Abnormal account detection method and device, computer device and storage medium

Abstract

The application relates to an abnormal account detection method and device and computer equipment. The method comprises the following steps: acquiring a resource transfer relationship graph corresponding to a target account, wherein the resource transfer relationship graph is established through resource transfer relationships between the target account and each associated account; acquiring each historical resource transfer data corresponding to each associated account based on the resource transfer relationship graph and performing feature extraction to obtain resource transfer feature information corresponding to each associated account; performing attention calculation based on the resource transfer feature information to obtain the attention weight of each associated account, performing feature fusion based on the resource transfer feature information and the attention weight to obtain target resource transfer feature information corresponding to the target account; acquiring account feature information corresponding to the target account, performing abnormal account detection based on the account feature information and the target resource transfer feature information to obtain the abnormal possibility of the target account. The method can improve the accuracy of abnormal account detection.

Description

Technical Field

[0001] This application relates to the field of Internet technology, and in particular to an abnormal account detection method, apparatus, computer equipment, storage medium, and computer program product. Background Technology

[0002] With the development of internet technology, online platforms can support services such as resource transfer, including financial resource transfers (e.g., inter-account transfers) and information resource transfers (e.g., email and chat services in communication applications). In internet platforms that facilitate resource transfers, anomalies in account transfer data can lead to errors and confusion, causing security issues for both the transfer and the account. Examples of abnormal transfer data include account identifiers, transfer amounts, identifiers of accounts sending spam, and identifiers of accounts sending harassing messages. Therefore, when an account conducts resource transfer transactions, it is necessary to perform anomaly detection to determine if the account is abnormal.

[0003] Existing methods for detecting abnormal accounts use preset rules to determine whether an account is abnormal based on its resource transfer data. However, these methods are not accurate enough to detect abnormal accounts, resulting in low accuracy. Summary of the Invention

[0004] Therefore, it is necessary to provide an abnormal account detection method, apparatus, computer equipment, computer-readable storage medium, and computer program product that can improve the accuracy of abnormal account detection in response to the above-mentioned technical problems.

[0005] Firstly, this application provides a method for detecting abnormal accounts. The method includes:

[0006] Obtain the resource transfer relationship graph corresponding to the target account. The resource transfer relationship graph is established through the resource transfer relationships between the target account and various related accounts.

[0007] Based on the resource transfer relationship graph, obtain the historical resource transfer data corresponding to each associated account, and extract features based on the historical resource transfer data to obtain the resource transfer feature information corresponding to each associated account.

[0008] Attention is calculated based on resource transfer feature information to obtain the attention weights corresponding to each associated account. Feature fusion is then performed based on the resource transfer feature information and the attention weights to obtain the target resource transfer feature information corresponding to the target account.

[0009] Obtain the account feature information corresponding to the target account, and perform abnormal account detection based on the account feature information and the target resource transfer feature information to obtain the probability of abnormality corresponding to the target account.

[0010] Secondly, this application also provides an abnormal account detection device. The device includes:

[0011] The acquisition module is used to acquire the resource transfer relationship graph corresponding to the target account. The resource transfer relationship graph is established through the resource transfer relationships between the target account and various associated accounts.

[0012] The feature extraction module is used to obtain the historical resource transfer data corresponding to each associated account based on the resource transfer relationship graph, and to extract features based on the historical resource transfer data to obtain the resource transfer feature information corresponding to each associated account.

[0013] The attention module is used to perform attention calculation based on resource transfer feature information to obtain the attention weights corresponding to each associated account, and to perform feature fusion based on resource transfer feature information and attention weights to obtain the target resource transfer feature information corresponding to the target account.

[0014] The detection module is used to obtain the account feature information corresponding to the target account, and to perform abnormal account detection based on the account feature information and the target resource transfer feature information to obtain the probability of abnormality corresponding to the target account.

[0015] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0016] Obtain the resource transfer relationship graph corresponding to the target account. The resource transfer relationship graph is established through the resource transfer relationships between the target account and various related accounts.

[0017] Based on the resource transfer relationship graph, obtain the historical resource transfer data corresponding to each associated account, and extract features based on the historical resource transfer data to obtain the resource transfer feature information corresponding to each associated account.

[0018] Attention is calculated based on resource transfer feature information to obtain the attention weights corresponding to each associated account. Feature fusion is then performed based on the resource transfer feature information and the attention weights to obtain the target resource transfer feature information corresponding to the target account.

[0019] Obtain the account feature information corresponding to the target account, and perform abnormal account detection based on the account feature information and the target resource transfer feature information to obtain the probability of abnormality corresponding to the target account.

[0020] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0021] Obtain the resource transfer relationship graph corresponding to the target account. The resource transfer relationship graph is established through the resource transfer relationships between the target account and various related accounts.

[0022] Based on the resource transfer relationship graph, obtain the historical resource transfer data corresponding to each associated account, and extract features based on the historical resource transfer data to obtain the resource transfer feature information corresponding to each associated account.

[0023] Attention is calculated based on resource transfer feature information to obtain the attention weights corresponding to each associated account. Feature fusion is then performed based on the resource transfer feature information and the attention weights to obtain the target resource transfer feature information corresponding to the target account.

[0024] Obtain the account feature information corresponding to the target account, and perform abnormal account detection based on the account feature information and the target resource transfer feature information to obtain the probability of abnormality corresponding to the target account.

[0025] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, performs the following steps:

[0026] Obtain the resource transfer relationship graph corresponding to the target account. The resource transfer relationship graph is established through the resource transfer relationships between the target account and various related accounts.

[0027] Based on the resource transfer relationship graph, obtain the historical resource transfer data corresponding to each associated account, and extract features based on the historical resource transfer data to obtain the resource transfer feature information corresponding to each associated account.

[0028] Attention is calculated based on resource transfer feature information to obtain the attention weights corresponding to each associated account. Feature fusion is then performed based on the resource transfer feature information and the attention weights to obtain the target resource transfer feature information corresponding to the target account.

[0029] Obtain the account feature information corresponding to the target account, and perform abnormal account detection based on the account feature information and the target resource transfer feature information to obtain the probability of abnormality corresponding to the target account.

[0030] The aforementioned abnormal account detection method, apparatus, computer equipment, storage medium, and computer program product extract features from the historical resource transfer data corresponding to each associated account to obtain resource transfer feature information for each associated account. Attention calculation is performed using the resource transfer feature information to obtain the attention weight for each associated account. Feature fusion is then performed using these attention weights to combine the resource transfer feature information of each associated account, resulting in more accurate target resource transfer feature information for the target account. Finally, abnormal account detection is performed using both the account feature information and the target resource transfer feature information, making the probability of abnormality for the target account more accurate, thereby improving the accuracy of abnormal account detection. Attached Figure Description

[0031] Figure 1 This is a diagram illustrating the application environment of an abnormal account detection method in one embodiment;

[0032] Figure 2 This is a flowchart illustrating an abnormal account detection method in one embodiment;

[0033] Figure 3 This is a schematic diagram of a resource transfer relationship map in one embodiment;

[0034] Figure 4 This is a flowchart illustrating an abnormal account detection method in one embodiment;

[0035] Figure 5 This is a structural block diagram of an abnormal account detection device in one embodiment;

[0036] Figure 6 This is a diagram of the internal structure of a computer device in another embodiment;

[0037] Figure 7 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0038] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0039] The abnormal account detection method provided in this application embodiment can be applied to, for example, Figure 1In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or placed on a cloud or other network server. Server 104 obtains the resource transfer relationship graph corresponding to the target account. The resource transfer relationship graph is established through the resource transfer relationships between the target account and various associated accounts.

[0040] Server 104 obtains the historical resource transfer data corresponding to each associated account based on the resource transfer relationship graph, and performs feature extraction based on the historical resource transfer data to obtain the resource transfer feature information corresponding to each associated account.

[0041] Server 104 performs attention calculation based on resource transfer feature information to obtain the attention weights corresponding to each associated account, and performs feature fusion based on resource transfer feature information and attention weights to obtain the target resource transfer feature information corresponding to the target account.

[0042] Server 104 obtains account feature information corresponding to the target account, performs abnormal account detection based on the account feature information and target resource transfer feature information, obtains the probability of abnormality corresponding to the target account, and can send the probability of abnormality corresponding to the target account to terminal 102. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, and tablets. Server 104 can be implemented using a standalone server or a server cluster composed of multiple servers.

[0043] In one embodiment, such as Figure 2 As shown, an abnormal account detection method is provided. This embodiment illustrates the method applied to a server. It is understood that this method can also be applied to a server, and further to a system including both a terminal and a server, and implemented through interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0044] Step 202: Obtain the resource transfer relationship graph corresponding to the target account. The resource transfer relationship graph is established through the resource transfer relationships between the target account and various related accounts.

[0045] In this context, the target account refers to the account to be checked for anomalies. Associated accounts are accounts that have engaged in resource transfers with the target account; these may include accounts pre-marked as abnormal. Resource transfer refers to the process of transferring resources from one account to another on the internet; these resources can be financial resources, information resources, etc. Accounts can be financial accounts, email accounts, communication accounts, etc. A relationship graph is a graph data structure composed of nodes (Points, entities) and edges (Edges, relationships). A resource transfer relationship graph represents the resource transfer relationships between the target account and various associated accounts; in the resource transfer relationship graph, nodes represent accounts, and edges represent resource transfer relationships.

[0046] Specifically, the server has a pre-configured database of abnormal accounts, storing accounts marked as abnormal. In response to an abnormal account filtering command sent by the management terminal, the server identifies a target abnormal account in the database. The target abnormal account represents an abnormal account identified in the database. The server then retrieves all associated abnormal accounts corresponding to the target abnormal account and returns them to the management terminal. These associated abnormal accounts represent accounts that have undergone resource transfer with the target abnormal account.

[0047] Then, in response to the target account filtering command sent by the management terminal, the server identifies the target account from among the various abnormal associated accounts and obtains the various associated accounts corresponding to the target account; that is, the various associated accounts corresponding to the target account include the target abnormal account. The server then generates a resource transfer relationship graph corresponding to the target account based on the resource transfer relationships between the target account and its associated accounts.

[0048] Step 204: Obtain historical resource transfer data corresponding to each associated account based on the resource transfer relationship graph, and extract features based on the historical resource transfer data to obtain resource transfer feature information corresponding to each associated account.

[0049] Historical resource transfer data refers to the data information required for resource transfers between target accounts and related accounts; one historical resource transfer data point represents one resource transfer process. Resource transfer feature information refers to the feature vector obtained after feature extraction from historical resource transfer data.

[0050] Specifically, in the resource transfer relationship graph, nodes represent accounts, and edges represent resource transfer relationships between the target account and associated accounts, which can be represented by resource transfer data. The server retrieves the resource transfer relationships between the target account and each associated account from the resource transfer relationship graph, i.e., the historical resource transfer data corresponding to each associated account. The server extracts features from the historical resource transfer data corresponding to each associated account according to the associated account's identifier, obtaining the resource transfer feature information corresponding to the associated account. The server then iterates through the historical resource transfer data corresponding to each associated account to obtain the resource transfer feature information corresponding to each associated account.

[0051] Step 206: Calculate attention based on resource transfer feature information to obtain the attention weights corresponding to each associated account. Perform feature fusion based on resource transfer feature information and attention weights to obtain the target resource transfer feature information corresponding to the target account.

[0052] Here, attention weight refers to the importance of resource transfer characteristics of each associated account. Target resource transfer characteristics refer to the feature vector representing the resource transfer characteristics of the target account.

[0053] Specifically, the server performs attention calculations on the resource transfer feature information corresponding to each associated account to obtain the attention weight for each associated account. This weight represents the importance of resource transfers between the target account and different associated accounts; that is, the higher the attention weight of an associated account, the greater the likelihood that the resource transfer between the target account and that associated account is an abnormal resource transfer. The server then performs feature fusion based on the resource transfer feature information corresponding to each associated account and the attention weight corresponding to each association transformation to obtain the target resource transfer feature information corresponding to the target account.

[0054] Step 208: Obtain the account feature information corresponding to the target account, and perform abnormal account detection based on the account feature information and the target resource transfer feature information to obtain the probability of abnormality corresponding to the target account.

[0055] Here, account feature information refers to the feature vector obtained based on the user information corresponding to the target account. User information refers to information representing the user's identity, and also includes anomaly indicator information corresponding to the target account. Anomaly indicator information refers to information on abnormal items that may exist when the target account is transferred in a pre-set manner. Anomaly probability refers to the likelihood that the target account is an abnormal account.

[0056] Specifically, the server can obtain user information and abnormal indicator information corresponding to the target account, and use a pre-set feature extraction network to extract feature information corresponding to the user information and abnormal indicator information, respectively, to obtain the account feature information corresponding to the target account. Then, the server concatenates the account feature information and the target resource transfer feature information to obtain the target feature information corresponding to the target account. The target feature information is then input into a pre-set deep learning network for abnormal account detection to obtain the abnormal probability of the target account. When the server detects that the abnormal probability exceeds a preset abnormal probability threshold, it determines that the target account is an abnormal account and stores the target account in the abnormal account database.

[0057] In the aforementioned abnormal account detection method, feature extraction is performed on the historical resource transfer data corresponding to each associated account to obtain resource transfer feature information for each associated account. Attention calculation is then performed using this resource transfer feature information to obtain attention weights for each associated account. By using these attention weights to fuse the resource transfer feature information of each associated account, more accurate target resource transfer feature information for the target account can be obtained. Finally, the account feature information and target resource transfer feature information are used for abnormal account detection, making the probability of abnormality for the target account more accurate, thereby improving the accuracy of abnormal account detection.

[0058] In one embodiment, step 204 involves extracting features based on historical resource transfer data to obtain resource transfer feature information corresponding to each associated account, including:

[0059] Initial feature extraction is performed based on the historical resource transfer data corresponding to each associated account to obtain initial resource transfer feature information.

[0060] Based on the time feature information in each initial resource transfer feature information, the initial resource transfer feature information is arranged to obtain the initial resource transfer feature information sequence corresponding to each associated account.

[0061] Time series analysis is performed based on the initial resource transfer feature information sequence corresponding to each associated account to obtain the resource transfer feature information corresponding to each associated account.

[0062] Among them, initial resource transfer feature information refers to the feature information extracted from each historical resource transfer data. Time feature information refers to the time-related feature information of resource transfers between the target account and associated accounts. The initial resource transfer feature information sequence is the sequence obtained by arranging the initial resource transfer feature information in chronological order. One associated account corresponds to one initial resource transfer feature information sequence.

[0063] Specifically, the server can obtain historical resource transfer data corresponding to each associated account from the resource transfer relationship graph, extract features from each historical resource transfer data, and obtain initial resource transfer feature information corresponding to each historical resource transfer data. Then, the server arranges each initial resource transfer feature information in chronological order according to the time feature information in each initial resource transfer feature information to obtain the initial resource transfer feature information sequence corresponding to each associated account.

[0064] In one specific embodiment, such as Figure 3 As shown, a schematic diagram of a resource transfer relationship is provided: node B represents the target account, nodes A, C, and D represent related accounts, and arrows indicate the resource transfer process and direction.

[0065] A resource transfer relationship graph can be a multi-way network, indicating that there is at least one edge between any two nodes in the network. A resource transfer relationship graph can be represented by G = (V, E), where V represents nodes, E represents the set of edges, and each edge represents resource transfer data between a target account and an associated account, denoted by e. The resource transfer data is then e = (u, v, w, t), where u represents the account corresponding to the resource transfer initiator, v represents the account corresponding to the resource transfer recipient, w represents the resource transfer value (e.g., transaction amount), and t represents the time of the resource transfer. The resource transfer value w can represent the edge weight and serves as an important indicator for detecting abnormal accounts. In other words, a resource transfer relationship graph can be a time-weighted multi-way directed network, indicating that the network includes time information t, weight information represented by the resource transfer value w, resource transfer direction information represented by u and v, and the number of edges between any two nodes representing multi-way connections.

[0066] The server extracts the resource transfer values ​​and times from each edge of the resource transfer relationship graph. Then, based on the accounts of the initiator and receiver of each resource transfer, the server determines the directional characteristics of each edge. The direction can be represented by 'b', where b = 1 indicates an inbound transfer to the target account, and b = -1 indicates an outbound transfer. Each edge in the resource transfer relationship graph also includes the type of resource being transferred, such as the quantity of the currency involved in the transaction, which can be represented by 'm'. The initial resource transfer characteristic information can be represented as follows: u represents the target account, k represents any associated account, and i represents the sequence number of any resource transfer between the target account and the associated account. For example, the initial resource transfer feature information corresponding to the i-th historical resource transfer data between target account u and associated account v can be represented as follows: The initial resource transfer feature information sequence corresponding to each historical resource transfer data between the target account u and the associated account v can be represented as follows:

[0067]

[0068] The server can input the initial resource transfer feature information sequence corresponding to each associated account into a time series analysis network for time series analysis. The time series analysis network can be a Long Short-Term Memory (LSTM) network to obtain the resource transfer feature information corresponding to each associated account. For example, the resource transfer feature information corresponding to associated account v can be represented as...

[0069] In this embodiment, by extracting the initial resource transfer feature information corresponding to each historical resource transfer data and arranging it in time sequence, a sequence of initial resource transfer feature information corresponding to each associated account is obtained. Then, time sequence analysis is performed on the initial resource transfer feature information sequence to obtain resource transfer feature information. This is equivalent to feature fusion of each initial resource transfer feature information corresponding to the associated account to obtain the resource transfer feature information corresponding to the associated account, which improves the accuracy of the resource transfer feature information of each associated account, thereby improving the accuracy of abnormal account detection using resource transfer feature information.

[0070] In one embodiment, step 206, which involves calculating attention based on resource transfer feature information to obtain the attention weights corresponding to each associated account, includes:

[0071] Obtain attention parameters, perform attention calculation based on attention parameters and resource transfer feature information, and obtain the original attention weights corresponding to each associated account;

[0072] The attention weights for each associated account are obtained by standardizing the original attention weights for each associated account.

[0073] Here, attention parameters refer to the computational parameters required for attention calculation. Raw attention weights refer to the unstandardized weight information corresponding to the associated accounts.

[0074] Specifically, the server obtains pre-set attention parameters, which can be weight vectors and weight matrices. The server uses the weight vectors, weight matrices, and resource transfer feature information corresponding to each associated account to perform attention calculations, obtaining the raw attention weights for each associated account. Then, the server performs standardized calculations on the raw attention weights for each associated account to obtain the total attention weights for each associated account.

[0075] In one specific embodiment, the server can use a pre-stored attention calculation equation to perform attention calculation on the resource transfer feature information corresponding to each associated account, thereby obtaining the attention weight corresponding to each associated account. The attention calculation equation is shown in formula (1):

[0076]

[0077] Where, α uv Let σ represent the attention weights of the associated account v, and let a represent the activation function. T Let W represent the weight vector, and let e represent the weight matrix. uv This indicates the resource transfer characteristics of the associated account v, e uk This represents the resource transfer characteristics of any associated account k.

[0078] In this embodiment, attention weights corresponding to each associated account are calculated using an attention calculation equation to characterize the degree of abnormality in resource transfer between the target account and each associated account. This makes the target resource transfer feature information obtained by subsequent calculations using the attention weights corresponding to each associated account more accurate, thereby improving the accuracy of abnormal account detection using target resource transfer feature information.

[0079] In one embodiment, step 206 involves performing feature fusion based on resource transfer feature information and attention weights to obtain target resource transfer feature information corresponding to the target account, including:

[0080] Obtain feature fusion parameters, and perform weighted merging based on feature fusion parameters, resource transfer feature information corresponding to each associated account, and attention weight corresponding to each associated account to obtain the merging result;

[0081] The activation function is calculated based on the merged results to obtain the target resource transfer feature information corresponding to the target account.

[0082] Among them, feature fusion parameters refer to the calculation parameters required in the feature fusion calculation process.

[0083] Specifically, the server obtains pre-set feature fusion parameters, which can be a trained weight matrix. The server uses these parameters to weight and merge the resource transfer features corresponding to each associated account and the attention weights corresponding to each associated account, obtaining a merged result. Then, the server uses a pre-set activation function to calculate the merged result, obtaining the target resource transfer features corresponding to the target account.

[0084] In one specific embodiment, the server can obtain a pre-stored calculation formula for target resource transfer feature information, and use the calculation formula to calculate the resource transfer feature information corresponding to each associated account and the attention weight corresponding to each associated account to obtain the target resource transfer feature information.

[0085] The calculation equation for the target resource transfer characteristic information is shown in formula (2):

[0086]

[0087] Among them, h u This represents the target resource transfer characteristics of target account u, where σ represents the activation function, and N... u This represents the number of associated accounts, where k represents any one associated account, and α... uk The attention weight of any associated account k in the table, e uk Let W represent the resource transfer characteristics of any associated account k, and let W represent the trained weight matrix.

[0088] In this embodiment, the resource transfer feature information corresponding to each associated account is fused using the attention weight corresponding to each associated account through the target resource transfer feature information calculation formula. This results in the target resource transfer feature information corresponding to the target account including the feature information of the associated account, thereby improving the target resource transfer feature information and thus improving the accuracy of abnormal account detection using the target resource transfer feature information.

[0089] In one embodiment, step 208, obtaining account feature information corresponding to the target account, includes:

[0090] Obtain the user information corresponding to the target account, and extract basic features based on the user information to obtain the basic feature information corresponding to the target account;

[0091] Obtain the target resource transfer data corresponding to the target account, and extract abnormal features based on the target resource transfer data to obtain the abnormal feature information corresponding to the target account;

[0092] The basic feature information and the abnormal feature information are concatenated to obtain the account feature information corresponding to the target account.

[0093] User information refers to basic information representing a user's identity. Basic feature information refers to feature information extracted from user information. Target resource transfer data refers to resource transfer information statistically obtained based on historical resource transfer data corresponding to each associated account. Anomaly feature information refers to feature information extracted from the target resource transfer data.

[0094] Specifically, the server obtains the user information corresponding to the target account, then obtains the historical resource transfer data corresponding to each associated account, and performs statistics based on the account corresponding to the resource transfer sender, the account corresponding to the resource transfer receiver, the resource transfer value, and the resource transfer time in each historical resource transfer data to obtain the target resource transfer data corresponding to the target account.

[0095] The target resource transfer data includes pre-set anomaly indicators. Anomaly features are indicators that indicate whether the target account is abnormal. For example, the number of accounts of the resource transfer recipient (which can also be expressed as the number of resource transfers in the target account), the net value of the resource transfer (representing the difference between the value of resource transfers in and out of the target account), the resource transfer time period (representing the time difference between resource transfers in and out of the target account), and the node density in the resource transfer relationship graph corresponding to the target account.

[0096] The server extracts abnormal features from the target resource transfer data to obtain abnormal feature information corresponding to the target account. The server concatenates the basic feature information and the abnormal feature information to obtain the account feature information corresponding to the target account. The feature concatenation is shown in formula (3):

[0097] z u =[x u ][h u ] Formula (3)

[0098] Among them, z u Indicates account characteristic information, x u Represents basic feature information, h u [ ] indicates abnormal feature information, and [ ] indicates concatenation operation.

[0099] The server then inputs the account feature information into the pre-set neural network output layer, outputting the probability of anomalies corresponding to the target account. The calculation formula for the neural network output layer is shown in formula (4):

[0100] O u =LogSoftmax(z u W f ) Formula (4)

[0101] Among them, O u W indicates the probability of an anomaly. f This represents the weight matrix corresponding to the output layer, and LogSoftmax represents the calculation function of the output layer.

[0102] In one specific embodiment, the server performs feature annotation in the resource transfer relationship graph based on the resource transfer feature information and account feature information corresponding to each associated account. That is, the server annotates the corresponding resource transfer feature information on each edge of the resource transfer relationship graph and annotates the account feature information on the node corresponding to the target account to obtain the target resource transfer relationship graph. The server inputs the target resource transfer relationship graph into a pre-set embedding layer to perform the calculations of formulas (1) to (4) and outputs the probability of anomalies corresponding to the target account.

[0103] The target account is associated with other accounts, including the target abnormal account. When the probability of an abnormality for the target account exceeds a preset abnormality threshold, the target account is identified as an abnormal account. The preset abnormality threshold can be 0.5. Then, the target account and the target abnormal account are associated with each other as similar abnormal accounts and stored.

[0104] In this embodiment, by extracting abnormal feature information and using it to supplement the basic feature information, the feature selection of the target account is improved from multiple perspectives. By concatenating the basic feature information and abnormal feature information corresponding to the target account, more accurate account feature information is obtained, thus making the results of abnormal account detection using account feature information more accurate and improving the accuracy of abnormal account detection.

[0105] In one embodiment, the abnormal account detection method further includes:

[0106] Input the resource transfer relationship graph and account feature information corresponding to the target account into the abnormal account detection model;

[0107] The abnormal account detection model obtains the historical resource transfer data corresponding to each associated account based on the resource transfer relationship graph, and extracts features based on the historical resource transfer data to obtain the resource transfer feature information corresponding to each associated account.

[0108] The abnormal account detection model calculates attention based on resource transfer feature information to obtain the attention weights corresponding to each associated account. Based on the resource transfer feature information and attention weights, feature fusion is performed to obtain the target resource transfer feature information corresponding to the target account.

[0109] The abnormal account detection model is used to obtain the account feature information corresponding to the target account. Based on the account feature information and the target resource transfer feature information, abnormal account detection is performed to obtain the probability of abnormality corresponding to the target account.

[0110] Among them, the abnormal account detection model refers to a pre-trained model used to detect abnormal accounts.

[0111] Specifically, the abnormal account detection model includes a feature extraction module, an abnormal account detection module, and an anomaly detection module.

[0112] The server retrieves a pre-configured abnormal account detection model and inputs the resource transfer relationship graph and account feature information corresponding to the target account into the abnormal account detection model. The feature extraction module in the abnormal account detection model obtains the historical resource transfer data corresponding to each associated account in the resource transfer relationship graph, and then performs feature extraction on each historical resource transfer data to obtain the resource transfer feature information corresponding to each associated account.

[0113] The attention calculation module in the abnormal account detection module performs attention calculations on the resource transfer feature information corresponding to each associated account to obtain the attention weight for each associated account. Then, feature fusion is performed based on the resource transfer feature information and attention weights to obtain the target resource transfer feature information corresponding to the target account.

[0114] The anomaly detection module in the anomaly account detection model obtains the account feature information corresponding to the target account, and performs anomaly account detection based on the account feature information and the target resource transfer feature information to obtain the anomaly probability corresponding to the target account.

[0115] In one specific embodiment, such as Figure 4 The diagram illustrates a process for detecting abnormal accounts.

[0116] The server identifies the target abnormal account in the abnormal account database and then identifies the target account in the abnormal associated accounts corresponding to the target abnormal account. The server queries the associated accounts of the target account and the historical resource transfer data corresponding to each associated account.

[0117] The server constructs a time-weighted multi-directed network based on the target account, all associated accounts, and historical resource transfer data, with the node corresponding to the target account serving as the central node. The server obtains the account feature information corresponding to the target account in the time-weighted multi-directed network and extracts the resource transfer feature information corresponding to each edge in the time-weighted multi-directed network.

[0118] The server then inputs account feature information and resource transfer feature information into a pre-set attention-based embedding layer, outputting the anomaly probability corresponding to the target account. The server determines whether the anomaly probability corresponding to the target account exceeds a preset anomaly probability threshold. If it does, the target account is determined to be an anomaly account and stored in the anomaly account database; otherwise, no action is taken.

[0119] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0120] Based on the same inventive concept, this application also provides an abnormal account detection device for implementing the abnormal account detection method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more abnormal account detection device embodiments provided below can be found in the limitations of the abnormal account detection method described above, and will not be repeated here.

[0121] In one embodiment, such as Figure 5 As shown, an abnormal account detection device 500 is provided, including: an acquisition module 502, a feature extraction module 504, an attention module 506, and a detection module 508, wherein:

[0122] The acquisition module 502 is used to acquire the resource transfer relationship graph corresponding to the target account. The resource transfer relationship graph is established through the resource transfer relationship between the target account and various associated accounts.

[0123] The feature extraction module 504 is used to obtain the historical resource transfer data corresponding to each associated account based on the resource transfer relationship graph, and to perform feature extraction based on the historical resource transfer data to obtain the resource transfer feature information corresponding to each associated account.

[0124] Attention module 506 is used to perform attention calculation based on resource transfer feature information to obtain the attention weights corresponding to each associated account, and to perform feature fusion based on resource transfer feature information and attention weights to obtain the target resource transfer feature information corresponding to the target account.

[0125] The detection module 508 is used to obtain the account feature information corresponding to the target account, and to perform abnormal account detection based on the account feature information and the target resource transfer feature information to obtain the probability of abnormality corresponding to the target account.

[0126] In one embodiment, the feature extraction module 504 includes:

[0127] The time series analysis unit is used to extract initial features based on the historical resource transfer data corresponding to each associated account to obtain initial resource transfer feature information; arrange the initial resource transfer feature information based on the time feature information in each initial resource transfer feature information to obtain the initial resource transfer feature information sequence corresponding to each associated account; and perform time series analysis based on the initial resource transfer feature information sequence corresponding to each associated account to obtain the resource transfer feature information corresponding to each associated account.

[0128] In one embodiment, attention module 506 includes:

[0129] The weight calculation unit is used to obtain attention parameters, perform attention calculation based on attention parameters and resource transfer feature information to obtain the original attention weights corresponding to each associated account, and perform standardized calculation based on the original attention weights corresponding to each associated account to obtain the attention weights corresponding to each associated account.

[0130] In one embodiment, attention module 506 includes:

[0131] The feature fusion unit is used to obtain feature fusion parameters, and to perform weighted merging based on the feature fusion parameters, resource transfer feature information corresponding to each associated account, and attention weight corresponding to each associated account to obtain the merged result; and to calculate the activation function based on the merged result to obtain the target resource transfer feature information corresponding to the target account.

[0132] In one embodiment, the detection module 508 includes:

[0133] The feature concatenation module is used to obtain user information corresponding to the target account, extract basic features based on the user information to obtain basic feature information corresponding to the target account; obtain target resource transfer data corresponding to the target account, extract abnormal features based on the target resource transfer data to obtain abnormal feature information corresponding to the target account; and concatenate the basic feature information and abnormal feature information to obtain account feature information corresponding to the target account.

[0134] In one embodiment, the abnormal account detection device 500 further includes:

[0135] The model detection unit is used to input the resource transfer relationship graph and account feature information corresponding to the target account into the abnormal account detection model; the abnormal account detection model obtains the historical resource transfer data corresponding to each associated account based on the resource transfer relationship graph, and performs feature extraction based on the historical resource transfer data to obtain the resource transfer feature information corresponding to each associated account; the abnormal account detection model performs attention calculation based on the resource transfer feature information to obtain the attention weight corresponding to each associated account, and performs feature fusion based on the resource transfer feature information and attention weight to obtain the target resource transfer feature information corresponding to the target account; the abnormal account detection model obtains the account feature information corresponding to the target account, and performs abnormal account detection based on the account feature information and the target resource transfer feature information to obtain the abnormal probability corresponding to the target account.

[0136] Each module in the aforementioned abnormal account detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0137] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 6 As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores resource transfer relationship maps and historical resource transfer data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When executed by the processor, the computer program implements an abnormal account detection method.

[0138] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 7 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When executed by the processor, the computer program implements an abnormal account detection method. The display unit of the computer device is used to form a visually visible image. It can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0139] Those skilled in the art will understand that Figure 6-7 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0140] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0141] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0142] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0143] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data shall comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0144] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0145] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0146] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for detecting abnormal accounts, characterized in that, The method includes: Obtain the resource transfer relationship graph corresponding to the target account, which is established through the resource transfer relationships between the target account and various associated accounts; Based on the resource transfer relationship graph, obtain the historical resource transfer data corresponding to each of the associated accounts, and perform feature extraction based on the historical resource transfer data to obtain resource transfer feature information corresponding to each of the associated accounts; wherein, perform initial feature extraction based on the historical resource transfer data corresponding to each of the associated accounts to obtain initial resource transfer feature information. Based on the time feature information in each initial resource transfer feature information, the initial resource transfer feature information is arranged to obtain the initial resource transfer feature information sequence corresponding to each associated account. Time series analysis is performed based on the initial resource transfer feature information sequence corresponding to each of the associated accounts to obtain the resource transfer feature information corresponding to each of the associated accounts; Attention is calculated based on the resource transfer feature information to obtain the attention weights corresponding to each associated account. Feature fusion is then performed based on the resource transfer feature information and the attention weights to obtain the target resource transfer feature information corresponding to the target account. The system obtains account feature information corresponding to the target account, performs abnormal account detection based on the account feature information and the target resource transfer feature information, and obtains the probability of abnormality corresponding to the target account; wherein, the system obtains user information corresponding to the target account, performs basic feature extraction based on the user information, and obtains basic feature information corresponding to the target account. Obtain the target resource transfer data corresponding to the target account, and extract abnormal features based on the target resource transfer data to obtain the abnormal feature information corresponding to the target account; The basic feature information and the abnormal feature information are concatenated to obtain the account feature information corresponding to the target account.

2. The method according to claim 1, characterized in that, The resource transfer relationship graph includes a time-weighted multi-directed network; the time-weighted multi-directed network is represented by G = (V, E), where V represents a node, E represents a set of edges, the edges represent resource transfer data between the target account and the associated account, the resource transfer data is e = (u, v, w, t), u represents the account corresponding to the resource transfer initiator, v represents the account corresponding to the resource transfer recipient, w represents the resource transfer value, t represents the time of the resource transfer, and the resource transfer value w represents the weight of the edge.

3. The method according to claim 1, characterized in that, The attention calculation based on the resource transfer feature information to obtain the attention weights corresponding to each associated account includes: Obtain attention parameters, perform attention calculation based on the attention parameters and the resource transfer feature information, and obtain the original attention weights corresponding to each associated account; The attention weights for each associated account are obtained by standardizing the original attention weights for each associated account.

4. The method according to claim 1, characterized in that, The step of fusing features based on the resource transfer feature information and the attention weight to obtain the target resource transfer feature information corresponding to the target account includes: Obtain feature fusion parameters, and perform weighted merging based on the feature fusion parameters, the resource transfer feature information corresponding to each associated account, and the attention weight corresponding to each associated account to obtain the merging result; Based on the merging results, an activation function is calculated to obtain the target resource transfer feature information corresponding to the target account.

5. The method according to claim 1, characterized in that, The process of determining the attention weights includes: Attention calculation is performed on the resource transfer feature information corresponding to each associated account using an attention calculation equation to obtain the attention weight for each associated account; the attention calculation equation is as follows: Where, α uv Let σ represent the attention weights of the associated account v, and let a represent the activation function. T Let W represent the weight vector, and let e represent the weight matrix. uv This indicates the resource transfer characteristics of the associated account v, e uk This represents the resource transfer characteristics of any associated account k.

6. The method according to claim 1, characterized in that, The method further includes: The resource transfer relationship graph corresponding to the target account and the account feature information are input into the abnormal account detection model; The abnormal account detection model obtains historical resource transfer data corresponding to each associated account based on the resource transfer relationship graph, and performs feature extraction based on the historical resource transfer data to obtain resource transfer feature information corresponding to each associated account. The abnormal account detection model performs attention calculation based on the resource transfer feature information to obtain the attention weights corresponding to each associated account. Based on the resource transfer feature information and the attention weights, feature fusion is performed to obtain the target resource transfer feature information corresponding to the target account. The abnormal account detection model is used to obtain the account feature information corresponding to the target account. Based on the account feature information and the target resource transfer feature information, abnormal account detection is performed to obtain the probability of abnormality corresponding to the target account.

7. An abnormal account detection device, characterized in that, The device includes: The acquisition module is used to acquire the resource transfer relationship graph corresponding to the target account. The resource transfer relationship graph is established through the resource transfer relationships between the target account and various associated accounts. The feature extraction module is used to obtain historical resource transfer data corresponding to each associated account based on the resource transfer relationship graph, and to perform feature extraction based on the historical resource transfer data to obtain resource transfer feature information corresponding to each associated account; wherein, initial feature extraction is performed based on the historical resource transfer data corresponding to each associated account to obtain initial resource transfer feature information; the initial resource transfer feature information is arranged based on the time feature information in the initial resource transfer feature information to obtain the initial resource transfer feature information sequence corresponding to each associated account; and time series analysis is performed based on the initial resource transfer feature information sequence corresponding to each associated account to obtain the resource transfer feature information corresponding to each associated account. The attention module is used to perform attention calculation based on the resource transfer feature information to obtain the attention weights corresponding to each associated account, and to perform feature fusion based on the resource transfer feature information and the attention weights to obtain the target resource transfer feature information corresponding to the target account. The detection module is used to acquire account feature information corresponding to the target account, perform abnormal account detection based on the account feature information and the target resource transfer feature information, and obtain the probability of abnormality corresponding to the target account; wherein, it acquires user information corresponding to the target account, performs basic feature extraction based on the user information to obtain basic feature information corresponding to the target account; acquires target resource transfer data corresponding to the target account, performs abnormal feature extraction based on the target resource transfer data to obtain abnormal feature information corresponding to the target account; and concatenates the basic feature information and the abnormal feature information to obtain the account feature information corresponding to the target account.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images