Method and apparatus for processing resource interaction data, computer device and storage medium

Abstract

The application relates to a resource interaction data processing method and device, computer equipment and a storage medium, comprising the following steps: determining the independent stability degree of each resource interaction feature in a plurality of resource interaction features of a subject identifier according to the feature data corresponding to the resource interaction feature; determining the cross fluctuation degree between any two resource interaction features in the plurality of resource interaction features of the subject identifier according to the feature data corresponding to the two resource interaction features; performing abnormal identifier identification on the subject identifier based on the independent stability degree of each resource interaction feature in the plurality of resource interaction features and the cross fluctuation degree between any two resource interaction features in the plurality of resource interaction features, to obtain an identification result for representing whether the subject identifier is an abnormal identifier. The method can improve the identification accuracy of abnormal subject identifiers.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method, apparatus, computer device, and storage medium for processing resource interaction data. Background Technology

[0002] With the development of computer and internet technologies, various entities have emerged, such as online merchants, electronic payment accounts, websites, applications, and mini-programs. However, some of these entities are considered abnormal, such as those engaging in unfair competition (e.g., merchants using fake orders to boost sales) or illegal transactions (e.g., merchants using online stores for high-risk transactions). Therefore, to maintain a fair and competitive online transaction order and safeguard cybersecurity, it is necessary to promptly identify and address these abnormal entities.

[0003] Taking online merchants as an example, current identification methods mostly involve checking for sudden increases in transactions; if such an increase is observed, the merchant is deemed abnormal. However, this identification method is not accurate enough. Summary of the Invention

[0004] Therefore, it is necessary to provide a method, apparatus, computer equipment, and storage medium for processing resource interaction data that can improve the accuracy of identifying abnormal subject identifiers, in order to address the above-mentioned technical problems.

[0005] A method for processing resource interaction data, the method comprising:

[0006] Obtain the resource interaction data corresponding to the subject identifier; the resource interaction data includes feature data corresponding to each of multiple different resource interaction features;

[0007] Based on the feature data corresponding to each resource interaction feature, the degree of independence and stability of the corresponding resource interaction feature is determined; the degree of independence and stability is used to characterize the degree of fluctuation of the feature data corresponding to the resource interaction feature itself.

[0008] Based on the feature data corresponding to any two resource interaction features among the plurality of resource interaction features, the degree of cross-fluctuation between the two resource interaction features is determined; the degree of cross-fluctuation is used to characterize the degree of distribution difference between the feature data corresponding to the two resource interaction features.

[0009] Based on the independent stability of each of the multiple resource interaction features and the degree of cross-fluctuation between any two of the multiple resource interaction features, the subject identifier is subjected to anomaly identification to obtain an identification result that characterizes whether the subject identifier is an anomaly identifier.

[0010] A resource interaction data processing apparatus, the apparatus comprising:

[0011] The acquisition module is used to acquire resource interaction data corresponding to the subject identifier; the resource interaction data includes feature data corresponding to each of multiple different resource interaction features.

[0012] The independent stability determination module is used to determine the independent stability of the corresponding resource interaction feature based on the feature data corresponding to each resource interaction feature; the independent stability is used to characterize the degree of fluctuation of the feature data corresponding to the resource interaction feature itself.

[0013] The cross-fluctuation degree determination module is used to determine the cross-fluctuation degree between any two resource interaction features based on the feature data corresponding to any two resource interaction features among the plurality of resource interaction features; the cross-fluctuation degree is used to characterize the degree of distribution difference between the feature data corresponding to any two resource interaction features;

[0014] The identification module is used to identify the main entity identifier based on the independent stability of each of the multiple resource interaction features and the degree of cross-fluctuation between any two of the multiple resource interaction features, and to obtain an identification result that characterizes whether the main entity identifier is an abnormal identifier.

[0015] In one embodiment, the resource interaction data is generated based on resource interaction records generated in each unit time period of the target time period; the independence and stability determination module is further configured to: for each resource interaction feature, determine the feature data corresponding to each unit time period based on the resource interaction records generated in each unit time period; calculate the distribution dispersion of the feature data corresponding to the resource interaction feature in the target time period based on the feature data corresponding to each unit time period; and normalize the distribution dispersion based on the total duration of the target time period to obtain the independence and stability degree corresponding to the resource interaction feature.

[0016] In one embodiment, the independent stability determination module is further configured to: when the resource interaction feature is a transaction value, calculate the unit transaction value generated in each unit time period based on the transaction records generated in each unit time period, and use it as the feature data corresponding to the transaction value in each unit time period; when the resource interaction feature is the number of transactions, calculate the unit number of transactions generated in each unit time period based on the transaction records generated in each unit time period, and use it as the feature data corresponding to the number of transactions in each unit time period; when the resource interaction feature is the number of trading parties, calculate the unit number of trading parties generated in each unit time period based on the transaction records generated in each unit time period, and use it as the feature data corresponding to the number of trading parties in each unit time period.

[0017] In one embodiment, the independent stability determination module is further configured to: determine the total amount of data corresponding to the resource interaction feature in the target time period; and calculate the distribution dispersion of the feature data corresponding to the resource interaction feature in the target time period based on the ratio of the feature data of each unit time to the total amount of data.

[0018] In one embodiment, the independence stability determination module is further configured to calculate the independence stability corresponding to the resource interaction feature using the following formula:

[0019]

[0020]

[0021]

[0022] Among them, H fea This indicates the degree of dispersion of the feature data corresponding to the resource interaction characteristics within the target time period; D span D represents the total duration of the target time period. act This represents the sum of unit times generated by resource interaction records within the target time period; fea i This represents the feature data of the resource interaction feature at the unit time in which the resource interaction record is generated, where fea all This represents the total amount of data corresponding to the resource interaction features within the target time period; F fea This indicates the degree of independence and stability corresponding to the resource interaction characteristics.

[0023] In one embodiment, any two of the plurality of resource interaction features are respectively a first resource interaction feature and a second resource interaction feature; the resource interaction data is generated based on resource interaction records generated in each unit time of the target time period; the cross-fluctuation degree determination module is further configured to: determine the first feature data corresponding to each unit time of the first resource interaction feature; determine the second feature data corresponding to each unit time of the second resource interaction feature; calculate the distribution difference degree between the first resource interaction feature and the second resource interaction feature in the target time period based on the first feature data and the second feature data; and normalize the distribution difference degree based on the active duration of the target time period to obtain the cross-fluctuation degree between the first resource interaction feature and the second resource interaction feature.

[0024] In one embodiment, the cross-fluctuation degree determination module is further configured to: use the first feature data as standard data to calculate a first distribution difference degree between the distribution of the second feature data and the distribution of the first feature data; use the second feature data as standard data to calculate a second distribution difference degree between the distribution of the first feature data and the distribution of the second feature data; and take the average of the first distribution difference degree and the second distribution difference degree as the distribution difference degree between the first resource interaction feature and the second resource interaction feature in the target time period.

[0025] In one embodiment, the cross-fluctuation degree determination module is further configured to: determine the first total data corresponding to the first resource interaction feature in the target time period; determine the second total data corresponding to the second resource interaction feature in the target time period; calculate the first ratio of the first feature data to the first total data in each unit time period, and the second ratio of the second feature data to the second total data in each unit time period; and calculate the first distribution difference degree of the distribution of the second feature data relative to the distribution of the first feature data based on the first ratio and the second ratio.

[0026] In one embodiment, the cross-fluctuation degree determination module is further configured to calculate the cross-fluctuation degree between the first resource interaction feature and the second resource interaction feature using the following formula:

[0027]

[0028]

[0029]

[0030] in, This indicates the degree of difference between the distribution of the second feature data and the distribution of the first feature data in the first distribution within the target time period. This indicates the degree of difference between the distribution of the first feature data and the distribution of the second feature data in the second distribution within the target time period; D span D represents the total duration of the target time period. act This represents the sum of unit times generated by resource interaction records within the target time period; fea 1-i This represents the first feature data of the first resource interaction feature at the unit time in which the resource interaction record is generated, where fea 1-all The first resource interaction feature is the first total data corresponding to the target time period, fea 2-i This represents the second feature data of the second resource interaction feature at the unit time in which the resource interaction record is generated, where fea 2-all This represents the second total data corresponding to the second resource interaction feature in the target time period; This represents the first ratio between the first feature data corresponding to the first resource interaction feature per unit time and the first total data. This represents the second ratio between the second feature data corresponding to the second resource interaction feature per unit time and the second total data; This indicates the degree of cross-fluctuation between the first resource interaction feature and the second resource interaction feature.

[0031] In one embodiment, the identification module is further configured to: determine the subject identifier as the abnormal category when the degree of independent stability of at least one of the plurality of resource interaction features and the degree of cross-fluctuation between any two of the plurality of resource interaction features satisfy the preset abnormal conditions corresponding to the abnormal category.

[0032] In one embodiment, the identification module is further configured to: generate a classification feature corresponding to the subject identifier based on the degree of independent stability of each of the plurality of resource interaction features and the degree of cross-fluctuation between any two of the plurality of resource interaction features; and perform anomaly identification on the subject identifier according to the classification feature through an anomaly identifier identification model to obtain an identification result used to characterize whether the subject identifier is an anomaly identifier.

[0033] A computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0034] Obtain the resource interaction data corresponding to the subject identifier; the resource interaction data includes feature data corresponding to each of multiple different resource interaction features;

[0035] Based on the feature data corresponding to each resource interaction feature, the degree of independence and stability of the corresponding resource interaction feature is determined; the degree of independence and stability is used to characterize the degree of fluctuation of the feature data corresponding to the resource interaction feature itself.

[0036] Based on the feature data corresponding to any two resource interaction features among the plurality of resource interaction features, the degree of cross-fluctuation between the two resource interaction features is determined; the degree of cross-fluctuation is used to characterize the degree of distribution difference between the feature data corresponding to the two resource interaction features.

[0037] Based on the independent stability of each of the multiple resource interaction features and the degree of cross-fluctuation between any two of the multiple resource interaction features, the subject identifier is subjected to anomaly identification to obtain an identification result that characterizes whether the subject identifier is an anomaly identifier.

[0038] A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, performs the following steps:

[0039] Obtain the resource interaction data corresponding to the subject identifier; the resource interaction data includes feature data corresponding to each of multiple different resource interaction features;

[0040] Based on the feature data corresponding to each resource interaction feature, the degree of independence and stability of the corresponding resource interaction feature is determined; the degree of independence and stability is used to characterize the degree of fluctuation of the feature data corresponding to the resource interaction feature itself.

[0041] Based on the feature data corresponding to any two resource interaction features among the plurality of resource interaction features, the degree of cross-fluctuation between the two resource interaction features is determined; the degree of cross-fluctuation is used to characterize the degree of distribution difference between the feature data corresponding to the two resource interaction features.

[0042] Based on the independent stability of each of the multiple resource interaction features and the degree of cross-fluctuation between any two of the multiple resource interaction features, the subject identifier is subjected to anomaly identification to obtain an identification result that characterizes whether the subject identifier is an anomaly identifier.

[0043] A computer program includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps of the above-described method for processing resource interaction data.

[0044] The aforementioned method, apparatus, computer equipment, and storage medium for processing resource interaction data determine the independent stability of each resource interaction feature based on the feature data corresponding to each of the multiple resource interaction features of the subject identifier. They also determine the cross-variability between any two resource interaction features based on the feature data corresponding to any two of the multiple resource interaction features of the subject identifier. Since the independent stability is used to characterize the fluctuation of the feature data corresponding to the resource interaction feature itself, and the cross-variability is used to characterize the degree of distribution difference between the feature data corresponding to any two resource interaction features, the independent stability and cross-variability can comprehensively reflect the resource interaction stability state of the subject identifier. Based on the independent stability of each resource interaction feature and the cross-variability between any two resource interaction features, anomaly identification of the subject identifier can be performed, improving the accuracy of identifying abnormal subject identifiers. Attached Figure Description

[0045] Figure 1 This is an application environment diagram of a resource interaction data processing method in one embodiment;

[0046] Figure 2 This is a flowchart illustrating a method for processing resource interaction data in one embodiment;

[0047] Figure 3 A schematic diagram illustrating the resource interaction data for constructing a merchant identifier in one embodiment;

[0048] Figure 4 This is a schematic diagram illustrating the fluctuation of transaction values ​​for a merchant identifier in one embodiment;

[0049] Figure 5 This is a schematic diagram illustrating the fluctuations in the transaction value and the number of transacting parties for a merchant identifier in one embodiment;

[0050] Figure 6 This is a flowchart illustrating a method for processing resource interaction data in one embodiment;

[0051] Figure 7 This is a flowchart illustrating a method for processing resource interaction data in one embodiment;

[0052] Figure 8 This is a schematic diagram illustrating the identification of anomaly categories in one embodiment;

[0053] Figure 9 This is a schematic diagram illustrating the transaction behavior of an illegal merchant in one embodiment;

[0054] Figure 10 This is a structural block diagram of a resource interaction data processing device in one embodiment;

[0055] Figure 11 This is an internal structural diagram of a computer device in one embodiment;

[0056] Figure 12 This is a diagram of the internal structure of a computer device in another embodiment. Detailed Implementation

[0057] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0058] The resource interaction data processing method provided in this application embodiment relates to cloud technology, which refers to a hosting technology that unifies a series of resources such as hardware, software, and networks within a wide area network or local area network to realize data computation, storage, processing, and sharing.

[0059] Cloud technology is a collective term for network technology, information technology, integration technology, management platform technology, and application technology applied to the cloud computing business model. It can form resource pools, providing flexible and convenient on-demand access. Cloud computing technology will become a crucial support. Backend services of technical network systems require substantial computing and storage resources, such as video websites, image websites, and many portal websites. With the rapid development and application of the internet industry, every item may have its own identification mark in the future, requiring transmission to backend systems for logical processing. Data at different levels will be processed separately, and various industry data will all require robust system support, which can only be achieved through cloud computing.

[0060] The resource interaction data processing method provided in this application mainly relates to cloud computing. Cloud computing refers to the delivery and usage model of IT infrastructure, which means obtaining the required resources in an on-demand and easily scalable manner through the network; in a broader sense, cloud computing refers to the delivery and usage model of services, which means obtaining the required services in an on-demand and easily scalable manner through the network. Such services can be IT and software, Internet-related, or other services. Cloud computing is a product of the development and integration of traditional computer and network technologies such as grid computing, distributed computing, parallel computing, utility computing, network storage technologies, virtualization, and load balancing.

[0061] With the development of the internet, real-time data streams, and the diversification of connected devices, as well as the demands for search services, social networks, mobile commerce, and open collaboration, cloud computing has rapidly developed. Unlike previous parallel distributed computing, cloud computing will fundamentally revolutionize the entire internet model and enterprise management model.

[0062] For example, in this embodiment, the server receives resource interaction data corresponding to the subject identifier uploaded by the terminal. The resource interaction data includes feature data corresponding to multiple different resource interaction features. Based on the feature data corresponding to each resource interaction feature, the server determines the degree of independence and stability of the corresponding resource interaction feature. The degree of independence and stability is used to characterize the degree of fluctuation of the feature data corresponding to the resource interaction feature itself. Based on the feature data corresponding to any two resource interaction features among the multiple resource interaction features, the server determines the degree of cross-fluctuation between any two resource interaction features. The degree of cross-fluctuation is used to characterize the degree of distribution difference between the feature data corresponding to any two resource interaction features. Based on the degree of independence and stability of each resource interaction feature among the multiple resource interaction features, and the degree of cross-fluctuation between any two resource interaction features among the multiple resource interaction features, the server performs anomaly identification on the subject identifier to obtain an identification result that characterizes whether the subject identifier is an anomaly identifier.

[0063] The resource interaction data processing method provided in this application also relates to blockchain technology. Blockchain is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Essentially, a blockchain is a decentralized database, a chain of data blocks linked using cryptographic methods. Each data block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and generate the next block. A blockchain can include a blockchain underlying platform, a platform product service layer, and an application service layer.

[0064] For example, in this embodiment of the application, the server can be a blockchain node in a blockchain network. The terminal uploads the resource interaction data corresponding to the subject identifier to the blockchain node in the blockchain network. The blockchain node determines the identification result used to characterize whether the subject identifier is an abnormal identifier based on the resource interaction data corresponding to the subject identifier.

[0065] The resource interaction data processing method provided in this application can be applied to, for example... Figure 1In the application environment shown, terminal 102 communicates with server 104 via a network. Terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, portable wearable devices, televisions, etc. Server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms.

[0066] In one embodiment, terminal 102 acquires resource interaction data corresponding to a subject identifier, the resource interaction data including feature data corresponding to multiple different resource interaction features. Terminal 102 uploads the resource interaction data corresponding to the subject identifier to server 104. Server 104 determines the independent stability degree of each resource interaction feature based on the feature data corresponding to each resource interaction feature, the independent stability degree being used to characterize the fluctuation degree of the feature data corresponding to the resource interaction feature itself; it determines the cross-fluctuation degree between any two resource interaction features based on the feature data corresponding to any two resource interaction features, the cross-fluctuation degree being used to characterize the distribution difference between the feature data corresponding to any two resource interaction features; based on the independent stability degree of each resource interaction feature and the cross-fluctuation degree between any two resource interaction features, it performs anomaly identification on the subject identifier to obtain an identification result characterizing whether the subject identifier is an anomaly identifier.

[0067] The resource interaction data processing method provided in this application embodiment can be executed by the resource interaction data processing device provided in this application embodiment, or by a terminal that integrates the resource interaction data processing device, wherein the resource interaction data processing device can be implemented in hardware or software.

[0068] The resource interaction data processing method provided in this application embodiment can be applied to abnormal subject identification scenarios, such as abnormal merchant identification scenarios, abnormal resource account identification scenarios, abnormal application user identification scenarios, abnormal social member account identification scenarios, abnormal group conversation identification scenarios, abnormal URL identification scenarios, abnormal application identification scenarios, abnormal mini-program identification scenarios, and so on.

[0069] For example, online shopping has become one of the main ways people shop, but some merchants engage in unfair competition by engaging in fraudulent order practices, and even worse, some merchants conduct illegal transactions through their online stores. All of these merchants are considered abnormal. The method provided in this application can identify whether a merchant's identifier is abnormal, and when it is, it can also identify the abnormal category to which the identifier belongs. This not only helps maintain a fair and competitive online transaction order but also contributes to maintaining network security.

[0070] In one embodiment, a computer device acquires resource interaction data corresponding to a merchant identifier, the resource interaction data including feature data corresponding to multiple different resource interaction features; based on the feature data corresponding to each resource interaction feature, the independent stability degree of the corresponding resource interaction feature is determined, the independent stability degree being used to characterize the fluctuation degree of the feature data corresponding to the resource interaction feature itself; based on the feature data corresponding to any two resource interaction features among the multiple resource interaction features, the cross-fluctuation degree between any two resource interaction features is determined, the cross-fluctuation degree being used to characterize the distribution difference between the feature data corresponding to any two resource interaction features; based on the independent stability degree of each resource interaction feature among the multiple resource interaction features, and the cross-fluctuation degree between any two resource interaction features among the multiple resource interaction features, anomaly identification is performed on the merchant identifier to obtain an identification result used to characterize whether the merchant identifier is an anomaly identifier, and when the merchant identifier is an anomaly identifier, the anomaly category to which the merchant identifier belongs can be identified.

[0071] In a specific embodiment, resource interaction characteristics can be transaction value, transaction frequency, and number of trading parties. The computer device determines the unit transaction value, unit transaction frequency, and unit number of trading parties generated by the merchant identifier within each unit of time during the target time period, based on the transaction records generated by the merchant identifier within each unit of time. Based on these parameters, the device determines the independent stability of each transaction value, transaction frequency, and number of trading parties, as well as the cross-variation degree between each pair of resource interaction characteristics (transaction value and transaction frequency, transaction value and number of trading parties, transaction frequency and number of trading parties). Therefore, based on the three independent stability degrees and the three cross-variation degrees, the merchant identifier can be identified as an anomaly.

[0072] In one embodiment, such as Figure 2 As shown, a method for processing resource interaction data is provided. This embodiment mainly applies this method to computer devices (as described above). Figure 1 Taking terminal 102 or server 104 as an example, the following steps are included:

[0073] Step S202: Obtain the resource interaction data corresponding to the subject identifier; the resource interaction data includes the feature data corresponding to each of the multiple different resource interaction features.

[0074] The subject identifier is an object to be identified as an abnormal identifier by the method provided in this application embodiment. Examples include merchant identifiers, resource accounts, application user identifiers, social member accounts, group chat identifiers, URLs, application identifiers, mini-program identifiers, etc. The subject can be an object that uses the internet for activities, such as an online merchant, or it can be an object in a real-world scenario, such as a physical merchant. The subject identifier is used to uniquely represent the subject and can be composed of at least one of text, letters, numbers, and symbols.

[0075] Resource interaction data describes the resource interaction behavior of the entity corresponding to the entity identifier. This includes resource value interactions, information interactions, and data interactions between the entity and other entities. The interacting parties can be of the same or different entity types. Examples include resource value transfers between merchants and buyers, information interactions between social members in social applications, and data interactions generated when users visit websites.

[0076] In one embodiment, the computer device obtains resource interaction records of a subject identifier and generates resource interaction data corresponding to the subject identifier based on these records. For example, the computer device can generate resource interaction data corresponding to a merchant identifier based on transaction records of a merchant identifier, generate resource interaction data corresponding to a social member account based on message records of a social member account, generate resource interaction data corresponding to a URL based on URL access records, and so on.

[0077] Resource interaction features are used to describe the interactive behavior characteristics of the entity corresponding to the entity identifier. Feature data consists of the feature values ​​of the entity corresponding to the entity identifier under the resource interaction features. The computer device determines multiple resource interaction features from the resource interaction records of the entity identifier. Each resource interaction feature serves as a feature dimension, and the feature values ​​of the entity identifier under each feature dimension are used to describe the interactive behavior of the entity corresponding to the entity identifier. For example, the computer device can determine multiple resource interaction features from the transaction records of the merchant identifier: transaction value, number of transactions, and number of transacting parties. The resource interaction data of the merchant identifier under each resource interaction feature is then used to construct the merchant identifier's resource interaction data.

[0078] In one embodiment, the computer device acquires resource interaction records generated by the subject identifier within each unit time period of the target time period, and constructs resource interaction data corresponding to the subject identifier based on these records. The duration of the target time period and the duration of each unit time period can be set according to the actual application; for example, the duration of each unit time period could be one day. Optionally, the computer device acquires resource interaction records generated by the subject identifier within each unit time period of the target time period. For each unit time period, it determines the feature data of each resource interaction feature corresponding to the subject identifier within that unit time period based on the corresponding resource interaction records, and constructs the resource interaction data of the subject identifier using the feature data of each resource interaction feature corresponding to the subject identifier within each unit time period of the target time period.

[0079] For example, refer to Figure 3 , Figure 3 The diagram illustrates an embodiment of constructing resource interaction data for a merchant identifier. It shows that the computer device determines the daily transaction value, number of transactions, and number of transacting parties of the merchant identifier based on the daily transaction records of the merchant identifier over 1 to n days. Using these daily transaction values, number of transactions, and number of transacting parties, the resource interaction data for the merchant identifier is constructed.

[0080] In one embodiment, for each unit of time, the computer device, based on the transaction records generated by the merchant identifier within that unit of time, calculates the sum of the transaction values ​​of each transaction as the transaction value generated by the merchant identifier within that unit of time, the sum of the number of transactions of each transaction as the transaction count generated by the merchant identifier within that unit of time, and the sum of the number of transacting parties of each transaction as the transacting party count generated by the merchant identifier within that unit of time. It is understood that repeated transacting parties within a unit of time can be counted as one transacting party in the transacting party count, and the transaction value generated within a unit of time can be at least one of the resource values ​​received and transferred by the merchant identifier.

[0081] Step S204: Determine the degree of independence and stability of the corresponding resource interaction feature based on the feature data corresponding to each resource interaction feature; the degree of independence and stability is used to characterize the degree of fluctuation of the feature data corresponding to the resource interaction feature itself.

[0082] In this application, a computer device extracts feature data of each resource interaction characteristic from the resource interaction record of a subject identifier, and measures the resource interaction stability of the subject identifier based on this feature data. On the one hand, the computer device determines the degree of fluctuation of the feature data of each resource interaction characteristic of the subject identifier itself (i.e., the degree of independent stability); on the other hand, the computer device determines the relative degree of fluctuation between each pair of feature data of each resource interaction characteristic of the subject identifier (i.e., the degree of cross fluctuation). The degree of independent stability and the degree of cross fluctuation can comprehensively reflect the resource interaction stability of the subject identifier. Based on the degree of independent stability and the degree of cross fluctuation, the identification of abnormal subject identifiers can be performed, which can improve the accuracy of identifying abnormal subject identifiers.

[0083] In one embodiment, for each resource interaction feature, the computer device determines the degree of independence and stability of the resource interaction feature based on the feature data corresponding to the subject identifier. The degree of independence and stability reflects the degree of fluctuation of the feature data corresponding to the resource interaction feature itself.

[0084] In one embodiment, for each resource interaction feature, the computer device determines the degree of independence and stability of the resource interaction feature based on the feature data of that resource interaction feature corresponding to each unit time of the target time period. For example, referring to... Figure 4 , Figure 4 The diagram illustrates the fluctuation of transaction values ​​for a merchant identifier in one embodiment. It shows that the computer device determines the degree of independent stability of the merchant identifier's transaction values ​​based on the daily transaction values ​​generated by the merchant identifier over 1 to n days. This degree of independent stability reflects the degree of fluctuation of the merchant identifier's transaction values ​​over 1 to n days, i.e., the degree of dispersion in its distribution.

[0085] In one embodiment, considering that the feature data of various resource interaction characteristics of normal interacting entities, such as normal trading merchants, are generally relatively stable, the volatility of the feature data corresponding to the resource interaction characteristics is set to be inversely proportional to the degree of independent stability. That is, the lower the volatility of the feature data corresponding to the resource interaction characteristics, the higher the degree of independent stability. The degree of independent stability and the degree of anomaly have a monotonic relationship. For example, the higher the degree of independent stability, the lower the degree of anomaly.

[0086] In one embodiment, the computer device calculates the information entropy or coefficient of variation of the corresponding resource interaction features based on the feature data of each resource interaction feature corresponding to each unit time of the target time period of the subject identifier, and determines the degree of independence and stability of the corresponding resource interaction features based on the calculation results.

[0087] Step S206: Based on the feature data corresponding to any two resource interaction features among multiple resource interaction features, determine the degree of cross-fluctuation between any two resource interaction features; the degree of cross-fluctuation is used to characterize the degree of distribution difference between the feature data corresponding to any two resource interaction features.

[0088] In this application, there are correlations between pairs of resource interaction features among multiple resource interaction features. Furthermore, the distribution of feature data for various resource interaction features of normal interaction subjects, such as normal trading merchants, will also show similarities. For example, the distribution of transaction value and transaction frequency, the distribution of transaction value and the number of trading parties, and the distribution of transaction frequency and the number of trading parties will all show similar trends. If a few trading parties contribute a large amount of transaction value, the transaction value will be too high relative to the number of trading parties, which may indicate an anomaly.

[0089] In one embodiment, for any two resource interaction features among a plurality of resource interaction features, the computer device determines the degree of cross-fluctuation of the two resource interaction features based on the feature data corresponding to the subject identifier for each of the two resource interaction features. The degree of cross-fluctuation reflects the degree of distribution difference between the feature data corresponding to the two resource interaction features.

[0090] In one embodiment, for any two resource interaction features among multiple resource interaction features, the computer device determines the degree of cross-fluctuation between the two resource interaction features based on the feature data of the subject identifier corresponding to each unit time of the target time period. For example, referring to... Figure 5 , Figure 5 This diagram illustrates the fluctuations in transaction value and number of transacting parties for a merchant identifier in one embodiment. As can be seen, the computer device determines the degree of cross-variation between the transaction value and number of transacting parties for a merchant identifier based on the daily transaction value and number of transacting parties generated by the merchant identifier within days 1 to n. This degree of cross-variation reflects the relative fluctuation between the transaction value and number of transacting parties for the merchant identifier, i.e., the degree of distribution difference.

[0091] In one embodiment, the degree of distributional difference between the feature data corresponding to any two resource interaction features is directly proportional to the degree of cross-variability; that is, the smaller the distributional difference between the feature data corresponding to any two resource interaction features, the lower the degree of cross-variability. The degree of cross-variability has a monotonic relationship with the degree of anomaly. For example, the lower the degree of cross-variability, the lower the degree of anomaly.

[0092] In one embodiment, for any two resource interaction features among multiple resource interaction features, the computer device calculates the relative entropy or Wasserstein distance of the two resource interaction features based on the feature data of each resource interaction feature corresponding to the subject identifier in each unit time of the target time period, and determines the degree of cross-fluctuation between the two resource interaction features based on the calculation results.

[0093] Step S208: Based on the independent stability of each resource interaction feature among multiple resource interaction features, and the degree of cross-fluctuation between any two resource interaction features among multiple resource interaction features, perform anomaly identification on the subject identifier to obtain an identification result used to characterize whether the subject identifier is an anomaly identifier.

[0094] In one embodiment, the computer device identifies anomaly identifiers of a subject identifier based on the independent stability of each resource interaction feature among multiple resource interaction features, and the degree of cross-variation between any two resource interaction features, to obtain an identification result characterizing whether the subject identifier is an anomalous identifier. It is understood that the computer device may also identify anomaly identifiers of a subject identifier based on at least one of the independent stability of each resource interaction feature among multiple resource interaction features, and the degree of cross-variation between any two resource interaction features.

[0095] For example, the resource interaction characteristics of a merchant identifier are transaction value, transaction frequency, and number of transacting parties. The computer equipment determines the degree of independence and stability corresponding to the transaction value, transaction frequency, and number of transacting parties, as well as the degree of cross-variation between pairwise resource interaction characteristics (transaction value and transaction frequency, transaction value and number of transacting parties, and transaction frequency and number of transacting parties). Based on the three degrees of independence and stability and the three degrees of cross-variation, the merchant identifier is identified as an anomaly.

[0096] In one embodiment, since the degree of independent stability and the degree of anomaly are monotonically correlated, and the degree of cross-variance is also monotonically correlated with the degree of anomaly, for different application scenarios, thresholds for the degree of independent stability corresponding to each resource interaction feature and thresholds for the degree of cross-variance corresponding to each pair of resource interaction features can be set accordingly. For example, the degree of independent stability corresponding to the resource interaction features of a normal merchant identifier is high, and the degree of cross-variance corresponding to each pair of resource interaction features is low. Therefore, abnormal merchant identifiers can be quickly detected by using predetermined thresholds. Optionally, when the degree of independent stability of a resource interaction feature is lower than the corresponding degree of independent stability threshold, or the degree of cross-variance between each pair of resource interaction features is higher than the corresponding degree of cross-variance threshold, the subject identifier is determined to be an abnormal identifier.

[0097] In one embodiment, when a subject identifier is determined to be an anomaly identifier, the computer device can identify the anomaly category to which the subject identifier belongs. The computer device obtains preset anomaly conditions corresponding to the anomaly category. When at least one of the independent stability degree of each resource interaction feature of the subject identifier and the cross-variation degree between any two resource interaction features satisfies the preset anomaly condition, the subject identifier is determined to be an anomaly identifier of that anomaly category. The preset anomaly conditions may include independent stability degree thresholds corresponding to each resource interaction feature and cross-variation degree thresholds corresponding to each pair of resource interaction features.

[0098] The above-mentioned method for processing resource interaction data determines the degree of independence and stability of each resource interaction feature based on the feature data corresponding to each of the multiple resource interaction features of the subject identifier. It also determines the degree of cross-variation between any two resource interaction features based on the feature data corresponding to any two of the multiple resource interaction features of the subject identifier. Since the degree of independence and stability characterizes the fluctuation of the feature data corresponding to the resource interaction feature itself, and the degree of cross-variation characterizes the degree of distribution difference between the feature data corresponding to any two resource interaction features, both the degree of independence and stability and the degree of cross-variation can comprehensively reflect the stable state of resource interaction of the subject identifier. Based on the degree of independence and stability of each resource interaction feature and the degree of cross-variation between any two of the multiple resource interaction features, anomaly identification of the subject identifier can be performed, improving the accuracy of identifying abnormal subject identifiers.

[0099] The following example illustrates how to calculate the degree of independence and stability corresponding to resource interaction characteristics:

[0100] In one embodiment, resource interaction data is generated based on resource interaction records generated within each unit of time in the target time period. Determining the independence and stability of each resource interaction feature based on its corresponding feature data includes: for each resource interaction feature, determining the feature data corresponding to each unit of time based on the resource interaction records generated within each unit of time; calculating the distribution dispersion of the feature data corresponding to the resource interaction feature within the target time period based on the feature data corresponding to each unit of time; and normalizing the distribution dispersion based on the total duration of the target time period to obtain the independence and stability of the resource interaction feature.

[0101] In one embodiment, for each resource interaction feature, the computer device determines the feature data corresponding to each unit of time based on the resource interaction records generated by the subject identifier in each unit of time within the target time period.

[0102] In one embodiment, when the resource interaction feature is a transaction value, the unit transaction value generated in each unit time is calculated based on the transaction records generated in each unit time, and this is used as the feature data corresponding to the transaction value in each unit time; when the resource interaction feature is the number of transactions, the unit number of transactions generated in each unit time is calculated based on the transaction records generated in each unit time, and this is used as the feature data corresponding to the number of transactions in each unit time; when the resource interaction feature is the number of trading parties, the unit number of trading parties generated in each unit time is calculated based on the transaction records generated in each unit time, and this is used as the feature data corresponding to the number of trading parties in each unit time.

[0103] In one embodiment, for each unit of time, the computer device, based on the transaction records generated by the subject identifier within that unit of time, uses the sum of the transaction values ​​of each transaction as the unit transaction value generated by the subject identifier within that unit of time, the sum of the number of transactions of each transaction as the unit transaction count generated by the subject identifier within that unit of time, and the sum of the number of trading parties of each transaction as the unit trading party count generated by the subject identifier within that unit of time.

[0104] In one embodiment, when the resource interaction feature is the transaction value, the total transaction value corresponding to the target time period is calculated based on the transaction records generated in each unit of time; when the resource interaction feature is the number of transactions, the total number of transactions corresponding to the target time period is calculated based on the transaction records generated in each unit of time; when the resource interaction feature is the number of trading parties, the total number of trading parties corresponding to the target time period is calculated based on the transaction records generated in each unit of time.

[0105] In one embodiment, repeated transactions within a unit of time can be counted as one transaction in the transaction count. The computer device can use the sum of the transaction counts corresponding to each unit of time within the target time period as the total number of transactions for the target time period. The computer device can determine the total transaction value and total number of transactions for the target time period based on the transaction records generated by the subject identifier within the target time period.

[0106] In one embodiment, the distribution dispersion of the feature data corresponding to the resource interaction feature in the target time period is calculated based on the feature data corresponding to each unit of time for the resource interaction feature. This includes: determining the total amount of data corresponding to the resource interaction feature in the target time period; and calculating the distribution dispersion of the feature data corresponding to the resource interaction feature in the target time period based on the ratio of the feature data to the total amount of data in each unit of time.

[0107] In one embodiment, the dispersion of the feature data corresponding to the resource interaction feature in the target time period is calculated using the following formula:

[0108]

[0109]

[0110] Among them, H fea D represents the degree of dispersion of the feature data corresponding to resource interaction characteristics within the target time period; act This represents the sum of unit times generated by resource interaction records within the target time period; fea i This represents the feature data of the resource interaction characteristics generated in the unit of time of the i-th resource interaction record, fea all This represents the total amount of data corresponding to the resource interaction characteristics within the target time period.

[0111] In one embodiment, the degree of independence and stability corresponding to resource interaction characteristics is calculated using the following formula:

[0112]

[0113] Among them, D span Indicates the total duration of the target time period; F fea This indicates the degree of independence and stability corresponding to resource interaction characteristics.

[0114] Specifically, F fea ≤1, when D act =D span ,and When the condition is met, the equality holds. The range of the independent stability degree calculated by the above formula is controllable, which is [0, 1]. The independent stability degree and the anomaly degree have a monotonic relationship; the higher the independent stability degree, the lower the anomaly degree. When resource interaction records are generated in every unit of time in the target time period, and the feature data corresponding to the resource interaction feature are equal in each unit of time, the independent stability degree corresponding to the resource interaction feature is 1.

[0115] In this embodiment, on the one hand, the calculated degree of independence and stability is not affected by the scale of the main resource interaction and the length of the resource interaction record, and has a wide range of applications; on the other hand, the calculated degree of independence and stability has a monotonic correlation with the degree of anomaly, and the value range is controllable, making it suitable for formulating anomaly identification strategies for different application scenarios, and can also bring about performance improvement when applied to anomaly identification models.

[0116] The following example illustrates how to calculate the degree of cross-variation between any two resource interaction features:

[0117] In one embodiment, any two resource interaction features among the multiple resource interaction features are respectively a first resource interaction feature and a second resource interaction feature; the resource interaction data is generated based on the resource interaction records generated in each unit time of the target time period; the degree of cross-fluctuation between any two resource interaction features is determined based on the feature data corresponding to any two resource interaction features among the multiple resource interaction features, including: determining the first feature data corresponding to the first resource interaction feature in each unit time; and determining the second feature data corresponding to the second resource interaction feature in each unit time.

[0118] Based on the first feature data and the second feature data, the degree of distribution difference between the first resource interaction feature and the second resource interaction feature during the target time period is calculated; based on the active duration of the target time period, the degree of distribution difference is normalized to obtain the degree of cross-fluctuation between the first resource interaction feature and the second resource interaction feature.

[0119] In one embodiment, the method for determining the feature data corresponding to each unit of time for resource interaction features can refer to the above embodiment, and will not be repeated here.

[0120] In one embodiment, calculating the degree of distribution difference between the first resource interaction feature and the second resource interaction feature during a target time period based on the first feature data and the second feature data includes: using the first feature data as standard data, calculating a first degree of distribution difference between the distribution of the second feature data and the distribution of the first feature data; using the second feature data as standard data, calculating a second degree of distribution difference between the distribution of the first feature data and the distribution of the second feature data; and taking the average of the first degree of distribution difference and the second degree of distribution difference as the degree of distribution difference between the first resource interaction feature and the second resource interaction feature during the target time period.

[0121] In one embodiment, the computer device may calculate the Kullback-Leibler divergence of the distribution of the second feature data relative to the distribution of the first feature data as a first degree of distribution difference, and calculate the Kullback-Leibler divergence of the distribution of the first feature data relative to the distribution of the second feature data as a second degree of distribution difference.

[0122] In one embodiment, using the first feature data as standard data, calculating the first distribution difference degree between the distribution of the second feature data and the distribution of the first feature data includes: determining the first total data corresponding to the first resource interaction feature in the target time period; determining the second total data corresponding to the second resource interaction feature in the target time period; calculating the first ratio of the first feature data to the first total data and the second ratio of the second feature data to the second total data for each unit time; and calculating the first distribution difference degree between the distribution of the second feature data and the distribution of the first feature data based on the first ratio and the second ratio.

[0123] In one embodiment, the degree of difference between the distribution of the second feature data and the distribution of the first feature data can be calculated using the following formula:

[0124]

[0125]

[0126] in, This indicates the degree of difference between the distribution of the second feature data and the distribution of the first feature data within the target time period; D act This represents the sum of unit times generated by resource interaction records within the target time period; fea 1-i This represents the first feature data of the first resource interaction feature at the unit time in which the resource interaction record is generated, where fea 1-all The first total data corresponding to the first resource interaction feature in the target time period, fea 2-i The second feature data, fea, represents the second feature data of the i-th unit of time in which a resource interaction record is generated. 2-all This represents the second total data corresponding to the second resource interaction feature within the target time period; This represents the first ratio of the first feature data to the first total data per unit time corresponding to the first resource interaction feature. This represents the second ratio of the second feature data to the second total data per unit time corresponding to the second resource interaction feature.

[0127] In one embodiment, the degree of difference between the distribution of the first feature data and the distribution of the second feature data can be calculated using the following formula:

[0128]

[0129] in, This indicates the degree of difference between the distribution of the first feature data and the distribution of the second feature data in the target time period.

[0130] In one embodiment, the degree of cross-variation between the first resource interaction feature and the second resource interaction feature is calculated using the following formula:

[0131]

[0132] Among them, D span Indicates the total duration of the target time period; This indicates the degree of cross-fluctuation between the first resource interaction feature and the second resource interaction feature.

[0133] Specifically, When for When the equation holds true, the value range of the cross-variance calculated using the above formula is controllable, being [0, +∞). The cross-variance and anomaly levels have a monotonic relationship; the lower the cross-variance, the lower the anomaly. When, for any given unit of time, the first ratio of the first feature data to the first total data corresponding to the first resource interaction feature is equal to the second ratio of the second feature data to the second total data corresponding to the second resource interaction feature, the cross-variance between the first and second resource interaction features is 0.

[0134] In this embodiment, on the one hand, the calculated cross fluctuation degree is not affected by the scale of the main resource interaction and the length of the resource interaction record, and has a wide range of applications; on the other hand, the calculated cross fluctuation degree has a monotonic correlation with the anomaly degree, and the value range is controllable, making it suitable for formulating anomaly identification strategies for different application scenarios, and can also bring about performance improvement when applied to anomaly identification models.

[0135] In one embodiment, the method further includes: when the degree of independent stability of at least one of the multiple resource interaction features and the degree of cross-fluctuation between any two of the multiple resource interaction features satisfy the preset abnormal conditions corresponding to the abnormal category, the subject identifier is determined to be an abnormal category.

[0136] In one embodiment, the computer device obtains a preset anomaly condition corresponding to the anomaly category. When the independent stability of each resource interaction feature of the subject identifier and the cross fluctuation between any two resource interaction features among the multiple resource interaction features meet the preset anomaly condition, the subject identifier is determined to be an anomaly identifier of the anomaly category.

[0137] In one embodiment, the preset anomaly conditions may include independent stability thresholds for each resource interaction feature and cross-variability thresholds for each pair of resource interaction features. Based on the above analysis, the range of independent stability is controllable and has a monotonic correlation with the anomaly level; similarly, the range of cross-variability is controllable and has a monotonic correlation with the anomaly level. Based on this principle, and the different manifestations of independent stability and cross-variability under each anomaly category, the anomaly category corresponding to the subject identifier can be accurately determined by using the independent stability thresholds and cross-variability thresholds in the preset anomaly conditions for each anomaly category.

[0138] In this embodiment, based on the independent stability of each resource interaction feature among multiple resource interaction features, and the degree of cross-fluctuation between any two resource interaction features among multiple resource interaction features, the abnormal category of the subject identifier can be accurately identified.

[0139] In one embodiment, based on the independent stability of each resource interaction feature among multiple resource interaction features and the degree of cross-fluctuation between any two resource interaction features, anomaly identification is performed on the subject identifier to obtain an identification result characterizing whether the subject identifier is an anomalous identifier. This includes: generating classification features corresponding to the subject identifier based on the independent stability of each resource interaction feature among multiple resource interaction features and the degree of cross-fluctuation between any two resource interaction features; and using anomaly identification model, performing anomaly identification on the subject identifier based on the classification features to obtain an identification result characterizing whether the subject identifier is an anomalous identifier.

[0140] Among them, the anomaly recognition model is a model structure that has the ability to identify anomalies after training.

[0141] In one embodiment, the anomaly detection model can be a general graph neural network model, such as GNN (Graph Neural Network) or GAT (Graph Attention Network), or a structured classification model, such as LightGBM (Light Gradient Boosting Machine).

[0142] In one embodiment, a computer device can use an anomaly category recognition model to identify the anomaly category of a subject identifier based on classification features, thereby determining the anomaly category to which the subject identifier belongs. The anomaly category recognition model is a model structure that, after training, possesses the ability to identify anomaly categories.

[0143] In this embodiment, the calculated independent stability and cross-variability are monotonically correlated with the anomaly level, which can be used as model input. Furthermore, since the feature dimension of the input model is increased, it can also improve the performance when applied to the anomaly identification model.

[0144] In one embodiment, such as Figure 6 As shown, a method for processing resource interaction data is provided. This embodiment mainly applies this method to computer devices (as described above). Figure 1 Taking terminal 102 or server 104 as an example, the following steps are included:

[0145] Step S602: Obtain the resource interaction data corresponding to each unit time of the subject identifier in the target time period; the resource interaction data includes the feature data corresponding to each of the multiple different resource interaction features.

[0146] Step S604: Determine the degree of independence and stability of the corresponding resource interaction feature based on the feature data corresponding to each resource interaction feature; the degree of independence and stability is used to characterize the degree of fluctuation of the feature data corresponding to the resource interaction feature itself.

[0147] In one embodiment, the degree of independence and stability corresponding to resource interaction characteristics is calculated using the following formula:

[0148]

[0149]

[0150]

[0151] Among them, F fea ≤1, when D act =D span ,and When, the equality holds; H fea D represents the degree of dispersion of the feature data corresponding to resource interaction characteristics within the target time period; span D represents the total duration of the target time period. act This represents the sum of unit times generated by resource interaction records within the target time period; fea i This represents the feature data of the resource interaction characteristics generated in the unit of time of the i-th resource interaction record, fea all This represents the total amount of data corresponding to resource interaction characteristics within the target time period; F fea This indicates the degree of independence and stability corresponding to resource interaction characteristics.

[0152] The range of the independent stability level calculated by the above formula is controllable, which is [0, 1]. The independent stability level and the anomaly level have a monotonic correlation; the higher the independent stability level, the lower the anomaly level.

[0153] Step S606: Based on the feature data corresponding to any two resource interaction features among multiple resource interaction features, determine the degree of cross-fluctuation between any two resource interaction features; the degree of cross-fluctuation is used to characterize the degree of distribution difference between the feature data corresponding to any two resource interaction features.

[0154] In one embodiment, any two resource interaction features among the multiple resource interaction features are designated as a first resource interaction feature and a second resource interaction feature, and the degree of cross-fluctuation between the first resource interaction feature and the second resource interaction feature is calculated using the following formula:

[0155]

[0156]

[0157]

[0158] in, When for When the equality holds, the equality holds. This indicates the degree of difference between the distribution of the second feature data and the distribution of the first feature data within the target time period. This indicates the degree of difference between the distribution of the first feature data and the distribution of the second feature data within the target time period; D span D represents the total duration of the target time period. act This represents the sum of unit times generated by resource interaction records within the target time period; fea 1-i This represents the first feature data of the first resource interaction feature at the unit time in which the resource interaction record is generated, where fea 1-all The first total data corresponding to the first resource interaction feature in the target time period, fea 2-i The second feature data, fea, represents the second feature data of the i-th unit of time in which a resource interaction record is generated. 2-all This represents the second total data corresponding to the second resource interaction feature within the target time period; This represents the first ratio of the first feature data to the first total data per unit time corresponding to the first resource interaction feature. This represents the second ratio of the second feature data to the second total data per unit time corresponding to the second resource interaction feature; This indicates the degree of cross-fluctuation between the first resource interaction feature and the second resource interaction feature.

[0159] The range of cross volatility calculated using the above formula is controllable, being [0, +∞]. Cross volatility and anomaly severity have a monotonic correlation; the lower the cross volatility, the lower the anomaly severity.

[0160] Step S608: Based on the independent stability of each resource interaction feature among multiple resource interaction features, and the degree of cross-fluctuation between any two resource interaction features among multiple resource interaction features, perform anomaly identification on the subject identifier to obtain an identification result used to characterize whether the subject identifier is an anomaly identifier.

[0161] The above-mentioned method for processing resource interaction data, since the degree of independent stability is used to characterize the fluctuation of the feature data corresponding to the resource interaction feature itself, and the degree of cross fluctuation is used to characterize the degree of distribution difference between the feature data corresponding to any two resource interaction features, can comprehensively reflect the resource interaction stability state of the subject identifier. Based on the degree of independent stability of each resource interaction feature among multiple resource interaction features, and the degree of cross fluctuation between any two resource interaction features among multiple resource interaction features, the identification of abnormal subject identifiers can be performed, which can improve the accuracy of identifying abnormal subject identifiers.

[0162] In one embodiment, such as Figure 7 As shown, a method for processing resource interaction data is provided, which can be applied to scenarios involving the identification of abnormal merchant identifiers. This embodiment mainly applies this method to computer equipment (as described above). Figure 1 Taking terminal 102 or server 104 as an example, the following steps are included:

[0163] Step S702: Obtain the resource interaction data corresponding to each unit of time of the merchant identifier in the target time period; the resource interaction data includes the feature data corresponding to each of the multiple resource interaction features, which are the transaction value, the number of transactions, and the number of transaction parties.

[0164] In one embodiment, the transaction value can be the resource value received by the merchant identifier. The duration of the unit of time can be one day.

[0165] Step S704: Determine the degree of independence and stability of the corresponding resource interaction feature based on the feature data corresponding to each resource interaction feature; the degree of independence and stability is used to characterize the degree of fluctuation of the feature data corresponding to the resource interaction feature itself.

[0166] In one embodiment, the degree of independent stability corresponding to the transaction value is calculated using the following formula:

[0167]

[0168]

[0169]

[0170] Among them, F amt ≤1, when D act =D span ,and When, the equality holds; H amt D represents the degree of dispersion of the characteristic data corresponding to the transaction value within the target time period; span D represents the total duration of the target time period. act This represents the sum of unit times during which transactions occur within the target time period; amt i amt represents the characteristic data of the transaction value at the i-th unit of time in which the transaction was generated. all This represents the total amount of transaction data within the target time period; F amt This indicates the degree of independence and stability corresponding to the transaction value.

[0171] In one embodiment, the degree of independent stability corresponding to the number of transactions is calculated using the following formula:

[0172]

[0173]

[0174]

[0175] Among them, F cnt ≤1, when D act =D span ,and When, the equality holds; H cnt D represents the degree of dispersion of the feature data corresponding to the number of transactions within the target time period; span D represents the total duration of the target time period. act This represents the sum of unit times during which transactions occur within the target time period; cnt i cnt represents the number of transactions in the i-th unit of time in which a transaction occurs. all This represents the total number of transactions within the target time period; F cnt This indicates the degree of independence and stability corresponding to the number of transactions.

[0176] In one embodiment, the degree of independence and stability corresponding to the number of trading parties is calculated using the following formula:

[0177]

[0178]

[0179]

[0180] Among them, F num ≤1, when D act =D span ,and When, the equality holds; H num D represents the degree of dispersion of the characteristic data corresponding to the number of trading parties within the target time period; span D represents the total duration of the target time period. act This represents the sum of unit times during which transactions occur within the target time period; num i num represents the number of trading parties in the i-th unit of time in which the transaction occurs. all This represents the total number of trading parties within the target time period; F num This indicates the degree of independence and stability of the number of trading parties. It can be understood that a trading party repeating within a unit of time can be counted as one trading party in the total number of trading parties. The total number of trading parties within the target time period is the sum of the number of trading parties within each unit of time within the target time period.

[0181] The range of the independent stability level calculated by the above formula is controllable, which is [0, 1]. The independent stability level and the anomaly level have a monotonic correlation; the higher the independent stability level, the lower the anomaly level.

[0182] Step S706: Based on the feature data corresponding to any two resource interaction features among multiple resource interaction features, determine the degree of cross-fluctuation between any two resource interaction features; the degree of cross-fluctuation is used to characterize the degree of distribution difference between the feature data corresponding to any two resource interaction features.

[0183] In one embodiment, the degree of cross-variability between the transaction value and the number of transactions is calculated using the following formula:

[0184]

[0185]

[0186]

[0187] Among them, F amt-cnt ≥0, when for When, the equality holds; KL amt-cnt KL represents the degree of difference between the distribution of the second characteristic data (number of transactions) and the distribution of the first characteristic data (value of transactions) within the target time period. cnt-amtThis indicates the degree of difference between the distribution of the first characteristic data (transaction value) and the distribution of the second characteristic data (transaction frequency) within the target time period; D span D represents the total duration of the target time period. act This represents the sum of unit times during which transactions occur within the target time period; amt i amt represents the first characteristic data of the transaction value at the i-th unit of time in which the transaction was generated. all The first total data of transaction values ​​within the target time period, cnt i The number of transactions represents the second feature data of the i-th unit of time in which the transaction was generated, cnt. all This represents the second total data point indicating the number of transactions within the target time period; This represents the first ratio of the first characteristic data to the first total data per unit time corresponding to the transaction value. The second ratio represents the ratio of the second characteristic data to the second total data per unit time corresponding to the number of transactions; F amt-cnt This indicates the degree of cross-variability between the transaction value and the number of transactions.

[0188] In one embodiment, the degree of cross-variability between the transaction value and the number of trading parties is calculated using the following formula:

[0189]

[0190]

[0191]

[0192] Among them, F amt-num ≥0, when for When, the equality holds; KL amt-num KL represents the degree of difference between the distribution of the second characteristic data (number of trading parties) and the distribution of the first characteristic data (value of trading parties) within the target time period. num-amt D represents the degree of difference between the distribution of the first characteristic data (transaction value) and the distribution of the second characteristic data (number of trading parties) within the target time period; span D represents the total duration of the target time period. act This represents the sum of unit times during which transactions occur within the target time period; amt i amt represents the first characteristic data of the transaction value at the i-th unit of time in which the transaction was generated. all The first total data of the transaction value within the target time period, num i num represents the second characteristic data indicating the number of trading parties in the i-th unit of time in which a transaction occurs. allThis represents the second total number of trading parties within the target time period; This represents the first ratio of the first characteristic data to the first total data per unit time corresponding to the transaction value. This represents the second ratio between the second characteristic data and the second total data corresponding to the number of trading parties per unit time; F amt-num This indicates the degree of cross-variation between the transaction value and the number of trading parties.

[0193] In one embodiment, the cross-variability between the number of transactions and the number of trading parties is calculated using the following formula:

[0194]

[0195]

[0196]

[0197] Among them, F cnt-num ≥0, when for When, the equality holds; KL cnt-num KL represents the degree of difference between the distribution of the second characteristic data (number of trading parties) and the distribution of the first characteristic data (number of trading events) within the target time period. num-cnt D represents the degree of difference between the distribution of the first characteristic data (number of transactions) and the distribution of the second characteristic data (number of trading parties) within the target time period; span D represents the total duration of the target time period. act This represents the sum of unit times during which transactions occur within the target time period; cnt i The number of transactions represents the first feature data of the i-th unit of time in which the transaction was generated, cnt. all The first total number of transactions within the target time period, num i num represents the second characteristic data indicating the number of trading parties in the i-th unit of time in which a transaction occurs. all This represents the second total number of trading parties within the target time period; This represents the first ratio of the first characteristic data to the first total data per unit time corresponding to the number of transactions. This represents the second ratio between the second characteristic data and the second total data corresponding to the number of trading parties per unit time; F cnt-num This indicates the degree of cross-variability between the number of transactions and the number of trading parties.

[0198] The range of cross volatility calculated using the above formula is controllable, being [0, +∞]. Cross volatility and anomaly severity have a monotonic correlation; the lower the cross volatility, the lower the anomaly severity.

[0199] Step S708: Based on the independent stability of each resource interaction feature among multiple resource interaction features, and the degree of cross-fluctuation between any two resource interaction features among multiple resource interaction features, perform anomaly identification on the merchant identifier to obtain the identification result used to characterize whether the merchant identifier is an anomaly identifier.

[0200] In one embodiment, the computer device can identify abnormal merchant identifiers based on three independent stability levels and three cross-variability levels of the merchant identifier, and obtain an identification result to characterize whether the merchant identifier is an abnormal identifier.

[0201] Assuming there exists an ideal merchant whose daily transaction volume, number of transactions, and number of trading parties remain basically unchanged throughout the target time period, then the degree of independent stability of each resource interaction feature of this merchant approaches 1, and the degree of cross-fluctuation between each pair of resource interaction features approaches 0.

[0202] In one embodiment, refer to Figure 8 , Figure 8 A schematic diagram illustrating the identification of anomaly categories is shown in one embodiment. A computer device acquires preset anomaly conditions corresponding to anomaly categories. When at least one of the three independent stability levels and three cross-variability levels of a merchant identifier satisfies the preset anomaly conditions, the merchant identifier is determined to be an anomaly identifier of that anomaly category. The preset anomaly conditions may include independent stability thresholds corresponding to each resource interaction feature, and cross-variability thresholds corresponding to each pair of resource interaction features.

[0203] For example, if the anomaly category is "brushing," merchants engaging in brushing are characterized by a sharp increase in both transaction value and frequency while the number of transacting parties remains relatively small. In this case, the independent stability of the transaction value and frequency is low, while the cross-variability between transaction value and the number of transacting parties, and between the frequency and the number of transacting parties, is high. Therefore, if the independent stability of the transaction value is lower than the preset anomaly threshold, the independent stability of the frequency is lower than the preset anomaly threshold, and the cross-variability between the transaction value and the number of transacting parties exceeds the corresponding preset anomaly thresholds, then the merchant is identified as having a brushing anomaly.

[0204] For example, the anomaly category is illegal transaction category, see reference. Figure 9 , Figure 9The illustration shows a schematic diagram of the transaction behavior of an illegal merchant in one embodiment. It can be seen that illegal merchants typically conduct a small number of transactions during the initial registration phase to circumvent risk control strategies. After successful registration, these illegal merchants are entered into the illegal transaction backend and then remain offline with no transactions until the backend assigns them trades, at which point they generate a large number of transactions in a short period. Therefore, the independent stability of the transaction value, number of transactions, and number of trading parties for illegal merchants is low, while the cross-variability between transaction value and number of transactions, transaction value and number of trading parties, and the number of transactions and number of trading parties is high. Therefore, when the independent stability of the transaction value corresponding to the merchant identifier is lower than the transaction value threshold in the preset anomaly conditions, the independent stability of the number of transactions is lower than the number of transactions threshold in the preset anomaly conditions, the independent stability of the number of trading parties is lower than the number of trading parties threshold in the preset anomaly conditions, the cross-fluctuation degree between the transaction value and the number of trading parties is higher than the corresponding cross-fluctuation degree threshold in the preset anomaly conditions, the cross-fluctuation degree between the number of transactions and the number of trading parties is higher than the corresponding cross-fluctuation degree threshold in the preset anomaly conditions, and the cross-fluctuation degree between the transaction value and the number of transactions is higher than the corresponding cross-fluctuation degree threshold in the preset anomaly conditions, the merchant identifier is determined to be an anomaly identifier of the illegal transaction category.

[0205] Therefore, it can be seen that corresponding preset abnormal conditions can be formulated for different application scenarios, and abnormal merchants can be quickly discovered by using preset abnormal conditions.

[0206] The above-mentioned method for processing resource interaction data has two advantages. First, the calculated degree of independence and cross-variability is not affected by the scale and duration of merchant transactions, making it widely applicable. Second, the calculated degree of independence and cross-variability has a monotonic correlation with the degree of anomaly, and the value range is controllable. This makes it suitable for developing anomaly identification strategies for different application scenarios, and its application in anomaly identification models can also improve performance.

[0207] It should be understood that although the steps in the flowchart above are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowchart above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages in other steps.

[0208] In one embodiment, such as Figure 10 As shown, a resource interaction data processing device is provided. This device can be a software module, a hardware module, or a combination of both as part of a computer device. Specifically, the device includes: an acquisition module 1002, an independent stability determination module 1004, a cross-fluctuation degree determination module 1006, and an identification module 1008, wherein:

[0209] The acquisition module 1002 is used to acquire resource interaction data corresponding to the subject identifier; the resource interaction data includes feature data corresponding to each of the multiple different resource interaction features.

[0210] The independent stability determination module 1004 is used to determine the independent stability of the corresponding resource interaction feature based on the feature data corresponding to each resource interaction feature; the independent stability is used to characterize the degree of fluctuation of the feature data corresponding to the resource interaction feature itself.

[0211] The cross-variance degree determination module 1006 is used to determine the cross-variance degree between any two resource interaction features based on the feature data corresponding to any two resource interaction features among multiple resource interaction features; the cross-variance degree is used to characterize the degree of distribution difference between the feature data corresponding to any two resource interaction features.

[0212] The identification module 1008 is used to identify the abnormal identifier of the subject identifier based on the independent stability of each resource interaction feature among multiple resource interaction features and the degree of cross fluctuation between any two resource interaction features among multiple resource interaction features, and to obtain the identification result used to characterize whether the subject identifier is an abnormal identifier.

[0213] In one embodiment, the resource interaction data is generated based on the resource interaction records generated in each unit time period of the target time period; the independence and stability determination module 1004 is further configured to: for each resource interaction feature, determine the feature data corresponding to each unit time period based on the resource interaction records generated in each unit time period; calculate the distribution dispersion of the feature data corresponding to the resource interaction feature in the target time period based on the feature data corresponding to each unit time period of the resource interaction feature; and normalize the distribution dispersion based on the total duration of the target time period to obtain the independence and stability degree corresponding to the resource interaction feature.

[0214] In one embodiment, the independent stability determination module 1004 is further configured to: when the resource interaction feature is a transaction value, calculate the unit transaction value generated in each unit time based on the transaction records generated in each unit time, and use it as the feature data corresponding to the transaction value in each unit time; when the resource interaction feature is the number of transactions, calculate the unit number of transactions generated in each unit time based on the transaction records generated in each unit time, and use it as the feature data corresponding to the number of transactions in each unit time; when the resource interaction feature is the number of trading parties, calculate the unit number of trading parties generated in each unit time based on the transaction records generated in each unit time, and use it as the feature data corresponding to the number of trading parties in each unit time.

[0215] In one embodiment, the independent stability determination module 1004 is further configured to: determine the total amount of data corresponding to the resource interaction features in the target time period; and calculate the distribution dispersion of the feature data corresponding to the resource interaction features in the target time period based on the ratio of the feature data to the total amount of data in each unit of time.

[0216] In one embodiment, the independence stability determination module 1004 is further configured to calculate the independence stability corresponding to the resource interaction feature using the following formula:

[0217]

[0218]

[0219]

[0220] Among them, H fea D represents the degree of dispersion of the feature data corresponding to resource interaction characteristics within the target time period; span D represents the total duration of the target time period. act This represents the sum of unit times generated by resource interaction records within the target time period; fea i This represents the feature data of the resource interaction characteristics generated in the unit of time of the i-th resource interaction record, fea all This represents the total amount of data corresponding to resource interaction characteristics within the target time period; F fea This indicates the degree of independence and stability corresponding to resource interaction characteristics.

[0221] In one embodiment, any two resource interaction features among the multiple resource interaction features are respectively a first resource interaction feature and a second resource interaction feature; the resource interaction data is generated based on the resource interaction records generated in each unit time of the target time period; the cross-fluctuation degree determination module 1006 is further configured to: determine the first feature data corresponding to each unit time of the first resource interaction feature; determine the second feature data corresponding to each unit time of the second resource interaction feature; calculate the degree of distribution difference between the first resource interaction feature and the second resource interaction feature in the target time period based on the first feature data and the second feature data; and normalize the degree of distribution difference based on the active duration of the target time period to obtain the degree of cross-fluctuation between the first resource interaction feature and the second resource interaction feature.

[0222] In one embodiment, the cross-fluctuation degree determination module 1006 is further configured to: use the first feature data as standard data to calculate the first distribution difference degree between the distribution of the second feature data and the distribution of the first feature data; use the second feature data as standard data to calculate the second distribution difference degree between the distribution of the first feature data and the distribution of the second feature data; and use the average of the first distribution difference degree and the second distribution difference degree as the distribution difference degree between the first resource interaction feature and the second resource interaction feature in the target time period.

[0223] In one embodiment, the cross-fluctuation degree determination module 1006 is further configured to: determine the first total data corresponding to the first resource interaction feature in the target time period; determine the second total data corresponding to the second resource interaction feature in the target time period; calculate the first ratio of the first feature data to the first total data and the second ratio of the second feature data to the second total data in each unit time period; and calculate the first distribution difference degree between the distribution of the second feature data and the distribution of the first feature data based on the first ratio and the second ratio.

[0224] In one embodiment, the cross-fluctuation degree determination module 1006 is further configured to calculate the cross-fluctuation degree between the first resource interaction feature and the second resource interaction feature using the following formula:

[0225]

[0226]

[0227]

[0228] in, This indicates the degree of difference between the distribution of the second feature data and the distribution of the first feature data within the target time period. This indicates the degree of difference between the distribution of the first feature data and the distribution of the second feature data within the target time period; D span D represents the total duration of the target time period. act This represents the sum of unit times generated by resource interaction records within the target time period; fea 1-i This represents the first feature data of the first resource interaction feature at the unit time in which the resource interaction record is generated, where fea 1-all The first total data corresponding to the first resource interaction feature in the target time period, fea 2-i The second feature data, fea, represents the second feature data of the i-th unit of time in which a resource interaction record is generated. 2-all This represents the second total data corresponding to the second resource interaction feature within the target time period; This represents the first ratio of the first feature data to the first total data per unit time corresponding to the first resource interaction feature. This represents the second ratio of the second feature data to the second total data per unit time corresponding to the second resource interaction feature; This indicates the degree of cross-fluctuation between the first resource interaction feature and the second resource interaction feature.

[0229] In one embodiment, the identification module 1008 is further configured to: determine the subject identifier as the abnormal category when the degree of independent stability of at least one of the plurality of resource interaction features and the degree of cross-fluctuation between any two of the plurality of resource interaction features satisfy the preset abnormal conditions corresponding to the abnormal category.

[0230] In one embodiment, the identification module 1008 is further configured to: generate classification features corresponding to the subject identifier based on the degree of independent stability of each resource interaction feature among multiple resource interaction features and the degree of cross-fluctuation between any two resource interaction features among multiple resource interaction features; and perform anomaly identification on the subject identifier according to the classification features through an anomaly identifier identification model to obtain an identification result used to characterize whether the subject identifier is an anomaly identifier.

[0231] Specific limitations regarding the processing device for resource interaction data can be found in the limitations on the processing method for resource interaction data described above, and will not be repeated here. Each module in the aforementioned resource interaction data processing device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0232] In the aforementioned resource interaction data processing device, the independent stability of each resource interaction feature is determined based on the feature data corresponding to each of the multiple resource interaction features of the subject identifier. Furthermore, the cross-variability between any two resource interaction features is determined based on the feature data corresponding to any two of the multiple resource interaction features of the subject identifier. Since the independent stability is used to characterize the fluctuation of the feature data corresponding to the resource interaction feature itself, and the cross-variability is used to characterize the degree of distribution difference between the feature data corresponding to any two resource interaction features, the independent stability and cross-variability can comprehensively reflect the resource interaction stability state of the subject identifier. Based on the independent stability of each resource interaction feature and the cross-variability between any two resource interaction features, anomaly identification of the subject identifier can be performed, thereby improving the accuracy of identifying abnormal subject identifiers.

[0233] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 11 As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores processed data for resource interaction. The network interface communicates with external terminals via a network connection. When executed by the processor, the computer program implements a method for processing resource interaction data.

[0234] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 12 As shown, the computer device includes a processor, memory, and a communication interface connected via a system bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage medium. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a method for processing resource exchange data.

[0235] Those skilled in the art will understand that Figure 11 and Figure 12 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0236] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0237] In one embodiment, a computer-readable storage medium is provided storing a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0238] In one embodiment, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and executes the computer instructions, causing the computer device to perform the steps in the above method embodiments.

[0239] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0240] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0241] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for processing resource interaction data, characterized in that, The method includes: Obtain resource interaction data corresponding to the subject identifier; the resource interaction data includes feature data corresponding to each of multiple different resource interaction features; the resource interaction data is generated based on resource interaction records generated in each unit of time within the target time period; For each resource interaction feature, when the resource interaction feature is a transaction value, the unit transaction value generated in each unit time is calculated based on the transaction records generated in each unit time, and is used as the feature data corresponding to the transaction value in each unit time. When the resource interaction feature is the number of transactions, the number of unit transactions generated in each unit time is counted based on the transaction records generated in each unit time, and is used as the feature data of the number of transactions corresponding to each unit time. When the resource interaction feature is the number of transacting parties, the number of transacting parties generated in each unit of time is counted based on the transaction records generated in each unit of time, and is used as the feature data of the number of transacting parties corresponding to each unit of time. Based on the feature data corresponding to each unit of time for the resource interaction feature, calculate the degree of dispersion of the feature data corresponding to the resource interaction feature in the target time period. Based on the total duration of the target time period, the dispersion of the distribution is normalized to obtain the independent stability degree corresponding to the resource interaction feature; the independent stability degree is used to characterize the fluctuation degree of the feature data itself corresponding to the resource interaction feature. Based on the feature data corresponding to any two resource interaction features among the plurality of resource interaction features, the degree of cross-fluctuation between the two resource interaction features is determined; the degree of cross-fluctuation is used to characterize the degree of distribution difference between the feature data corresponding to the two resource interaction features. Based on the independent stability of each of the multiple resource interaction features and the degree of cross-fluctuation between any two of the multiple resource interaction features, the subject identifier is subjected to anomaly identification to obtain an identification result that characterizes whether the subject identifier is an anomaly identifier.

2. The method according to claim 1, characterized in that, The step of calculating the distribution dispersion of the feature data corresponding to the resource interaction feature in the target time period based on the feature data corresponding to each unit time of the resource interaction feature includes: Determine the total amount of data corresponding to the resource interaction features in the target time period; Based on the ratio of the feature data of each unit time to the total data, the distribution dispersion of the feature data corresponding to the resource interaction feature in the target time period is calculated.

3. The method according to claim 2, characterized in that, The degree of independence and stability corresponding to the resource interaction characteristics is calculated using the following formula: in, This indicates the degree of dispersion of the feature data corresponding to the resource interaction feature in the target time period; This represents the total duration of the target time period. This represents the sum of unit times during which resource interaction records are generated within the target time period; The resource interaction feature is indicated in the first... A unit of time characterized by resource interaction records. This represents the total amount of data corresponding to the resource interaction features in the target time period; This indicates the degree of independence and stability corresponding to the resource interaction characteristics.

4. The method according to claim 1, characterized in that, Any two of the multiple resource interaction features are the first resource interaction feature and the second resource interaction feature, respectively. The step of determining the degree of cross-fluctuation between any two resource interaction features based on the feature data corresponding to any two resource interaction features among the plurality of resource interaction features includes: Determine the first feature data corresponding to each unit of time for the first resource interaction feature; Determine the second feature data corresponding to each unit of time for the second resource interaction feature; Based on the first feature data and the second feature data, calculate the degree of distribution difference between the first resource interaction feature and the second resource interaction feature in the target time period; Based on the active duration of the target time period, the degree of distribution difference is normalized to obtain the degree of cross-fluctuation between the first resource interaction feature and the second resource interaction feature.

5. The method according to claim 4, characterized in that, The step of calculating the degree of distribution difference between the first resource interaction feature and the second resource interaction feature in the target time period based on the first feature data and the second feature data includes: Using the first feature data as standard data, calculate the degree of first distribution difference between the distribution of the second feature data and the distribution of the first feature data; Using the second feature data as standard data, calculate the degree of difference in the second distribution between the distribution of the first feature data and the distribution of the second feature data; The average of the first distribution difference degree and the second distribution difference degree is taken as the distribution difference degree between the first resource interaction feature and the second resource interaction feature in the target time period.

6. The method according to claim 5, characterized in that, The step of calculating the degree of difference in the distribution of the second feature data relative to the distribution of the first feature data, using the first feature data as standard data, includes: Determine the first total data corresponding to the first resource interaction feature in the target time period; Determine the second total data corresponding to the second resource interaction feature in the target time period; Calculate the first ratio of the first characteristic data to the first total data for each unit of time, and the second ratio of the second characteristic data to the second total data for each unit of time. Based on the first ratio and the second ratio, calculate the first distribution difference degree between the distribution of the second feature data and the distribution of the first feature data.

7. The method according to claim 6, characterized in that, The degree of cross-fluctuation between the first resource interaction feature and the second resource interaction feature is calculated using the following formula: in, This indicates the degree of difference between the distribution of the second feature data and the distribution of the first feature data in the first distribution within the target time period. This indicates the degree of difference between the distribution of the first feature data and the distribution of the second feature data in the target time period; This represents the sum of unit times during which resource interaction records are generated within the target time period; Indicates that the first resource interaction feature is in the first... The first characteristic data per unit time of resource interaction record generation The first resource interaction feature is the first total data corresponding to the target time period. Indicates that the second resource interaction feature is in the first A second characteristic data point with a unit of time for generating resource interaction records. This represents the second total data corresponding to the second resource interaction feature in the target time period; This represents the first ratio between the first feature data corresponding to the first resource interaction feature per unit time and the first total data. This represents the second ratio between the second feature data corresponding to the second resource interaction feature per unit time and the second total data; This indicates the degree of cross-fluctuation between the first resource interaction feature and the second resource interaction feature.

8. The method according to claim 1, characterized in that, The method further includes: When the degree of independent stability of at least one of the multiple resource interaction features, and the degree of cross-fluctuation between any two of the multiple resource interaction features, satisfy the preset abnormal conditions corresponding to the abnormal category, the subject identifier is determined to be the abnormal category.

9. The method according to claim 1, characterized in that, The method of identifying anomalies in the subject identifier based on the independent stability of each of the multiple resource interaction features and the degree of cross-fluctuation between any two of the multiple resource interaction features, to obtain an identification result characterizing whether the subject identifier is an anomaly, includes: Based on the degree of independent stability of each of the multiple resource interaction features and the degree of cross-fluctuation between any two of the multiple resource interaction features, the classification feature corresponding to the subject identifier is generated. The anomaly identification model is used to identify the anomaly of the subject identifier based on the classification features, thereby obtaining an identification result that characterizes whether the subject identifier is an anomaly.

10. A resource interaction data processing device, characterized in that, The device includes: The acquisition module is used to acquire resource interaction data corresponding to the subject identifier; the resource interaction data includes feature data corresponding to each of multiple different resource interaction features; the resource interaction data is generated based on the resource interaction records generated in each unit of time within the target time period; The independent stability determination module is used for each resource interaction feature. When the resource interaction feature is a transaction value, it calculates the unit transaction value generated in each unit time period based on the transaction records generated in each unit time period, and uses this as the feature data corresponding to the transaction value in each unit time period. When the resource interaction feature is the number of transactions, it calculates the unit number of transactions generated in each unit time period based on the transaction records generated in each unit time period, and uses this as the feature data corresponding to the number of transactions in each unit time period. When the resource interaction feature is the number of trading parties, it calculates the unit number of trading parties generated in each unit time period based on the transaction records generated in each unit time period, and uses this as the feature data corresponding to the number of trading parties in each unit time period. Based on the feature data corresponding to each unit time period of the resource interaction feature, it calculates the distribution dispersion of the feature data corresponding to the resource interaction feature in the target time period. Based on the total duration of the target time period, it normalizes the distribution dispersion to obtain the independent stability degree corresponding to the resource interaction feature. The independent stability degree is used to characterize the fluctuation degree of the feature data corresponding to the resource interaction feature itself. The cross-fluctuation degree determination module is used to determine the cross-fluctuation degree between any two resource interaction features based on the feature data corresponding to any two resource interaction features among the plurality of resource interaction features; the cross-fluctuation degree is used to characterize the degree of distribution difference between the feature data corresponding to any two resource interaction features; The identification module is used to identify the main entity identifier based on the independent stability of each of the multiple resource interaction features and the degree of cross-fluctuation between any two of the multiple resource interaction features, and to obtain an identification result that characterizes whether the main entity identifier is an abnormal identifier.

11. The resource interaction data processing apparatus according to claim 10, characterized in that, The independent stability determination module is also used to determine the total amount of data corresponding to the resource interaction feature in the target time period; and to calculate the distribution dispersion of the feature data corresponding to the resource interaction feature in the target time period based on the ratio of the feature data of each unit time to the total amount of data.

12. The resource interaction data processing apparatus according to claim 11, characterized in that, The independent stability determination module is also used to calculate the independent stability corresponding to the resource interaction feature using the following formula: in, This indicates the degree of dispersion of the feature data corresponding to the resource interaction feature in the target time period; This represents the total duration of the target time period. This represents the sum of unit times during which resource interaction records are generated within the target time period; The resource interaction feature is indicated in the first... A unit of time characterized by resource interaction records. This represents the total amount of data corresponding to the resource interaction features in the target time period; This indicates the degree of independence and stability corresponding to the resource interaction characteristics.

13. The resource interaction data processing apparatus according to claim 10, characterized in that, Any two of the multiple resource interaction features are the first resource interaction feature and the second resource interaction feature, respectively. The cross-fluctuation degree determination module is also used to determine the first feature data corresponding to each unit of time for the first resource interaction feature; Determine the second feature data corresponding to each unit time for the second resource interaction feature; calculate the degree of distribution difference between the first resource interaction feature and the second resource interaction feature in the target time period based on the first feature data and the second feature data; normalize the degree of distribution difference based on the active duration of the target time period to obtain the degree of cross-fluctuation between the first resource interaction feature and the second resource interaction feature.

14. The resource interaction data processing apparatus according to claim 13, characterized in that, The cross-fluctuation degree determination module is further configured to use the first feature data as standard data to calculate a first distribution difference degree between the distribution of the second feature data and the distribution of the first feature data; use the second feature data as standard data to calculate a second distribution difference degree between the distribution of the first feature data and the distribution of the second feature data; and use the average of the first distribution difference degree and the second distribution difference degree as the distribution difference degree between the first resource interaction feature and the second resource interaction feature in the target time period.

15. The resource interaction data processing apparatus according to claim 14, characterized in that, The cross-fluctuation degree determination module is further configured to determine the first total data corresponding to the first resource interaction feature in the target time period; determine the second total data corresponding to the second resource interaction feature in the target time period; calculate the first ratio of the first feature data to the first total data in each unit time period, and the second ratio of the second feature data to the second total data in each unit time period; and calculate the first distribution difference degree of the distribution of the second feature data relative to the distribution of the first feature data based on the first ratio and the second ratio.

16. The resource interaction data processing apparatus according to claim 15, characterized in that, The cross-fluctuation degree determination module is further configured to calculate the cross-fluctuation degree between the first resource interaction feature and the second resource interaction feature using the following formula: in, This indicates the degree of difference between the distribution of the second feature data and the distribution of the first feature data in the first distribution within the target time period. This indicates the degree of difference between the distribution of the first feature data and the distribution of the second feature data in the target time period; This represents the sum of unit times during which resource interaction records are generated within the target time period; Indicates that the first resource interaction feature is in the first... The first characteristic data per unit time of resource interaction record generation The first resource interaction feature is the first total data corresponding to the target time period. Indicates that the second resource interaction feature is in the first A second characteristic data point with a unit of time for generating resource interaction records. This represents the second total data corresponding to the second resource interaction feature in the target time period; This represents the first ratio between the first feature data corresponding to the first resource interaction feature per unit time and the first total data. This represents the second ratio between the second feature data corresponding to the second resource interaction feature per unit time and the second total data; This indicates the degree of cross-fluctuation between the first resource interaction feature and the second resource interaction feature.

17. The resource interaction data processing apparatus according to claim 10, characterized in that, The identification module is further configured to determine the subject identifier as the abnormal category when the degree of independent stability of at least one of the plurality of resource interaction features and the degree of cross-fluctuation between any two of the plurality of resource interaction features satisfy the preset abnormal conditions corresponding to the abnormal category.

18. The resource interaction data processing apparatus according to claim 10, characterized in that, The identification module is further configured to generate a classification feature corresponding to the subject identifier based on the independent stability of each of the plurality of resource interaction features and the degree of cross-fluctuation between any two of the plurality of resource interaction features; and to perform anomaly identification on the subject identifier according to the classification feature through an anomaly identification model to obtain an identification result characterizing whether the subject identifier is an anomaly identifier.

19. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 9.

20. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 9.

21. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 9.

Images