An abnormal two-card identification method and system

Abstract

The application provides an abnormal two-card identification method and system. The method comprises the following steps: obtaining opening card or opening account data of a mobile phone card and a bank card; performing cleaning processing on the data to obtain cleaned data; using various resource libraries to associate and supplement the cleaned data to obtain to-be-processed data; constructing an abnormal rule analysis model to analyze the to-be-processed data and output abnormal two-card information. According to the method and system, the bank card and the telephone card can be quickly analyzed, the behavior of buying and selling two cards is effectively curbed, the key link of the industry chain is cut off, the crime implementation cost is improved, and the "card breaking" action of various levels of authorities is helped to achieve breakthrough.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of information technology, and in particular to an abnormal two-card identification method and system. BACKGROUND

[0002] In October 2020, the "card cutting" action was launched nationwide. The main purpose of the "card cutting" action is to rectify the "real name not real person" "telephone card" and "bank card", which are obtained by purchasing, leasing and other means. Statistics show that the amount involved in the country reaches tens of billions of yuan every year, and the funds flowing out through the network even reach the trillion level. For this reason, a series of documents on cracking down on telecommunications networks have been introduced by multiple departments, and through strong management measures, the units and personnel involved in illegal handling, leasing, selling, purchasing and hoarding two cards have achieved certain results.

[0003] However, the current crackdown measures and rules of these departments are relatively simple, including directly determining bank cards that have not had any transaction records for more than six months as abnormal, freezing bank cards that frequently trade at night or have multiple transactions with the same amount, and long-term low balance or out-of-town card use may also lead to card abnormalities. Moreover, the target population often has strong anti-detection awareness, and after mastering the countermeasures of relevant departments, they constantly innovate their models to some extent, which can evade crackdown and bypass regulation.

[0004] The above actual situation brings great interference and inconvenience to the two-card governance work. At the same time, a huge industrial chain has been formed in China and abroad, and relying solely on the rectification of key industries such as financial banks and telecommunications operators has been unable to meet the needs of the rapidly developing situation. SUMMARY

[0005] The present application is proposed in view of the above problems. The present application proposes an abnormal two-card identification method and system to solve the problem of being unable to quickly analyze and identify abnormal two cards.

[0006] According to a first aspect of the present application, an abnormal two-card identification method is provided, comprising the following steps:

[0007] S1: obtaining card opening or account opening data of a mobile phone card and a bank card;

[0008] S2: performing cleaning processing on the data to obtain cleaned data;

[0009] S3: using the mastered various resource libraries to associate and supplement the cleaned data to obtain to-be-processed data;

[0010] S4: constructing an abnormal rule analysis model, analyzing the to-be-processed data, and outputting abnormal two-card information.

[0011] In specific embodiments, the cleaning process specifically includes: for the phone card opening data obtained from the operator, retaining the key data of opening date, mobile phone number, opening person's name, opening person's ID card, and opening address; for the bank card opening data obtained from the bank, retaining the key data of opening date, name, mobile phone number, registered ID card, bank card number, and opening address, and excluding the data with incomplete opening mobile phone number and ID number or with star marked number segment, as the basic data for subsequent data cleaning and abnormal two-card identification.

[0012] In specific embodiments, the abnormal rule analysis model includes a static analysis model, a dynamic analysis model, and a weight integral model. The static analysis model is used for preliminary screening, and the dynamic analysis model is used for further verification to improve the accuracy of the results. Considering that the accuracy of the preliminary screening result may not be high, a low weight value is set for the screening result of the static analysis model to reduce the possibility of misjudgment.

[0013] In preferred embodiments, the static analysis model includes:

[0014] Opening date analysis: analyzing the interval days between the opening date of the bank card opening registered mobile phone number and the bank card opening date, and marking as abnormal if it is lower than threshold T1, wherein T1 represents the interval days;

[0015] Mobile phone number associated bank card analysis: analyzing the number of bank cards associated with the bank card opening registered mobile phone number, and marking as abnormal if it exceeds threshold T2, wherein T2 represents the number of mobile phone number associated bank cards, and the earliest time and the latest time span of all associated bank card opening are counted;

[0016] ID number associated bank card analysis: analyzing the number of bank cards associated with the bank card opening person's ID number, and marking as abnormal if it exceeds threshold T2, wherein T3 represents the number of ID number associated bank cards, and the earliest time and the latest time span of all associated bank card opening are counted;

[0017] Opening place analysis: when the opening places of the two cards match the key areas of buying and selling two cards, the corresponding opening records are marked as sensitive opening places;

[0018] Opening person analysis: when the opening persons of the two cards have abnormal behaviors, they are marked as sensitive opening persons.

[0019] In preferred embodiments, the dynamic analysis model includes:

[0020] Life phone number judgment, including: obtaining the nickname information of the phone number from the mastered phone note resource library, that is, the nickname of the phone number in the other's address book; obtaining the sender or receiver name associated with the phone number from the mastered postal logistics data; obtaining the nickname or real name of all virtual identities associated with the phone number from the mastered phone number-virtual identity resource library; and identifying the real name of the phone number user from other data resources;

[0021] Common communication object analysis, specifically, analyzing the opening person associated with the opening registration phone number, correlating the other phone numbers held by the opening person through the identity card-phone number resource library, and determining whether each phone number is a life number, if not, determining whether the phone opening time exceeds the threshold value, if yes, determining that the opening phone number is abnormal, if not, continuing to iterate the judgment; connecting the data platform operator call resource to obtain the address book and call record corresponding to the opening registration phone number, obtaining the address book and call record corresponding to the life phone number of the opening person, and taking the intersection of the address book and the call record to obtain the common friends and common communication objects of the opening phone number and the life phone number, and then filtering these common numbers again to screen out special service numbers, advertising sales numbers, etc.; when the number of common numbers after screening and filtering is less than the threshold value, it is determined that the opening phone number is abnormal;

[0022] Trajectory analysis, whether the opening registration phone number and all life phone numbers are "person-card separation" is determined by calculating the trajectory space-time distribution of the opening registration phone number and all life phone numbers, if the activity positions of the two numbers are within a certain distance range for a certain period of time, it is considered that the trajectory is accompanied, otherwise, if there is no trajectory accompanying, it means that the opening person and the card may have been separated;

[0023] Trajectory separation analysis, whether the opening registration phone number and all life phone numbers have obvious separation is analyzed, if the activity positions of the two numbers are more than a certain distance range for a certain period of time, it is considered that the trajectory has been separated, otherwise, it means that the opening person and the card are not separated;

[0024] Opening registration phone number usage analysis, the call times and the number of sent and received messages of the "opening registration phone number" are analyzed to determine whether the phone number is in normal use, that is, whether the phone number has a large number of sent and received messages, and most of the messages are sent by the bank special service number, and the call times are few, if not, it is determined that the phone number is in normal use;

[0025] Opening person / user consistency analysis, the real name of the opening person or user of the opening registration phone number is obtained from the big data platform resource to determine whether it is the opening person of the bank card, if not, the family graph data is analyzed to determine whether there is a kinship between the two, if not, it is marked as abnormal.

[0026] In the preferred embodiment, the weight integration model specifically comprises: analyzing the to-be-processed data by the static analysis model and the dynamic analysis model, and scoring the to-be-processed data according to the weight, and further marking the to-be-processed data as three states of trusted, suspicious and uncertain according to the score interval.

[0027] Through the above technical means, considering that the accuracy of the static analysis as a preliminary screening result is not high and the "registered mobile phone number" may not be used in a period of time after opening a new card, the weight of the static analysis result is set to a low value, and the accuracy of the result is further verified and improved, and the possibility of misjudgment is reduced.

[0028] In a specific embodiment, it further includes manual disposal of the suspicious state and feedback of the result, and iteration optimization of the abnormal rule analysis model.

[0029] Through the above technical means, the user can manually mark and adjust the pushed abnormal two-card information. The clues in the "suspicious" state can be disposed by the personnel of the operator and the bank department, and the result is fed back, and the operation rules are adjusted according to the feedback result, the accuracy of the analysis result is improved, and a business closed loop of "determine rules->push clues->disposal feedback->iteration optimization" is formed.

[0030] According to a second aspect of the present application, a computer readable storage medium is provided, and one or more computer programs are stored on the computer readable storage medium, and the computer program is executed by a computer processor to implement the above method.

[0031] According to a third aspect of the present application, an abnormal two-card identification system is provided, which comprises:

[0032] The data acquisition unit is configured to acquire the data of opening a card or an account of a mobile phone card or a bank card;

[0033] The data cleaning unit is configured to clean the data to obtain cleaned data;

[0034] The data supplement unit is configured to supplement the cleaned data based on the mastered various resource libraries to obtain to-be-processed data;

[0035] The data analysis unit is configured to analyze the to-be-processed data based on the constructed abnormal analysis model to generate an analysis result;

[0036] The output unit is configured to output abnormal two-card information.

[0037] In specific embodiments, the data cleaning unit is used to retain the card opening date, mobile phone number, card opening person name, card opening person ID, and key data of the opening address for the phone card opening data obtained from the operator; retain the card opening date, name, mobile phone number, registered ID, bank card number, and key data of the opening address for the bank card opening data obtained from the bank; and eliminate the data with incomplete card opening mobile phone number and ID number or with star marked part of the number segment.

[0038] Through the above technical solutions, the accuracy of the original data is ensured, and a foundation is laid for subsequent rule analysis.

[0039] In specific embodiments, the output unit analyzes the to-be-processed data through the static analysis model and the dynamic analysis model arranged therein, scores the to-be-processed data according to the weight, and outputs credible / suspicious / uncertain according to the score interval.

[0040] In specific embodiments, it further includes an iterative updating unit configured to manually dispose the suspicious state and feed back the result, and iteratively optimize the abnormal rule analysis model.

[0041] The present application combines the actual application scene requirements, first performs cleaning processing on the obtained data, and then uses the constructed abnormal analysis model to screen out the abnormal result after combining the related database mastered. The two card misjudgment, wrong judgment and other business difficulty problems are solved, and the entire analysis method has the characteristics of intelligence and automation, which can not only analyze the new card opening data, but also can efficiently identify the inventory cards on the market, and form a business closed loop.

[0042] An intelligent analysis model is also constructed by using the data of operators, banks and the like, and a long-term working mechanism is established. BRIEF DESCRIPTION OF DRAWINGS

[0043] The accompanying drawings are included to provide a further understanding of embodiments and are incorporated in and constitute a part of this specification. The drawings illustrate embodiments and serve to explain principles of the present application. Other embodiments and many of the intended advantages of the present application will be readily appreciated as the same becomes better understood by reference to the following detailed description when considered in connection with the accompanying drawings. Other features, objects, and advantages of the application will become apparent from the detailed description of the non-limiting embodiments made by way of illustration:

[0044] Figure 1 is an exemplary system architecture diagram to which the present application can be applied;

[0045] Figure 2 is a flowchart of an analysis method for abnormal two card identification of an embodiment of the present application;

[0046] Figure 3is a flow chart of an abnormal two-card identification method according to an embodiment of the present application;

[0047] Figure 4 is a framework diagram of an analysis system for abnormal two-card identification according to an embodiment of the present application;

[0048] Figure 5 is a common communication object analysis flowchart for abnormal two-card identification according to an embodiment of the present application;

[0049] Figures 6(a)-6(c) is an analysis result page display diagram for abnormal two-card identification according to an embodiment of the present application;

[0050] Figure 7 is a structural diagram of a computer system of an electronic device suitable for implementing embodiments of the present application. DETAILED DESCRIPTION

[0051] The present application will be further described below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely intended for the purpose of illustration of the related application and are not intended to limit the application. In addition, it should be noted that only parts related to the application are shown in the accompanying drawings for the purpose of description.

[0052] It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict. The present application will be described in detail below with reference to the accompanying drawings and embodiments.

[0053] Figure 1 An exemplary system architecture 100 for the abnormal two-card identification method according to an embodiment of the present application is shown.

[0054] As shown in Figure 1 , the system architecture 100 can include a data server 101, a network 102 and a host server 103. The network 102 is a medium for providing a communication link between the data server 101 and the host server 103. The network 102 can include various connection types, such as wired, wireless communication links or fiber optic cables, etc.

[0055] The host server 103 can be a server providing various services, such as a data processing server for processing information uploaded by the data server 101. The data processing server can analyze and process the data set according to the constructed abnormal analysis model, and store the processing result in the matching result library.

[0056] It should be noted that the abnormal two-card identification method provided by the embodiments of the present application is generally executed by the host server 103, and accordingly, the device for the abnormal two-card identification method is generally provided in the host server 103.

[0057] It should be noted that the data server and the host server can be hardware or software. When it is hardware, it can be implemented as a distributed server cluster composed of multiple servers, or as a single server. When it is software, it can be implemented as multiple software or software modules (for example, software or software modules used to provide distributed services), or as a single software or software module.

[0058] It should be understood that Figure 1 The number of data servers, networks and host servers in the above is only illustrative. According to the needs of implementation, there can be any number of terminal devices, networks and servers.

[0059] According to an embodiment of the application, a method for abnormal two-card identification, Figure 2 A flowchart of a method for abnormal two-card identification according to an embodiment of the application is shown. As shown in Figure 2 The method includes the following steps:

[0060] S1: Obtain the card opening or account opening data of the mobile phone card and the bank card.

[0061] Table 1: Bank card opening (account) example data

[0062]

[0063] Table 2: Mobile phone card opening (account) example data

[0064]

[0065] S2: Clean the data to obtain cleaned data.

[0066] In a specific embodiment, for the telephone card opening data obtained from the operator, the card opening date, mobile phone number, card opening person's name, card opening person's ID card, and account opening place are retained as key data; for the bank card opening data obtained from the bank, the card opening date, name, mobile phone number, registered ID card, bank card number, and account opening place are retained as key data, and the data with incomplete card opening mobile phone number or ID number or with some number segments with asterisks are excluded, as the basis data for subsequent data cleaning and abnormal two-card identification.

[0067] S3: Use the mastered various resource libraries to associate and supplement the cleaned data to obtain the data to be processed.

[0068] In a specific embodiment, the "ID card-mobile phone number" resource library can be called to associate and land the ID number to complete the relevant information, laying a foundation for subsequent rule analysis.

[0069] S4: Construct an abnormal rule analysis model, analyze the data to be processed, and output abnormal two-card information.

[0070] In specific embodiments, the abnormal rule analysis model is composed of a static analysis model, a dynamic analysis model and a weight integration model. The preliminary screening is completed by the static analysis model. After the preliminary screening, the dynamic analysis model is used to analyze the data more deeply.

[0071] The static and dynamic analysis combined with weight integration can better solve the problem that the accuracy of the preliminary screening result may not be high and it is easy to cause misjudgment. Therefore, the weight of the static analysis result is set to a low value. The "registered mobile phone number for opening an account" may not be used in a certain period of time after opening a card. The dynamic analysis method may lack online and offline data support. The static analysis rule does not depend on the use of the "registered mobile phone number for opening an account". As time goes by, the online and offline activity data after using the card will be more and more, and the rule operation result will be more accurate. The whole model can be continuously iterated and run.

[0072] In specific embodiments, the static analysis model includes: opening date analysis, mobile phone number associated bank card analysis, ID number associated bank card analysis, opening place analysis, and card opening person analysis.

[0073] In specific embodiments, it is judged whether the interval days between the card opening date of the registered mobile phone number for opening an account and the card opening date of the bank card are lower than a threshold T1. T1 represents the interval days, which is usually set to 10 days by default.

[0074] In specific embodiments, it is judged whether the number of bank cards associated with the registered mobile phone number for opening an account exceeds a threshold T2. T2 represents the number of bank cards associated with the mobile phone number, which is usually set to 5 by default. The earliest time and the latest time span of opening the card of all associated bank cards are counted, and it can be analyzed whether there is a large number of card opening behavior in a short period of time.

[0075] In specific embodiments, it is judged whether the number of bank cards associated with the ID number of the card opening person exceeds a threshold T3. T3 represents the number of bank cards associated with the ID number, which is usually set to 5 by default. Similarly, the earliest and latest time of opening the card of these bank cards can be analyzed to determine whether there is a large number of card opening behavior in a short period of time.

[0076] In specific embodiments, when the opening places of the two cards match the key areas of buying and selling the two cards, the corresponding card opening records are marked as "sensitive opening places" by using the knowledge base accumulated by the relevant departments.

[0077] In specific embodiments, the ID number and mobile phone number of the card opening person are associated with big data, and when the real identity of the card opening person has abnormal behavior, the card opening person is marked as "sensitive card opening person".

[0078] In specific embodiments, the dynamic analysis model includes: life mobile number judgment, common communication object analysis, trajectory following analysis, trajectory separation analysis, opening account registered mobile number usage analysis, and opening account person / user consistency analysis.

[0079] Life mobile number judgment is to determine whether it is a life mobile number through real name analysis method, which specifically includes: obtaining the nickname information of the mobile number from the mastered mobile phone note resource library, i.e. the nickname of the mobile number in the address book of others. When multiple people give the same name to the same mobile number, the user of the mobile number is most likely to be the name. Obtain the sender or receiver name associated with the mobile number from the mastered postal and delivery data. Obtain the nickname or real name of all virtual identities from the mastered mobile number-virtual identity resource library. Identify the real name of the mobile number user from other data resources.

[0080] In specific embodiments, Figure 5 The common communication object analysis process in one specific embodiment of the application is shown in the schematic diagram. Common communication object analysis is based on the rule that even if a normal person has multiple mobile numbers for different use scenarios, there will inevitably be some intersection of communication objects. As shown in the figure, the specific steps are as follows: Figure 5

[0081] Step 1: First, analyze the opening account person associated with the "opening account registered mobile number". Obtain other mobile numbers held by the opening account person from the mastered "ID card-mobile number" resource library, and determine whether each mobile number is a life number. If not, further determine whether the mobile number has been opened for more than a certain threshold (configurable, default is 30 days, i.e. more than 30 days after opening the mobile number without any life data association), and if so, determine that the opening mobile number is abnormal. If not, continue to iterate the judgment.

[0082] Step 2: Access the operator call record resource of the big data platform to obtain the address book and call record corresponding to the opening account registered mobile number, obtain the address book and call record corresponding to the life mobile number of the opening account person, and take the intersection of the address book and call record to obtain the common friends and common communication (call / sms) objects of the opening mobile number and the life mobile number. Then, perform secondary filtering on these common numbers to filter out special service numbers (such as 10086, 95533, etc.), advertising numbers (such as 400 numbers), etc.

[0083] Step 3: When the number of common numbers after filtering is less than a certain threshold (configurable, default is 5), it means that the "opening account registered mobile number" is most likely not used by the person himself / herself, and the opening mobile number can be determined to be abnormal.

[0084] ​Trajectory companion analysis is to judge whether the "registered mobile number" and all "life mobile numbers" are separated by calculating the trajectory space-time distribution. If the activity positions of the two numbers are within a certain distance range (configurable, default 500 meters) for multiple times within a certain period of time (configurable, default 10 minutes), it is considered that the trajectory is accompanied. The position calculation method of the mobile number is to obtain the mobile phone connection base station information through the big data platform, and to use the longitude and latitude of the base station library for positioning. When multiple mobile numbers are accompanied by trajectories, it is indicated that the "registered mobile number" and the cardholder are not separated in the trajectory, which is consistent with the behavior of taking multiple mobile phones out. On the contrary, if there is no trajectory companion, it means that the cardholder and the card may have been separated.

[0085] Trajectory separation analysis is the opposite of the above trajectory companion analysis, which analyzes whether the "registered mobile number" and all "life mobile numbers" are obviously separated.

[0086] The use of the registered mobile number is mainly to analyze the call times and SMS sending and receiving times of the registered mobile number to determine whether the mobile number is in normal use.

[0087] The consistency analysis of the cardholder / user is to determine whether the cardholder is the bank card holder by using the real name of the cardholder (or user) of the "registered mobile number" through the big data platform resources. If not, further use the big data platform to obtain the family graph (household registration) data to analyze whether there is a kinship between the two, and if not, it is marked as abnormal.

[0088] Through preliminary screening by static analysis and further selection by dynamic analysis, and combining the weight score model, different weight scores are given to the screening results of static analysis and the screening results of dynamic analysis, so as to score each data, and place it in different weight intervals according to the data score.

[0089] Abnormal rule weight score model

[0090]

[0091]

[0092] According to the two-card state "credible, can, uncertain" output by the weight score model, and the user can manually mark and adjust the output two-card information. The clues with the state of "suspicious" can be disposed by the personnel of the operator and the bank department, and the results are fed back. According to the feedback results, the operation rules are adjusted to improve the accuracy of the analysis results, forming a business closed loop of "determined rules → pushed clues → disposal feedback → iterative optimization".

[0093] Figure 3A flow chart of the abnormal two-card identification method of one specific embodiment of the present application is shown. The method specifically comprises the following steps:

[0094] S301: Obtain data. Obtain telephone card opening data from the interface operator and bank card opening data from the interface bank department, retain the required data, and enter the data cleaning process.

[0095] S302: Data cleaning. Remove data with incomplete card opening mobile phone numbers and identity card numbers or partial number segments with asterisks to ensure the accuracy of the original data and enter the data completion process.

[0096] S303: Data completion. Call the "identity card-mobile phone number" resource library to associate the identity card number and land relevant information, and enter the data analysis process.

[0097] The data analysis process includes: S304 static analysis, S305 dynamic analysis, and S306 weight analysis.

[0098] S304: Static analysis. Perform static analysis on the completed data to preliminarily screen possible abnormal card opening records.

[0099] S3041: Analysis of opening date. Screen for new mobile phone cards and corresponding bank cards.

[0100] S3042: Analysis of mobile phone number associated bank card. Analyze whether there is a large number of card opening behavior in a short period of time.

[0101] S3043: Analysis of identity card number associated bank card. Screen from the dimension of identity card number, analyze the earliest and latest time of this batch of bank card opening, and judge whether there is a large number of card opening behavior in a short period of time.

[0102] S3044: Analysis of opening place. When the opening places of the two cards match the key areas of buying and selling two cards, mark the corresponding card opening records as "sensitive opening place".

[0103] S3045: Analysis of card opening person. If the card opening person has abnormal behavior, mark it as "sensitive opening person".

[0104] S305: Dynamic analysis. Perform dynamic analysis on the completed data to further screen abnormal card opening records.

[0105] S3051: Life mobile phone number determination. Determine the identity consistent mobile phone number through real name analysis method, which is the actual daily life number of the card opening person.

[0106] S3052: Commonly linked object analysis. Screen whether the intersection of the mobile phone number used in the daily life of the account holder and the mobile phone number bound to the bank card in the address book and the call object meets the threshold.

[0107] S3053: Trajectory companion analysis. Calculate whether the "account registration mobile phone number" and all "life mobile phone numbers" are separated by card.

[0108] S3054: Trajectory separation analysis. Analyze whether the "account registration mobile phone number" and all "life mobile phone numbers" are obviously separated.

[0109] S3055: Account registration mobile phone usage analysis. Analyze the call times, SMS sending and receiving times, etc. of the account registration mobile phone number to determine whether the mobile phone number is in normal use.

[0110] S3056: Account holder / user consistency analysis. Obtain the real name of the cardholder (or user) of the account registration mobile phone number through the big data platform resources, and determine whether it is the account holder of the bank card or has a family relationship.

[0111] S306: Weight integration. The accuracy of the preliminary screening result may not be high, and it is relatively easy to cause misjudgment, so the weight of the static analysis result is set to a lower value.

[0112] S307: Output result. According to the weight and score interval, automatically push the two-card state information (trusted, suspicious, and uncertain), and at the same time, the user can manually mark and adjust the abnormal two-card information pushed out.

[0113] S308: Correction feedback. The clues in the "suspicious" state can be disposed by the personnel of the operator and the bank department, and the results are fed back, and the operation rules are adjusted according to the feedback results, the accuracy of the analysis results is improved, and a business closed loop of "determine rules→push clues→disposal feedback→iterative optimization" is formed.

[0114] Figures 6(a)-Figures 6(c) The analysis result page display diagram for abnormal two-card identification of one embodiment of the application is shown, it can be seen that the abnormal two-card identification analysis method, rule configuration, flexibility is high, can cope with the application demand in complex scene, effectively solve the business difficult problem such as two-card misjudgment and wrong judgment.

[0115] Figure 4 The abnormal two-card identification system according to another embodiment of the application is shown. The system specifically includes a data acquisition unit 401, a data cleaning unit 402, a data supplementing unit 403, a data analysis unit 404, an output unit 405, and an iterative updating unit 406.

[0116] In specific embodiments, the data acquisition unit 401 is configured to acquire data of card opening or account opening of a mobile phone card or a bank card.

[0117] The data cleaning unit 402 is configured to clean the data to obtain cleaned data.

[0118] The data complementing unit 403 is configured to complement the cleaned data based on various types of resource libraries to obtain to-be-processed data.

[0119] The data analysis unit 404 is configured to analyze the to-be-processed data based on an abnormal analysis model to generate an analysis result.

[0120] The output unit 405 is configured to output abnormal two-card information.

[0121] In preferred embodiments, a feedback unit is further included, which is configured to manually mark and adjust the output result, and optimize the operation rules according to the feedback result.

[0122] The iterative updating unit 406 is configured to manually dispose the suspicious state and feed back the result, and iteratively optimize the abnormal rule analysis model.

[0123] Reference is made below to Figure 7 which shows a structural schematic diagram of a computer system 500 of an electronic device suitable for implementing embodiments of the present application. Figure 7 The electronic device shown is merely an example and should not bring any limitation to the functions and use range of embodiments of the present application.

[0124] As shown in Figure 7 , the computer system 500 includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 502 or programs loaded from a storage portion 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the system 500 are also stored. The CPU 401, the ROM 502, and the RAM 503 are connected to each other through a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0125] The following components are connected to the I / O interface 505: an input section 506 including a keyboard, a mouse, etc.; an output section 507 including a display such as a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, a modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as necessary. A removable recording medium 511 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc. is attached to the drive 510 as necessary, so that a computer program read out therefrom is installed in the storage section 508 as necessary.

[0126] In particular, the processes described above with reference to the flowcharts can be implemented as a computer software program according to embodiments of the present disclosure. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer readable storage medium, the computer program comprising program code for performing the methods illustrated by the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network by the communication section 509, and / or installed from the removable medium 511. When the computer program is executed by the central processing unit (CPU) 501, the above-described functions defined in the methods of the present application are performed. It should be noted that the computer readable storage medium of the present application can be a computer readable signal medium or a computer readable storage medium or any combination of the two. The computer readable storage medium may, for example, be but is not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or any suitable combination of the above. More specific examples of the computer readable storage medium can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, the computer readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus or device. In the present application, the computer readable signal medium can include a data signal carried in a baseband or as part of a carrier wave, in which the computer readable program code is carried. Such a propagated data signal can take many forms, including but not limited to electro-magnetic, optical, or any suitable combination thereof. The computer readable signal medium can also be any computer readable storage medium that can be used to carry or store computer readable program code except the computer readable storage medium that can be embodied as a computer readable program code means which can be directed to a transitory propagating signal per se. The program code contained on the computer readable storage medium can be transmitted using any suitable medium, including but not limited to wireless, wire line, optical fiber, RF, etc., or any suitable combination of the above.

[0127] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0128] The computer program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0129] The modules involved in the embodiments of the present application can be implemented in the form of software, or can be implemented in the form of hardware.

[0130] As another aspect, the present application also provides a computer readable storage medium, which can be included in the electronic device described in the above embodiments, or can exist separately without being assembled into the electronic device. The above computer readable storage medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to: acquire card opening or account opening data of a mobile phone card and a bank card; perform cleaning processing on the data to obtain cleaned data; utilize various resource libraries mastered to associate and supplement the cleaned data to obtain to-be-processed data; construct an abnormal rule analysis model, analyze the to-be-processed data, and output abnormal two-card information.

[0131] The above description is only the preferred embodiment of the present application and the explanation of the technical principles. It should be understood by those skilled in the art that the scope of the protection of the present application is not limited to the technical solutions formed by the specific combinations of the above technical features. It should also cover other technical solutions formed by the combinations of the above technical features or their equivalent features without departing from the concept of the present application. For example, the technical solutions formed by the mutual replacement of the above features and the technical features with similar functions disclosed (but not limited to) in the present application.

Claims

1. An abnormal two-card identification method, characterized in that, The method comprises the following steps: S1: obtaining card opening or account opening data of a mobile phone card and a bank card; S2: performing cleaning processing on the data to obtain cleaned data; S3: complementing the cleaned data by using a resource library to obtain to-be-processed data; S4: constructing an abnormal rule analysis model to analyze the to-be-processed data and output abnormal two-card information. The abnormal rule analysis model comprises a static analysis model, a dynamic analysis model and a weight integration model. Life mobile phone judgment: whether the mobile phone is a life mobile phone is determined by a real name analysis method, which comprises the following steps: obtaining the nickname information of the mobile phone from a mobile phone remark resource library, that is, the remark of the mobile phone in the address book of others; obtaining the sender or receiver name associated with the mobile phone from mastered delivery data; obtaining the nickname or real name of all virtual identities from a mobile phone-virtual identity resource library; and identifying the real name of the user of the mobile phone from other data resources; Common communication object analysis: the account holder associated with the account registration mobile phone is analyzed, other mobile phones held by the account holder are associated from an ID-mobile phone resource library, and whether each mobile phone is a life mobile phone is determined; if not, whether the mobile phone account registration duration exceeds a threshold value is determined; if yes, the mobile phone account is determined to be abnormal; if not, the determination is iterated; the address book and call record corresponding to the account registration mobile phone are obtained from a communication platform operator call record resource; the address book and call record corresponding to the life mobile phone are obtained; the common friends and common communication objects of the account registration mobile phone and the life mobile phone are obtained by taking the intersection of the address books and call records; the common mobile phones are filtered again to filter out special service numbers and advertising numbers; and when the number of the common mobile phones after the filtering is lower than a threshold value, the account registration mobile phone is determined to be abnormal; Accompanying trajectory analysis: whether the account holder and the card are separated is determined by calculating the trajectory and space-time distribution of the account registration mobile phone and all life mobile phones; if the activity positions of the two numbers are within a certain distance range for multiple times within a certain time period, it is considered that the two numbers are accompanied by trajectories; otherwise, if there is no trajectory accompanying, it is considered that the account holder and the card are not separated; Trajectory separation analysis: whether the account holder and the card are separated is determined by analyzing whether the account registration mobile phone and all life mobile phones are obviously separated; if the activity positions of the two numbers are more than a certain distance range for multiple times within a certain time period, it is considered that the two numbers are separated by trajectories; otherwise, it is considered that the account holder and the card are not separated; Account registration mobile phone usage analysis: whether the mobile phone is in normal use is determined by analyzing the call times and the number of sent and received messages of the account registration mobile phone; Account holder / user consistency analysis: the real name of the card holder or user of the account registration mobile phone is obtained from a big data platform resource, and whether the real name is the account holder of the bank card is determined; if not, whether the account holder and the user have a family relationship is determined by analyzing family graph data from the big data platform; if not, the account holder and the user are marked as abnormal.

2. The method of claim 1, wherein the two cards are different from each other. The cleaning processing in the step S2 specifically includes: reserving the card opening date, mobile phone number, card opening person's name, card opening person's ID card, and key data of the opening location for the phone card opening data obtained from the operator; reserving the card opening date, name, mobile phone number, registered ID card, bank card number, and key data of the opening location for the bank card opening data obtained from the bank; and eliminating the data with incomplete card opening mobile phone number and ID card number or with star marked number segment.

3. The method of claim 2, wherein the step of identifying the abnormal two-card recognition is characterized by, The static analysis model includes: The opening date analysis analyzes the interval days between the card opening date of the bank card opening registration mobile phone number and the bank card opening date, and marks as abnormal if lower than a threshold T1, wherein the T1 represents the interval days; The mobile phone number associated bank card analysis analyzes the number of bank cards associated with the bank card opening registration mobile phone number, and marks as abnormal if exceeding a threshold T2, wherein the T2 represents the number of mobile phone number associated bank cards, and the earliest time and the latest time span of all associated bank card opening are counted; The ID card number associated bank card analysis analyzes the number of bank cards associated with the bank card opening person's ID card number, and marks as abnormal if exceeding a threshold T2, wherein the T3 represents the number of ID card number associated bank cards, and the earliest time and the latest time span of all associated bank card opening are counted; The opening location analysis marks the corresponding card opening record as sensitive opening location when the opening locations of the two cards match the key area of buying and selling the two cards; The card opening person analysis marks as sensitive card opening person when the card opening persons of the two cards have abnormal behaviors.

4. The method of claim 1, wherein the method further comprises: The weight score model specifically includes: analyzing the to-be-processed data through the static analysis model and the dynamic analysis model, scoring the to-be-processed data according to the weight, and marking the to-be-processed data as three states of credible, suspicious, and uncertain according to the score interval.

5. The method of claim 4, wherein the step of identifying the abnormal two-card recognition is characterized by, It also includes manually processing the suspicious state and feeding back the result, and iteratively optimizing the abnormal rule analysis model.

6. A computer readable storage medium having stored thereon one or more computer programs. The one or more computer programs are executed by a computer processor to implement the method of any one of claims 1-5.

7. An abnormal two card identification system, characterized by, The system includes: A data acquisition unit configured to acquire data of mobile phone card or bank card opening or opening; A data cleaning unit configured to clean the data to obtain cleaned data; A data supplement unit configured to supplement the cleaned data based on the mastered various resource library to obtain to-be-processed data; A data analysis unit configured to analyze the to-be-processed data based on the constructed abnormal analysis model to generate an analysis result; the data analysis unit is provided with an abnormal rule analysis model, and the abnormal rule analysis model is composed of a static analysis model, a dynamic analysis model, and a weight analysis model; the dynamic analysis model includes: Life mobile number judgment; whether it is a life mobile number is judged by real name analysis method, including: obtaining the nickname information of the mobile number by the mobile phone note resource library mastered, that is, the note of the mobile number in the other address book; obtaining the sender or receiver name associated with the mobile number by the mastered postal and delivery data; obtaining all virtual identity nicknames or real names by the mastered mobile number-virtual identity resource library; identifying the real name of the mobile number user through other data resources; Common communication object analysis; analyze the opening person associated with the opening registration mobile number, associate the opening person's other mobile numbers through the identity card-mobile number resource library, and determine whether each mobile number is a life number. If not, determine whether the mobile number has been opened for more than a threshold value. If yes, determine that the opening mobile number is abnormal. If not, continue to iterate the judgment; connect to the operator call data resource of the big data platform to obtain the address book and call record corresponding to the opening registration mobile number, obtain the address book and call record corresponding to the life mobile number of the opening person, and obtain the common friends and common communication objects of the opening mobile number and the life mobile number by taking the intersection of the address book and the call record, respectively. Then, the common numbers are filtered again to screen out special service numbers and advertising numbers. When the number of common numbers after screening and filtering is less than a threshold value, it is determined that the opening mobile number is abnormal. Trajectory analysis; whether "person-card separation" is determined by calculating the trajectory space-time distribution of the opening registration mobile number and all life mobile numbers. If the activity positions of the two numbers are within a certain distance range for multiple times within a certain period of time, it is considered that the trajectory is accompanied. Otherwise, if there is no trajectory accompaniment, it means that the opening person and the card may have been separated. Trajectory separation analysis; whether there is a clear separation between the opening registration mobile number and all life mobile numbers is analyzed. If the activity positions of the two numbers are more than a certain distance range for multiple times within a certain period of time, it is considered that the trajectory has been separated. Otherwise, it means that the opening person and the card are not separated. Opening registration mobile number usage analysis, including: analyzing the call times and SMS sending and receiving times of the opening registration mobile number to determine whether the mobile number is in normal use. Opening person / user consistency analysis; the opening card person or user real name of the opening registration mobile number is obtained through the big data platform resource to determine whether it is the opening person of the bank card. If not, the family graph data is analyzed to determine whether there is a kinship between the two. If not, it is marked as abnormal. Output unit: configured to output abnormal two-card information.

8. The dual card recognition system of claim 7, wherein, The data cleaning unit is used to retain the opening date, mobile number, opening person name, opening person identity card, and opening place key data of the telephone card opening data obtained from the operator; retain the opening date, name, mobile number, registered identity card, bank card number, and opening place key data of the bank card opening data obtained from the bank; and eliminate data with incomplete opening card mobile number and identity card number or partial number segment with asterisk.

9. The dual card recognition system of claim 7, wherein, The static analysis model comprises: opening date analysis, mobile phone number associated bank card analysis, ID number associated bank card analysis, opening place analysis, and card opening person analysis; the dynamic analysis model comprises: life mobile phone number judgment, common communication object analysis, accompanying trajectory analysis, trajectory separation analysis, opening registration mobile phone number usage analysis, and opening person / user consistency analysis.

10. The dual card recognition system of claim 9, wherein, The output unit analyzes the to-be-processed data through the static analysis model and the dynamic analysis model, scores the to-be-processed data according to weights, and outputs credibility / suspicion / uncertainty according to score intervals.

11. The dual card recognition system of claim 9, wherein, The iteration updating unit is configured to manually dispose the suspicious state, feed back the result, and iteratively optimize the abnormal rule analysis model.

Images