An abnormal transaction behavior detection method, system, electronic device and storage medium

Abstract

The application provides an abnormal transaction behavior detection method and system, an electronic device and a storage medium. The method comprises: obtaining business data, generating user information data files and enterprise information data files according to the business data; generating user behavior portraits and enterprise behavior portraits according to preset statistical rules, the user information data files and the enterprise information data files; when a target user and a target enterprise initiate a transaction request, determining target user behavior data according to the target user and target enterprise behavior data according to the target enterprise; matching the target user behavior data and the target enterprise behavior data with preset matching rules to determine a risk level corresponding to the transaction request, and updating the user behavior portraits and the enterprise behavior portraits according to the risk level. The behavior portraits solve the problems of data timeliness, the inability of multiple data to form a unity and the inability of rules to be dynamically configured and processed, realize real-time abnormal monitoring, optimize reasoning efficiency, reduce transaction risks and improve security.

Description

Technical Field

[0001] This application relates to the field of abnormal behavior detection, and in particular to a method, system, electronic device, and storage medium for detecting abnormal transaction behavior. Background Technology

[0002] In today's world of diversified businesses, diverse data, and massive data volumes, cross-interaction requests from multiple systems and data sources can put pressure on the system architecture to collapse, and there may be transaction risks between users and enterprises.

[0003] Risk control refers to the various measures and methods taken by risk managers to eliminate or reduce the likelihood of risk events occurring, or to reduce the losses caused by risk events when they do occur. However, understanding the general situation of users or enterprises is an extremely complex task, placing very high demands on data collection, organization, and synchronization. It requires synchronized storage and archiving of different business processes, different data, and different documents to meet the requirements of rapid response.

[0004] How to leverage the advantages of the Drools rule engine to change the traditional development approach of handling business logic in a procedural manner, and separate business logic from application code to achieve unified management, is a technical problem that needs to be solved.

[0005] The technical problem that needs to be solved is how to leverage Flume's advantages in data collection and synchronization to change the traditional method of supplementing data, and manage data from multiple systems, data sources, methods, and nodes in a unified way using tag profiles. Summary of the Invention

[0006] In view of the aforementioned problems, this application is made to provide an abnormal behavior detection method, system, electronic device, and storage medium that overcomes or at least partially solves the aforementioned problems, comprising:

[0007] An abnormal behavior detection method is provided, which is used to control abnormal transaction behavior of users and enterprises.

[0008] The method includes:

[0009] Acquire business data, and generate user information data files and enterprise information data files based on the business data;

[0010] Based on preset statistical rules, the user information data file, and the enterprise information data file, a user behavior profile corresponding to the user information data file and an enterprise behavior profile corresponding to the enterprise information data file are generated.

[0011] When a target user and a target enterprise initiate a transaction request, target user behavior data corresponding to the user behavior profile is determined based on the target user, and target enterprise behavior data corresponding to the enterprise behavior profile is determined based on the target enterprise.

[0012] The target user behavior data and the target enterprise behavior data are matched with preset matching rules to determine the risk level corresponding to the transaction request, and the user behavior profile and the enterprise behavior profile are updated according to the risk level.

[0013] Furthermore, the step of acquiring business data and generating user information data files and enterprise information data files based on the business data includes:

[0014] Determine whether the business data is business data that conforms to a preset standard;

[0015] If yes, then the business data is used to generate the user information data file and the enterprise information data file in a preset format; if not, then the business data is cleaned to generate the user information data file and the enterprise information data file in a preset format.

[0016] Furthermore, the step of cleaning the business data and generating the user information data file and enterprise information data file in a preset format includes:

[0017] The business data is segmented to generate segmented business data;

[0018] Empty strings are removed from the segmented business data to generate removed business data;

[0019] The excluded business data is assembled to generate the user information data file and the enterprise information data file in a preset format.

[0020] Further, the steps of generating user behavior profiles corresponding to the user information data file and enterprise behavior profiles corresponding to the enterprise information data file based on preset statistical rules, the user information data file, and the enterprise information data file include:

[0021] Store the user information data file and the enterprise information data file into the file system;

[0022] The user information data file and the enterprise information data file are analyzed according to preset statistical rules to generate user behavior profiles corresponding to the user information data file and enterprise behavior profiles corresponding to the enterprise information data file.

[0023] Further, the step of analyzing the user information data file and the enterprise information data file according to preset statistical rules to generate a user behavior profile corresponding to the user information data file and an enterprise behavior profile corresponding to the enterprise information data file:

[0024] The storage paths of the user information data file and the enterprise information data file are determined according to preset statistical rules;

[0025] Based on the storage paths of the user information data file and the enterprise information data file, the user information data file and the enterprise information data file are stored in the corresponding tag library to generate user behavior profiles corresponding to the user information data file and enterprise behavior profiles corresponding to the enterprise information data file;

[0026] The user behavior profile and the enterprise behavior profile are stored in the database.

[0027] Further, the step of matching the target user behavior data and the target enterprise behavior data with preset matching rules to determine the risk level corresponding to the transaction request, and updating the user behavior profile and the enterprise behavior profile respectively according to the risk level, includes:

[0028] Determine preset matching rules; wherein, the preset matching rules include rule code, rule name, business domain, rule conditions, rule threshold, and rule description;

[0029] The target user behavior data and the target enterprise behavior data are matched with preset matching rules to generate matching results corresponding to the transaction request;

[0030] The risk level is determined based on the matching results, and the user behavior profile and the enterprise behavior profile are updated based on the risk level.

[0031] Further, the step of determining the risk level based on the matching result, and updating the user behavior profile and the enterprise behavior profile based on the risk level, includes:

[0032] When the risk level reaches the preset level, the transaction request is judged as abnormal and marked, and the marked risk level is stored in the user behavior profile and the enterprise behavior profile respectively.

[0033] The type of follow-up visit is determined based on the target user and the target enterprise;

[0034] or;

[0035] When the risk level is less than the preset level, the transaction data of the target user and the target enterprise are obtained, and the transaction data and the risk level are stored in the user behavior profile and the enterprise behavior profile, respectively.

[0036] An abnormal transaction behavior detection system is provided for controlling abnormal transaction behaviors of users and enterprises.

[0037] The system includes:

[0038] The cleaning module is used to acquire business data and generate user information data files and enterprise information data files based on the business data;

[0039] The profiling module is used to generate user behavior profiles corresponding to the user information data file and enterprise behavior profiles corresponding to the enterprise information data file based on preset statistical rules, the user information data file, and the enterprise information data file;

[0040] The query module is used to determine the target user behavior data corresponding to the user behavior profile and the target enterprise behavior data corresponding to the enterprise behavior profile based on the target user and the target enterprise behavior data based on the target enterprise when the target user and the target enterprise initiate a transaction request.

[0041] The matching module is used to match the target user behavior data and the target enterprise behavior data with preset matching rules, determine the risk level corresponding to the transaction request, and update the user behavior profile and the enterprise behavior profile according to the risk level.

[0042] A computer device includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the steps of an abnormal behavior detection method as described above.

[0043] A computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of an abnormal behavior detection method as described above.

[0044] This application has the following advantages:

[0045] In the embodiments of this application, business data is acquired, and user information data files and enterprise information data files are generated based on the business data. User behavior profiles corresponding to the user information data files and enterprise behavior profiles corresponding to the enterprise information data files are generated based on preset statistical rules, the user information data files, and the enterprise information data files. When a target user and a target enterprise initiate a transaction request, target user behavior data corresponding to the user behavior profile and target enterprise behavior data corresponding to the enterprise behavior profile are determined based on the target user and the enterprise behavior data corresponding to the enterprise behavior profile, respectively. The target user behavior data and the target enterprise behavior data are matched with preset matching rules to determine the risk level corresponding to the transaction request, and the user behavior profile and the enterprise behavior profile are updated according to the risk level. By performing behavioral profile inductive analysis and using behavioral profiles for real-time data analysis, the problems of data timeliness, inability to unify multiple data sets, and inability to dynamically configure and process rules are solved. This enables real-time anomaly monitoring, optimizes the inference efficiency of the risk control system, reduces transaction risk, improves the anti-money laundering security of transaction orders, reduces the pressure of manual review, and improves system reliability. Attached Figure Description

[0046] To more clearly illustrate the technical solution of this application, the drawings used in the description of this application will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 This is a flowchart illustrating the steps of an abnormal transaction behavior detection method provided in an embodiment of this application;

[0048] Figure 2 This is a schematic diagram of a data collection structure provided in an embodiment of this application;

[0049] Figure 3 This is a schematic diagram of a Rete algorithm for matching Drools provided in an embodiment of this application;

[0050] Figure 4 This is a schematic flowchart of a risk control sequence provided in an embodiment of this application;

[0051] Figure 5 This is a structural block diagram of an abnormal transaction behavior detection system provided in one embodiment of this application;

[0052] Figure 6 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0053] To make the objectives, features, and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without inventive effort are within the scope of protection of this application.

[0054] It should be noted that, in any embodiment of the present invention, the abnormal behavior detection system includes an application layer, a database, and external Qichacha data. The application layer adopts a B / S (Browser / Server, i.e., browser-side / server-side application) and C / S (Client / Server, i.e., client-side / server) architecture to enable users and enterprises to enter data. The database uses MySQL, MongoDB, and Hive to store user and enterprise data. The external Qichacha data uses scheduled tasks to query the enterprise's operating status and business scope.

[0055] Reference Figure 1 This application illustrates an embodiment of an abnormal transaction behavior detection method, which is used to monitor abnormal transaction behaviors of users and enterprises.

[0056] The method includes:

[0057] S110. Obtain business data, and generate user information data file and enterprise information data file based on the business data;

[0058] S120. Generate a user behavior profile corresponding to the user information data file and an enterprise behavior profile corresponding to the enterprise information data file based on preset statistical rules, the user information data file and the enterprise information data file;

[0059] S130. When a target user and a target enterprise initiate a transaction request, target user behavior data corresponding to the user behavior profile is determined based on the target user, and target enterprise behavior data corresponding to the enterprise behavior profile is determined based on the target enterprise.

[0060] S140. Match the target user behavior data and the target enterprise behavior data with preset matching rules to determine the risk level corresponding to the transaction request, and update the user behavior profile and the enterprise behavior profile according to the risk level.

[0061] In the embodiments of this application, business data is acquired, and user information data files and enterprise information data files are generated based on the business data. User behavior profiles corresponding to the user information data files and enterprise behavior profiles corresponding to the enterprise information data files are generated based on preset statistical rules, the user information data files, and the enterprise information data files. When a target user and a target enterprise initiate a transaction request, target user behavior data corresponding to the user behavior profile and target enterprise behavior data corresponding to the enterprise behavior profile are determined based on the target user and the enterprise behavior data corresponding to the enterprise behavior profile, respectively. The target user behavior data and the target enterprise behavior data are matched with preset matching rules to determine the risk level corresponding to the transaction request, and the user behavior profile and the enterprise behavior profile are updated according to the risk level. By performing behavioral profile inductive analysis and using behavioral profiles for real-time data analysis, the problems of data timeliness, inability to unify multiple data sets, and inability to dynamically configure and process rules are solved. This enables real-time anomaly monitoring, optimizes the inference efficiency of the risk control system, reduces transaction risk, improves the anti-money laundering security of transaction orders, reduces the pressure of manual review, and improves system reliability.

[0062] The following will further describe an abnormal behavior detection method in this exemplary embodiment.

[0063] As described in step S110, business data is acquired, and user information data files and enterprise information data files are generated based on the business data.

[0064] In one embodiment of the present invention, the specific process of "acquiring business data and generating user information data file and enterprise information data file based on the business data" in step S110 can be further described in conjunction with the following description.

[0065] As described in the following steps, determine whether the business data is business data that conforms to a preset standard;

[0066] If the above steps are true, then the business data will be used to generate the user information data file and the enterprise information data file in a preset format; otherwise, the business data will be cleaned to generate the user information data file and the enterprise information data file in a preset format.

[0067] As an example, refer to Figure 2This diagram illustrates a data collection structure provided in this embodiment. Raw business data, such as user and enterprise behavior logs, consumption logs, and consumption data, are collected via Flume. Alternatively, in B / S and C / S architectures, the xxl-job distributed task scheduling platform is used to query whether a user is on a blacklist, whitelist, graylist, or blacklist of dishonest individuals using their ID card at a preset frequency, collecting user data and storing it in a user behavior profile database; and the xxl-job distributed task scheduling platform is also used to query the business status and scope of an enterprise based on its credit code at a preset frequency, collecting enterprise data and storing it in an enterprise behavior profile database.

[0068] The obtained business data is cleaned using the distributed computing framework MapReduce (a programming model for parallel computation of large datasets) to generate the user information data file and the enterprise information data file. The user information data file and the enterprise information data file are then stored in the HDFS (Hadoop Distributed File System, which stores very large files in a streaming data access mode) file system (e.g., / hdfs / input).

[0069] The user information data file includes: a population attribute data file, an interest characteristic data file, a consumption characteristic data file, a location characteristic data file, and a device attribute data file; the enterprise information data file includes: an enterprise basic information attribute data file, a legal litigation attribute data file, an operational risk attribute data file, and an operational information attribute data file.

[0070] It should be noted that Flume is a highly available, highly reliable, distributed system for collecting, aggregating, and transmitting massive amounts of logs. Flume supports customizing various data senders in the log system for data collection; at the same time, Flume provides the ability to perform simple data processing and write to various data receivers (which can be customized).

[0071] In one specific implementation, when the collected business data is of a preset standard, the business data is used to generate user information data files and enterprise information data files according to a preset format, and stored in the directory monitored by Flume.

[0072] In one specific implementation, when the collected business data is an irregular log file or file, the MapReduce data is used to clean the above business data, generate the user information data file and enterprise information data file in the preset format, and store them in the directory monitored by Flume.

[0073] In one embodiment of the present invention, the specific process of "cleaning the business data and generating the user information data file and enterprise information data file in a preset format" can be further described in conjunction with the following description.

[0074] The business data is segmented as described in the following steps to generate segmented business data;

[0075] As described in the following steps, empty strings are removed from the segmented business data to generate removed business data;

[0076] As described in the following steps, the excluded business data is assembled to generate the user information data file and the enterprise information data file in a preset format.

[0077] In one specific implementation, the cleaning steps are as follows:

[0078] a. Split the business data into rows to generate split business data, such as (String[] strs = value.toString().split(""););

[0079] b. Remove empty strings from the segmented business data. Generate the removed business data by replacing the fields. The replacement method is (strs[i].replace("","");

[0080] c. Assemble the required data from the excluded business data using subscripts, such as strs[i];

[0081] d. Output the assembled data content, such as context.write(new Text(newWords), NullWritable.get());

[0082] As described in step S120, user behavior profiles corresponding to the user information data file and enterprise behavior profiles corresponding to the enterprise information data file are generated based on preset statistical rules, the user information data file, and the enterprise information data file.

[0083] In one embodiment of the present invention, the specific process of "generating a user behavior profile corresponding to the user information data file and an enterprise behavior profile corresponding to the enterprise information data file based on preset statistical rules, the user information data file and the enterprise information data file" in step S120 can be further described in conjunction with the following description.

[0084] As described in the following steps, store the user information data file and the enterprise information data file into the file system;

[0085] As described in the following steps, the user information data file and the enterprise information data file are analyzed according to preset statistical rules to generate user behavior profiles corresponding to the user information data file and enterprise behavior profiles corresponding to the enterprise information data file.

[0086] In one embodiment of the present invention, the specific process of "analyzing the user information data file and the enterprise information data file according to preset statistical rules to generate a user behavior profile corresponding to the user information data file and an enterprise behavior profile corresponding to the enterprise information data file" can be further described in conjunction with the following description.

[0087] As described in the following steps, the storage paths of the user information data file and the enterprise information data file are determined according to preset statistical rules;

[0088] As described in the following steps, the user information data file and the enterprise information data file are stored in the corresponding tag library according to the storage path of the user information data file and the storage path of the enterprise information data file, thereby generating a user behavior profile corresponding to the user information data file and an enterprise behavior profile corresponding to the enterprise information data file;

[0089] As described in the following steps, the user behavior profile and the enterprise behavior profile are stored in the database.

[0090] As an example, after data cleaning, the field information of the user information data file and the enterprise information data file is stored in the HDFS file system. HDFS imports the user information data file and the enterprise information data file into Hive. Hive performs statistical analysis on the user information data file and the enterprise information data file according to the dimensions of year, month, and day. The statistical results of the user information data file and the enterprise information data file are stored in the corresponding Hive tag library, generating user behavior profiles corresponding to the user information data file and enterprise behavior profiles corresponding to the enterprise information data file. The user behavior profiles and enterprise behavior profiles are exported from the Hive database using the sqoop export method and synchronized to the information warehouse MySQL database, making the data available for external systems to access. External applications can obtain the corresponding behavior profiles based on the unique identifier code.

[0091] It's important to note that Hive is a data warehouse tool based on Hadoop, used for data extraction, transformation, and loading. It's a mechanism for storing, querying, and analyzing large-scale data stored in Hadoop. Sqoop is an open-source tool primarily used for transferring data between Hadoop (Hive) and traditional databases (MySQL, PostgreSQL, etc.). It can import data from a relational database (e.g., MySQL, Oracle, Postgres) into Hadoop's HDFS, and vice versa.

[0092] In one specific implementation, the incoming file is stored in Hive according to its file attributes. Specifically:

[0093] The first step is to create a new table in Hive to store the data from HDFS. The code for creating the table is as follows: `hive -e "CREATE TABLE IF NOT EXISTS table(user_id STRING,name STRING,score STRING)rowformat delimited fields terminated by ','";`

[0094] The second step is to write the HDFS data into the prepared Hive table. To write data, you first need to know the data storage path. Note down the data storage path, and use `hive -e "load data inpath' / hdfs / input' into table` to write the data into Hive, corresponding to the database table name.

[0095] As described in step S130, when a target user and a target enterprise initiate a transaction request, target user behavior data corresponding to the user behavior profile is determined based on the target user, and target enterprise behavior data corresponding to the enterprise behavior profile is determined based on the target enterprise.

[0096] In one embodiment of the present invention, the specific process of step S130, "when a target user and a target enterprise initiate a transaction request, the target user behavior data corresponding to the user behavior profile is determined based on the target user, and the target enterprise behavior data corresponding to the enterprise behavior profile is determined based on the target enterprise," can be further explained in conjunction with the following description.

[0097] As an example, utilizing B / S and C / S architectures, when a target user and a target enterprise initiate a transaction request, the business system determines target user behavior data corresponding to the user behavior profile based on the target user, and target enterprise behavior data corresponding to the enterprise behavior profile based on the target enterprise. This data is then supplemented by a data collection system and uniformly transmitted to the risk control system to provide real-time data support. The target user behavior data includes the target user's transaction amount, ID card number, mobile phone number, bank card number, monthly disbursement amount, and cumulative disbursement amount, while the target enterprise behavior data includes the target enterprise's basic information and enterprise nature.

[0098] As described in step S140, the target user behavior data and the target enterprise behavior data are matched with preset matching rules to determine the risk level corresponding to the transaction request, and the user behavior profile and the enterprise behavior profile are updated according to the risk level.

[0099] In one embodiment of the present invention, the specific process of step S140, which involves "matching the target user behavior data and the target enterprise behavior data with preset matching rules to determine the risk level corresponding to the transaction request, and updating the user behavior profile and the enterprise behavior profile according to the risk level", can be further explained in conjunction with the following description.

[0100] As described in the following steps, a preset matching rule is determined; wherein the preset matching rule includes a rule code, a rule name, a business domain, rule conditions, a rule threshold, and a rule description;

[0101] As described in the following steps, the target user behavior data and the target enterprise behavior data are matched with preset matching rules to generate a matching result corresponding to the transaction request;

[0102] As described in the following steps, the risk level is determined based on the matching result, and the user behavior profile and the enterprise behavior profile are updated according to the risk level.

[0103] As an example, preset matching rules are defined on the B / S architecture page, and object file packages corresponding to the preset matching rules are generated in the development environment. Specifically, the preset matching rules are defined on the rule definition page, including: filling in the rule code, rule name, business domain, rule conditions, rule threshold, and rule description.

[0104] Service deployment and startup are performed using the Drools rule engine, publishing preset matching rules as publicly available Dubbo services. Business logic is handled through the Drools rule engine, separating it from application code for unified management. This enables rapid response to complex and rapidly changing risk control rules, improving the flexibility of the business system.

[0105] It's worth noting that Drools is an open-source business rules engine that offers easy access to enterprise policies, is easy to adjust, and is easy to manage. It conforms to industry standards and is fast and efficient. Business analysts or auditors can use it to easily view business matching rules, thereby verifying whether the coded rules are executing the required business matching rules.

[0106] As an example, refer to Figure 4 This diagram illustrates a Drools Rete algorithm for matching provided in this embodiment. The Drools inference engine of the risk control system uses the Rete algorithm to match the target user behavior data and the target enterprise behavior data with the preset matching rules in the rule base to obtain a risk level conclusion corresponding to the current transaction request. The risk level is then sent to the review system, which distributes the data to different levels of review (human review or machine review) for supplementary review based on the reported risk level.

[0107] In one specific implementation, the matching rules are as follows:

[0108] IF:

[0109] User credit rating

[0110] The user made more than 3 purchases on the same day.

[0111] The user's total spending on that day exceeded 100,000.

[0112] More than 30% of users receive payments from the same merchant.

[0113] THEN:

[0114] This involves money laundering and requires manual review.

[0115] Matching process:

[0116] The flow order of the network nodes during the matching process is: A->B->C->D->E;

[0117] A RiskFact object to be matched is retrieved from the working memory. After entering from the root node, pattern matching is performed. The following is the activity graph of the fact in each node.

[0118] Node A: Takes the user credit rating from the input parameter RiskFact and compares it with the user credit rating of the rules. If the conditions are met, the user credit rating record is added to the working memory area, and then the user credit rating matching is exited.

[0119] Node B: Compares the number of user transactions with the rule-based user transaction count using the input parameter RiskFact. If the conditions are met, the user transaction count record is added to the working memory area, and then the user transaction count matching is exited.

[0120] C node: Takes the total user spending amount from the input parameter RiskFact and compares it with the total user spending amount according to the rules. If it meets the conditions, it adds the total user spending amount record to the working memory area and then exits the total user spending amount matching.

[0121] Node D: Takes the percentage of the same merchant receiving payment from the input parameter RiskFact and compares it with the percentage of the same merchant receiving payment according to the rules. If the conditions are met, the record of the percentage of the same merchant receiving payment payment is added to the working memory range, and then the matching of the percentage of the same merchant receiving payment payment payment is exited.

[0122] E-node: If the user's credit rating, number of user transactions, total user spending amount, and percentage of the same merchant as the receiving merchant all meet the conditions, it means that the RiskFact object matches the rule, forming a decision. The result of executing the condition: This involves money laundering and requires manual review.

[0123] In one embodiment of the present invention, the specific process of "determining the risk level based on the matching result, and updating the user behavior profile and the enterprise behavior profile based on the risk level" can be further explained in conjunction with the following description.

[0124] As described in the following steps, when the risk level reaches the preset level, the transaction request is judged as abnormal and marked, and the marked risk level is stored in the user behavior profile and the enterprise behavior profile respectively;

[0125] As described in the following steps, determine the type of follow-up visit based on the target user and the target enterprise;

[0126] or;

[0127] As described in the following steps, when the risk level is less than the preset level, the transaction data of the target user and the target enterprise are obtained, and the transaction data and the risk level are stored in the user behavior profile and the enterprise behavior profile, respectively.

[0128] As an example, when the risk level reaches the preset level, the transaction between the target user and the target company is rejected, the risk level is marked and stored in the MySQL database, and a follow-up visit is conducted on the target user and the target company based on the risk level. The follow-up visit types are automatic telephone follow-up and manual review follow-up.

[0129] As an example, when the risk level is less than the preset level, the target user and the target enterprise are allowed to transact. After the current user's consumption behavior is completed, the transaction data is archived in the consumption feature file of the user information data file; the consumption is also archived in the enterprise's business information attribute data file of the enterprise information data file.

[0130] Reference Figure 5 This is a risk control sequence diagram provided in one embodiment of this application. The abnormal behavior detection system of this application includes a client, a business system, a real-time risk control system, a customer service system, a data warehouse system, and a data collection system. Target users and target enterprises initiate transactions with the business system through the client. The business system queries relevant information of target users and target enterprises in the data warehouse system. The real-time risk control system pushes real-time data to the business system for business processing. The business system determines whether the customer service system should review the transaction based on the matching results. The client and business system synchronize the results and collect the results into the data collection system.

[0131] As the system implementation is basically similar to the method implementation, it is described in a relatively simple way. For relevant details, please refer to the description of the method implementation.

[0132] Reference Figure 5 This application illustrates an embodiment of an abnormal transaction behavior detection system, which is used to manage abnormal transaction behaviors of users and enterprises.

[0133] Specifically, it includes:

[0134] The cleaning module 510 is used to acquire business data and generate user information data files and enterprise information data files based on the business data;

[0135] The profiling module 520 is used to generate a user behavior profile corresponding to the user information data file and an enterprise behavior profile corresponding to the enterprise information data file based on preset statistical rules, the user information data file and the enterprise information data file;

[0136] The query module 530 is used to determine the target user behavior data corresponding to the user behavior profile and the target enterprise behavior data corresponding to the enterprise behavior profile based on the target user and the target enterprise behavior data based on the target enterprise when the target user and the target enterprise initiate a transaction request.

[0137] The matching module 540 is used to match the target user behavior data and the target enterprise behavior data with preset matching rules, determine the risk level corresponding to the transaction request, and update the user behavior profile and the enterprise behavior profile according to the risk level.

[0138] In one embodiment of the present invention, the cleaning module 510 includes:

[0139] The standard business data determination submodule is used to determine whether the business data is business data of a preset standard.

[0140] The cleaning and judgment submodule is used to generate the user information data file and the enterprise information data file in a preset format from the business data if the condition is met; otherwise, the business data is cleaned to generate the user information data file and the enterprise information data file in a preset format.

[0141] In one embodiment of the present invention, the cleaning determination submodule includes:

[0142] A segmentation unit is used to segment the business data to generate segmented business data;

[0143] The elimination unit is used to remove empty strings from the segmented business data to generate eliminated business data.

[0144] An assembly unit is used to assemble the excluded business data to generate the user information data file and the enterprise information data file in a preset format.

[0145] In one embodiment of the present invention, the portrait module 520 includes:

[0146] The first storage submodule is used to store the user information data file and the enterprise information data file into the file system;

[0147] The analysis submodule is used to analyze the user information data file and the enterprise information data file according to preset statistical rules, and generate user behavior profiles corresponding to the user information data file and enterprise behavior profiles corresponding to the enterprise information data file.

[0148] In one embodiment of the present invention, the analysis submodule includes:

[0149] The storage path determination unit is used to determine the storage path of the user information data file and the enterprise information data file according to preset statistical rules;

[0150] The second storage unit is used to store the user information data file and the enterprise information data file into the corresponding tag library according to the storage path of the user information data file and the storage path of the enterprise information data file, and generate a user behavior profile corresponding to the user information data file and an enterprise behavior profile corresponding to the enterprise information data file.

[0151] The third storage unit is used to store the user behavior profile and the enterprise behavior profile into the database.

[0152] In one embodiment of the present invention, the matching module 540 includes:

[0153] The matching rule determination submodule is used to determine preset matching rules; wherein, the preset matching rules include rule code, rule name, business domain, rule conditions, rule threshold and rule description;

[0154] The matching result generation submodule is used to match the target user behavior data and the target enterprise behavior data with preset matching rules to generate matching results corresponding to the transaction request;

[0155] The update submodule is used to determine the risk level based on the matching result, and update the user behavior profile and the enterprise behavior profile respectively based on the risk level.

[0156] In one embodiment of the present invention, the update submodule includes:

[0157] The marking unit is used to determine the transaction request as abnormal and mark it when the risk level reaches the preset level, and to store the marked risk level in the user behavior profile and the enterprise behavior profile respectively.

[0158] The follow-up unit is used to determine the follow-up type based on the target user and the target enterprise;

[0159] or;

[0160] The transaction unit is used to acquire transaction data of the target user and the target enterprise when the risk level is less than the preset level, and to store the transaction data and the risk level in the user behavior profile and the enterprise behavior profile, respectively.

[0161] Reference Figure 6 The computer device illustrating the abnormal transaction behavior detection method of the present invention may specifically include the following:

[0162] The computer device 12 described above is in the form of a general-purpose computing device. The components of the computer device 12 may include, but are not limited to: one or more processors or processing units 16, system memory 28, and bus 18 connecting different system components (including system memory 28 and processing unit 16).

[0163] Bus 18 refers to one or more of several types of bus 18 architectures, including memory bus 18 or memory controller, peripheral bus 18, graphics acceleration port, processor, or local bus 18 using any of the various bus 18 architectures. For example, these architectures include, but are not limited to, Industry Standard Architecture (ISA) bus 18, Micro Channel Architecture (MAC) bus 18, Enhanced ISA bus 18, Audio / Video Electronics Standards Association (VESA) local bus 18, and Peripheral Component Interconnect (PCI) bus 18.

[0164] Computer device 12 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by computer device 12, including volatile and non-volatile media, removable and non-removable media.

[0165] System memory 28 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 30 and / or cache memory 32. Computer device 12 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 34 may be used to read and write non-removable, non-volatile magnetic media (commonly referred to as a "hard disk drive"). Figure 6 Not shown, a disk drive for reading and writing to a removable non-volatile disk (such as a "floppy disk") and an optical disk drive for reading and writing to a removable non-volatile optical disk (such as a CD-ROM, DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to bus 18 via one or more data media interfaces. The memory may include at least one program product having a set (e.g., at least one) of program modules 42 configured to perform the functions of the embodiments of the present invention.

[0166] A program / utility 40 having a set (at least one) of program modules 42 may be stored, for example, in memory. Such program modules 42 include—but are not limited to—an operating system, one or more application programs, other program modules 42, and program data. Each or some combination of these examples may include an implementation of a network environment. Program modules 42 typically perform the functions and / or methods described in the embodiments of the present invention.

[0167] Computer device 12 can also communicate with one or more external devices 14 (e.g., keyboard, pointing device, display 24, camera, etc.), and with one or more devices that enable an operator to interact with the computer device 12, and / or with any device that enables the computer device 12 to communicate with one or more other computing devices (e.g., network card, modem, etc.). This communication can be performed through input / output (I / O) interface 22. Furthermore, computer device 12 can also communicate with one or more networks (e.g., local area network (LAN)), wide area network (WAN), and / or public networks (e.g., the Internet) via network adapter 20. As shown, network adapter 20 communicates with other modules of computer device 12 via bus 18. It should be understood that, although... Figure 6 Not shown, it can be combined with computer device 12 to use other hardware and / or software modules, including but not limited to: microcode, device drivers, redundant processing unit 16, external disk drive array, RAID system, tape drive and data backup storage system 34, etc.

[0168] The processing unit 16 executes various functional applications and data processing by running programs stored in the system memory 28, such as implementing an abnormal transaction behavior detection method provided in the embodiments of the present invention.

[0169] That is, when the processing unit 16 executes the above procedure, it achieves the following: by acquiring business data, and generating user information data files and enterprise information data files based on the business data; generating user behavior profiles corresponding to the user information data files and enterprise behavior profiles corresponding to the enterprise information data files based on preset statistical rules, the user information data files, and the enterprise information data files; when a target user and a target enterprise initiate a transaction request, determining target user behavior data corresponding to the user behavior profile based on the target user and target enterprise behavior data corresponding to the enterprise behavior profile based on the target enterprise; matching the target user behavior data and the target enterprise behavior data with preset matching rules to determine the risk level corresponding to the transaction request, and updating the user behavior profile and the enterprise behavior profile respectively based on the risk level. By performing behavioral profile inductive analysis and using behavioral profiles for real-time data analysis, the problems of data timeliness, inability to form a unified dataset, and inability to dynamically configure and process rules are solved, enabling real-time anomaly monitoring, optimizing the inference efficiency of the risk control system, reducing transaction risks, improving the anti-money laundering security of transaction orders, reducing the pressure of manual review, and improving system reliability.

[0170] In this embodiment of the invention, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements an abnormal transaction behavior detection method as provided in all embodiments of this application:

[0171] In other words, when the program is executed by the processor, it performs the following: It acquires business data and generates user information data files and enterprise information data files based on the business data; it generates user behavior profiles corresponding to the user information data files and enterprise behavior profiles corresponding to the enterprise information data files based on preset statistical rules, the user information data files, and the enterprise information data files; when a target user and a target enterprise initiate a transaction request, it determines target user behavior data corresponding to the user behavior profile based on the target user and target enterprise behavior data corresponding to the enterprise behavior profile based on the target enterprise; it matches the target user behavior data and target enterprise behavior data with preset matching rules to determine the risk level corresponding to the transaction request, and updates the user behavior profile and enterprise behavior profile respectively based on the risk level. By performing behavioral profile inductive analysis and using behavioral profiles for real-time data analysis, it solves the problems of data timeliness, the inability to unify multiple data sets, and the inability to dynamically configure and process rules. This enables real-time anomaly monitoring, optimizes the inference efficiency of the risk control system, reduces transaction risk, improves the anti-money laundering security of transaction orders, reduces the pressure of manual review, and improves system reliability.

[0172] Any combination of one or more computer-readable media may be used. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. A computer-readable storage medium can be, for example—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device.

[0173] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including—but not limited to—electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, capable of transmitting, propagating, or transmitting programs for use by or in connection with an instruction execution system, apparatus, or device.

[0174] Computer program code for performing the operations of this invention can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on the operator's computer, partially on the operator's computer, as a standalone software package, partially on the operator's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the operator's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider). The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments; similar or identical parts between embodiments can be referred to interchangeably.

[0175] Although preferred embodiments of the present application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present application.

[0176] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0177] The above provides a detailed description of the abnormal transaction behavior detection method, system, electronic device, and storage medium provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for detecting abnormal transaction behavior, characterized in that, The method is used to control abnormal transaction behavior of users and enterprises; The method includes: Acquire business data, and generate user information data files and enterprise information data files based on the business data; Based on preset statistical rules, the user information data file, and the enterprise information data file, a user behavior profile corresponding to the user information data file and an enterprise behavior profile corresponding to the enterprise information data file are generated. When a target user and a target enterprise initiate a transaction request, the target user behavior data corresponding to the user behavior profile is determined based on real-time data and the target user, and the target enterprise behavior data corresponding to the enterprise behavior profile is determined based on real-time data and the target enterprise. The target user behavior data and the target enterprise behavior data are matched with preset matching rules to determine the risk level corresponding to the transaction request, and the user behavior profile and the enterprise behavior profile are updated according to the risk level.

2. The method according to claim 1, characterized in that, The steps of acquiring business data and generating user information data files and enterprise information data files based on the business data include: Determine whether the business data is business data that conforms to a preset standard; If yes, then the business data is used to generate the user information data file and the enterprise information data file in a preset format; if not, then the business data is cleaned to generate the user information data file and the enterprise information data file in a preset format.

3. The method according to claim 2, characterized in that, The step of cleaning the business data to generate the user information data file and enterprise information data file in a preset format includes: The business data is segmented to generate segmented business data; Empty strings are removed from the segmented business data to generate removed business data; The excluded business data is assembled to generate the user information data file and the enterprise information data file in a preset format.

4. The method according to claim 3, characterized in that, The step of generating user behavior profiles corresponding to the user information data file and enterprise behavior profiles corresponding to the enterprise information data file based on preset statistical rules, the user information data file, and the enterprise information data file includes: Store the user information data file and the enterprise information data file into the file system; The user information data file and the enterprise information data file are analyzed according to preset statistical rules to generate user behavior profiles corresponding to the user information data file and enterprise behavior profiles corresponding to the enterprise information data file.

5. The method according to claim 4, characterized in that, The step of analyzing the user information data file and the enterprise information data file according to preset statistical rules to generate user behavior profiles corresponding to the user information data file and enterprise behavior profiles corresponding to the enterprise information data file: The storage paths of the user information data file and the enterprise information data file are determined according to preset statistical rules; Based on the storage paths of the user information data file and the enterprise information data file, the user information data file and the enterprise information data file are stored in the corresponding tag library to generate user behavior profiles corresponding to the user information data file and enterprise behavior profiles corresponding to the enterprise information data file; The user behavior profile and the enterprise behavior profile are stored in the database.

6. The method according to claim 5, characterized in that, The step of matching the target user behavior data and the target enterprise behavior data with preset matching rules to determine the risk level corresponding to the transaction request, and updating the user behavior profile and the enterprise behavior profile according to the risk level, includes: Determine preset matching rules; wherein, the preset matching rules include rule code, rule name, business domain, rule conditions, rule threshold, and rule description; The target user behavior data and the target enterprise behavior data are matched with preset matching rules to generate matching results corresponding to the transaction request; The risk level is determined based on the matching results, and the user behavior profile and the enterprise behavior profile are updated based on the risk level.

7. The method according to claim 6, characterized in that, The steps of determining the risk level based on the matching result, and updating the user behavior profile and the enterprise behavior profile based on the risk level, include: When the risk level reaches the preset level, the transaction request is judged as abnormal and marked, and the marked risk level is stored in the user behavior profile and the enterprise behavior profile respectively. The type of follow-up visit is determined based on the target user and the target enterprise; or; When the risk level is less than the preset level, the transaction data of the target user and the target enterprise are obtained, and the transaction data and the risk level are stored in the user behavior profile and the enterprise behavior profile, respectively.

8. An abnormal transaction behavior detection system, characterized in that, The system is used to manage and control abnormal transaction behavior of users and enterprises; The system includes: The cleaning module is used to acquire business data and generate user information data files and enterprise information data files based on the business data; The profiling module is used to generate user behavior profiles corresponding to the user information data file and enterprise behavior profiles corresponding to the enterprise information data file based on preset statistical rules, the user information data file, and the enterprise information data file; The query module is used to determine the target user behavior data corresponding to the user behavior profile and the target enterprise behavior data corresponding to the enterprise behavior profile based on real-time data and the target user when the target user and the target enterprise initiate a transaction request. The matching module is used to match the target user behavior data and the target enterprise behavior data with preset matching rules, determine the risk level corresponding to the transaction request, and update the user behavior profile and the enterprise behavior profile according to the risk level.

9. A computer device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and capable of running on the processor, wherein the computer program, when executed by the processor, implements the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, A computer program is stored on the computer-readable storage medium, which, when executed by a processor, implements the method as described in any one of claims 1 to 7.

Images