Abnormal transaction account identification method, system, server and storage medium

Abstract

The present invention provides a method, system, server and storage medium for identifying abnormal transaction accounts. The method is applied to the field of data processing technology. The method includes: obtaining transaction flow information of an account to be detected and determining at least one transaction cycle corresponding to the account to be detected, determining the transaction amount corresponding to the transaction cycle according to the difference between the account balance at the awakening time node of each transaction cycle and the account balance at the outbreak time node, taking the maximum transaction amount as the target transaction amount, and determining the target transaction sleep time according to the awakening time node contained in the target transaction cycle corresponding to the target transaction amount and the time of obtaining the transaction flow information of the account to be detected, and if the target transaction sleep time is greater than or equal to the target sleep time threshold, the account to be detected is determined to be an abnormal account. The present invention proposes a method for identifying abnormal accounts according to transaction amount and sleep time, which improves the accuracy of identifying abnormal accounts.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a method, system, server and storage medium for identifying abnormal transaction accounts. Background Art

[0002] Financial fraud and telecommunications fraud are becoming more and more rampant. In order to evade detection, criminals usually rent or purchase other people's bank cards to conduct financial fraud transactions through the form of "renting cards" or "buying cards".

[0003] In the prior art, in order to detect abnormal transaction accounts in advance, the transaction flow of the corresponding account of the bank card is generally tracked. If a fund transaction of an abnormal amount is detected in the transaction flow of a certain account, the fund transaction account of the bank card account will be monitored, and the funds of possible financial fraud transactions will be frozen in time.

[0004] Then, since the method in the prior art detects abnormal accounts by tracking fund transactions with abnormal amounts, accounts with normal transactions may be misjudged as abnormal accounts, affecting the accuracy of the abnormal account detection results. Summary of the invention

[0005] The present invention provides a method, system, server and storage medium for identifying abnormal transaction accounts. By proposing a method for identifying abnormal accounts according to transaction amounts and sleep time, the accuracy of abnormal account identification results is improved.

[0006] In a first aspect, the present invention provides a method for identifying an abnormal transaction account, comprising:

[0007] Acquire transaction flow information of the account to be detected, and determine a transaction time sequence corresponding to the account to be detected according to the transaction flow information, wherein the transaction time sequence includes at least one transaction sequence, and each transaction sequence includes a transaction time node and an account balance;

[0008] Obtain at least one trading cycle according to all trading sequences, and determine the awakening time node and the outbreak time node corresponding to each trading cycle according to the trading time nodes of all trading sequences contained in each trading cycle;

[0009] Determine the transaction amount corresponding to the transaction cycle according to the difference between the account balance corresponding to the awakening time node corresponding to each transaction cycle and the account balance corresponding to the outbreak time node, take the maximum transaction amount as the target transaction amount, and determine the transaction cycle corresponding to the target transaction amount as the target transaction cycle, and obtain the target transaction dormancy time according to the awakening time node included in the target transaction cycle and the time for obtaining the transaction flow information of the account to be detected;

[0010] The target dormancy time threshold corresponding to the target transaction amount is determined according to a comparison table of pre-stored transaction amounts and dormancy time thresholds. If the target transaction dormancy time is greater than or equal to the target dormancy time threshold, the account to be detected is determined to be an abnormal account.

[0011] In a possible design, before determining the target dormancy time threshold corresponding to the target transaction amount according to the pre-stored comparison table of transaction amounts and dormancy time thresholds, the method further includes:

[0012] Obtaining sample transaction flow information corresponding to at least one sample account, and determining a sample transaction time sequence corresponding to each sample account according to the sample transaction flow information corresponding to the sample account, wherein each sample transaction time sequence includes at least one sample transaction sequence, wherein each sample transaction sequence includes a sample transaction time and a sample transaction balance;

[0013] Obtain at least one sample trading cycle according to all sample trading sequences, and determine a sample awakening time node and a sample burst time node corresponding to each sample trading cycle according to the sample trading times of all sample trading sequences contained in each sample trading cycle;

[0014] Determine the sample transaction amount corresponding to the sample transaction cycle according to the difference between the sample transaction balance corresponding to the sample awakening time node and the sample transaction balance corresponding to the sample outbreak time node of each sample transaction cycle, determine the sample transaction cycle with the largest sample transaction amount corresponding to each sample account as the target sample transaction cycle of the sample account, determine the sample transaction amount corresponding to the target sample transaction cycle corresponding to each sample account as the target sample transaction amount corresponding to the sample account, and obtain the target sample dormancy time according to the sample outbreak time node included in each target transaction cycle and the time of obtaining the sample transaction flow information corresponding to the sample account;

[0015] Divide all sample accounts into at least one sample set according to at least one preset transaction reference amount interval, wherein each transaction amount reference interval corresponds to a minimum transaction amount and a maximum transaction amount, and the sample set corresponding to the transaction reference amount interval contains all sample accounts whose target sample transaction amounts are greater than or equal to the minimum transaction amount and less than or equal to the maximum transaction amount;

[0016] Determine the reference transaction amount corresponding to each sample set according to the average of the target sample transaction amounts of all sample accounts included in each sample set, and obtain the reference dormancy time corresponding to the sample set according to the target sample dormancy time of all sample accounts included in each sample set;

[0017] A comparison table of transaction amounts and dormant time thresholds is obtained based on the reference transaction amounts and reference dormant times corresponding to all sample sets.

[0018] In a possible design, obtaining the reference sleep time corresponding to each sample set according to the target sample sleep time of all sample accounts included in each sample set includes:

[0019] Obtaining a dormancy time probability distribution function corresponding to each sample set according to the target sample dormancy time of all sample accounts included in each sample set, wherein the dormancy time probability distribution function corresponding to the sample set corresponds to the reference transaction amount corresponding to the sample set, and the abscissa in each dormancy time probability distribution function is the dormancy time, and the ordinate is the probability corresponding to the dormancy time;

[0020] The reference sleep time corresponding to the sample set is obtained according to the sleep time corresponding to the preset probability threshold in each sleep time probability distribution function.

[0021] In a possible design, after all the sample accounts are divided into at least one sample set according to at least one preset transaction reference amount interval, the method further includes:

[0022] If the number of sample accounts included in the sample set is less than the preset number, the steps of obtaining sample transaction flow information corresponding to at least one sample account, determining the sample transaction time series corresponding to the sample account according to the sample transaction flow information corresponding to each sample account, determining at least one sample transaction cycle according to all the sample transaction time series, and determining the sample transaction amount corresponding to the sample transaction cycle according to the difference between the sample transaction balance corresponding to the sample awakening time node of each sample transaction cycle and the sample transaction balance corresponding to the sample outbreak time node; determining the sample transaction cycle with the largest sample transaction amount corresponding to each sample account as the target sample transaction cycle of the sample account, determining the sample transaction amount corresponding to the target sample transaction cycle corresponding to each sample account as the target sample transaction amount corresponding to the sample account, and obtaining the target sample dormancy time according to the sample outbreak time node contained in each target transaction cycle and the time of obtaining the sample transaction flow information corresponding to the sample account, until the number of sample accounts included in each sample set is greater than or equal to the preset number.

[0023] In a possible design, before obtaining the sample transaction flow information corresponding to at least one sample account, the method further includes:

[0024] Obtain transaction flow information corresponding to at least one transaction account, and obtain the cumulative transfer-in amount and the cumulative transfer-out amount of the transaction flow information corresponding to each transaction account according to a preset sampling time interval;

[0025] If the cumulative transfer-in amount or the cumulative transfer-out amount corresponding to the transaction account is greater than or equal to a preset transaction amount threshold, the transaction account is determined as a sample account.

[0026] In a possible design, determining the transaction time sequence corresponding to the account to be detected according to the transaction flow information includes:

[0027] Acquire at least one transaction sequence corresponding to the transaction flow information according to a preset time interval, wherein the transaction sequence includes a transaction start time, a transaction end time, an incoming transaction amount or an outgoing transaction amount, a transaction start balance, and a transaction end balance;

[0028] Determine the transaction start time or transaction end time included in each transaction sequence as the transaction time node corresponding to the transaction sequence, determine the account balance at the transaction start time or the account balance at the transaction end time of each transaction sequence as the account balance corresponding to the transaction sequence, and sort all transaction sequences in chronological order to obtain the transaction time sequence corresponding to the account to be detected;

[0029] Accordingly, obtaining at least one transaction cycle according to all transaction sequences, and determining the awakening time node and the outbreak time node corresponding to each transaction cycle according to the transaction time nodes of all transaction sequences contained in each transaction cycle, includes:

[0030] Numerically encoding the account balance corresponding to each transaction sequence in the transaction time sequence, clustering and grouping the encoded transaction time sequence using a mean shift algorithm, and obtaining at least one transaction cycle;

[0031] The awakening time node of each trading cycle is determined according to the transaction start time corresponding to the first trading sequence contained in each trading cycle, and the outbreak time node of the trading cycle is determined according to the transaction start time corresponding to the last trading sequence contained in each trading cycle.

[0032] In a possible design, the step of obtaining the target transaction dormancy time according to the awakening time node included in the target transaction cycle and the time of obtaining the transaction flow information of the account to be detected includes:

[0033] Determine a first transaction sequence according to the transaction time nodes corresponding to all transaction sequences in the transaction time sequence, and determine the transaction time node corresponding to the first transaction sequence as the transaction start time corresponding to the account to be detected;

[0034] If the time for acquiring the transaction flow information of the account to be detected is less than or equal to the transaction start time, the time difference between the transaction start time and the awakening time node included in the target transaction cycle is determined as the target transaction dormant time;

[0035] If the transaction start time is less than or equal to the time for obtaining the transaction flow information of the account to be detected, the time difference between the time for obtaining the transaction flow information of the account to be detected and the awakening time node included in the target transaction cycle is determined as the target transaction dormant time.

[0036] In a second aspect, the present invention provides a device for identifying an abnormal transaction account, comprising:

[0037] An acquisition module, configured to acquire transaction flow information of an account to be detected, and determine a transaction time sequence corresponding to the account to be detected according to the transaction flow information, wherein the transaction time sequence includes at least one transaction sequence, and each transaction sequence includes a transaction time node and an account balance;

[0038] A determination module, used to obtain at least one transaction cycle according to all transaction sequences, and determine the awakening time node and the outbreak time node corresponding to each transaction cycle according to the transaction time nodes of all transaction sequences contained in each transaction cycle;

[0039] An acquisition module is used to determine the transaction amount corresponding to each transaction cycle according to the difference between the account balance corresponding to the awakening time node corresponding to each transaction cycle and the account balance corresponding to the outbreak time node, take the maximum transaction amount as the target transaction amount, and determine the transaction cycle corresponding to the target transaction amount as the target transaction cycle, and obtain the target transaction dormancy time according to the awakening time node included in the target transaction cycle and the time for obtaining the transaction flow information of the account to be detected;

[0040] The determination module is used to determine the target dormancy time threshold corresponding to the target transaction amount according to a comparison table of pre-stored transaction amounts and dormancy time thresholds, and if the target transaction dormancy time is greater than or equal to the target dormancy time threshold, determine that the account to be detected is an abnormal account.

[0041] In a third aspect, the present invention provides a server, comprising: at least one processor and a memory;

[0042] The memory stores computer-executable instructions;

[0043] The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the method for identifying accounts with abnormal transactions as described in the first aspect and various possible designs of the first aspect.

[0044] In a fourth aspect, the present invention provides a computer storage medium storing computer execution instructions. When a processor executes the computer execution instructions, the method for identifying abnormal transaction accounts as described in the first aspect and various possible designs of the first aspect is implemented.

[0045] In a fifth aspect, the present invention provides a computer program product, including a computer program, which, when executed by a processor, implements the method for identifying abnormal transaction accounts as described in the first aspect and various possible designs of the first aspect.

[0046] The method, system, server and storage medium for identifying abnormal transaction accounts provided by the present invention obtain the transaction flow information of the account to be detected, determine the transaction time sequence corresponding to the account to be detected according to the transaction flow information, determine at least one transaction cycle according to all the transaction time sequences, and determine the transaction amount corresponding to the transaction cycle according to the difference between the account balance corresponding to the awakening time node of each transaction cycle and the account balance corresponding to the outbreak time node, take the maximum transaction amount as the target transaction amount, determine the transaction time sequence corresponding to the target transaction amount as the target transaction sequence, obtain the target transaction dormancy time according to the awakening time node contained in the target transaction cycle and the time of obtaining the transaction flow information of the account to be detected, determine the target dormancy time threshold corresponding to the target transaction amount according to the comparison table of the pre-stored transaction amount and the dormancy time threshold, and if the target transaction dormancy time is greater than or equal to the target dormancy time threshold, the account to be detected is determined to be an abnormal account. The present invention proposes a method for identifying abnormal accounts according to transaction amount and dormancy time, which improves the accuracy of identifying abnormal accounts. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0048] Figure 1 It is a schematic diagram of an application scenario of the method for identifying abnormal transaction accounts provided by an embodiment of the present invention;

[0049] Figure 2 Schematic diagram of the process of identifying abnormal transaction accounts provided by an embodiment of the present invention Figure 1 ;

[0050] Figure 3 Schematic diagram of the process of identifying abnormal transaction accounts provided by an embodiment of the present invention Figure 2 ;

[0051] Figure 4 A schematic diagram of a sleep time probability distribution function provided by an embodiment of the present invention;

[0052] Figure 5 A schematic diagram of the structure of a device for identifying abnormal transaction accounts provided by an embodiment of the present invention;

[0053] Figure 6 A schematic diagram of the hardware structure of a server provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0054] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0055] In the technical solution of this application, the collection, storage, use, processing, transmission, provision and disclosure of information such as financial data or user data involved shall comply with the provisions of relevant laws and regulations and shall not violate public order and good morals.

[0056] In the prior art, criminals usually rent or buy other people's bank accounts to conduct financial fraud transactions in order to avoid being tracked down by "renting cards" or "buying cards". Banking institutions can protect customers' property by detecting abnormal accounts in advance. Generally, by tracking the transaction flow of the account corresponding to the bank card, if a fund transaction of an abnormal amount is detected in the transaction flow of a certain account, the fund transaction account of the bank card account will be monitored, and the funds of possible financial fraud transactions will be frozen in time. However, due to the method of detecting abnormal accounts by tracking fund transactions of abnormal amounts in the prior art, normal transaction accounts may be misjudged as abnormal accounts, affecting the accuracy of the abnormal account detection results.

[0057] In order to solve the above technical problems, the embodiment of the present invention proposes the following technical solution: by determining the target transaction amount and the target transaction dormancy time according to the transaction flow information of the account to be detected, determining the target dormancy time threshold corresponding to the target transaction amount according to the comparison table of the pre-stored transaction amount and the dormancy time threshold, if the target transaction dormancy time is greater than or equal to the target dormancy time threshold, the account to be detected is determined to be an abnormal account. The present invention improves the accuracy of the abnormal account identification result by proposing a method for identifying abnormal accounts according to the transaction amount and the dormancy time. The following is a detailed description using a detailed embodiment.

[0058] Figure 1Schematic diagram of the application scenario of the method for identifying abnormal transaction accounts provided by an embodiment of the present invention. Figure 1 As shown, the terminal of the banking institution will collect and store the transaction flow information of all bank accounts. The terminal will send the collected transaction flow information to the backend server for data processing. The backend server will analyze the transaction flow information of the account to be detected, and determine whether the account to be detected is an abnormal account based on the comparison table of transaction amount and dormant time threshold pre-stored in the server, thereby improving the accuracy of identifying abnormal accounts.

[0059] Figure 2 Schematic diagram of the process of identifying abnormal transaction accounts provided by an embodiment of the present invention Figure 1 , the execution subject of this embodiment can be Figure 1 The server in the embodiment shown is not particularly limited in this embodiment. Figure 2 As shown, the method includes:

[0060] S201: Acquire transaction flow information of the account to be detected, and determine the transaction time sequence corresponding to the account to be detected according to the transaction flow information, wherein the transaction time sequence includes at least one transaction sequence, and each transaction sequence includes a transaction time node and an account balance.

[0061] In an embodiment of the present invention, the transaction flow information of the account to be detected sent by the terminal includes all transaction information of the account. Exemplarily, the transaction flow information includes the transaction start time and transaction end time, the transaction direction such as expenditure and income, and also includes the registration information of the transaction merchant, the transaction bill number, and the balance after the transaction. Exemplarily, after obtaining all the transaction flow information of the account to be detected, the transaction time sequence corresponding to the account is obtained according to all the transaction flow information. Exemplarily, at least one transaction sequence corresponding to the transaction flow information can be obtained according to a preset time interval, wherein the transaction sequence includes the transaction start time, transaction end time, account entry transaction amount or account exit transaction amount, transaction start balance, and transaction end balance. Exemplarily, the preset time interval can be 1 minute. If no transaction occurs in any time interval, there is no corresponding transaction sequence for the time interval. If multiple financial transactions occur within any time interval, the transaction amount is the total value of the transaction amounts of all incoming transaction amounts or outgoing transaction amounts, that is, the sum of the incoming transaction amounts contained in the multiple financial transactions is recorded as a positive value, and the sum of the outgoing transaction amounts is recorded as a negative value. The total value of the positive and negative values ​​is calculated. If the total value is greater than zero, it is recorded as the incoming transaction amount of the transaction sequence corresponding to the time interval. If the total value is less than zero, it is recorded as the outgoing transaction amount of the transaction sequence corresponding to the time interval.

[0062] Exemplarily, the transaction start time or transaction end time included in each transaction sequence is determined as the transaction time node corresponding to the transaction sequence, the account balance at the transaction start time or the account balance at the transaction end time of each transaction sequence is determined as the account balance corresponding to the transaction sequence, and all transaction sequences are sorted in chronological order to obtain the transaction time sequence corresponding to the account to be detected. Specifically, the transaction start time corresponding to each transaction sequence is the time when the transaction starts, that is, multiple financial transactions may be included in the time interval, and the start time of the first transaction is determined as the transaction start time corresponding to the transaction sequence. The transaction end time is the corresponding time after the last transaction ends.

[0063] S202: Obtain at least one transaction cycle according to all transaction sequences, and determine the awakening time node and the outbreak time node corresponding to each transaction cycle according to the transaction time nodes of all transaction sequences included in each transaction cycle.

[0064] In an embodiment of the present invention, the account balance corresponding to each transaction sequence in the transaction time sequence is numerically encoded, and the encoded transaction time sequence is clustered and grouped using a mean shift algorithm to obtain at least one transaction cycle. Among them, the mean shift clustering algorithm is an algorithm based on a sliding window, which attempts to find dense data points. Specifically, the account balance of each transaction sequence is numerically encoded according to a preset unit transaction amount to obtain a transaction parameter corresponding to each transaction sequence. A transaction parameter change curve is generated according to a preset time interval and the transaction parameters corresponding to each transaction sequence. The account amount of the transaction sequence whose encoded transaction parameter is less than the preset transaction parameter is set to zero. According to the transaction sequence whose account amount is set to zero, all transaction sequences are divided into multiple segmented transaction sequences, each of which contains multiple transaction sequences whose transaction parameters are not zero. In each segmented transaction sequence, a time point corresponding to any transaction sequence is selected as the center point, and a time window of a preset length is slid from the center point on the time axis of the transaction parameter change curve according to the size of the preset time interval, and the average value of the transaction parameters of all transaction sequences contained in the time window after each sliding is calculated, and the sliding direction is adjusted according to the average value of the transaction parameters of the time window after each sliding, and the time window will gradually move in the direction of a higher average value of the transaction parameters by moving to the average value of the transaction parameters of the time window. In each segmented transaction sequence, multiple transaction sequences are used as the center point to slide the time window, and a time window with a higher average value of the transaction parameters corresponding to each segmented transaction sequence will be obtained. The transaction cycle is determined according to the transaction sequence with the highest transaction amount contained in the time window with the highest transaction parameter average value after the sliding is completed, wherein the transaction start time of the first non-zero transaction sequence contained in the segmented transaction sequence is determined as the awakening time node of the transaction cycle, and the transaction start time corresponding to the transaction sequence with the highest transaction amount contained in the time window with the highest average value is determined as the outbreak time node of the transaction cycle.

[0065] S203: Determine the transaction amount corresponding to the transaction cycle according to the difference between the account balance corresponding to the awakening time node corresponding to each transaction cycle and the account balance corresponding to the outbreak time node, take the maximum transaction amount as the target transaction amount, and determine the transaction cycle corresponding to the target transaction amount as the target transaction cycle, and obtain the target transaction dormancy time according to the awakening time node included in the target transaction cycle and the time for obtaining the transaction flow information of the account to be detected.

[0066] In an embodiment of the present invention, after obtaining the transaction time sequence of the account to be detected, all transaction sequences contained in the transaction time sequence are analyzed. Since the abnormal mutation characteristics of the abnormal account are a long dormant period and a large transaction amount, that is, the correspondence between the dormant period and the outbreak characteristics, the transaction time sequence corresponding to the account can be analyzed to determine the transaction outbreak point of the account and the dormant time corresponding to the outbreak point, so as to improve the accuracy of identifying abnormal accounts. Exemplarily, the transaction amount corresponding to the transaction cycle is determined according to the difference between the account balance corresponding to the awakening time node corresponding to each transaction cycle and the account balance corresponding to the outbreak time node, the maximum transaction amount is used as the target transaction amount, and the transaction cycle corresponding to the target transaction amount is determined as the target transaction cycle, and the target transaction dormant time is obtained according to the awakening time node contained in the target transaction cycle and the time of obtaining the transaction flow information of the account to be detected. Exemplarily, the first transaction sequence is determined according to the transaction times corresponding to all transaction sequences in the transaction time sequence, and the transaction time node corresponding to the first transaction sequence is determined as the transaction start time corresponding to the account to be detected; if the time for obtaining the transaction flow information of the account to be detected is less than or equal to the transaction start time, the time difference between the transaction start time and the awakening time node included in the target transaction cycle is determined as the target transaction dormancy time; if the transaction start time is less than or equal to the time for obtaining the transaction flow information of the account to be detected, the time difference between the time for obtaining the transaction flow information of the account to be detected and the awakening time node included in the target transaction cycle is determined as the target transaction dormancy time.

[0067] S204: Determine the target dormancy time threshold corresponding to the target transaction amount according to the comparison table of pre-stored transaction amounts and dormancy time thresholds. If the target transaction dormancy time is greater than or equal to the target dormancy time threshold, determine that the account to be detected is an abnormal account.

[0068] In the embodiment of the present invention, a comparison table of transaction amounts and dormancy time thresholds is pre-stored, that is, different transaction amounts correspond to different dormancy time thresholds. The target dormancy time threshold corresponding to the target transaction amount can be determined according to the comparison table. When the target transaction dormancy time is greater than or equal to the target dormancy time threshold, it indicates that the account may have abnormal transactions, and the account to be detected is determined to be an abnormal account.

[0069] The method for identifying abnormal transaction accounts provided by an embodiment of the present invention obtains the transaction flow information of the account to be detected and determines the target transaction amount and the target transaction dormancy time, and determines the target dormancy time threshold corresponding to the target transaction amount according to a comparison table of pre-stored transaction amount and dormancy time threshold. If the target transaction dormancy time is greater than or equal to the target dormancy time threshold, the account to be detected is determined to be an abnormal account. A method for identifying abnormal accounts according to transaction amount and dormancy time is proposed, which improves the accuracy of the results of identifying abnormal accounts.

[0070] Figure 3 Schematic diagram of the process of identifying abnormal transaction accounts provided by an embodiment of the present invention Figure 2 .like Figure 3 As shown, in Figure 2 Before determining the target dormancy time threshold corresponding to the target transaction amount according to the pre-stored comparison table of transaction amounts and dormancy time thresholds provided in the provided embodiment, the embodiment of the present invention provides a method for determining the comparison table of dormancy time thresholds, the method comprising the following steps:

[0071] S301: Obtain sample transaction flow information corresponding to at least one sample account, and determine a sample transaction time series corresponding to the sample account based on the sample transaction flow information corresponding to each sample account, wherein each sample transaction time series includes at least one sample transaction sequence, wherein each sample transaction sequence includes a sample transaction time and a sample transaction amount.

[0072] Exemplarily, the terminal will send the collected and stored transaction flow information corresponding to the multiple accounts to the server. In an embodiment of the present invention, the sample transaction flow information corresponding to the sample accounts sent by the multiple terminals can be analyzed to identify the relationship between the dormant period and the burst amount of the abnormal account, and obtain a comparison table of the transaction amount and the dormant time threshold. Exemplarily, in order to improve the accuracy of the obtained comparison table results, relatively active station accounts can be extracted as sample accounts. Exemplarily, before obtaining the sample transaction flow information corresponding to at least one sample account, the transaction flow information corresponding to at least one transaction account is obtained, and the cumulative transfer amount and the cumulative transfer amount corresponding to the transaction flow information corresponding to each transaction account are obtained according to the preset sampling time interval; if the cumulative transfer amount or the cumulative transfer amount corresponding to the transaction account is greater than or equal to the preset transaction amount threshold, the transaction account is determined as a sample account. Exemplarily, the preset sampling time interval is 15 months, that is, the historical transaction sequence corresponding to each transaction account within 15 months is obtained. If the cumulative transfer amount or the cumulative transfer amount corresponding to the transaction account is greater than or equal to the preset transaction amount threshold, the account is determined to be an active transaction account, and the transaction account is determined as a sample account. In an embodiment of the present invention, a method and method for obtaining sample transaction flow information corresponding to at least one sample account, and determining a sample transaction time sequence corresponding to the sample account according to the sample transaction flow information corresponding to each sample account is provided. Figure 2 The method of S201 in the embodiment is consistent and will not be repeated here.

[0073] S302: Obtain at least one sample transaction cycle according to all sample transaction sequences, and determine a sample awakening time node and a sample outbreak time node corresponding to each sample transaction cycle according to the sample transaction times of all sample transaction sequences included in each sample transaction cycle.

[0074] S303: Determine the sample transaction amount corresponding to the sample transaction cycle according to the difference between the sample transaction balance corresponding to the sample awakening time node of each sample transaction cycle and the sample transaction balance corresponding to the sample outbreak time node, determine the sample transaction cycle with the largest sample transaction amount corresponding to each sample account as the target sample transaction cycle of the sample account, determine the sample transaction amount corresponding to the target sample transaction cycle corresponding to each sample account as the target sample transaction amount corresponding to the sample account, and obtain the target sample dormancy time according to the sample outbreak time node included in each target transaction cycle and the time for obtaining the sample transaction flow information corresponding to the sample account.

[0075] The method and effect of S302 to S303 are the same as Figure 2 The methods from S202 to S203 in the embodiments are the same and will not be described again here.

[0076] S304: Divide all sample accounts into at least one sample set according to at least one preset transaction reference amount interval, wherein each transaction amount reference interval corresponds to a minimum transaction amount and a maximum transaction amount, and the sample set corresponding to the transaction reference amount interval contains all sample accounts whose target sample transaction amounts are greater than or equal to the minimum transaction amount and less than or equal to the maximum transaction amount.

[0077] In an embodiment of the present invention, in order to obtain the correlation between the dormant period corresponding to an abnormal account and the burst amount, the dormant period corresponding to an account with a similar burst amount can be analyzed. Exemplarily, all sample accounts are divided into at least one sample set according to at least one preset transaction reference amount interval. Specifically, the range of the transaction reference amount interval corresponds to a minimum transaction amount and a maximum transaction amount, and all sample accounts falling within the range are divided into a sample set, that is, the difference between the target sample transaction amounts corresponding to all sample accounts included in the same sample set is less than the difference range of the transaction reference amount interval.

[0078] Exemplarily, in order to ensure the number of sample accounts included in each sample set, if the number of sample accounts included in the sample set is less than the preset number, steps S301 and S303 are repeated. When the number of sample accounts included in the sample set is greater than or equal to the preset number, the correlation between the dormant period corresponding to the abnormal account and the outbreak amount can be accurately analyzed based on the sample account.

[0079] S305: Determine the reference transaction amount corresponding to the sample set according to the mean of the target sample transaction amounts of all sample accounts included in each sample set, and obtain the reference dormancy time corresponding to the sample set according to the target sample dormancy time of all sample accounts included in each sample set.

[0080] Exemplarily, a sleep time probability distribution function corresponding to the sample set is obtained based on the target sample sleep time of all sample accounts included in each sample set, wherein the sleep time probability distribution function corresponding to the sample set corresponds to the reference transaction amount corresponding to the sample set, and the horizontal axis in each sleep time probability distribution function is the sleep time, and the vertical axis is the probability corresponding to the sleep time; the reference sleep time corresponding to the sample set is obtained based on the sleep time corresponding to the preset probability threshold in each sleep time probability distribution function.

[0081] In the embodiment of the present invention, the sleep time probability distribution function corresponding to the sample set can be obtained by using the target sample sleep time of all sample accounts included in each sample set according to the Pareto function fitting algorithm. The horizontal axis of each sleep time probability distribution function is the sleep time, and the vertical axis is the probability corresponding to the sleep time. Figure 4 As shown, Figure 4 A schematic diagram of the dormancy time probability distribution function provided for an embodiment of the present invention. For example, a sample set contains 50 sample accounts, of which 10 sample accounts correspond to a target sample dormancy time of 10 months, 10 sample accounts correspond to a target sample dormancy time of 20 months, 10 sample accounts correspond to a target sample dormancy time of 30 months, 10 sample accounts correspond to a target sample dormancy time of 50 months, and 10 sample accounts correspond to a target sample dormancy time of 70 months. The Pareto function fitting algorithm can be used to analyze the 50 sample accounts contained in the sample set and the target sample dormancy time corresponding to each sample account to obtain the dormancy time probability distribution function corresponding to the sample set.

[0082] In an embodiment of the present invention, after obtaining the sleep time probability distribution function corresponding to the sample set, the reference sleep time corresponding to the sample set can be obtained according to the sleep time corresponding to the preset probability threshold in the sleep time probability distribution function. After obtaining the sleep time probability distribution function corresponding to the sample set, if the target sample sleep time corresponding to any sample account in the sample set is greater than the reference sleep time, it can be considered that the sleep time corresponding to the financial transaction of the account is abnormal, that is, the sample account is an abnormal account. Exemplarily, the preset probability threshold can be adjusted according to demand.

[0083] S306: Obtain a comparison table of transaction amounts and dormant time thresholds according to reference transaction amounts and reference dormant times corresponding to all sample sets.

[0084] In an embodiment of the present invention, after obtaining the reference sleep time corresponding to each sample set, the reference transaction amount corresponding to each sample set is associated with the sleep time threshold corresponding to the sample set, and a comparison table of transaction amounts and sleep time thresholds corresponding to all sample sets is obtained.

[0085] The method for identifying abnormal transaction accounts provided in this embodiment utilizes the sample transaction flow information of each sample account, and divides all sample accounts into at least one sample set according to at least one preset transaction reference amount interval, and obtains a comparison table of transaction amounts and dormant time thresholds to identify the correlation between the reference transaction amount corresponding to each sample set and the dormant time threshold corresponding to the sample set, thereby improving the accuracy of the results of identifying abnormal accounts.

[0086] Figure 5 A schematic diagram of the structure of the abnormal transaction account identification device provided by an embodiment of the present invention. Figure 5 As shown, the device for identifying an abnormal transaction account includes: an acquisition module 501 , a determination module 502 , an acquisition module 503 and a determination module 504 .

[0087] The acquisition module 501 is used to obtain the transaction flow information of the account to be detected, and determine the transaction time sequence corresponding to the account to be detected according to the transaction flow information, wherein the transaction time sequence includes at least one transaction sequence, and each transaction sequence includes a transaction time node and an account balance.

[0088] The determination module 502 is used to obtain at least one transaction cycle according to all transaction sequences, and determine the awakening time node and the outbreak time node corresponding to each transaction cycle according to the transaction time nodes of all transaction sequences included in each transaction cycle.

[0089] The acquisition module 503 is used to determine the transaction amount corresponding to the transaction cycle according to the difference between the account balance corresponding to the awakening time node corresponding to each transaction cycle and the account balance corresponding to the outbreak time node, take the maximum transaction amount as the target transaction amount, and determine the transaction cycle corresponding to the target transaction amount as the target transaction cycle, and obtain the target transaction dormancy time according to the awakening time node included in the target transaction cycle and the time for obtaining the transaction flow information of the account to be detected.

[0090] The determination module 504 is used to determine the target dormancy time threshold corresponding to the target transaction amount according to a comparison table of pre-stored transaction amounts and dormancy time thresholds. If the target transaction dormancy time is greater than or equal to the target dormancy time threshold, the account to be detected is determined to be an abnormal account.

[0091] In a possible implementation, the abnormal transaction account identification device also includes an acquisition module, which is specifically used to obtain sample transaction flow information corresponding to at least one sample account, and determine the sample transaction time series corresponding to the sample account according to the sample transaction flow information corresponding to each sample account, wherein each sample transaction time series includes at least one sample transaction sequence, wherein each sample transaction sequence includes a sample transaction time and a sample transaction balance; obtain at least one sample transaction cycle according to all the sample transaction sequences, and determine the sample awakening time node and the sample outbreak time node corresponding to each sample transaction cycle according to the sample transaction time of all the sample transaction sequences included in each sample transaction cycle; determine the sample transaction amount corresponding to the sample transaction cycle according to the difference between the sample transaction balance corresponding to the sample awakening time node and the sample transaction balance corresponding to the sample outbreak time node of each sample transaction cycle, determine the sample transaction cycle with the largest sample transaction amount corresponding to each sample account as the target sample transaction cycle of the sample account, and The sample transaction amount corresponding to the target period is determined as the target sample transaction amount corresponding to the sample account, and the target sample dormancy time is obtained according to the sample outbreak time node contained in each target transaction period and the time of obtaining the sample transaction flow information corresponding to the sample account; all the sample accounts are divided into at least one sample set according to at least one preset transaction reference amount interval, wherein each transaction amount reference interval corresponds to a minimum transaction amount and a maximum transaction amount, and the sample set corresponding to the transaction reference amount interval contains target sample transaction amounts of all sample accounts greater than or equal to the minimum transaction amount and less than or equal to the maximum transaction amount; the reference transaction amount corresponding to the sample set is determined according to the average of the target sample transaction amounts of all the sample accounts contained in each sample set, and the reference dormancy time corresponding to the sample set is obtained according to the target sample dormancy time of all the sample accounts contained in each sample set; a comparison table of transaction amount and dormancy time thresholds is obtained according to the reference transaction amounts and reference dormancy times corresponding to all the sample sets.

[0092] In a possible implementation, the acquisition module is also used to obtain the sleep time probability distribution function corresponding to the sample set based on the target sample sleep time of all sample accounts included in each sample set, wherein the sleep time probability distribution function corresponding to the sample set corresponds to the reference transaction amount corresponding to the sample set, and the horizontal axis in each sleep time probability distribution function is the sleep time, and the vertical axis is the probability corresponding to the sleep time; the reference sleep time corresponding to the sample set is obtained according to the sleep time corresponding to the preset probability threshold in each sleep time probability distribution function.

[0093] In one possible implementation, the acquisition module is also used to repeatedly execute the steps of obtaining sample transaction flow information corresponding to at least one sample account if the number of sample accounts included in the sample set is less than a preset number, and determining the sample transaction time series corresponding to the sample account based on the sample transaction flow information corresponding to each sample account, determining at least one sample transaction cycle based on all the sample transaction time series, and determining the sample transaction amount corresponding to the sample transaction cycle based on the difference between the sample transaction balance corresponding to the sample awakening time node of each sample transaction cycle and the sample transaction balance corresponding to the sample outbreak time node; determining the sample transaction cycle with the largest sample transaction amount corresponding to each sample account as the target sample transaction cycle of the sample account, determining the sample transaction amount corresponding to the target sample transaction cycle corresponding to each sample account as the target sample transaction amount corresponding to the sample account, and obtaining the target sample dormancy time based on the sample outbreak time node included in each target transaction cycle and the time for obtaining the sample transaction flow information corresponding to the sample account, until the number of sample accounts included in each sample set is greater than or equal to the preset number.

[0094] In one possible implementation, the acquisition module 501 is also used to obtain transaction flow information corresponding to at least one transaction account, and obtain the cumulative transfer-in amount and the cumulative transfer-out amount of the transaction flow information corresponding to each transaction account according to a preset sampling time interval; if the cumulative transfer-in amount or the cumulative transfer-out amount corresponding to the transaction account is greater than or equal to the preset transaction amount threshold, the transaction account is determined as a sample account.

[0095] In a possible implementation, the acquisition module 501 is specifically used to acquire at least one transaction sequence corresponding to the transaction flow information according to a preset time interval, wherein the transaction sequence includes a transaction start time, a transaction end time, an incoming transaction amount or an outgoing transaction amount, a transaction start balance, and a transaction end balance; each transaction sequence including a transaction start time or a transaction end time is determined as a transaction time node corresponding to the transaction sequence, the account balance at the transaction start time or the account balance at the transaction end time of each transaction sequence is determined as the account balance corresponding to the transaction sequence, and all transaction sequences are sorted in chronological order to obtain the transaction time sequence corresponding to the account to be detected. Correspondingly, the determination module 502 is specifically used to numerically encode the account balance corresponding to each transaction sequence in the transaction time sequence, cluster and group the encoded transaction time sequence using a mean shift algorithm, and obtain at least one transaction cycle; determine the awakening time node of the transaction cycle according to the transaction start time corresponding to the first transaction sequence contained in each transaction cycle, and determine the outbreak time node of the transaction cycle according to the transaction start time corresponding to the last transaction sequence contained in each transaction cycle.

[0096] In a possible implementation, the determination module 502 is specifically used to determine the first transaction sequence based on the transaction time nodes corresponding to all transaction sequences in the transaction time sequence, and determine the transaction time node corresponding to the first transaction sequence as the transaction start time corresponding to the account to be detected; if the time for obtaining the transaction flow information of the account to be detected is less than or equal to the transaction start time, then the time difference between the transaction start time and the awakening time node contained in the target transaction cycle is determined as the target transaction sleep time; if the transaction start time is less than or equal to the time for obtaining the transaction flow information of the account to be detected, then the time difference between the time for obtaining the transaction flow information of the account to be detected and the awakening time node contained in the target transaction cycle is determined as the target transaction sleep time.

[0097] The device provided in this embodiment can be used to execute the technical solution of the above method embodiment. Its implementation principle and technical effect are similar, and this embodiment will not be repeated here.

[0098] Figure 6 The hardware structure diagram of the server provided in the embodiment of the present invention is shown in FIG. Figure 6 As shown, the server of this embodiment includes: a processor 601 and a memory 602; wherein,

[0099] Memory 602, used to store computer-executable instructions;

[0100] The processor 601 is used to execute the computer-executable instructions stored in the memory to implement the various steps executed by the server in the above embodiment. For details, please refer to the relevant description in the above method embodiment.

[0101] Optionally, the memory 602 may be independent or integrated with the processor 601 .

[0102] When the memory 602 is independently provided, the server further includes a bus 603 for connecting the memory 602 and the processor 601 .

[0103] An embodiment of the present invention further provides a computer storage medium, in which computer execution instructions are stored. When a processor executes the computer execution instructions, the method for identifying an account with abnormal transactions as described above is implemented.

[0104] The embodiment of the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements the above-mentioned method for identifying an abnormal transaction account. The embodiment of the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements the above-mentioned method for identifying an abnormal transaction account.

[0105] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the modules is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0106] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to implement the solution of this embodiment.

[0107] In addition, each functional module in each embodiment of the present invention may be integrated into one processing unit, or each module may exist physically separately, or two or more modules may be integrated into one unit. The above-mentioned module-composed unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0108] The above-mentioned integrated module implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, including a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the method described in each embodiment of the present application.

[0109] It should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be implemented by a combination of hardware and software modules in the processor.

[0110] The memory may include a high-speed RAM memory, and may also include a non-volatile storage NVM, such as at least one disk memory, and may also be a USB flash drive, a mobile hard disk, a read-only memory, a magnetic disk or an optical disk, etc.

[0111] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0112] The above storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The storage medium can be any available medium that can be accessed by a general or special purpose computer.

[0113] An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the storage medium can also exist as discrete components in an electronic device or a main control device.

[0114] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0115] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for identifying abnormal transaction accounts, characterized in that: include: Acquire transaction flow information of the account to be detected, and determine a transaction time sequence corresponding to the account to be detected according to the transaction flow information, wherein the transaction time sequence includes at least one transaction sequence, and each transaction sequence includes a transaction time node and an account balance; Obtain at least one trading cycle according to all trading sequences, and determine the awakening time node and the outbreak time node corresponding to each trading cycle according to the trading time nodes of all trading sequences contained in each trading cycle; Determine the transaction amount corresponding to the transaction cycle according to the difference between the account balance corresponding to the awakening time node corresponding to each transaction cycle and the account balance corresponding to the outbreak time node, take the maximum transaction amount as the target transaction amount, and determine the transaction cycle corresponding to the target transaction amount as the target transaction cycle, and obtain the target transaction dormancy time according to the awakening time node included in the target transaction cycle and the time for obtaining the transaction flow information of the account to be detected; Determine the target dormancy time threshold corresponding to the target transaction amount according to a pre-stored comparison table of transaction amounts and dormancy time thresholds, and if the target transaction dormancy time is greater than or equal to the target dormancy time threshold, determine that the account to be detected is an abnormal account; Before determining the target dormancy time threshold corresponding to the target transaction amount according to the pre-stored comparison table of transaction amounts and dormancy time thresholds, the method further includes: Obtaining sample transaction flow information corresponding to at least one sample account, and determining a sample transaction time sequence corresponding to each sample account according to the sample transaction flow information corresponding to the sample account, wherein each sample transaction time sequence includes at least one sample transaction sequence, wherein each sample transaction sequence includes a sample transaction time and a sample transaction balance; Obtain at least one sample trading cycle according to all sample trading sequences, and determine a sample awakening time node and a sample burst time node corresponding to each sample trading cycle according to the sample trading times of all sample trading sequences contained in each sample trading cycle; Determine the sample transaction amount corresponding to the sample transaction cycle according to the difference between the sample transaction balance corresponding to the sample awakening time node of each sample transaction cycle and the sample transaction balance corresponding to the sample outbreak time node, determine the sample transaction cycle with the largest sample transaction amount corresponding to each sample account as the target sample transaction cycle of the sample account, determine the sample transaction amount corresponding to the target sample transaction cycle corresponding to each sample account as the target sample transaction amount corresponding to the sample account, and obtain the target sample dormancy time according to the sample awakening time node included in each target transaction cycle and the time of obtaining the sample transaction flow information corresponding to the sample account; Divide all sample accounts into at least one sample set according to at least one preset transaction reference amount interval, wherein each transaction amount reference interval corresponds to a minimum transaction amount and a maximum transaction amount, and the sample set corresponding to the transaction reference amount interval contains all sample accounts whose target sample transaction amounts are greater than or equal to the minimum transaction amount and less than or equal to the maximum transaction amount; Determine the reference transaction amount corresponding to each sample set according to the average of the target sample transaction amounts of all sample accounts included in each sample set, and obtain the reference dormancy time corresponding to the sample set according to the target sample dormancy time of all sample accounts included in each sample set; A comparison table of transaction amount and dormancy time thresholds is obtained based on the reference transaction amounts and reference dormancy times corresponding to all sample sets.

2. The method according to claim 1, characterized in that The obtaining the reference sleep time corresponding to each sample set according to the target sample sleep time of all sample accounts included in each sample set includes: Obtaining a dormancy time probability distribution function corresponding to each sample set according to the target sample dormancy time of all sample accounts included in each sample set, wherein the dormancy time probability distribution function corresponding to the sample set corresponds to the reference transaction amount corresponding to the sample set, and the abscissa in each dormancy time probability distribution function is the dormancy time, and the ordinate is the probability corresponding to the dormancy time; The reference sleep time corresponding to the sample set is obtained according to the sleep time corresponding to the preset probability threshold in each sleep time probability distribution function.

3. The method according to claim 1, characterized in that After all the sample accounts are divided into at least one sample set according to at least one preset transaction reference amount interval, the method further includes: If the number of sample accounts included in the sample set is less than the preset number, the step of obtaining sample transaction flow information corresponding to at least one sample account, and determining the sample transaction time series corresponding to the sample account according to the sample transaction flow information corresponding to each sample account, determining at least one sample transaction cycle according to all the sample transaction time series, and determining the sample transaction amount corresponding to the sample transaction cycle according to the difference between the sample transaction balance corresponding to the sample awakening time node of each sample transaction cycle and the sample transaction balance corresponding to the sample outbreak time node; determining the sample transaction cycle with the largest sample transaction amount corresponding to each sample account as the target sample transaction cycle of the sample account, determining the sample transaction amount corresponding to the target sample transaction cycle corresponding to each sample account as the target sample transaction amount corresponding to the sample account, and obtaining the target sample dormancy time according to the sample awakening time node contained in each target transaction cycle and the time of obtaining the sample transaction flow information corresponding to the sample account, until the number of sample accounts included in each sample set is greater than or equal to the preset number.

4. The method according to claim 1, characterized in that: Before obtaining the sample transaction flow information corresponding to at least one sample account, the method further includes: Obtain transaction flow information corresponding to at least one transaction account, and obtain the cumulative transfer-in amount and the cumulative transfer-out amount of the transaction flow information corresponding to each transaction account according to a preset sampling time interval; If the cumulative transfer-in amount or the cumulative transfer-out amount corresponding to the transaction account is greater than or equal to a preset transaction amount threshold, the transaction account is determined as a sample account.

5. The method according to claim 1, characterized in that The determining, according to the transaction flow information, the transaction time sequence corresponding to the account to be detected includes: Acquire at least one transaction sequence corresponding to the transaction flow information according to a preset time interval, wherein the transaction sequence includes a transaction start time, a transaction end time, an incoming transaction amount or an outgoing transaction amount, a transaction start balance, and a transaction end balance; Determine the transaction start time or transaction end time included in each transaction sequence as the transaction time node corresponding to the transaction sequence, determine the account balance at the transaction start time or the account balance at the transaction end time of each transaction sequence as the account balance corresponding to the transaction sequence, and sort all transaction sequences in chronological order to obtain the transaction time sequence corresponding to the account to be detected; Accordingly, obtaining at least one transaction cycle according to all transaction sequences, and determining the awakening time node and the outbreak time node corresponding to each transaction cycle according to the transaction time nodes of all transaction sequences contained in each transaction cycle, includes: Numerically encoding the account balance corresponding to each transaction sequence in the transaction time sequence, clustering and grouping the encoded transaction time sequence using a mean shift algorithm, and obtaining at least one transaction cycle; The awakening time node of each trading cycle is determined according to the transaction start time corresponding to the first trading sequence contained in each trading cycle, and the outbreak time node of the trading cycle is determined according to the transaction start time corresponding to the last trading sequence contained in each trading cycle.

6. The method according to any one of claims 1 to 5, characterized in that: The step of obtaining the target transaction dormancy time according to the awakening time node included in the target transaction cycle and the time of acquiring the transaction flow information of the account to be detected includes: Determine a first transaction sequence according to the transaction time nodes corresponding to all transaction sequences in the transaction time sequence, and determine the transaction time node corresponding to the first transaction sequence as the transaction start time corresponding to the account to be detected; If the time for acquiring the transaction flow information of the account to be detected is less than or equal to the transaction start time, the time difference between the transaction start time and the awakening time node included in the target transaction cycle is determined as the target transaction dormant time; If the transaction start time is less than or equal to the time for obtaining the transaction flow information of the account to be detected, the time difference between the time for obtaining the transaction flow information of the account to be detected and the awakening time node included in the target transaction cycle is determined as the target transaction dormant time.

7. A device for identifying abnormal transaction accounts, characterized in that: include: An acquisition module, configured to acquire transaction flow information of an account to be detected, and determine a transaction time sequence corresponding to the account to be detected according to the transaction flow information, wherein the transaction time sequence includes at least one transaction sequence, and each transaction sequence includes a transaction time node and an account balance; A determination module, used to obtain at least one transaction cycle according to all transaction sequences, and determine the awakening time node and the outbreak time node corresponding to each transaction cycle according to the transaction time nodes of all transaction sequences contained in each transaction cycle; An acquisition module is used to determine the transaction amount corresponding to each transaction cycle according to the difference between the account balance corresponding to the awakening time node corresponding to each transaction cycle and the account balance corresponding to the outbreak time node, take the maximum transaction amount as the target transaction amount, and determine the transaction cycle corresponding to the target transaction amount as the target transaction cycle, and obtain the target transaction dormancy time according to the awakening time node included in the target transaction cycle and the time for obtaining the transaction flow information of the account to be detected; A determination module, configured to determine a target dormancy time threshold corresponding to the target transaction amount according to a pre-stored comparison table of transaction amounts and dormancy time thresholds, and if the target transaction dormancy time is greater than or equal to the target dormancy time threshold, determine that the account to be detected is an abnormal account; An acquisition module is used to obtain sample transaction flow information corresponding to at least one sample account, and determine the sample transaction time series corresponding to the sample account according to the sample transaction flow information corresponding to each sample account, wherein each sample transaction time series includes at least one sample transaction sequence, wherein each sample transaction sequence includes a sample transaction time and a sample transaction balance; obtain at least one sample transaction cycle according to all sample transaction sequences, and determine the sample awakening time node and the sample outbreak time node corresponding to each sample transaction cycle according to the sample transaction time of all sample transaction sequences included in each sample transaction cycle; determine the sample transaction amount corresponding to the sample transaction cycle according to the difference between the sample transaction balance corresponding to the sample awakening time node and the sample transaction balance corresponding to the sample outbreak time node of each sample transaction cycle, determine the sample transaction cycle with the largest sample transaction amount corresponding to each sample account as the target sample transaction cycle of the sample account, and determine the sample transaction amount corresponding to the target sample transaction cycle corresponding to each sample account as The target sample transaction amount corresponding to the sample account, and the target sample sleep time is obtained according to the sample awakening time node included in each target transaction cycle and the time of obtaining the sample transaction flow information corresponding to the sample account; all sample accounts are divided into at least one sample set according to at least one preset transaction reference amount interval, wherein each transaction amount reference interval corresponds to a minimum transaction amount and a maximum transaction amount, and the sample set corresponding to the transaction reference amount interval contains target sample transaction amounts of all sample accounts greater than or equal to the minimum transaction amount and less than or equal to the maximum transaction amount; the reference transaction amount corresponding to the sample set is determined according to the average of the target sample transaction amounts of all sample accounts included in each sample set, and the reference sleep time corresponding to the sample set is obtained according to the target sample sleep time of all sample accounts included in each sample set; a comparison table of transaction amount and sleep time thresholds is obtained according to the reference transaction amounts and reference sleep times corresponding to all sample sets.

8. A server, characterized in that: include: at least one processor and memory; The memory stores computer-executable instructions; The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor executes the method for identifying accounts with abnormal transactions as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions. When the processor executes the computer-executable instructions, the method for identifying accounts with abnormal transactions as described in any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method for identifying an abnormal transaction account according to any one of claims 1 to 6 is implemented.

Images