Transaction data anomaly determination method, apparatus, device, medium, and product

Abstract

The present application belongs to the technical field of data processing, and specifically provides a transaction data anomaly determination method, device, equipment, medium and product, which comprises the following steps: obtaining target transaction data to be determined for an abnormal result; determining a target customer identifier according to the target transaction data; determining customer transaction related data of a target customer within a preset time period before a target transaction time according to the target customer identifier; the target transaction data comprises the target transaction time; inputting the target transaction data and the customer transaction related data into a decision tree algorithm model trained to convergence to output an abnormal result corresponding to the target transaction data. The transaction data anomaly determination method of the present application, based on the decision tree algorithm model trained, combined with the customer transaction related data, can determine whether the target transaction data is abnormal from multiple dimensions of data, thereby improving the accuracy of transaction data anomaly determination.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data processing, and in particular to a transaction data anomaly determination method, device, equipment, medium and product. BACKGROUND

[0002] With the rapid development of network technology, the financial industry currently mainly adopts an online and offline combined mode to handle business. Customers can complete most payment behaviors and business signing behaviors in a terminal manner through an online mode, which provides great convenience for customers. At the same time, the security of the online mode is lower than that of the offline mode.

[0003] In order to improve the security of the online mode, analysis and prevention and control of security risk identification are one of the main means at present. The analysis and prevention and control of security risk identification mainly screen transaction data that may exist abnormally in an artificial manner according to certain rules. Since the rules have a certain lag, and the artificial manner depends on artificial experience, the accuracy of transaction data anomaly determination is low. SUMMARY

[0004] The present application provides a transaction data anomaly determination method, device, equipment, medium and product, to solve the problem that the accuracy of transaction data anomaly determination is low in the analysis and prevention and control of security risk identification in the artificial manner depending on artificial experience at present.

[0005] The first aspect of the present application provides a transaction data anomaly determination method, comprising:

[0006] obtaining target transaction data to be determined for an abnormal result;

[0007] determining a target customer identifier according to the target transaction data;

[0008] determining customer transaction related data of a target customer within a preset time period before a target transaction time according to the target customer identifier; the target transaction data comprises the target transaction time;

[0009] inputting the target transaction data and the customer transaction related data into a decision tree algorithm model trained to convergence, to output an abnormal result corresponding to the target transaction data.

[0010] Further, the method as described above, the customer transaction related data comprises: customer location portrait, historical transaction object data, customer business signing data;

[0011] the target transaction data and the customer transaction related data are inputted into a decision tree algorithm model trained to convergence, to output an abnormal result corresponding to the target transaction data, comprising:

[0012] The decision tree algorithm model is used to perform feature extraction on the customer location portrait and historical transaction object data respectively to generate corresponding location features and transaction object features.

[0013] The decision tree algorithm model is used to output an abnormal result corresponding to the target transaction data according to the target transaction data, location features, transaction object features, and customer business subscription data.

[0014] Further, the method described above, the target transaction data further includes: target transaction location, target transaction object data, and target transaction business;

[0015] The decision tree algorithm model is used to output an abnormal result corresponding to the target transaction data according to the target transaction data, location features, transaction object features, and customer business subscription data.

[0016] The decision tree algorithm model is used to generate customer location information entropy according to the target transaction location and the location features;

[0017] The decision tree algorithm model is used to determine whether the target transaction object is an abnormal transaction object according to the target transaction object data and the transaction object features;

[0018] The decision tree algorithm model is used to output an abnormal result corresponding to the target transaction data according to the customer location information entropy, the determination result of whether the target transaction object is an abnormal transaction object, the target transaction business, and the customer business subscription data.

[0019] Further, the method described above, the decision tree algorithm model is used to output an abnormal result corresponding to the target transaction data according to the customer location information entropy, the determination result of whether the target transaction object is an abnormal transaction object, the target transaction business, and the customer business subscription data.

[0020] The decision tree algorithm model is used to determine historical business subscription data in the customer business subscription data that is within a preset number of subscriptions before the target transaction time;

[0021] The decision tree algorithm model is used to determine whether the historical business subscription data includes the target transaction business;

[0022] The decision tree algorithm model is used to output an abnormal result corresponding to the target transaction data according to the customer location information entropy, the determination result of whether the target transaction object is an abnormal transaction object, and the result of whether the historical business subscription data includes the target transaction business.

[0023] Further, the method as described above, the target customer identification has a mapping relationship with a transaction account identification, a transaction customer number identification, and a transaction customer number sub-identification.

[0024] Before the target transaction data is used to determine the target customer identification, the method further includes:

[0025] establishing a mapping relationship between the target customer identification and a transaction account identification, a transaction customer number identification, and a transaction customer number sub-identification corresponding to the target customer;

[0026] obtaining first transaction-related data corresponding to the transaction account identification according to the transaction account identification;

[0027] obtaining second transaction-related data corresponding to the transaction customer number identification according to the transaction customer number identification;

[0028] obtaining third transaction-related data corresponding to the transaction customer number sub-identification according to the transaction customer number sub-identification;

[0029] generating customer transaction-related data corresponding to the target customer identification according to the first transaction-related data, the second transaction-related data, and the third transaction-related data.

[0030] Further, the method as described above, the customer transaction-related data further includes a customer historical transaction time.

[0031] Before the target transaction data and the customer transaction-related data are input into the trained and converged decision tree algorithm model, the method further includes:

[0032] determining whether a time difference between a target transaction time and a nearest customer historical transaction time is less than a preset difference threshold value;

[0033] If it is determined that the time difference is less than the preset difference threshold value, it is determined that a corresponding state of the target transaction data is continuous transaction.

[0034] The target transaction data and the customer transaction-related data are input into the trained and converged decision tree algorithm model, including:

[0035] The target transaction data, the corresponding state of the target transaction data being continuous transaction, and the customer transaction-related data are input into the trained and converged decision tree algorithm model.

[0036] Further, the method as described above, before the target transaction data and the customer transaction-related data are input into the trained and converged decision tree algorithm model, the method further includes:

[0037] obtaining a training sample, the training sample including historical customer transaction-related data of a customer;

[0038] inputting the training samples into a preset decision tree algorithm model to train the preset decision tree algorithm model;

[0039] adopting a receiver operating characteristic curve to determine whether the preset decision tree algorithm model satisfies a convergence condition;

[0040] determining the preset decision tree algorithm model satisfying the convergence condition as a decision tree algorithm model trained to convergence.

[0041] The second aspect of the present application provides a transaction data anomaly determination device, comprising:

[0042] an acquisition module configured to acquire target transaction data to be determined for an abnormal result;

[0043] a first determination module configured to determine a target customer identifier according to the target transaction data;

[0044] a second determination module configured to determine customer transaction related data of a target customer within a preset time period before a target transaction time according to the target customer identifier; the target transaction data comprises the target transaction time;

[0045] an output module configured to input the target transaction data and the customer transaction related data into a decision tree algorithm model trained to convergence to output an abnormal result corresponding to the target transaction data.

[0046] Further, as described above, the customer transaction related data comprises customer location portraits, historical transaction object data, and customer business subscription data.

[0047] The output module is specifically configured to:

[0048] The decision tree algorithm model is used to extract features from the customer location portraits and the historical transaction object data respectively to generate corresponding location features and transaction object features; and the decision tree algorithm model is used to output the abnormal result corresponding to the target transaction data according to the target transaction data, the location features, the transaction object features, and the customer business subscription data.

[0049] Further, as described above, the target transaction data further comprises a target transaction location, target transaction object data, and a target transaction business.

[0050] When the output module uses the decision tree algorithm model to output the abnormal result corresponding to the target transaction data according to the target transaction data, the location features, the transaction object features, and the customer business subscription data, the output module is specifically configured to:

[0051] adopting the decision tree algorithm model to generate customer location information entropy according to the target transaction location and the location feature; adopting the decision tree algorithm model to determine whether the target transaction object is an abnormal transaction object according to target transaction object data and transaction object features; and adopting the decision tree algorithm model to output an abnormal result corresponding to the target transaction data according to the customer location information entropy, a determination result of whether the target transaction object is an abnormal transaction object, a target transaction business, and customer business subscription data.

[0052] Further, the apparatus as described above, when the output module outputs an abnormal result corresponding to the target transaction data according to the customer location information entropy, a determination result of whether the target transaction object is an abnormal transaction object, a target transaction business, and customer business subscription data by adopting the decision tree algorithm model, is specifically used for:

[0053] adopting the decision tree algorithm model to determine historical business subscription data in the customer business subscription data that is before a preset subscription number of times of the target transaction time; adopting the decision tree algorithm model to determine whether the historical business subscription data contains the target transaction business; and adopting the decision tree algorithm model to output an abnormal result corresponding to the target transaction data according to the customer location information entropy, a determination result of whether the target transaction object is an abnormal transaction object, and a result of whether the historical business subscription data contains the target transaction business.

[0054] Further, the apparatus as described above, the target customer identifier has a mapping relationship with a transaction account identifier, a transaction customer number identifier, and a channel customer number identifier.

[0055] The apparatus further comprises:

[0056] a data association module configured to establish a mapping relationship between the target customer identifier and a transaction account identifier, a transaction customer number identifier, and a channel customer number identifier corresponding to the target customer; acquire first transaction related data corresponding to the transaction account identifier according to the transaction account identifier; acquire second transaction related data corresponding to the transaction customer number identifier according to the transaction customer number identifier; acquire third transaction related data corresponding to the channel customer number identifier according to the channel customer number identifier; and generate customer transaction related data corresponding to the target customer identifier according to the first transaction related data, the second transaction related data, and the third transaction related data.

[0057] Further, the apparatus as described above, the customer transaction related data further comprises a customer historical transaction time.

[0058] The apparatus further comprises:

[0059] The judgment module is configured to determine whether a time difference between the target transaction time and the nearest customer historical transaction time is less than a preset difference threshold value; and if it is determined that the time difference is less than the preset difference threshold value, it is determined that the corresponding state of the target transaction data is continuous transaction.

[0060] The output module is configured to, when inputting the target transaction data and the customer transaction related data into the decision tree algorithm model trained to convergence, specifically:

[0061] The target transaction data, the corresponding state of the target transaction data being continuous transaction, and the customer transaction related data are input into the decision tree algorithm model trained to convergence.

[0062] Further, the device as described above further comprises:

[0063] The training module is configured to obtain a training sample, the training sample comprising historical customer transaction related data of a customer; input the training sample into a preset decision tree algorithm model to train the preset decision tree algorithm model; determine whether the preset decision tree algorithm model satisfies a convergence condition by using a receiver operating characteristic curve; and determine the preset decision tree algorithm model satisfying the convergence condition as a decision tree algorithm model trained to convergence.

[0064] The third aspect of the present application provides an electronic device, comprising: a processor, and a memory connected to the processor in communication;

[0065] The memory stores computer execution instructions.

[0066] The processor executes the computer execution instructions stored in the memory to implement the transaction data anomaly determination method according to any one of the first aspect.

[0067] The fourth aspect of the present application provides a computer readable storage medium, the computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by a processor to implement the transaction data anomaly determination method according to any one of the first aspect.

[0068] The fifth aspect of the present application provides a computer program product, comprising a computer program, and the computer program is executed by a processor to implement the transaction data anomaly determination method according to any one of the first aspect.

[0069] This invention provides a method, apparatus, device, medium, and product for determining transaction data anomalies. The method includes: acquiring target transaction data for which anomalies need to be determined; determining a target customer identifier based on the target transaction data; determining customer transaction-related data of the target customer within a preset time period before a target transaction time based on the target customer identifier; the target transaction data includes a target transaction time; and inputting the target transaction data and the customer transaction-related data into a converged decision tree algorithm model to output an anomaly result corresponding to the target transaction data. The method for determining transaction data anomalies of this invention first acquires the target transaction data for which anomalies need to be determined, and determines a target customer identifier based on the target transaction data. Simultaneously, it determines customer transaction-related data of the target customer within a preset time period before the target transaction time based on the target customer identifier. Then, a converged decision tree algorithm model is used to process the target transaction data and the customer transaction-related data to output the corresponding anomaly result. Since the method in this embodiment is based on a trained decision tree algorithm model and incorporates customer transaction-related data, it can determine whether the target transaction data is anomaly from multiple dimensions of the data, improving the accuracy of transaction data anomaly determination. Attached Figure Description

[0070] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0071] Figure 1 This is a scenario diagram illustrating how the transaction data anomaly determination method of this embodiment of the invention can be implemented;

[0072] Figure 2 This is a flowchart illustrating the method for determining transaction data anomalies provided in the first embodiment of the present invention.

[0073] Figure 3 A flowchart illustrating the transaction data anomaly determination method provided in the second embodiment of the present invention;

[0074] Figure 4 A flowchart illustrating the method for determining transaction data anomalies provided in the third embodiment of the present invention;

[0075] Figure 5 The contract representation intent of the transaction data anomaly determination method provided in the third embodiment of the present invention;

[0076] Figure 6 This is a schematic diagram illustrating the customer identifier association in the transaction data anomaly determination method provided in the third embodiment of the present invention.

[0077] Figure 7 This is a schematic diagram of the transaction data anomaly determination device provided in the fourth embodiment of the present invention;

[0078] Figure 8 The structural schematic diagram of the electronic device provided by the fifth embodiment of the present application is shown.

[0079] The specific embodiments of the present application have been shown and described in the above drawings, and will be described in more detail hereinafter. These drawings and the written description are not intended to restrict the scope of the inventive concept in any way, but to illustrate the inventive concept by reference to specific embodiments. DETAILED DESCRIPTION

[0080] The exemplary embodiments will be described in detail herein with reference to the attached drawings. The same numbers are used in different drawings to represent the same or similar elements. The following detailed description is not intended to restrict the scope of the present application, but to explain the present application by reference to some embodiments.

[0081] In the technical solutions of the embodiments of the present application, the collection, storage, use, processing, transmission, provision and disclosure of user personal information comply with relevant laws and regulations and do not violate public order and good customs.

[0082] The technical solutions of the present application will be described in detail below with reference to specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes can not be described again in some embodiments. The embodiments of the present application will be described below with reference to the drawings.

[0083] In order to clearly understand the technical solutions of the present application, the prior art solutions will be described in detail first. At present, with the rapid development of network finance and mobile payment in the field of financial technology, new and efficient and convenient financial services are provided for customers. Through the combination of online and offline, customers can complete payment and business signing behaviors through terminals in an online manner. Therefore, the security threats on the line have changed greatly, and emerging threats are increasing.

[0084] The analysis and prevention of security risk identification is one of the main protection means at present. The analysis and prevention of security risk identification mainly screen the transaction data that may exist abnormity through manual mode according to certain rules. Since the rules have certain hysteresis, and the manual mode depends on manual experience, the accuracy of transaction data abnormity determination is low.

[0085] Therefore, in order to solve the problem that the accuracy of transaction data anomaly determination is low in the prior art, the inventors find that the transaction data can be determined to be abnormal or normal by using a decision tree algorithm model based on big data and machine learning, thereby improving the accuracy.

[0086] Specifically, first, target transaction data to be determined for an abnormal result is obtained, and a target customer identifier is determined according to the target transaction data. Meanwhile, customer transaction related data of the target customer within a preset time period before a target transaction time is determined according to the target customer identifier. Then, the target transaction data and the customer transaction related data are processed by the trained decision tree algorithm model to output a corresponding abnormal result. Since the method of the embodiment is based on the trained decision tree algorithm model and combines the customer transaction related data, whether the target transaction data is abnormal can be determined from multiple dimensions of data, thereby improving the accuracy of transaction data anomaly determination.

[0087] Based on the above creative findings, the inventors propose the technical solution of the present application.

[0088] The application scenario of the transaction data anomaly determination method provided by the embodiment of the present application will be introduced below. As shown in Figure 1 The network architecture of the application scenario corresponding to the transaction data anomaly determination method provided by the embodiment of the present application includes a first electronic device 1 and a second electronic device 2. The second electronic device 2 stores customer transaction data and customer transaction related data, such as target transaction data to be determined for an abnormal result. The customer transaction related data includes, for example, customer transaction location, customer transaction time, customer transaction object, and the like. The data stored in the second electronic device 2 can be obtained from a financial system or manually input.

[0089] When transaction data anomaly determination is needed, the first electronic device 1 obtains target transaction data to be determined for an abnormal result from the second electronic device 2. Meanwhile, the first electronic device 1 determines a target customer identifier according to the target transaction data, and determines customer transaction related data of the target customer within a preset time period before a target transaction time from the second electronic device 2 according to the target customer identifier. Then, the first electronic device 1 inputs the target transaction data and the customer transaction related data into the trained decision tree algorithm model to output an abnormal result corresponding to the target transaction data. After generating the abnormal result, if it is determined to be abnormal, the abnormal result can be sent to a customer terminal device and / or a financial system for subsequent security processing.

[0090] The embodiment of the present application will be introduced below in conjunction with the drawings of the specification.

[0091] Figure 2 The flowchart of the transaction data anomaly determination method provided by the first embodiment of the present application is shown in Figure 2 In this embodiment, the execution subject of the embodiment of the present application is a transaction data anomaly determination device, which can be integrated in a financial system or other electronic equipment. The transaction data anomaly determination method provided by this embodiment includes the following steps:

[0092] Step S101, obtaining target transaction data to be determined for abnormality.

[0093] In this embodiment, the target transaction data can be the transaction flow data just completed, and the target transaction data generally includes transaction time, transaction object data, transaction location data, and transaction business data.

[0094] Step S102, determining a target customer identifier according to the target transaction data.

[0095] In this embodiment, the target customer identifier is a unique identifier set for each customer, which can use an ID card number as the unique identifier. In the financial system, each customer corresponds to a unique identifier, and the unique identifier is set because the customer may also correspond to multiple customer number identifiers and channel customer number identifiers in different business situations. At the same time, the customer number and the channel customer number are recorded in different data tables in the financial system, and there are different degrees of missing in the customer number and the channel customer number. The ID card number also records the location information of the customer, which is convenient for subsequent location portrait processing.

[0096] After the target customer identifier is determined, the customer transaction related data corresponding to the target customer identifier can be obtained in the database. Since there are many business categories in the financial system, there are also many customer transaction data. In this embodiment, the customer transaction related data needs to be integrated in advance to form the customer transaction related data, and the association between the target customer identifier and the customer transaction related data is established, so as to facilitate the subsequent determination of whether the transaction data is abnormal.

[0097] Step S103, determining the customer transaction related data of the target customer within a preset time period before the target transaction time according to the target customer identifier. The target transaction data includes the target transaction time.

[0098] In this embodiment, the customer transaction related data within the preset time period before the target transaction time is needed to determine whether the transaction data is abnormal. The preset time period can be set according to actual needs, such as 3 months, half a year, one month, etc. The customer transaction related data can include transaction time, transaction location, transaction object, transaction frequency, transaction amount data, etc.

[0099] Step S104, input the target transaction data and the customer transaction related data into the decision tree algorithm model trained to convergence to output the abnormal result corresponding to the target transaction data.

[0100] In this embodiment, the decision tree algorithm model (English full name: Gradient Boosting Decision Tree, English abbreviation: GBDT) is used. When training, the parameters of the decision tree algorithm model can be adjusted, such as the maximum depth of the single tree number, the maximum bucket number of the feature, the minimum sample number of the tree leaf node, the minimum information gain of the leaf node segmentation, the decision tree number, the learning rate, the sample sampling rate of the single tree learning, the candidate feature ratio for calculating the segmentation feature when the leaf node is separated, and the like.

[0101] Through the trained decision tree algorithm model combined with the target transaction data and the customer transaction related data, the abnormal result corresponding to the target transaction data determined is more accurate.

[0102] The transaction data abnormality determination method provided by the embodiment of the application comprises: obtaining target transaction data to be determined for an abnormal result. A target customer identifier is determined according to the target transaction data. Customer transaction related data of a target customer within a preset time period before a target transaction time is determined according to the target customer identifier. The target transaction data comprises the target transaction time. The target transaction data and the customer transaction related data are input into a decision tree algorithm model trained to convergence to output an abnormal result corresponding to the target transaction data.

[0103] The transaction data abnormality determination method provided by the embodiment of the application comprises: obtaining target transaction data to be determined for an abnormal result. A target customer identifier is determined according to the target transaction data. Customer transaction related data of a target customer within a preset time period before a target transaction time is determined according to the target customer identifier. The target transaction data comprises the target transaction time. The target transaction data and the customer transaction related data are input into a decision tree algorithm model trained to convergence to output an abnormal result corresponding to the target transaction data.

[0104] Figure 3 The flowchart of the transaction data abnormality determination method provided by the second embodiment of the application is shown in FIG. 2. Figure 3 The transaction data abnormality determination method provided by the embodiment of the application is further refined on the basis of the transaction data abnormality determination method provided by the previous embodiment of the application. The transaction data abnormality determination method provided by the embodiment comprises the following steps.

[0105] Step S201, obtaining target transaction data to be determined for an abnormal result.

[0106] In this embodiment, the implementation of step 201 is similar to that of step 101 in the previous embodiment of the present application, and will not be repeated here.

[0107] In step S202, the target customer identification is determined according to the target transaction data.

[0108] In this embodiment, the implementation of step 202 is similar to that of step 102 in the previous embodiment of the present application, and will not be repeated here.

[0109] In step S203, the customer transaction related data of the target customer within a preset time period before the target transaction time is determined according to the target customer identification.

[0110] In this embodiment, the implementation of step 203 is similar to that of step 103 in the previous embodiment of the present application, and will not be repeated here.

[0111] It should be noted that the customer transaction related data includes customer location portrait, historical transaction object data, and customer business signing data.

[0112] In step S204, the decision tree algorithm model is used to extract features from the customer location portrait and the historical transaction object data respectively to generate corresponding location features and transaction object features.

[0113] In this embodiment, the customer location portrait can be pre-constructed according to the transaction location data of the customer within a preset time period before the target transaction time. The pre-construction process can be: extracting the original geographic location information of the customer and the interaction behavior record at the time of the customer transaction, then constructing a weighted location interaction relationship graph according to the original geographic location information of the customer and the interaction behavior record at the time of the customer transaction, and updating the actual geographic location of the customer and the geographic location information of the terminal entity on the location interaction relationship graph using a location propagation algorithm. Finally, the customer location portrait is generated according to the actual geographic location of the customer and the geographic location information of the terminal entity, and the location information entropy is used to represent the location characteristics of the user.

[0114] Meanwhile, after the pre-construction is completed, a periodic full update can be adopted, and each update needs to recalculate the entire process to obtain a new customer location portrait. Alternatively, the customer location portrait can be updated when the decision tree algorithm model detects a large amount of data that is not included in the customer location portrait, or when the decision tree algorithm model determines that the accuracy of the anomaly is decreased.

[0115] The historical transaction object data can include transaction object address, transaction object identification, transaction object attribute, and the like. The customer business signing data includes business category data, signing time, signing account, signing action, signing content, and the like.

[0116] The position feature can include frequency in certain positions, position times, position quantity, and the like, and the transaction object feature includes transaction object categories, such as merchant categories, personal categories, and the like, transaction object use entity categories, transaction total times, frequency, and the like.

[0117] Meanwhile, in order to further improve the accuracy of determining the transaction data, the transaction data generation frequency of the target transaction time adjacent time period can also be analyzed. Specifically:

[0118] It is determined whether the time difference between the target transaction time and the nearest customer historical transaction time is less than a preset difference threshold. It should be noted that the customer transaction related data also includes the customer historical transaction time.

[0119] If it is determined that the time difference is less than the preset difference threshold, it is determined that the state of the target transaction data is continuous transaction.

[0120] Thus, the state of continuous transaction is combined as a factor for judgment and analysis together with the target transaction data and the customer transaction related data.

[0121] For example, assuming that the target transaction time is 10:00 am, the customer historical transaction time is 9:50 am, and 8:55 am, the nearest customer historical transaction time is 9:00 am. The time difference is 10 minutes, and if the preset difference threshold is 30 minutes, it can be determined as continuous transaction.

[0122] In the financial field, after a security problem occurs, continuous transaction is likely to occur, and thus, the state of continuous transaction can be used to further determine whether the transaction data is abnormal.

[0123] In step S205, a decision tree algorithm model is used to output the abnormal result corresponding to the target transaction data according to the target transaction data, the position feature, the transaction object feature, and the customer business subscription data.

[0124] In this embodiment, analysis and judgment can be performed from the dimensions of target transaction data, position feature, transaction object feature, and customer business subscription data.

[0125] Specifically, the target transaction data further includes target transaction location, target transaction object data, and target transaction business.

[0126] A decision tree algorithm model is used to generate customer location information entropy according to the target transaction location and the position feature. The customer location information entropy can reflect whether the location is unexpected, if the customer often generates transaction data in positions A, B, and C, where A is 9 times, B is 3 times, and C is 5 times, if the target transaction location is B, the customer location information entropy is high, and if the customer location information is D, the customer location information entropy becomes very high, thereby indicating whether the user transaction location is a common location.

[0127] The decision tree algorithm model is used to determine whether the target transaction object is an abnormal transaction object according to the target transaction object data and the transaction object characteristics.

[0128] Therefore, the transaction object characteristics are comprehensive characteristics of the transaction object of the customer in a preset time period, such as the number of transaction objects, the number of transaction times of the transaction object, the location area of the transaction object, and the like. If the target transaction object data is greatly different from the transaction object characteristics, the target transaction object can be determined as an abnormal transaction object.

[0129] The abnormal transaction object can be set according to actual needs, such as a newly added transaction object, a network protocol address where a security accident often occurs, and the like.

[0130] The decision tree algorithm model is used to output the abnormal result corresponding to the target transaction data according to the customer location information entropy, the determination result of whether the target transaction object is an abnormal transaction object, the target transaction belonging to a business, and the customer business subscription data.

[0131] Meanwhile, the customer business subscription data can be further analyzed and determined.

[0132] The decision tree algorithm model is used to determine the historical business subscription data in the customer business subscription data before the target transaction time and within a preset number of subscriptions.

[0133] The decision tree algorithm model is used to determine whether the historical business subscription data contains the target transaction belonging to a business. The determination of whether the historical business subscription data contains the target transaction belonging to a business is mainly used to determine whether the target transaction data involves a change in the business subscription. Generally, a network threat will change the business subscription signed by the customer to achieve greater benefits.

[0134] The decision tree algorithm model is used to output the abnormal result corresponding to the target transaction data according to the customer location information entropy, the determination result of whether the target transaction object is an abnormal transaction object, and the result of whether the historical business subscription data contains the target transaction belonging to a business.

[0135] In this embodiment, the determination can be made from multiple dimensions such as the customer location information entropy, the determination result of whether the target transaction object is an abnormal transaction object, and the result of whether the historical business subscription data contains the target transaction belonging to a business. Whether it is a continuous transaction state, the number of address regions involved by the network protocol address of the transaction data before the target transaction data, the network protocol address usage frequency, and the like can be added for further analysis and determination.

[0136] The embodiment is described by way of example only, and does not limit the number of analysis dimensions of the decision tree algorithm model.

[0137] Figure 4 The flowchart of the transaction data anomaly determination method provided by the third embodiment of the present application is shown in Figure 4 The transaction data anomaly determination method provided by the present embodiment is further refined on the basis of the transaction data anomaly determination method provided by the previous embodiment of the present application. The transaction data anomaly determination method provided by the present embodiment includes the following steps.

[0138] It should be noted that the target customer identification has a mapping relationship with the transaction account identification, the transaction customer number identification, and the channel customer number identification.

[0139] Step S301: Establish the mapping relationship between the target customer identification and the transaction account identification, the transaction customer number identification, and the channel customer number identification corresponding to the target customer.

[0140] Step S302: Obtain the first transaction-related data corresponding to the transaction account identification according to the transaction account identification.

[0141] Step S303: Obtain the second transaction-related data corresponding to the transaction customer number identification according to the transaction customer number identification.

[0142] Step S304: Obtain the third transaction-related data corresponding to the channel customer number identification according to the channel customer number identification.

[0143] Step S305: Generate the customer transaction-related data corresponding to the target customer identification according to the first transaction-related data, the second transaction-related data, and the third transaction-related data.

[0144] In the present embodiment, since the financial system has many data categories, the customer transaction data is relatively large, and there are many sub-identifications related to customer transactions, it is necessary to integrate and process the customer transaction-related data in advance.

[0145] The target customer identification can be the customer's ID number or other identity proof code. The transaction account identification can generally refer to the bank account in the financial industry, the transaction customer number identification can generally refer to the bank customer number, and the channel customer number identification can generally refer to the bank channel customer number.

[0146] The transaction-related data can include multiple dimensions, such as the signing table, the transaction table, and the login information table recorded by the financial system. As shown in Figure 5 Figure 5 ​For the association diagram of the contract table, the contract table includes the account contract trace table, the contract trace table and the channel contract trace table. The contract trace table records the contract time, the customer number of the contract customer and other basic information. The specific contract action, the contract account, the contract content and other information are in the account contract trace table and the channel contract trace table. The complete contract information including the contract customer, the contract time, the contract account, the contract action and the contract content can be obtained by respectively associating the contract trace table with the account contract table, the contract trace table with the channel contract table, and the final contract wide table is generated.

[0147] The transaction table is also similar. The channel transaction trace table, the super network transaction trace table, the transaction payment trace table, the dragon payment trace table and the suspended transaction table can be associated. These tables include the transaction account identifier, the transaction customer number identifier and the channel customer number identifier corresponding table.

[0148] The super network transaction flow table and the channel transaction flow table, the transaction payment flow table and the dragon payment flow table respectively exist intersection. First, the two groups of transfer transaction tables are associated through the flow number and the account number, which can complete the de-duplication processing of the intersection part record and avoid deriving a large number of duplicate records in subsequent various association tasks.

[0149] The transaction wide table can include transaction object data, such as transaction object account historical information cache table, transaction object name historical information cache table, terminal information cache table, secondary merchant identifier historical information cache table, secondary merchant name historical information cache table, primary merchant identifier historical information cache table and primary merchant name historical information cache table. The terminal can be a tablet computer, a mobile phone and the like.

[0150] Then the contract wide table, the transaction wide table and the login information table are merged into the final behavior wide table.

[0151] After generating the behavior wide table, the specific data can be associated according to the unique identifier of the customer. The unique identifier of the embodiment adopts the ID card number. The mapping relationship between the transaction account identifier, the transaction customer number identifier and the channel customer number identifier corresponding to the target customer is established through the ID card number, so as to generate the account-ID card number mapping table, the customer number-ID card number mapping table and the channel customer number-ID card number mapping table. As shown in the following table, the data with the standard account can be associated through the account-ID card number mapping table. The data with the standard customer number and unable to associate the ID card number through the account can be associated through the customer number-ID card number mapping table. The data with the standard channel customer number and unable to associate the ID card number through the account and the customer number can be associated through the channel customer number-ID card number mapping table. For the data that cannot be associated, the discarding mode is adopted. Figure 6

[0152] ​After the data is processed, the decision tree algorithm model can be trained, and the training process is as follows:

[0153] The training sample is obtained, and the training sample includes the historical customer transaction related data of the customer.

[0154] The training sample is input into the preset decision tree algorithm model to train the preset decision tree algorithm model.

[0155] Whether the preset decision tree algorithm model meets the convergence condition is judged by using the receiver operating characteristic curve.

[0156] The preset decision tree algorithm model meeting the convergence condition is determined as the trained decision tree algorithm model.

[0157] In the training process, the ROC curve (full name in English: receiver operating characteristic curve, Chinese: receiver operating characteristic curve) can be used to judge whether the convergence condition is met, and other error loss functions can also be used to judge.

[0158] The decision tree algorithm model can extract features including location features, transaction object features, and continuous transaction features. The location features can include the maximum number of regions of the previous network protocol address, wherein the previous behavior refers to the behavior within several hours before the current transaction behavior, the number of different regions using the same network protocol address, and the use frequency of the current network protocol address. The use frequency of the network protocol address, telephone number, etc. refers to the maximum number of customers from different regions using the network protocol address, which is divided into N parts, and N is adjusted according to the experiment, such as 32, 64, 128, etc.

[0159] The location features can also include the maximum entropy of the previous telephone number, and the geographical location information entropy of the telephone number is calculated through the overall distribution of the geographical location of the customers related to the telephone number in history, reflecting the dispersion of the customers using the telephone number in geographical location.

[0160] The number of IP-related provinces refers to the number of different provinces from which the people using the IP come from, and the use frequency of the related entity such as IP and telephone number refers to the maximum number of customers from different provinces using the entity, which is divided into N parts, and N is adjusted according to the experiment, such as 32, 64, 128, etc.

[0161] Figure 7 The structure diagram of the transaction data anomaly determination device provided by the fourth embodiment of the present application is shown in Figure 7 As shown in the figure, in this embodiment, the transaction data anomaly determination device 400 can be arranged in a financial system, and the transaction data anomaly determination device 400 includes:

[0162] The acquisition module 401 is configured to acquire target transaction data to be determined for an abnormal result.

[0163] The first determination module 402 is configured to determine a target customer identifier according to the target transaction data.

[0164] The second determination module 403 is configured to determine customer transaction related data of the target customer within a preset time period before a target transaction time according to the target customer identifier. The target transaction data includes the target transaction time.

[0165] The output module 404 is configured to input the target transaction data and the customer transaction related data into a decision tree algorithm model trained to convergence, to output an abnormal result corresponding to the target transaction data.

[0166] The transaction data abnormality determination apparatus provided in this embodiment can perform Figure 2 The technical solutions of the method embodiments shown in the description and the drawings are similar in principle and effects to the transaction data abnormality determination apparatus Figure 2 The technical solutions of the method embodiments shown in the description and the drawings are similar in principle and effects to the transaction data abnormality determination apparatus

[0167] The transaction data abnormality determination apparatus provided in this embodiment is further refined on the basis of the transaction data abnormality determination apparatus provided in the previous embodiment.

[0168] Optionally, in this embodiment, the customer transaction related data includes customer location portrait, historical transaction object data, and customer business contract data.

[0169] The output module 404 is specifically configured to:

[0170] The decision tree algorithm model is used to perform feature extraction on the customer location portrait and the historical transaction object data respectively, to generate corresponding location features and transaction object features. The decision tree algorithm model is used to output an abnormal result corresponding to the target transaction data according to the target transaction data, the location features, the transaction object features, and the customer business contract data.

[0171] Optionally, in this embodiment, the target transaction data further includes a target transaction location, target transaction object data, and a target transaction business.

[0172] When the output module 404 outputs an abnormal result corresponding to the target transaction data according to the target transaction data, the location features, the transaction object features, and the customer business contract data using the decision tree algorithm model, the output module 404 is specifically configured to:

[0173] The decision tree algorithm model is used to generate customer location information entropy according to the target transaction location and the location characteristics. The decision tree algorithm model is used to determine whether the target transaction object is an abnormal transaction object according to the target transaction object data and the transaction object characteristics. The decision tree algorithm model is used to output an abnormal result corresponding to the target transaction data according to the customer location information entropy, the determination result of whether the target transaction object is an abnormal transaction object, the target transaction business, and the customer business subscription data.

[0174] Optionally, in the embodiment, when the output module 404 is used to output an abnormal result corresponding to the target transaction data according to the customer location information entropy, the determination result of whether the target transaction object is an abnormal transaction object, the target transaction business, and the customer business subscription data by using the decision tree algorithm model, the output module 404 is specifically used for:

[0175] The decision tree algorithm model is used to determine historical business subscription data in the customer business subscription data before the target transaction time and within a preset subscription number of times. The decision tree algorithm model is used to determine whether the historical business subscription data contains the target transaction business. The decision tree algorithm model is used to output an abnormal result corresponding to the target transaction data according to the customer location information entropy, the determination result of whether the target transaction object is an abnormal transaction object, and the result of whether the historical business subscription data contains the target transaction business.

[0176] Optionally, in the embodiment, the target customer identifier has a mapping relationship with the transaction account identifier, the transaction customer number identifier, and the transaction customer number sub-identifier.

[0177] The transaction data abnormality determination apparatus 400 further includes:

[0178] The data association module is configured to establish a mapping relationship between the target customer identifier and the transaction account identifier, the transaction customer number identifier, and the channel customer number identifier corresponding to the target customer. The data association module is configured to obtain first transaction related data corresponding to the transaction account identifier according to the transaction account identifier. The data association module is configured to obtain second transaction related data corresponding to the transaction customer number identifier according to the transaction customer number identifier. The data association module is configured to obtain third transaction related data corresponding to the channel customer number identifier according to the channel customer number identifier. The data association module is configured to generate customer transaction related data corresponding to the target customer identifier according to the first transaction related data, the second transaction related data, and the third transaction related data.

[0179] Optionally, in the embodiment, the customer transaction related data further includes a customer historical transaction time.

[0180] The transaction data abnormality determination apparatus 400 further includes:

[0181] The judgment module is configured to determine whether a time difference between the target transaction time and the nearest customer historical transaction time is less than a preset difference threshold. If it is determined that the time difference is less than the preset difference threshold, it is determined that the state corresponding to the target transaction data is continuous transaction.

[0182] When the output module 404 inputs the target transaction data and customer transaction-related data into the convergent decision tree algorithm model, it is specifically used for:

[0183] The target transaction data, the corresponding status of the target transaction data (continuous transactions), and customer transaction-related data are input into the decision tree algorithm model trained until convergence.

[0184] Optionally, in this embodiment, the transaction data anomaly determination device 400 further includes:

[0185] The training module is used to acquire training samples, which include historical customer transaction data. These training samples are then input into a pre-defined decision tree algorithm model to train it. The receiver operating characteristic curve is used to determine whether the pre-defined decision tree algorithm model meets the convergence criteria. Pre-defined decision tree algorithm models that meet the convergence criteria are identified as the final convergent decision tree algorithm models.

[0186] The transaction data anomaly determination device provided in this embodiment can perform... Figures 2-6 The technical solution of the method embodiment shown has the same implementation principle and technical effect as... Figures 2-6 The methods and embodiments shown are similar and will not be described in detail here.

[0187] According to embodiments of the present invention, the present invention also provides an electronic device, a computer-readable storage medium, and a computer program product.

[0188] like Figure 8 As shown, Figure 8 This is a schematic diagram of the structure of an electronic device provided in the fifth embodiment of the present invention. The electronic device is intended for various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, blade servers, mainframe computers, and other suitable computers. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0189] like Figure 8 As shown, the electronic device includes a processor 501 and a memory 502. The various components are interconnected via different buses and can be mounted on a common motherboard or installed in other ways as needed. The processor can process instructions executed within the electronic device.

[0190] The memory 502 is the non-transitory computer-readable storage medium provided by the present invention. The memory stores instructions executable by at least one processor to cause the at least one processor to perform the transaction data anomaly determination method provided by the present invention. The non-transitory computer-readable storage medium of the present invention stores computer instructions for causing a computer to perform the transaction data anomaly determination method provided by the present invention.

[0191] Memory 502, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the program instructions / modules corresponding to the transaction data anomaly determination method in this embodiment of the invention (e.g., appendix). Figure 7 The acquisition module 401, the first determination module 402, the second determination module 403, and the output module 404 are shown. The processor 501 executes various functional applications and data processing of the electronic device by running non-transient software programs, instructions, and modules stored in the memory 502, thereby implementing the transaction data anomaly determination method in the above method embodiments.

[0192] In addition, this embodiment also provides a computer product, which, when the instructions in the computer product are executed by the processor of an electronic device, enables the electronic device to execute the transaction data anomaly determination method of the above embodiment.

[0193] Other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. The invention is intended to cover any variations, uses, or adaptations of the embodiments thereof that follow the general principles of the embodiments thereof and include common knowledge or customary techniques in the art not disclosed in the embodiments thereof.

[0194] It should be understood that the embodiments of the present invention are not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from their scope. The scope of the embodiments of the present invention is limited only by the appended claims.

Claims

1. A transaction data anomaly determination method characterized by, The method comprises: acquiring target transaction data to be determined as an abnormal result; determining a target customer identifier according to the target transaction data; determining customer transaction related data of the target customer within a preset time period before a target transaction time according to the target customer identifier; the target transaction data comprises the target transaction time; the customer transaction related data comprises a customer location portrait, historical transaction object data, and customer business signing data; using a decision tree algorithm model trained to convergence to perform feature extraction on the customer location portrait and the historical transaction object data respectively to generate corresponding location features and transaction object features; the customer location portrait is pre-constructed according to transaction location data of the customer within the preset time period before the target transaction time; the pre-construction process comprises extracting the customer original geographic location information and the customer transaction interactive behavior record, constructing a location interactive relationship graph with weights according to the customer original geographic location information and the customer transaction interactive behavior record, using a location propagation algorithm on the location interactive relationship graph to iteratively update the actual geographic location of the customer and the geographic location information of a terminal entity, and generating the customer location portrait according to the actual geographic location of the customer and the geographic location information of the terminal entity; using the decision tree algorithm model to output an abnormal result corresponding to the target transaction data according to the target transaction data, the location features, the transaction object features, and the customer business signing data.

2. The method of claim 1, wherein, the target transaction data further comprises a target transaction location, target transaction object data, and a target transaction business; the using the decision tree algorithm model to output an abnormal result corresponding to the target transaction data according to the target transaction data, the location features, the transaction object features, and the customer business signing data comprises: using the decision tree algorithm model to generate customer location information entropy according to the target transaction location and the location features; using the decision tree algorithm model to determine whether the target transaction object is an abnormal transaction object according to the target transaction object data and the transaction object features; using the decision tree algorithm model to output an abnormal result corresponding to the target transaction data according to the customer location information entropy, the determination result of whether the target transaction object is an abnormal transaction object, the target transaction business, and the customer business signing data.

3. The method of claim 2, wherein, the using the decision tree algorithm model to output an abnormal result corresponding to the target transaction data according to the customer location information entropy, the determination result of whether the target transaction object is an abnormal transaction object, the target transaction business, and the customer business signing data comprises: using the decision tree algorithm model to determine historical business signing data within a preset signing number before the target transaction time in the customer business signing data; using the decision tree algorithm model to determine whether the historical business signing data comprises the target transaction business; using the decision tree algorithm model to output an abnormal result corresponding to the target transaction data according to the customer location information entropy, the determination result of whether the target transaction object is an abnormal transaction object, and the result of whether the historical business signing data comprises the target transaction business.

4. The method of claim 3, wherein, The target customer identification has a mapping relationship with a transaction account identification, a transaction customer number identification, and a transaction customer number sub-identification; Before the target customer identification is determined according to the target transaction data, the method further includes: establishing a mapping relationship between the target customer identification and corresponding transaction account identification, transaction customer number identification, and channel customer number identification of the target customer; acquiring first transaction-related data corresponding to the transaction account identification according to the transaction account identification; acquiring second transaction-related data corresponding to the transaction customer number identification according to the transaction customer number identification; acquiring third transaction-related data corresponding to the channel customer number identification according to the channel customer number identification; generating customer transaction-related data corresponding to the target customer identification according to the first transaction-related data, the second transaction-related data, and the third transaction-related data.

5. The method of claim 1, wherein, The customer transaction-related data further includes historical transaction time of the customer; Before the target transaction data and the customer transaction-related data are input into the decision tree algorithm model trained to convergence, the method further includes: determining whether a time difference between the target transaction time and the latest historical transaction time of the customer is less than a preset difference threshold value; if it is determined that the time difference is less than the preset difference threshold value, determining that a corresponding state of the target transaction data is continuous transaction; inputting the target transaction data, the corresponding state of the target transaction data being continuous transaction, and the customer transaction-related data into the decision tree algorithm model trained to convergence. Before the target transaction data and the customer transaction-related data are input into the decision tree algorithm model trained to convergence, the method further includes:

6. The method according to any one of claims 1 to 5, characterized in that, acquiring a training sample, the training sample including historical customer transaction-related data of the customer; inputting the training sample into a preset decision tree algorithm model to train the preset decision tree algorithm model; determining whether the preset decision tree algorithm model meets a convergence condition by using a receiver operating characteristic curve; determining the preset decision tree algorithm model meeting the convergence condition as the decision tree algorithm model trained to convergence. includes:

7. A transaction data abnormality determination apparatus characterized by comprising: an acquisition module, configured to acquire target transaction data to be determined for an abnormal result; a first determination module, configured to determine a target customer identification according to the target transaction data; a second determination module, configured to determine customer transaction-related data of a target customer within a preset time period before a target transaction time according to the target customer identification; the target transaction data includes the target transaction time; the customer transaction-related data includes customer location portrait, historical transaction object data, and customer business signing data; an output module, configured to use the decision tree algorithm model trained to convergence, ​ The customer location portrait and the historical transaction object data are respectively subjected to feature extraction to generate corresponding location features and transaction object features; the customer location portrait is obtained by pre-construction according to transaction location data of the customer within a preset time period before the target transaction time; the pre-construction process comprises: extracting the original geographic location information of the customer and the interaction behavior record at the transaction time of the customer, constructing a weighted location interaction relationship graph according to the original geographic location information of the customer and the interaction behavior record at the transaction time of the customer, adopting a location propagation algorithm on the location interaction relationship graph, iteratively updating the actual geographic location of the customer and the geographic location information of the terminal entity, and generating the customer location portrait according to the actual geographic location of the customer and the geographic location information of the terminal entity; The decision tree algorithm model is adopted to output an abnormal result corresponding to the target transaction data according to the target transaction data, the location features, the transaction object features and the customer business signing data.

8. An electronic device, comprising: It comprises: a processor and a memory connected in communication with the processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to realize the transaction data abnormality determination method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to realize the transaction data abnormality determination method according to any one of claims 1 to 6.

10. A computer program product comprising a computer program, characterized in that, The computer program is executed by the processor to realize the transaction data abnormality determination method according to any one of claims 1 to 6.

Images