Account data processing method, device, computer equipment and storage medium

Abstract

The present application relates to an account data processing method, apparatus, computer equipment, and storage medium. The method comprises: obtaining the business transaction data of a target account; inputting the business transaction data of the target account into at least one base classifier to obtain an account anomaly identification result corresponding to each base classifier, wherein each base classifier is a classification model with independent errors, and the account anomaly identification result is used to characterize the probability that the target account has abnormal interaction behavior in a resource interaction system; merging the account anomaly identification results corresponding to each base classifier to obtain a merged account anomaly identification result, wherein the merged account anomaly identification result characterizes whether the target account has abnormal business transactions; fusing the account anomaly identification results corresponding to each base classifier and the merged account anomaly identification result to obtain an account anomaly scoring result corresponding to the target account. The use of this method can improve the accuracy of account data processing and improve the timeliness of updating the account data processing model.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an account data processing method, apparatus, computer equipment, and storage medium. Background Art

[0002] With the development of computer technology, risk monitoring technology has emerged. Risk monitoring technology is a variety of monitoring and control activities carried out according to the project risk management plan and the actual risks and changes in the project development. This is a project risk management work based on the phased, gradual and controllable nature of project risks.

[0003] Current risk monitoring methods primarily focus on deploying anti-fraud models. Developers rely on requirements reports from business personnel, documents issued by the Ministry of Public Security, and past experience to write and deploy these models. After identification is complete, these models must be distributed to various branches for manual verification to ultimately identify risks. However, this entire process is highly coupled, subjective, and time-consuming, requiring significant labor and effort. Deviations at any stage can significantly reduce the accuracy of risk detection. Summary of the Invention

[0004] Based on this, it is necessary to provide an account data processing method, device, computer equipment, computer-readable storage medium and computer program product that can identify telecommunications fraud customers in response to the above technical problems.

[0005] In a first aspect, the present application provides an account data processing method. The method comprises: obtaining business transaction data of a target account, wherein the business transaction data of the target account is business data generated after the target account performs a resource interaction operation in a resource interaction system; inputting the business transaction data of the target account into at least one base classifier to obtain an account anomaly recognition result corresponding to each base classifier, wherein each base classifier is a classification model with independent errors, and the account anomaly recognition result is used to characterize the probability that the target account has abnormal interaction behavior in the resource interaction system; merging the account anomaly recognition results corresponding to each base classifier to obtain a merged account anomaly recognition result, wherein the merged account anomaly recognition result characterizes whether the target account has abnormal business transactions; and fusing the account anomaly recognition results corresponding to each base classifier and the merged account anomaly recognition result to obtain an account anomaly scoring result corresponding to the target account.

[0006] In one embodiment, the account anomaly identification results corresponding to each of the base classifiers are merged to obtain a merged account anomaly identification result, including: inputting the account anomaly identification results corresponding to each of the base classifiers into a voting algorithm to obtain a merged result matrix corresponding to the account anomaly identification results, wherein the dimension of the merged result matrix is the same as the number of the base classifiers; and selecting, from the merged result matrix, the anomaly discrimination results corresponding to the account anomaly identification results whose number of votes exceeds a preset threshold as the merged account anomaly identification result.

[0007] In one embodiment, the account anomaly identification results corresponding to each of the base classifiers are input into a voting algorithm to obtain a merged result matrix corresponding to the account anomaly identification results, including: determining the columns corresponding to the unvoted matrix based on the number of the base classifiers, and determining the rows corresponding to the unvoted matrix based on the number of the account anomaly identification results; multiplying each data of the rows and columns corresponding to the unvoted matrix one by one to obtain an unvoted matrix corresponding to the number of the base classifiers; and inputting the unvoted matrix into the voting algorithm to obtain a merged result matrix corresponding to the account anomaly identification results.

[0008] In one embodiment, the abnormality discrimination result corresponding to the account abnormality identification result in which the number of votes exceeds a preset threshold from the merged result matrix is selected as the merged account abnormality identification result, including: determining the preset threshold of the votes obtained by each element in the merged result matrix from the number of the base classifiers, and the setting of the preset threshold is smaller than the number of the base classifiers; if the number of votes obtained by an element in the merged result matrix exceeds the preset threshold, then outputting the abnormality discrimination result corresponding to the account abnormality identification result where the element is located as the merged account abnormality identification result.

[0009] In one embodiment, the fusion of the account anomaly recognition results corresponding to each of the base classifiers and the merged account anomaly recognition results to obtain the account anomaly scoring result corresponding to the target account includes: obtaining the weights corresponding to each of the base classifiers and the number of the base classifiers, the weights corresponding to the base classifiers being determined according to the errors corresponding to each of the base classifiers; adjusting the account anomaly recognition results corresponding to each of the base classifiers based on the weights corresponding to each of the base classifiers to obtain each adjusted recognition result; and multiplying each of the adjusted recognition results with the merged account anomaly recognition result to obtain the account anomaly scoring result corresponding to the target account.

[0010] In one embodiment, the account anomaly scoring result corresponding to the target account is obtained by multiplying the adjusted recognition result with the merged account anomaly recognition result, including: multiplying each of the adjusted recognition results with the merged account anomaly recognition result to obtain a sub-anomaly scoring result corresponding to each of the adjusted recognition results; and accumulating the sub-anomaly scoring results corresponding to each of the adjusted recognition results to obtain the account anomaly scoring result corresponding to the target account.

[0011] In a second aspect, the present application further provides an account data processing device. The device includes: a business transaction data acquisition module for acquiring business transaction data of a target account, wherein the business transaction data of the target account is business data generated after the target account performs a resource interaction operation in a resource interaction system; an account anomaly identification result acquisition module for inputting the business transaction data of the target account into at least one base classifier to obtain an account anomaly identification result corresponding to each base classifier, wherein each base classifier is a classification model with independent errors, and the account anomaly identification result is used to characterize the probability that the target account has abnormal interaction behavior in the resource interaction system; a merged account anomaly identification result module for merging the account anomaly identification results corresponding to each base classifier to obtain a merged account anomaly identification result, wherein the merged account anomaly identification result characterizes whether the target account has abnormal business transactions; and an account anomaly scoring result module for fusing the account anomaly identification results corresponding to each base classifier and the merged account anomaly identification result to obtain an account anomaly scoring result corresponding to the target account.

[0012] In one embodiment, the merged account anomaly identification result module is further used to input the account anomaly identification results corresponding to each base classifier into a voting algorithm to obtain a merged result matrix corresponding to the account anomaly identification results, and the dimension of the merged result matrix is the same as the number of base classifiers; and the anomaly discrimination results corresponding to the account anomaly identification results whose number of votes exceeds a preset threshold are selected from the merged result matrix as the merged account anomaly identification results.

[0013] In one embodiment, the merged account anomaly identification result module is further used to determine the columns corresponding to the unvoted matrix based on the number of the base classifiers, and determine the rows corresponding to the unvoted matrix based on the number of the account anomaly identification results; multiply the data of the rows and columns corresponding to the unvoted matrix one by one to obtain the unvoted matrix corresponding to the number of the base classifiers; and input the unvoted matrix into the voting algorithm to obtain the merged result matrix corresponding to the account anomaly identification results.

[0014] In one embodiment, the merged account anomaly identification result module is also used to determine a preset threshold of the votes obtained by each element in the merged result matrix from the number of the base classifiers, and the preset threshold is set to be smaller than the number of the base classifiers; if the number of votes obtained by an element in the merged result matrix exceeds the preset threshold, the anomaly discrimination result corresponding to the account anomaly identification result of the element is output as the merged account anomaly identification result.

[0015] In one embodiment, the account anomaly scoring result module is further used to obtain the weights corresponding to each of the base classifiers and the number of the base classifiers, where the weights corresponding to the base classifiers are determined based on the errors corresponding to the base classifiers; based on the weights corresponding to the base classifiers, the account anomaly identification results corresponding to the base classifiers are adjusted to obtain adjusted identification results; based on the multiplication of each adjusted identification result with the merged account anomaly identification result, the account anomaly scoring result corresponding to the target account is obtained.

[0016] In one embodiment, the account anomaly scoring result module is further used to multiply each of the adjusted recognition results with the merged account anomaly recognition result to obtain a sub-anomaly scoring result corresponding to each of the adjusted recognition results; and accumulate the sub-anomaly scoring results corresponding to each of the adjusted recognition results to obtain an account anomaly scoring result corresponding to the target account.

[0017] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor implementing the following steps when executing the computer program: obtaining business transaction data of a target account, the business transaction data of the target account being business data generated after the target account performs a resource interaction operation in a resource interaction system; inputting the business transaction data of the target account into at least one base classifier to obtain an account anomaly recognition result corresponding to each base classifier, each base classifier being a classification model with independent errors, the account anomaly recognition result being used to characterize the probability that the target account has abnormal interaction behavior in the resource interaction system; merging the account anomaly recognition results corresponding to each base classifier to obtain a merged account anomaly recognition result, the merged account anomaly recognition result characterizing whether the target account has abnormal business transactions; and fusing the account anomaly recognition results corresponding to each base classifier and the merged account anomaly recognition result to obtain an account anomaly scoring result corresponding to the target account.

[0018] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the following steps: obtaining business transaction data of a target account, the business transaction data of the target account being business data generated after the target account performs a resource interaction operation in a resource interaction system; inputting the business transaction data of the target account into at least one base classifier to obtain an account anomaly recognition result corresponding to each base classifier, each base classifier being a classification model with independent errors, the account anomaly recognition result being used to characterize the probability that the target account has abnormal interaction behavior in the resource interaction system; merging the account anomaly recognition results corresponding to each base classifier to obtain a merged account anomaly recognition result, the merged account anomaly recognition result characterizing whether the target account has abnormal business transactions; and fusing the account anomaly recognition results corresponding to each base classifier and the merged account anomaly recognition result to obtain an account anomaly scoring result corresponding to the target account.

[0019] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the following steps:

[0020] Obtain business transaction data of the target account, where the business transaction data of the target account is business data generated after the target account performs resource interaction operations in the resource interaction system; input the business transaction data of the target account into at least one base classifier to obtain account anomaly recognition results corresponding to each base classifier, where each base classifier is a classification model with independent errors, and the account anomaly recognition result is used to characterize the probability that the target account has abnormal interaction behavior in the resource interaction system; merge the account anomaly recognition results corresponding to each base classifier to obtain a merged account anomaly recognition result, where the merged account anomaly recognition result characterizes whether the target account has abnormal business transactions; and fuse the account anomaly recognition results corresponding to each base classifier and the merged account anomaly recognition result to obtain an account anomaly scoring result corresponding to the target account.

[0021] The above-mentioned account data processing method, device, computer equipment, storage medium and computer program product obtain the business transaction data of the target account, which is the business data generated after the target account performs resource interaction operations in the resource interaction system; input the business transaction data of the target account into at least one base classifier to obtain the account anomaly identification results corresponding to each base classifier, each base classifier is a classification model with independent errors, and the account anomaly identification results are used to characterize the probability of the target account having abnormal interaction behavior in the resource interaction system; merge the account anomaly identification results corresponding to each base classifier to obtain a merged account anomaly identification result, and the merged account anomaly identification result characterizes whether the target account has abnormal business transactions; and fuse the account anomaly identification results corresponding to each base classifier and the merged account anomaly identification result to obtain the account anomaly scoring result corresponding to the target account.

[0022] Leveraging the high-precision features of ensemble learning, data is classified using different models, and the results are combined to categorize and score the target account's business transactions. Learning and fitting user data using different models to obtain effective information improves the accuracy of the target account anomaly verification system, reduces labor costs, and increases the timeliness of updating the target account scoring model. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 This is a diagram of an application environment of an account data processing method in one embodiment;

[0024] Figure 2 1 is a flowchart of a method for processing account data in one embodiment;

[0025] Figure 3 1 is a flow chart of a method for obtaining abnormality identification results of merged accounts in one embodiment;

[0026] Figure 4 Schematic diagram of a flow chart of a method for obtaining abnormal identification results of merged accounts in another embodiment;

[0027] Figure 5 1 is a flow chart of a method for obtaining abnormality identification results of merged accounts in another embodiment;

[0028] Figure 6 1 is a flow chart of a method for obtaining an abnormal account score result in one embodiment;

[0029] Figure 7 1 is a flow chart of a method for obtaining an abnormal account score result in another embodiment;

[0030] Figure 8 A schematic diagram of an integrated learning and recognition process of an account data processing method in one embodiment;

[0031] Figure 9 A schematic diagram of scoring logic of an account data processing method in one embodiment;

[0032] Figure 10 is a structural block diagram of an account data processing device in one embodiment;

[0033] Figure 11 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0035] The account data processing method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown, terminal 102 acquires data, and server 104 receives the data from terminal 102 in response to instructions from terminal 102 and performs calculations on the acquired data. Server 104 transmits the calculation results back to terminal 102, which then displays them. Terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated with server 104 or placed in the cloud or on other network servers. Server 104 obtains the target account's business transaction data from terminal 102. The target account's business transaction data is generated after the target account performs resource interaction operations in the resource interaction system. The target account's business transaction data is input into at least one base classifier to obtain an account anomaly identification result corresponding to each base classifier. Each base classifier is a classification model with independent errors. The account anomaly identification result is used to represent the probability that the target account has abnormal interaction behavior in the resource interaction system. The account anomaly identification results corresponding to each base classifier are merged to obtain a merged account anomaly identification result. The merged account anomaly identification result represents whether the target account has abnormal business transactions. The account anomaly identification results corresponding to each base classifier and the merged account anomaly identification result are combined to obtain an account anomaly score corresponding to the target account. Terminal 102 may be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices may include smart speakers, smart TVs, smart air conditioners, smart car devices, etc. Portable wearable devices may include smart watches, smart bracelets, head-mounted devices, etc. Server 104 may be implemented as a standalone server or a server cluster consisting of multiple servers.

[0036] In one embodiment, Figure 2 As shown, a method for processing account data is provided, which is applied to Figure 1 The following steps are used as an example to illustrate the server in the example:

[0037] Step 202: Obtain the business transaction data of the target account.

[0038] The target account may be an account that is scored using an account data processing method, and there may be multiple scoring criteria, such as specific scores, whether or not a score is passed, or security levels.

[0039] The business transaction data may be transaction data generated when a business transaction is conducted in an account that needs to be scored, and the transaction data may include transaction records, transaction amounts, transaction times, and transaction locations.

[0040] Specifically, the server responds to the terminal's instructions, obtains the target account's business transaction data from the terminal, and stores the obtained business transaction data corresponding to the target account in a storage unit. When the server needs to process any transaction data record in the target account's business transaction data, it retrieves the data from the storage unit and transfers it to a volatile storage resource for computation by the central processing unit. The business transaction data can be a single data item or multiple data items input simultaneously, and each piece of pending business transaction data can include at least one transaction data record.

[0041] For example, the server 104 responds to the instruction of the terminal 102, obtains the business transaction data of the target account from the terminal 102, and stores it in the storage unit of the server 104, wherein the business transaction data of the target account obtained by the server 104 corresponds to 10 pieces of information, and there are 20 transaction data records corresponding to each piece of business transaction data.

[0042] Step 204: Input the business transaction data of the target account into at least one base classifier to obtain the account anomaly recognition results corresponding to each base classifier.

[0043] Among them, the base classifier can be a type of classifier, and at the same time, a boosting algorithm is run, that is, gradually fitting and approximating the true value. It is a serial algorithm that can reduce errors but cannot reduce deviations. Basically, all samples are involved in training each time, which cannot eliminate the influence of chance, but it gradually approaches the true value each time, which can reduce errors. Each base classifier is a classification model with independent errors. The account anomaly recognition result is used to characterize the probability of abnormal interaction behavior of the target account in the resource interaction system.

[0044] Among them, the account anomaly identification result can be the calculation result obtained after the business transaction data of the target account is calculated through the base classifier. The expression method of the account anomaly identification result will be determined according to the output result of the base classifier. Generally speaking, the account anomaly identification result will give a probability of whether the target account is involved in the case.

[0045] Specifically, there are multiple base classifiers that can process account data, so the set formed by multiple base classifiers is a base classifier set. When the business transaction data of any target account needs to be processed, the server selects at least one base classifier suitable for processing the business transaction data from the base classifier set. In the case where multiple base classifiers need to be selected, the server will find multiple base classifiers with independent errors based on the principle of ensemble learning and the results of multiple classification models. After determining the required base classifier, the business transaction data of the target account is input into the determined base classifier. If multiple base classifiers are selected, multiple base classifiers are input at the same time to obtain the account anomaly recognition result corresponding to each base classifier. The account anomaly recognition result uses probability to represent the abnormal situation of the target account. Among them, the above-mentioned base classifiers can be support vector machines (SVM), random forests, linear regression and logistic regression models.

[0046] For example, the required base classifier (random forest, linear regression) is determined from a base classifier set A having multiple base classifiers, and the business transaction data of the target account is simultaneously input into the two base classifiers, random forest and linear regression, to obtain the account anomaly recognition results corresponding to the two base classifiers, random forest and linear regression. Both account anomaly recognition results use probability to express the abnormal situation of the target account.

[0047] Step 206: Merge the account anomaly recognition results corresponding to the base classifiers to obtain a merged account anomaly recognition result.

[0048] Among them, the merged account anomaly identification result can be obtained by processing the account anomaly identification result corresponding to each base classifier using a voting algorithm to obtain a result on whether the target account is an abnormal account. The voting result is generally 0 or 1, and the output result is generally yes or no.

[0049] Specifically, the matching voting algorithm for the account anomaly identification results corresponding to each base classifier is selected from a set of voting algorithms. This selection is based on the data type of the account anomaly identification result. The data type of each voting algorithm in the set is traversed, and the voting algorithm with the highest matching degree is selected. Based on the selected voting algorithm, the results are merged by voting, with the one with the most votes being the final result. The voting algorithm combines the outputs of multiple base classifiers into a multidimensional matrix with the same number of dimensions as the base classifiers. Each column represents the discrimination results of different base classifiers on all data, and each row represents the discrimination results of different base classifiers on the same sample. If a class label receives more than half of the votes, it is predicted as that label; otherwise, the prediction is rejected. Algorithm Implementation: In this method, the classification category is whether there is abnormal behavior, with 0 representing no abnormal behavior and 1 representing abnormal behavior. For example, the classification results of the four base classifiers are determined to determine whether class 0 receives more than 3 votes. If so, it is determined to be no abnormal behavior; otherwise, it is determined to be abnormal behavior.

[0050] For example, the absolute voting algorithm is selected from the voting algorithm set B as the voting algorithm for merging, and the account anomaly recognition results corresponding to the two base classifiers, random forest and linear regression, are input into the absolute voting algorithm for merging. The merged account anomaly recognition result after voting is obtained. If the output result of this result is 1, it indicates that the target account has abnormal behavior.

[0051] Step 208 : The account anomaly recognition results corresponding to each base classifier and the merged account anomaly recognition result are integrated to obtain an account anomaly scoring result corresponding to the target account.

[0052] Among them, the account anomaly scoring result can be the result of digitally measuring the degree of abnormality of the target account. The higher the score of the account anomaly scoring result, the higher the degree of abnormality of the target account. If it exceeds the preset threshold, it is considered a dangerous account and further manual verification is carried out.

[0053] Specifically, the account anomaly identification results corresponding to the base classifiers, the combined account anomaly identification results, the number of base classifiers, and the weight of each base classifier are input into the anomaly scoring formula for calculation to obtain the account anomaly score result for the target account. The target account is classified according to the preset threshold ranges of each level. If the target account is a risky account, the transaction data of the target account is further manually verified based on the specific score value. Among them, behaviors that may cause the target account to become a risky account include rapid inflow and outflow of resources within the account, concentrated inflow and dispersed outflow, dispersed inflow and concentrated outflow, small-amount trial, frequent transfers at night, and large-amount cash withdrawals from ATMs in key border areas. The anomaly scoring formula is as follows:

[0054]

[0055] Where n is the number of base classifiers, θ i For each base classifier, the probability of a customer being involved in the case is determined (between 0 and 1), δ i is the weight of each base classifier, and flag is the result of merging the base classifiers (0 or 1).

[0056] For example, the account anomaly recognition result a corresponding to the base classifier, the merged account anomaly recognition result b, the number of base classifiers c, and the weight d of each base classifier are input into the anomaly scoring formula for calculation to obtain the account anomaly scoring result e for the target account composed of a, b, c, and d.

[0057] In the above-mentioned account data processing method, the business transaction data of the target account is obtained, and the business transaction data of the target account is the business data generated after the target account performs resource interaction operations in the resource interaction system; the business transaction data of the target account is input into at least one base classifier to obtain the account anomaly recognition results corresponding to each base classifier, and each base classifier is a classification model with independent errors. The account anomaly recognition result is used to characterize the probability that the target account has abnormal interaction behavior in the resource interaction system; the account anomaly recognition results corresponding to each base classifier are merged to obtain a merged account anomaly recognition result, and the merged account anomaly recognition result characterizes whether the target account has abnormal business transactions; the account anomaly recognition results corresponding to each base classifier and the merged account anomaly recognition result are integrated to obtain the account anomaly scoring result corresponding to the target account.

[0058] Leveraging the high-precision features of ensemble learning, data is classified using different models, and the results are combined to categorize and score the target account's business transactions. Learning and fitting user data using different models to obtain effective information improves the accuracy of the target account anomaly verification system, reduces labor costs, and increases the timeliness of updating the target account scoring model.

[0059] In one embodiment, Figure 3 As shown, the account anomaly recognition results corresponding to each base classifier are merged to obtain the merged account anomaly recognition results, including:

[0060] In step 302 , the account anomaly identification results corresponding to each base classifier are input into a voting algorithm to obtain a combined result matrix corresponding to the account anomaly identification results.

[0061] The voting algorithm may be a voting method, such as an absolute voting algorithm, which requires more than half of the valid votes to be recognized. When multiple classifiers predict a certain category, only the part that is higher than half of the total results will be predicted.

[0062] The merged result matrix may be a matrix obtained by performing absolute voting on an intermediate matrix composed of the account anomaly recognition results corresponding to the base classifiers through an absolute voting algorithm to indicate whether the target account has an abnormality.

[0063] Specifically, the results of each base classifier are output separately and merged into a multi-dimensional intermediate matrix. The dimension of this intermediate matrix is the same as the number of base classifiers. That is, each column is the discrimination result of different base classifiers on all data, and each row is the discrimination result of different base classifiers on the same sample. Based on the merged multi-dimensional intermediate matrix, it is input into the absolute voting algorithm for voting, and the merged result matrix corresponding to the account anomaly identification result is obtained. The calculation formula of the absolute voting algorithm is as follows:

[0064]

[0065] Among them, C j is the classification category, h i is the base classifier, T represents the number of classifiers, and N represents the number of categories. That is, if the predictions for category j from all T classifiers exceed half of the total votes, the prediction is category j; otherwise, the prediction is rejected. Specifically, if a certain label receives more than half of the votes, the prediction is that label; otherwise, the prediction is rejected. For example, in this method, the classification category is whether or not there is abnormal behavior, with 0 representing no abnormal behavior and 1 representing abnormal behavior. The method then determines whether category 0 receives more than 3 votes in the discrimination results of the five base classifiers. If so, the prediction is considered to be no abnormal behavior; otherwise, abnormal behavior is present.

[0066] For example, the account anomaly recognition results corresponding to 5 base classifiers form a 5-dimensional intermediate matrix with the same number of base classifiers. Each column is the discrimination result of different base classifiers on all data, and each row is the discrimination result of different base classifiers on the same sample. The 5-dimensional intermediate matrix is input into the absolute voting algorithm for voting to obtain the merged result matrix corresponding to the account anomaly recognition results, and whether the target account is abnormal can be obtained from the merged result matrix.

[0067] Step 304 : Select the abnormality identification result corresponding to the abnormal account identification result whose number of votes exceeds a preset threshold from the merged result matrix as the merged account abnormality identification result.

[0068] Among them, the abnormality judgment result can be the result of determining whether the account abnormality identification result is abnormal after voting by the absolute voting algorithm. Generally speaking, the output of the abnormality judgment result can be 0 or 1. If the output is 0, there is no abnormality in the target account. If the output is 1, there is an abnormality in the target account.

[0069] Specifically, a threshold for the number of votes is pre-set. If the number of votes received exceeds the threshold, the target account is determined to be an abnormal account. If the number of votes received does not exceed the threshold, the target account is determined to be a normal account. From the merged result matrix, the abnormal identification results of the accounts that received votes exceeding the threshold are selected and output as 1 as the abnormal identification result. If no abnormal identification results of any accounts in the merged result matrix exceed the threshold for the number of votes, 0 is output. The output result is the abnormal identification result of the merged account. Therefore, the output of the abnormal identification result of the merged account is also 0 or 1. If it is 0, it is a normal account, and if it is 1, it is an abnormal account.

[0070] For example, if the number of base classifiers is 5, then based on the number of base classifiers, if the number of votes exceeds 3, the account is considered an abnormal account. From the merged result matrix, select the abnormal identification results for accounts with more than 3 votes, set the abnormality discrimination result to 1, indicating that the account is abnormal, and use this abnormality discrimination result as the abnormal identification result for the merged account. If there are no abnormal identification results for accounts with more than 3 votes in the merged result matrix, the abnormality discrimination result is 0, and the abnormal identification result for the merged account is also 0.

[0071] In this embodiment, by using the absolute voting algorithm to merge multiple account anomaly identification results, and further obtain the votes corresponding to each account anomaly identification result, it is possible to further judge the account anomaly identification results and eliminate the randomness brought about by the probability obtained simply through the base classifier.

[0072] In one embodiment, Figure 4 As shown, the account anomaly recognition results corresponding to each base classifier are input into the voting algorithm to obtain the combined result matrix corresponding to the account anomaly recognition results, including:

[0073] Step 402 : Determine the columns corresponding to the non-voting matrix based on the number of base classifiers, and determine the rows corresponding to the non-voting matrix based on the number of account anomaly recognition results.

[0074] The unvoted matrix may be a matrix formed according to the number of base classifiers and the result of account anomaly recognition, and the matrix is not input into the absolute voting algorithm for voting.

[0075] Specifically, the number of columns of the unvoting matrix is determined based on the number of base classifiers, and each base classifier is filled into the corresponding column of the unvoting matrix in an arbitrary order; the number of rows of the unvoting matrix is determined based on the number of account anomaly identification results, and each account anomaly identification result is filled into the corresponding row of the unvoting matrix in an arbitrary order.

[0076] For example, the number of base classifiers is 3, namely X, Y, and Z, and the corresponding number of account anomaly recognition results is also 3, namely x, y, and z. Then the number of rows of the unvoted matrix corresponds to the account anomaly recognition results, and the number of columns corresponds to the number of base classifiers. For the base classifiers X, Y, and Z, fill in the columns of the unvoted matrix in any order, for example: X, Y, Z or X, Z, Y, etc.

[0077] Step 404 : fuse the data of the rows and columns corresponding to the non-voting matrix one by one to obtain a non-voting matrix corresponding to the number of base classifiers.

[0078] Specifically, the corresponding relationships between the data corresponding to the rows and columns of the unvoted matrix established based on the base classifier and the account anomaly recognition results are used to fuse, thereby obtaining an unvoted matrix with the same dimension as the number of base classifiers. The fusion can be mathematical calculations such as multiplication and weighting between the corresponding data.

[0079] For example, the rows of the non-voting matrix established with 5 base classifiers and the columns of the non-voting matrix established with 5 account anomaly recognition results are fused by multiplication to obtain a five-dimensional non-voting matrix.

[0080] In step 406, the non-voting matrix is input into the voting algorithm to obtain a combined result matrix corresponding to the account anomaly identification result.

[0081] Specifically, an unvoted matrix consisting of multiple base classifiers and the account anomaly identification results corresponding to the multiple base classifiers is input into the absolute voting algorithm for voting to obtain a merged result matrix corresponding to the account anomaly identification results. The algorithm for inputting the unvoted matrix is not limited to the absolute voting algorithm, and soft voting algorithm, hard voting algorithm, weighted sum method and stacking algorithm can be selected.

[0082] For example, a five-dimensional unvoted matrix consisting of five base classifiers and the account anomaly recognition results corresponding to the five base classifiers is input into the stacking algorithm for processing to obtain a merged result matrix corresponding to the account anomaly recognition results.

[0083] In this embodiment, by establishing a multidimensional matrix and inputting the multidimensional matrix into the voting algorithm for voting, it is possible to further verify the target accounts that may have abnormal account identification results, reduce judgment errors, and improve the accuracy of the system.

[0084] In one embodiment, Figure 5 As shown, the abnormal discrimination results corresponding to the abnormal identification results of accounts with a number of votes exceeding a preset threshold are selected from the combined result matrix as the combined abnormal identification results of accounts, including:

[0085] Step 502: Determine a preset threshold value of votes obtained by each element in the combined result matrix based on the number of base classifiers.

[0086] Specifically, based on the number of base classifiers and the voting algorithm used to merge the corresponding elements from the voting algorithm set, the vote threshold corresponding to any element in the merged result matrix is further determined. The preset threshold must be set to be less than the number of base classifiers. If any element receives votes greater than or equal to the threshold, it indicates that the target account has an anomaly. If all elements receive votes less than the threshold, it indicates that the target account has no anomalies.

[0087] For example, for an account data processing business, five base classifiers are used. At the same time, the absolute voting algorithm is selected as the merging algorithm from the voting algorithm set. Based on the properties of the absolute voting algorithm and the fact that the vote threshold cannot be greater than the number of base classifiers, three votes are selected as the vote threshold.

[0088] In step 504, if the number of votes obtained by an element in the merged result matrix exceeds a preset threshold, the abnormality identification result corresponding to the abnormality identification result of the account where the element is located is output as the merged account abnormality identification result.

[0089] Specifically, if the number of votes received by any element in the merged result matrix after the unvoted matrix is voted using the corresponding voting algorithm exceeds the corresponding preset threshold, the account anomaly identification result corresponding to the element exceeding the threshold is output. Based on the account anomaly identification result, the anomaly discrimination result is further output as the merged account anomaly identification result. The anomaly discrimination result and the merged account anomaly identification result are both represented as 0 or 1, with 0 representing a normal target account and 1 representing an anomaly target account.

[0090] For example, after the five-dimensional unvoted matrix is merged using the absolute voting algorithm, a five-dimensional merged result matrix is obtained. The number of votes for the H element in the matrix is 5, which exceeds the preset vote threshold of 3. Then the abnormal identification result of the account where the H element is located corresponds to the abnormal identification result of 1, and the abnormal identification result of the merged account is also output as 1.

[0091] In this embodiment, by setting a preset vote threshold for each element in the merged result matrix and comparing the number of votes obtained by the element with the preset threshold, the efficiency of identifying abnormal target accounts can be further improved.

[0092] In one embodiment, Figure 6 As shown in the figure, the account anomaly recognition results corresponding to each base classifier and the merged account anomaly recognition results are integrated to obtain the account anomaly score result corresponding to the target account, including:

[0093] Step 602: Obtain the weight corresponding to each base classifier and the number of base classifiers.

[0094] Specifically, the server obtains the base classifiers to be used, counts the number of base classifiers, and simultaneously obtains the weight corresponding to each base classifier. The weight corresponding to the base classifier is determined based on the error corresponding to each base classifier. For any base classifier, the errors are independent of each other.

[0095] For example, the server obtains the four base classifiers needed (support vector machine (SVM), random forest, linear regression, and logistic regression models), and obtains the corresponding weights for each base classifier (support vector machine -0.4, random forest -0.2, linear regression -0.35, and logistic regression model -0.05).

[0096] Step 604 : Adjust the account anomaly recognition results corresponding to the base classifiers based on the weights corresponding to the base classifiers to obtain adjusted recognition results.

[0097] The adjusted recognition result may be obtained by adjusting the account anomaly recognition result obtained by correspondingly calculating each base classifier using the weight corresponding to each base classifier.

[0098] Specifically, each base classifier has its own corresponding weight and account anomaly recognition result obtained after calculation. Therefore, for the same base classifier, the corresponding weight and account anomaly recognition result are jointly adjusted to obtain the adjusted recognition result determined based on the weight and account anomaly recognition result. The same operation is performed for any base classifier. The adjustment can be performed using a variety of different mathematical calculation methods.

[0099] For example, the weights corresponding to the base classifiers H, I, and J are h, i, and j, and the account anomaly recognition results corresponding to each base classifier obtained by calculation are x, y, and z. The adjustment method of multiplying the weights by the account anomaly recognition results is adopted. Therefore, the adjusted recognition results corresponding to each base classifier are hx, iy, and jz.

[0100] Step 606 : Multiply the adjusted recognition results by the merged account anomaly recognition result to obtain an account anomaly score result corresponding to the target account.

[0101] Specifically, the adjusted recognition results corresponding to each base classifier are multiplied one by one with the merged account anomaly recognition results, and the products corresponding to each base classifier are obtained. Then, the products are fused to further obtain the account anomaly score results corresponding to the target account.

[0102] For example, the adjusted recognition results corresponding to each base classifier are hx, iy, and jz, and the combined account anomaly recognition result is 0 or 1. If the combined account anomaly recognition result is 0, the account anomaly score corresponding to the target account is 0, indicating that the account is normal. If the combined account anomaly recognition result is 1, the account anomaly score corresponding to the target account is hx+iy+jz.

[0103] In this embodiment, by obtaining the weights corresponding to the base classifiers and adjusting the corresponding account anomaly identification results according to the obtained weights, the weights of the account anomaly identification results corresponding to different base classifiers can be changed, so that the output results can be biased according to business needs.

[0104] In one embodiment, Figure 7 As shown, the adjusted recognition result is multiplied by the merged account anomaly recognition result to obtain the account anomaly score corresponding to the target account, including:

[0105] Step 702 : multiply each adjusted recognition result by the merged account anomaly recognition result to obtain a sub-anomaly score result corresponding to each adjusted recognition result.

[0106] Specifically, if the abnormal identification result of the merged account is 0, the result of multiplying each adjusted identification result by the abnormal identification result of the merged account is 0, then the sub-abnormality score result corresponding to the adjusted identification result is 0; if the abnormal identification result of the merged account is 1, the result of multiplying each adjusted identification result by the abnormal identification result of the merged account is still the adjusted identification result, then the sub-abnormality score result corresponding to the adjusted identification result is the adjusted identification result.

[0107] For example, if the abnormal identification result of the merged account is 0, the result of multiplying the adjusted identification results hx, iy, jz with the abnormal identification result of the merged account is 0, then the sub-abnormality score result corresponding to the adjusted identification result is 0; if the abnormal identification result of the merged account is 1, the result of multiplying the adjusted identification results hx, iy, jz with the abnormal identification result of the merged account is still the adjusted identification result, then the sub-abnormality score result corresponding to the adjusted identification result is the adjusted identification results hx, iy, jz.

[0108] Step 704 : Accumulate the sub-anomaly score results corresponding to the adjusted recognition results to obtain the account anomaly score result corresponding to the target account.

[0109] Specifically, if the merged account anomaly identification result is 1, the sub-anomaly score results corresponding to each adjusted identification result are summed, and the sum obtained is the account anomaly score result corresponding to the target account; if the merged account anomaly identification result is 0, the account anomaly score result corresponding to the target account is 0.

[0110] For example, if the merged account anomaly recognition result is 1, the sub-anomaly score results hx, iy, and jz corresponding to each adjusted recognition result are summed up, and the account anomaly score result corresponding to the target account is hx+iy+jz.

[0111] In this embodiment, by summing up the sub-anomaly scoring results, the scoring results obtained by all base classifiers according to different algorithms can be integrated, so that the account anomaly scoring results are more reference-oriented.

[0112] In one embodiment, the business transaction data of the target account needs to be preprocessed, wherein the preprocessing steps include data cleaning, data encoding, and data normalization.

[0113] (1) Data cleaning: Clean the user data to be used, such as cleaning missing values and abnormal values. The commonly used methods are: deleting data, filling missing values, not processing, and true value conversion.

[0114] Deleting data: This involves directly deleting rows or columns with missing values to reduce the impact of trend data on the overall data, thereby improving data accuracy. However, this method is not suitable for all scenarios because deletion reduces data features. This method cannot be used when the dataset contains a large amount of data, records are incomplete, or missing values have obvious data distribution patterns or characteristics.

[0115] Missing value filling: Filling missing data with some method to form a complete data record. This behavior is very important for subsequent data processing, analysis and modeling;

[0116] Do not process data: During the data preprocessing phase, do not process missing values in the dataset;

[0117] True value conversion: Acknowledge the existence of missing values, treat data missingness as part of the data distribution law, and use the actual value and missingness of the variable as input dimensions for subsequent data processing and model calculation.

[0118] (2) Data encoding: In order to make some features usable in models such as logistic regression and support vector machines, some features need to be converted into numerical types: serial encoding, one-hot encoding, and binary encoding.

[0119] Ordinal encoding: This is mainly used when a dataset consists entirely of categorical features, and the values within these categorical features are ordered by size. For a feature with m categories, it is mapped to integers in the range [0, m-1]. For example, for "education level," "bachelor," "master," and "doctor" are naturally encoded as [0, 1, 2].

[0120] One-hot encoding: also known as one-bit effective encoding, mainly uses an N-bit state register to encode N states. Each state has an independent register bit, and only one bit is valid at any time.

[0121] Binary encoding: Use 0 and 1 to represent elements in the sample matrix that are higher or lower than a given threshold.

[0122] In this method, one-hot encoding is used to encode part of the text data, for example, for model training to improve the model's fit to the data.

[0123] (3) Data normalization: Unify the features into a roughly similar numerical range to eliminate the dimensional influence between the features and make different indicators comparable. Commonly used methods include linear function normalization and zero mean normalization.

[0124] In this method, the data of attributes involving amount are normalized using zero mean normalization to eliminate the dimensional impact caused by excessive transaction amount.

[0125] In one embodiment, the integrated learning recognition process is as follows Figure 8 As shown, the scoring logic diagram is as follows Figure 9 shown.

[0126] It should be understood that, although the steps in the flowcharts of the above embodiments are shown in sequence as indicated by the arrows, these steps are not necessarily performed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be performed in other orders. Moreover, at least a portion of the steps in the flowcharts of the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily performed at the same time, but can be performed at different times. The execution order of these steps or stages is not necessarily to be performed in sequence, but can be performed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0127] Based on the same inventive concept, embodiments of the present application further provide an account data processing device for implementing the aforementioned account data processing method. The solution provided by this device is similar to the solution described in the aforementioned method. Therefore, the specific limitations of one or more of the following embodiments of the account data processing device can be found in the above-described limitations of the account data processing method and will not be further elaborated here.

[0128] In one embodiment, Figure 10 As shown, an account data processing device is provided, comprising: a business transaction data acquisition module, an account anomaly identification result acquisition module, a merged account anomaly identification result module, and an account anomaly scoring result module, wherein:

[0129] The business transaction data acquisition module 1002 is used to acquire the business transaction data of the target account. The business transaction data of the target account is the business data generated after the target account performs a resource interaction operation in the resource interaction system.

[0130] An account anomaly identification result obtaining module 1004 is configured to input the target account's business transaction data into at least one base classifier and obtain an account anomaly identification result corresponding to each base classifier. Each base classifier is a classification model with independent errors. The account anomaly identification result is used to represent the probability of the target account having abnormal interaction behavior in the resource interaction system.

[0131] A merged account anomaly identification result module 1006 is used to merge the account anomaly identification results corresponding to each base classifier to obtain a merged account anomaly identification result. The merged account anomaly identification result indicates whether the target account has any abnormal business transactions.

[0132] The account anomaly scoring result module 1008 is used to fuse the account anomaly identification results corresponding to each base classifier and the merged account anomaly identification results to obtain the account anomaly scoring result corresponding to the target account.

[0133] In one embodiment, the merged account anomaly identification result module is also used to input the account anomaly identification results corresponding to each base classifier into the voting algorithm to obtain a merged result matrix corresponding to the account anomaly identification results, and the dimension of the merged result matrix is the same as the number of base classifiers; the anomaly discrimination results corresponding to the account anomaly identification results whose number of votes exceeds a preset threshold are selected from the merged result matrix as the merged account anomaly identification results.

[0134] In one embodiment, the merged account anomaly identification result module is further used to determine the columns corresponding to the unvoted matrix based on the number of base classifiers, and determine the rows corresponding to the unvoted matrix based on the number of account anomaly identification results; multiply the data of the rows and columns corresponding to the unvoted matrix one by one to obtain the unvoted matrix corresponding to the number of base classifiers; input the unvoted matrix into the voting algorithm to obtain the merged result matrix corresponding to the account anomaly identification results.

[0135] In one embodiment, the merged account anomaly identification result module is also used to determine a preset threshold of votes obtained by each element in the merged result matrix from the number of base classifiers, and the preset threshold is set to be smaller than the number of base classifiers; if the number of votes obtained by an element in the merged result matrix exceeds the preset threshold, the anomaly discrimination result corresponding to the account anomaly identification result of the element is output as the merged account anomaly identification result.

[0136] In one embodiment, the account anomaly scoring result module is further used to obtain the weights corresponding to each of the base classifiers and the number of the base classifiers, where the weights corresponding to the base classifiers are determined based on the errors corresponding to the base classifiers; based on the weights corresponding to the base classifiers, the account anomaly identification results corresponding to the base classifiers are adjusted to obtain adjusted identification results; based on the multiplication of each adjusted identification result with the merged account anomaly identification result, the account anomaly scoring result corresponding to the target account is obtained.

[0137] In one embodiment, the account anomaly scoring result module is further used to multiply each of the adjusted recognition results with the merged account anomaly recognition result to obtain a sub-anomaly scoring result corresponding to each of the adjusted recognition results; and accumulate the sub-anomaly scoring results corresponding to each of the adjusted recognition results to obtain an account anomaly scoring result corresponding to the target account.

[0138] Each module in the aforementioned account data processing device may be implemented in whole or in part through software, hardware, or a combination thereof. Each module may be embedded in or independent of a processor in a computer device in the form of hardware, or may be stored in a memory in the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0139] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 11 As shown. The computer device includes a processor, memory, and a network interface connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store server data. The network interface of the computer device is used to communicate with an external terminal via a network connection. When executed by the processor, the computer program implements an account data processing method.

[0140] Those skilled in the art will understand that Figure 11 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0141] In one embodiment, a computer device is further provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps in the above method embodiments when executing the computer program.

[0142] In one embodiment, a computer-readable storage medium is provided, storing a computer program, which implements the steps in the above-mentioned method embodiments when executed by a processor.

[0143] In one embodiment, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps of each of the above-described method embodiments.

[0144] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0145] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, distributed databases based on blockchains. The processor involved in the various embodiments provided herein may be, but are not limited to, a general-purpose processor, a central processing unit, a graphics processing unit, a digital signal processor, a programmable logic unit, a data processing logic unit based on quantum computing, and the like.

[0146] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0147] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A method for processing account data, characterized in that: The method comprises: Acquire business transaction data of a target account, where the business transaction data of the target account is business data generated after the target account performs a resource interaction operation in the resource interaction system; Inputting the business transaction data of the target account into at least one base classifier to obtain an account anomaly identification result corresponding to each base classifier, wherein each base classifier is a classification model with independent errors, and the account anomaly identification result is used to represent the probability that the target account has abnormal interaction behavior in the resource interaction system; The account anomaly identification results corresponding to the base classifiers are merged to obtain a merged account anomaly identification result, including: Inputting the account anomaly identification results corresponding to each base classifier into a voting algorithm to obtain a merged result matrix corresponding to the account anomaly identification results, wherein the dimension of the merged result matrix is the same as the number of base classifiers; Selecting, from the combined result matrix, the abnormality identification result corresponding to the abnormal account identification result in which the number of votes exceeds a preset threshold as the combined account abnormality identification result, wherein the combined account abnormality identification result indicates whether the target account has any abnormal business transactions; The account anomaly recognition results corresponding to each of the base classifiers and the merged account anomaly recognition result are integrated to obtain an account anomaly scoring result corresponding to the target account.

2. The method according to claim 1, characterized in that The account anomaly identification results corresponding to each base classifier are input into a voting algorithm to obtain a combined result matrix corresponding to the account anomaly identification results, including: Determining columns corresponding to a non-voting matrix based on the number of base classifiers, and determining rows corresponding to the non-voting matrix based on the number of account anomaly identification results; Merging the data of the rows and columns corresponding to the non-voting matrix one by one to obtain a non-voting matrix corresponding to the number of base classifiers; The non-voting matrix is input into the voting algorithm to obtain a combined result matrix corresponding to the account anomaly identification result.

3. The method according to claim 1, characterized in that The selecting, from the combined result matrix, the abnormality identification result corresponding to the abnormal account identification result in which the number of votes exceeds a preset threshold as the combined abnormal account identification result includes: Determining a preset threshold of the votes obtained by each element in the combined result matrix based on the number of the base classifiers, wherein the preset threshold is set to be smaller than the number of the base classifiers; If the number of votes obtained by an element in the merged result matrix exceeds the preset threshold, the abnormality discrimination result corresponding to the account abnormality identification result where the element is located is output as the merged account abnormality identification result.

4. The method according to claim 1, wherein The fusing of the account anomaly identification results corresponding to the base classifiers and the merged account anomaly identification result to obtain the account anomaly scoring result corresponding to the target account includes: Obtaining a weight corresponding to each base classifier and the number of base classifiers, wherein the weight corresponding to the base classifier is determined according to the error corresponding to each base classifier; Adjusting the account anomaly recognition results corresponding to the base classifiers based on the weights corresponding to the base classifiers to obtain adjusted recognition results; The account anomaly score result corresponding to the target account is obtained by multiplying each of the adjusted recognition results with the merged account anomaly recognition result.

5. The method according to claim 4, characterized in that The multiplication of the adjusted recognition result and the merged account anomaly recognition result to obtain the account anomaly score result corresponding to the target account includes: Multiplying each of the adjusted recognition results by the merged account anomaly recognition result to obtain a sub-anomaly score result corresponding to each of the adjusted recognition results; The sub-anomaly scoring results corresponding to the adjusted recognition results are accumulated to obtain the account anomaly scoring result corresponding to the target account.

6. An account data processing device, characterized in that: The device comprises: A business transaction data acquisition module is used to acquire business transaction data of a target account, where the business transaction data of the target account is business data generated after the target account performs a resource interaction operation in the resource interaction system; An account anomaly identification result obtaining module is used to input the business transaction data of the target account into at least one base classifier to obtain an account anomaly identification result corresponding to each base classifier, each base classifier being a classification model with independent errors. The account anomaly identification result is used to represent the probability that the target account has abnormal interaction behavior in the resource interaction system; A merged account anomaly identification result module is used to merge the account anomaly identification results corresponding to each base classifier to obtain a merged account anomaly identification result, wherein the merged account anomaly identification result indicates whether the target account has any abnormal business transactions; An account anomaly scoring result module is used to fuse the account anomaly identification results corresponding to each base classifier and the merged account anomaly identification result to obtain an account anomaly scoring result corresponding to the target account; The merged account anomaly identification result module is further used to input the account anomaly identification results corresponding to each base classifier into a voting algorithm to obtain a merged result matrix corresponding to the account anomaly identification results, where the dimension of the merged result matrix is the same as the number of base classifiers; and select from the merged result matrix the anomaly discrimination results corresponding to the account anomaly identification results whose number of votes exceeds a preset threshold as the merged account anomaly identification results.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

9. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images