Abnormal behavior detection method, device, equipment and medium based on transaction data

Abstract

The present application discloses a method, apparatus, device and medium for detecting abnormal behavior based on transaction data, which obtains each field of transaction information within a set time period, as well as each attribute value of each field, combines each field, obtains each initial combination field, and then screens each initial combination field according to each difference characterization value. On the one hand, it saves computing resource consumption for abnormal behavior detection and improves processing speed. On the other hand, it screens each initial combination field according to each difference characterization value, thereby improving the accuracy of abnormal behavior detection. Then, for each target combination field, it screens according to the joint probability and conditional probability of each initial attribute combination of the target combination field, and then determines the abnormal attribute evaluation value corresponding to each retained target attribute combination, and finally performs abnormal behavior detection according to the abnormal attribute evaluation value. This further improves the accuracy of abnormal behavior detection.

Description

Technical Field

[0001] The present application relates to the field of financial technology, and in particular to methods, devices, equipment, and media for detecting abnormal behavior based on transaction data. Background Art

[0002] The payment industry is rapidly evolving, with payment services and financial technology increasingly integrated, making payment services more secure, efficient, and convenient. Business departments of major financial institutions and non-financial payment institutions regularly organize events to attract large numbers of users and provide them with preferential treatment and a comfortable payment experience. However, the various marketing activities regularly conducted by these companies often attract the participation of unscrupulous individuals. These individuals engage in marketing activities to profit illicitly. This behavior is considered abnormal behavior. Detecting abnormal behavior in the financial sector facilitates the orderly conduct of marketing activities and combats this behavior.

[0003] Existing technologies for detecting abnormal behavior typically cluster individual abnormal transaction samples based on the user's transaction location information obtained from the system. This clustering process then further detects abnormal behavior based on the clustering results. However, existing technologies suffer from the fact that detecting abnormal behavior solely based on the user's transaction location lacks sufficient data dimensions and effective additional information, resulting in poor accuracy in detecting abnormal behavior. Summary of the Invention

[0004] The embodiments of the present application provide a method, apparatus, device, and medium for detecting abnormal behavior based on transaction data, to solve the problem of poor accuracy in existing abnormal behavior detection.

[0005] In a first aspect, the present application provides a method for detecting abnormal behavior based on transaction data, the method comprising:

[0006] Get each field of transaction information within a set time period, as well as each attribute value of each field;

[0007] Combining the fields to obtain initial combination fields; determining, for each initial combination field, a difference representation value of the initial combination field according to each attribute value corresponding to the initial combination field; screening the initial combination fields according to each difference representation value to obtain each target combination field;

[0008] For each target combination field, combining each attribute value in the target combination field to obtain each initial attribute combination; for each initial attribute combination, determining the joint probability and conditional probability of the initial attribute combination based on the number of occurrences of each attribute value in the initial attribute combination; screening each initial attribute combination based on the joint probabilities and conditional probabilities to obtain each target attribute combination;

[0009] According to the number of transaction cards corresponding to each target attribute combination, the abnormal attribute evaluation value corresponding to each target attribute combination is determined; and abnormal behavior detection is performed based on the abnormal attribute evaluation value.

[0010] In a second aspect, the present application provides a device for detecting abnormal behavior based on transaction data, the device comprising:

[0011] The acquisition module is used to obtain each field of transaction information within a set time period, as well as each attribute value of each field;

[0012] a screening module configured to combine the fields to obtain initial combination fields; determine, for each initial combination field, a difference representation value of the initial combination field based on each attribute value corresponding to the initial combination field; and screen the initial combination fields based on each difference representation value to obtain each target combination field;

[0013] a determination module configured to combine, for each target combination field, each attribute value in the target combination field to obtain each initial attribute combination; determine, for each initial attribute combination, a joint probability and a conditional probability of the initial attribute combination based on the number of occurrences of each attribute value in the initial attribute combination; and screen each initial attribute combination based on the joint probabilities and conditional probabilities to obtain each target attribute combination;

[0014] The detection module is used to determine the abnormal attribute evaluation value corresponding to each target attribute combination according to the number of transaction cards corresponding to each target attribute combination; and perform abnormal behavior detection based on the abnormal attribute evaluation value.

[0015] In a third aspect, the present application provides an electronic device, comprising a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other via the communication bus;

[0016] Memory for storing computer programs;

[0017] The processor is configured to implement any of the above method steps when executing a program stored in the memory.

[0018] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of the above items are implemented.

[0019] The present application provides a method, apparatus, device, and medium for detecting abnormal behavior based on transaction data. The method includes: obtaining various fields of transaction information within a set time period, as well as various attribute values ​​of various fields; combining the various fields to obtain various initial combination fields; for each initial combination field, determining a difference characterization value of the initial combination field based on various attribute values ​​corresponding to the initial combination field; screening the various initial combination fields based on various difference characterization values ​​to obtain various target combination fields; for each target combination field, combining various attribute values ​​in the target combination field to obtain various initial attribute combinations; for each initial attribute combination, determining a joint probability and a conditional probability of the initial attribute combination based on the number of occurrences of various attribute values ​​in the initial attribute combination; screening the various initial attribute combinations based on various joint probabilities and conditional probabilities to obtain various target attribute combinations; determining an abnormal attribute evaluation value corresponding to each target attribute combination based on the number of transaction cards corresponding to each target attribute combination; and performing abnormal behavior detection based on the abnormal attribute evaluation value.

[0020] The above technical solution has the following advantages or beneficial effects:

[0021] In this application, each field of the transaction information within a set time period and each attribute value of each field are obtained, each field is combined, and after obtaining each initial combination field, each initial combination field is screened according to each difference characterization value. On the one hand, it saves the computing resource consumption of abnormal behavior detection and improves the processing speed. On the other hand, it improves the accuracy of abnormal behavior detection by screening each initial combination field according to each difference characterization value. Then, for each target combination field, screening is performed according to the joint probability and conditional probability of each initial attribute combination of the target combination field, and then the abnormal attribute evaluation value corresponding to each retained target attribute combination is determined, and finally abnormal behavior detection is performed according to the abnormal attribute evaluation value. This application combines all the fields and attribute values ​​in the transaction information to realize abnormal behavior detection, with more data dimensions, which further improves the accuracy of abnormal behavior detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0023] Figure 1 Schematic diagram of the abnormal behavior detection process based on transaction data provided by this application;

[0024] Figure 2 Flowchart for abnormal behavior detection based on transaction data provided for this application;

[0025] Figure 3 A schematic diagram of the structure of the abnormal behavior detection device based on transaction data provided by this application;

[0026] Figure 4 This is a schematic diagram of the electronic device structure provided in this application. DETAILED DESCRIPTION

[0027] In order to make the purpose and implementation of this application clearer, the exemplary implementation of this application will be clearly and completely described below in conjunction with the drawings in the exemplary embodiments of this application. Obviously, the described exemplary embodiments are only part of the embodiments of this application, not all of the embodiments.

[0028] It should be noted that the brief descriptions of terms in this application are only for the purpose of facilitating the understanding of the embodiments described below, and are not intended to limit the embodiments of this application. Unless otherwise specified, these terms should be understood according to their ordinary and usual meanings.

[0029] In the specification and claims of this application and the accompanying drawings, the terms "first," "second," "third," etc. are used to distinguish similar or similar objects or entities, and are not necessarily intended to limit a particular order or sequence, unless otherwise noted. It should be understood that the terms used in this manner are interchangeable under appropriate circumstances.

[0030] The terms "comprise," "include," and "have," and any variations thereof, are intended to cover but not exclude inclusion; for example, a product or device comprising a list of components is not necessarily limited to all the components expressly listed but may include other components not expressly listed or inherent to such product or device.

[0031] The term "module" refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware and / or software code that is capable of performing the functionality associated with that element.

[0032] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some or all of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

[0033] For ease of explanation, the above description has been made with reference to specific embodiments. However, the above exemplary discussion is not intended to be exhaustive or to limit the embodiments to the specific forms disclosed above. Based on the above teachings, various modifications and variations are possible. The above embodiments are selected and described to better explain the principles and practical applications, so that those skilled in the art can better utilize the embodiments and various different variations of the embodiments suitable for specific use considerations.

[0034] Figure 1 This is a schematic diagram of the abnormal behavior detection process based on transaction data provided by this application. The process includes the following steps:

[0035] S101: Acquire each field of transaction information within a set time period, and each attribute value of each field.

[0036] S102: Combining the various fields to obtain various initial combination fields; for each of the initial combination fields, determining the difference representation value of the initial combination field according to various attribute values ​​corresponding to the initial combination field; screening the various initial combination fields according to the various difference representation values ​​to obtain various target combination fields.

[0037] S103: For each target combination field, combine each attribute value in the target combination field to obtain each initial attribute combination; for each initial attribute combination, determine the joint probability and conditional probability of the initial attribute combination according to the number of occurrences of each attribute value in the initial attribute combination; based on the joint probabilities and conditional probabilities, screen each initial attribute combination to obtain each target attribute combination.

[0038] S104: Determine the abnormal attribute evaluation value corresponding to each target attribute combination according to the number of transaction cards corresponding to each target attribute combination; and perform abnormal behavior detection according to the abnormal attribute evaluation value.

[0039] The abnormal behavior detection method based on transaction data provided in this application is applied to an electronic device, which can be a PC, tablet computer or other device, or a server.

[0040] In this application, an electronic device retrieves each field of transaction information within a set time period, as well as each attribute value of each field. The set time period can be, for example, 6 hours, 12 hours, or a day. For example, the electronic device retrieves all transaction information for that day. Specifically, the transaction information is stored in a Hive database. When performing abnormal behavior detection, all transaction information within the set time period is retrieved from the Hive database. Furthermore, each field of the transaction information within the set time period, as well as each attribute value of each field, is retrieved.

[0041] It's important to note that Hive is a data warehouse tool based on Hadoop, used for data extraction, transformation, and loading. It's a mechanism for storing, querying, and analyzing large amounts of data stored in Hadoop. The Hive data warehouse tool maps structured data files into database tables and provides SQL query functionality, converting SQL statements into MapReduce tasks for execution. Hive's advantages include a low learning curve and the ability to implement fast MapReduce statistics using SQL-like statements, making MapReduce much simpler without the need to develop dedicated MapReduce applications. Hive is well-suited for statistical analysis of data warehouses.

[0042] The various fields of transaction information include the amount of each transaction, transaction time, transaction merchant, transaction location, name of the acceptance agency, and transaction application. The card attributes of the transaction bank card and the cardholder's gender, user ID, age, bank card registration date, community, etc. This application aggregates the transaction dimension into the transaction card dimension. At this time, for a transaction card, some features have multiple different attribute values. Therefore, the model filters out redundant attribute values ​​and selects the most important attribute values ​​under this feature, such as the current user's most frequent transaction location, most frequent consumer merchant, most frequent transaction APP, most frequent amount, most frequent acquiring agency, most frequent transaction time, etc. The transaction card is, for example, a bank card, credit card, etc. Examples of field attribute values ​​are as follows: the community ID field contains the attributes [community 1, community 2, community 3], the most frequent transaction merchant name field contains the attributes [supermarket 1, convenience store 2, restaurant 3], the most frequent accepting agency contains the attributes [institution 1, institution 2, institution 3], etc.

[0043] This application combines various fields to obtain various initial combination fields, wherein the initial combination fields include unary fields and multi-element combination fields. Unary fields are, for example, [community id], [name of the most frequently traded merchant], [most frequently accepted institution], etc., and multi-element combination fields are, for example, binary combination fields such as [community id, name of the most frequently traded merchant], ternary combination fields such as [community id, name of the most frequently traded merchant, most frequently accepted institution], and so on.

[0044] For each initial combination field, a difference representation value of the initial combination field is determined according to each attribute value corresponding to the initial combination field.

[0045] Specifically, perform the following operations for each unary field:

[0046] If the unary field is a numeric field, the difference characterization value of the unary field is determined based on the variance of each attribute value of the unary field; if the unary field is a binary attribute field, the difference characterization value of the unary field is determined based on the variance of the Bernoulli random variable of each attribute value of the unary field; if the unary field is a multi-attribute field, the probability distribution of each attribute is determined separately, and the difference characterization value of the unary field is determined based on the variance of each probability distribution;

[0047] Perform the following operations for each multi-combination field:

[0048] The difference characterization value of each field in the multi-combination field is determined respectively, and the difference characterization value of the multi-combination field is determined according to an average value of the difference characterization value of each field.

[0049] Numeric fields include age, amount, etc.; binary attribute fields include gender fields, which only have two attributes: male and female; multi-attribute fields include community ID fields that contain multiple attributes. If the unary field is a numeric field, input the attribute values ​​of the unary field into the variance calculation formula to calculate the variance, and the calculated variance can be directly used as the difference characterization value. If the unary field is a binary attribute field, determine the percentage of the number of occurrences of each attribute value in the field, and use the product of the two percentages as the difference characterization value of the unary field. If the unary field is a multi-attribute field, determine the probability distribution of each attribute separately, and then input the probability distribution of each attribute into the variance calculation formula to calculate the variance, and the calculated variance can be directly used as the difference characterization value. For each multi-combination field, determine the difference characterization value of each field in the multi-combination field separately, and determine the difference characterization value of the multi-combination field based on the average value of the difference characterization value of each field.

[0050] The initial combination fields are filtered based on the difference characterization values ​​to obtain target combination fields. Specifically, for each difference characterization value, if the difference characterization value is greater than a set difference characterization threshold, the initial combination field corresponding to the difference characterization value is retained as the target combination field; otherwise, the initial combination field corresponding to the difference characterization value is filtered out.

[0051] Furthermore, to reduce the computational complexity of abnormal behavior detection, before combining the fields to obtain the initial combined fields, the method further includes filtering out the transaction information of each transaction card in the transaction information if the number of transactions for that transaction card is less than a set threshold. The set threshold may be, for example, 2 or 3 times.

[0052] For each target combination field, the attribute values ​​in the target combination field are combined to obtain each initial attribute combination, which includes single attribute and multi-attribute combinations. Single attribute combinations include [community 1], [community 2], etc. Multi-attribute combinations include binary attribute combinations such as [community 1, supermarket 1], [community 1, convenience store 2], [convenience store 2, institution 2], and ternary attribute combinations such as [community 1, supermarket 1, convenience store 1]. For each initial attribute combination, the joint probability and conditional probability of the initial attribute combination are determined based on the number of occurrences of each attribute value in the initial attribute combination; based on the joint probabilities and conditional probabilities, the initial attribute combinations are screened to obtain each target attribute combination.

[0053] Specifically, for each attribute value of each target combination field, a first joint probability of the attribute value is determined based on the number of occurrences of the attribute value; and attribute values ​​corresponding to the first joint probabilities that are greater than a set joint probability threshold are retained. The first joint probability of the attribute value is determined based on the ratio of the number of occurrences of the attribute value to the total number of transaction cards.

[0054] The retained attribute values ​​are arbitrarily combined to obtain various binary attribute combinations. For each binary attribute combination, the second joint probability and the first conditional probability of the binary attribute combination are determined according to the number of times each attribute value appears in the binary attribute combination; the binary attribute combinations corresponding to the second joint probability greater than the set joint probability threshold and the first conditional probability greater than the set conditional probability threshold are retained.

[0055] Specifically, the second joint probability is determined based on the ratio of the number of times each attribute value in the binary attribute combination appears simultaneously to the total number of transaction cards; the number of times each attribute value in the binary attribute combination appears is determined, and the minimum number is selected, and the first conditional probability is determined based on the ratio of the number of times each attribute value in the binary attribute combination appears simultaneously to the minimum number.

[0056] The retained binary attribute combinations and the retained attribute values ​​are arbitrarily combined to obtain ternary attribute combinations, and the ternary attribute combinations are screened based on the set joint probability threshold and the set conditional probability threshold. All attribute combinations are obtained through iteration as the target attribute combinations.

[0057] Then, according to the number of transaction cards corresponding to each target attribute combination, the abnormal attribute evaluation value corresponding to each target attribute combination is determined; and abnormal behavior detection is performed based on the abnormal attribute evaluation value.

[0058] Specifically, for each target combination field, perform the following operations:

[0059] Select each first target attribute combination whose corresponding number of transaction cards is less than a set number threshold, and determine the first sub-abnormal attribute evaluation value based on the ratio of the sum of the number of transaction cards corresponding to each first target attribute combination to the total number of transaction cards;

[0060] Selecting the second target attribute combination corresponding to the largest number of transaction cards, determining an average value of the number of transaction cards corresponding to each third target attribute combination other than the second target attribute combination and each of the first target attribute combinations, and determining a second sub-abnormality attribute evaluation value based on a ratio of the number of transaction cards corresponding to the second target attribute combination to the average value;

[0061] Abnormal behavior detection is performed according to the first sub-abnormal attribute evaluation value and the second sub-abnormal attribute evaluation value of each target combination field.

[0062] Specifically, for each target combination field, arrange them in descending order according to the number of fields included, the first sub-abnormal attribute evaluation value, and the second sub-abnormal attribute evaluation value, select a set number of target combination fields that are ranked first, and determine that each target attribute combination in the selected target combination field is the attribute combination corresponding to the abnormal behavior.

[0063] The priority of the number of fields, the first sub-anomaly attribute evaluation value, and the second sub-anomaly attribute evaluation value can be set. For example, the number of fields has the highest priority, the first sub-anomaly attribute evaluation value has the second highest priority, and the second sub-anomaly attribute evaluation value has the lowest priority. Then, when sorting, first sort in descending order by the number of fields included. If the number of fields included is the same, then sort in descending order by the first sub-anomaly attribute evaluation value. If the first sub-anomaly attribute evaluation values ​​are the same, then sort in descending order by the second sub-anomaly attribute evaluation value.

[0064] The following describes in detail the abnormal behavior detection process based on transaction data provided by this application through specific examples.

[0065] Figure 2This application provides a flowchart for abnormal behavior detection based on transaction data. It includes: extracting transaction data; data preprocessing, which includes dirty data cleaning, missing value filling, and outlier processing; data analysis and processing; bank card screening; calculation of additional bank card features; field distillation, including field combination and variance filtering; attribute aggregation, including attribute combination, confidence, and support filtering, where support is joint probability and confidence is conditional probability; evaluation and sorting after multiple iterations, calculation of the first sub-abnormal attribute evaluation value r1 and the second sub-abnormal attribute evaluation value r2, counting the number of feature combinations, sorting in descending order, and outputting the results.

[0066] Large-scale abnormal behavior typically refers to a cluster of unusual characteristics across a specific attribute or behavior, or across multiple different attributes and behaviors. From a global perspective, abnormal behavior clearly differs from normal individual cardholder behavior. Due to differences in payment scenarios, geography, and individual intentions, transactions generated by individual cardholders at different times and locations are unlikely to have a potential correlation. Conversely, abnormal financial transactions inevitably generate a large number of similar characteristics and behaviors, such as the use of the same transaction application, a fixed number of transactions, the same acquiring institution, and a close geographic location.

[0067] Through the above analysis, this application classifies all bank card groups with abnormal high-frequency transactions as suspicious abnormal behaviors that require special attention. An unsupervised algorithm is used to cluster dense abnormal behaviors in large-scale data. Since transaction data has the characteristics of multiple fields and multiple attributes, this application first designs a field distillation method to distill significant field combinations from a massive non-empty set of fields and discard highly overlapping low-significance field combinations. On the one hand, it saves the computing resource consumption of the model and improves the subsequent bank card aggregation speed. On the other hand, discarding useless field combinations improves the accuracy of abnormal behavior detection. The attribute aggregation method is used to iteratively obtain bank card combinations that meet the conditions from the distilled field combinations. Behind these bank card combinations are potential abnormal behaviors. Finally, the model scores and ranks the potential abnormal behaviors that have been screened out, locates the final real abnormal behavior, and organizes the real abnormal behavior data to the business department. Finally, manual analysis is performed to obtain a specific description of the abnormal behavior.

[0068] During the field subset distillation process, unimportant subsets are filtered out from a large number of field subsets, ultimately identifying significant field combinations. For numerical features, the variance of each field is used to evaluate field significance. For binary attributes, the variance of a Bernoulli random variable is used to evaluate field significance. For fields with multiple attributes, the probability distribution of each attribute is calculated, followed by the variance of the probability distribution, to determine the significance of the multiple attribute field. Finally, field combinations with low significance are discarded.

[0069] During the attribute aggregation process, the concepts of support and confidence are introduced. Multiple attributes are iteratively combined, and the support and confidence of each combination are used to filter out sparse transaction combinations. This results in dense transaction combinations, representing potentially suspicious anomalies. Finally, the model ranks and scores all suspicious anomalies. r1 is defined as the proportion of the total size of feature combinations with a number of less than 3 in the same feature space. r2 is defined as the size of the largest top group divided by the average number of bank cards in groups with a size greater than 3, excluding the top group. All bank card features are manually divided into 10 groups, and the total number of feature groups in each frequent item set is calculated. Finally, the frequent items are sorted in descending order by the number of feature combinations, r1, and r2, ultimately resulting in highly suspicious anomalies.

[0070] To mine relationships between cardholders and unusual relationship networks from massive amounts of transaction data, this application requires identifying interconnected bank cards, discovering potential communities formed by these connected bank cards, and then evaluating all these communities to identify suspicious, unusual communities. To discover the relationships between these massive amounts of bank cards and identify the unusually high-frequency features associated with unusual behavior, we introduce support and confidence methods to calculate the strength of associations between bank cards.

[0071] There are multiple fields in the current transaction data, and even a single field contains a large amount of characteristic attribute information. For example, the acquirer field contains the names of the head offices of acquirers across the country. Before finding high-frequency attribute combinations, it is necessary to traverse all field combinations. We first combine all fields in the transaction and extract all non-empty sets in the transaction field set. However, the number of non-empty subsets of a set increases exponentially with the increase in the number of fields in the set. Currently, each transaction contains many fields to save the attribute information of the transaction, so a large number of field subsets will be obtained after the field combination. In order to reduce computing resource consumption, increase computing speed, and enhance the ability to identify abnormal behavior. This application adds a field subset distillation method to filter out unimportant subsets from a large number of field subsets, and finally screen out important field combination methods.

[0072] For numerical features, we use the variance of each field to evaluate the field's significance. For binary attributes, we use the variance of the Bernoulli random variable to evaluate the field's significance. For fields with multiple attributes, we calculate the probability distribution of each attribute, then the variance of the probability distribution, and finally determine the significance of the multiple attribute field.

[0073] When a feature's variance is small, it's considered to have little variability, suggesting that most of its attributes are likely the same, meaning its significance is weak. When distilling field subsets, we calculate the mean of all fields in the subset. Fields with variances that don't meet a given threshold are discarded, ultimately resulting in the distilled field subset.

[0074] Given a set of fields from the distilled field subset, the model first counts the occurrences of all attributes in the field. The model then calculates the support and confidence of each attribute, discarding those below a given threshold. The model then combines these attributes based on the previously filtered attributes to generate a set of two attribute combinations. The model then calculates the support and confidence of each combination, discarding those below a given threshold. Next, the model generates a larger set of attribute combinations based on the two attribute combinations filtered in the previous step. The model then calculates the support and confidence of each combination, selecting combinations that meet the given threshold. This process repeats until the model is unable to generate new attribute combinations, at which point iteration for the current set of fields ceases. The model then begins counting the next set of fields, ultimately capturing all suspicious anomalies in the massive transaction data.

[0075] Finally, the model ranks and scores all suspicious abnormal behaviors. r1 is defined as the sum of the sizes of feature combinations with a number of less than or equal to 3 in the same feature space. r2 is defined as the size of the top group divided by the combined average size of feature combinations with a number of greater than 3 in the same feature space. The r1 and r2 values ​​of all frequent itemsets are calculated, retaining results with r1 > 0.8 and r2 > 10. All bank card features are manually divided into 10 groups, and the total number of feature groups in each frequent item set, i.e., feature_group_num, is calculated. The highly suspicious abnormal behavior groups are finally identified by sorting them in descending order of feature_group_num, r1, and r2.

[0076] Finally, the model identifies abnormal behavior clusters, then conducts behavioral analysis on the merchant or card side to check for similarities in non-transactional descriptive information. This analysis is then reviewed with the business side. This unsupervised clustering method primarily identifies clusters of transactions that are similar in transaction data and frequently appear in non-data fields. These clusters are then identified as abnormal behaviors at the network data level. Finally, manual analysis of the data reveals the specific behaviors described.

[0077] The following are examples:

[0078] Extract the day's raw transaction information from the Hive database, including fields such as bank card account number, card attributes, user ID, application name, transaction amount, transaction time, discount type, merchant name, acceptance institution name, community ID, gender, age, bank card registration date, QR code order type, latitude and longitude. Then, clean the dirty data, fill in missing values, and handle outliers.

[0079] Filter the extracted transactions for bank cards with more than two transactions, calculate additional features for the bank cards, and aggregate the transaction dimension into the card dimension. A record now includes fields such as bank card account number, card attributes, user ID, community ID, gender, age, bank card registration date, most frequent transaction location, most frequent merchant name, most frequent application name, most frequent acceptance institution name, most frequent transaction amount, number of transactions under 1 yuan, number of transactions under 10 yuan, number of transactions under 100 yuan, most frequent transaction time, total number of transactions, total transaction amount, and total number of merchants.

[0080] In the decision engine, the field distillation module first identifies significant field combinations from all field subsets. Unary combinations include (community ID), (gender), (age), (most frequently transacted merchant name), (most frequently accepted institution, etc.), and binary combinations include (community ID, gender), (community ID, most frequently transacted merchant name), (most frequently transacted merchant name, most frequently accepted institution, etc.), and so on, resulting in an N-ary combination encompassing all fields. Using the significance calculation method designed in this proposal, the significance of each field combination is calculated, and combinations with lower significance are filtered out. Finally, the most significant field combinations are distilled to obtain them for further analysis.

[0081] The attribute aggregation module processes the field combinations obtained from the field distillation module. For a single field combination, the attribute module iterates all attributes step by step, calculates the support and confidence (i.e., joint probability and conditional probability) of all attribute combinations, and generalizes the attributes from unary combinations to multi-ary combinations. Once a low-ary combination does not meet the screening threshold conditions, its corresponding high-ary combination does not meet the screening conditions. Therefore, this application will perform a pruning operation and no longer calculate all attribute combinations in its high-ary combination. For example, there is a field combination (community id, most frequently traded merchant name, most frequently accepted institution), where the community id field contains the attributes [community 1, community 2, community 3], the most frequently traded merchant name field contains the attributes [supermarket 1, convenience store 2, restaurant 3], and the most frequently accepted institution contains the attributes [institution 1, institution 2, institution 3]. The attribute aggregation module first calculates the support and confidence of all unigram attributes, such as [community 1], [community 2], [community 3], [supermarket 1], [convenience store 2], [restaurant 3], [institution 1], [institution 2], [institution 3]. The attributes [community 1], [community 2], [supermarket 1], [convenience store 2], [institution 1], [institution 2] that meet a given threshold are retained, and [community 3], [restaurant 3], [institution 3], and their subsequent multi-tuple combinations are pruned. The unigram combinations from the previous step are combined to obtain binary combinations such as [community 1, supermarket 1], [community 1, convenience store 2], [convenience store 2, institution 2]. The support and confidence of all binary attribute combinations are calculated, and attributes that meet a given threshold are retained. Attributes below the given threshold and their subsequent multi-tuple combinations are pruned. This step is repeated multiple times to obtain an M-tuple attribute combination of multiple attributes and calculate the index size.

[0082] By iterating the above steps multiple times, this proposal aggregates multiple groups. Assume that these include 293 groups (attribute groups), including [Community 1, Supermarket 1], [Community 1, Convenience Store 2], [Community 1, Restaurant 3], [Community 1, Stationery Store 4], ..., [Community N, Coffee Shop M]. They all come from the same feature space, that is, the field combination (community ID, most frequently traded merchant name), and contain a total of 1,000 bank cards. Of these, 290 attribute groups have a size of less than 3, totaling 850 bank cards. The remaining two groups have a size of 10 (each containing 10 bank cards), and one group has a size of 130 (130 bank cards).

[0083] To evaluate and rank abnormal behavior, we first calculate the total number of bank cards in the group with less than 3 bank cards and divide it by the total number of bank cards to obtain the ratio r1, i.e., r1 = 850 / 1000, which is greater than 0.8. We then calculate the number of bank cards in the largest group divided by the average number of bank cards in the groups with a size greater than 3, excluding the top group, to obtain r2, i.e., r2 = 130 / ((10 + 10) / 2) > 10. Pre-defined rules retain results where r1 > 0.8 and r2 > 10. Field binding relationships are also provided. Based on data and business analysis, closely related fields are grouped together. Assuming the current field combination includes the binding fields (a1, a2, a3) and (b1, b2, b3), the number of feature groups is 2. Finally, we sort the data in descending order based on the number of feature groups, r1, and r2, to identify highly suspicious abnormal behavior groups.

[0084] Finally, we conduct multi-faceted behavioral analysis on the abnormal behavior clusters identified by the model, examining whether the non-transactional descriptive information is similar. This analysis is then reviewed with the business side. This unsupervised clustering method primarily identifies clusters of transactions that are similar in transaction data and frequently occur in non-data fields. We consider these to be abnormal behavior within the UnionPay network data. Finally, manual analysis is performed to identify the specific behaviors described in the data.

[0085] Figure 3 The schematic diagram of the structure of the abnormal behavior detection device based on transaction data provided in this application includes:

[0086] The acquisition module 31 is used to obtain each field of the transaction information within a set time period, as well as each attribute value of each field;

[0087] The screening module 32 is configured to combine the fields to obtain initial combination fields; determine, for each initial combination field, a difference representation value of the initial combination field based on each attribute value corresponding to the initial combination field; and screen the initial combination fields based on the difference representation values ​​to obtain target combination fields;

[0088] The determination module 33 is configured to combine the attribute values ​​in each target combination field to obtain each initial attribute combination; determine the joint probability and conditional probability of each initial attribute combination based on the number of occurrences of each attribute value in the initial attribute combination; and screen each initial attribute combination based on the joint probabilities and conditional probabilities to obtain each target attribute combination;

[0089] The detection module 34 is configured to determine the abnormal attribute evaluation value corresponding to each target attribute combination according to the number of transaction cards corresponding to each target attribute combination, and perform abnormal behavior detection based on the abnormal attribute evaluation value.

[0090] The screening module 32 is specifically used for the initial combination fields including unary fields and multi-component combination fields; the following operations are performed for each unary field: if the unary field is a numerical field, the difference characterization value of the unary field is determined according to the variance of each attribute value of the unary field; if the unary field is a binary attribute field, the difference characterization value of the unary field is determined according to the variance of the Bernoulli random variable of each attribute value of the unary field; if the unary field is a multi-component attribute field, the probability distribution of each attribute is determined separately, and the difference characterization value of the unary field is determined according to the variance of each probability distribution; the following operations are performed for each multi-component combination field: the difference characterization value of each field in the multi-component combination field is determined separately, and the difference characterization value of the multi-component combination field is determined according to the average value of the difference characterization value of each field.

[0091] The screening module 32 is specifically configured to, for each difference characterization value, if the difference characterization value is greater than a set difference characterization threshold, retain the initial combination field corresponding to the difference characterization value as the target combination field; otherwise, filter out the initial combination field corresponding to the difference characterization value.

[0092] The screening module 32 is further configured to filter out the transaction information of each transaction card in the transaction information if the number of transactions of the transaction card is less than a set number threshold.

[0093] The determination module 33 is specifically used to determine, for each attribute value of each target combination field, the first joint probability of the attribute value according to the number of occurrences of the attribute value; retain the attribute value corresponding to the first joint probability that is greater than the set joint probability threshold; arbitrarily combine the retained attribute values ​​to obtain each binary attribute combination, and for each binary attribute combination, determine the second joint probability and the first conditional probability of the binary attribute combination according to the number of occurrences of each attribute value in the binary attribute combination; retain the binary attribute combination corresponding to the second joint probability that is greater than the set joint probability threshold and the first conditional probability that is greater than the set conditional probability threshold; arbitrarily combine the retained binary attribute combinations with the retained attribute values ​​to obtain each ternary attribute combination, and screen each ternary attribute combination based on the set joint probability threshold and the set conditional probability threshold, and continue to iterate to obtain all attribute combinations as each target attribute combination.

[0094] The determination module 33 is specifically configured to determine the second joint probability based on the ratio of the number of simultaneous appearances of each attribute value in the binary attribute combination to the total number of transaction cards; determine the number of appearances of each attribute value in the binary attribute combination, select the minimum number of appearances, and determine the first conditional probability based on the ratio of the number of simultaneous appearances of each attribute value in the binary attribute combination to the minimum number of appearances.

[0095] The detection module 34 is specifically configured to perform the following operations for each target combination field: select each first target attribute combination whose corresponding transaction card quantity is less than a set quantity threshold, and determine a first sub-abnormal attribute evaluation value based on the ratio of the sum of the transaction card quantities corresponding to each first target attribute combination to the total number of transaction cards; select a second target attribute combination corresponding to the largest number of transaction cards, determine the average value of the transaction card quantities corresponding to each third target attribute combination excluding the second target attribute combination and each first target attribute combination, and determine a second sub-abnormal attribute evaluation value based on the ratio of the transaction card quantities corresponding to the second target attribute combination to the average value; and perform abnormal behavior detection based on the first sub-abnormal attribute evaluation value and the second sub-abnormal attribute evaluation value of each target combination field.

[0096] The detection module 34 is specifically used to sort each target combination field in descending order according to the number of fields included, the first sub-abnormal attribute evaluation value and the second sub-abnormal attribute evaluation value, select a set number of target combination fields that are ranked first, and determine that each target attribute combination in the selected target combination field is an attribute combination corresponding to the abnormal behavior.

[0097] The present application also provides an electronic device, such as Figure 4 As shown, it includes: a processor 301, a communication interface 302, a memory 303 and a communication bus 304, wherein the processor 301, the communication interface 302, and the memory 303 communicate with each other through the communication bus 304;

[0098] The memory 303 stores a computer program, and when the program is executed by the processor 301 , the processor 301 performs any of the above method steps.

[0099] The communication bus mentioned in the electronic device mentioned above may be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus. This communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is used in the figure, but this does not mean that there is only one bus or only one type of bus.

[0100] The communication interface 302 is used for communication between the electronic device and other devices.

[0101] The memory may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk memory. Alternatively, the memory may be at least one storage device located away from the processor.

[0102] The above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0103] The present application also provides a computer storage readable storage medium, which stores a computer program that can be executed by an electronic device. When the program runs on the electronic device, the electronic device implements any of the above method steps when executing.

[0104] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0105] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A method for detecting abnormal behavior based on transaction data, characterized in that: The method comprises: Get each field of transaction information within a set time period, as well as each attribute value of each field; Combining the fields to obtain initial combination fields; determining, for each initial combination field, a difference representation value of the initial combination field according to each attribute value corresponding to the initial combination field; screening the initial combination fields according to each difference representation value to obtain each target combination field; For each target combination field, combining each attribute value in the target combination field to obtain each initial attribute combination; for each initial attribute combination, determining the joint probability and conditional probability of the initial attribute combination based on the number of occurrences of each attribute value in the initial attribute combination; screening each initial attribute combination based on the joint probabilities and conditional probabilities to obtain each target attribute combination; For each target combination field, perform the following operations: Select each first target attribute combination whose corresponding number of transaction cards is less than a set number threshold, and determine the first sub-abnormal attribute evaluation value based on the ratio of the sum of the number of transaction cards corresponding to each first target attribute combination to the total number of transaction cards; Selecting the second target attribute combination corresponding to the largest number of transaction cards, determining an average value of the number of transaction cards corresponding to each third target attribute combination other than the second target attribute combination and each of the first target attribute combinations, and determining a second sub-abnormality attribute evaluation value based on a ratio of the number of transaction cards corresponding to the second target attribute combination to the average value; Abnormal behavior detection is performed according to the first sub-abnormal attribute evaluation value and the second sub-abnormal attribute evaluation value of each target combination field.

2. The method according to claim 1, wherein The determining, for each of the initial combination fields, according to each attribute value corresponding to the initial combination field, of a difference representation value of the initial combination field includes: Each of the initial combination fields includes a unary field and a multi-element combination field; Perform the following operations for each unigram field: If the unary field is a numeric field, the difference characterization value of the unary field is determined based on the variance of each attribute value of the unary field; if the unary field is a binary attribute field, the difference characterization value of the unary field is determined based on the variance of the Bernoulli random variable of each attribute value of the unary field; if the unary field is a multi-attribute field, the probability distribution of each attribute is determined separately, and the difference characterization value of the unary field is determined based on the variance of each probability distribution; Perform the following operations for each multi-combination field: The difference characterization value of each field in the multi-combination field is determined respectively, and the difference characterization value of the multi-combination field is determined according to an average value of the difference characterization value of each field.

3. The method according to claim 1, wherein The initial combination fields are screened according to the difference characterization values ​​to obtain target combination fields, including: For each difference characterization value, if the difference characterization value is greater than a set difference characterization threshold, the initial combination field corresponding to the difference characterization value is used as the target combination field and retained; otherwise, the initial combination field corresponding to the difference characterization value is filtered out.

4. The method according to claim 1, wherein Before combining the fields to obtain initial combination fields, the method further includes: For each transaction card in the transaction information, if the transaction times of the transaction card is less than a set times threshold, the transaction information of the transaction card is filtered out.

5. The method according to claim 1, wherein include: For each attribute value of each target combination field, determining a first joint probability of the attribute value according to the number of occurrences of the attribute value; The attribute value corresponding to the first joint probability greater than the set joint probability threshold is retained; Arbitrarily combine the retained attribute values ​​to obtain various binary attribute combinations. For each binary attribute combination, determine the second joint probability and the first conditional probability of the binary attribute combination based on the number of times each attribute value appears in the binary attribute combination; retain the binary attribute combinations corresponding to the second joint probability greater than the set joint probability threshold and the first conditional probability greater than the set conditional probability threshold; The retained binary attribute combinations and the retained attribute values ​​are arbitrarily combined to obtain ternary attribute combinations, and the ternary attribute combinations are screened based on the set joint probability threshold and the set conditional probability threshold. All attribute combinations are obtained through iteration as the target attribute combinations.

6. The method according to claim 5, wherein Determining the second joint probability and the first conditional probability of the binary attribute combination according to the number of occurrences of each attribute value in the binary attribute combination includes: determining the second joint probability based on a ratio of the number of times each attribute value in the binary attribute combination appears simultaneously to the total number of transaction cards; The number of occurrences of each attribute value in the binary attribute combination is determined, and the minimum number is selected. The first conditional probability is determined according to the ratio of the number of simultaneous occurrences of each attribute value in the binary attribute combination to the minimum number.

7. The method according to claim 1, wherein The abnormal behavior detection according to the first sub-abnormal attribute evaluation value and the second sub-abnormal attribute evaluation value of each target combination field includes: For each target combination field, arrange them in descending order according to the number of fields included, the first sub-abnormal attribute evaluation value and the second sub-abnormal attribute evaluation value, select a set number of target combination fields that are ranked first, and determine that each target attribute combination in the selected target combination field is the attribute combination corresponding to the abnormal behavior.

8. An abnormal behavior detection device based on transaction data, characterized in that: The device comprises: The acquisition module is used to obtain each field of transaction information within a set time period, as well as each attribute value of each field; a screening module configured to combine the fields to obtain initial combination fields; determine, for each initial combination field, a difference representation value of the initial combination field based on each attribute value corresponding to the initial combination field; and screen the initial combination fields based on each difference representation value to obtain each target combination field; a determination module configured to combine, for each target combination field, each attribute value in the target combination field to obtain each initial attribute combination; determine, for each initial attribute combination, a joint probability and a conditional probability of the initial attribute combination based on the number of occurrences of each attribute value in the initial attribute combination; and screen each initial attribute combination based on the joint probabilities and conditional probabilities to obtain each target attribute combination; The detection module is used to perform the following operations for each target combination field: select each first target attribute combination whose corresponding transaction card quantity is less than a set quantity threshold, and determine the first sub-abnormal attribute evaluation value based on the ratio of the sum of the transaction card quantities corresponding to each first target attribute combination to the total number of transaction cards; select the second target attribute combination with the largest number of corresponding transaction cards, determine the average value of the transaction card quantities corresponding to each third target attribute combination other than the second target attribute combination and each first target attribute combination, and determine the second sub-abnormal attribute evaluation value based on the ratio of the transaction card quantities corresponding to the second target attribute combination to the average value; and perform abnormal behavior detection based on the first sub-abnormal attribute evaluation value and the second sub-abnormal attribute evaluation value of each target combination field.

9. The device according to claim 8, wherein The screening module is specifically used for the initial combination fields including unary fields and multi-component combination fields; the following operations are performed for each unary field: if the unary field is a numerical field, the difference characterization value of the unary field is determined according to the variance of each attribute value of the unary field; if the unary field is a binary attribute field, the difference characterization value of the unary field is determined according to the variance of the Bernoulli random variable of each attribute value of the unary field; if the unary field is a multi-component attribute field, the probability distribution of each attribute is determined separately, and the difference characterization value of the unary field is determined according to the variance of each probability distribution; the following operations are performed for each multi-component combination field: the difference characterization value of each field in the multi-component combination field is determined separately, and the difference characterization value of the multi-component combination field is determined according to the average value of the difference characterization value of each field.

10. The device according to claim 8, wherein The screening module is specifically configured to, for each difference characterization value, if the difference characterization value is greater than a set difference characterization threshold, retain the initial combination field corresponding to the difference characterization value as the target combination field; otherwise, filter out the initial combination field corresponding to the difference characterization value.

11. The device according to claim 8, wherein The screening module is further configured to filter out the transaction information of each transaction card in the transaction information if the number of transactions of the transaction card is less than a set number threshold.

12. The device according to claim 8, wherein The determination module is specifically used to determine, for each attribute value of each target combination field, the first joint probability of the attribute value according to the number of occurrences of the attribute value; retain the attribute value corresponding to the first joint probability that is greater than the set joint probability threshold; arbitrarily combine the retained attribute values ​​to obtain each binary attribute combination, and for each binary attribute combination, determine the second joint probability and the first conditional probability of the binary attribute combination according to the number of occurrences of each attribute value in the binary attribute combination; retain the binary attribute combination corresponding to the second joint probability that is greater than the set joint probability threshold and the first conditional probability that is greater than the set conditional probability threshold; arbitrarily combine the retained binary attribute combinations with the retained attribute values ​​to obtain each ternary attribute combination, and screen each ternary attribute combination based on the set joint probability threshold and the set conditional probability threshold, and continue to iterate to obtain all attribute combinations as each target attribute combination.

13. The device according to claim 12, wherein The determination module is specifically configured to determine the second joint probability based on a ratio of the number of simultaneous appearances of each attribute value in the binary attribute combination to the total number of transaction cards; determine the number of appearances of each attribute value in the binary attribute combination, select the minimum number of appearances therein, and determine the first conditional probability based on the ratio of the number of simultaneous appearances of each attribute value in the binary attribute combination to the minimum number of appearances.

14. The device according to claim 13, wherein The detection module is specifically used to arrange each target combination field in descending order according to the number of fields included, the first sub-abnormal attribute evaluation value and the second sub-abnormal attribute evaluation value, select a set number of target combination fields that are ranked first, and determine that each target attribute combination in the selected target combination field is an attribute combination corresponding to the abnormal behavior.

15. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; Memory for storing computer programs; A processor, configured to implement the method steps described in any one of claims 1 to 7 when executing a program stored in a memory.

16. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps according to any one of claims 1 to 7 are implemented.

Images