Abnormal user identification method, processing method, device, equipment and medium

Abstract

The present invention relates to an abnormal object identification method, processing method, apparatus, device, and medium. The method comprises: inputting acquired transaction information into a preset recognition model to determine candidate objects; obtaining transaction records of the candidate objects to extract a first group of candidate abnormal objects; obtaining transaction records of a preset abnormal object sample to extract a second group of candidate abnormal objects; and obtaining the intersection of the first group of candidate abnormal objects and the second group of candidate abnormal objects to determine a target abnormal object. The present invention not only improves the accuracy of target object identification but also enhances the real-time nature of identification, facilitating effective suppression of anomalies. The method can be widely applied in the field of internet technology.

Description

Technical Field

[0001] The present invention relates to the field of Internet technology, and in particular to an abnormal user identification method, processing method, device, equipment and medium. Background Art

[0002] With the rapid development of internet technology, a growing number of internet-related anomalous industries have emerged. Abnormal online behavior refers to illegal activities that threaten the security of computer information systems and the orderly management of cyberspace, using the internet as a medium and network technology as a primary means. Users who participate in transactions involving abnormal online behavior are generally referred to as abnormal users.

[0003] Traditionally, identifying abnormal users relies on transaction data generated when user transaction volume suddenly increases. However, in the mobile payment sector, abnormal users often profit by initiating online refunds for previous transactions. This method of online refunds hardly reflects the characteristics of a sudden increase in transactions. Therefore, existing technologies can only identify abnormal users based on static clues such as merchant complaints and links to illegal business licenses. This identification method is not very timely and is prone to identification lags, making it impossible to implement timely restrictive measures against abnormal users. Furthermore, identification accuracy is low, making it ineffective in suppressing abnormalities. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide an abnormal user identification method, processing method, apparatus, device, and medium to improve the accuracy and real-time performance of abnormal user identification.

[0005] One aspect of the present invention provides a method for identifying abnormal users, comprising:

[0006] Input the acquired transaction information of the merchant to be identified into the preset abnormal merchant identification model to determine the candidate merchant;

[0007] Acquiring transaction records of the candidate merchant, and extracting a first candidate abnormal user group based on the transaction records of the candidate merchant; candidate abnormal users in the first candidate abnormal user group have transaction records with the candidate merchant;

[0008] Acquire transaction records of a preset abnormal merchant sample, and extract a second candidate abnormal user group based on the transaction records of the abnormal merchant sample; the candidate abnormal users in the second candidate abnormal user group have transaction records with the abnormal merchant sample;

[0009] A target abnormal user is determined according to the intersection of the first candidate abnormal user group and the second candidate abnormal user group.

[0010] Another aspect of an embodiment of the present invention provides a method for handling abnormal users. The method for handling abnormal users includes:

[0011] Apply the abnormal user identification method described above to identify the target abnormal user;

[0012] Determining an operation scenario of the target abnormal user based on the account information of the target abnormal user, where the operation scenario includes at least one of a commercial payment scenario, a commercial withdrawal scenario, or a commercial refund scenario;

[0013] In the operation scenario, at least one of fund interception processing, fund freezing processing, and fund recovery processing is performed on the target abnormal user.

[0014] Another aspect of the present invention provides an abnormal user identification device, including:

[0015] A determination module is used to input the acquired transaction information of the merchant to be identified into a preset abnormal merchant identification model to determine the candidate merchant;

[0016] A first extraction module is configured to obtain transaction records of the candidate merchant and extract a first candidate abnormal user group based on the transaction records of the candidate merchant; the candidate abnormal users in the first candidate abnormal user group have transaction records with the candidate merchant;

[0017] A second extraction module is configured to obtain transaction records of a preset abnormal merchant sample and extract a second candidate abnormal user group based on the transaction records of the abnormal merchant sample; the candidate abnormal users in the second candidate abnormal user group have transaction records with the abnormal merchant sample;

[0018] An identification module is configured to determine a target abnormal user based on an intersection of the first candidate abnormal user group and the second candidate abnormal user group.

[0019] Another aspect of the present invention provides an abnormal user processing device, including:

[0020] An identification module, configured to identify target abnormal users using the abnormal user identification device described above;

[0021] A scenario confirmation module is used to determine the operation scenario of the target abnormal user based on the account information of the target abnormal user, where the operation scenario includes at least one of a commercial payment scenario, a commercial withdrawal scenario, or a commercial refund scenario;

[0022] The strike module is used to perform at least one of fund interception, fund freezing or fund recovery processing on the target abnormal user in the operation scenario.

[0023] Another aspect of an embodiment of the present invention further provides an electronic device, including a processor and a memory;

[0024] The memory is used to store programs;

[0025] The processor executes the program to implement the method described above.

[0026] Another aspect of the embodiments of the present invention further provides a computer-readable storage medium, wherein the storage medium stores a program, and the program is executed by a processor to implement the method described above.

[0027] Another aspect of an embodiment of the present invention further provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions, causing the computer device to perform the above method.

[0028] The embodiment of the present invention first inputs the acquired transaction information of the merchant to be identified into a preset abnormal merchant identification model to determine the candidate merchant, then obtains the transaction records of the candidate merchant and extracts a first candidate abnormal user group based on the transaction records of the candidate merchant; then obtains the transaction records of a preset abnormal merchant sample and extracts a second candidate abnormal user group based on the transaction records of the abnormal merchant sample; finally, the target abnormal user is determined based on the intersection of the first candidate abnormal user group and the second candidate abnormal user group. While extracting the first candidate abnormal user group based on the transaction records of the candidate merchant, the embodiment of the present invention also extracts the second candidate abnormal user group based on the transaction records of the preset abnormal merchant sample, and finally identifies the target abnormal user based on the intersection of the first candidate abnormal user group and the second candidate abnormal user group, thereby improving the accuracy of abnormal user identification; in addition, the embodiment of the present invention takes into account the real-time transaction records of the candidate merchant in the process of identifying the target abnormal user. Compared with the prior art that uses static clues such as merchant complaints and the association of illegal business licenses to perform abnormal identification, the present invention improves the real-time performance of target abnormal user identification and helps to effectively suppress abnormal users. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0030] Figure 1 A schematic diagram of the implementation environment of abnormal user transaction behavior;

[0031] Figure 2 A schematic diagram of an application scenario of a method for identifying and processing abnormal users provided by an embodiment of the present invention;

[0032] Figure 3 A diagram of the interactive interface of a terminal device during the exception handling process provided by an embodiment of the present invention;

[0033] Figure 4 A flowchart of a method for identifying abnormal users provided by an embodiment of the present invention;

[0034] Figure 5 A flowchart of the steps for determining candidate merchants provided by an embodiment of the present invention;

[0035] Figure 6 A flowchart of the steps for determining candidate abnormal users during the scenario preparation period according to an embodiment of the present invention;

[0036] Figure 7 A flowchart of the steps for obtaining a first candidate abnormal user group according to an embodiment of the present invention;

[0037] Figure 8 A flowchart of the steps for obtaining a second candidate abnormal user group according to an embodiment of the present invention;

[0038] Figure 9 This is a flowchart of the steps for determining candidate abnormal users during the fund withdrawal period according to an embodiment of the present invention;

[0039] Figure 10 A flowchart of the steps for determining a second candidate abnormal user group according to an embodiment of the present invention;

[0040] Figure 11 This is a flowchart of the steps for determining a target abnormal user according to an embodiment of the present invention;

[0041] Figure 12 A flowchart of the steps of a method for identifying abnormal target users provided by another embodiment of the present invention;

[0042] Figure 13 Schematic diagram of the process of the Fast Unfolding community algorithm in an embodiment of the present invention;

[0043] Figure 14 A flowchart of the abnormal user processing method according to an embodiment of the present invention;

[0044] Figure 15 A complete flowchart of abnormal user identification and processing steps provided by an embodiment of the present invention;

[0045] Figure 16 A schematic diagram of the structure of an abnormal user identification device provided by an embodiment of the present invention;

[0046] Figure 17 A schematic diagram of the structure of an abnormal user processing device provided by an embodiment of the present invention;

[0047] Figure 18 A schematic diagram of the structure of an abnormal user identification device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solutions and advantages of this application more clearly understood, the present application is further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0049] Reference Figure 1 In the mobile payment sector, abnormal transactions generally involve three scenarios: scenario preparation period 101, abnormal transaction period 102, and fund withdrawal period 103. Specifically, during scenario preparation period 101, an abnormal user pays a large sum of money to an abnormal merchant and then withdraws the entire amount. During abnormal transaction period 102, the abnormal user uses the aforementioned illegal behavior to deceive the public into initiating transactions with the abnormal merchant. During fund withdrawal period 103, the abnormal user initiates a large refund from the abnormal merchant, thereby achieving abnormal profits. Abnormal users are those who exploit mobile payment for malicious purposes.

[0050] In related technologies, anomalous users can only be identified through static clues such as merchant complaints and links to illegal business licenses. This identification method is not very timely and is prone to identification lags, making it difficult to implement restrictive measures against anomalous users in a timely manner. Furthermore, identification accuracy is low, making it ineffective in curbing anomalous transactions.

[0051] Furthermore, related technologies also suffer from the same issues of single scenarios and single behaviors when handling abnormal users. Because abnormal transactions rarely exhibit the same characteristics as a sudden surge in commercial payment transactions during withdrawals, related technologies often rely on static clues such as merchant complaints and links to illegal business licenses to determine the merchant's malicious intent and then penalize the abnormal user accordingly. This type of penalty exhibits significant lags and fails to effectively inhibit abnormal users from withdrawing funds.

[0052] Therefore, embodiments of the present invention provide a software platform for identifying and handling abnormal users. The platform identifies three periods during which abnormal users conduct transactions: scenario preparation, abnormal transaction, and fund withdrawal. The platform selects the scenario preparation and fund withdrawal periods to identify candidate abnormal users in the transaction process and screens and identifies these candidates during the transaction process. Once the platform identifies an account as an abnormal user, it can handle the abnormal user during the fund withdrawal period or during the commercial payment transaction, thereby improving the accuracy and timeliness of abnormality handling.

[0053] Moreover, in the process of identifying and determining abnormal users, the embodiments of the present invention are based on the real-time transaction records of candidate merchants. Compared with the prior art that identifies abnormal users through static clues such as merchant complaints and association with illegal business licenses, the present invention improves the real-time nature of target abnormal user identification, and further contributes to the effective suppression of abnormal transactions.

[0054] refer to Figure 2 , Figure 2The present invention provides an embodiment of an abnormal user identification method application scenario diagram. In this application scenario, including at least one terminal device 201 and a server 202, the user can log in to the personal account through the terminal device to make mobile payments or online transactions, the server obtains the transaction data generated by the personal account in the terminal device, identifies whether the personal account is an abnormal account, and if it is determined to be an abnormal account, it will accurately process the abnormal account of the terminal device. In this application scenario, the terminal device can be any electronic product that can perform human-computer interaction through one or more methods such as a keyboard, touchpad, touch screen, remote control, voice interaction or handwriting device. The electronic product can conduct transactions through a web page or an online transaction or mobile payment application (Application, APP) installed therein and generate corresponding transaction records. For example, the terminal device can be a personal computer (Personal Computer, PC), a mobile phone, a smart phone, a personal digital assistant (Personal Digital Assistant, PDA), a wearable device, a handheld computer PPC (Pocket PC), a tablet computer, etc. It is understandable that in this application scenario, the server can be an independent server, or a server cluster composed of several servers, or a cloud computing service center; the form of the server is not limited to the form described in the above example. In this application scenario, the server is equipped with a software platform for abnormal user identification and abnormal user processing provided by the application embodiment. The server obtains the transaction records of the personal account logged in to the terminal device and updates and loads them to the platform. The platform screens and identifies the transaction process in the transaction record to determine whether the personal account is an abnormal account; if it is determined to be an abnormal account, the platform will mark the abnormal user and perform precise processing. The processing methods may include but are not limited to fund truncation processing, fund freezing processing, and fund recovery, etc.

[0055] like Figure 2As shown, the user logs in to a personal account on the terminal device 201 and generates a certain number of transaction records stored locally, i.e., in the terminal device, through behaviors such as mobile payment or online transactions. The server 202 obtains the transaction records uploaded by the device terminal, which carry merchant information and the merchant is not marked as a candidate merchant. The server inputs the transaction information of the merchant to be identified into the abnormal merchant identification model preset in the platform. After determining that the merchant is a candidate merchant, the transaction records of the candidate merchant are extracted from the transaction records obtained by the server, and the first candidate abnormal user group is further extracted; the candidate abnormal users in the first candidate abnormal user group have transaction records with the candidate merchants; the platform of the embodiment of the present invention then obtains the second candidate abnormal user group based on the transaction records of the preset abnormal merchant samples; the candidate abnormal users in the second candidate abnormal user group have transaction records with the abnormal merchant samples; the intersection of the first candidate abnormal user group and the second candidate abnormal user group is obtained, and the target abnormal user is determined based on the intersection. Finally, if it is determined that the personal account logged in on the terminal device is an abnormal user, the server will perform processing actions, for example, freezing the funds of the abnormal user. The server will feed back the processing results to the terminal device and display the processing results visually; Figure 3 As shown, for example, the user interaction interface of the terminal device 201 logged in by the abnormal user displays relevant information such as "the account has been frozen".

[0056] It should be understood that the embodiments of the present invention are only Figure 2 and Figure 3 An example of an application scenario that can be implemented and a possible implementation result is described, that is, a user logs into a personal account through the device terminal 201 to complete mobile payment and online transactions to generate transaction data, and the server 202 identifies the personal account of the device terminal based on the transaction data, determines it as an abnormal user, performs processing, and feeds back the processing results to the terminal device 201 for visual display. In other application scenarios of the embodiments of the present invention, the software platform for abnormal user identification and abnormal user processing can also be directly installed on the terminal device 201. After the terminal device 201 disconnects the communication connection with the server 202, the user can perform offline identification operations based on the data cached in the terminal device; after reconnecting to the server 202, the identification results cached locally by the terminal device 201 are uploaded and updated to the server 202. For another example, an ordinary user may log into a personal account through the device terminal 201 to complete mobile payment and online transactions to generate transaction data, and the other party to the transaction is an abnormal user or an abnormal merchant. In this case, the server will feedback corresponding reminder information to indicate that a risky transaction operation is in progress. The embodiments of the present invention do not limit specific application scenarios. The above-mentioned Figure 2 and Figure 3The application scenarios are only used as examples.

[0057] It is understandable that in the implementation environment of the abnormal user identification and processing method disclosed in the embodiment of the present invention, the blockchain can also be used for data storage; that is, during the implementation process, abnormal users or other data identified by other blockchain nodes can be obtained from the existing blocks in the blockchain; the abnormal user data identified by the node is packaged into a new block and uploaded to the blockchain. Through the decentralized data storage method of the blockchain, the data is more open and secure, and malicious data tampering is also avoided. In addition, the result data obtained by the abnormal user identification and processing method disclosed in the embodiment of the present invention can also be stored through the blockchain, so that all blocks in the blockchain can obtain and use the above result data in real time.

[0058] like Figure 4 As shown, the embodiment of the present invention provides a method for identifying abnormal users, which can be applied to the above Figure 2 The terminal device 201 or server 202 in the embodiment can be implemented, and can also be executed on any device or equipment with data processing capabilities, such as a smart phone. Figure 4 The method specifically includes but is not limited to steps S100-S400:

[0059] S100: Input the acquired transaction information of the merchant to be identified into a preset abnormal merchant identification model to determine candidate merchants;

[0060] Specifically, the transaction information of the merchant to be identified is the transaction data generated after the user logs into his personal account on the device terminal and makes a mobile payment or an online transaction, and in such transaction data, the payee of the transaction or the merchant receiving the payment is not marked as a candidate merchant. A candidate merchant refers to a payee or a merchant receiving the payment that has a high probability of being an abnormal merchant; and the probability thereof is obtained by fitting and predicting the probability result through a preset abnormal merchant identification model. When the obtained probability result is not less than the set probability threshold, the merchant is marked as a candidate merchant. It should be understood that the preset abnormal merchant identification model in the embodiment of the present invention can use a recurrent neural network (RNN) model to output the probability result; or a classification model such as a support vector machine (SVM) or a random forest (Random Forest) model can be used to directly output the classification result of the candidate merchant or non-candidate merchant. The embodiment of the present invention inputs the transaction information of the merchant to be identified into a preset abnormal merchant identification model, thereby determining whether the merchant is a candidate merchant, and performing fitting prediction through the model, thereby ensuring the accuracy of the prediction throughout the abnormal transaction confrontation process.

[0061] S200: Obtain transaction records of candidate merchants and extract a first candidate abnormal user group;

[0062] Among them, there are transaction records between the candidate abnormal users in the first candidate abnormal user group and the candidate merchants; it can be understood that the candidate abnormal users are users who have transactions with the merchants marked as candidate merchants in step S100; the transaction records of the candidate merchants obtained are marked as candidate merchants in step S100, and then the transaction records are extracted according to the label of the candidate merchants in all the acquired transaction data.

[0063] Specifically, the embodiment of the present invention obtains the transaction records of the candidate merchants, preliminarily determines the first candidate abnormal users according to the transaction objects of the transaction records, and constructs a first candidate abnormal user group.

[0064] S300: Acquire transaction records of a preset abnormal merchant sample, and extract a second candidate abnormal user group based on the transaction records of the abnormal merchant sample;

[0065] The candidate abnormal users in the second candidate abnormal user group have transaction records with the abnormal merchant sample. The acquired transaction records of the preset abnormal merchant sample are sample data extracted from historical transaction data, and in this sample data, at least one of the two parties to the transaction has been marked as an abnormal merchant, that is, transaction records marked with abnormal merchants are extracted from the historical transaction data. It is understood that the sample data extracted from the historical transaction data can be filtered according to specific needs, for example, to determine whether the transaction was completed within the past six months.

[0066] Specifically, this embodiment of the present invention obtains transaction records from a preset sample of abnormal merchants and, similarly based on the transaction objects in these transaction records, preliminarily identifies a second group of candidate abnormal users, thereby constructing a second group of candidate abnormal users; where the transaction objects include individual users or merchants. It is understood that the first and second candidate abnormal users differ only in the source of their acquisition, while the information field attributes they carry remain somewhat consistent.

[0067] S400: Determine a target abnormal user according to the intersection of the first candidate abnormal user group and the second candidate abnormal user group.

[0068] By extracting the intersection of the first candidate abnormal user group and the second candidate abnormal user group, the transaction characteristics of the candidate abnormal users that exist in both candidate abnormal user groups can be determined. Transaction characteristics are attributes within the abnormal user group that distinguish the abnormal user from ordinary users, or behavioral characteristics in the transaction records completed by the abnormal user that can be used to characterize the abnormal user as an abnormal user. It should be understood that if the transaction characteristics are behavioral characteristics, they are primarily reflected in the transaction scenario preparation period and the fund withdrawal period. The target abnormal user in step S400 is the abnormal user ultimately determined from the candidate users based on the analysis and comparison of transaction characteristics.

[0069] Specifically, the embodiment of the present invention extracts transaction features from the first candidate abnormal user group and the second candidate abnormal user group, respectively, and through analysis and comparison of the features, further determines whether the candidate abnormal users in the first candidate abnormal user group are target abnormal users. The analysis and comparison can be performed by mathematical intersection or by using an iterative algorithm to divide the community, thereby determining the target abnormal user; it should be understood that when performing community division by an iterative algorithm, the final output result is an abnormal user community containing several abnormal users. For example, when the analysis and comparison in step S400 uses mathematical intersection to determine the target abnormal user, the intersection of the first candidate abnormal user group and the first candidate abnormal user group is obtained. The obtained intersection is a set of candidate abnormal users that appear in the first candidate abnormal user group and also appear in the second candidate abnormal user group, and then the candidate abnormal users in the intersection are determined to be target abnormal users; it should be understood that when using mathematical intersection to determine the target abnormal user, the transaction features of the two are compared, and the data attributes and numerical content of the two should be completely consistent.

[0070] The abnormal user identification method of the embodiment of the present invention first inputs the preset abnormal merchant identification model through the transaction information of the merchant to be identified in the transaction data, marks the candidate merchant in the transaction data, and then determines the first candidate abnormal user group based on the transaction record of the candidate merchant; obtains the transaction records of the preset abnormal merchant sample from the historical transaction data, and extracts the second candidate abnormal user group; extracts transaction features from the first candidate abnormal user group and the second candidate abnormal user group, and finally identifies the target abnormal user in combination with the transaction features; through model recognition and feature extraction and analysis, the accuracy of abnormal user identification is improved.

[0071] Reference Figure 5 , which is a flowchart of the steps for determining candidate merchants provided by an embodiment of the present invention. In some embodiments, the above embodiment step S100, inputting the acquired transaction information of the merchant to be identified into the preset abnormal merchant identification model to determine the candidate merchant, may include steps S110-S140:

[0072] S110. Generate a transaction instruction in response to a commercial payment behavior of the merchant to be identified during the mobile payment process;

[0073] Merchants to be identified are merchants that have not been flagged as candidate abnormal users. Commercial payment behavior is a payment action completed during a mobile payment process, such as transferring money to a merchant in exchange for goods. Transaction instructions are instructions that contain a variety of attribute information about the commercial payment behavior. These transaction instructions are also used to trigger feature extraction and recognition actions in subsequent steps. In the embodiments of this application, the attribute information of commercial payment behavior includes, but is not limited to, historical variables and static text variables.

[0074] Specifically, when a merchant conducts a transaction, a transaction instruction is generated based on the commercial payment behavior, and abnormal users are subsequently identified based on the merchant information in the transaction instruction.

[0075] S120. Obtain historical variables and static text variables of the merchant to be identified according to the transaction instruction;

[0076] Historical variables are information recorded from commercial payments completed by the merchant before the current payment, such as the transaction amount between the merchant and the abnormal merchant and the time the transaction was completed. Static text variables are extracted from the merchant's registration information, such as the merchant's real-name registration information and whether the merchant's registered IP address (Internet Protocol Address) is located in a high-risk area.

[0077] Specifically, after obtaining the transaction instruction in step S110, the embodiment of the present invention extracts historical variables and static text variables from the merchant's transaction history data and merchant registration information; the method of extracting historical variables and static text variables includes but is not limited to natural language processing (NLP) methods, for example, performing word segmentation and keyword detection on the transaction history data recorded in text form, and then obtaining feature variables of multiple dimensions.

[0078] S130. Generate a feature combination based on the transaction instructions, historical variables, and static text variables;

[0079] The feature combination is a combination of several historical variables and static text variables of the merchant to be identified obtained in step S120 according to the transaction instruction.

[0080] For example, this embodiment of the present invention can call pre-stored variables using merchant name and transaction date as keywords. Historical variables include the merchant, transaction amount, and number of completed transactions; static text variables include the merchant name and notes associated with each transaction. Furthermore, this embodiment of the present invention parses transaction instructions to obtain real-time stream variables, such as the time of the current transaction. Based on these historical variables, static text variables, and real-time stream variables, a three-dimensional feature combination is constructed as input to a pre-defined abnormal merchant identification model.

[0081] S140: Input the feature combination into a preset abnormal merchant identification model, predict the merchants to be identified, and determine candidate merchants among the merchants to be identified;

[0082] The pre-set abnormal merchant identification model is an algorithmic model capable of data classification, including but not limited to neural network models, cluster analysis models, and binary classification models. The fitting prediction process involves using the abnormal merchant identification model to combine input features and output a prediction result. Based on this prediction result, the merchant to be identified is then determined to be an abnormal merchant.

[0083] Specifically, refer to Figure 6 In an embodiment of the present invention, a support vector machine (SVM) can be used as an abnormal merchant identification model. The model is trained using historical transaction data and a dataset of merchants marked as abnormal. The training set is then binary-classified based on historical variables, static text variables, and real-time stream variables from the historical transaction data to obtain the optimal decision boundary for the abnormal merchant identification model, completing the training. The feature combination of the merchant to be identified is then input into the abnormal merchant identification model to obtain a predicted probability. Users with a predicted probability greater than 90% are identified as candidate merchants, while those with a predicted probability lower than 90% are considered normal merchants. In some specific scenarios, the model's results can be binarized, with candidate merchants marked with 1 and normal users marked with 0.

[0084] For example, in an embodiment of the present invention, a transaction instruction is triggered according to the transaction behavior of merchant A. According to the transaction instruction and the historical variables and static text variables of merchant A, a feature combination is extracted as {merchant name: XX, transaction amount with abnormal merchant B: XX yuan, number of transactions with abnormal merchant B: 1}. The feature combination is input into a pre-trained support vector machine model. The prediction result probability output by the model is 98.89%, and merchant A is determined to be an abnormal merchant. A tag field for the abnormal merchant is generated and its value is set to 1. The embodiment of the present invention adopts a model prediction method instead of a method of judging abnormal merchants by static clues, and the obtained prediction result is more accurate.

[0085] Reference Figure 7 , which is a flow chart of extracting a first candidate abnormal user group according to an embodiment of the present invention. In some embodiments, step S200, obtaining transaction records of candidate merchants, and extracting a first candidate abnormal user group according to the transaction records of the candidate merchants, may include steps S210-S230:

[0086] S210: Obtain transaction records of candidate merchants;

[0087] Specifically, in the abnormal transaction behavior of abnormal merchants, the transactions of abnormal users generally present the characteristics of a small number of transactions, large amounts, and a sudden increase in transactions. The embodiment of the present invention obtains the transaction records of the candidate merchant from the transaction data based on the merchant name or merchant information according to the candidate merchant determined in step S100. In some feasible implementation scenarios, after identification through the abnormal merchant identification model, a specific tag field can be obtained. When the field value is 1, the merchant is an abnormal merchant; when the field value is 0, the merchant is a non-abnormal merchant. In the process of obtaining transactions of merchants, the embodiment of the present invention can be used to index and distinguish abnormal merchants from non-abnormal merchants based on the tag field, and then extract the transaction records of specific candidate merchants from the transaction data of all abnormal merchants to improve the efficiency of data processing.

[0088] S220: Determine, based on a preset first transaction amount threshold, a first target transaction record of the candidate merchant whose transaction amount is greater than the first transaction amount threshold;

[0089] Among them, the preset first transaction amount threshold is used to distinguish abnormal users from non-abnormal users based on the transaction feature of the transaction amount, and to determine from all the transaction records of the candidate merchant whether the candidate merchant has any transaction behavior with a transaction amount greater than the transaction amount threshold.

[0090] S230: Extract transaction users from all first target transaction records to determine a first candidate abnormal user group;

[0091] In this embodiment of the present invention, the abnormal users in the first candidate abnormal user group can be further specifically users who have conducted large-value transactions with the candidate merchant, where large-value transactions are transactions in which the transaction amount determined in step S220 is greater than the first transaction amount threshold. Users who have conducted large-value transactions with the candidate merchant are obtained to construct a candidate abnormal user group, i.e., the first candidate abnormal user group, and the users in the candidate abnormal user group are labeled.

[0092] Exemplarily, the first transaction amount threshold preset in the embodiment of the present invention is 100,000 yuan. According to the candidate merchant determined in step S100, the historical transaction records of the candidate merchant in the past year are obtained, and the historical transaction records are screened according to the transaction amount to extract transaction records with a transaction amount greater than 100,000 yuan. From the transaction records with a transaction amount greater than 100,000 yuan, users who have conducted transactions with the candidate merchant are determined, and such users are clustered to obtain a first candidate abnormal user group, and the candidate abnormal users are marked.

[0093] Reference Figure 8 , which is a flowchart of extracting the second candidate abnormal user group according to an embodiment of the present invention. In some embodiments, step S300, obtaining transaction records of a preset abnormal merchant sample, and extracting the second candidate abnormal user group based on the transaction records of the abnormal merchant sample, may include steps S310-S330:

[0094] S310. Obtain transaction records of the abnormal merchant samples according to the preset abnormal merchant samples;

[0095] Specifically, similar to the principle of the method for determining the first candidate abnormal user group, in view of the characteristics of abnormal transaction behavior such as a small number of transactions, large amounts, and sudden increases in transactions, the embodiment of the present invention pre-collects and stores a large amount of historical transaction data, including transaction data of abnormal merchants. It can be understood that the abnormal merchant sample is an abnormal merchant that has been determined and marked, and the identification method used includes but is not limited to the use of an abnormal merchant identification model or through manual marking. The implementation of the present invention uses abnormal merchants in the historical transaction data as sample data and filters the transaction records of the abnormal merchant sample from the historical transaction data.

[0096] S320: Determine, based on a preset second transaction amount threshold, a second target transaction record in the transaction records of the abnormal merchant sample, whose transaction amount is greater than the second transaction amount threshold;

[0097] Similarly, the function of the preset second transaction amount threshold is the same as that of the first transaction amount threshold; the embodiment of the present invention determines whether the abnormal merchant has any transaction behavior with a transaction amount greater than the transaction amount threshold from all transaction records of the acquired abnormal merchant samples.

[0098] S330: Extract transaction users from all second target transaction records to determine a second candidate abnormal user group.

[0099] Similarly, in this embodiment of the present invention, abnormal users in the second candidate abnormal user group can be further specifically users who have conducted large-value transactions with abnormal merchants, where large-value transactions are transactions in which the transaction amount determined in step S320 is greater than the second transaction amount threshold. Users who have conducted large-value transactions with abnormal merchants are obtained to construct a candidate abnormal user group, i.e., the second candidate abnormal user group, and the users in the candidate abnormal user group are labeled.

[0100] Exemplarily, the first transaction amount threshold preset in the embodiment of the present invention is 150,000 yuan. Based on the abnormal merchant determined from the historical data, the historical transaction records of the abnormal merchant in the past six months are obtained, and the historical transaction records are screened according to the transaction amount to extract transaction records with a transaction amount greater than 150,000 yuan. From the transaction records with a transaction amount greater than 150,000 yuan, users who have conducted transactions with the abnormal merchant are determined, and such users are clustered to obtain a second candidate abnormal user group, and the candidate abnormal users are labeled.

[0101] In some embodiments, step S310, based on a preset abnormal merchant sample, obtains transaction records of the abnormal merchant sample; may include steps S311-S312:

[0102] S311. In response to a commercial refund during a mobile payment process, generate a transaction record acquisition instruction;

[0103] Specifically, the abnormal transaction behavior of abnormal merchants also has the characteristic of a cash withdrawal period. In the process of obtaining the transaction records of abnormal merchant samples, the embodiment of the present invention mainly constitutes the transaction records of abnormal merchant samples preset in step S300 based on the refund behavior in the transaction records. Among them, the cash withdrawal period is after the abnormal transaction ends, the abnormal merchant refunds the order of the previous large transaction with itself, realizing the behavior of fast in and out of funds. Figure 9 As shown, the embodiment of the present invention first filters the stored historical transaction data to identify transaction records from merchants marked as abnormal and with commercial refunds. If such transaction records are successfully identified, a transaction record acquisition instruction is generated to trigger subsequent acquisition actions. If necessary, thresholds can be set for the number and amount of commercial refunds to form more specific screening rules, thereby making the screening process more rigorous and the generated transaction record acquisition instructions more accurate.

[0104] S312. Obtain transaction records of a preset abnormal merchant sample according to the transaction record acquisition instruction;

[0105] Specifically, in response to the transaction record acquisition instruction generated in step S0311, the transaction records of the preset abnormal merchant sample are acquired; if necessary, they can be classified according to different data attributes for easy distinction and calling.

[0106] Exemplarily, the screening rule for abnormal merchant samples preset in the embodiment of the present invention is that there are two or more records of commercial refund behaviors in the transaction records, and the single refund amount is not less than 100,000 yuan. First, the transaction data in which both parties of the transaction are marked as abnormal merchants are preliminarily screened from the historical transaction data, and then the commercial refund behaviors that meet the preset rules are screened from the data obtained from the preliminary screening. According to the screened commercial refund behaviors, the transaction records are traced back, and finally a sample set is constructed based on the obtained transaction records. For example, there are two records of commercial refund behaviors in the transaction records of abnormal merchant A, one of which is for a refund amount of 50,000 yuan and the other for a refund amount of 200,000 yuan; and there are also two records of commercial refund behaviors in the transaction records of abnormal merchant B, and both refund amounts are 150,000 yuan. In the process of screening the transaction records, the embodiment of the present invention will filter out the transaction records of abnormal merchant A, and retain the transaction records of abnormal merchant B, and classify the retained transaction records according to the merchant name to obtain an abnormal merchant sample set.

[0107] Reference Figure 10 , is a flow chart of determining a second candidate abnormal user group according to an embodiment of the present invention; in some embodiments, step S330, extracting transaction users from all second target transaction records, and determining the second candidate abnormal user group may include steps S331-S333:

[0108] S331. Extracting transaction users from all second target transaction records;

[0109] Specifically, in step S320, based on the preset second transaction amount threshold, the transaction users in the second target transaction record are extracted, for example, individual user A, individual user B, etc. If necessary, a cluster of transaction users can be constructed based on the transaction users.

[0110] S332. Obtain user information of the transaction user;

[0111] Among them, user information includes a variety of basic information and characteristic information of the user; specifically in an embodiment of the present invention, user information includes historical variables and static text variables; static text variables include the user registration place information and real-name authentication information of the transaction user; historical variables include the transaction amount and transaction time of the transaction user in the abnormal merchant sample.

[0112] Specifically, the embodiment of the present invention extracts the user information of the transaction user based on the name or identity identifier such as ID (Identity document) of the transaction user.

[0113] S333: performing unsupervised cluster analysis on the user information of the transaction users to determine a second candidate abnormal user group and a non-candidate abnormal user group among the transaction users;

[0114] Among them, the process of unsupervised cluster analysis is the process of using an unsupervised clustering algorithm model to realize user binary classification. The only historical variables in the user information, such as transaction amount and transaction time, and the only static text variables, such as the user's real-name information and registration place information, are used as the input of the unsupervised clustering algorithm model, and the final output is the prediction result, that is, the user is a candidate abnormal user or a non-candidate abnormal user, and then the users are clustered to obtain candidate abnormal user groups and non-candidate abnormal user groups.

[0115] In an embodiment of the present invention, the unsupervised clustering algorithm model constructs a multidimensional space using several attribute features contained in the input historical variables and static text variables. For example, if the historical variables and static text variables contain a total of four feature variables, namely, the transaction amount, transaction time real-name information, and registration location information, a four-dimensional space is constructed. Each specific feature value is a scattered point in the space, and a judgment boundary is determined in the four-dimensional space. The two different subspaces obtained by dividing the boundary are the two different groups obtained by the division, namely, the candidate abnormal user group and the non-candidate abnormal user group. It should be understood that if the space is a two-dimensional space, that is, a plane, the determined judgment boundary can be a point or a straight line.

[0116] For example, this embodiment of the present invention employs an unsupervised K-means algorithm as an unsupervised clustering algorithm. The K-means clustering algorithm is an iterative clustering analysis algorithm. First, two dimensional feature variables are extracted from user information: one representing the transaction amount and the other representing the user's registered location. These extracted feature variables are used as input to construct a two-dimensional feature plane, with the transaction amount as the horizontal axis and the user's registered location as the vertical axis. Each piece of user information is represented as a scattered point within this feature plane. Next, two points are randomly selected from the feature plane as centroids (i.e., K in K-means is set to 2). The Euclidean distance from each sample to the centroid is then calculated. The user information scattered points in the feature plane are then assigned the centroid with the smallest distance as a cluster for that user information. The user information scattered points are then divided into two clusters. Within each cluster, the center of the scattered point is determined and used as the centroid. The Euclidean distance between each scattered point and the new centroid is calculated, and the two clusters are reconstructed. During this process, a loss function is defined that represents the sum of the squares of the distances from each scattered point to its centroid. The process of determining the centroid and dividing the scattered points into clusters is repeated until the algorithm converges, i.e., the loss function reaches a minimum, resulting in the optimal classification result. Furthermore, since the loss function is non-convex, the K-means algorithm may not reach a global minimum, but instead converge to a local minimum. Therefore, the initial centroid can be randomly selected multiple times, and the results can be compared to select the cluster and centroid that minimizes the loss function. Ultimately, the candidate and non-candidate abnormal user groups are determined.

[0117] Reference Figure 11 , is a flow chart of determining a target abnormal user according to an embodiment of the present invention; in some embodiments, step S400, based on the intersection of the first candidate abnormal user group and the second candidate abnormal user group, determines the target abnormal user, which can directly determine the users in the intersection of the first candidate abnormal user group and the second candidate abnormal user group as the target abnormal user; alternatively, step S400 may include detailed steps S410-S440:

[0118] S410, obtaining abnormal user account information of candidate abnormal users in the first candidate abnormal user group and the second candidate abnormal user group;

[0119] Specifically, a candidate abnormal user is determined from the first candidate abnormal user group obtained in step S200 and the second candidate abnormal user group obtained in step S300, and the account information of the candidate abnormal user is further extracted.

[0120] S420: Obtaining the account information of the abnormal merchant that has transaction records with the candidate abnormal user;

[0121] Specifically, the transaction records in the account information of the candidate abnormal user are sorted and screened. The screening rule is that the other party of the transaction belongs to the abnormal merchant or the candidate merchant. Then, the transaction records of the abnormal account and the abnormal merchant or the candidate merchant are screened and the account information of the abnormal merchant or the candidate merchant of the transaction is determined.

[0122] S430: Obtain transaction records between candidate abnormal users and abnormal merchants, and determine clustering weights based on the transaction records;

[0123] Among them, the clustering weight is the weight assigned to the transaction record between the abnormal account and the abnormal merchant or candidate merchant. It is the coefficient for determining that the user is an abnormal user based on the transaction record. The weight can also be used to cluster the transaction records. The weight value can be determined based on the transaction amount and number of transactions in the transaction record. It should be understood that the clustering weight can be calculated through a function expression or divided according to a set threshold.

[0124] Specifically, based on the transaction records obtained in step S420 for transactions between the abnormal account and the abnormal merchant or candidate merchant, the transaction amount and number of transactions are extracted from the transaction records. For example, for the account information of abnormal user C, it is found that there are two large transactions between the abnormal user C and abnormal merchant D, one for 100,000 yuan and the other for 200,000 yuan.

[0125] S440 : Identify a target abnormal user from the first candidate abnormal user group and the second candidate abnormal user group according to the candidate abnormal user account information, the abnormal merchant account information, and the clustering weight.

[0126] Specifically, the embodiment of the present invention obtains the abnormal user account information according to step S410, and after determining the candidate abnormal user account information in the transaction record and the abnormal merchant account information or the candidate merchant account information, it can determine whether the candidate abnormal user is the target abnormal user based on the clustering weight of the transaction records between the candidate abnormal user and the abnormal merchant or the candidate merchant. This embodiment calculates the clustering weight of the transaction records between a single candidate abnormal user and the black market merchant based on the transaction amount and number of transactions, and then determines the target abnormal user. The method is highly robust and the recognition result is more accurate.

[0127] For example, in an embodiment of the present invention, the first candidate abnormal user group and the second candidate abnormal user group both include candidate abnormal user C. Screening of their transaction records reveals five transactions with abnormal merchant D totaling 500,000 yuan. The clustering weight division rule for this embodiment of the present invention is: if the transaction amount is greater than 200,000 yuan and the number of transactions is less than 10, the clustering weight is 3; if the transaction amount is less than 200,000 yuan but the number of transactions is less than 10, the clustering weight is 2; and if the transaction amount is less than 200,000 yuan and the number of transactions is less than 10, the clustering weight is set to 1. Based on this clustering weight division rule, the clustering weight of candidate abnormal user C and abnormal merchant D is 3, meaning that candidate abnormal user C is highly likely to be the target abnormal user.

[0128] In some embodiments, in the above step S430, the transaction records between the candidate abnormal user and the abnormal merchant include the transaction amount and transaction number of the candidate abnormal user, and step S430, determining the clustering weight based on the transaction records, may include one of the more detailed steps S431-S433:

[0129] S431: When the transaction amount is greater than or equal to the third transaction amount threshold, and the number of transactions is greater than or equal to the first transaction number threshold, use the preset first weight value as the clustering weight;

[0130] The third transaction amount threshold is a threshold for segmenting transaction amounts in transaction records and can be set based on specific needs. The first transaction count threshold is a threshold for segmenting transaction counts in transaction records. The first weight value is a weight assigned to the association between the candidate abnormal user and the abnormal merchant, and its specific value can also be set based on specific needs. In this embodiment of the present invention, when it is determined that the transaction amount is not less than the third transaction amount threshold and the transaction count is not less than the first transaction count threshold, a pre-set weight value is assigned as a clustering weight to the association between the candidate abnormal user and the abnormal merchant.

[0131] S432: When the transaction amount is greater than or equal to the fourth transaction amount threshold and less than the third transaction amount threshold, and the number of transactions is greater than or equal to the second transaction number threshold and less than the first transaction number threshold, use the preset second weight value as the clustering weight;

[0132] Similarly, the fourth transaction amount threshold is also a threshold for transaction amount segmentation, and the second weight value is also a weight assigned to the association relationship between the candidate abnormal user and the abnormal merchant. It should be noted that the third transaction amount threshold should be greater than the fourth transaction amount threshold, and the first transaction count threshold should be greater than the second transaction count threshold. In this embodiment of the present invention, when it is determined that the transaction amount is less than the third transaction amount threshold but not less than the fourth transaction amount threshold, and the transaction count is less than the first transaction count threshold but not less than the second transaction count threshold, another pre-set weight value is assigned as the clustering weight to the association relationship between the candidate abnormal user and the abnormal merchant.

[0133] S433: When the transaction amount is less than the fourth transaction amount threshold and the number of transactions is less than the second transaction number threshold, use the preset third weight value as the clustering weight;

[0134] Similarly, when it is determined that the transaction amount is less than the fourth transaction amount threshold and the number of transactions is less than the second transaction number threshold, the embodiment of the present invention assigns a preset third weight value as a clustering weight to the association relationship between the candidate abnormal user and the abnormal merchant.

[0135] For example, in the process of determining the clustering weight of the association relationship between candidate abnormal users and abnormal merchants, the embodiment of the present invention assigns the clustering weight as follows: if the transaction amount between the abnormal merchant and the candidate abnormal user is not less than 50,000 yuan, and the number of transactions is not less than 20, then the clustering weight is assigned as 1; if the transaction amount between the abnormal merchant and the candidate abnormal user is less than 50,000 yuan but not less than 30,000 yuan, and the number of transactions is less than 20 and not less than 10, then the clustering weight is assigned as 2; if the transaction amount between the abnormal merchant and the candidate abnormal user is less than 30,000 yuan, and the number of transactions is less than 10, then the clustering weight is assigned as 3. Among them, 50,000 yuan is the third transaction amount threshold, 30,000 yuan is the fourth transaction amount threshold, and 20 and 10 correspond to the first transaction number threshold and the second transaction number threshold, respectively. If there are 26 transactions between the input abnormal merchant E and the candidate abnormal user F, and the transaction amount reaches 320,000 yuan, then according to the clustering weight assignment rule, the clustering weight of abnormal merchant E and candidate abnormal user F should be 1. It can be understood that, in the embodiment of the present invention, the smaller the clustering weight value is, the higher the possibility that the candidate abnormal user associated with the abnormal merchant is the target abnormal user.

[0136] Reference Figure 12 , is a flow chart of another method for identifying target abnormal users according to an embodiment of the present invention; in some embodiments, step S440, identifying the target abnormal user from the first candidate abnormal user group and the second candidate abnormal user group based on the abnormal user account information, the abnormal merchant account information, and the clustering weight, may include steps S441-S443:

[0137] S441, inputting the abnormal user account information, abnormal merchant account information, and clustering weights of the candidate abnormal user into a preset fast community partitioning model to generate multiple community networks;

[0138] Among them, the rapid community segmentation model outputs a node relationship network based on the input node information. It can be understood that in the embodiment of the present invention, the input node information is the transaction record between the abnormal merchant and the candidate abnormal user, which includes account information, merchant account information and clustering weight; in the relationship network output by the model, the more closely connected part can be regarded as a community, in which the nodes inside it have relatively close connections, while the connection between the two communities is relatively sparse, that is, a community network.

[0139] S442: When the number of abnormal merchants in any community network is greater than or equal to the merchant number threshold, or the proportion of abnormal merchants is greater than or equal to the merchant number proportion threshold, or both, the community network is determined to be a target community;

[0140] The abnormal merchant ratio can be the ratio of the number of abnormal merchants to the total number of merchants in the community network, or the ratio of the number of abnormal merchants to the number of normal merchants. Furthermore, the merchant number threshold is another factor in addition to the abnormal merchant ratio. When the number of abnormal merchants in the community network is not less than the threshold, or the abnormal merchant ratio is not less than one or both of the merchant ratio thresholds, the community network is identified as a target community. It should be understood that only one of the three conditions provided in step S442 needs to be satisfied.

[0141] S443. Determine abnormal users in the target community as target abnormal users;

[0142] Specifically, the nodes that fall into the target community after being output by the fast community segmentation model are determined as target abnormal users.

[0143] Exemplarily, the fast community division process of the embodiment of the present invention adopts the Fast Unfolding community algorithm. It should be supplemented that the goal of community division is to make the connection within the divided community closer, while the connection between communities is sparse. The modularity can be used to characterize the quality of such division. The greater the modularity, the better the effect of community division. Therefore, modularity becomes an important criterion for measuring the quality of community division. The greater the modularity value of the network after division, the better the effect of community division. The Fast Unfolding algorithm is an algorithm for community division based on modularity. The Fast Unfolding algorithm is an iterative algorithm whose main goal is to continuously divide the community so that the modularity of the entire network after division continues to increase.

[0144] The Fast Unfolding algorithm mainly consists of two stages. The first stage is Modularity Optimization, which divides each node into the community of its adjacent nodes so that the modularity value continues to increase. The second stage is Community Aggregation, which aggregates the communities obtained in the first stage into a point, that is, reconstructs the network based on the generated community structure. The above two stages are repeated until the structure in the network no longer changes. Specifically, if Figure 13 As shown, based on the first candidate abnormal user group and the second candidate abnormal user, their intersection 1301 is obtained. The users of the intersection are all candidate abnormal users. The nodes of the abnormal merchants are initialized according to the account information, merchant account information and clustering weight of the candidate abnormal users, and the nodes of the abnormal merchants are divided into different communities. For each abnormal merchant node, each node is tried to be divided into the community where its adjacent points are located, and the modularity at this time is calculated. It is determined whether the difference in modularity before and after the division is a positive number. If it is a positive number, the current division is accepted. If it is not a positive number, the current division is abandoned. The division process is repeated until the modularity can no longer be increased. The abnormal user community 1302 is finally obtained. The users in this community are the target abnormal users determined by the embodiment of the present invention. For example, if candidate abnormal user C and candidate abnormal user F are both divided into the abnormal user community, it can be determined that candidate abnormal user C and candidate abnormal user F are the target abnormal users. Compared with traditional recognition methods, the Fast Unfolding community algorithm has higher recognition accuracy and efficiency, and can avoid the interference of noise data in the sample, and has higher robustness.

[0145] In some embodiments, the method for identifying target abnormal users may further include steps S500-S600:

[0146] S500: Update the model parameters of the abnormal merchant identification model according to the transaction instruction;

[0147] Specifically, the embodiment of the present invention can make corrections based on the identification results of abnormal merchants, and then update the abnormal merchant identification model parameters based on the corrected results to achieve real-time updating of the abnormal merchant identification model.

[0148] S600: Adjust the abnormal merchant identification model according to the updated model parameters.

[0149] Specifically, the abnormal merchant identification model is dynamically adjusted according to the updated model parameters, and the accuracy of the prediction is guaranteed during the entire abnormal anti-mutation process through real-time updating of the abnormal merchant identification model.

[0150] To sum up, the abnormal user identification method of the embodiment of the present invention extracts a first candidate abnormal user group based on the transaction records of the candidate merchants, and also extracts a second candidate abnormal user group based on the transaction records of the preset abnormal merchant samples, and finally identifies the target abnormal user through transaction characteristics, thereby improving the accuracy of abnormal user identification; in addition, the embodiment of the present invention takes into account the real-time transaction records of the candidate merchants in the process of identifying the target abnormal user. Compared with the prior art that performs abnormality identification through static clues such as merchant complaints and the association of black business licenses, the present invention improves the real-time performance of target abnormal user identification, and helps to effectively suppress abnormal transactions.

[0151] Reference Figure 14 , is a flow chart of an abnormal user processing method according to an embodiment of the present invention. In addition to the abnormal user identification method, the embodiment of the present invention further provides an abnormal user processing method, which includes steps T100-T300:

[0152] T100, apply abnormal user identification method to identify target abnormal users;

[0153] Specifically, according to the abnormal user identification method provided in the embodiment of the present invention, a target abnormal user is identified, and the identification process of the target abnormal user can be as follows: Figure 4 The method shown is implemented.

[0154] T200: Determine the operation scenario of the target abnormal user based on the target abnormal user's account information;

[0155] The operation scenarios include, but are not limited to, commercial payment scenarios, commercial withdrawal scenarios, and commercial refund scenarios. Specifically, embodiments of the present invention obtain the target abnormal user's account information and monitor the transaction behavior of the account information to determine the abnormal user's operation scenario; for example, if abnormal account G is determined to be in the process of a 130,000 yuan refund operation, it is further determined that abnormal account G is in a commercial refund scenario.

[0156] T300, handle target abnormal users in the operation scenario;

[0157] The processing includes fund truncation, fund freezing and fund recovery. For example, abnormal account G is performing a refund operation of 130,000 yuan in a commercial refund scenario. The funds for the refund operation will be truncation and the commercial refund will be frozen.

[0158] Reference Figure 15 , combined with the above abnormal user identification method, the implementation process of the abnormal user processing method of the embodiment of the present invention is described in detail:

[0159] First, candidate abnormal account C is identified during the scenario preparation period. In the offline state, it is marked as candidate abnormal user a, and each intersection is marked in real time.

[0160] Secondly, the fund withdrawal period is to use the black merchant samples in the manual review system, and calculate all candidate abnormal C accounts yesterday based on the time delay of days + 1; it should be noted that, in the embodiment of the present invention, the minimum time unit is day. For example, the abnormal C account used to determine on January 25, 2020 is the abnormal C account determined based on the time on January 24, 2020 and before.

[0161] Then, the calculated candidate anomaly a is intersected with the candidate anomaly b and marked as candidate anomaly c. The candidate anomaly C accounts are collected and, at a fixed time every day, such as 8 p.m., the collected candidate anomaly c are put into the community algorithm to determine the optimal community and the optimal anomaly C account.

[0162] Finally, the optimal abnormal C account is marked and uploaded to an online platform, such as an online account information system. The online processing system will perform scenario recognition based on the marked transaction behavior, such as commercial payment, refund and other scenarios. The online processing system performs processing based on the identified scenario; for example, abnormal C account interception, etc. The embodiment of the present invention greatly improves the processing capacity of abnormal merchants, can automatically process abnormal merchants with high precision, intercept abnormal fund withdrawal behavior, and optimize the barriers to malicious behavior of the entire mobile payment system; in addition, the three algorithms involved in the embodiment of the present invention can be personalized according to the abnormal behavior characteristics of each mobile payment product. Different models may bring differences in effects, and the model is a more important optimization point to improve the overall processing accuracy. In the process of abnormal user identification, due to the setting of the triple screening mechanism, the tolerance for the identification model is greatly improved, with better identification effect.

[0163] Reference Figure 16 , is a schematic diagram of the structure of an abnormal user identification device provided by an embodiment of the present invention, such as Figure 16 As shown, the device includes:

[0164] The determination module 1601 is used to input the acquired transaction information of the merchant to be identified into a preset abnormal merchant identification model to determine the candidate merchant;

[0165] A first extraction module 1602 is configured to obtain transaction records of candidate merchants and extract a first candidate abnormal user group; wherein the candidate abnormal users in the first candidate abnormal user group have transaction records with the candidate merchants;

[0166] The second extraction module 1603 is used to obtain transaction records of a preset abnormal merchant sample and extract a second candidate abnormal user group; wherein the candidate abnormal users in the second candidate abnormal user group have transaction records with the abnormal merchant sample;

[0167] The identification module 1604 is configured to obtain the intersection of the first candidate abnormal user group and the second candidate abnormal user group, and determine the target abnormal user.

[0168] To sum up, the abnormal user identification device provided by the embodiment of the present invention takes into account the real-time transaction records of candidate merchants in the process of identifying target abnormal users. Compared with the existing technology that uses static clues such as merchant complaints and associations with black business licenses to identify anomalies, the present invention improves the real-time performance of target abnormal user identification and helps to effectively suppress anomalies.

[0169] Reference Figure 17 , is a structural diagram of an abnormal user processing device provided by an embodiment of the present invention, such as Figure 17 As shown, the device includes:

[0170] Identification module 1701, used to identify target abnormal users using abnormal user identification device;

[0171] A scenario confirmation module 1702 is configured to determine an operation scenario of the target abnormal user based on the target abnormal user's account information, where the operation scenario includes at least one of a commercial payment scenario, a commercial withdrawal scenario, or a commercial refund scenario;

[0172] The strike module 1703 is used to perform at least one of fund interception, fund freezing, or fund recovery processing on the target abnormal user in the operation scenario.

[0173] Specifically, the device significantly improves the processing capacity of abnormal merchants, can automatically process abnormal merchants with high precision, intercept abnormal fund withdrawal behaviors, and optimize the barriers to malicious behavior in the entire mobile payment system.

[0174] An embodiment of the present invention further provides an electronic device, the device including a processor and a memory;

[0175] The memory stores a program;

[0176] The processor executes the program to perform Figure 2 The method for identifying and handling abnormal users of the terminal device 202 is shown.

[0177] The electronic device has the function of carrying and running the software platform for abnormal user identification and abnormality processing provided by the embodiment of the present invention, such as a personal computer (PC), a mobile phone, a smart phone, a personal digital assistant (PDA), a wearable device, a handheld computer PPC (Pocket PC), a tablet computer, etc. Figure 18 In the embodiment of the present invention, the terminal device is a mobile phone as an example:

[0178] Figure 18 FIG2 is a block diagram showing a partial structure of a mobile phone related to a terminal device provided by an embodiment of the present invention. Figure 18 The mobile phone includes components such as a radio frequency (RF) circuit 1810, a memory 1820, an input unit 1830, a display unit 1840, a sensor 1850, an audio circuit 1860, a wireless fidelity (WiFi) module 1870, a processor 1880, and a power supply 1890. It will be understood by those skilled in the art that Figure 17 The mobile phone structure shown in the figure does not constitute a limitation to the mobile phone, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0179] In this embodiment of the present invention, the processor 1890 included in the terminal device has the following functions:

[0180] Input the acquired transaction information of the merchant to be identified into the preset abnormal merchant identification model to determine the candidate merchant;

[0181] Obtaining transaction records of candidate merchants and extracting a first candidate abnormal user group; transaction records exist between candidate abnormal users in the first candidate abnormal user group and candidate merchants;

[0182] Obtaining transaction records of a preset abnormal merchant sample and extracting a second candidate abnormal user group; the candidate abnormal users in the second candidate abnormal user group have transaction records with the abnormal merchant sample;

[0183] Obtain the intersection of the first candidate abnormal user group and the second candidate abnormal user group to determine the target abnormal user.

[0184] The embodiment of the present invention also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs Figure 4The method shown.

[0185] An embodiment of the present invention further provides a computer-readable storage medium storing a program, which is executed by a processor to implement the method for identifying and processing abnormal users as described in the aforementioned embodiments.

[0186] In some optional embodiments, the function / operation mentioned in the block diagram may not occur in the order mentioned in the operation diagram. For example, depending on the function / operation involved, the two boxes shown in succession can actually be executed substantially simultaneously or the boxes can sometimes be executed in reverse order. In addition, the embodiment presented and described in the flow chart of the present invention is provided in an exemplary manner for the purpose of providing a more comprehensive understanding of the technology. The disclosed method is not limited to the operation and logic flow presented herein. Optional embodiments are contemplated in which the order of the various operations is changed and the sub-operations described as a part of a larger operation are performed independently.

[0187] Furthermore, although the present invention is described in the context of functional modules, it should be understood that, unless otherwise indicated, one or more of the functions and / or features described may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in separate physical devices or software modules. It will also be understood that a detailed discussion of the actual implementation of each module is not necessary for understanding the present invention. More specifically, given the properties, functions, and internal relationships of the various functional modules in the devices disclosed herein, the actual implementation of the module will be understood within the ordinary skill of an engineer. Therefore, a person skilled in the art using ordinary skill will be able to implement the present invention set forth in the claims without undue experimentation. It will also be understood that the specific concepts disclosed are merely illustrative and are not intended to limit the scope of the present invention, which is determined by the full scope of the appended claims and their equivalents.

[0188] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0189] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0190] More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or more wires (electronic devices), a portable computer disk cartridge (magnetic devices), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0191] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0192] Throughout this specification, reference to terms such as "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" means that a specific feature, structure, material, or characteristic described in conjunction with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0193] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to the embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the claims and their equivalents.

[0194] The above is a specific description of the preferred implementation of the present invention, but the present invention is not limited to the embodiments. Those skilled in the art can make various equivalent modifications or substitutions without violating the spirit of the present invention. These equivalent modifications or substitutions are all included in the scope defined by the claims of this application.

Claims

1. A method for identifying abnormal users, characterized in that: include: Input the acquired transaction information of the merchant to be identified into the preset abnormal merchant identification model to determine the candidate merchant; Obtaining transaction records of the candidate merchant, and extracting a first candidate abnormal user group based on the transaction records of the candidate merchant; There is a transaction record between the candidate abnormal users in the first candidate abnormal user group and the candidate merchant; Obtaining transaction records of a preset abnormal merchant sample, and extracting a second candidate abnormal user group based on the transaction records of the abnormal merchant sample; There are transaction records between the candidate abnormal users in the second candidate abnormal user group and the abnormal merchant samples, and the abnormal merchant samples are merchants determined based on transaction records marked with abnormal merchant participation extracted from historical transaction data; A target abnormal user is determined according to the intersection of the first candidate abnormal user group and the second candidate abnormal user group.

2. The abnormal user identification method according to claim 1, characterized in that: The step of inputting the acquired transaction information of the merchant to be identified into a preset abnormal merchant identification model to determine candidate merchants includes: generating a transaction instruction in response to a commercial payment behavior of the merchant to be identified during the mobile payment process; According to the transaction instruction, obtaining the historical variables and static text variables of the merchant to be identified; generating a feature combination according to the transaction instruction, the historical variable, and the static text variable; Inputting the feature combination into the preset abnormal merchant identification model, predicting the merchants to be identified, and determining candidate merchants among the merchants to be identified; The historical variables include the historical transaction amount and the historical transaction times of the merchant to be identified; and the static text variables include the name of the merchant to be identified and the transaction notes.

3. The abnormal user identification method according to claim 1, characterized in that: The acquiring the transaction records of the candidate merchant and extracting the first candidate abnormal user group according to the transaction records of the candidate merchant includes: Obtaining transaction records of the candidate merchant; According to a preset first transaction amount threshold, determining a first target transaction record in the transaction record of the candidate merchant whose transaction amount is greater than the first transaction amount threshold; Transaction users in all the first target transaction records are extracted to determine a first candidate abnormal user group.

4. The abnormal user identification method according to claim 1, characterized in that: The acquiring of transaction records of a preset abnormal merchant sample and extracting a second candidate abnormal user group based on the transaction records of the abnormal merchant sample includes: According to a preset abnormal merchant sample, obtaining transaction records of the abnormal merchant sample; According to a preset second transaction amount threshold, determining a second target transaction record in the transaction record of the abnormal merchant sample whose transaction amount is greater than the second transaction amount threshold; Extract all transaction users in the second target transaction records to determine a second candidate abnormal user group.

5. The abnormal user identification method according to claim 4, characterized in that: The step of obtaining transaction records of the abnormal merchant samples according to the preset abnormal merchant samples includes: In response to a commercial refund during a mobile payment process, generating a transaction record acquisition instruction; The transaction records of a preset abnormal merchant sample are obtained according to the transaction record acquisition instruction.

6. The abnormal user identification method according to claim 4, characterized in that: The extracting transaction users from all the second target transaction records to determine a second candidate abnormal user group includes: Extracting all transaction users in the second target transaction records; Obtaining user information of the transaction user; wherein the user information includes historical variables and static text variables; the static text variables include the user registration location information and real-name authentication information of the transaction user; the historical variables include the transaction amount and transaction time of the transaction user in the abnormal merchant sample; An unsupervised cluster analysis is performed on the user information of the transaction users to determine a second candidate abnormal user group and a non-candidate abnormal user group among the transaction users.

7. The abnormal user identification method according to claim 1, characterized in that: Determining a target abnormal user according to the intersection of the first candidate abnormal user group and the second candidate abnormal user group includes one of the following: Determine the intersection of the first candidate abnormal user group and the second candidate abnormal user group as the target abnormal user; or, According to the intersection of the first candidate abnormal user group and the second candidate abnormal user group, obtaining abnormal user account information of the candidate abnormal users in the intersection; Obtaining the account information of abnormal merchants that have transaction records with the candidate abnormal user; Obtaining transaction records between the candidate abnormal user and the abnormal merchant, and determining clustering weights based on the transaction records; A target abnormal user is identified from the first candidate abnormal user group and the second candidate abnormal user group according to the abnormal user account information, the abnormal merchant account information, and the clustering weight.

8. The abnormal user identification method according to claim 7, characterized in that: The transaction records between the candidate abnormal user and the abnormal merchant include the transaction amount and the number of transactions of the candidate abnormal user. The determining of the clustering weight according to the transaction records includes one of the following: When the transaction amount is greater than or equal to a third transaction amount threshold, and the number of transactions is greater than or equal to a first transaction number threshold, a preset first weight value is used as the clustering weight; or, When the transaction amount is greater than or equal to the fourth transaction amount threshold and less than the third transaction amount threshold, and the number of transactions is greater than or equal to the second transaction number threshold and less than the first transaction number threshold, a preset second weight value is used as the clustering weight; or, When the transaction amount is less than the fourth transaction amount threshold and the number of transactions is less than the second transaction number threshold, a preset third weight value is used as the clustering weight; The third transaction amount threshold is greater than the fourth transaction amount threshold, and the first transaction number threshold is greater than the second transaction number threshold.

9. The abnormal user identification method according to claim 7, characterized in that: The identifying a target abnormal user from the first candidate abnormal user group and the second candidate abnormal user group according to the abnormal user account information, the abnormal merchant account information, and the clustering weight includes: Inputting the abnormal user account information, abnormal merchant account information and clustering weight of the candidate abnormal user into a preset fast community partitioning model to generate multiple community networks; When the number of abnormal merchants in any of the community networks is greater than or equal to the merchant number threshold, or the proportion of the abnormal merchants is greater than or equal to the merchant number proportion threshold, or both of them are met, the community network is determined to be a target community; Abnormal users in the target community are determined as target abnormal users.

10. The abnormal user identification method according to claim 2, characterized in that: The method further comprises: updating the model parameters of the abnormal merchant identification model according to the transaction instruction; The abnormal merchant identification model is adjusted according to the updated model parameters.

11. A method for handling abnormal users, characterized in that: include: Applying the abnormal user identification method according to any one of claims 1 to 10 to identify a target abnormal user; Determining an operation scenario of the target abnormal user based on the account information of the target abnormal user, where the operation scenario includes at least one of a commercial payment scenario, a commercial withdrawal scenario, or a commercial refund scenario; The target abnormal user is processed in the operation scenario, and the processing includes at least one of fund truncation processing, fund freezing processing or fund recovery processing.

12. An abnormal user identification device, characterized in that: include: A determination module is used to input the acquired transaction information of the merchant to be identified into a preset abnormal merchant identification model to determine the candidate merchant; a first extraction module, configured to obtain transaction records of the candidate merchant and extract a first candidate abnormal user group based on the transaction records of the candidate merchant; There is a transaction record between the candidate abnormal users in the first candidate abnormal user group and the candidate merchant; A second extraction module is used to obtain transaction records of a preset abnormal merchant sample and extract a second candidate abnormal user group based on the transaction records of the abnormal merchant sample; There are transaction records between the candidate abnormal users in the second candidate abnormal user group and the abnormal merchant samples, and the abnormal merchant samples are merchants determined based on transaction records marked with abnormal merchant participation extracted from historical transaction data; An identification module is configured to determine a target abnormal user based on an intersection of the first candidate abnormal user group and the second candidate abnormal user group.

13. An abnormal user processing device, characterized in that: include: an identification module, configured to identify a target abnormal user by applying the abnormal user identification device according to claim 12; A scenario confirmation module is used to determine the operation scenario of the target abnormal user based on the account information of the target abnormal user, where the operation scenario includes at least one of a commercial payment scenario, a commercial withdrawal scenario, or a commercial refund scenario; A processing module is used to process the target abnormal user in the operation scenario, and the processing includes at least one of fund truncation processing, fund freezing processing or fund recovery processing.

14. An electronic device, characterized in that: including a processor and a memory; The memory is used to store programs; The processor executes the program to implement the method according to any one of claims 1 to 11.

15. A computer-readable storage medium, characterized in that The storage medium stores a program, and the program is executed by a processor to implement the method according to any one of claims 1 to 11.

Images