Data processing method, device, electronic device and computer readable storage medium

Abstract

This invention discloses a data processing method, apparatus, electronic device, and computer-readable storage medium. The method includes: collecting historical transaction data and attribute data of a first target object; extracting transaction features of the first target object based on the historical transaction data and attribute data; obtaining current transaction data of a second target object, wherein the current transaction data corresponds to the transaction data of the second target object currently pending payment; and predicting the probability that the current transaction data of the second target object is abnormal based on the transaction features of the first target object, thereby obtaining the probability that the current transaction data of the second target object is abnormal. This invention solves the technical problem in related technologies of the difficulty in judging and intercepting abnormal transactions being performed by a target object.

Description

Technical Field

[0001] The present invention relates to the field of computers, and in particular to a data processing method, device, electronic device and computer-readable storage medium. Background Art

[0002] With the rapid development of Internet mobile payment, the problem of safe payment has become more frequent and serious. The problem of safe payment is not limited to simple problems such as routine password cracking and Trojan virus infection. Complex frauds such as wrong payment by scanning code are more frequent. When users make payment operations, it is difficult to determine whether it is the owner of the machine who is making the operation, and it is difficult to determine whether the current transaction has risks, so as to intercept them in time.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present invention provide a data processing method, device, electronic device and computer-readable storage medium to at least solve the technical problem in the related art that it is difficult to judge abnormalities in transaction operations being performed by a target object and intercept them.

[0005] According to one aspect of an embodiment of the present invention, there is provided a data processing method, comprising: collecting historical transaction data and attribute data of a first target object; extracting transaction features of the first target object based on the historical transaction data and attribute data of the first target object; obtaining current transaction data of a second target object, wherein the current transaction data is transaction data corresponding to a transaction currently to be paid by the second target object; and predicting a probability that the current transaction data of the second target object is abnormal transaction data based on the transaction features of the first target object, to obtain a probability that the current transaction data of the second target object is abnormal transaction data.

[0006] Optionally, extracting transaction features of the first target object based on historical transaction data and attribute data of the first target object includes: determining transaction categories of the historical transaction data, and storing the historical transaction data in corresponding transaction categories respectively; extracting a predetermined number of transaction categories according to predetermined rules; extracting transaction features of the first target object based on the predetermined number of transaction categories and the attribute data.

[0007] Optionally, determining the transaction category of the historical transaction data and storing the historical transaction data in corresponding transaction categories respectively include: extracting the transaction amount of the historical transaction data and the transfer account name of the historical transaction data; assigning corresponding weights to the historical transaction data based on the transaction amount of the historical transaction data; determining the transaction category of the historical transaction data based on the transfer account name of the historical transaction data, and storing the historical transaction data assigned with corresponding weights in corresponding transaction categories respectively.

[0008] Optionally, predicting the probability that the current transaction data of the second target object is abnormal transaction data based on the transaction characteristics of the first target object to obtain the probability that the current transaction data of the second target object is abnormal transaction data includes: obtaining the transaction amount of the current transaction data of the second target object, and the transfer-in account name of the current transaction data of the second target object; predicting the probability that the current transaction data of the second target object is abnormal transaction data based on the transaction characteristics of the first target object, the transaction amount of the current transaction data of the second target object, and the transfer-in account name of the current transaction data of the second target object to obtain the probability that the current transaction data of the second target object is abnormal transaction data.

[0009] Optionally, the predicting the probability that the current transaction data of the second target object is abnormal transaction data based on the transaction characteristics of the first target object to obtain the probability that the current transaction data of the second target object is abnormal transaction data includes: inputting the transaction characteristics of the first target object into a transaction security model, predicting the probability that the current transaction data of the second target object is abnormal transaction data, and obtaining the probability that the current transaction data of the second target object is abnormal transaction data, wherein the transaction security model is obtained by training an initial model with a sample set, the sample set includes a positive sample set and a negative sample set, the positive sample set includes: multiple groups of normal transaction data, and the negative sample set includes: multiple groups of abnormal transaction data.

[0010] Optionally, after predicting the probability that the current transaction data of the second target object is abnormal transaction data based on the transaction characteristics of the first target object and obtaining the probability that the current transaction data of the second target object is abnormal transaction data, the method further includes at least one of the following: when the probability that the current transaction data of the second target object is abnormal transaction data is less than a first predetermined threshold, reminding the second target object that there is a risk in the current transaction to be paid; when the probability that the current transaction data of the second target object is abnormal transaction data is less than a second predetermined threshold but greater than or equal to the first predetermined threshold, using payment verification when the second target object pays the current transaction to be paid; when the probability that the current transaction data of the second target object is abnormal transaction data is greater than or equal to the second predetermined threshold, prohibiting the second target object from paying the current transaction to be paid.

[0011] According to one aspect of an embodiment of the present invention, there is provided a data processing device, comprising: a collection module for collecting historical transaction data and attribute data of a first target object; an extraction module for extracting transaction features of the first target object based on the historical transaction data and attribute data of the first target object; an acquisition module for acquiring current transaction data of a second target object, wherein the current transaction data is transaction data corresponding to a transaction currently to be paid by the second target object; and a prediction module for predicting a probability that the current transaction data of the second target object is abnormal transaction data based on the transaction features of the first target object, so as to obtain a probability that the current transaction data of the second target object is abnormal transaction data.

[0012] According to one aspect of an embodiment of the present invention, there is provided an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions to implement any of the above-mentioned data processing methods.

[0013] According to one aspect of an embodiment of the present invention, a computer-readable storage medium is provided. When instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute any of the above-mentioned data processing methods.

[0014] According to one aspect of an embodiment of the present invention, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the computer program implements any of the above-mentioned data processing methods.

[0015] In the embodiment of the present invention, the historical transaction data and attribute data of the first target object are collected, and the transaction features of the first target object are extracted based on the historical transaction data and attribute data of the first target object, and then the probability of abnormal transaction can be predicted for the transaction data corresponding to the current transaction to be paid by the second target object based on the transaction features, and the probability that the current transaction data of the second target object is abnormal transaction data is obtained. Because the abnormal prediction is made based on the transaction features of the first target object, and the transaction features are obtained based on the historical transaction data and attribute data of the first target object, it is more targeted and can better reflect the characteristics of the first target object, ensuring that the abnormal prediction can be made in a timely and accurate manner, thereby solving the technical problem in the related art that it is difficult to make abnormal judgments on the transaction operations being performed by the target object and intercept them. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0017] Figure 1 is a flow chart of a data processing method according to an embodiment of the present invention;

[0018] Figure 2 is a schematic diagram of user features provided by an optional implementation manner of the present invention;

[0019] Figure 3 It is a schematic diagram of four core functional modules in the anti-abnormal transaction model provided by an optional implementation mode of the present invention;

[0020] Figure 4 is a structural block diagram of a data processing device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0022] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0023] Example 1

[0024] According to an embodiment of the present invention, an embodiment of a data processing method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0025] Figure 1 is a flow chart of a data processing method according to an embodiment of the present invention. Figure 1 As shown, the method comprises the following steps:

[0026] Step S102, collecting historical transaction data and attribute data of the first target object;

[0027] Step S104, extracting transaction features of the first target object based on the historical transaction data and attribute data of the first target object;

[0028] Step S106, obtaining current transaction data of the second target object, wherein the current transaction data is transaction data corresponding to the transaction currently to be paid by the second target object;

[0029] Step S108, predicting the probability that the current transaction data of the second target object is abnormal transaction data based on the transaction characteristics of the first target object, and obtaining the probability that the current transaction data of the second target object is abnormal transaction data.

[0030] Through the above steps, the historical transaction data and attribute data of the first target object are collected, and the transaction features of the first target object are extracted based on the historical transaction data and attribute data of the first target object, and then the probability of abnormal transaction can be predicted for the transaction data corresponding to the current transaction to be paid by the second target object based on the transaction features, and the probability that the current transaction data of the second target object is abnormal transaction data is obtained. Because the abnormal prediction is based on the transaction features of the first target object, and the transaction features are obtained based on the historical transaction data and attribute data of the first target object, it is more targeted and can better reflect the characteristics of the first target object, ensuring that the abnormal prediction can be made in a timely and accurate manner, thereby solving the technical problem in the related technology that it is difficult to make abnormal judgments on the transaction operations being performed by the target object and intercept them.

[0031] First of all, it should be noted that the first target object is the owner of the terminal device, and the second target object is the user who performs transaction operations on the terminal device. Because there may be situations such as unauthorized payment, the user is not necessarily the owner of the terminal device, that is, the second target object may not be the first target object. When predicting the probability that the current transaction data of the second target object is abnormal transaction data, this factor will also be considered to predict whether the current transaction data is abnormal transaction data. The historical transaction data may include the consumption data, income data, asset data, behavior data, etc. of the owner of the terminal device, that is, the first target object. The attribute data may include the basic information of the owner of the terminal device, that is, the first target object, such as age, occupation, natural person relationship, education level, place of residence, etc. The transaction features are multiple features that can be obtained based on the historical transaction data of the first target object and the attribute data. In order to better describe, the multiple features can also be factual features, primary features, and advanced features. Among them, the factual features are those that can be directly obtained from the above historical transaction data and attribute data, such as the number of complaints and purchase frequency features. Primary features are obtained by further analysis based on factual features, such as product preference features, shopping interest features, etc. Advanced features are obtained by further summarizing primary features, such as consumption capacity features, crowd attribute features, etc. Features at different levels can play different roles. For example, factual features can reflect the actual behavior of the first target object to a large extent. Preliminary features summarize the behavior of the first target object and can better predict the transaction risk of the first target object based on the features. Advanced features can make it possible to predict transaction risks without deviating from this large range. Therefore, by setting multiple features, the behavior of the first target object can be reflected in a larger range and in multiple dimensions, ensuring the accuracy of the prediction on the basis of targeted prediction based on the first target object.

[0032] As an optional embodiment, historical transaction data and attribute data of the first target object are collected. The historical transaction data and attribute data of the first target object can be collected through various channels, for example, automatically obtained based on the behavior log, network log, etc. of the first target object when the first target object is authorized. By collecting the historical transaction data and attribute data of the first target object, the characteristics of the first target object can be described for the target object for personalized settings.

[0033] As an optional embodiment, the transaction features of the first target object are extracted based on the historical transaction data and attribute data of the first target object. The transaction features of the first target object are extracted not only based on the dynamic historical transaction data of the first target object, but also based on the static attribute data of the first target object. This ensures that the transaction features of the first target object are extracted in all aspects and in multiple dimensions, making the extracted transaction features of the first target object more accurate.

[0034] As an optional embodiment, when extracting the transaction features of the first target object based on the historical transaction data and attribute data of the first target object, multiple methods can be used. For example, the transaction categories of the historical transaction data can be determined, and the historical transaction data can be stored in corresponding transaction categories respectively, and then a predetermined number of transaction categories can be extracted according to a predetermined rule, and then the transaction features of the first target object can be extracted based on the predetermined number of transaction categories and attribute data. Through the above steps, the historical transaction data can be classified first, so that more accurate transaction features can be extracted based on the classified historical transaction data.

[0035] Among them, when determining the transaction category of historical transaction data, it can be classified in a variety of ways. For example, consumption data can be extracted from historical transaction data, and expenditures can be classified in detail. Expenditure is subdivided into investment and financial management, credit card loan repayment, third-party payment, learning and improvement, online and offline entertainment, online shopping supermarkets, catering takeout, rent, house purchase mortgage, decoration, living payment, communication Internet access, transportation and tourism, medical fitness, public welfare red envelopes, etc. The above categories can be used as transaction categories. However, when the number of transaction categories is too large, it is not conducive to the extraction of transaction features. Therefore, the number of transaction categories can be set, for example, greater than or equal to 5 and less than 10. Therefore, the above-mentioned multiple categories can be combined and classified into living payment, medical fitness, catering takeout, online shopping supermarkets, and others, a total of 5 categories. That is, a predetermined number of transaction categories are selected to extract better transaction features.

[0036] It should be noted that when selecting a predetermined number of transaction categories as mentioned above, the selection can also be made according to predetermined rules. For example, the consumption data in the historical transaction data can be first subdivided as mentioned above, and then the 5 to 10 categories with the largest consumption amounts can be extracted as transaction categories. Alternatively, the consumption frequency and the consumption amount can be comprehensively selected. Alternatively, transaction categories can be formulated based on experience. No settings are made here. Custom settings can be made according to actual applications and scenarios to better meet the needs of the scenarios and achieve more accurate feature extraction in specific scenarios.

[0037] As an optional embodiment, after determining the transaction category, the historical transaction data should be stored in the corresponding transaction category. At this time, the following method can be used to operate: extract the transaction amount of the historical transaction data and the transfer account name of the historical transaction data, and assign corresponding weights to the historical transaction data according to the transaction amount of the historical transaction data. A higher weight can be set for a large amount, and a smaller weight can be set for a small amount. The weight can be set according to the actual application, so that the historical transaction data stored in the transaction category is weighted and more in line with real life. Then, based on the transfer account name of the historical transaction data, the transaction category of the historical transaction data is determined, and the historical transaction data with corresponding weights are respectively stored in the corresponding transaction category. The historical transaction data in each transaction category has different weights, and more accurate transaction features can be extracted based on different weights.

[0038] It should be noted that when the historical transaction data with corresponding weights are stored in the corresponding transaction categories, the weight values ​​of the transaction categories can also be set, that is, not only the historical transaction data has weight values, but also the transaction categories can be set with weight values. Different transaction categories can also have certain weights. For example, the impact of using 300 yuan for a lunch and 1,000 yuan for a training course is different. Therefore, setting different weights is more conducive to feature extraction and judgment of abnormal transactions.

[0039] As an optional embodiment, based on the transaction characteristics, the probability that the current transaction data of the second target object is abnormal transaction data is predicted. When the probability that the current transaction data of the second target object is abnormal transaction data is obtained, the following method can be used: obtain the transaction amount of the current transaction data of the second target object, and the transfer account name of the current transaction data of the second target object, and predict the probability that the current transaction data of the second target object is abnormal transaction data based on the transaction characteristics of the first target object, the transaction amount of the current transaction data of the second target object, and the transfer account name of the current transaction data of the second target object. The probability of abnormal transaction data is obtained. The current transaction data of the second target object is abnormal transaction data. Simply put, based on the behavioral habits of the first target object, the current transaction is compared with the historical transaction to determine whether the second target object is the first target object and whether the current transaction of the second target object is abnormal. Optionally, in the process of calculating the probability, the machine learning gradient descent algorithm GBDT, light GBM algorithm, and XGBoost algorithm can be used for calculation and probability prediction. Make the calculated probability more accurate and credible.

[0040] As an optional embodiment, based on the transaction features, the probability that the current transaction data of the second target object is abnormal transaction data is predicted. When the probability that the current transaction data of the second target object is abnormal transaction data is obtained, the transaction features can be input into the transaction security model to predict the probability that the current transaction data of the second target object is abnormal transaction data, and the probability that the current transaction data of the second target object is abnormal transaction data is obtained, wherein the transaction security model is obtained by training the initial model using a sample set, and the sample set includes a positive sample set and a negative sample set, and the positive sample set includes: multiple groups of normal transaction data, and the negative sample set includes: multiple groups of abnormal transaction data. Because the transaction security model is continuously trained by positive and negative sample sets, the accuracy of the prediction can be guaranteed. The transaction security model mentioned in this optional embodiment is not introduced in detail here, and in the following optional implementation mode, it is introduced in detail as an anti-abnormal transaction model.

[0041] As an optional embodiment, multiple thresholds can be set for the probability, and multiple different processing methods can be used. Specifically, when the probability is less than the first predetermined threshold, that is, the possibility that the second target object is not the first target object is low, and / or the risk of the current transaction is low. In this case, the first target object is reminded that the current transaction to be paid has risks, and the first target object is reminded to further determine the payment operation, or confirm whether it is its own payment operation. When the probability is less than the second predetermined threshold and greater than or equal to the first predetermined threshold, that is, the possibility that the second target object is not the first target object is medium, and / or the risk of the current transaction is medium, payment verification is used when the second target object pays the current transaction to be paid; the payment verification method can include a single method or multiple combined authentication methods such as face three-dimensional recognition, fingerprint recognition, voice recognition, signature recognition, password, U shield, electronic password device, SMS verification code, reserved questions, etc. When using the payment verification method, the above-mentioned multiple payment verification methods can be displayed in the form of microservices, and combined verification can be performed, which is scalable, that is, the verification method can be added and adjusted to delete, without affecting the service implementation of other authentication methods, and without adding additional workload, so that it can adapt to the needs of various scenarios and businesses. When the probability is greater than or equal to a second predetermined threshold, that is, the possibility that the second target object is not the first target object is high, and / or the risk of the current transaction is high, the second target object is prohibited from paying the current transaction to be paid, and a security reminder mode in the form of SMS or phone call is performed to protect the property safety of the owner in various ways and under different circumstances.

[0042] Based on the above embodiments and optional embodiments, an optional implementation is provided, which is described in detail below.

[0043] The optional implementation of the present invention proposes a method for providing security services based on artificial intelligence to establish a user portrait model. The user mentioned in the optional implementation of the present invention corresponds to the first target object mentioned above. When judging whether it is an abnormal transaction based on the current transaction data, the user mentioned in this part corresponds to the second target object mentioned above, and there will be a situation where the second target object is verified to be the first target object.

[0044] An optional implementation manner of the present invention performs multi-dimensional identification and analysis through the user's historical transaction data and attribute data, etc., so as to better obtain the user's characteristics and accurately extract the user's transaction characteristics. By establishing an adaptive dynamic two-layer anti-abnormal transaction identification model that changes according to the time dimension, personalized consumer safety services can be customized to better provide users with personalized security services, efficiently identify and intercept suspicious transactions, and achieve safety, reliability, ease of use and convenience in the payment field.

[0045] Build user portraits, that is, extract user transaction features:

[0046] The construction of user portraits is based on historical transaction data, such as historical transaction information and user-common operation functions. Transaction data is processed through corpus artificial intelligence, and supervised learning of machine learning is used to classify consumption and extract data feature values. Through artificial intelligence, an adaptive dynamic two-layer user portrait that changes over time is established. User feature values ​​with relatively strong correlation are selected to customize personalized consumer safety services.

[0047] The core work of user portrait is to extract user characteristics. Figure 2 is a schematic diagram of user characteristics provided by an optional implementation mode of the present invention, such as Figure 2 As shown in the figure, the user's characteristics can be displayed in the form of tags, which can be understood as highly refined feature identifiers specified by humans. Each tag describes a dimension of the user, and the dimensions are interconnected to form an overall description of the user. It can abstract the overall information of a user, that is, extract the user's transaction characteristics, which is equivalent to constructing a user profile.

[0048] It should be noted that when building labels, the granularity of the labels should not be too fine. Too fine granularity will lead to a label system that is too complex and not universal, and the label system changes with the development of the business. Therefore, labels can be hierarchical to build labels of different levels.

[0049] In an optional implementation of the present invention, the user is labeled by extracting the user's historical transaction data and attribute data. The general steps for labeling the user are as follows:

[0050] S1, collect the user's attribute data, where the attribute data includes the user's age, occupation, income, housing, car, natural person relationship, etc.

[0051] S2, collects historical transaction data of users, including: assets, investments, transaction information, user's commonly used operation functions, etc.

[0052] S3, extracting and cleaning the user historical transaction data and attribute data collected above.

[0053] S4, extracting the user's transaction features from the above extracted and cleaned data.

[0054] It should be noted that when extracting the transaction characteristics of users, the KNN (K-NearestNeighbor) algorithm can be used to intelligently analyze the user's income and expenditure, and extract the user's expenditure and income characteristics, and then use the artificial intelligence BP (back propagation, a multi-layer feedforward neural network according to the error back propagation algorithm) neural network algorithm to extract the user's transaction characteristics. Among them, it is not limited to the use of the BP neural network algorithm, and user portraits can also be constructed through models such as neural network CNN (Convolutional Neural Networks) and recurrent neural network RNN ​​(Recurrent Neural Networks).

[0055] It should also be noted that there are various transaction characteristics that can be extracted from the above data in the optional implementation mode of the present invention, such as: demographic characteristics: gender, age, region, education level, date of birth, occupation, zodiac sign; interest characteristics: interests and hobbies, use of apps / websites, browsing / collecting content, interactive content, brand preferences, product preferences; social characteristics: marital status, family situation, social / information channel preferences; consumption characteristics: income status, purchasing power level, purchased goods, purchase channel preferences, last purchase time, purchase frequency.

[0056] Because many features can be extracted from the above data, taking into account the amount of calculation, business needs, and the difficulty of construction, an optional implementation method of the present invention proposes a method of constructing priorities for various features. Figure 3 is a schematic diagram of a priority sorting method provided by an optional embodiment of the present invention, such as Figure 3 As shown in the figure, the construction is mainly based on the difficulty of construction and the dependency relationship of various features. Different levels of features can be selected to predict abnormal transactions based on the actual application scenarios and needs.

[0057] Taking consumption characteristics as an example, the data is based on users as the dimension. Sparse matrices and the graph database node4j are combined to establish branches according to consumption types to store consumption type characteristic values. The diagonal of the sparse matrix represents the characteristic value weight, which is encoded in a one-hot (unique hot code) manner. The consumption type sparse matrix stores the total amount according to the consumption type. The graph database node4j storage branch records each consumption record according to the consumption type. The cumulative result of the characteristic value weight calculation is stored on the diagonal of the sparse matrix, which describes the user characteristics, builds a user portrait, and simplifies and improves efficiency. This form can reduce update calculations, thereby speeding up calculations, and if new consumption characteristics are discovered through machine learning and deep learning, it is convenient to update without having to recalculate all of them. The following is an example:

[0058] S1, determining the transaction category of the user's historical transaction data, and storing the historical transaction data into corresponding transaction categories respectively;

[0059] For example, consumption data is extracted from historical transaction data, and expenditures are classified in detail. Expenditure is subdivided into investment and financial management, credit card loan repayment, third-party payment, learning and improvement, online and offline entertainment, online shopping, catering and takeaway, rent, mortgage, decoration, living expenses, communication and Internet access, transportation and tourism, medical and fitness, charity red envelopes, etc. To extract consumption-related services, the K value represents the classification represented by the consumption record. Among them, the selection of the K value has been verified that the number is not suitable for too many, and the k value is greater than or equal to 5 and less than or equal to 10. Therefore, it is combined and classified into living expenses, medical and fitness, catering and takeaway, online shopping, and others, a total of 5 categories, that is, K = 5.

[0060] For example, a user's monthly consumption data is as follows: Consumption, totaling 4,628 yuan. A-APP-takeaway 205 yuan; B-APP-takeaway 104 yuan; C-APP-transportation card recharge 100 yuan; D card-medical 90 yuan; B-APP-F supermarket 58 yuan; B-APP-G supermarket 276 yuan...

[0061] Through supervised machine learning of text, big data artificial intelligence automatically divides the above consumption data into the above K types of transaction categories, and stores the consumption data in the corresponding transaction categories respectively.

[0062] 1. Online shopping at supermarkets 58+276+… totaling 2,617 yuan. B-APP-F supermarket 58 yuan; B-APP-G supermarket 276 yuan…

[0063] 2. Catering takeaway 205+104+…Total 1516 yuan. A-APP-takeaway 205 yuan; B-APP-takeaway 104 yuan…

[0064] 3. Living expenses of 100 yuan, totaling 100 yuan. C-APP – Transportation card recharge of 100 yuan.

[0065] 4. Medical and fitness 90 yuan, a total of 90 yuan. D card - medical 90 yuan.

[0066] 5. Others totaling RMB 305.

[0067] When the above-mentioned big data artificial intelligence automatically divides the above-mentioned consumption data into transaction categories, intelligent judgment can be made based on the transfer account name.

[0068] For example, several transaction data of a user are as follows:

[0069] The transfer account 203120277484154XXXXXX is the account of this user.

[0070] The account transferred to 145XXXXXXXXXXXXXXX is the account of a catering delivery agency.

[0071] The transfer amount is 205 yuan.

[0072] The above consumption data is stored in the graph database node4j. According to the category of the transferred account, it is intelligently divided into catering takeaway and added to the transaction category - catering takeaway. The corresponding weight is set according to the transfer amount, and the values ​​of node4j and sparse matrix are updated.

[0073] It should also be noted that K=5 has been set. For the above classification, when the following consumption data are added to the user's account details:

[0074] The transfer account 203120277484154XXXXXX is the account of this user.

[0075] The account transferred to 175XXXXXXXXXXXXXXX is the Children's Paradise account.

[0076] The transfer amount is 1999 yuan.

[0077] The transfer account 203120277484154XXXXXXX is the account of this user.

[0078] The account transferred to is 158XXXXXXXXXXXXXXX which is the children's clothing account.

[0079] The transfer amount is 324 yuan.

[0080] The above consumption data is stored in the graph database node4j. According to the category of the transferred account, it is intelligently divided into childcare expenses, intelligently judged that the account has children, and the transaction category - childcare is added. The corresponding weight is set according to the transfer amount, and the values ​​of node4j and sparse matrix are updated to avoid repeated calculation of data, so that K can be automatically updated.

[0081] S2, extracting transaction features of the first target object based on the consumption data and attribute data in the transaction category.

[0082] A kmeans (K-means clustering algorithm, an iterative clustering analysis algorithm) clustering algorithm may be used to extract transaction features of the first target object.

[0083] It should be noted that in the above processing, it is also necessary to avoid noise problems and inaccurate transaction feature extraction caused by confusion caused by multiple types of consumption. The following methods can be used to solve the noise problem.

[0084] 1) Do not classify and store special consumption into transaction categories. For example, do not classify and store occasional large-amount consumption of a certain type by the user into transaction categories because the consumption data is not predictive.

[0085] 2) Classify users by total consumption amount. Transaction categories with monthly average consumption amount not exceeding the first threshold of RMB 1,000 are directly classified as low-consumption transaction categories, and no subsequent classification analysis is performed. The first threshold can be flexibly set according to the transaction category and the actual application scenario.

[0086] 3) On the basis of satisfying condition 2), a greedy algorithm is used. If the number of low-consumption transaction categories exceeds 3, they are sorted from large to small according to the amount, and the amount proportion of each transaction category in each low-consumption transaction category and the transaction category exceeding 0.8 are determined. The transaction category is reclassified, and a predetermined number of reclassified transaction categories are selected for subsequent processing. Other types of consumption are directly set to 0 in the sparse matrix, that is, they are not processed to reduce the amount of calculation.

[0087] S3, predicting the probability that the current transaction data of the second target object is abnormal transaction data based on the transaction characteristics, and obtaining the probability that the current transaction data of the second target object is abnormal transaction data.

[0088] When predicting the probability that the current transaction data of the second target object is abnormal transaction data based on the transaction characteristics, different influence coefficients can be set for data with different transaction characteristics, and the value of the influence coefficient can be determined according to the amount. The following is an example:

[0089] Calculate the transaction characteristics of a certain transaction type for each user. For example, in the learning improvement transaction category, cram school is a large-amount consumption once a month, and the impact coefficient is high. For example, the initial value is set to 10. For example, in the online shopping supermarket transaction category, supermarket consumption may be more than 30 times in 20 days a month, and the impact coefficient is low. The initial value is set to 1.5.

[0090] The basic influence coefficient G(x)=poly, and the least square method is used to perform polynomial fitting.

[0091] It should be noted that the data characteristics of the basic influence coefficient are that 1 to 5 converge relatively quickly, 6 to 10 converge slowly, and above 10 decreases slightly and approaches 1.

[0092] The n transfer account names with recent user consumption data are also used as feature values. The transfer account names with too frequent transactions are identified through clustering, which can help intelligently identify whether there is abnormal group behavior.

[0093] For example, setting:

[0094]

[0095] The consumption of the day is superimposed, and the impact coefficient is also superimposed G(xn)=G(xn-1)*(1+a), where the initial value of a is set to 20%. a can also be set to a function related to time, but considering the amount of calculation and output, it is simply set to a fixed value.

[0096] By dynamically adjusting the impact coefficient based on the number of payments in the month, multiple purchases on the same day increase the probability of suspicious transactions. The calculation formula for the last purchase limit of the day is:

[0097]

[0098] Among them, E(x) is the predicted value of the transaction category in the current month. The accumulated value of the transaction category of the user in the current month divided by the current day. b is the floating factor, which is determined by the absolute value of the difference between the user's predicted value E(x) and the historical highest value Cmax * the adjustment parameter d. The initial adjustment parameter is d = 0.8, indicating consumption fluctuation. The d value of users with large consumption fluctuations can be set higher. It can be seen that b = |E(x)-Cmax| / (Cmax*d). From this, the last consumption limit of the day can be calculated.

[0099] Take the transaction category of online shopping for supermarkets as an example: a user has spent 30 times in supermarkets on average per month in the past 12 months. In the past half month, the cumulative consumption is 3708 yuan, excluding today. On that day, he has spent 4 times, 106, 340, 112, and 350 yuan respectively. Determine whether the fifth consumption of 167 yuan exceeds the limit. The expected consumption in supermarkets this month is 4106 yuan. The highest consumption in supermarkets in the past 12 months is 9836 yuan. Apply the formula, 4106*(1+(|4106-9836|) / (9836*0.8))-3708-106*1.1-340*1.2*1.1-112*1.2*1.2*1.1-350*1.2*1.2*1.2*1.1=910. It does not exceed the limit and can be consumed normally.

[0100] That is, the transaction amount of the current payment transaction is within the limit, so the probability that the current transaction data is abnormal transaction data is 0.

[0101] If the transaction amount of the current payment transaction is outside the limit, different probabilities that the current transaction data is abnormal transaction data can be obtained based on the degree to which the transaction amount is outside the limit, multiple thresholds can be set for the probability, and multiple different processing methods can be used.

[0102] Through the above method, the expected consumption is intelligently and flexibly calculated to reduce misjudgment of elastic consumption, and the probability of suspicious transactions is also increased for continuous consumption dynamics. The weight of game recharge is increased to prevent children from stealing and other situations. The payment amount is controlled. The elderly account is intelligently identified and the contact person is notified when a large amount of payment is made. Users who trade too frequently can be identified through clustering to help intelligently identify whether there is abnormal behavior. Accounts with abnormal behavior are blocked. This makes transactions more secure and reliable.

[0103] It should be noted that, in the above case, that is, the transaction amount of the current payment transaction is within the limit, therefore, when the probability that the current transaction data is abnormal transaction data is 0, we can not only use the above algorithm to predict the probability based on the floating degree of the transaction amount within the limit, but also combine the anti-abnormal transaction model to make a more comprehensive and multi-dimensional prediction:

[0104] The anti-abnormal transaction model corresponds to the above-mentioned transaction security model:

[0105] The general anti-abnormal transaction model adopted in the optional implementation mode of the present invention is obtained by training the initial model using a sample set, the sample set includes a positive sample set and a negative sample set, the positive sample set includes: multiple groups of normal transaction data, and the negative sample set includes: multiple groups of abnormal transaction data. The multiple groups of abnormal transaction data can be obtained by an artificial intelligence classification algorithm by learning known unauthorized payment samples and case data to form a basic abnormal list.

[0106] On this basis, the anti-abnormal transaction model combines knowledge graph technology, Ada Boost algorithm, classification algorithm and clustering algorithm to ensure the ability of the model provided in the optional implementation of the present invention to identify abnormal transactions. Among them, knowledge graph technology can be used to analyze the special attributes of payment accounts, Ada Boost algorithm can be used to weightedly integrate multi-layer models to comprehensively evaluate the probability of user transaction risks, and classification algorithm and clustering algorithm can find out the implicit common features in the data through global analysis and high-dimensional space clustering, which can improve the technical ability to discover and identify abnormal transactions, and can also intercept abnormal websites.

[0107] The various technologies used in the anti-abnormal transaction model provided in the optional implementation of the present invention are used in multiple modules, and the multiple modules are combined with each other to ensure the anti-abnormal transaction model's ability to identify abnormal transactions. Among them, there are four core functional modules in the anti-abnormal transaction model: an abnormal list module, an anti-abnormal transaction model module, a knowledge base module based on a knowledge graph, and an abnormal website interception module. Figure 2 Schematic diagram of four core functional modules in the anti-abnormal transaction model provided by an optional embodiment of the present invention, such as Figure 2As shown, the four core functional modules in the anti-abnormal transaction model provided in the optional implementation mode of the present invention are introduced in detail below:

[0108] (1) Abnormal list module:

[0109] Classification and clustering algorithms are used to optimize the abnormal list and the mild abnormal list mechanism, thereby improving the technical ability to discover and identify abnormal transactions.

[0110] Specifically, the abnormal list and the mild abnormal list can be imported through various channels, among which the abnormal list and the mild abnormal list can form a basic abnormal list and the mild abnormal list for known case data. The classification algorithm uses the abnormal list and the mild abnormal list to analyze and predict the abnormal transaction risk of new behavioral events. On this basis, the clustering algorithm is combined with global analysis and high-dimensional space clustering to find the implicit common features in the data under the condition of normal transaction sample data, so as to complete the automatic discovery of large-scale management abnormal transactions. Through the combination of the two machine learning algorithms, the technical ability to discover and identify abnormal transactions can be effectively improved, and accurate warnings can be given.

[0111] (2) Anti-abnormal transaction module:

[0112] The three-layer sub-model is integrated through the weighted adaptive ada boost algorithm to predict the risk score and comprehensively evaluate the probability of the user's transaction risk. Among them, the three-layer model is the login sub-model, the account opening sub-model, and the transaction sub-model.

[0113] Login sub-model: Apply the decision tree machine learning algorithm to build a login sub-model based on features such as multi-terminal login, remote login, number of login locations, and login time.

[0114] Account opening sub-model: The account opening sub-model is established based on the user’s historical account opening times, historical card replacement times, and historical card loss reports times.

[0115] Transaction sub-model: Build a transaction sub-model based on the number of large transactions, frequent transactions, and quick in and out transactions by users.

[0116] When integrating the three-layer sub-models through the weighted adaptive boosting ada boost algorithm, it is necessary to understand the characteristics of normal transactions and abnormal transactions (abnormal transactions include credit card fraud, non-cardholder game recharges, etc.) presented in the massive data based on specific business and industry historical cases, so as to accurately distinguish them from multiple dimensions. Specifically, it is necessary to calculate multiple features and derivative variables, such as the frequency of card swiping per unit time, the deviation of the amount and density of card swiping compared with the historical total amount, the distribution quantile of the transaction amount, the usual transaction time and place, terminal information, whether there will be prior inquiries and small-amount tests before large transactions, etc. Then use the above model to combine the features, optimize the parameters, and train the best combination of feature dimensions based on historical samples to form the optimal model.

[0117] (3) Knowledge base module based on knowledge graph:

[0118] Abnormal lists of abnormal numbers, abnormal cards, and IP addresses are shared and built together to establish a knowledge base in order to identify the special attributes of payment accounts.

[0119] Specifically, the identification of special attributes of payment accounts also focuses on the identification of common irrational consumption. The corpus generated by pre-training the Bert (Bidirectional Encoder Representations from Transformer) training model is merged with the ready-made corpus such as Jieba (open source database), and the keywords transferred into the account name in the consumption record are extracted. Using the existing training set and text NLP (Neuro-Linguistic Programming) artificial intelligence analysis, the special attribute analysis of the payment account is identified.

[0120] By analyzing and identifying various credit card frauds, non-authenticated transactions in online channels such as APPs, etc., for example, credit card frauds usually involve continuous large transactions.

[0121] (4) Abnormal URL interception module:

[0122] It is mainly based on the classification and clustering methods of machine learning to intercept payment operations on abnormal websites.

[0123] Specifically, the classification method is mainly to normalize the sample data, construct a classifier, and identify whether it is abnormal: first, extract static features (host, URL, web page information, etc.) and dynamic features (browser behavior, web page jump relationship, etc.) based on the marked URL data set, normalize the extracted features, and construct a classifier through an algorithm to identify abnormal websites. Taking the detection and identification of abnormal URLs as an example, on the basis of extracting multiple feature attributes such as the title, keywords, and page tag elements of the target URL, the direct feature distance between the target URL and the URL sample in the abnormal resource template library is calculated to determine the direct similarity between the two. Those with similarity exceeding the threshold are intercepted.

[0124] Specifically, the clustering method is as follows: first, the link relationship table, URL features, web page text information and other features are extracted from the URL data set collected from the web pages. Then, based on the features of abnormal behaviors that are close in distance on the multidimensional space vector, a multidimensional space vector with features such as login time, browser type, IP address, GPS address, nickname modification, etc. is constructed. The clustering algorithm can be used to cluster suspected abnormal behaviors or accounts into a group and extract the common information of the group to generate training data.

[0125] It can be combined with anti-abnormal trading models to make more comprehensive and multi-dimensional predictions.

[0126] S4, for transactions suspected to be abnormal, adopt multiple security authentication methods.

[0127] Set multiple thresholds for probability and use a variety of different processing methods.

[0128] Specifically, when the probability is less than the first predetermined threshold, that is, the possibility that the second target object is not the first target object is low, and / or the risk of the current transaction is low, in this case, the first target object is reminded that the current transaction to be paid has risks, and the first target object is reminded to further determine the payment operation, or confirm whether it is its own payment operation. When the probability is less than the second predetermined threshold and greater than or equal to the first predetermined threshold, that is, the possibility that the second target object is not the first target object is medium, and / or the risk of the current transaction is medium, payment verification is used when the second target object pays the current transaction to be paid; the payment verification method can include a single method or multiple combined authentication methods such as face three-dimensional recognition, fingerprint recognition, voice recognition, signature recognition, password, U shield, electronic password device, SMS verification code, reserved questions, etc. When using the payment verification method, the above-mentioned multiple payment verification methods can be displayed in the form of microservices, and combined verification can be performed, which is scalable, that is, verification methods can be added and adjusted to delete verification methods, without affecting the service implementation of other authentication methods, and without adding additional workload, so that it can adapt to the needs of various scenarios and businesses. When the probability is greater than or equal to a second predetermined threshold, that is, the possibility that the second target object is not the first target object is high, and / or the risk of the current transaction is high, the second target object is prohibited from paying the current transaction to be paid, and a security reminder mode in the form of SMS or phone call is performed to protect the property safety of the owner in various ways and under different circumstances.

[0129] Through the above optional implementation, at least the following beneficial effects can be achieved:

[0130] (1) The historical transaction data and attribute data are identified and processed first by combining the KNN classification algorithm. Then, the transaction features of users are extracted by kmeans. Compared with the simple use of kmeans clustering algorithm to directly extract the transaction features of users, this method has better accuracy and flexibility and avoids the interference of erroneous data.

[0131] (2) Extracting the user's transaction features, that is, when constructing the user's portrait, a sparse matrix method is used and noise optimization processing is performed, which not only improves the calculation efficiency but also increases the accuracy of extracting the user's transaction features.

[0132] (3) Dynamically adjust the threshold and intelligently intercept abnormal transactions. Increase the weight of game recharges to prevent children from stealing and other situations. Control the payment amount. For some elderly accounts, notify the contact person when large payments are made. Users with too frequent transactions can be clustered to help intelligently identify whether there are abnormal behaviors. Improve security.

[0133] (4) The user's transaction characteristics have good scalability, which can understand the user and use the user's behavior information for personalized recommendations, personalized searches, etc.

[0134] (5) It efficiently solves the personalized and differentiated user security needs in the Internet era, balances convenience and user security needs, has high recognition accuracy, timely monitors and intercepts suspicious transactions, ensures user account security, and has high scalability and data reliability.

[0135] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described action sequence, because according to the present invention, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0136] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods of various embodiments of the present invention.

[0137] Example 2

[0138] According to an embodiment of the present invention, a device for implementing the above data processing method is also provided. Figure 4 is a structural block diagram of a data processing device according to an embodiment of the present invention. Figure 4 As shown, the device includes: a collection module 402, an extraction module 404, an acquisition module 406 and a prediction module 408. The device is described in detail below.

[0139] The collection module 402 is used to collect the historical transaction data and attribute data of the first target object; the extraction module 404 is connected to the above-mentioned collection module 402, and is used to extract the transaction characteristics of the first target object based on the historical transaction data and attribute data of the first target object; the acquisition module 406 is connected to the above-mentioned extraction module 404, and is used to obtain the current transaction data of the second target object, wherein the current transaction data is the transaction data corresponding to the transaction currently to be paid by the second target object; the prediction module 408 is connected to the above-mentioned acquisition module 406, and is used to predict the probability that the current transaction data of the second target object is abnormal transaction data based on the transaction characteristics of the first target object, and obtain the probability that the current transaction data of the second target object is abnormal transaction data.

[0140] It should be noted here that the above-mentioned collection module 402, extraction module 404, acquisition module 406 and prediction module 408 correspond to steps S102 to S108 in the implementation of the data processing method, and the instances and application scenarios implemented by the multiple modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above-mentioned embodiment 1.

[0141] Example 3

[0142] According to another aspect of an embodiment of the present invention, there is provided an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor, wherein the processor is configured to execute the instructions to implement any one of the above data processing methods.

[0143] Example 4

[0144] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided. When instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device can execute any of the above data processing methods.

[0145] Example 5

[0146] According to another aspect of an embodiment of the present invention, there is further provided a computer program product, including a computer program, wherein the computer program implements any of the above-mentioned data processing methods when executed by a processor.

[0147] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0148] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0149] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0150] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0151] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0152] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0153] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A data processing method, characterized in that: include: Collecting historical transaction data and attribute data of a first target object, wherein the first target object is an owner of a terminal device; Extracting transaction features of the first target object based on historical transaction data and attribute data of the first target object; Acquire current transaction data of a second target object, wherein the current transaction data is transaction data corresponding to a transaction currently to be paid by the second target object, and the second target object is a user who performs a transaction operation on the terminal device; Predicting, based on the transaction characteristics of the first target object, the probability that the current transaction data of the second target object is abnormal transaction data, thereby obtaining the probability that the current transaction data of the second target object is abnormal transaction data; Wherein, the transaction features include consumption features, which are obtained through the following processing: taking the consumption data as the user dimension, for each user, using a sparse matrix and a graph database to combine, establishing branches according to consumption types, storing consumption type feature values, using the diagonal of the sparse matrix to represent feature value weights, encoding the consumption types in a one-hot code manner, storing the consumption types in the sparse matrix, and recording each consumption record in the graph database storage branch according to the total amount of the consumption types, and storing the accumulated results of the feature value weight calculation on the diagonal of the sparse matrix; Among them, the method also includes an interception operation for intercepting payment operations in abnormal websites, and the interception operation includes a classification method and a clustering method. The classification method extracts static features and dynamic features based on the marked URL data set, normalizes the extracted features, and then identifies abnormal websites by constructing a classifier. By calculating the direct feature distance between the target URL and the URL sample in the abnormal resource template library, the similarity between the target URL and the URL sample is determined, and interception is performed when the similarity exceeds a threshold. The clustering method includes extracting features and a link relationship table from the URL data set collected from the web page, constructing a multidimensional space vector based on the features of abnormal behaviors with similar distances on the multidimensional space vector, and using a clustering algorithm to cluster abnormal behaviors or accounts into a group and extract common information of the group to generate training data for training, so as to cluster and identify abnormal behaviors.

2. The method according to claim 1, characterized in that The step of extracting the transaction features of the first target object based on the historical transaction data and attribute data of the first target object includes: Determining transaction categories of the historical transaction data, and storing the historical transaction data in corresponding transaction categories respectively; Extracting a predetermined number of transaction categories according to predetermined rules; Transaction features of the first target object are extracted based on the predetermined number of transaction categories and the attribute data.

3. The method according to claim 2, characterized in that The determining the transaction categories of the historical transaction data and storing the historical transaction data into corresponding transaction categories respectively includes: Extract the transaction amount of the historical transaction data and the transfer account name of the historical transaction data; According to the transaction amount of the historical transaction data, a corresponding weight is assigned to the historical transaction data; According to the transfer account name of the historical transaction data, the transaction category of the historical transaction data is determined, and the historical transaction data assigned with corresponding weights are respectively stored in the corresponding transaction categories.

4. The method according to claim 1, characterized in that The predicting, based on the transaction characteristics of the first target object, the probability that the current transaction data of the second target object is abnormal transaction data to obtain the probability that the current transaction data of the second target object is abnormal transaction data includes: Acquire the transaction amount of the current transaction data of the second target object and the transfer account name of the current transaction data of the second target object; Based on the transaction characteristics of the first target object, the transaction amount of the current transaction data of the second target object, and the transfer account name of the current transaction data of the second target object, the probability that the current transaction data of the second target object is abnormal transaction data is predicted to obtain the probability that the current transaction data of the second target object is abnormal transaction data.

5. The method according to claim 1, characterized in that The predicting, based on the transaction characteristics of the first target object, the probability that the current transaction data of the second target object is abnormal transaction data to obtain the probability that the current transaction data of the second target object is abnormal transaction data includes: The transaction features of the first target object are input into the transaction security model, and the probability that the current transaction data of the second target object is abnormal transaction data is predicted to obtain the probability that the current transaction data of the second target object is abnormal transaction data, wherein the transaction security model is obtained by training an initial model with a sample set, and the sample set includes a positive sample set and a negative sample set, the positive sample set includes: multiple groups of normal transaction data, and the negative sample set includes: multiple groups of abnormal transaction data.

6. The method according to claim 1, characterized in that After predicting the probability that the current transaction data of the second target object is abnormal transaction data based on the transaction characteristics of the first target object and obtaining the probability that the current transaction data of the second target object is abnormal transaction data, the method further includes at least one of the following: When the probability that the current transaction data of the second target object is abnormal transaction data is less than a first predetermined threshold, reminding the first target object that the current transaction to be paid has risks; When the probability that the current transaction data of the second target object is abnormal transaction data is less than a second predetermined threshold and greater than or equal to a first predetermined threshold, payment verification is adopted when the second target object pays the current transaction to be paid; When the probability that the current transaction data of the second target object is abnormal transaction data is greater than or equal to a second predetermined threshold, the second target object is prohibited from paying the current transaction to be paid.

7. A data processing device, characterized in that: include: A collection module, used to collect historical transaction data and attribute data of a first target object, wherein the first target object is an owner of a terminal device; An extraction module, configured to extract transaction features of the first target object based on historical transaction data and attribute data of the first target object; an acquisition module, configured to acquire current transaction data of a second target object, wherein the current transaction data is transaction data corresponding to a transaction currently to be paid by the second target object, and the second target object is a user who performs a transaction operation on the terminal device; A prediction module, configured to predict the probability that the current transaction data of the second target object is abnormal transaction data according to the transaction characteristics of the first target object, and obtain the probability that the current transaction data of the second target object is abnormal transaction data; Wherein, the transaction features include consumption features, which are obtained through the following processing: taking the consumption data as the user dimension, for each user, using a sparse matrix and a graph database to combine, establishing branches according to consumption types, storing consumption type feature values, using the diagonal of the sparse matrix to represent feature value weights, encoding the consumption types in a one-hot code manner, storing the consumption types in the sparse matrix, and recording each consumption record in the graph database storage branch according to the total amount of the consumption types, and storing the accumulated results of the feature value weight calculation on the diagonal of the sparse matrix; Among them, the prediction module is also used for intercepting payment operations in abnormal websites. The intercepting operation includes a classification method and a clustering method. The classification method extracts static features and dynamic features based on the marked URL data set, normalizes the extracted features, and then identifies abnormal websites by constructing a classifier. The similarity between the target URL and the URL sample in the abnormal resource template library is calculated by calculating the direct feature distance between the target URL and the URL sample. When the similarity exceeds a threshold, interception is performed. The clustering method includes extracting features and a link relationship table from the URL data set collected from the web page, constructing a multidimensional space vector based on the features of abnormal behaviors with similar distances on the multidimensional space vector, and using a clustering algorithm to group abnormal behaviors or accounts and extract common information of the group to generate training data for training, so as to cluster and identify abnormal behaviors.

8. An electronic device, characterized in that: include: processor; a memory for storing instructions executable by the processor; The processor is configured to execute the instructions to implement the data processing method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: When the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the data processing method as claimed in any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the data processing method according to any one of claims 1 to 6 is implemented.

Images