An intelligent assessment method and system for transaction fraud risk

Abstract

The present invention provides an intelligent assessment method and system for transaction fraud risk, wherein the method comprises: collecting information and obtaining information monitoring rules; conducting information monitoring and investigation according to the information monitoring rules to build a transaction blacklist database and a transaction whitelist database; obtaining first transaction information, and obtaining a first transaction network by performing transaction association according to the first transaction information and the transaction blacklist database and the transaction whitelist database; conducting transaction flow analysis to obtain account attribute analysis results; collecting a historical transaction record set according to the account attribute analysis results; inputting the historical transaction record set into a risk assessment model to obtain a transaction risk analysis result of the first transaction information. The technical problems of failing to fully tap the underlying data capabilities, low monitoring and identification capabilities, and low risk assessment accuracy are solved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence, and in particular to an intelligent assessment method and system for transaction fraud risk. Background Art

[0002] The monitoring of bank card numbers, mobile phone numbers, and IP address numbers, the underlying infrastructure of the online "black and gray industries", can create certain value for transaction fraud risk assessment and prevention of transaction risks.

[0003] Existing technologies have technical problems such as low monitoring and identification capabilities and low risk assessment accuracy, as fraud methods have developed towards Internet channels and they have failed to fully tap into underlying data capabilities for transaction frauds that have a wide coverage, high concealment, and low reporting rates. Summary of the invention

[0004] This application provides an intelligent assessment method and system for transaction fraud risk, which solves the technical problems of the prior art that, due to the development of fraud methods to Internet channels, the underlying data capabilities have not been fully explored, the monitoring and identification capabilities are not high, and the risk assessment accuracy is low for transaction fraud behaviors with wide coverage, high concealment, and low reporting rates. The application achieves the technical effect of collecting underlying data information, building underlying information monitoring rules, obtaining blacklist and whitelist databases, providing more data support for risk investigation, and analyzing the attributes of accounts based on the flow of funds in transactions combined with blacklist and whitelist databases, and evaluating transaction risks according to account attributes, thereby improving the accuracy of risk assessment and the ability to monitor and identify transactions.

[0005] In view of the above problems, the present application provides an intelligent assessment method and system for transaction fraud risk.

[0006] In the first aspect, the present application provides an intelligent assessment method for transaction fraud risks, wherein the method includes: collecting bank card information, mobile phone number information and IP address information according to the joint prevention and control platform; obtaining information monitoring rules for the bank card information, the mobile phone number information and the IP address information; performing information monitoring and investigation according to the bank card information, mobile phone number information and IP address information and the information monitoring rules, and constructing a transaction blacklist database and a transaction whitelist database; obtaining first transaction information, and performing transaction association with the transaction blacklist database and the transaction whitelist database based on the first transaction information to obtain a first transaction network; performing transaction flow analysis according to the first transaction network to obtain account attribute analysis results; collecting a set of account historical transaction records according to the account attribute analysis results; inputting the set of account historical transaction records into a risk assessment model to obtain a transaction risk analysis result of the first transaction information.

[0007] On the other hand, the present application provides an intelligent assessment system for transaction fraud risk, wherein the system includes: a first collection unit, the first collection unit is used to collect bank card information, mobile phone number information and IP address information according to the joint prevention and control platform; a first acquisition unit, the first acquisition unit is used to obtain information monitoring rules for the bank card information, the mobile phone number information and the IP address information; a first construction unit, the first construction unit is used to perform information monitoring and investigation according to the bank card information, mobile phone number information and IP address information and the information monitoring rules, and construct a transaction blacklist database and a transaction whitelist database; a second acquisition unit, the second acquisition unit is used to obtain first transaction information, and based on the first transaction information, the transaction is associated with the transaction blacklist database and the transaction whitelist database to obtain a first transaction network; a third acquisition unit, the third acquisition unit is used to perform transaction flow analysis according to the first transaction network to obtain an account attribute analysis result; a second collection unit, the second collection unit is used to collect an account historical transaction record set according to the account attribute analysis result; a fourth acquisition unit, the fourth acquisition unit is used to input the account historical transaction record set into a risk assessment model to obtain a transaction risk analysis result of the first transaction information.

[0008] In a third aspect, the present application provides an intelligent assessment system for transaction fraud risk, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any one of the methods described in the first aspect when executing the program.

[0009] One or more technical solutions provided in this application have at least the following technical effects or advantages:

[0010] By adopting the method of collecting information, building information monitoring rules and conducting information monitoring and investigation according to the information monitoring rules, a transaction blacklist database and a transaction whitelist database are obtained; first transaction information is obtained, and transaction association is performed with the transaction blacklist database and the transaction whitelist database according to the first transaction information to obtain a first transaction network; transaction flow analysis is performed according to the first transaction network to obtain account attribute analysis results; a set of historical transaction records is collected according to the account attribute analysis results; the set of historical transaction records is input into a risk assessment model to obtain a technical solution for the transaction risk analysis results of the first transaction information. This application provides an intelligent assessment method and system for transaction fraud risks, which achieves the technical effect of obtaining blacklist and whitelist databases by collecting underlying data information, building underlying information monitoring rules, and providing more data support for risk investigation, and performing attribute analysis on accounts based on the flow of funds of transactions in combination with blacklist and whitelist databases, and conducting transaction risk assessment according to account attributes, thereby improving the accuracy of risk assessment and the ability of transaction monitoring and identification.

[0011] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 A flowchart of an intelligent transaction fraud risk assessment method according to an embodiment of the present application;

[0013] Figure 2 A schematic diagram of a process for obtaining an account attribute analysis result in an intelligent transaction fraud risk assessment method according to an embodiment of the present application;

[0014] Figure 3 A schematic diagram of a process of obtaining a first transaction network in an intelligent transaction fraud risk assessment method according to an embodiment of the present application;

[0015] Figure 4 This is a schematic diagram of the structure of an intelligent assessment system for transaction fraud risk according to an embodiment of the present application;

[0016] Figure 5 It is a schematic diagram of the structure of an exemplary electronic device according to an embodiment of the present application.

[0017] Explanation of the reference numerals: first acquisition unit 11 , first obtaining unit 12 , first construction unit 13 , second obtaining unit 14 , third obtaining unit 15 , second acquisition unit 16 , fourth obtaining unit 17 , electronic device 300 , memory 301 , processor 302 , communication interface 303 , bus architecture 304 . DETAILED DESCRIPTION

[0018] This application provides an intelligent assessment method and system for transaction fraud risk, which solves the technical problems of the prior art that, due to the development of fraud methods to Internet channels, the underlying data capabilities have not been fully explored, the monitoring and identification capabilities are not high, and the risk assessment accuracy is low for transaction fraud behaviors with wide coverage, high concealment, and low reporting rates. The application achieves the technical effect of collecting underlying data information, building underlying information monitoring rules, obtaining blacklist and whitelist databases, providing more data support for risk investigation, and analyzing the attributes of accounts based on the flow of funds in transactions combined with blacklist and whitelist databases, and evaluating transaction risks according to account attributes, thereby improving the accuracy of risk assessment and the ability to monitor and identify transactions.

[0019] The acquisition, storage, use, and processing of data in the technical solution of this application comply with the relevant provisions of national laws and regulations.

[0020] As fraud methods develop towards Internet channels, there is a technical problem of failing to fully tap into the underlying data capabilities, low monitoring and identification capabilities, and low risk assessment accuracy for transaction frauds that have a wide coverage, high concealment, and low reporting rates.

[0021] In response to the above technical problems, the overall idea of ​​the technical solution provided by this application is as follows:

[0022] The present application provides an intelligent assessment method for transaction fraud risk, wherein the method includes: collecting information, building information monitoring rules, and conducting information monitoring and investigation according to the information monitoring rules, thereby obtaining a transaction blacklist database and a transaction whitelist database; obtaining first transaction information, and conducting transaction association based on the first transaction information with the transaction blacklist database and the transaction whitelist database to obtain a first transaction network; conducting transaction flow analysis according to the first transaction network to obtain account attribute analysis results; collecting a set of historical transaction records according to the account attribute analysis results; inputting the set of historical transaction records into a risk assessment model to obtain a transaction risk analysis result of the first transaction information. The method achieves the technical effect of obtaining a blacklist and whitelist database by collecting underlying data information, building underlying information monitoring rules, and providing more data support for risk investigation, and conducting attribute analysis on accounts based on the flow of funds of transactions in combination with the blacklist and whitelist databases, and conducting transaction risk assessment according to account attributes, thereby improving the accuracy of risk assessment and the ability of transaction monitoring and identification.

[0023] After introducing the basic principles of the present application, various non-limiting implementation methods of the present application will be specifically described below in conjunction with the drawings in the specification.

[0024] Embodiment 1

[0025] like Figure 1 As shown, an embodiment of the present application provides an intelligent assessment method for transaction fraud risk, wherein the method is applied to an intelligent assessment system for transaction fraud risk, the system is communicatively connected to a joint prevention and control platform, and the method includes:

[0026] Step S100: collecting bank card information, mobile phone number information and IP address information according to the joint prevention and control platform;

[0027] Specifically, the monitoring of bank card numbers, mobile phone numbers, and IP address numbers, the underlying infrastructure of the online "black and gray industries", can create certain value for transaction fraud risk assessment and prevention of transaction risks.

[0028] Therefore, this application proposes an intelligent assessment method for transaction fraud risk, which assesses transaction fraud risk based on the underlying basic data of "black and gray industries". The method is applied to the intelligent assessment system for transaction fraud risk, and the intelligent assessment system for transaction fraud risk is communicatively connected to the joint prevention and control platform. The joint prevention and control platform is jointly constructed by the central bank, branches / sub-branches of the People's Bank of China, China UnionPay, financial institutions, payment institutions, the three major operators, security vendors, etc. in the anti-transaction fraud ecological chain. The joint prevention and control platform can break data silos and achieve the effect of sharing fraud data.

[0029] Therefore, bank card information, mobile phone number information and IP address information are collected separately according to the joint prevention and control platform. Among them, by further combining information encryption technology, while ensuring that personal information is not leaked, the cardholder's ID card information can be obtained based on the bank card information, laying the foundation for risk verification and risk assessment; mobile phone number information includes mobile phone number permanent location information, mobile phone number card opening location information, mobile phone number online status, etc.; IP address information includes the physical location information of the IP address, whether it is a broadband IP or a mobile phone IP, IP address changes, etc. By collecting bank card information, mobile phone number information and IP address information, data support can be provided for the construction of a transaction database.

[0030] Step S200: obtaining information monitoring rules for the bank card information, the mobile phone number information and the IP address information;

[0031] Specifically, bank card information monitoring rules include but are not limited to whether it is a dormant card (a dormant card is a bank card that has not been activated for a long time after opening the card); judging whether it is multiple cards for one person in combination with the corresponding identity information of the bank card, and whether other bank cards of the identity information have performed bad activities; checking the website to see whether the bank card is the payment card of the website; and whether there is an account opening risk for the new card user's identity. Mobile phone number information monitoring rules include but are not limited to three-factor consistency verification (the three factors are ID card, mobile phone number, and name); segmented monitoring of the length of time the mobile phone number is online; monitoring of the mobile phone's online status, including normal, arrears, and shutdown status; monitoring of the city where the mobile phone number belongs; verification of the mobile phone number's permanent location, including feedback on the location through signaling data, verification of the individual's place of work, place of residence, and place of card opening, and thus verification of the permanent location; monitoring of the number of mobile phone terminals used within a period; whether the mobile phone number is frequently in arrears, whether there is a number maintenance situation, etc. IP address information monitoring rules include but are not limited to whether there is IP second-broadcasting behavior; IP risk area verification, whether it is an IP from a high-risk overseas area; IP IDC room verification, check whether the IP is an IDC room IP; cloud service provider identification, identify whether the IP is a cloud service provider IP, such as Alibaba Cloud.

[0032] According to various forms of transaction fraud, information monitoring rules are formulated for bank card information, mobile phone number information and IP address information respectively. The targeted analysis of the three basic data is achieved, which is conducive to improving the accuracy of risk identification and can lay the foundation for data sharing among the three.

[0033] Step S300: Perform information monitoring and investigation according to the bank card information, mobile phone number information, IP address information and the information monitoring rules, and build a transaction blacklist database and a transaction whitelist database;

[0034] Step S400: obtaining first transaction information, and performing transaction association with the transaction blacklist database and the transaction whitelist database based on the first transaction information to obtain a first transaction network;

[0035] Specifically, a large amount of bank card information, mobile phone number information, and IP address information collected are monitored and checked according to the information monitoring rules, and the information without any transaction risk in the information monitoring and checking is compiled and stored to form the transaction whitelist database. The information detected abnormally in the information checking is compiled and stored to form the transaction blacklist database.

[0036] The first transaction information is the transaction information that needs to be evaluated for transaction risk, including the complete fund transfer information of the transaction, from the transfer of funds to the final cessation of fund flow. The first transaction information contains several entities involved in the transaction. The transaction subject in the first transaction information is associated with the transaction blacklist database and the whitelist database. Transaction association can be understood as using the transaction subject in the first transaction information to traverse and search the subject in the above two databases, so as to predict the risk of each transaction subject in the first transaction information. The transaction subject in the transaction blacklist database and the transaction whitelist database is marked on the transaction subject of the first transaction information. The first transaction network is constructed according to the marked transaction subject information and the fund transaction time and transaction relationship of the first transaction information. By constructing the first transaction network, the analysis and judgment of the transaction subject and the analysis of the nature of the funds can be more intuitive, so as to predict the risk level of the overall transaction, and lay the foundation for improving the accuracy of transaction risk assessment.

[0037] Step S500: performing transaction flow analysis according to the first transaction network to obtain account attribute analysis results;

[0038] Further, such as Figure 2 As shown, the embodiment S500 of the present application also includes:

[0039] Step S510: performing transaction flow analysis according to the first transaction network to obtain first position information, where the first position information is relative position information between the funds and the set of transaction abnormal objects;

[0040] Step S520: Obtaining a fund attribute analysis result according to the first location information;

[0041] Step S530: performing transaction amount analysis and transaction frequency analysis according to the fund attribute analysis result to obtain a transaction amount analysis result and a transaction frequency analysis result;

[0042] Step S540: performing transaction behavior feature analysis on the transaction abnormality object set based on the transaction amount analysis result and the transaction frequency analysis result to obtain the account attribute analysis result.

[0043] Specifically, the first transaction network is connected in series based on transaction time and transaction relationship, so the transaction flow of funds can be analyzed. For example, account A transfers funds out, and account B transfers funds to accounts C, D, E, etc. after receiving the funds. The flow of funds this time is from A to B, B to C, B to D, and B to E. According to the transaction flow, location information can be obtained, that is, the location information of funds and transaction objects.

[0044] The position of the funds and the transaction abnormality object set in the position information is the first position information. The transaction abnormality object set is a transaction object set that overlaps with the transaction blacklist database in the first transaction network. According to the position of the funds and the transaction abnormality object set, the fund attributes can be analyzed to obtain the fund attribute analysis result. Exemplary: For example, if the funds are transferred out of the transaction abnormality object set, if the funds are transferred into the transaction abnormality object set by an ordinary user, that is, the funds are upstream of the transaction abnormality object set, then the fund transaction is more likely to be defrauded by an ordinary user.

[0045] The results of the fund attribute analysis are further used to analyze the transaction amount and transaction frequency, that is, the transaction amount and transaction frequency of each transaction are analyzed based on the first transaction network. For example, if a certain account receives a fund transfer, and transfers the funds to multiple downstream accounts in batches within a fixed time, and the total amount of the transfer is not much different from the total amount of the received fund transfer, it means that this account can be determined as an intermediate account. Different attribute accounts have their own characteristics during the fraud process. For example, accounts with high fund transfer outflows are generally outgoing accounts, accounts with high fund transfer inflows are generally incoming accounts, and accounts with high-frequency, large-scale fund transfers and basically consistent amounts are intermediate accounts.

[0046] By analyzing the transaction amount of each transaction account and the transaction frequency within a fixed time range, the transaction amount analysis results and the transaction frequency analysis results can be obtained. After comparing the transaction amount analysis results and the transaction frequency analysis results with the transaction behaviors in different fraud scenarios, the attribute information of the account can be determined, that is, the account attribute analysis results are obtained.

[0047] By focusing on transaction amount and frequency, we can analyze account attributes, thus laying the foundation for effective transaction risk assessment and prevention.

[0048] Step S600: Collecting a set of historical transaction records of the account according to the account attribute analysis result;

[0049] Step S700: inputting the account historical transaction record set into a risk assessment model to obtain a transaction risk analysis result of the first transaction information.

[0050] Specifically, historical transaction records of each account are collected according to the account attribute analysis results, including, for example, bank card transaction records, mobile phone number communication records, SMS receiving records, IP address switching records of the same account, etc. The historical transaction records are collected starting from the data that can be queried, and all queried data records of accounts in the first transaction network are collected as the historical transaction record set. The historical transaction records of each account are sequentially input into the risk assessment model for risk assessment.

[0051] The risk assessment model is a recurrent neural network, which is a type of recurrent neural network that takes sequence data as input, recursively in the direction of sequence evolution, and all nodes (recurrent units) are connected in a chain. The recurrent neural network includes an input layer, a hidden layer, and an output layer. In the process of processing input information in the processing layer of the recurrent neural network, in addition to processing according to the current input information, it also saves the output information of the previous time series, and processes the output information as the input information of the current time series, thereby obtaining the output. As the time series progresses, the processing layer is continuously updated, and the risk assessment model is obtained by training a large amount of data until the preset accuracy is reached.

[0052] Each account is evaluated by the risk assessment model to obtain a risk value, and the risk value range is preferably 0-100. The larger the risk value, the higher the risk. Finally, according to the risk values ​​of all accounts in the first transaction network, the transaction risk assessment of the first transaction information is performed to obtain the transaction risk analysis result. For example: if the risk value of at least one account in the first transaction information reaches the risk range, for example, 40-100, then the first transaction information is relatively risky and needs further network tracking. If the risk value of no account reaches the risk range (40-100), it means that the first transaction information is highly secure, and the risk range can be set according to those skilled in the art. The risk assessment of different account attributes is achieved through the trained risk assessment model, and the re-verification of different account attributes is achieved, which improves the monitoring and identification capabilities of concealed fraud and the accuracy of risk assessment.

[0053] Furthermore, step S400 in the embodiment of the present application further includes:

[0054] Step S410: extracting a transaction object based on the first transaction information to obtain a first transaction object and a second transaction object;

[0055] Step S420: traversing and searching the transaction blacklist database and the transaction whitelist database based on the first transaction object and the second transaction object to obtain a transaction abnormal object set and a transaction normal object set;

[0056] Step S430: labeling the first transaction object and the second transaction object based on the abnormal transaction object set and the normal transaction object set to obtain a first labeled transaction object set;

[0057] Step S440: Serializing transactions according to the first identified transaction object set based on transaction time to obtain the first transaction network.

[0058] Further, such as Figure 3 As shown, the embodiment of the present application also includes:

[0059] Step S441: obtaining a transaction node of the first transaction network according to the first identified transaction object set;

[0060] Step S442: Connecting the transaction nodes in series according to the transaction time to construct the edges of the first transaction network;

[0061] Step S443: Obtain transaction amount information according to the first transaction information, and use the transaction amount information of each edge as the weight of the edge;

[0062] Step S444: Obtain the first trading network according to the trading nodes of the first trading network, the edges of the first trading network, and the weights of the edges.

[0063] Specifically, through existing network technology means of data extraction, such as web crawlers, natural language processing and other technologies, the transaction object of the first transaction information is extracted to obtain the first transaction object and the second transaction object, wherein the first transaction object is the starting point of the transaction, which is a funds outgoing account, and the second transaction object is one or more accounts, which are intermediate accounts and incoming accounts for funds. When the fund transaction is more complicated, the second transaction object is often composed of multiple accounts.

[0064] After the first transaction object and the second transaction object have been obtained, the transaction blacklist library and the transaction whitelist library are traversed and searched through the first transaction object and the second transaction object. The transaction object set found in the transaction blacklist is used as the transaction abnormality object set. The transaction object set found in the transaction whitelist is used as the transaction normal object set. The transaction abnormality object set and the transaction normal object set are marked in the first transaction object and the second transaction object. The mark with normal transaction indicates that the transaction object has never participated in transaction fraud activities, and the mark with abnormal transaction indicates that the transaction object is in the transaction blacklist and has a great risk of participating in transaction fraud activities.

[0065] After label identification, the first identification transaction object set is obtained. According to the objects in the first identification transaction object set and the objects not queried in the transaction blacklist database and the transaction whitelist database, the transaction nodes of the first transaction network are formed according to the objects in the first identification transaction object set and the unidentified objects. The transaction nodes with transaction relationships are connected in series according to the time of the transaction to obtain the edges of the first transaction network. At the same time, the transaction amount of each transaction relationship is used as the importance evaluation standard of the transaction, and the transaction amount information is used as the weight of the corresponding edge. In this way, the edge with a high weight is thicker than the edge with a low weight, and the capital transaction volume of different transactions in the process of capital flow can be intuitively seen. By setting the transaction nodes, edges and edge weights, the first transaction network is formed, which achieves the technical effect of intuitively displaying the transaction process, and the identification information with suspicious transaction objects and whitelist transaction objects can improve the efficiency of risk assessment.

[0066] Furthermore, step S700 of the embodiment of the present application further includes:

[0067] Step S710: extracting transaction information from the transaction blacklist database to obtain a set of time-series transaction data of each blacklist account;

[0068] Step S720: performing transaction time distribution analysis based on the time-series transaction data set of each blacklist account to obtain transaction distribution information;

[0069] Step S730: performing cluster analysis on the blacklist accounts based on the transaction distribution information to obtain cluster analysis results.

[0070] Specifically, since the accounts in the blacklist database can be further subdivided according to different fraud frequencies, it is necessary to extract the transaction information of the accounts in the blacklist database. Through the database data query function, the time-series transaction data of each blacklist account is obtained to obtain the time-series transaction data set of each blacklist account. The time distribution of transactions is analyzed. For example: if a certain account has ultra-high frequency of fraud on a single day or multiple days close to the current time, the transaction distribution behavior of the account is more distributed near the current time. If an account has been involved in fraudulent behavior long before the current time, but has never committed fraud, it means that the transaction distribution behavior of the account is distributed in large numbers in a certain period of history, and gradually decreases to 0 with the development of time.

[0071] Transaction distribution information is obtained through transaction time distribution analysis, and accounts in different blacklist databases can be clustered according to the transaction distribution information. Thus, cluster analysis results with different fraud behavior characteristics are obtained. The risk of each type of account is relatively similar, so cluster analysis can extract the commonalities of the numerous blacklist accounts in the blacklist database, achieving a technical effect of making account risk assessment more accurate.

[0072] Furthermore, step S700 of the embodiment of the present application further includes:

[0073] Step S740: extracting transaction information from the transaction whitelist database to obtain a set of sequential transaction data of each whitelist account;

[0074] Step S750: performing risk identification on the cluster analysis result and the time series transaction data set of each whitelist account respectively, and obtaining identification data identifying the transaction risk;

[0075] Step S760: The cluster analysis result and the time-series transaction data of each whitelist account are combined as training data, and a recurrent neural network model is trained using the training data and the identification data identifying the transaction risk to obtain the risk assessment model.

[0076] Furthermore, step S760 of the embodiment of the present application further includes:

[0077] Step S761: obtaining an initial hidden layer value of the recurrent neural network, and obtaining a first input weight matrix based on the initial hidden layer value;

[0078] Step S762: using the training data as input layer information respectively, and training the recurrent neural network according to the input layer information and the first input weight matrix;

[0079] Step S763: Use the input layer information and the initial hidden layer value as the next hidden layer value, perform iterative training in sequence, and construct the risk assessment model.

[0080] Specifically, all accounts in the transaction whitelist database are accounts without fraudulent behavior. Through the database query method, the time-series transaction data set of each whitelist account is obtained. The time-series transaction data set can well reflect the transaction behavior characteristics of the whitelist account. The time-series transaction data set of each whitelist account is marked with a risk level of 0 points, or marked as a safety interval such as 0-40 points. Whitelist accounts close to 40 in the safety interval may be caused by some objective reasons, and the user himself has no actual fraudulent behavior, for example: the user's bank card is not activated or the IP address is in a high-incidence area of ​​fraud. Adaptive adjustments can be made according to the specific circumstances of the user, and are not limited here.

[0081] The cluster analysis results are marked with risk levels, and can be marked according to the risk of various types of transaction behaviors. The higher the score, the higher the risk. For example, a person with a history of fraudulent behavior and no recent suspected behavior is marked with 40-60 points; a person with a recent record of fraud is marked with 60-80 points; a person with a high frequency of fraud in a single day / multiple days is marked with 80-100 points. After manual risk marking, identification data for identifying transaction risk is obtained for training the risk assessment model. The cluster analysis results 8 and the time series data sets of each whitelist account are combined as training data, and the recurrent neural network model is trained in combination with the identification data to obtain the risk assessment model.

[0082] The recurrent neural network model includes an input layer, a hidden layer and an output layer. It uses neurons with self-feedback so that the output of the network is not only related to the current input, but also to the output at the previous moment, so it has short-term memory when processing time series data of any length. The initial hidden layer value can be obtained in a customized manner, and the first input weight matrix is ​​obtained based on the initial hidden layer value. During the processing, the current input information and the output information of the previous time series are predicted according to a certain weight ratio, which is the above-mentioned weight matrix, and the weight values ​​in the weight matrix are stable and unchanged during the entire training process.

[0083] The training data is used as the input layer information, and the corresponding identification data identifying the transaction risk is used as the output identification information. The recurrent neural network is trained according to the input layer information and the first input weight matrix, and the input layer of each time and the hidden layer of the previous time are used as the hidden layer of each time. Here, the hidden layer of each time is the hidden layer value of the next time. Through iterative training in sequence, when the output result of the recurrent neural network reaches a certain accuracy or converges, the supervised training is completed and the risk assessment model is constructed. The risk assessment model is used to analyze and evaluate the risk value of each account in the first transaction information, which can make the output transaction risk analysis result more accurate and reasonable, thereby ensuring the accuracy of transaction fraud risk assessment.

[0084] In summary, the intelligent transaction fraud risk assessment method and system provided by the embodiments of the present application have the following technical effects:

[0085] 1. Due to the adoption of the method of collecting information, building information monitoring rules and conducting information monitoring and investigation according to the information monitoring rules, a transaction blacklist database and a transaction whitelist database are obtained; first transaction information is obtained, and transaction association is performed with the transaction blacklist database and the transaction whitelist database based on the first transaction information to obtain a first transaction network; transaction flow analysis is performed according to the first transaction network to obtain account attribute analysis results; a historical transaction record set is collected according to the account attribute analysis results; the historical transaction record set is input into a risk assessment model to obtain a transaction risk analysis result of the first transaction information. The embodiment of the present application provides an intelligent assessment method and system for transaction fraud risk, thereby achieving the technical effect of obtaining a blacklist and a whitelist database by collecting underlying data information, building underlying information monitoring rules, and providing more data support for risk investigation, and performing attribute analysis on the account based on the transaction funds flow combined with the blacklist and whitelist databases, and conducting transaction risk assessment according to the account attributes, thereby improving the accuracy of risk assessment and the ability of transaction monitoring and identification.

[0086] 2. Due to the method of setting transaction nodes, edges and edge weights to form the first transaction network, the transaction process can be displayed intuitively, and the technical effect of improving the efficiency of risk assessment can be achieved by identifying suspicious transaction objects and identifying whitelist transaction objects.

[0087] 3. Since the method of clustering analysis of accounts in different blacklist databases is adopted, cluster analysis results with different fraud behavior characteristics are obtained. The risks of each type of account are relatively similar. Therefore, through cluster analysis, the commonalities of the numerous blacklist accounts in the blacklist database are extracted, making the account risk assessment more accurate.

[0088] Embodiment 2

[0089] Based on the same inventive concept as the intelligent assessment method for transaction fraud risk in the aforementioned embodiment, Figure 4 As shown, an embodiment of the present application provides an intelligent assessment system for transaction fraud risk, wherein the system includes:

[0090] A first collection unit 11, the first collection unit 11 is used to collect bank card information, mobile phone number information and IP address information according to the joint prevention and control platform;

[0091] A first obtaining unit 12, the first obtaining unit 12 is used to obtain information monitoring rules for the bank card information, the mobile phone number information and the IP address information;

[0092] A first construction unit 13, the first construction unit 13 is used to perform information monitoring and investigation according to the bank card information, mobile phone number information and IP address information and the information monitoring rules, and to construct a transaction blacklist database and a transaction whitelist database;

[0093] A second obtaining unit 14, the second obtaining unit 14 is used to obtain first transaction information, and perform transaction association with the transaction blacklist database and the transaction whitelist database based on the first transaction information to obtain a first transaction network;

[0094] A third obtaining unit 15, the third obtaining unit 15 is used to perform transaction flow analysis according to the first transaction network to obtain an account attribute analysis result;

[0095] A second collection unit 16, the second collection unit 16 is used to collect a set of account historical transaction records according to the account attribute analysis result;

[0096] The fourth obtaining unit 17 is used to input the account historical transaction record set into the risk assessment model to obtain the transaction risk analysis result of the first transaction information.

[0097] Furthermore, the system comprises:

[0098] a fifth obtaining unit, configured to extract a transaction object based on the first transaction information to obtain a first transaction object and a second transaction object;

[0099] A sixth obtaining unit, the sixth obtaining unit is used to perform traversal search in the transaction blacklist database and the transaction whitelist database based on the first transaction object and the second transaction object to obtain a transaction abnormal object set and a transaction normal object set;

[0100] a seventh obtaining unit, the seventh obtaining unit being configured to label the first transaction object and the second transaction object based on the abnormal transaction object set and the normal transaction object set to obtain a first labeled transaction object set;

[0101] An eighth obtaining unit is used to perform transaction concatenation according to the first identified transaction object set and transaction time to obtain the first transaction network.

[0102] Furthermore, the system comprises:

[0103] a ninth obtaining unit, configured to obtain a transaction node of the first transaction network according to the first identified transaction object set;

[0104] a second construction unit, the second construction unit being used to connect the transaction nodes for transaction in series according to transaction time to construct edges of the first transaction network;

[0105] a first execution unit, the first execution unit being configured to obtain transaction amount information according to the first transaction information, and to use the transaction amount information of each edge as the weight of the edge;

[0106] A tenth obtaining unit, the tenth obtaining unit is used to obtain the first trading network according to the trading nodes of the first trading network, the edges of the first trading network, and the weights of the edges.

[0107] Furthermore, the system comprises:

[0108] an eleventh obtaining unit, the eleventh obtaining unit being used to perform transaction flow analysis according to the first transaction network to obtain first position information, wherein the first position information is relative position information between funds and the set of transaction abnormal objects;

[0109] a twelfth obtaining unit, the twelfth obtaining unit being configured to obtain a fund attribute analysis result according to the first location information;

[0110] a thirteenth obtaining unit, the thirteenth obtaining unit being used to perform transaction amount analysis and transaction frequency analysis according to the fund attribute analysis result, and obtain a transaction amount analysis result and a transaction frequency analysis result;

[0111] A fourteenth obtaining unit is used to perform transaction behavior feature analysis on the transaction abnormality object set based on the transaction amount analysis result and the transaction frequency analysis result to obtain the account attribute analysis result.

[0112] Furthermore, the system comprises:

[0113] a fifteenth obtaining unit, the fifteenth obtaining unit being used to extract transaction information according to the transaction blacklist database to obtain a set of time-series transaction data of each blacklist account;

[0114] a sixteenth obtaining unit, the sixteenth obtaining unit being used to perform transaction time distribution analysis according to the time-series transaction data set of each blacklist account to obtain transaction distribution information;

[0115] A seventeenth obtaining unit is used to perform cluster analysis on each blacklist account based on the transaction distribution information to obtain a cluster analysis result.

[0116] Furthermore, the system comprises:

[0117] An eighteenth obtaining unit, the eighteenth obtaining unit is used to extract transaction information according to the transaction whitelist database to obtain a set of time-series transaction data of each whitelist account;

[0118] A nineteenth obtaining unit, the nineteenth obtaining unit is used to respectively identify the risk of the cluster analysis result and the time-series transaction data set of each whitelist account, and obtain identification data identifying the transaction risk;

[0119] The twentieth obtaining unit is used to combine the cluster analysis results and the time-series transaction data of each whitelist account as training data, and use the training data and the identification data identifying the transaction risk to train a recurrent neural network model to obtain the risk assessment model.

[0120] Furthermore, the system comprises:

[0121] a twenty-first obtaining unit, the twenty-first obtaining unit being used to obtain an initial hidden layer value of the recurrent neural network, and to obtain a first input weight matrix based on the initial hidden layer value;

[0122] A second execution unit, the second execution unit is used to use the training data as input layer information respectively, and train the recurrent neural network according to the input layer information and the first input weight matrix;

[0123] The third construction unit is used to use the input layer information and the initial hidden layer value as the next hidden layer value, perform iterative training in sequence, and construct the risk assessment model.

[0124] Exemplary Electronic Devices

[0125] Reference below Figure 5 To describe the electronic device of the embodiment of the present application.

[0126] Based on the same inventive concept as the intelligent assessment method for transaction fraud risk in the aforementioned embodiment, an embodiment of the present application also provides an intelligent assessment system for transaction fraud risk, including: a processor, the processor is coupled to a memory, the memory is used to store a program, when the program is executed by the processor, the system executes any one of the methods described in the first aspect.

[0127] The electronic device 300 includes: a processor 302, a communication interface 303, and a memory 301. Optionally, the electronic device 300 may also include a bus architecture 304. The communication interface 303, the processor 302, and the memory 301 may be interconnected via the bus architecture 304; the bus architecture 304 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus architecture 304 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0128] The processor 302 may be a CPU, a microprocessor, an ASIC, or one or more integrated circuits for controlling the execution of the program of the present application.

[0129] The communication interface 303 uses any transceiver-like system for communicating with other devices or communication networks, such as Ethernet, radio access network (RAN), wireless local area networks (WLAN), wired access networks, etc.

[0130] The memory 301 may be a ROM or other type of static storage device that can store static information and instructions, a RAM or other type of dynamic storage device that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory may exist independently and be connected to the processor via the bus architecture 304. The memory may also be integrated with the processor.

[0131] The memory 301 is used to store computer-executable instructions for executing the solution of the present application, and the execution is controlled by the processor 302. The processor 302 is used to execute the computer-executable instructions stored in the memory 301, thereby realizing an intelligent assessment method for transaction fraud risk provided in the above embodiment of the present application.

[0132] Optionally, the computer-executable instructions in the embodiments of the present application may also be referred to as application code, which is not specifically limited in the embodiments of the present application.

[0133] An embodiment of the present application provides an intelligent assessment method for transaction fraud risk, wherein the method includes: collecting information, constructing information monitoring rules, and performing information monitoring and investigation according to the information monitoring rules, so as to obtain a transaction blacklist database and a transaction whitelist database; obtaining first transaction information, and performing transaction association with the transaction blacklist database and the transaction whitelist database based on the first transaction information to obtain a first transaction network; performing transaction flow analysis based on the first transaction network to obtain account attribute analysis results; collecting a set of historical transaction records based on the account attribute analysis results; and inputting the set of historical transaction records into a risk assessment model to obtain a transaction risk analysis result of the first transaction information.

[0134] Those of ordinary skill in the art will appreciate that the various digital numbers such as the first and second involved in the present application are only for the convenience of description, and are not used to limit the scope of the embodiments of the present application, nor do they represent the order of precedence. "And / or" describes the association relationship of the associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are in an "or" relationship. "At least one" refers to one or more. At least two refers to two or more. "At least one", "any one" or similar expressions refer to any combination of these items, including any combination of single items (individuals) or plural items (individuals). For example, at least one item (individual, kind) of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0135] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable systems. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server, data center, etc. that includes one or more available media integrated. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.

[0136] The various illustrative logic units and circuits described in the embodiments of the present application can be implemented or operated by a general-purpose processor, a digital signal processor, an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic system, a discrete gate or transistor logic, a discrete hardware component, or the design of any combination of the above functions. The general-purpose processor can be a microprocessor, and optionally, the general-purpose processor can also be any traditional processor, controller, microcontroller or state machine. The processor can also be implemented by a combination of a computing system, such as a digital signal processor and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a digital signal processor core, or any other similar configuration to implement.

[0137] The steps of the method or algorithm described in the embodiments of the present application can be directly embedded in hardware, a software unit executed by a processor, or a combination of the two. The software unit can be stored in a RAM memory, a flash memory, a ROM memory, an EPROM memory, an EEPROM memory, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium in the art. Exemplarily, the storage medium can be connected to the processor so that the processor can read information from the storage medium and can write information to the storage medium. Optionally, the storage medium can also be integrated into the processor. The processor and the storage medium can be arranged in an ASIC, and the ASIC can be arranged in a terminal. Optionally, the processor and the storage medium can also be arranged in different components in the terminal. These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are performed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0138] Although the present application has been described in conjunction with specific features and embodiments thereof, it is apparent that various modifications and combinations may be made thereto without departing from the spirit and scope of the present application. Accordingly, this specification and the accompanying drawings are merely exemplary illustrations of the present application as defined herein, and are deemed to have covered any and all modifications, variations, combinations or equivalents within the scope of the present application. Obviously, a person skilled in the art may make various modifications and variations to the present application without departing from the scope of the present application. Thus, the present application is intended to include such modifications and variations if such modifications and variations fall within the scope of the present application and its equivalents.

Claims

1. An intelligent assessment method for transaction fraud risk, characterized in that: The method is applied to an intelligent assessment system for transaction fraud risk, the system is communicatively connected with a joint prevention and control platform, and the method includes: Collect bank card information, mobile phone number information and IP address information according to the joint prevention and control platform; Obtain information monitoring rules for the bank card information, the mobile phone number information, and the IP address information; Perform information monitoring and investigation based on the bank card information, mobile phone number information, IP address information and the information monitoring rules, and build a transaction blacklist database and a transaction whitelist database; Obtaining first transaction information, and performing transaction association with the transaction blacklist database and the transaction whitelist database based on the first transaction information to obtain a first transaction network; Perform transaction flow analysis based on the first transaction network to obtain account attribute analysis results; Collecting a set of historical transaction records of the account according to the account attribute analysis result; Inputting the account historical transaction record set into a risk assessment model to obtain a transaction risk analysis result of the first transaction information; The method further comprises: Extracting a transaction object based on the first transaction information to obtain a first transaction object and a second transaction object; Based on the first transaction object and the second transaction object, a traversal search is performed in the transaction blacklist database and the transaction whitelist database to obtain a transaction abnormal object set and a transaction normal object set; Based on the abnormal transaction object set and the normal transaction object set, label the first transaction object and the second transaction object to obtain a first labeled transaction object set; According to the first identified transaction object set, transactions are connected in series according to transaction time to obtain the first transaction network; Obtaining a transaction node of the first transaction network according to the first identified transaction object set; Connecting the transaction nodes for transactions in series according to transaction time to construct edges of the first transaction network; Obtaining transaction amount information according to the first transaction information, and taking the transaction amount information of each edge as the weight of the edge; Obtaining the first trading network according to the trading nodes of the first trading network, the edges of the first trading network, and the weights of the edges; Performing transaction flow analysis according to the first transaction network to obtain first position information, where the first position information is relative position information between the funds and the set of transaction abnormal objects; Obtaining a fund attribute analysis result according to the first location information; Performing transaction amount analysis and transaction frequency analysis according to the fund attribute analysis results to obtain transaction amount analysis results and transaction frequency analysis results; Based on the transaction amount analysis result and the transaction frequency analysis result, transaction behavior characteristics analysis is performed on the transaction abnormality object set to obtain the account attribute analysis result.

2. The method according to claim 1, characterized in that The method comprises: Extracting transaction information from the transaction blacklist database to obtain a set of time-series transaction data for each blacklist account; Perform transaction time distribution analysis based on the time-series transaction data set of each blacklist account to obtain transaction distribution information; A cluster analysis is performed on each of the blacklist accounts based on the transaction distribution information to obtain a cluster analysis result.

3. The method according to claim 2, characterized in that The method comprises: Extracting transaction information from the transaction whitelist database to obtain a set of time-series transaction data for each whitelist account; Perform risk identification on the cluster analysis results and the time-series transaction data sets of each whitelist account respectively to obtain identification data identifying the transaction risk; The cluster analysis results and the time-series transaction data of each whitelist account are combined as training data, and a recurrent neural network model is trained using the training data and the identification data identifying the transaction risk to obtain the risk assessment model.

4. The method according to claim 3, characterized in that The method comprises: Obtaining initial hidden layer values ​​of the recurrent neural network, and obtaining a first input weight matrix based on the initial hidden layer values; Using the training data as input layer information respectively, and training the recurrent neural network according to the input layer information and the first input weight matrix; The input layer information and the initial hidden layer value are used as the next hidden layer value, and the training is iterated in sequence to construct the risk assessment model.

5. An intelligent assessment system for transaction fraud risk, characterized in that: A method for intelligently assessing transaction fraud risk according to any one of claims 1 to 4, the system comprising: A first collection unit, the first collection unit is used to collect bank card information, mobile phone number information and IP address information according to the joint prevention and control platform; A first obtaining unit, the first obtaining unit is used to obtain information monitoring rules for the bank card information, the mobile phone number information and the IP address information; A first construction unit, the first construction unit is used to perform information monitoring and investigation according to the bank card information, mobile phone number information, IP address information and the information monitoring rules, and to construct a transaction blacklist database and a transaction whitelist database; a second obtaining unit, the second obtaining unit being configured to obtain first transaction information, and to perform transaction association with the transaction blacklist database and the transaction whitelist database based on the first transaction information to obtain a first transaction network; a third obtaining unit, the third obtaining unit being used to perform transaction flow analysis according to the first transaction network to obtain an account attribute analysis result; A second collection unit, the second collection unit is used to collect a set of historical transaction records of the account according to the account attribute analysis result; A fourth obtaining unit is used to input the account historical transaction record set into a risk assessment model to obtain a transaction risk analysis result of the first transaction information.

6. An intelligent assessment system for transaction fraud risk, comprising: A processor, wherein the processor is coupled to a memory, wherein the memory is used to store a program, and when the program is executed by the processor, the system is enabled to execute the method according to any one of claims 1 to 4.

Images