A method and device for detecting account abnormality

Abstract

The embodiment of the present invention provides a method and device for detecting account anomalies, which relates to the field of data analysis technology. The method includes: obtaining each transaction of an account within a set time; for any transaction in each transaction, determining the execution status corresponding to the transaction according to the account status after the transaction is executed; wherein, if the account status after the transaction is executed meets the increase condition, then the execution status of the transaction is determined to be an upward crossing; if the account status after the transaction is executed meets the decrease condition, then the execution status of the transaction is determined to be a downward crossing; counting the number of times the execution status changes from an upward crossing to a downward crossing in the execution status sequence of each transaction, and obtaining the number of downward crossings of each transaction; the execution status sequence is obtained by calculating the execution status of each transaction according to the transaction order of each transaction; obtaining the abnormal number of the account according to the number of downward crossings, and determining that the abnormal number exceeds the abnormal number threshold, then the account is abnormal. The above method is used to improve the accuracy of obtaining abnormal accounts.

Description

Technical Field

[0001] The present application relates to the field of data analysis technology, and in particular to a method and device for detecting account anomalies. Background Art

[0002] There are money laundering accounts in the financial network where illegal transactions are conducted. Money laundering accounts are nodes in the money laundering path in the financial network. How to find suspicious money laundering accounts from the complex financial network is of great significance to combating money laundering.

[0003] The existing technology generally uses the following three methods to find money laundering accounts: The first is to prevent them by obtaining a blacklist based on a list issued by the public security department or regulatory agency or after manual verification by the business department of a financial institution. The second is to formulate business rules based on the experience of business experts. Although these two methods of finding money laundering accounts can help discover some abnormal money laundering behaviors, most of them are summarized based on historical data, and they rely too much on manual experience, which is bound to cause omissions. In addition, most anti-money laundering systems are still rule-based. Criminals have mastered some anti-money laundering rules and deliberately circumvent them, making it difficult for the system to identify them. The third method is to use graph mining technology to mine suspicious gangs. When there are many related transaction accounts in the business of financial institutions, this method is prone to mining super-large subgraphs, which contain a large number of non-problem subnodes, resulting in low model accuracy.

[0004] Therefore, there is an urgent need for a method and device for detecting account anomalies to improve the accuracy of obtaining abnormal accounts. Summary of the invention

[0005] The embodiment of the present invention provides a method and device for detecting account anomalies, which are used to improve the accuracy of obtaining abnormal accounts.

[0006] In a first aspect, an embodiment of the present invention provides a method for detecting account anomalies, the method comprising:

[0007] Get all transactions of the account within the set time;

[0008] For any transaction among the transactions, determining the execution status corresponding to the transaction according to the account status after the transaction is executed; wherein, if the account status after the transaction is executed satisfies an increase condition, determining the execution status of the transaction is an upward crossing; if the account status after the transaction is executed satisfies a decrease condition, determining the execution status of the transaction is a downward crossing;

[0009] Counting the execution status sequence of each transaction to obtain the number of down-crossings of each transaction; the execution status sequence is obtained by calculating the execution status of each transaction according to the transaction order of each transaction;

[0010] The number of abnormalities of the account is obtained according to the number of underpasses, and it is determined that if the number of abnormalities exceeds a threshold of the number of abnormalities, then the account is abnormal.

[0011] In the above method, each transaction of the account within a set time is obtained; for any transaction in the transactions, the execution status corresponding to the transaction is determined according to the account status after the transaction is executed; wherein, if the account status after the transaction is executed satisfies the increase condition, the execution status of the transaction is determined to be an upward crossing; if the account status after the transaction is executed satisfies the decrease condition, the execution status of the transaction is determined to be a downward crossing. In this way, each transaction of each account within a set time is analyzed, and the account status and the execution status of the transaction of the account after the transaction is executed are obtained, and the transaction execution status characteristics of the account within the set time can be obtained, and whether the account is an abnormal account can be determined according to the transaction execution status characteristics. In other words, the present application analyzes the transaction execution status characteristics corresponding to the account, and determines whether the account is abnormal according to the transaction execution situation of the account itself, which has a higher accuracy of abnormal account detection. The present application eliminates the omission of abnormal account detection caused by relying on manual detection of abnormal accounts in the prior art, and eliminates the risk of rule leakage and abnormal account detection rules being circumvented by illegal personnel due to reliance on rules in the prior art. In addition, the number of downcrossings of each transaction is determined according to the number of times the execution status changes from upcrossing to downcrossing, so that the number of downcrossings of each transaction can be obtained quickly and accurately, ensuring the timeliness of the detection results.

[0012] Optionally, it also includes: if the account status after the execution of the transaction does not meet the increase condition or if the account status after the execution of the transaction does not meet the decrease condition, setting the execution status of the previous transaction of the transaction as the execution status of the transaction.

[0013] In the above method, if the account status after the transaction is executed satisfies the increase condition, the execution status corresponding to the transaction is determined to be an upward crossing state; if the account status after the transaction is executed satisfies the decrease condition, the execution status corresponding to the transaction is determined to be a downward crossing state; if the account status after the transaction is executed does not meet the increase condition or does not meet the decrease condition, the execution status of the previous transaction is set as the execution status of the transaction. In this way, a continuous execution status sequence obtained by the transaction order of each transaction of the account within a set time can be obtained, the continuous correct change direction of the transaction execution status of the account can be obtained, and the continuous trend of each transaction execution status within the set time can be obtained. When analyzing each transaction, the trend of the transaction and the impact on the trend can be taken into account, so as to improve the accuracy of the account status analysis after the transaction of the account is executed and ensure the accuracy of the detection result.

[0014] Optionally, if the account status after the execution of the transaction meets the increase condition, the execution status of the transaction is determined to be an upward crossing, including: if the transaction is an inflow transaction, judging whether the difference between the account balance after the execution of the transaction and the local state minimum value is greater than an upward crossing threshold; if so, the execution status of the transaction is an upward crossing, and the local state minimum value is the minimum value of the account balance in the set state period in which the transaction is located.

[0015] In the above method, when the difference between the account balance after the transaction is executed and the local state minimum is greater than the upper crossing threshold, it can be confirmed that, under the cumulative inflow transaction amount corresponding to the continuous inflow transaction, the cumulative inflow transaction amount has exceeded the normal upper crossing threshold (for ease of understanding, the upper crossing threshold can be understood as the inflow amount threshold). At this time, the account may show signs of being an abnormal account, and the transaction upper crossing can be used as a detection indicator.

[0016] Optionally, if the account status after the execution of the transaction satisfies the reduction condition, the execution status of the transaction is determined to be a downward crossing, including: if the transaction is an outflow transaction, it is determined that the difference between the account balance after the execution of the transaction and the local state maximum value is greater than the downward crossing threshold, and the account balance after the execution of the transaction is not greater than the sum of the local state minimum value and the retained balance threshold, then the execution status of the transaction is determined to be a downward crossing, the local state minimum value is the minimum account balance in the set state period where the transaction is located, and the local state maximum value is the maximum account balance in the set state period where the transaction is located.

[0017] In the above method, if the transaction is an outflow transaction, it is determined whether the difference between the account balance after the transaction is executed and the local state maximum value is greater than the underpass threshold. If it is greater, and the account balance after the transaction is executed is less than or equal to the sum of the local state minimum value and the retained balance threshold, the transaction is determined to be underpassed. In this way, if the difference between the updated account balance and the local state maximum value is greater than the underpass threshold, it can be determined that the cumulative outflow transaction amount of the continuous outflow transactions of the account has exceeded the upper limit of the normal outflow transaction amount, and the transaction may be an abnormal transaction. In order to stabilize the reliability of the abnormal transaction judgment, the restriction condition "and the updated account balance is less than or equal to the sum of the local state minimum value and the retained balance threshold" is added (when some abnormal accounts have abnormal outflow transaction amounts, the accompanying phenomenon is that the remaining account balance is at a smaller value), to improve the accuracy of determining abnormal accounts.

[0018] Optionally, after determining the execution status corresponding to the transaction, it also includes: judging whether the account balance after the transaction is executed is greater than the local state maximum value, and if so, updating the local state maximum value with the account balance after the transaction is executed; judging whether the account balance after the transaction is executed is less than the local state minimum value, and if so, updating the local state minimum value with the account balance after the transaction is executed.

[0019] In the above method, after the transaction is executed, the local state maximum or local state minimum is updated based on the updated account balance. This facilitates the illegal or legal detection of the next transaction.

[0020] Optionally, after determining the execution status corresponding to the transaction, it also includes: based on the execution status sequence of each transaction, if the execution status changes from upward crossing to downward crossing, the local state minimum value is updated with the account balance after the transaction is executed; if the execution status changes from downward crossing to upward crossing, the local state maximum value is updated with the account balance after the transaction is executed.

[0021] In the above method, after the transaction is executed, the local state maximum or local state minimum can be updated based on the updated account balance according to the change in the execution state of the current transaction and the previous transaction. In this way, the state of the account after the next transaction is executed can be accurately obtained, which is convenient for the illegal or legal detection of the next transaction.

[0022] Optionally, obtaining the number of abnormalities of the account according to the number of underpasses includes: dividing the transactions into time slices; determining the number of underpasses of each sliding group according to the number of underpasses of each time slice; each sliding group is obtained by dividing the time slices according to a sliding window and a sliding step, and the sliding step is at least one time slice; obtaining the number of abnormalities of the account according to the number of underpasses of each sliding group.

[0023] In the above method, for the execution state sequence of each transaction corresponding to each time slice, the number of crossovers in each time slice is determined; according to the number of crossovers of each time slice, the number of crossovers of each sliding group is determined; each sliding group is obtained by dividing the time slices according to the sliding window and the sliding step; according to the number of crossovers of each sliding group, the number of abnormalities of the account is obtained. In this way, when performing account anomaly detection based on the number of crossovers of transactions under the account, the sliding group corresponding to the time slice is used to emphasize the time feature, making the behavior of the abnormal account more obvious.

[0024] Optionally, it also includes: sorting the number of abnormal times of each account from large to small, and selecting a set number of accounts as abnormal accounts.

[0025] In the above method, the number of abnormalities of each account can be sorted from large to small, and the accounts with a set number of abnormalities can be selected as abnormal accounts. In this way, the set number can be determined based on the abnormal probability of historical accounts, and further based on the number of abnormalities of each account, the accounts with a set number of abnormalities with a higher number of abnormalities can be determined as abnormal accounts.

[0026] Optionally, after determining the execution status corresponding to the transaction, the method further includes:

[0027] Count the number of upward crossings of each transaction;

[0028] Get the number of abnormal times of the account, including:

[0029] The number of abnormalities of the account is obtained according to the number of downward crossings and the number of upward crossings.

[0030] In the above method, the number of abnormal times of an account can be determined based on the two factors of the number of upward and downward crossings of the transaction, thereby improving the comprehensiveness of the upward and downward crossing indicators of the number of abnormal times of the account.

[0031] In a second aspect, an embodiment of the present invention provides a device for detecting account abnormalities, the device comprising:

[0032] The acquisition module is used to obtain each transaction of the account within a set time;

[0033] a processing module, configured to determine, for any transaction among the transactions, an execution status corresponding to the transaction according to the account status after the transaction is executed; wherein, if the account status after the transaction is executed satisfies an increase condition, the execution status of the transaction is determined to be an upward crossing; and if the account status after the transaction is executed satisfies a decrease condition, the execution status of the transaction is determined to be a downward crossing;

[0034] The processing module is further used to count the number of times the execution status changes from an upward crossing to a downward crossing in the execution status sequence of each transaction, so as to obtain the number of downward crossings of each transaction; the execution status sequence is obtained by calculating the execution status of each transaction according to the transaction order of each transaction;

[0035] The processing module is further configured to obtain the number of abnormalities of the account according to the number of underpasses, and determine that if the number of abnormalities exceeds a threshold of the number of abnormalities, then the account is abnormal.

[0036] In a third aspect, an embodiment of the present application further provides a computer-readable non-volatile storage medium, comprising a computer-readable program. When a computer reads and executes the computer-readable program, the computer executes the method for detecting account anomalies as described in various possible designs of the first aspect.

[0037] In a fourth aspect, an embodiment of the present application further provides a computer device, comprising: a memory for storing programs; a processor for calling the computer program stored in the memory, and executing the method for detecting account anomalies as described in various possible designs of the first aspect according to the obtained program.

[0038] In a fifth aspect, an embodiment of the present application provides a computer program product. When the computer program product runs on a computer, it enables the computer to execute the method for detecting account anomalies in the first aspect and any possible design of the first aspect.

[0039] These implementations or other implementations of the present application will be more concise and understandable in the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0041] Figure 1 A schematic diagram of an architecture for detecting account anomalies provided by an embodiment of the present invention;

[0042] Figure 2 A flowchart of a method for detecting account anomalies provided by an embodiment of the present invention;

[0043] Figure 3 A schematic diagram of a sliding group provided by an embodiment of the present invention;

[0044] Figure 4 A flowchart of a method for detecting account anomalies provided by an embodiment of the present invention;

[0045] Figure 5 A schematic diagram of a calculation method for detecting account anomalies provided by an embodiment of the present invention;

[0046] Figure 6 A schematic diagram of a device for detecting account anomalies provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0048] Figure 1 A system architecture for detecting account anomalies provided by an embodiment of the present invention, wherein a transaction data acquisition module 101 is used to acquire each transaction of an account within a set time. The transaction processing module 102 determines, for any transaction in the transactions, according to the account status after the transaction is executed, that if the account status after the transaction is executed satisfies the increase condition, then the execution status of the transaction is determined to be an upward crossing; if the account status after the transaction is executed satisfies the decrease condition, then the execution status of the transaction is determined to be a downward crossing. The statistical module 103 obtains the execution status sequence of each transaction according to the transaction order of each transaction, and counts the number of times the execution status changes from upward crossing to downward crossing in the execution status sequence of each transaction to obtain the number of downward crossings of each transaction. Further, a corresponding statistical algorithm is performed according to the number of downward crossings of each transaction to obtain the number of abnormalities of the account. The abnormality analysis module 104 determines whether the number of abnormalities exceeds the abnormality threshold, if it exceeds, the account is abnormal, and if it does not exceed, the account is normal. Through the above system architecture, the transaction execution status corresponding to the account is analyzed, and the result of determining whether the account is abnormal is determined according to the transaction execution situation of the account itself, which has a higher accuracy of abnormal account detection. The invention eliminates the omission of abnormal account detection caused by reliance on manual detection of abnormal accounts in the prior art, and eliminates the risk of rule leakage and circumvention of abnormal account detection rules by illegal persons caused by reliance on rules in the prior art.

[0049] Based on this, the present application embodiment provides a method for detecting account anomalies. Figure 2 As shown, including:

[0050] Step 201, obtaining each transaction of the account within a set time;

[0051] Here, the account can be a bank card account, a fund software account, an individual's account at a financial institution, or a company or organization's account at a financial institution. There is no specific restriction on the account. The time can be set so that the staff needs to analyze and detect abnormal accounts for a period of time, which can be one day, one week, half a month, or one month, without specific restrictions. It should be noted that in the technical solution of this application, the collection, dissemination, storage, processing, and use of data are in compliance with the requirements of relevant national laws and regulations.

[0052] Step 202: for any transaction among the transactions, determine the execution status corresponding to the transaction according to the account status after the transaction is executed; wherein, if the account status after the transaction is executed satisfies an increase condition, the execution status of the transaction is determined to be an upward crossing; if the account status after the transaction is executed satisfies a decrease condition, the execution status of the transaction is determined to be a downward crossing;

[0053] Here, the account status can characterize the phenomenon exhibited by the account after the transaction is executed (it can be a dynamic comparison before and after the transaction is executed, and the phenomenon reflected by the changes before and after the transaction is executed). Upward or downward penetration is the execution type of the transaction execution action when the transaction reaches the corresponding increase condition or decrease condition. The execution type is expressed as an execution state of upward penetration or downward penetration, that is, an upward penetration state or a downward penetration state. The execution action of the transaction is subsequently described by the execution type as an upward penetration execution type or a downward penetration execution type. The execution type of the transaction is described by the execution state as an execution state of an upward penetration state or an execution state of a downward penetration state. The increase condition can be a condition for the transaction to have an upward penetration transaction execution action set as needed. The reduction condition can be a condition for the transaction to have a downward penetration transaction execution action set as needed.

[0054] Step 203: Count the number of times the execution status changes from an upward crossing to a downward crossing in the execution status sequence of each transaction, and obtain the number of downward crossings of each transaction; the execution status sequence is obtained by calculating the execution status of each transaction according to the transaction order of each transaction;

[0055] Here, the execution status sequence of each transaction can represent the overall execution status change of transactions in the account within the set time. Step 204, obtain the abnormal number of the account according to the underpass number, and determine that the abnormal number exceeds the abnormal number threshold, then the account is abnormal.

[0056] Here, the abnormal number threshold may be obtained based on professional knowledge or historical data analysis, and there is no restriction on the specific setting method of the abnormal number threshold.

[0057] In the above method, each transaction of the account within a set time is obtained; for any transaction in the transactions, the execution status corresponding to the transaction is determined according to the account status after the transaction is executed; wherein, if the account status after the transaction is executed satisfies the increase condition, the execution status of the transaction is determined to be an upward crossing; if the account status after the transaction is executed satisfies the decrease condition, the execution status of the transaction is determined to be a downward crossing. In this way, each transaction of each account within a set time is analyzed, and the account status and the execution status of the transaction of the account after the transaction is executed are obtained, and the transaction execution status characteristics of the account within the set time can be obtained, and whether the account is an abnormal account can be determined according to the transaction execution status characteristics. In other words, the present application analyzes the transaction execution status characteristics corresponding to the account, and determines whether the account is abnormal according to the transaction execution situation of the account itself, which has a higher accuracy of abnormal account detection. The present application eliminates the omission of abnormal account detection caused by relying on manual detection of abnormal accounts in the prior art, and eliminates the risk of rule leakage and abnormal account detection rules being circumvented by illegal personnel due to reliance on rules in the prior art. In addition, the number of downcrossings of each transaction is determined according to the number of times the execution status changes from upcrossing to downcrossing, so that the number of downcrossings of each transaction can be obtained quickly and accurately, ensuring the timeliness of the detection results.

[0058] Based on the above method, the embodiment of the present application provides a method for detecting account anomalies, further comprising:

[0059] If the account status after the transaction is executed does not satisfy the increase condition or if the account status after the transaction is executed does not satisfy the decrease condition, the execution status of the previous transaction of the transaction is set as the execution status of the transaction.

[0060] That is, each transaction of the account within the set time is obtained. For any transaction in each transaction, the execution status corresponding to the transaction is determined according to the account status after the transaction is executed. Among them, if the account status after the transaction is executed meets the increase condition, the execution type of the transaction is determined to be up-crossing, and the execution status corresponding to the transaction is up-crossing state; if the account status after the transaction is executed meets the decrease condition, the execution type of the transaction is determined to be down-crossing, and the execution status corresponding to the transaction is down-crossing state; if the account status after the transaction is executed does not meet the increase condition or if the account status after the transaction is executed does not meet the decrease condition, the execution type of the transaction is neither up-crossing nor down-crossing, and the execution status of the previous transaction of the transaction is set as the execution status of the transaction. For example, if the execution status of the previous transaction of the transaction is up-crossing state, the execution status of the transaction is up-crossing state, and if the execution status of the previous transaction of the transaction is down-crossing state, the execution status of the transaction is down-crossing state. Then, the execution status of each transaction can be obtained according to the transaction order of each transaction to obtain the execution status sequence of each transaction. For example, if five transactions occur within the set time of the account, the execution status sequence of the five transactions can be obtained according to the transaction time sequence and the execution status of each transaction: up-crossing state, up-crossing state, up-crossing state, down-crossing state, down-crossing state. The number of down-crossings of each transaction is counted, and the number of abnormalities of the account is further obtained based on the number of down-crossings of each transaction. If it is determined that the number of abnormalities exceeds the threshold of the number of abnormalities, the detection result of the account abnormality is obtained.

[0061] The embodiment of the present application provides a method for detecting account anomalies. In step 202 of the above method, if the account status after the transaction is executed satisfies the increase condition, determining that the execution status of the transaction is an upward crossing includes:

[0062] If the transaction is an inflow transaction, determine whether the difference between the account balance after the transaction is executed and the local state minimum value is greater than the upper crossing threshold. If so, determine that the execution state of the transaction is an upper crossing, and the local state minimum value is the minimum account balance in the set state period where the transaction is located.

[0063] Here, the set state cycle includes an upward crossing cycle or a downward crossing cycle; wherein the upward crossing cycle starts when the downward crossing state changes to the upward crossing state and ends when the upward crossing state changes to the downward crossing state; the downward crossing cycle starts when the upward crossing state changes to the downward crossing state and ends when the downward crossing state changes to the upward crossing state. For example, if 10 transactions occur within the account set time, the execution state sequence corresponding to the transaction sequence is: transaction 1-upward crossing state, transaction 2-upward crossing state, transaction 3-upward crossing state, transaction 4-downward crossing state, transaction 5-downward crossing state, transaction 6-upward crossing state, transaction 7-upward crossing state, transaction 8-upward crossing state, transaction 9-downward crossing state, transaction 10-downward crossing state, wherein the execution states of transaction 1, transaction 2, and transaction 3 correspond to the upward crossing cycle, the execution states of transaction 6, transaction 7, and transaction 8 correspond to the upward crossing cycle, the execution states of transaction 4 and transaction 5 correspond to the downward crossing cycle, and the execution states of transaction 9 and transaction 10 correspond to the downward crossing cycle. The local state minimum value is the minimum account balance value in the set state cycle where the transaction is located. The local state maximum is the maximum value of the account balance in the set state cycle in which the transaction is located.

[0064] That is to say, each transaction of the account within the set time is obtained. For any transaction in each transaction, if the transaction is an inflow transaction, determine whether the difference between the account balance after the execution of the transaction and the local state minimum is greater than the upper crossing threshold. If it is greater, it is determined that the execution type of the transaction is an upper crossing, and the execution state is an upper crossing state. The number of upper crossings of the transaction can be recorded (to facilitate the subsequent statistical analysis of the number of upper crossings of each transaction), and the corresponding upper crossing state of the transaction can be added to the above-mentioned transaction execution state sequence (the execution state of each transaction is obtained according to the transaction order of each transaction). Further count the number of lower crossings of each transaction to obtain the number of abnormalities of the account, and determine that the number of abnormalities exceeds the threshold of the number of abnormalities, and then obtain the detection result of the account abnormality.

[0065] The embodiment of the present application provides a method for detecting account anomalies. In step 202 of the above method, if the account status after the transaction is executed satisfies the reduction condition, determining that the execution status of the transaction is a downward crossing includes:

[0066] If the transaction is an outflow transaction, it is determined that the difference between the account balance after the execution of the transaction and the local state maximum value is greater than the underpass threshold, and the account balance after the execution of the transaction is not greater than the sum of the local state minimum value and the retained balance threshold, then it is determined that the execution state of the transaction is underpass, the local state minimum value is the minimum account balance in the set state period where the transaction is located, and the local state maximum value is the maximum account balance in the set state period where the transaction is located.

[0067] In the above-mentioned method for detecting account anomalies that meets the additional conditions, the setting of the state cycle, the local state minimum value, and the local state maximum value have been explained, and will not be repeated here. The retained balance threshold can be determined based on professional knowledge or the abnormal retained balance of a large number of historical abnormal accounts. In the transaction of the under-crossing execution type, if the account balance after the transaction is executed is not greater than the sum of the local state minimum value and the retained balance threshold, it means that the account balance after the transaction is executed is already below the possible value of the abnormal account balance. At this time, the under-crossing abnormality of the transaction is relatively large, and the specific analysis and setting of the retained balance threshold are not limited here.

[0068] That is to say, each transaction of the account within the set time is obtained. For any transaction in each transaction, if the transaction is an outflow transaction, it is determined that the difference between the account balance after the execution of the transaction and the local state maximum value is greater than the down-crossing threshold, and the account balance after the execution of the transaction is not greater than the sum of the local state minimum value and the retained balance threshold, then it is determined that the execution type of the transaction is down-crossing, and the execution state is down-crossing state. The number of down-crossings of the transaction can be recorded (to facilitate the subsequent statistical analysis of the number of down-crossings of each transaction), and the down-crossing state corresponding to the transaction can be added to the above-mentioned transaction execution state sequence (the execution state of each transaction is obtained according to the transaction order of each transaction). Further statistics are made on the number of down-crossings of each transaction to obtain the number of abnormalities of the account, and it is determined that the number of abnormalities exceeds the threshold of the number of abnormalities, and the detection result of the account abnormality is obtained.

[0069] The method for detecting account anomalies based on the above-mentioned determination of the execution status of a transaction, after determining the execution status corresponding to the transaction, further includes: determining whether the account balance after the execution of the transaction is greater than the local state maximum value, and if so, updating the local state maximum value with the account balance after the execution of the transaction; determining whether the account balance after the execution of the transaction is less than the local state minimum value, and if so, updating the local state minimum value with the account balance after the execution of the transaction.

[0070] That is to say, for each transaction, after determining the execution status of the transaction, determine whether the account balance after the transaction is executed is greater than the local state maximum value in the set state period of the transaction. If so, use the account balance after the transaction to update the local state maximum value in the set state period of the transaction. Determine whether the account balance after the transaction is executed is less than the local state minimum value in the set state period of the transaction. If so, use the account balance after the transaction to update the local state minimum value in the set state period of the transaction. In this way, in the next transaction execution process, the updated local state maximum value and local state minimum value can be used as parameters of the above-mentioned increase or decrease conditions to ensure the accuracy of the increase or decrease conditions, further ensure the accuracy of the transaction execution type and transaction execution status judgment, and improve the accuracy of the result of detecting account anomalies.

[0071] Based on the above method for detecting account anomalies by determining the execution status of a transaction, after determining the execution status corresponding to the transaction, the method further includes:

[0072] Based on the execution status sequence judgment of each transaction,

[0073] If the execution status changes from upward crossing to downward crossing, the local state minimum value is updated with the account balance after the transaction is executed;

[0074] If the execution status changes from down-crossing to up-crossing, the local state maximum value is updated with the account balance after the transaction is executed.

[0075] That is to say, for each transaction, after determining the execution status of the transaction, the execution status of the transaction is updated to the execution status sequence of each transaction, and based on the transition between the execution status of the previous transaction and the transaction in the execution status sequence containing the transaction, it is determined whether to update the local state minimum value or the local state maximum value with the account balance after the transaction is executed. Similarly, in the next transaction execution process, the updated local state maximum value and local state minimum value can be used as parameters of the above-mentioned increase or decrease conditions to ensure the accuracy of the increase or decrease conditions, further ensure the accuracy of the transaction execution type and transaction execution status judgment, and improve the accuracy of the result of detecting account anomalies.

[0076] The embodiment of the present application provides a method for detecting account anomalies. In step 204 of the above method, obtaining the number of abnormalities of the account according to the number of down-crossings includes:

[0077] Dividing each transaction into time slices;

[0078] According to the number of down-crossings of each time slice, the number of down-crossings of each sliding group is determined; each sliding group is obtained by dividing the time slices according to a sliding window and a sliding step, and the sliding step is at least one time slice;

[0079] According to the number of crossovers of each sliding group, the number of abnormalities of the account is obtained. Figure 3 As shown, obtain each transaction within the set time of the account, based on the above methods, obtain the number of crossovers of each transaction, and calculate the set time by Figure 3 The time slices in the sliding window are divided to obtain each time slice. The sliding group corresponding to each sliding window contains a set number of time slices. The sliding step length of the sliding window is the length of at least one time slice. The number of time slices corresponding to the sliding step length can be fixed. Then, for the sliding group of each sliding window, the number of crossovers of the sliding group of the sliding window is obtained. The number of abnormalities of the account is obtained according to the number of crossovers of each sliding group. Among them, the number of crossovers of the sliding group can be the sum of the number of crossovers corresponding to each transaction in each time slice contained in the sliding group. For example, if the sliding group contains 10 time slices, the sum of the number of crossovers of each transaction corresponding to time slice 1 is 4, the sum of the number of crossovers of each transaction corresponding to time slice 2 is 4, the sum of the number of crossovers of each transaction corresponding to time slice 3 is 6, the sum of the number of crossovers of each transaction corresponding to time slice 4 is 1, the sum of the number of crossovers of each transaction corresponding to time slice 5 is 7, the sum of the number of crossovers of each transaction corresponding to time slice 6 is 8, the sum of the number of crossovers of each transaction corresponding to time slice 7 is 4, the sum of the number of crossovers of each transaction corresponding to time slice 8 is 2, the sum of the number of crossovers of each transaction corresponding to time slice 9 is 0, and the sum of the number of crossovers of each transaction corresponding to time slice 10 is 5. Then the number of crossovers of the sliding group = SUM(4+4+6+1+7+8+4+2+0+5).

[0080] Based on the above method for detecting account anomalies, it is also possible to obtain the number of abnormalities of each account, and each account may be an account that needs to be detected, and there is no specific restriction on the determination of each account. The number of abnormalities of each account is sorted from large to small, and a set number of accounts are selected as abnormal accounts. Here, the set number can be determined through professional knowledge or a large amount of data analysis. Among a certain number of accounts (the portrait information of the account can be restricted, such as whether the account is an organizational account or a personal account, the transaction type of the account - borrowing or selling goods, the type of goods sold, etc.), a set number of abnormal accounts will generally appear.

[0081] Based on the above method for detecting account anomalies, after determining the execution status corresponding to the transaction, it can also include: counting the number of up-crossings of each transaction; obtaining the number of abnormalities of the account, including: obtaining the number of abnormalities of the account according to the number of down-crossings and the number of up-crossings. In other words, the number of abnormalities of the account can be determined not only based on the indicator of the number of down-crossings, but also based on the indicator of the number of up-crossings, and the number of abnormalities of the account can be determined based on the indicator based on the number of down-crossings and the indicator based on the number of up-crossings. If the number of abnormalities exceeds the threshold of the number of abnormalities, the account is determined to be abnormal. In this way, the comprehensiveness of the detection results is improved.

[0082] According to the above methods for detecting account anomalies, the present application embodiment also provides a process for detecting account anomalies, such as Figure 4 As shown, including:

[0083] Step 401: For each account, obtain transaction information of each transaction occurring within a set time period of the account.

[0084] Here, each transaction information includes the transaction time, transaction direction (inflow transaction or outflow transaction), and account information of the account. The above-mentioned set time can be any period of time. The specific time length and specific time can be determined according to the needs of transaction abnormality analysis, and there is no specific restriction here. When the set time starts from the account opening, the initial account balance of the account opening is determined as the initial value. If the set time starts from any time, the initial account balance at the starting time is the initial value. The initial value can be regarded as the local state maximum value or the local state minimum value. In other words, the initial values ​​of the local state minimum value and the local state maximum value are the initial account balances, and the initial values ​​of the local state minimum value and the local state maximum value can also be the account balance after the first transaction is executed.

[0085] At this time, the execution state of the transaction of the account is "empty" (none), that is, the initial execution state is "empty", state (0) = none. Figure 5 In the example shown, the initial account balance of the account is the initial value, and the account balance after the first transaction in the account is the local state minimum (local_min) and the local state maximum (local_max), and the initial values ​​are set to positive infinity and negative infinity, respectively, that is, local_min=inf, local_max=-inf.

[0086] Step 402: Sort the transactions of the account in order of transaction execution.

[0087] Here, if Figure 5 The 8 transactions in are sorted according to the order in which they were executed.

[0088] Step 403: for any transaction within the period, analyze the transaction type and transaction amount of the transaction, execute the transaction, and obtain the account balance after the transaction is executed.

[0089] Here, if the transaction is an inflow transaction, the transaction amount of the inflow transaction is added to the current account balance to obtain the updated account balance. If the transaction is an outflow transaction, the negative outflow transaction amount is added to the current account balance to obtain the updated account balance.

[0090] Step 404: If the current transaction type is an inflow transaction, and the account balance after the transaction is executed minus the local state minimum value is greater than the upper crossing threshold, the execution type of the transaction is determined to be an upper crossing, the execution state is an upper crossing state, and the temporary upper crossing times are increased by 1. If the current transaction type is an outflow transaction, the local state maximum value minus the account balance after the transaction is executed is greater than the lower crossing threshold, and the account balance after the transaction is executed is less than the sum of the local state minimum value and the retained balance threshold, the execution type of the transaction is determined to be a lower crossing, the execution state is a lower crossing state, and the lower crossing times are increased by 1, and the temporary upper crossing times are added to the upper crossing times to obtain the updated upper crossing times, and the temporary upper crossing times are reset to 0.

[0091] Here, if Figure 5 As shown, the first transaction is an inflow transaction, and the account balance after the first transaction is the local state minimum (local_min) = the local state maximum (local_max).

[0092] The second transaction is an inflow transaction. The account balance after the execution of this transaction (remain(t)) minus the local state minimum (local_min) is greater than the upward crossing threshold (delta_in), that is, (remain(t)-local_min>delta_in), then the execution type of this transaction is determined to be upward crossing, the execution state is the upward crossing state (state(t)=up), and the temporary upward crossing times (in_time_temp(t-1)) is increased by 1, that is, (in_time_temp(t)=in_time_temp(t-1)+1=1).

[0093] The third transaction is an inflow transaction. The account balance after the execution of this transaction (remain(t)) minus the local state minimum (local_min) is greater than the upward crossing threshold (delta_in), that is, (remain(t)-local_min>delta_in). The execution type of this transaction is determined to be upward crossing, and the execution state is the upward crossing state (state(t)=up), and the temporary upward crossing times (in_time_temp(t-1)) is increased by 1, that is, (in_time_temp(t)=in_time_temp(t-1)+1=2).

[0094] The fourth transaction is an outflow transaction. The local state maximum value (local_max) minus the account balance after the execution of this transaction (remain(t)) is not greater than the downward crossing threshold (delta_down). It is determined that the execution type of this transaction is not an upward crossing or downward crossing, and the execution status is the execution status of the previous transaction (the third transaction) - the upward crossing status (state(t) = up).

[0095] The fifth transaction is an outflow transaction. The local state maximum value (local_max) minus the account balance after the transaction is executed (remain(t)) is greater than the down-crossing threshold (delta_down), that is, (local_max-remain(t)>delta_down). And the account balance after the transaction is executed (remain(t)) is less than the sum of the local state minimum value (local_min) and the retained balance threshold (epsilon) (remain<=local_min+epsilon). Then the execution type of the transaction is determined to be down-crossing, and the execution state is down-crossing state (state(t)=down), and the number of down-crossings (down_time(t))+1=1, and the temporary number of up-crossings (in_time_temp(t)=2) and the number of up-crossings (in_time(t-1)=0) are added to obtain the updated number of up-crossings (in_time(t)=2), and the temporary number of up-crossings in_time_temp(t) is set to 0, in_time_temp(t)=0.

[0096] The sixth transaction is an inflow transaction. The account balance after the execution of this transaction (remain(t)) minus the local state minimum (local_min) is not greater than the upward crossing threshold (delta_in), that is, (remain(t)-local_min<delta_in), which determines that the execution type of this transaction is not upward crossing or downward crossing, and the execution status is the execution status of the previous transaction (the second transaction)-the upward crossing status (state(t)=down).

[0097] The seventh transaction is an outflow transaction. The local state maximum value (local_max) minus the account balance after the execution of this transaction (remain(t)) is not greater than the downward crossing threshold (delta_down). It is determined that the execution type of this transaction is not an upward crossing or downward crossing, and the execution status is the execution status of the previous transaction (the sixth transaction) - the upward crossing status (state(t) = down).

[0098] The eighth transaction is an inflow transaction. The account balance after the execution of this transaction (remain(t)) minus the local state minimum (local_min) is greater than the upward crossing threshold (delta_in), that is, (remain(t)-local_min>delta_in), then the execution type of this transaction is determined to be upward crossing, the execution state is the upward crossing state (state(t)=up), and the temporary upward crossing times (in_time_temp(t-1)) is increased by 1, that is, (in_time_temp(t)=in_time_temp(t-1)+1=1), and in_time(t) at this time is 2.

[0099] Step 405: further analyze the executed transaction. If the account balance after the execution of the transaction is less than the local state minimum value, the local state minimum value is updated with the account balance after the execution of the transaction; if the account balance after the execution of the transaction is greater than the local state maximum value, the local state maximum value is updated with the account balance after the execution of the transaction; there is also a special case method. If the execution state of the transaction changes from the upper crossing state to the lower crossing state, the local state minimum value is updated with the account balance after the execution of the transaction; if the execution state of the transaction changes from the lower crossing state to the upper crossing state, the local state maximum value is updated with the account balance after the execution of the transaction.

[0100] Here, based on the above Figure 5 In the example, the first transaction is an inflow transaction, and the account balance after the first transaction is the local state minimum (local_min) = local state maximum (local_max).

[0101] The second transaction is an inflow transaction. The account balance (remain(t)) after the execution of this transaction is greater than the local state maximum (local_max). The account balance (remain(t)) after the execution of this transaction is used to update the local state maximum (local_max).

[0102] The third transaction is an inflow transaction. The account balance (remain(t)) after the execution of this transaction is greater than the local state maximum (local_max). The account balance (remain(t)) after the execution of this transaction is used to update the local state maximum (local_max).

[0103] The fourth transaction is an outflow transaction. The account balance (remain(t)) after the execution of this transaction is not greater than the local state maximum value (local_max), the account balance (remain(t)) after the execution of this transaction is not less than the local state minimum value (local_max), and the execution state of this transaction is unchanged compared with the execution state of the previous transaction. In this case, the local state maximum value (local_max) and the local state minimum value (local_max) are not updated.

[0104] The fifth transaction is an outflow transaction. The account balance (remain(t)) after the execution of this transaction is less than the local state minimum (local_max). The account balance (remain(t)) after the execution of this transaction is used to update the local state minimum (local_max).

[0105] The sixth transaction is an inflow transaction. The account balance (remain(t)) after the execution of this transaction is not greater than the local state maximum value (local_max), the account balance (remain(t)) after the execution of this transaction is not less than the local state minimum value (local_max), and the execution state of this transaction is unchanged compared with the execution state of the previous transaction. In this case, the local state maximum value (local_max) and the local state minimum value (local_max) are not updated.

[0106] The seventh transaction is an outflow transaction. The account balance (remain(t)) after the execution of this transaction is not greater than the local state maximum value (local_max), the account balance (remain(t)) after the execution of this transaction is not less than the local state minimum value (local_max), and the execution state of this transaction is unchanged compared with the execution state of the previous transaction. In this case, the local state maximum value (local_max) and the local state minimum value (local_max) are not updated.

[0107] The eighth transaction is an inflow transaction. The execution status of this transaction changes compared to the execution status of the previous transaction. The execution status of this transaction changes from the down-crossing state to the up-crossing state. The account balance after the execution of this transaction (remain(t)) is used to update the local state maximum value (local_max).

[0108] Step 406: determine a time slice with a first fixed duration within the set time, determine a sliding window with a second fixed duration formed by multiple time slices, and obtain each sliding group based on a fixed number of time slices as a sliding step of the sliding window.

[0109] Step 407: determine the number of crossovers of each time slice, and further calculate the sum of the number of crossovers of each time slice in each sliding group.

[0110] Step 408: Determine the sum of the number of crossovers of each sliding group within the set time, and use the sum of the number of crossovers as the abnormality assessment indicator of the account - the number of abnormalities.

[0111] Here, the sum of the number of upward crossings of each sliding group within the set time can also be determined, and the sum of the number of downward crossings and the sum of the number of upward crossings can be used as the abnormality assessment indicator of the account - the number of abnormalities.

[0112] Step 409: If the number of abnormalities exceeds the abnormality threshold, the account is abnormal.

[0113] It should be noted that the execution order of the above process steps is not unique. For example, step 406 can be executed before or after any step between step 402 and step 407. The execution of the process steps here is only an example and does not limit the actual implementation.

[0114] Based on the same concept, an embodiment of the present invention provides a device for detecting account anomalies. Figure 6 A schematic diagram of a device for detecting account anomalies provided in an embodiment of the present application, such as Figure 6 Including:

[0115] The acquisition module 601 is used to acquire each transaction of the account within a set time;

[0116] The processing module 602 is used to determine, for any transaction among the transactions, the execution status corresponding to the transaction according to the account status after the transaction is executed; wherein, if the account status after the transaction is executed satisfies an increase condition, the execution status of the transaction is determined to be an upward crossing; if the account status after the transaction is executed satisfies a decrease condition, the execution status of the transaction is determined to be a downward crossing;

[0117] The processing module 602 is also used to count the number of times the execution status changes from upward crossing to downward crossing in the execution status sequence of each transaction, so as to obtain the number of downward crossings of each transaction; the execution status sequence is obtained by calculating the execution status of each transaction according to the transaction order of each transaction; the processing module 602 is also used to obtain the number of abnormalities of the account according to the number of downward crossings, and determine that if the number of abnormalities exceeds the threshold of the number of abnormalities, then the account is abnormal.

[0118] Optionally, the processing module 602 is also used to set the execution status of the previous transaction of the transaction as the execution status of the transaction if the account status after the execution of the transaction does not meet the increase condition or if the account status after the execution of the transaction does not meet the decrease condition.

[0119] Optionally, the processing module 602 is specifically used to, if the transaction is an inflow transaction, determine whether the difference between the account balance after the execution of the transaction and the local state minimum value is greater than an upward crossing threshold; if so, determine that the execution state of the transaction is an upward crossing, and the local state minimum value is the minimum account balance in the set state period in which the transaction is located.

[0120] Optionally, the processing module 602 is specifically used to, if the transaction is an outflow transaction, determine that the difference between the account balance after the execution of the transaction and the local state maximum value is greater than the underpass threshold, and the account balance after the execution of the transaction is not greater than the sum of the local state minimum value and the retained balance threshold, then determine that the execution state of the transaction is underpass, the local state minimum value is the minimum account balance in the set state period in which the transaction is located, and the local state maximum value is the maximum account balance in the set state period in which the transaction is located.

[0121] Optionally, the processing module 602 is also used to determine whether the account balance after the transaction is executed is greater than the local state maximum value, and if so, use the account balance after the transaction to update the local state maximum value; determine whether the account balance after the transaction is executed is less than the local state minimum value, and if so, use the account balance after the transaction to update the local state minimum value.

[0122] Optionally, the processing module 602 is also used to judge based on the execution status sequence of each transaction, if the execution status changes from upward crossing to downward crossing, the local state minimum value is updated with the account balance after the transaction is executed; if the execution status changes from downward crossing to upward crossing, the local state maximum value is updated with the account balance after the transaction is executed.

[0123] Optionally, the processing module 602 is specifically used to divide the transactions into time slices; determine the number of crossovers of each sliding group according to the number of crossovers of each time slice; each sliding group is obtained by dividing the time slices according to a sliding window and a sliding step, and the sliding step is at least one time slice; and obtain the number of abnormalities of the account according to the number of crossovers of each sliding group.

[0124] Optionally, the processing module 602 is further configured to sort the number of abnormalities of each account from large to small, and select a pre-set number of accounts as abnormal accounts.

[0125] Optionally, the processing module 602 is further used to count the number of upward crossings of each transaction; the processing module 602 is specifically used to obtain the number of abnormalities of the account according to the number of downward crossings and the number of upward crossings.

[0126] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0127] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0128] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0129] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0130] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for detecting account anomalies, It is characterized in that include: Get all transactions of the account within the set time; For any of the transactions, determining an execution status corresponding to the transaction according to the account status after the transaction is executed; If the account status after the transaction is executed satisfies an increase condition, the execution status of the transaction is determined to be an upward crossing; if the account status after the transaction is executed satisfies a decrease condition, the execution status of the transaction is determined to be a downward crossing; Counting the number of times the execution status changes from an upward crossing to a downward crossing in the execution status sequence of each transaction, to obtain the number of downward crossings of each transaction; the execution status sequence is obtained by calculating the execution status of each transaction according to the transaction order of each transaction; Dividing each transaction into time slices; According to the number of down-crossings of each time slice, the number of down-crossings of each sliding group is determined; each sliding group is obtained by dividing the time slices according to a sliding window and a sliding step, and the sliding step is at least one time slice; According to the number of crossovers of each sliding group, the number of abnormalities of the account is obtained, the number of abnormalities of each account is sorted from large to small, and a set number of accounts are selected as abnormal accounts; After determining the execution status corresponding to the transaction, the method further includes: Based on the execution status sequence judgment of each transaction, If the execution status changes from upward crossing to downward crossing, the local state minimum value is updated with the account balance after the transaction is executed; If the execution status changes from downward crossing to upward crossing, the local state maximum value is updated with the account balance after the transaction is executed, and the updated local state minimum value and the updated local state maximum value are the parameters of the increase condition or decrease condition corresponding to the next transaction.

2. The method according to claim 1, It is characterized in that Also includes: If the account status after the transaction is executed does not satisfy the increase condition or if the account status after the transaction is executed does not satisfy the decrease condition, the execution status of the previous transaction of the transaction is set as the execution status of the transaction.

3. The method according to claim 2, It is characterized in that If the account status after the transaction is executed meets the increase condition, then the execution status of the transaction is determined to be an upward crossing, including: If the transaction is an inflow transaction, determine whether the difference between the account balance after the transaction is executed and the local state minimum value is greater than the upper crossing threshold. If so, determine that the execution state of the transaction is an upper crossing, and the local state minimum value is the minimum account balance in the set state period where the transaction is located.

4. The method according to claim 2, It is characterized in that If the account status after the transaction is executed satisfies the reduction condition, then determining that the execution status of the transaction is down-crossing includes: If the transaction is an outflow transaction, it is determined that the difference between the account balance after the execution of the transaction and the local state maximum value is greater than the underpass threshold, and the account balance after the execution of the transaction is not greater than the sum of the local state minimum value and the retained balance threshold, then it is determined that the execution state of the transaction is underpass, the local state minimum value is the minimum account balance in the set state period where the transaction is located, and the local state maximum value is the maximum account balance in the set state period where the transaction is located.

5. The method as claimed in claim 3 or 4, It is characterized in that After determining the execution status corresponding to the transaction, the method further includes: Determine whether the account balance after the transaction is executed is greater than the local state maximum value, and if so, update the local state maximum value with the account balance after the transaction is executed; Determine whether the account balance after the transaction is executed is less than the local state minimum value, and if so, update the local state minimum value with the account balance after the transaction is executed.

6. The method according to claim 2, It is characterized in that After determining the execution status corresponding to the transaction, the method further includes: Count the number of upward crossings of each transaction; Get the number of abnormal times of the account, including: The number of abnormalities of the account is obtained according to the number of downward crossings and the number of upward crossings.

7. A device for detecting account anomalies, It is characterized in that include: The acquisition module is used to obtain each transaction of the account within a set time; a processing module, configured to determine, for any transaction among the transactions, an execution status corresponding to the transaction according to the account status after the transaction is executed; wherein, if the account status after the transaction is executed satisfies an increase condition, the execution status of the transaction is determined to be an upward crossing; and if the account status after the transaction is executed satisfies a decrease condition, the execution status of the transaction is determined to be a downward crossing; The processing module is further used to count the number of times the execution status changes from an upward crossing to a downward crossing in the execution status sequence of each transaction, so as to obtain the number of downward crossings of each transaction; the execution status sequence is obtained by calculating the execution status of each transaction according to the transaction order of each transaction; The processing module is also used to divide the transactions into time slices; determine the number of down-crossings of each sliding group according to the number of down-crossings of each time slice; each sliding group is obtained by dividing the time slices according to a sliding window and a sliding step, and the sliding step is at least one time slice; obtain the number of abnormalities of the account according to the number of down-crossings of each sliding group, sort the number of abnormalities of each account from large to small, and select a pre-set number of accounts as abnormal accounts; wherein, after determining the execution status corresponding to the transaction, it also includes: based on the execution status sequence judgment of each transaction, if the execution status changes from up-crossing to down-crossing, the local state minimum value is updated with the account balance after the transaction is executed; if the execution status changes from down-crossing to up-crossing, the local state maximum value is updated with the account balance after the transaction is executed, and the updated local state minimum value and the updated local state maximum value are parameters of the increase condition or decrease condition corresponding to the next transaction.

8. A computer-readable non-volatile storage medium, It is characterized in that The computer-readable non-volatile storage medium stores a program, and when the program is run on a computer, the computer is enabled to implement the method according to any one of claims 1 to 6.

9. A computer device, It is characterized in that include: Memory for storing computer programs; A processor, configured to call a computer program stored in the memory, and execute the method according to any one of claims 1 to 6 according to the obtained program.

10. A computer program product, It is characterized in that When a computer reads and executes the computer program product, the computer is enabled to execute the method according to any one of claims 1 to 6.

Images