A method for detecting abnormal driver income

Abstract

The present invention discloses a method for detecting abnormal driver income, comprising the following steps: S1, defining the input of the financial settlement system; S2, establishing an isolated forest of general ledger accounts; S3, using isolated forest trees to calculate the score of each driver; S4, finding drivers with abnormal income; S5, generating abnormal detection results. The present invention provides a method for detecting abnormal driver income, which first establishes an isolated forest tree for the general ledger account through an isolated forest to find abnormal drivers, and then uses a box method to confirm abnormal accounts for abnormal drivers, summarizes the driver's abnormal income data table, and can provide subsequent manual processing data; the method provides a method for checking whether the amount of payment is abnormal in the financial settlement link, strengthens the control of fund security in the last link of fund export, and prevents major financial risks. The advantage is that there is no need to pay attention to the complex rules of the business side, and the risk management of the general ledger and each account can be automatically performed.

Description

Technical Field

[0001] The present invention relates to the field of fund settlement, and in particular to a method for detecting abnormal driver income. Background Art

[0002] In the area of ​​online ride-hailing financial settlement, the online ride-hailing platform deducts the platform commission based on the amount of the passenger's order, and periodically adds up the order's share of the amount and various reward amounts before paying the driver.

[0003] During the fund settlement stage, the financial settlement system only contains information related to financial accounts, such as the general ledger account of this cycle: total amount of payments, and detailed accounts: order fees, cancellation fees, surcharges, bonuses, risk control deductions and other financial accounts. The financial settlement system settles the bills provided by the billing system for the driver. If there are problems with the bills provided by the billing system, such as errors in the order summary calculation, the driver obtained a large amount of money by cheating, and the operator mistakenly entered a large amount of rewards, etc., it will cause financial losses and be difficult to detect.

[0004] Based on this, the present invention discloses a method for detecting abnormal driver income. The method can detect abnormal driver income in the financial settlement link before the final exit of funds, thereby screening out abnormal drivers and requiring secondary manual confirmation, thereby effectively intercepting drivers with large abnormal values ​​and avoiding financial losses and financial risks in the system. Summary of the invention

[0005] The technical problem to be solved by the present invention is to overcome the defects of the prior art and provide a method for detecting abnormal driver income in the amount settlement link.

[0006] The present invention provides the following technical solutions:

[0007] The present invention provides a method for detecting abnormal driver income, comprising the following steps:

[0008] S1. Define the input of the financial settlement system:

[0009] Assume that the settlement cycle is t natural days, and the billing system generates a driver bill every t days; there are n drivers in total, and the driver numbers are 1, 2...n. Each driver's bill contains a general ledger account and detailed accounts; the general ledger account is the sum of the detailed accounts, and the general ledger account is the amount of money to be paid to the driver in this period. The detailed accounts of risk control deductions are negative numbers; now record the general ledger account amount of a driver as c, which contains m detailed accounts, recorded as p1, p2...pm,

[0010] S2. Create an isolated forest of general ledger accounts:

[0011] For n drivers, the general ledger accounts are denoted as c(1), c(2)…c(n), and find the abnormal values among them; use the one-dimensional isolation forest method to identify the abnormal values;

[0012] The isolation forest method constructs w trees, Each tree is a binary tree, and the construction process of each tree is as follows:

[0013] (1) Tree initialization: Randomly select v drivers from n drivers, as set D, and initialize an empty binary tree; e represents the current height of the tree, initially e = 0, l represents the maximum height limit of the tree, and set the maximum height of the tree l = ceil(log 2 (v)), where ceil means rounding down;

[0014] (2) Set splitting rule: Let a set X, the maximum value of the general ledger accounts of the drivers in X be kmax, the minimum value be kmin, randomly generate an integer k such that kmin ≤ k ≤ kmax; k is used as the splitting point of set X, and set X is split into P and Q; for the general ledger account c in set X, if c < k, put it into P; otherwise c ≥ k, put it into Q, the tree height e increases by 1, and at this time the integer k is constructed as a binary tree node (non-leaf), the content of the node is k, its left son node is the splitting node of P, and the right son node is the splitting node of Q; recursively repeat the splitting process for P and Q to construct a complete tree;

[0015] (3) Set non-splitting rule: If the number of elements in set X is less than or equal to 1, or the tree height has reached l when set X is split, then at this time construct a binary tree node, and the content of the binary tree node is set X, and X is a leaf node;

[0016] (4) Algorithm initialization X = D, start splitting according to the splitting and non-splitting rules until there is no set that can be split again;

[0017] S3. Calculate the score of each driver using the isolation forest tree:

[0018] The average path length of the forest is u = 2*(H(v - 1)-(v - 1) / v); where H(x) = Ln(x)+γ; Ln is the natural logarithm, and γ is the Euler constant, γ≈0.5772156649;

[0019] For each driver, in w trees, perform a binary search to confirm its path length. The path length is the number of edges passed from the root node to the leaf node. The path lengths of a single driver in w trees are d1, d2…dw respectively, then the average path length of this driver The score of the driver is score = d / u. Through this method, score is normalized to the value range [0, 1]. The closer score is to 1, the higher the abnormal probability;

[0020] The scores of all drivers are obtained in sequence as score1, score2... scoren;

[0021] S4. Find the drivers with abnormal income:

[0022] Perform a descending sort on score1, score2... scoren; α is a preset abnormal estimation factor, 0 < α ≤ 0.1, then the first α*n drivers are the drivers with abnormal income; screen the first α*n drivers according to the following rules:

[0023] (1) If the maximum score of the α*n drivers < 0.5, then the scores of all α*n drivers are less than 0.5. At this time, there are no abnormal drivers, and all are removed from the α*n drivers;

[0024] (2) For these α*n drivers, since mainly drivers with abnormally high values are detected and drivers with abnormally low values are not considered, remove the drivers whose total ledger amount is less than β, where β is a preset attention amount;

[0025] (3) Remove the drivers with score < 0.01. Drivers with very low scores are not abnormal drivers;

[0026] Finally, r drivers are obtained, r ≤ α*n;

[0027] S5. Generate an abnormal detection result:

[0028] Locate the abnormal values of the detailed accounts of the abnormal drivers; calculate the abnormal values of the detailed accounts p1, p2... pm respectively;

[0029] Use the box method to confirm the abnormal account values. Specifically, taking account p1 as an example, sort the values of n drivers in account p1 in ascending order. Q1 is the 25% quantile, Q3 is the 75% quantile, and IQR = Q3 - Q1; check the p1 values of r abnormal drivers. If p1 < Q1 - 1.5IQR or p1 > Q3 + 1.5IQR, then the p1 of this driver is abnormal, otherwise p1 is normal; the calculation methods for accounts p2, p3... pm are similar.

[0030] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0031] The present invention provides a method for detecting abnormal driver income. First, an isolation forest tree is established for the general ledger account through the isolation forest to find abnormal drivers. Then, for the abnormal drivers, the box method is used to confirm the abnormal accounts, and a data table of abnormal driver income is summarized, which can provide data for subsequent manual processing;

[0032] This method provides a way to check whether the amount of payment is abnormal during the financial settlement process, strengthen the control of fund security at the last link of fund outflow, and prevent major financial risks. The advantage is that there is no need to pay attention to the complex rules of the business party, and it can automatically perform risk management of the general ledger and each account. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0034] Figure 1 It is a structural diagram of the present invention;

[0035] Figure 2 It is one of the schematic diagrams of the embodiments of the present invention;

[0036] Figure 3 This is the second schematic diagram of the embodiment of the present invention. DETAILED DESCRIPTION

[0037] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention. The same reference numerals in the accompanying drawings all refer to the same components.

[0038] Example 1

[0039] like Figure 1-3 The present invention provides a method for detecting abnormal driver income, comprising the following steps:

[0040] S1. Define the input of the financial settlement system:

[0041] Assume that the settlement cycle is t natural days, and the billing system generates a driver bill every t days. There are n drivers in total, and the driver numbers are 1, 2...n. Each driver's bill contains a general ledger account and a detailed account. The general ledger account is the sum of the detailed accounts. The general ledger account is the amount of money to be paid to the driver in this period. The detailed account of risk control deduction is a negative number. Now record the general ledger account amount of a driver as c, which contains m detailed accounts, recorded as p1, p2...pm,

[0042] The following is n pieces of driver data as input to the financial settlement system, including 1 general ledger account and 3 detailed accounts:

[0043] Driver No. Total ledger amount Detailed Subject 1 Detailed Subject 2 Detailed Subject 3

[0044] S2. Create an isolated forest of general ledger accounts:

[0045] For n drivers, the general ledger accounts are denoted as c(1), c(2), …, c(n), and the abnormal values are found from them. The one-dimensional isolation forest method is used to identify the abnormal values.

[0046] The isolation forest method constructs w trees. Each tree is a binary tree, and the construction process of each tree is as follows:

[0047] (1) Tree initialization: Randomly select v drivers from n drivers. As the set D, initialize an empty binary tree. e represents the current height of the tree, initially e = 0, and l represents the maximum height limit of the tree. Set the maximum height of the tree l = ceil(log 2 (v)), where ceil represents rounding up to the nearest integer.

[0048] (2) Set splitting rule: Let a set X, the maximum value of the general ledger accounts of the drivers in X be kmax, the minimum value be kmin, and randomly generate an integer k such that kmin ≤ k ≤ kmax; k is used as the splitting point of the set X, and the set X is split into P and Q. For the general ledger account c in the set X, if c < k, it is put into P; otherwise c ≥ k, it is put into Q, and the tree height e is increased by 1. At this time, the integer k is constructed as a binary tree node (non-leaf), the content of the node is k, its left son node is the splitting node of P, and the right son node is the splitting node of Q. Recursively repeat the splitting process for P and Q to construct a complete tree.

[0049] (3) Set non-splitting rule: If the number of elements in the set X is less than or equal to 1, or the tree height has reached l when the set X is split, then at this time, a binary tree node is constructed, and the content of the binary tree node is the set X, and X is a leaf node.

[0050] (4) Algorithm initialization X = D, start splitting according to the splitting and non-splitting rules until there is no set that can be split again.

[0051] Figure 2 For a subtree with a height of 2 established for 5 data (10, 20, 30, 40, 500), the yellow ones are leaf nodes, and the leaf nodes are sets:

[0052] This tree first generates a random number 35 within [10, 500], splits out the set {10, 20, 30} and the set {40, 500}, then generates a random number 30 within [10, 30] for the set {10, 20, 30}, splits out the sets {10, 20}, {30}. Since the tree height 2 satisfies non-splitting at this time, {10, 20} and {30} are not split further later. For {40, 500}, a random number 80 within [40, 500] is generated and split into {40}, {80};

[0053] As Figure 3 The figure shows two other splitting methods (caused by different random numbers). As can be seen from the figure, for the data 500, since 500 deviates greatly from other values, the random algorithm makes it very likely that its path is shorter.

[0054] S3. Calculate the score of each driver using the isolation forest tree:

[0055] The average path length of the forest is u = 2*(H(v-1)-(v-1) / v). Where H(x) = Ln(x) + γ. Ln is the natural logarithm, γ is the Euler constant, γ≈0.5772156649;

[0056] For each driver, binary search is performed to determine the path length in the w trees. The path length is the number of edges from the root node to the leaf node. The path lengths of a single driver in the w trees are d1, d2…dw. The average path length of the driver is The driver's score is score = d / u. Through this method, the score is normalized to the value range [0, 1]. The closer the score is to 1, the higher the abnormal probability.

[0057] The scores of all drivers are obtained in sequence as score1, score2…scoren.

[0058] S4. Find drivers with abnormal income:

[0059] Sorting score1, score2…scoren in descending order; α is the preset abnormality estimation factor, 0<α≤0.1, then the first α*n drivers are drivers with abnormal income. Filter the first α*n drivers according to the following rules:

[0060] (1) If the maximum score of α*n drivers is less than 0.5, then the scores of α*n drivers are all less than 0.5. At this time, there are no abnormal drivers and all of them are removed from α*n drivers.

[0061] (2) For these α*n drivers, since we mainly detect drivers with excessively high abnormalities, we do not consider drivers with excessively low abnormalities. We remove drivers whose total ledger amounts are less than β, where β is the preset attention amount.

[0062] (3) Remove drivers with score < 0.01. Drivers with very low scores are not abnormal drivers;

[0063] Finally, we get r drivers, r≤α*n.

[0064] S5. Generate anomaly detection results:

[0065] Locate the abnormal values ​​of the detailed items of abnormal drivers. Calculate the abnormal values ​​of the detailed items p1, p2...pm respectively.

[0066] The box method is adopted to confirm the abnormal account values. Taking the p1 account as an example specifically, the values of n drivers in the p1 account are sorted in ascending order. Q1 is the 25th percentile, Q3 is the 75th percentile, and IQR = Q3 - Q1. Check the p1 values of r abnormal drivers. If p1 < Q1 - 1.5IQR or p1 > Q3 + 1.5IQR, then the p1 of this driver is abnormal; otherwise, p1 is normal. The calculation methods for the p2, p3... pm accounts are similar.

[0067] Form the following r record results and provide them for manual review. The following is an example result.

[0068]

[0069]

[0070] Explanation: For driver number 8, its general ledger is abnormal, but each detailed account is normal. It may be that each account has increased, but not enough to be detected in each account. This detection result can reduce the difficulty of subsequent manual processing.

[0071] Finally, it should be noted that the above are only the preferred embodiments of the present invention and are not used to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements for some of the technical features. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims

1. A method for detecting abnormal driver income, characterized in that: Including the following steps: S1. Define the input of the financial settlement system: Assume that the settlement cycle is t natural days, and the billing system generates a driver bill every t days; there are n drivers in total, and the driver numbers are 1, 2...n. Each driver's bill contains a general ledger account and detailed accounts; the general ledger account is the sum of the detailed accounts, and the general ledger account is the amount of money to be paid to the driver in this period. The detailed accounts of risk control deductions are negative numbers; now record the general ledger account amount of a driver as c, which contains m detailed accounts, recorded as p1, p2...pm, S2. Establish an isolation forest for general ledger accounts: For n drivers, their general ledger accounts are denoted as c(1), c(2),..., c(n), and find the abnormal values among them; use the one-dimensional isolation forest method to identify the abnormal values; The isolation forest method constructs w trees, Each tree is a binary tree, and the construction process of each tree is as follows: (1) Tree initialization: v drivers are randomly selected from n drivers. As set D, initialize an empty binary tree; e represents the height of the current tree, initially e = 0, l represents the maximum height limit of the tree, and the maximum height of the tree is set to l = ceil(log2(v)), where ceil represents rounding down to an integer; (2) Set splitting rule: Let there be a set X. The maximum value of the general ledger accounts of the drivers in X is kmax, and the minimum value is kmin. Randomly generate an integer k such that kmin ≤ k ≤ kmax; k is used as the splitting point of set X, and set X is split into P and Q; for the general ledger account c in set X, if c < k, put it into P; otherwise, if c ≥ k, put it into Q, and the tree height e is incremented by 1. At this time, the integer k is constructed as a binary tree node (non-leaf), the node content is k, its left son node is the splitting node of P, and its right son node is the splitting node of Q; recursively repeat the splitting process for P and Q to construct a complete tree; (3) Set non-splitting rule: If the number of elements in set X is less than or equal to 1, or the tree height has reached l when set X is split, then at this time, construct a binary tree node, and the content of the binary tree node is set X, and X is a leaf node; (4) Algorithm initialization: X = D. According to the splitting rules of splitability and non-splitability, start splitting until there is no set that can be split again; S3. Use the isolation forest tree to calculate the score of each driver: The average path length of the forest is u = 2 * (H(v - 1) - (v - 1) / v); where H(x) = Ln(x) + γ; Ln is the natural logarithm, and γ is the Euler constant, γ ≈ 0.5772156649; For each driver, binary search is performed to determine the path length in the w trees. The path length is the number of edges from the root node to the leaf node. The path lengths of a single driver in the w trees are d1, d2…dw. The average path length of the driver is The driver's score is score = d / u. Through this method, the score is normalized to the value range [0, 1]. The closer the score is to 1, the higher the abnormal probability; Successively obtain the scores of all drivers as score1, score2,..., scoren; S4. Find the drivers with abnormal income: Sort score1, score2,..., scoren in descending order; α is a preset abnormal prediction factor, 0 < α ≤ 0.1, then the first α * n drivers are the drivers with abnormal income; screen the first α * n drivers according to the following rules: (1) If the maximum score of the α * n drivers < 0.5, then the scores of all α * n drivers are less than 0.

5. At this time, there are no abnormal drivers, and all are removed from the α * n drivers; (2) For these α * n drivers, since mainly drivers with abnormally high values are detected, drivers with abnormally low values are not considered, and remove the drivers whose general ledger amount is less than β, where β is the preset amount of concern; (3) Remove the drivers with score < 0.

01. Drivers with very low scores are not abnormal drivers; Finally, obtain r drivers, r ≤ α * n; S5. Generate the abnormal detection result: Locate the abnormal value of the detailed account of the abnormal driver; calculate the abnormal value of the detailed accounts p1, p2,..., pm respectively; The box method is used to confirm abnormal account values. Specifically, taking account p1 as an example, the values of n drivers in account p1 are sorted in ascending order. Q1 is the 25th percentile, Q3 is the 75th percentile, and IQR = Q3 - Q1. Check the p1 values of r abnormal drivers. If p1 < Q1 - 1.5IQR or p1 > Q3 + 1.5IQR, then the p1 of this driver is abnormal; otherwise, p1 is normal. The calculation methods for accounts p2, p3... pm are similar.

Images