data groups that include the same expenditure card transaction data is two or more, it means that the same expenditure card transaction data exists in different candidate data groups, that is, repeated matching occurs. Among the repeated matching candidate data groups, there are mismatched candidate data groups. It is necessary to retain only one candidate data group as the matching data group, and the one with the highest similarity can be determined as the matching data group.

[0113] If the number of candidate data groups that include the same income card transaction data is two or more, it means that the same income card transaction data exists in different candidate data groups, that is, repeated matching occurs. Among the repeated matching candidate data groups, there are mismatched candidate data groups. It is necessary to retain only one candidate data group as the matching data group, and the one with the highest similarity can be determined as the matching data group.

[0114] By removing duplicates from the candidate data sets that are matched repeatedly, the accuracy of the match can be further improved, thereby improving the accuracy of abnormal transaction identification.

[0115] In some embodiments, for an expense card that has an abnormal transaction, the abnormal level of the expense card can also be determined, so that the expense card that has an abnormal transaction can be processed accordingly. Specifically, for an expense card, the similarity of the matching data group corresponding to the expense card within a preset time period and the expenditure amount in the matching data group can be obtained; the first abnormal intensity parameter is calculated using the similarity of the matching data group and the expenditure amount in the matching data group; the first abnormal level of the expense card is determined according to the first abnormal intensity parameter; and the expense card is processed according to the first abnormal processing strategy corresponding to the first abnormal level.

[0116] In some embodiments, for an income card, the similarity of the matching data group corresponding to the income card within a preset time period and the income amount in the matching data group are obtained; the second abnormality intensity parameter is calculated using the similarity of the matching data group and the income amount in the matching data group; based on the second abnormality intensity parameter, the second abnormality level of the abnormal transaction indicated by the matching data group is determined; and the income card is processed according to the abnormality processing strategy corresponding to the second abnormality level.

[0117] The higher the similarity of the matching data group, the greater the possibility that the transaction indicated by the matching data group is an abnormal transaction, and the greater the harm. In the case of an abnormal transaction, the higher the expenditure amount in the matching data group, the greater the risk of fund security and the greater the harm. The strength of the bank card abnormality can be determined by the abnormal intensity parameter, that is, the abnormal intensity parameter is used to characterize the strength of the bank card abnormality. The larger the abnormal intensity parameter, the greater the strength of the bank card abnormality, and the greater the harm of the bank card. The abnormal intensity parameter has a corresponding relationship with the abnormal level, and the abnormal level corresponding to the abnormal intensity parameter can be found according to the corresponding relationship. The abnormal level is used to characterize the severity of the abnormality. The larger the abnormal intensity parameter, the greater the severity of the abnormality represented by the abnormal level. The abnormal level has a corresponding relationship with the abnormal handling strategy, and the abnormal handling strategy corresponding to the bank card can be determined according to the abnormal level, so that the bank card is processed according to the abnormal handling strategy. The greater the severity of the abnormality represented by the abnormal level, the stricter the abnormal handling strategy. The processing can be locking the bank card, freezing the bank card, sending an alarm message to the relevant law enforcement department, etc., which is not limited here.

[0118] For example, the abnormal intensity parameter can be obtained according to the following formula (8).

[0119] g(X)=f(x1,y1)·A(z1)+f(x2,y2)·A(z2)+…+f(x n ,y n )·A(z n ) (8)

[0120] Where X is the bank card, g(X) is the abnormal strength parameter of bank card X, and f(x i ,y i ) is the similarity of the matching data group of the i-th successful matching of bank card X within the preset time period, and n is the number of successful matching times of bank card X within the preset time period, that is, the number of matching data groups of bank card X that are successfully matched within the preset time period.

[0121] The first abnormal intensity parameter is the abnormal intensity parameter corresponding to the expenditure card. The first abnormal level is the abnormal level corresponding to the expenditure card. The first abnormal handling strategy is the abnormal handling strategy corresponding to the expenditure card. Specifically, the first abnormal intensity parameter is the sum of the similarity of each matching data group and the product of the expenditure amount in the matching data group, which can be specifically referred to in the above formula (8).

[0122] The second anomaly strength parameter is an anomaly strength parameter corresponding to the income card. The second anomaly level is an anomaly level corresponding to the income card. The second anomaly handling strategy is an anomaly handling strategy corresponding to the income card. Specifically, the second anomaly strength parameter is the sum of the product of the similarity of each matching data group and the income amount in the matching data group, and the details can be seen in the above formula (8).

[0123] In some embodiments, the expense card transaction data further includes an expense card number, and the income card transaction data further includes an income card number. A pre-configured abnormal transaction card database may be used to further determine abnormal transactions among transactions indicated by the matching data set. Figure 3 This is a flowchart of another embodiment of the abnormal transaction identification method provided by the present application. Figure 3 and Figure 1 The difference is that Figure 1 Step S103 in the method can be specifically divided into steps S1031 to S1033.

[0124] In step S1031, the abnormal transaction card database is called.

[0125] The abnormal transaction card database includes transaction card information of transaction cards that have experienced abnormal transactions, and the transaction card information may include transaction card numbers. The abnormal transaction card data may be obtained based on historical data analysis, or based on information from actual abnormal transaction cases, or based on other reasonable methods, which are not limited here. In the embodiment of the present application, after determining an abnormal transaction, the card numbers of the expenditure cards and / or income cards corresponding to the abnormal transaction that are not stored in the abnormal transaction card database may also be stored in the abnormal transaction card database.

[0126] In some examples, the abnormal transaction card database may be further divided into a plurality of abnormal transaction card data sub-databases according to the type of abnormal transaction, and each abnormal transaction card data sub-database may include transaction card information of a transaction card of a type of abnormal transaction. For example, the abnormal transaction card database may include a cash-out abnormal transaction card data sub-database and a fraud-related and gambling-related abnormal transaction card data sub-database.

[0127] After obtaining the matching data set, the abnormal transaction card database may be called to further determine abnormal transactions among the transactions indicated by the matching data set.

[0128] In step S1032, the abnormal transaction card database is searched for transaction card information matching the expenditure card number and / or income card number in the matching data set.

[0129] The transaction card information in the abnormal transaction card database matches the expenditure card number and / or income card number in the matching data set, indicating that the card number indicated by the transaction card information in the abnormal transaction card database is the same as the expenditure card number and / or income card number in the matching data set.

[0130] In step S1033, if there is transaction card information matching the expenditure card number and / or income card number in the matching data set in the abnormal transaction card database, the transaction indicated by the matching data set is identified as an abnormal transaction.

[0131] The existence of transaction card information in the abnormal transaction card database that matches the expenditure card number and / or income card number in the matching data group indicates that the transaction indicated by the matching data group is an abnormal transaction, and the transaction indicated by the matching data group can be identified as an abnormal transaction.

[0132] In some examples, the abnormal transaction card database may include at least one abnormal transaction card data sub-library, and each abnormal transaction card data sub-library corresponds to a type of abnormal transaction. The type of abnormal transaction indicated by the matching data group may also be determined based on the matching result of the expenditure card number and / or income card number in the matching data group and the transaction card information in the abnormal transaction card data sub-library. If the transaction card information matching the expenditure card number and / or income card number in the matching data group is stored in a certain abnormal transaction card data sub-library, it can be determined that the type of abnormal transaction indicated by the matching data group is consistent with the type of abnormal transaction corresponding to the abnormal transaction card data sub-library. For example, if the expenditure card number and / or income card number in the matching data group matches the transaction card information in the cash-out abnormal transaction card data sub-library, it can be determined that the abnormal transaction indicated by the matching data group is an abnormal cash-out transaction. For another example, if the expenditure card number and / or income card number in the matching data group matches the transaction card information in the fraud-related gambling abnormal transaction card data sub-library, it can be determined that the abnormal transaction indicated by the matching data group is an abnormal fraud-related gambling transaction.

[0133] In some embodiments, in order to fully obtain information related to abnormal transactions, the information associated with the abnormal transaction can be further tracked according to the information of the other party in the transfer record of the determined abnormal transaction, so as to improve the comprehensiveness of abnormal transaction identification and further improve the security of bank card funds. Specifically, the transaction card having a transaction relationship with the target expenditure card can be marked as a transaction abnormality risk card. The target expenditure card is the expenditure card indicated by the matching data group corresponding to the abnormal transaction. For example, the expenditure card indicated by the expenditure card number in the matching data group corresponding to the abnormal transaction is determined as the target expenditure card, and the transaction card with which the target expenditure card has transactions is marked as a transaction abnormality risk card, and the transaction abnormality risk card can be further investigated or related processing can be performed. The transaction card having a transaction relationship with the target income card can be marked as a transaction abnormality risk card. The target income card is the income card indicated by the matching data group corresponding to the abnormal transaction. For example, the income card indicated by the income card number in the matching data group corresponding to the abnormal transaction is determined as the target income card, and the transaction card with which the target income card has transactions is marked as a transaction abnormality risk card, and the transaction abnormality risk card can be further investigated or related processing can be performed.

[0134] The present application also provides an abnormal transaction identification device, which can execute the abnormal transaction identification method in the above embodiment. Figure 4 This is a schematic diagram of the structure of an embodiment of the abnormal transaction identification device provided by the present application. Figure 4 As shown, the abnormal transaction identification device 200 may include a data acquisition module 201 , a matching module 202 and an identification module 203 .

[0135] The data acquisition module 201 may be used to acquire expenditure card transaction data and income card transaction data within a preset time period.

[0136] The expenditure card transaction data is used to characterize expenditure details, and the income card transaction data is used to characterize income details.

[0137] The matching module 202 may be used to match the expenditure card transaction data with the income card transaction data according to the expenditure details represented by the expenditure card transaction data and the income details represented by the income card transaction data to obtain a matching data set.

[0138] The expenditure details represented by the expenditure card transaction data in the matching data set are the same or approximately the same as the income details represented by the income card transaction data.

[0139] The identification module 203 may be configured to identify transactions indicated by at least a portion of the matching data set as abnormal transactions based on the matching data set.

[0140] In an embodiment of the present application, the expenditure card transaction data and the income card transaction data are matched according to the expenditure details represented by the acquired expenditure card transaction data and the income details represented by the income card transaction data to obtain a matching data group. In abnormal transactions, the flow of funds is very fast. Regardless of whether the transaction funds are circulated in two cards or in more cards, the expenditure details and the income details are very similar. The matching data group obtained by matching the expenditure card transaction data and the income card transaction data includes a group of expenditure card transaction data and a group of income card transaction data whose expenditure details and income details are the same or approximately the same. Therefore, the possibility that the transaction indicated by the matching data group is an abnormal transaction is very high. Based on the matching data group, the abnormal transaction indicated by the matching data group can be identified to achieve the identification of abnormal transactions for illegal purposes.

[0141] Moreover, in the embodiment of the present application, not only can abnormal transactions between two cards without other intermediary cards be identified, but also abnormal transactions between two cards passing through one or more intermediary cards can be identified, thereby achieving penetrating deep identification of abnormal transactions and further improving the security of bank card funds.

[0142] In some embodiments, the spending card transaction data includes spending time, spending amount and transaction acquirer identification, and the income card transaction data includes income time, income amount and transaction acquirer identification. Figure 5 A schematic diagram of the structure of another embodiment of the abnormal transaction identification device provided in the present application.

[0143] Figure 5 and Figure 4 The difference is that Figure 4 The matching module 202 may include a first matching unit 2021, a second matching unit 2022, a third matching unit 2023, a grouping unit 2024 and a selection unit 2025.

[0144] The first matching unit 212 can be used to determine whether the spending time of the spending card transaction data and the income time of the income card transaction data belong to the same time period.

[0145] The second matching unit 2022 can be used to determine whether the expenditure amount of the expenditure card transaction data and the income amount of the income card transaction data belong to the same amount range.

[0146] The third matching unit 2023 can be used to determine whether the transaction acquirer identifier of the expenditure card transaction data is consistent with the transaction acquirer identifier of the income card transaction data.

[0147] The grouping unit 2024 can be used to: classify the expenditure card transaction data and the income card transaction data into the same candidate data group when the expenditure time of the expenditure card transaction data and the income time of the income card transaction data belong to the same time period, the expenditure amount of the expenditure card transaction data and the income amount of the income card transaction data belong to the same amount range, and the transaction acquiring institution identifier of the expenditure card transaction data and the transaction acquiring institution identifier of the income card transaction data are consistent.

[0148] The selection unit 2025 may be configured to select at least part of the candidate data set as the matching data set.

[0149] In some examples, the first matching unit 2021 can be used to: divide according to a preset time step to obtain multiple expenditure time intervals, multiple settlement time intervals and multiple income time intervals, wherein the associated corresponding expenditure time intervals, settlement time intervals and income time intervals have the same interval range; determine the first expenditure time interval, the first settlement time interval and the first income time interval according to the expenditure time, income time and the upper limit time of business processing, the first expenditure time interval is the expenditure time interval to which the expenditure time belongs, the first settlement time interval is the settlement time interval to which the sum of the expenditure time and the upper limit time of business processing belongs, and the first income time interval is the income time interval to which the income time belongs; if the first expenditure time interval is associated with the first income time interval, or the first settlement time interval is associated with the first income time interval, it is determined that the expenditure card income time and the income time belong to the same time period.

[0150] In some examples, the second matching unit 2022 can be used to: divide according to a preset amount step, obtain multiple expenditure amount intervals and multiple income amount intervals, and the associated corresponding expenditure amount intervals are the same as the interval range of the income amount interval; divide according to the expenditure amount interval and the preset legal fee upper limit information, obtain multiple income reduction amount intervals, the upper limit of the income reduction amount interval associated with the expenditure amount interval is the same as the lower limit of the expenditure amount interval, and the length of the income reduction amount interval associated with the expenditure amount interval is the product of the lower limit of the expenditure amount interval and the legal fee rate indicated by the legal fee upper limit information; determine the first expenditure amount interval, the first income amount interval and the first income reduction amount interval according to the expenditure amount, the income amount and the transaction fee, the first expenditure amount interval is the expenditure amount interval to which the expenditure amount belongs, the first income amount interval is the income amount interval to which the income amount belongs, and the first income reduction amount interval is the income reduction amount interval to which the income amount belongs; if the first expenditure amount interval is associated with the first income amount interval, or the first expenditure amount interval is associated with the first income reduction amount interval, it is determined that the expenditure amount and the income amount belong to the same amount range.

[0151] In some examples, the expense card transaction data also includes the expense card number and the income card transaction data also includes the income card number.

[0152] The selection unit 2025 can be used to: obtain feature information of each candidate data group, the feature information includes one or more of the first feature information, the second feature information and the third feature information, the first feature information is used to characterize whether the user of the expenditure card indicated by the expenditure card number and the user of the income card indicated by the income card number are the same user, the second feature information is used to characterize the number of successful matches between the historical expenditure card transaction data of the expenditure card indicated by the expenditure card number and the historical income card transaction data of the income card indicated by the income card number, and the third feature information is used to characterize the size of the gap between the handling fee between the expenditure amount and the income amount and the preset abnormal handling fee; based on the feature information of the candidate data group, calculate the similarity between the expenditure card transaction data and the income card transaction data in the candidate data group; remove the candidate data group whose similarity is lower than the preset similarity threshold; if the number of candidate data groups including the same expenditure card transaction data is more than two, select the one with the highest similarity from the more than two candidate data groups as the matching data group; if the number of candidate data groups including the same income card transaction data is more than two, select the one with the highest similarity from the more than two candidate data groups as the matching data group.

[0153] In some examples, the feature information includes first feature information, second feature information, and third feature information.

[0154] The selection unit 2025 can be used to: obtain a first characteristic function value based on the first characteristic information, wherein if the first characteristic information indicates that the user of the expenditure card indicated by the expenditure card number and the user of the income card indicated by the income card number are the same user, the first characteristic function value is 1, and if the first characteristic information indicates that the user of the expenditure card indicated by the expenditure card number and the user of the income card indicated by the income card number are not the same user, the first characteristic function value is 0; obtain a second characteristic function value based on the second characteristic information, the second characteristic function value is positively correlated with the number of successful matches, wherein if the number of successful matches is 0, the second characteristic function value is 0; obtain a third characteristic function value based on the third characteristic information, the third characteristic function value is negatively correlated with the gap; calculate the similarity between the expenditure card transaction data and the income card transaction data in the candidate data group based on the first characteristic function value, the first weight corresponding to the first characteristic function value, the second characteristic function value, the second weight corresponding to the second characteristic function value, the third characteristic function value, and the third weight corresponding to the third characteristic function value.

[0155] Figure 6 A schematic diagram of the structure of another embodiment of the abnormal transaction identification device provided in the present application. Figure 6 and Figure 5 The difference is that Figure 6The abnormal transaction identification device 200 shown may further include a processing module 204 .

[0156] In some examples, processing module 204 can be used to: for a spending card, obtain the similarity of the matching data group corresponding to the spending card within a preset time period and the spending amount in the matching data group; use the similarity of the matching data group and the spending amount in the matching data group to calculate a first abnormality intensity parameter; determine a first abnormality level of the spending card based on the first abnormality intensity parameter; and process the spending card based on a first abnormality processing strategy corresponding to the first abnormality level.

[0157] Specifically, the first anomaly strength parameter is the sum of the product of the similarity of each matching data group and the expenditure amount in the matching data group.

[0158] In some examples, the processing module 204 can be used to: for an income card, obtain the similarity of the matching data group corresponding to the income card within a preset time period and the income amount in the matching data group; use the similarity of the matching data group and the income amount in the matching data group to calculate a second abnormality intensity parameter; determine a second abnormality level of the income card based on the second abnormality intensity parameter; and process the income card according to the abnormality processing strategy corresponding to the second abnormality level.

[0159] Specifically, the second anomaly strength parameter is the sum of the product of the similarity of each matching data group and the income amount in the matching data group.

[0160] In some embodiments, the expense card transaction data further includes the expense card number and the revenue card transaction data further includes the revenue card number.

[0161] The identification module 203 can be used to: call the abnormal transaction card database; search for transaction card information that matches the expenditure card number and / or income card number in the matching data group in the abnormal transaction card database; if there is transaction card information that matches the expenditure card number and / or income card number in the matching data group in the abnormal transaction card database, identify the transaction indicated by the matching data group as an abnormal transaction.

[0162] Figure 7 This is a schematic diagram of the structure of another embodiment of the abnormal transaction identification device provided by the present application. Figure 7 and Figure 4 The difference is that Figure 7 The abnormal transaction identification device 200 shown may further include a data filtering module 205 .

[0163] In some examples, the data filtering module 205 may be used to: when the expenditure card transaction data includes the expenditure time and the income card transaction data includes the income time, before identifying, based on the matching data group, that at least part of the transactions indicated by the matching data group are abnormal transactions, if the expenditure time in the matching data group is later than or equal to the income time, then eliminate the matching data group; and / or, if the duration between the expenditure time and the income time in the matching data group is greater than an abnormal duration threshold, then eliminate the matching data group.

[0164] In some examples, the data filtering module 205 may be used to: when the expenditure card transaction data includes the expenditure amount and the transaction fee, and the income card transaction data includes the income amount, before identifying, based on the matching data group, that at least part of the transactions indicated by the matching data group are abnormal transactions, if the difference between the expenditure amount and the income amount in the matching data group is less than or equal to the transaction fee, then the matching data group is eliminated.

[0165] In some examples, the data filtering module 205 can be used for: when the expenditure card transaction data includes the expenditure amount and the income card transaction data includes the income amount, after obtaining the expenditure card transaction data and the income card transaction data within a preset time period, if the expenditure amount in the expenditure card transaction data is less than the small payment threshold, the expenditure card transaction data is eliminated; if the income amount in the income card transaction data is less than the small payment threshold, the income card transaction data is eliminated.

[0166] In some examples, the data filtering module 205 can be used for: when the expenditure card transaction data includes a transaction response identifier and the income card transaction data includes a transaction response identifier, after obtaining the expenditure card transaction data and the income card transaction data within a preset time period, if the transaction response identifier in the expenditure card transaction data indicates a transaction failure, then the expenditure card transaction data is eliminated; if the transaction response identifier in the income card transaction data indicates a transaction failure, then the income card transaction data is eliminated.

[0167] In some embodiments, the above-mentioned identification module 203 can also be used to: mark a transaction card that has a transaction relationship with a target expenditure card as a transaction abnormality risk card, and the target expenditure card is the expenditure card indicated by the matching data group corresponding to the abnormal transaction; mark a transaction card that has a transaction relationship with a target income card as a transaction abnormality risk card, and the target income card is the income card indicated by the matching data group corresponding to the abnormal transaction.

[0168] The present application also provides an abnormal transaction identification device. Figure 8 This is a schematic diagram of the structure of an embodiment of the abnormal transaction identification device provided by the present application. Figure 8 As shown, the abnormal transaction identification device 300 includes a memory 301 , a processor 302 , and a computer program stored in the memory 301 and executable on the processor 302 .

[0169] In an example, the processor 302 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured to implement one or more integrated circuits of the embodiments of the present application.

[0170] The memory 301 may include a read-only memory (ROM), a random access memory (RAM), a disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical or other physical / tangible memory storage device. Therefore, generally, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., a memory device) encoded with software including computer executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the abnormal transaction identification method in the embodiment of the present application.

[0171] The processor 302 runs a computer program corresponding to the executable program code by reading the executable program code stored in the memory 301 , so as to implement the abnormal transaction identification method in the above embodiment.

[0172] In one example, the abnormal transaction identification device 300 may further include a communication interface 303 and a bus 304. Figure 8 As shown, the memory 301, the processor 302, and the communication interface 303 are connected via a bus 304 and communicate with each other.

[0173] The communication interface 303 is mainly used to realize the communication between the modules, devices, units and / or equipment in the embodiment of the present application. The communication interface 303 can also be used to access input devices and / or output devices.

[0174] The bus 304 includes hardware, software or both, and the components of the abnormal transaction identification device 300 are coupled to each other. For example, but not limitation, the bus 304 may include an accelerated graphics port (Accelerated Graphics Port, AGP) or other graphics bus, an enhanced industry standard architecture (Enhanced Industry Standard Architecture, EISA) bus, a front side bus (Front Side Bus, FSB), a hypertransport (Hyper Transport, HT) interconnection, an industry standard architecture (Industry Standard Architecture, ISA) bus, an infinite bandwidth interconnection, a low pin count (Low pin count, LPC) bus, a memory bus, a micro channel architecture (Micro Channel Architecture, MCA) bus, a peripheral component interconnect (Peripheral Component Interconnect, PCI) bus, a PCI-Express (PCI-E) bus, a serial advanced technology attachment (Serial Advanced Technology Attachment, SATA) bus, a video electronics standards association local (Video Electronics Standards Association Local Bus, VLB) bus or other suitable buses or a combination of two or more of these. Where appropriate, the bus 304 may include one or more buses. Although embodiments of the present application describe and illustrate a particular bus, the present application contemplates any suitable bus or interconnect.

[0175] The fourth aspect of the present application also provides a computer-readable storage medium, on which a computer program instruction is stored, and when the computer program instruction is executed by a processor, the abnormal transaction identification method in the above embodiment can be implemented, and the same technical effect can be achieved. To avoid repetition, it is not repeated here. Among them, the above-mentioned computer-readable storage medium may include a non-transient computer-readable storage medium, such as a read-only memory (Read-Only Memory, referred to as ROM), a random access memory (Random Access Memory, referred to as RAM), a disk or an optical disk, etc., which is not limited here.

[0176] It should be clear that each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. For device embodiments, equipment embodiments, and computer-readable storage medium embodiments, the relevant parts can refer to the description part of the method embodiment. The present application is not limited to the specific steps and structures described above and shown in the figures. Those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application. In addition, for the sake of brevity, a detailed description of known method technologies is omitted here.

[0177] The above reference is according to the method of the embodiment of the present application, the flow chart of the device (system) and the computer program product and / or the block diagram described various aspects of the present application.It should be understood that each square box in the flow chart and / or the block diagram and the combination of each square box in the flow chart and / or the block diagram can be realized by computer program instructions.These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a machine so that these instructions executed by the processor of the computer or other programmable data processing device enable the realization of the function / action specified in one or more square boxes of the flow chart and / or the block diagram.Such a processor can be but is not limited to a general-purpose processor, a special-purpose processor, a special application processor or a field programmable logic circuit.It can also be understood that each square box in the block diagram and / or the flow chart and the combination of the square boxes in the block diagram and / or the flow chart can also be realized by the dedicated hardware that performs the specified function or action, or can be realized by the combination of dedicated hardware and computer instructions.

[0178] Those skilled in the art should understand that the above embodiments are exemplary rather than restrictive. Different technical features appearing in different embodiments can be combined to achieve beneficial effects. Based on the study of the drawings, the specification and the claims, those skilled in the art should be able to understand and implement other variations of the disclosed embodiments. In the claims, the term "comprising" does not exclude other devices or steps; the quantifier "one" does not exclude multiple; the terms "first" and "second" are used to indicate names rather than to indicate any specific order. Any figure marks in the claims should not be understood as limiting the scope of protection. The functions of multiple parts appearing in the claims can be implemented by a single hardware or software module. The appearance of certain technical features in different dependent claims does not mean that these technical features cannot be combined to achieve beneficial effects.

Claims

1. A method for identifying abnormal transactions, characterized in that: include: Acquire expenditure card transaction data and income card transaction data within a preset time period, wherein the expenditure card transaction data is used to characterize expenditure details and the income card transaction data is used to characterize income details; According to the expenditure details represented by the expenditure card transaction data and the income details represented by the income card transaction data, the expenditure card transaction data and the income card transaction data are matched to obtain a matching data group, wherein the expenditure details represented by the expenditure card transaction data and the income details of the income card transaction data in the matching data group are the same; Based on the matching data set, identifying at least some of the transactions indicated by the matching data set as abnormal transactions; The spending card transaction data includes spending time, spending amount, transaction acquiring institution identification and spending card number, and the income card transaction data includes income time, income amount, transaction acquiring institution identification and income card number. The step of matching the expenditure card transaction data with the income card transaction data according to the expenditure details represented by the expenditure card transaction data and the income details represented by the income card transaction data to obtain a matching data group includes: Determine whether the spending time of the spending card transaction data and the income time of the income card transaction data belong to the same period; Determine whether the expenditure amount of the expenditure card transaction data and the income amount of the income card transaction data belong to the same amount range; Determine whether the transaction acquirer identifier of the expenditure card transaction data and the transaction acquirer identifier of the income card transaction data are consistent; In the case where the expenditure time of the expenditure card transaction data and the income time of the income card transaction data belong to the same time period, the expenditure amount of the expenditure card transaction data and the income amount of the income card transaction data belong to the same amount range, and the transaction acquirer identifier of the expenditure card transaction data and the transaction acquirer identifier of the income card transaction data are consistent, the expenditure card transaction data and the income card transaction data are classified into the same candidate data group; Acquire characteristic information of each candidate data group, the characteristic information including one or more of first characteristic information, second characteristic information and third characteristic information, the first characteristic information is used to characterize whether the user of the expenditure card indicated by the expenditure card number and the user of the income card indicated by the income card number are the same user, the second characteristic information is used to characterize the number of successful matches between the historical expenditure card transaction data of the expenditure card indicated by the expenditure card number and the historical income card transaction data of the income card indicated by the income card number, and the third characteristic information is used to characterize the size of the difference between the handling fee between the expenditure amount and the income amount and a preset abnormal handling fee; Calculating the similarity between the expenditure card transaction data and the income card transaction data in the candidate data group according to the feature information of the candidate data group; Remove candidate data groups whose similarity is lower than a preset similarity threshold; If the number of the candidate data groups including the same payment card transaction data is more than two, selecting the one with the highest similarity from the more than two candidate data groups as the matching data group; If the number of the candidate data groups including the same income card transaction data is more than two, the one with the highest similarity is selected from the more than two candidate data groups as the matching data group.

2. The method according to claim 1, characterized in that The determining whether the spending time of the spending card transaction data and the income time of the income card transaction data belong to the same period includes: According to the preset time step, multiple expenditure time intervals, multiple settlement time intervals and multiple income time intervals are obtained, wherein the associated corresponding expenditure time intervals, the settlement time intervals and the income time intervals have the same interval range; According to the expenditure time, the income time and the upper limit duration of business processing, determine a first expenditure time interval, a first settlement time interval and a first income time interval, the first expenditure time interval being the expenditure time interval to which the expenditure time belongs, the first settlement time interval being the settlement time interval to which the sum of the expenditure time and the upper limit duration of business processing belongs, and the first income time interval being the income time interval to which the income time belongs; If the first expenditure time interval is associated with and corresponds to the first income time interval, or the first settlement time interval is associated with and corresponds to the first income time interval, it is determined that the expenditure time and the income time belong to the same time period.

3. The method according to claim 1, characterized in that The determining whether the expenditure amount of the expenditure card transaction data and the income amount of the income card transaction data belong to the same amount range includes: According to the preset amount step, multiple expenditure amount intervals and multiple income amount intervals are obtained, and the associated corresponding expenditure amount intervals and the income amount intervals have the same interval range; According to the expenditure amount interval and the preset legal fee upper limit information, a plurality of income reduction amount intervals are obtained, the upper limit of the income reduction amount interval associated with the expenditure amount interval is the same as the lower limit of the expenditure amount interval, and the length of the income reduction amount interval associated with the expenditure amount interval is the product of the lower limit of the expenditure amount interval and the legal fee rate indicated by the legal fee upper limit information; Determine a first expenditure amount interval, a first income amount interval and a first income reduction amount interval according to the expenditure amount, the income amount and the transaction fee, wherein the first expenditure amount interval is the expenditure amount interval to which the expenditure amount belongs, the first income amount interval is the income amount interval to which the income amount belongs, and the first income reduction amount interval is the income reduction amount interval to which the income amount belongs; If the first expenditure amount interval is associated with the first income amount interval, or the first expenditure amount interval is associated with the first income reduction amount interval, it is determined that the expenditure amount and the income amount belong to the same amount range.

4. The method according to claim 1, characterized in that: The feature information includes the first feature information, the second feature information and the third feature information, Calculating the similarity between the expenditure card transaction data and the income card transaction data in the candidate data group according to the feature information of the candidate data group includes: A first characteristic function value is obtained according to the first characteristic information, wherein if the first characteristic information indicates that the user of the expenditure card indicated by the expenditure card number and the user of the income card indicated by the income card number are the same user, the first characteristic function value is 1; if the first characteristic information indicates that the user of the expenditure card indicated by the expenditure card number and the user of the income card indicated by the income card number are not the same user, the first characteristic function value is 0; According to the second characteristic information, a second characteristic function value is obtained, wherein the second characteristic function value is positively correlated with the number of successful matches, wherein if the number of successful matches is 0, the second characteristic function value is 0; According to the third characteristic information, a third characteristic function value is obtained, and the third characteristic function value is negatively correlated with the gap; The similarity between the expenditure card transaction data and the income card transaction data in the candidate data group is calculated based on the first feature function value, the first weight corresponding to the first feature function value, the second feature function value, the second weight corresponding to the second feature function value, the third feature function value and the third weight corresponding to the third feature function value.

5. The method according to claim 1, characterized in that Also includes: For a spending card, obtaining the similarity of the matching data group corresponding to the spending card within the preset time period and the spending amount in the matching data group; Calculate a first abnormal intensity parameter using the similarity of the matching data group and the expenditure amount in the matching data group; determine a first abnormal level of the expenditure card according to the first abnormal intensity parameter; and process the expenditure card according to a first abnormal processing strategy corresponding to the first abnormal level; and / or, For an income card, obtaining the similarity of the matching data group corresponding to the income card within the preset time period and the income amount in the matching data group; using the similarity of the matching data group and the income amount in the matching data group, calculating a second abnormal intensity parameter; determining a second abnormality level of the income card according to the second abnormality intensity parameter; The income card is processed according to a second exception processing strategy corresponding to the second exception level.

6. The method according to claim 5, characterized in that The first anomaly strength parameter is the sum of the product of the similarity of each matching data group and the expenditure amount in the matching data group; The second anomaly strength parameter is the sum of the product of the similarity of each of the matching data groups and the income amount in the matching data group.

7. The method according to claim 1, characterized in that The step of identifying, based on the matching data set, at least some of the transactions indicated by the matching data set as abnormal transactions comprises: Call abnormal transaction card database; Searching an abnormal transaction card database for transaction card information matching the expenditure card number and / or the income card number in the matching data group; If there is transaction card information matching the expenditure card number and / or the income card number in the matching data set in the abnormal transaction card database, the transaction indicated by the matching data set is identified as an abnormal transaction.

8. The method according to claim 1, characterized in that Before identifying, based on the matching data group, at least part of the transactions indicated by the matching data group as abnormal transactions, the method further includes: If the expenditure time in the matching data group is later than or equal to the income time, the matching data group is eliminated; and / or if the duration between the expenditure time and the income time in the matching data group is greater than an abnormal duration threshold, the matching data group is eliminated; In the case where the expense card transaction data also includes a transaction fee, before identifying, based on the matching data group, at least part of the transactions indicated by the matching data group as abnormal transactions, the method further includes: If the difference between the expenditure amount and the income amount in the matching data group is less than or equal to the transaction fee, the matching data group is eliminated.

9. The method according to claim 1, characterized in that: After acquiring the expenditure card transaction data and the income card transaction data within the preset time period, the method further includes: If the expenditure amount in the expenditure card transaction data is less than the small payment threshold, the expenditure card transaction data is discarded; if the income amount in the income card transaction data is less than the small payment threshold, the income card transaction data is discarded; In the case where the expenditure card transaction data includes a transaction response identifier and the income card transaction data includes a transaction response identifier, after acquiring the expenditure card transaction data and the income card transaction data within a preset time period, the method further includes: If the transaction response identifier in the expenditure card transaction data indicates that the transaction failed, the expenditure card transaction data is discarded; if the transaction response identifier in the income card transaction data indicates that the transaction failed, the income card transaction data is discarded.

10. The method according to claim 1, characterized in that After identifying, based on the matching data group, at least part of the transactions indicated by the matching data group as abnormal transactions, the method further includes: Marking a transaction card having a transaction relationship with a target expenditure card as a transaction abnormality risk card, wherein the target expenditure card is the expenditure card indicated by the matching data group corresponding to the abnormal transaction; A transaction card having a transaction relationship with a target revenue card is marked as a transaction abnormality risk card, wherein the target revenue card is the revenue card indicated by the matching data group corresponding to the abnormal transaction.

11. An abnormal transaction identification device, characterized in that: include: A data acquisition module, used to acquire expenditure card transaction data and income card transaction data within a preset time period, wherein the expenditure card transaction data is used to represent expenditure details and the income card transaction data is used to represent income details; a matching module, configured to match the expenditure card transaction data with the income card transaction data according to the expenditure details represented by the expenditure card transaction data and the income details represented by the income card transaction data, so as to obtain a matching data group, wherein the expenditure details represented by the expenditure card transaction data and the income details of the income card transaction data in the matching data group are the same; an identification module, configured to identify, based on the matching data group, at least some of the transactions indicated by the matching data group as abnormal transactions; The spending card transaction data includes spending time, spending amount, transaction acquiring institution identification and spending card number, and the income card transaction data includes income time, income amount, transaction acquiring institution identification and income card number. The matching module comprises: A first matching unit is used to determine whether the spending time of the spending card transaction data and the income time of the income card transaction data belong to the same period; A second matching unit is used to determine whether the expenditure amount of the expenditure card transaction data and the income amount of the income card transaction data belong to the same amount range; A third matching unit, used to determine whether the transaction acquirer identifier of the expenditure card transaction data and the transaction acquirer identifier of the income card transaction data are consistent; A grouping unit, for grouping the expenditure card transaction data and the income card transaction data into the same candidate data group, when the expenditure time of the expenditure card transaction data and the income time of the income card transaction data belong to the same time period, the expenditure amount of the expenditure card transaction data and the income amount of the income card transaction data belong to the same amount range, and the transaction acquiring institution identifier of the expenditure card transaction data and the transaction acquiring institution identifier of the income card transaction data are consistent; a selection unit, for obtaining feature information of each candidate data group, wherein the feature information includes one or more of first feature information, second feature information and third feature information, wherein the first feature information is used to characterize whether the user of the expenditure card indicated by the expenditure card number and the user of the income card indicated by the income card number are the same user, the second feature information is used to characterize the number of successful matches between the historical expenditure card transaction data of the expenditure card indicated by the expenditure card number and the historical income card transaction data of the income card indicated by the income card number, and the third feature information is used to characterize the size of the difference between the handling fee between the expenditure amount and the income amount and a preset abnormal handling fee; Calculating the similarity between the expenditure card transaction data and the income card transaction data in the candidate data group according to the feature information of the candidate data group; Remove candidate data groups whose similarity is lower than a preset similarity threshold; If the number of the candidate data groups including the same payment card transaction data is more than two, selecting the one with the highest similarity from the more than two candidate data groups as the matching data group; If the number of the candidate data groups including the same income card transaction data is more than two, the one with the highest similarity is selected from the more than two candidate data groups as the matching data group.

12. An abnormal transaction identification device, characterized in that: include: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, the abnormal transaction identification method according to any one of claims 1 to 10 is implemented.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, and when the computer program instructions are executed by a processor, the abnormal transaction identification method according to any one of claims 1 to 10 is implemented.

Images