Subject classification method and apparatus

Abstract

A subject classification method and device, a computing device and a storage medium are disclosed. The subject classification method comprises: obtaining resource transfer history information of a first subject performing a first resource transfer operation of a first operation type; determining a subject attribute value of the first subject based on the resource transfer history information of the first subject, wherein the subject attribute value indicates a possibility of the first subject performing another resource transfer operation of the first operation type after the first resource transfer operation of the first operation type is blocked; in response to the subject attribute value of the first subject being greater than or equal to a subject attribute threshold, obtaining association information of a second resource transfer operation performed between the first subject and a second subject after the first resource transfer operation of the first operation type is blocked; and determining a subject type of the second subject based on at least the association information of the second resource transfer operation.

Description

Technical Field

[0001] This application relates to the technical field of classification, and in particular to a subject classification method and apparatus, as well as corresponding computing devices and storage media. Background Technology

[0002] Different types of entities tend to perform different types of operations. Depending on the nature of the operation, different types of operations should be treated differently—for example, allowing the operation to proceed or preventing it from proceeding. Similarly, different types of entities should also be treated differently—for example, allowing one type of entity to perform a certain operation while disallowing another type of entity from performing that operation.

[0003] In relevant fields, the determination of a subject's type is often based on the fact that the subject has already performed a large number of operations of a certain type. However, if a subject has not yet performed a large number of operations of a certain type, for example, if the subject has just been used in a new operational field, it may be impossible to determine the subject's type in a timely and accurate manner. This may lead to the inability to take appropriate measures against the subject in a timely manner. Therefore, a method is needed to classify subjects in a timely and accurate manner, so as to take appropriate measures in a timely manner. Summary of the Invention

[0004] According to one aspect of this application, a subject classification method is provided, characterized in that the method includes: acquiring resource transfer history information of a first subject performing a first resource transfer operation of a first operation type; determining a subject attribute value of the first subject based on the resource transfer history information of the first subject, wherein the subject attribute value indicates the possibility that the first subject will perform another resource transfer operation of a first operation type after the first resource transfer operation of the first operation type is blocked; in response to the subject attribute value of the first subject being greater than or equal to a subject attribute threshold, acquiring association information of a second resource transfer operation performed between the first subject and a second subject after the first resource transfer operation of the first operation type was blocked; and determining the subject type of the second subject based at least on the association information of the second resource transfer operation.

[0005] In some embodiments, determining the subject attribute value of the first subject based on the resource transfer history information of the first subject includes: inputting the resource transfer history information into multiple subject attribute determination models to obtain multiple initial values ​​of subject attributes, wherein each of the multiple subject attribute determination models represents a model used to predict the probability of the first subject performing a resource transfer operation of a first operation type; weighting the multiple initial values ​​of subject attributes based on the accuracy of each of the multiple subject attribute determination models; and determining the subject attribute value of the first subject based on the multiple weighted initial values ​​of subject attributes.

[0006] In some embodiments, the resource transfer history information of the first subject includes at least one of the following: the number of times, frequency, average resource transfer amount, and cumulative resource transfer amount that the first subject has performed resource transfer operations of the first operation type, as well as the time when the first subject first performed a resource transfer operation of the first operation type and the time when the first subject last performed a resource transfer operation of the first operation type.

[0007] In some embodiments, the first resource transfer operation is performed between the first subject and a third subject belonging to the first subject type, and the associated information of the second resource transfer operation includes at least one of the following: the time of the second resource transfer operation, the amount of resources transferred in the second resource transfer operation, the identity information of the second subject, and the similarity between the second subject and the third subject.

[0008] In some embodiments, determining the subject type of the second subject based at least on the association information of the second resource transfer operation includes: determining the subject type of the second subject based on the similarity between the second subject and the third subject in response to at least one of the following conditions being met: the interval between the time of the first resource transfer operation and the time of the second resource transfer operation is less than or equal to a time interval threshold; the difference between the resource transfer amount of the first resource transfer operation and the resource transfer amount of the second resource transfer operation is less than or equal to a resource transfer amount threshold.

[0009] In some embodiments, determining the subject type of the second subject based on the similarity between the second subject and the third subject includes: determining the subject type of the second subject based on the similarity between the second subject and the third subject and the subject characteristics of the second subject, wherein the subject characteristics of the second subject include at least one of the object characteristics of the second subject's historical resource transfers, the total amount of resource transfers, and the average amount of resource transfers.

[0010] In some embodiments, determining the subject type of the second subject based on the similarity between the second subject and the third subject and the subject features of the second subject includes: inputting the similarity between the second subject and the third subject and the subject features of the second subject into a subject classification model to determine the subject type of the second subject, wherein the subject classification model is a trained classifier model for predicting subject types.

[0011] In some embodiments, the subject classification model is obtained by training a classifier model through active learning, wherein the initial training samples include subjects belonging to a first subject type based on manual review, subjects belonging to the first subject type predicted by a model with a prediction accuracy exceeding a predetermined accuracy, and subjects belonging to a second subject type different from the first subject type based on manual review.

[0012] In some embodiments, determining the subject type of the second subject based at least on the association information of the second resource transfer operation includes: determining the subject type of the second subject to be a second subject type different from the first subject type in response to at least one of the following conditions: the interval between the time of the first resource transfer operation and the time of the second resource transfer operation is less than or equal to a time interval threshold; the difference between the resource transfer amount of the first resource transfer operation and the resource transfer amount of the second resource transfer operation is less than or equal to a resource transfer amount threshold; and the identity information of the second subject indicates that the subject type of the second subject is a second subject type.

[0013] In some embodiments, the similarity between the second subject and the third subject includes at least one of the following: the similarity of the registration information of the second subject and the third subject, and the similarity of the resource transfer history information of the second subject and the third subject.

[0014] In some embodiments, the similarity of the registration information of the second subject and the third subject includes the similarity or relevance of the second subject and the third subject in at least one of the following: registration name, registration identity, registration time, registration number, and registration address.

[0015] In some embodiments, the similarity of the resource transfer history information of the second subject and the third subject includes at least one of the following: object similarity of historical resource transfer operations, average resource transfer amount similarity of each resource transfer operation, cumulative resource transfer amount similarity, time similarity of the initial resource transfer operation, and similarity or correlation of resource transfer medium.

[0016] According to another aspect of this application, a subject classification apparatus is provided, characterized in that the apparatus comprises: a first acquisition module configured to acquire resource transfer history information of a first subject performing a first resource transfer operation of a first operation type; a first determination module configured to determine a subject attribute value of the first subject based on the resource transfer history information of the first subject, wherein the subject attribute value indicates the possibility that the first subject will perform another resource transfer operation of a first operation type after the first resource transfer operation of the first operation type is blocked; a second acquisition module configured to acquire association information of a second resource transfer operation performed between the first subject and a second subject after the first resource transfer operation of the first operation type is blocked, in response to the subject attribute value of the first subject being greater than or equal to a subject attribute threshold; and a second determination module configured to determine the subject type of the second subject based at least on the association information of the second resource transfer operation.

[0017] According to another aspect of this application, a computing device is provided, comprising: a memory configured to store computer-executable instructions; and a processor configured to perform the method as described in any embodiment of this application when the computer-executable instructions are executed by the processor.

[0018] According to another aspect of this application, a computer-readable storage medium is provided that stores computer-executable instructions thereon, which, when executed, perform the method described in any embodiment of this application.

[0019] According to another aspect of this application, a computer program product is provided, including computer instructions that, when executed by a processor, implement the steps of the method as described in any embodiment of this application. Attached Figure Description

[0020] Figure 1 The diagram schematically illustrates the structure of a network architecture in which the technical solutions according to embodiments of this application can be implemented.

[0021] Figure 2 A flowchart illustrating a subject classification method according to an embodiment of this application is shown schematically.

[0022] Figure 3 A schematic diagram illustrating the implementation process of the subject classification method according to an embodiment of this application is shown.

[0023] Figure 4 A flowchart illustrating a subject classification method according to another embodiment of this application is shown schematically.

[0024] Figure 5Another schematic diagram illustrating the implementation process of the subject classification method according to an embodiment of this application is shown.

[0025] Figure 6 A schematic diagram illustrating an implementation scenario of the subject classification method according to an embodiment of this application is shown.

[0026] Figure 7 The training process of a subject classification model according to some embodiments of this application is illustrated schematically.

[0027] Figure 8 An example block diagram of a subject sorting device according to some embodiments of this application is shown schematically.

[0028] Figure 9 An example block diagram of a computing device according to some embodiments of this application is illustrated schematically. Detailed Implementation

[0029] The technical solutions of this application will now be clearly and completely described with reference to the accompanying drawings. The described embodiments are merely some embodiments of this application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0030] Artificial intelligence (AI) is the theory, methods, technology, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce a new kind of intelligent machine that can react in a way similar to human intelligence. AI studies the design principles and implementation methods of various intelligent machines, enabling them to possess the functions of perception, reasoning, and decision-making.

[0031] Artificial intelligence (AI) is a comprehensive discipline encompassing a wide range of fields, including both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies primarily include computer vision, speech processing, natural language processing, as well as machine learning / deep learning, autonomous driving, intelligent transportation, and automatic control.

[0032] Machine learning (ML) is a multidisciplinary field involving probability theory, statistics, approximation theory, convex analysis, and algorithm complexity theory. It specifically studies how computers can simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to endow computers with intelligence; its applications span all areas of artificial intelligence. Machine learning and deep learning typically include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, instructional learning, and active learning.

[0033] With the research and advancement of artificial intelligence (AI) technology, AI is being studied and applied in various fields, such as smart homes, smart wearable devices, virtual assistants, smart speakers, smart marketing, autonomous driving, drones, robots, smart healthcare, smart customer service, vehicle networking, and intelligent transportation. It is believed that with the development of technology, AI will be applied in more fields and play an increasingly important role.

[0034] As mentioned earlier, different types of operations should be treated differently. Specifically, taking resource transfer operations as an example, in this field, resource transfer operations can include normal resource transfer operations and abnormal (i.e., anomalous) resource transfer operations. The types of entities performing resource transfer operations can also include normal resource transfer entities and anomalous resource transfer entities. Anomalous resource transfer operations should be accurately identified and quickly prevented. By identifying the participants in the anomalous resource transfer operation, i.e., the anomalous resource transfer entity, or simply the anomalous entity, and then preventing its resource transfer operation, the anomalous resource transfer operation can be stopped. In related technologies, whether a resource transfer entity is anomalous can be determined through a comprehensive analysis of the characteristics of multiple resource transfer operations that have reached a certain scale. However, before the anomalous resource transfer entity is identified, its anomalous resource transfer operation has already been completed and cannot be prevented. Moreover, after the anomalous resource transfer entity is identified and prevented from performing a resource transfer operation, the actual controller of that resource transfer entity can provide another resource transfer entity that has not been identified as an anomalous entity to continue the anomalous resource transfer operation. Identifying this other resource transfer entity still requires comprehensive analysis of the characteristics of multiple resource transfer operations, so a large number of abnormal resource transfer operations have already been completed. Therefore, the goal is to quickly and accurately identify abnormal resource transfer entities and prevent them from completing their abnormal resource transfer operations.

[0035] In the context of this application, "resources" specifically refers to resources that can be transferred between different entities, particularly resources that can be monetized, such as cash and stocks, but are not limited to physical currency. A resource transfer operation refers to the process of transferring resources from a resource transferor to a resource transferee. The resource transferor and the resource transferee are the entities involved in the resource transfer operation. The entities involved in the resource transfer operation can be institutions, organizations, or individuals engaged in the provision of services or goods, or in some operational activity, using machinery and equipment for resource transfer, including but not limited to merchants' and businesses' computers, servers, or mobile devices such as mobile phones. Abnormal resource transfer operations refer to transactions involved in resource transfer operations or other activities that do not comply with legal or ethical standards.

[0036] As mentioned earlier, preventing resource transfers by entities with abnormal resource transfer records can effectively stop such transfers. Besides the resource transferor and transferee, resource transfers often require the support of assisting parties, such as banks or third-party payment platforms. Therefore, assisting parties can be equipped with the ability to identify abnormal resource transfer entities, allowing for prevention before the transfer is completed. For example, when initiating a resource transfer, the transferor needs to send its own information and the transferor's information to the assisting party. An assisting party with the ability to identify abnormal entities can determine whether either the transferor or transferee is an abnormal entity based on their information. If at least one is identified as abnormal, the assisting party can terminate the transfer, preventing the transfer of resources from the transferor to the transferee. Furthermore, the focus can shift from the resource transfer operation itself to the entire entity involved. For instance, the assisting party can disable the transferor's resource transfer function for more stringent prevention.

[0037] However, the inventors discovered some flaws in the process of identifying anomalous entities. First, after identifying a resource transfer entity, the relevant technology requires identifying whether the entity is anomalous based on the characteristics of its multiple completed resource transfer operations. If at least a portion of these multiple resource transfer operations are anomalous, then the entity can be identified as anomalous. However, these anomalous resource transfer operations are already completed, and the adverse consequences and effects they have caused are irreversible. Moreover, even if these anomalous entities' resource transfer operations are blocked, their actual owners can provide new, unidentified resource transfer entities to continue the anomalous resource transfer operations; these new entities still need to complete multiple anomalous resource transfer operations before being identified. In the relevant technology, it is impossible to identify new anomalous entities based solely on a single resource transfer operation, especially a single, incomplete resource transfer operation, thereby failing to achieve real-time detection and countermeasures against anomalous entities.

[0038] Second, in related technologies, once a resource transfer entity is identified as an anomalous entity, all its resource transfer operations are blocked. However, an anomalous entity may still perform non-nominal resource transfer operations. Blocking all resource transfer operations of an anomalous entity could potentially have negative consequences in other areas.

[0039] On the other hand, the inventors also discovered that some abnormal resource transfer operations may be caused by the blocking of prior abnormal resource transfer operations by related abnormal entities. For example, there are abnormal resource transferors who initiate subsequent resource transfer operations to later resource transferees, possibly because their earlier resource transfer operations to earlier resource transferees were blocked because those earlier resource transferees were considered abnormal entities. The actual effect of transferring resources to the later resource transferee may be the same as transferring resources to the earlier resource transferee (for example, the two resource transferees may belong to the same owner). In other words, such abnormal resource transferors are highly likely to quickly initiate another abnormal resource transfer operation to a later resource transferee after their previous abnormal resource transfer operation to the earlier resource transferee was blocked. In this case, if such abnormal resource transferors can be identified, then it can be determined with a high degree of confidence that the later resource transferee is also an abnormal entity, and the subsequent resource transfer operation can be blocked. This effectively prevents situations where the actual owner of an anomalous entity provides a new, unidentified entity to continue the resource transfer operation after a prior anomalous resource transfer operation has been blocked. It should be noted that the above scenario is not limited to identifying anomalous subsequent resource transferees, but can also be applied to identifying anomalous subsequent resource transferors.

[0040] This application provides a subject classification method. Figure 1 The diagram schematically illustrates the structure of a network architecture 100 in which the technical solution according to an embodiment of this application can be implemented. For example... Figure 1 As shown, network architecture 100 may include a cluster of servers and terminal devices. The server cluster may include at least one server, such as server 105a, server 105b, etc. The terminal device cluster may include at least one terminal device, such as terminal device 110a, terminal device 110b, etc. This application does not limit the number of terminal devices. Figure 1 As shown, each terminal device 100a and 110b can connect to server 105a via a network, so that each terminal device 100a and 110b can interact with server 105a. Server 105a may connect to server 105b via a network in order to obtain data from server 105b.

[0041] The server in this application can be, for example, a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks, and big data and artificial intelligence platforms. The terminal device can be, for example, a smartphone, tablet, laptop, desktop computer, smart TV, or other smart terminal.

[0042] The following describes an embodiment of this application using communication between terminal device 110a and server 105a as an example. The subject classification method according to embodiments of this application can be implemented in the terminal device, in the server, or in a combination of a terminal device and a server. For example, in a resource transfer operation of a certain type (e.g., a normal resource transfer operation), the resource transfer subject can send information about its intended resource transfer operation to server 105a through terminal device 110a. Server 105a can process the resource transfer operation information and complete the resource transfer operation in the background. Server 105a can also send information that the resource transfer operation has been completed to terminal device 110b owned by another resource transfer subject.

[0043] In the case of a resource transfer operation of a different type (e.g., an abnormal resource transfer operation), a first entity can send information about its intended first resource transfer operation to server 105a via terminal device 110a. This first resource transfer operation is performed between a first entity and a third entity. The third entity belongs to the first entity type. Server 105a can obtain information associated with the first resource transfer operation, such as information related to the third entity. This information may exist on server 105a or be obtained from other servers, such as server 105b. Server 105a can determine the type of the first resource transfer operation based on the information associated with it, such as whether it is an abnormal resource transfer operation. If the first resource transfer operation is an abnormal resource transfer operation, server 105a can block it and obtain the first entity's resource transfer history information. The first entity's resource transfer history information may include information about resource transfer operations previously performed by the first entity, including completed resource transfer operations and incomplete resource transfer operations (such as operations initiated by the first entity but blocked by the server), and may include information about the first resource transfer operation. The resource transfer history information of the first subject can exist in server 105a or be obtained from other servers, such as server 105b. Based on the obtained resource transfer history information of the first subject, server 105a can determine the subject attribute value of the first subject. This subject attribute value indicates the probability that the first subject will perform a resource transfer operation of the same type after a first resource transfer operation of one type is blocked. Server 105a may also include a subject attribute threshold. If the subject attribute value of the first subject is greater than or equal to the subject attribute threshold, it means that the first subject has a high probability of performing another resource transfer operation of the same type after the first resource transfer operation is blocked. In this case, server 105a will continue to monitor the subsequent resource transfer operations of the first subject. If server 105a receives information that the first subject has initiated a second resource transfer operation, server 105a obtains the association information of the second resource transfer operation. The second resource transfer operation is performed between the first subject and the second subject. Then, server 105a can determine the subject type of the second subject based on the association information of the second resource transfer operation and determine whether to block the second resource transfer operation. Of course, this is not limiting; some or all of the above processes can also be completed in terminal device 110a. Specific details of the above processes will be described later.

[0044] According to one aspect of this application, a subject classification method 200 is provided. Figure 2A flowchart illustrating a subject classification method according to an embodiment of this application is shown schematically. This method can be executed by server 105a, terminal device 110a, or a combination of terminal device and server working together. For ease of understanding, the embodiments of this application are described using the method executed by server 105a as an example. Figure 2 As shown, the method may include the following steps: In step S205, the resource transfer history information of the first entity that performed the first resource transfer operation of the first operation type is obtained; In step S210, based on the resource transfer history information of the first subject, a subject attribute value of the first subject is determined, wherein the subject attribute value indicates the possibility that the first subject may perform another resource transfer operation of the first operation type after the first resource transfer operation of the first operation type is blocked. In step S215, in response to the first subject's subject attribute value being greater than or equal to a subject attribute threshold, the association information of the second resource transfer operation between the first subject and the second subject after the first resource transfer operation of the first operation type was blocked is obtained; and In step S220, the subject type of the second subject is determined based at least on the associated information of the second resource transfer operation.

[0045] These steps will be described in detail below.

[0046] First, the process of obtaining the resource transfer history information of the first subject performing the first resource transfer operation of the first operation type is described (step S205).

[0047] The first resource transfer operation in this step is performed between the first entity and the third entity. In some embodiments, the first resource transfer operation is a process in which the first entity actively transfers resources to the third entity, where the first entity is the resource transferor and the third entity is the resource transferee. In other embodiments, the first resource transfer operation is a process in which the first entity extracts resources from the resource pool of the third entity, where the first entity is the resource transferee and the third entity is the resource transferor. It is understood that in the latter embodiment, there may be an agreement between the first entity and the third entity, which may stipulate that the first entity can extract resources from the resource pool of the third entity within a certain range of resource transfer without the third entity's confirmation. In the former embodiment, such an agreement may not be necessary. The following description of step S205 will continue with the former embodiment as an example.

[0048] Step S205 assumes that the first entity has performed a first resource transfer operation of the first operation type. The classification of resource transfer operations can be based on whether the operation is abnormal. For example, a resource transfer operation of the first operation type can be an abnormal operation, while a resource transfer operation of the second operation type can be a normal operation. Here, "performing" only indicates that the first entity initiated the first resource transfer operation. For instance, the first entity inputs the object and resource transfer amount of the first resource transfer operation to terminal device 110a, and then terminal device 110a sends the information of the first resource transfer operation to server 105a. However, this does not mean that the first resource transfer operation has been completed. Server 105a may, after analyzing the information of the first resource transfer operation, determine that the first resource transfer operation should not be performed and does not instruct the backend to perform the resource transfer operation according to the first entity's request. Specifically, server 105a may determine that the first resource transfer operation is abnormal based on the information of the entity performing the first resource transfer operation, indicating that the first resource transfer operation is between abnormal resource transfer entities, or it may determine that the first resource transfer operation is abnormal based on the resource transfer amount meeting a certain condition, and then prevent the first abnormal resource transfer operation from proceeding. Before step S205 is performed, the first entity may have been identified as an abnormal resource transfer entity, for example, the first entity may have performed an abnormal resource transfer operation before step S205, or it may not have been identified as an abnormal resource transfer entity, for example, the first resource transfer operation is the first abnormal resource transfer operation performed by the first entity.

[0049] After confirming that a first entity has performed a resource transfer operation of the first operation type, the entity classification method according to embodiments of this application will obtain the resource transfer history information of the first entity that performed the first resource transfer operation of the first operation type. In some embodiments, the resource transfer history information includes at least one of six data types: the number of times the first entity performed the first operation type resource transfer operation, the frequency, the average resource transfer amount, the cumulative resource transfer amount, and the time when the first entity first performed the first operation type resource transfer operation and the time when the first entity last performed the first operation type resource transfer operation. This resource transfer history information can reflect the degree to which the first entity is addicted to performing the first operation type resource transfer operation. The inventors believe that the greater the degree to which a resource transfer entity is addicted to performing the first operation type resource transfer operation, the greater the likelihood that after a prior resource transfer operation of the first operation type with the original resource transfer object is blocked, it will quickly perform a subsequent resource transfer operation of the first operation type with another resource transfer object to complete the blocked resource transfer. After identifying such a highly addicted entity, the subsequent resource transfer operation it performs after the prior resource transfer operation is blocked is very likely to be a resource transfer operation of the same operation type. The resource transfer object in the subsequent resource transfer operation will most likely be a subject of the same subject type as the resource transfer object in the online resource transfer operation.

[0050] After obtaining the resource transfer history information of the first subject performing the first resource transfer operation of the first operation type, the subject attribute value of the first subject can be determined based on the resource transfer history information of the first subject (step S210). The subject attribute value indicates the probability that the first subject will perform another resource transfer operation of the first operation type after the first resource transfer operation of the first operation type is blocked. The subject attribute value is a numerical representation of this probability. By measuring the magnitude of the subject attribute value, the degree to which the first subject is prone to performing resource transfer operations of the first operation type can be measured, so as to determine the operation type of the first subject's subsequent resource transfer operations. In some embodiments, at least one type of resource transfer history information is input into an established model, which can output the subject attribute value of the first subject based on the input resource transfer history information of the first subject. The process of constructing this model will be described in more detail later.

[0051] After determining the subject attribute value of the first subject, in response to the subject attribute value being greater than or equal to the subject attribute threshold, the association information of the second resource transfer operation performed by the first subject with the second subject after the first resource transfer operation of the first operation type was blocked is obtained (step S215). After the aforementioned model outputs the subject attribute value of the first subject, the degree to which the first subject is addicted to performing resource transfer operations of the first operation type can be determined. The subject attribute threshold can be a preset threshold. If the subject attribute value of the first subject is greater than or equal to the subject attribute threshold, it indicates that the probability of the first subject performing a subsequent resource transfer operation of the first operation type to another resource transfer object after the previous resource transfer operation of the first operation type was blocked is high. In this case, the server 105a can monitor whether the first subject has performed a subsequent second resource transfer operation. If the first subject with a subject attribute value greater than or equal to the subject attribute threshold performs a subsequent second resource transfer operation after the previous resource transfer operation of the first operation type was blocked, then the second resource transfer operation is very likely to also be a resource transfer operation of the first operation type, and the object of the second resource transfer operation is very likely to be a subject of the same type as the object of the first resource transfer operation. If the attribute value of the first subject is less than the subject attribute threshold, it indicates that the first subject is less likely to perform a subsequent resource transfer operation of the first operation type to another resource transfer object after the previous first operation type resource transfer operation was blocked. In this case, its subsequent resource transfer operation can be disregarded.

[0052] After server 105a detects that a first entity with a subject attribute value greater than or equal to the subject attribute threshold has performed a second resource transfer operation with a second entity different from the aforementioned third entity after the first resource transfer operation has been blocked, server 105a can obtain the association information of the second resource transfer operation. The association information of the second resource transfer operation can be related to the specific information of the second resource transfer operation, such as the time and amount of resources transferred. This information is unaffected by the object of the second resource transfer operation. That is, regardless of the object of the second resource transfer operation, the specific information of the second resource transfer operation is definite. This specific information of the second resource transfer operation is relatively simple, and obtaining it is relatively easy. Therefore, by selecting this specific information as the association information of the second resource transfer operation, the association information of the second resource transfer operation can be obtained relatively quickly, thereby starting subsequent operations more quickly. Furthermore, since this specific information of the second resource transfer operation is relatively simple, the subsequent operations based on this information require relatively few computational resources.

[0053] In other embodiments, the associated information of the second resource transfer operation can also be derived information of the object of the second resource transfer operation—the second subject, such as the second subject's registration information, resource transfer history information, resource transfer medium, and identity information. After the first subject initiates the second resource transfer operation with the second subject, the server can retrieve the aforementioned derived information of the second subject based on the received basic information of the second subject. This derived information is often more essential information about the second subject. By comparing the derived information of the second subject with the corresponding derived information of the aforementioned third subject, it can be found whether there is a relationship between the second subject and the third subject. If there is a relationship between the second subject and the third subject, and the third subject has been identified as a subject of a certain subject type (e.g., the first subject type), the second subject is also highly likely to be a subject of that subject type (e.g., the second subject is also a subject of the first subject type). This method of determining the subject type of the second subject based on the relationship between the two subjects has higher accuracy.

[0054] After obtaining the association information of the second resource transfer operation, the subject type of the second subject can be determined based on the association information of the second resource transfer operation (step S220). The inventors have discovered that if a first subject performs another resource transfer operation of the same type after a first resource transfer operation of a certain type is blocked, then this other resource transfer operation of the same type will have some characteristics. For example, the other resource transfer operation of the same type is generally initiated soon after the first resource transfer operation is blocked, rather than being initiated long after the first resource transfer operation is blocked. Also, the resource transfer amount of the other resource transfer operation of the same type is often close to the resource transfer amount of the first resource transfer operation, because the purpose of the other resource transfer operation of the same type is generally to compensate for the failure of the first resource transfer operation of the same type to complete, and the compensated resource transfer amount should also be the resource transfer amount that the first resource transfer operation hoped to achieve. The inventors have also discovered that if a first subject performs another resource transfer operation of the same type after a first resource transfer operation of a certain type is blocked, the resource transfer object of the other resource transfer operation of the same type is often related to the resource transfer object of the prior first resource transfer operation. The connection lies in the fact that the resource transfer objects of these two resource transfer operations are controlled by the same controller. The registration information, resource transfer history, transfer medium, and identity information of resource transfer objects belonging to the same controller are likely to be identical or similar. By acquiring and analyzing the aforementioned information related to the second resource transfer operation itself or to the second entity, the type of the second entity can be determined more accurately. Furthermore, if the second entity can be determined to be a trustworthy entity based on the association information of the second resource transfer operation, then the second resource transfer operation can be left unblocked, thus maintaining normal resource transfer activities.

[0055] After identifying the second entity as the same entity type as the resource transfer object of the first resource transfer operation, for example, when determining that the entity type of the second entity is the same as the first entity type, in some embodiments, the second entity can also be targeted, such as preventing resource transfer activities related to it, or even arresting its controller offline.

[0056] The subject classification method proposed in this application focuses more on the actions of the resource transfer subject after the prior resource transfer operation has been blocked, essentially predicting subsequent resource transfer operations. When a subsequent resource transfer operation does occur, this method can identify the subject type of the resource transfer object earlier and block it. By utilizing the subject classification method according to the embodiments of this application, even if the actual controller of the resource transfer object of the blocked prior first operation type resource transfer operation provides a new resource transfer object, since the subsequent resource transfer operation is initiated by a resource transfer subject highly addicted to performing the first operation type resource transfer operation, the new resource transfer object can be quickly identified as a subject of the same type as the resource transfer object of the first resource transfer operation. The subsequent resource transfer operation with this new resource transfer object can be blocked in real time before it is completed, greatly advancing the point of attack for the first operation type resource transfer operation and curbing this type of resource transfer operation earlier, because the identification of the subject type of the new resource transfer object does not require it to have performed a certain amount of resource transfer operations as a basis.

[0057] In addition, the subject classification method proposed in this application analyzes the association information of subsequent resource transfer operations. Only when a subsequent resource transfer operation meets certain conditions, and / or the object of the subsequent resource transfer operation meets certain conditions, will the object of the subsequent resource transfer operation be identified as a subject of the same subject category as the object of the preceding resource transfer operation. This improves the accuracy of identification and reduces the impact on normal resource transfer operations.

[0058] Figure 3 A schematic diagram illustrating the implementation process of the subject classification method according to an embodiment of this application is shown. Figure 3As shown, after the server receives a request from a resource transfer subject (e.g., the first subject) to initiate a resource transfer operation (e.g., the first subject inputs the resource transfer amount and resource transfer object, such as information of a third subject, into a terminal device, and the terminal device provides this information to the server), the server can input at least one of the resource transfer subject's information, the resource transfer amount, and the resource transfer object's information into the operation type recognition model to determine whether the first resource transfer operation is a resource transfer operation of the first operation type. If it is determined that the first resource transfer operation is not a resource transfer operation of the first operation type, the method ends, and the background is instructed to complete the first resource transfer operation. If it is determined that the first resource transfer operation is a resource transfer operation of the first operation type, the resource transfer history information of the first subject is obtained. The resource transfer history information of the first subject includes at least one of the number of times, frequency, average resource transfer amount, cumulative resource transfer amount, and the time of the first subject's first and last resource transfer operations of the first operation type. The above-mentioned resource transfer history information can be used to evaluate the degree to which the first subject is addicted to performing resource transfer operations of the first operation type. For example, if the first entity performs resource transfer operations of the first operation type a large number of times, or performs resource transfer operations of the first operation type frequently, or the average or cumulative resource transfer amount of the first operation type resource transfer operations performed by the first entity is high, it indicates that the first entity is deeply addicted to performing resource transfer operations of the first operation type. Similarly, if the first entity first performed a resource transfer operation of the first operation type a long time ago, or the first entity last performed a resource transfer operation of the first operation type recently, or the interval between the first and last performances of the first operation type resource transfer operation is large, it also indicates that the first entity is deeply addicted to performing resource transfer operations of the first operation type.

[0059] After acquiring the resource transfer history information of the first subject, the resource transfer history information is input into the subject attribute determination model. Based on the resource transfer history information of the first subject, the subject attribute determination model outputs the subject attribute value of the first subject. As mentioned earlier, resource transfer history information can be used to evaluate the degree to which the first subject is addicted to performing a certain type of resource transfer operation. Therefore, it can be understood that when the resource transfer history information is input into the subject attribute determination model, the subject attribute value output by the model can directly reflect the degree to which the first subject is addicted to performing that type of resource transfer operation. Since a subject highly addicted to performing a certain type of resource transfer operation is more likely to switch resource transfer objects and perform another resource transfer operation of the same type after the previous resource transfer operation is blocked, the subject attribute value actually indicates the likelihood that the first subject will switch resource transfer objects and perform another resource transfer operation of the same type after the first resource transfer operation of that type is blocked. Therefore, by using the resource transfer history information of the first subject as input, the output of the subject attribute determination model can reflect the likelihood that the first subject will perform another resource transfer operation of the same type after the first resource transfer operation is blocked. The training method for the model, which is determined by this principal attribute, will be described later.

[0060] Continue to refer to Figure 3 .like Figure 3As shown, after the subject attribute determination model outputs the subject attribute value of the first subject, the subject attribute value of the first subject can be compared with the subject attribute threshold. The subject attribute threshold can be preset according to actual needs and can be modified according to the actual situation. For example, if the result of the aforementioned comparison is that the subject attribute value of the first subject is greater than or equal to the subject attribute threshold (indicating that the subject attribute determination model believes that the first subject has a high probability of performing another resource transfer operation of the same type after the first resource transfer operation is blocked), but the first subject does not subsequently perform a resource transfer operation, or only performs a normal resource transfer operation, then it indicates that the subject attribute determination model has overestimated the probability that the first subject will perform another resource transfer operation of the same type after the first resource transfer operation is blocked. In this case, the subject attribute threshold can be increased. Under the increased subject attribute threshold, the original subject attribute value of the first subject will be less than the subject attribute threshold, indicating that it has a low probability of performing another resource transfer operation of the same type after the first resource transfer operation is blocked, which is consistent with the actual situation. For similar reasons, if the aforementioned comparison results in the first subject's attribute value being less than the attribute threshold (indicating that the subject attribute determination model considers the first subject to have a low probability of performing another resource transfer operation of the same type after the first resource transfer operation is blocked), but the first subject subsequently performs a resource transfer operation of the same type, then the subject attribute determination model has underestimated the probability that the first subject will perform another resource transfer operation of the same type after the first resource transfer operation is blocked. In this case, the subject attribute threshold can be lowered. Another reason why the output of the subject attribute determination model may not match the actual situation could be that its internal processing scheme is inaccurate, i.e., the attribute values ​​it derives are inaccurate. Optimization of this problem will be described later when discussing the training method of the subject attribute determination model.

[0061] Then, in response to the first subject's subject attribute value being greater than or equal to a subject attribute threshold, the server begins monitoring the first subject's operations after the first resource transfer operation of the first operation type is blocked, for example, monitoring whether the first subject performs another resource transfer operation. If the first subject performs another resource transfer operation, such as a second resource transfer operation, the associated information of the second resource transfer operation is obtained. When the first subject performs the second resource transfer operation, it inputs the resource transfer object and resource transfer amount of the second resource transfer operation through terminal device 110a. After obtaining the resource transfer object and resource transfer amount of the second resource transfer operation, the associated information of the second resource transfer operation can be obtained based on this information. The associated information of the second resource transfer operation includes the operation information of the second resource transfer operation, or the derived information of the resource transfer object of the second resource transfer operation (e.g., the second subject). Specific examples of this information have been described above and will not be repeated here. The operation information of the second resource transfer operation can be directly determined based on the resource transfer object and resource transfer amount of the second resource transfer operation provided by the first subject. The derived information of the second subject may require further acquisition operations by server 105a. For example, the derived information of the second subject may exist in another server 105b, which requires scheduling by server 105a.

[0062] After obtaining the association information for the second resource transfer operation, the association information is input into a subject classification model to determine the subject type of the second subject based on the association information. The subject classification model may include multiple parts, each for processing specific association information. In some embodiments, to improve efficiency, the subject type of the second subject may be determined based on only one type of association information. In other embodiments, for accuracy, the subject type of the second subject may be determined based on two or more types of association information. The specific uses of various types of association information will be described in detail later. The output of the subject classification model will indicate the subject type of the second subject.

[0063] like Figure 3 As shown, if it is determined that the second entity is of the same type as the third entity, i.e., the second entity belongs to the first entity type, then online and / or offline actions can be taken against the second entity. Online actions can be real-time. For example, if it is determined that the second entity belongs to the first entity type, every resource transfer operation of the second entity can be intercepted in real time, or the second entity can be directly disabled. Offline actions essentially involve, based on the information of the second entity, seizing the resource transfer tools of its actual controller, such as bank accounts, and even arresting them offline.

[0064] Figure 4 A flowchart illustrating a subject classification method according to another embodiment of this application is shown schematically. Figure 4 As shown, in this embodiment, the step of determining the subject attribute value of the first subject based on the resource transfer history information of the first subject (step S210) specifically includes: In step S2101, the resource transfer history information is input into multiple subject attribute determination models to obtain multiple subject attribute initial values, wherein each of the multiple subject attribute determination models represents a model used to predict the probability of a first subject performing a resource transfer operation of a first operation type. In step S2102, the accuracy of each subject in the model is determined based on the multiple subject attributes, and the initial values ​​of the multiple subject attributes are weighted. In step S2103, the subject attribute value of the first subject is determined based on the multiple weighted initial values ​​of the subject attributes.

[0065] First, the process in step S2101 is described. As mentioned earlier, the resource transfer history information of the first subject can include various types of information, such as the number of times, frequency, average resource transfer amount, and cumulative resource transfer amount of the first subject performing resource transfer operations of the first operation type, as well as at least one of the times the first subject first performed resource transfer operations of the first operation type and the time of the last resource transfer operation of the first operation type. Each type of information has a corresponding model, and each model targets different features and scenarios. That is, each model will determine the degree to which the first subject is addicted to performing resource transfer operations of the first operation type based on specific information. These models can be existing models. Existing models are relatively complete, have undergone long-term online validation, and their accuracy is relatively reliable; they can be used directly, reducing the process of retraining the model. Since different models target different features and scenarios, in order to cover more aspects of the analysis of the first user, multiple features can be used as input, and each model will output an initial value for a subject attribute.

[0066] The accuracy rates for judging different historical resource transfer information vary. This accuracy can be obtained based on the degree to which the first subject is prone to performing a certain type of resource transfer operation as predicted by the corresponding model over a long period, as well as the extent of manual annotation. Therefore, the accuracy rates of each model can be used as weights to perform weighted fusion with the initial values ​​of the subject attributes output by the corresponding models to obtain more accurate subject attribute values. For example, in step S2102, the initial values ​​of the subject attributes can be weighted based on the accuracy rates of the models to obtain weighted initial values ​​of the subject attributes for each model. Then, in step S2103, the subject attribute value of the first subject can be determined based on the weighted initial values ​​of the subject attributes. For example, the accuracy rates can be used as weights to weight the initial values ​​of the subject attributes output by each model, and then the weighted initial values ​​of the subject attributes for each model can be summed to obtain the final subject attribute value.

[0067] Figure 5 Another schematic diagram illustrating the implementation process of the subject classification method according to an embodiment of this application is shown, specifically depicting the process by which the aforementioned subject attribute determination model determines the subject attribute values ​​of the first subject based on the resource transfer history information of the first subject. The following is based on... Figure 5 The specific scenario shown further describes the process of determining the subject attribute value of the first subject based on the resource transfer history information of the first subject.

[0068] exist Figure 5 In the application scenario, there are N models, and the resource transfer history information of the first subject includes N types of information. The weighted fusion steps are as follows: First, the N types of information contained in the resource transfer history information are input into the corresponding models. Then, each model outputs initial values ​​of subject attributes P_1, P_2, P_3, ..., P_N. Furthermore, based on the probability predicted by each model during long-term operation of the resource transfer subject to perform another resource transfer operation of the first operation type after the first operation type is blocked, and the actual situation of whether the resource transfer subject performs another resource transfer operation of the first operation type as manually labeled, the accuracy w_1, w_2, w_3, ..., w_N of each model is obtained. Then, the accuracy is used as a weight and weighted summed with the initial values ​​of subject attributes P_1, P_2, P_3, ..., P_N output by each model to obtain the final prediction result w_1*P_1 + w_2*P_2 + ... + w_N*P_Q = P_final. The output P_final is then normalized to convert it into the subject attribute values ​​of the first subject. This normalization operation can be implemented, for example, using a softmax process.

[0069] Through the above process, it can be identified whether the first entity is a resource transfer entity that performs another resource transfer operation of the first operation type after the first resource transfer operation of the first operation type is blocked. Therefore, the resource transfer object of the subsequent resource transfer operation performed by the first entity after the first resource transfer operation is blocked will be the resource transfer entity that this application focuses on identifying. Figure 6 The diagram illustrates several possible scenarios for subsequent resource transfer operations. In the first scenario, after the first resource transfer operation is blocked, the first entity initiates a second resource transfer operation within a very short time T_1. The object of this second resource transfer operation is indeed a subject of the same type as the object of the first resource transfer operation. This scenario is indeed one that allows for subject classification. However, the first entity may perform resource transfer operations of other types besides the first type. For example, in addition to the abnormal first resource transfer operation, it may also perform normal resource transfer operations for daily life. In the second scenario, after the first resource transfer operation is blocked, the first entity initiates a second resource transfer operation within another very short time T_2. However, after studying the identity information of the resource transfer object of the second resource transfer operation, it is found that the resource transfer object of the second resource transfer operation is a trustworthy resource transfer subject, such as some large institutions frequently used in daily life. Such a resource transfer object is obviously not an abnormal subject, so it is desirable to filter out this situation. Furthermore, the inventors discovered that if a first entity performs another resource transfer operation of the same type after a first resource transfer operation of a certain type is blocked, the time interval between these two resource transfer operations is usually very short. After the time interval exceeds a certain length, the first entity will abandon the second resource transfer operation of the same type and instead perform a resource transfer operation of a different type with a resource transfer object of a different entity type. In a third scenario, the first entity performs another resource transfer operation only after a long period T_3 following the blocking of the first resource transfer operation of the first type, and this resource transfer operation is a normal resource transfer operation. Therefore, it is desirable that this situation be filtered out. Additionally, the inventors discovered that if a first entity performs another resource transfer operation of the same type after a first resource transfer operation of a certain type is blocked, the resource transfer amounts of these two resource transfer operations are very close, because the purpose of the later resource transfer operation is to address the situation where the earlier first resource transfer operation failed to complete.

[0070] To avoid the above problems, trusted resource transfer entities can be eliminated first. Furthermore, it is necessary to limit the time window between the first and second resource transfer operations, and also to limit the difference between the resource transfer amounts of the first and second resource transfer operations.

[0071] The above operations can filter out cases where the resource transfer object of the second resource transfer operation (i.e., the second subject) is clearly not of the same subject type as the resource transfer object of the first resource transfer operation (i.e., the third subject). However, this does not mean that in the remaining cases, the resource transfer object of the second resource transfer operation is necessarily of the same subject type as the resource transfer object of the first resource transfer operation. This application also considers the similarity between the resource transfer object of the second resource transfer operation (i.e., the second subject) and the resource transfer object of the first resource transfer operation (i.e., the third subject). Similarity includes similarity between the two subjects, as well as the situation where there is a connection between the two subjects. In related technologies, the reason why the subject type cannot be accurately identified is likely because its transaction volume has not reached a certain level. This application considers the similarity between the second subject and the third subject. If the similarity between the second subject and the third subject reaches a certain level, this is equivalent to a large number of features of the third subject being usable as features of the second subject. In other words, if the similarity between the second and third entities, along with the second entity's characteristics (including at least one of the object characteristics of the second entity's historical resource transfers, total resource transfer volume, and average resource transfer volume), are used together as input features to determine the second entity's entity type, the number of input features for the second entity is significantly increased. This allows for accurate identification of the second entity's entity type even when it has only performed a small number of resource transfer operations, without having to wait until the number of resource transfer operations it has participated in reaches a certain scale.

[0072] The similarity between the second and third entities includes at least one of the following: similarity of their registration information and similarity of their resource transfer history information. In some embodiments, the similarity of the registration information of the second and third entities includes: similarity or relevance in at least one aspect of their registration name, registration identity, registration time, registration number, and registration address. According to some relevant regulations, resource transfer entities need to register with the relevant authorities before carrying out resource transfer operations. This registration process can generate information such as registration name, registration identity, registration time, registration number, and registration address. It is generally believed that if the similarity between entities is high, their registration information is also relatively similar. Therefore, the similarity between the registration information of the second and third entities can be determined based on the similarity or relevance in at least one aspect of their registration name, registration identity, registration time, registration number, and registration address, thereby determining the similarity between the second and third entities.

[0073] In some embodiments, the similarity of the resource transfer history information between the second and third entities includes at least one of the following: object similarity of historical resource transfer operations, average resource transfer amount similarity of each resource transfer operation, cumulative resource transfer amount similarity, initial resource transfer operation time similarity, and resource transfer medium similarity or relevance. Object similarity of historical resource transfer operations refers to whether the second and third entities have historically conducted resource transfer operations with the same objects. Average resource transfer amount similarity of each resource transfer operation refers to whether the resource transfer amounts of the second and third entities in each resource transfer operation are similar. Cumulative resource transfer amount similarity refers to whether the cumulative value of the resource transfer amounts of each resource transfer operation conducted by the second and third entities in history is similar. Furthermore, similar resource transfer entities generally conduct resource transfer operations at similar times, so the initial resource transfer operation time similarity can be used to measure the similarity between the second and third entities. Resource transfer medium refers to the platform on which the resource transfer entity promotes its activities, such as a WeChat official account or mini-program. Similar resource transfer entities often use the same or related resource transfer media. Therefore, by studying the similarity or correlation of resource transfer media, the similarity between the second and third entities can be determined.

[0074] In some embodiments, the associated information of the second resource transfer operation includes at least one of the following: the time of the second resource transfer operation, the amount of resources transferred in the second resource transfer operation, the identity information of the second subject, and the similarity between the second subject and the third subject. If it is desired to determine the subject type of the second subject more quickly, only one of the above items can be used as the associated information of the second resource transfer operation. If it is desired to determine the subject type of the second subject more accurately, multiple or even all of the above items can be used as the associated information of the second resource transfer operation.

[0075] In a further embodiment, since the interval between the time of the first resource transfer operation and the time of the second resource transfer operation, as well as the difference between the resource transfer amount of the first resource transfer operation and the resource transfer amount of the second resource transfer operation, are easier to determine and require less computational resources, at least one of these two conditions can be judged first to filter out the possibility that the third subject and the second subject have the same subject type as early as possible, that is, to determine as early as possible that the subject type of the second subject is a second subject type different from the first subject type. After excluding the possibility that the second subject is obviously the second subject type based on these two conditions, the subject type of the second subject can be determined based on the similarity between the second subject and the third subject to see if it is the first subject type. Thus, determining the subject type of the second subject (step S220) based at least on the association information of the second resource transfer operation can include: in response to at least one of the following conditions being met, determining the subject type of the second subject based on the similarity between the second subject and the third subject—the interval between the time of the first resource transfer operation and the time of the second resource transfer operation is less than or equal to a time interval threshold; the difference between the resource transfer amount of the first resource transfer operation and the resource transfer amount of the second resource transfer operation is less than or equal to a resource transfer amount threshold.

[0076] In some embodiments, determining the subject type of the second subject based on the similarity between the second subject and the third subject includes: determining the subject type of the second subject based on the similarity between the second subject and the third subject, as well as the subject characteristics of the second subject. The subject characteristics of the second subject include at least one of the object characteristics of the second subject's historical resource transfers, the total amount of resource transfers, and the average amount of resource transfers. The subject characteristics of the second subject reflect the level of the second subject's historical resource transfer operations. As mentioned above, if the similarity between the second subject and the third subject reaches a certain level, this is equivalent to a large number of features of the third subject being usable as features of the second subject; for example, the subject characteristics of the third subject can also be used as subject characteristics of the second subject. Therefore, the subject characteristics of the second subject are greatly enriched to more accurately determine the subject type of the second subject.

[0077] In some embodiments, determining the subject type of the second subject based on the similarity between the second subject and the third subject, and the subject features of the second subject, specifically involves inputting the similarity between the second subject and the third subject, and the subject features of the second subject, into a subject classification model to determine the subject type of the second subject. The subject classification model is a trained classifier model for predicting subject types. In some embodiments, the subject classification model is trained using an active learning method, wherein the initial training samples include subjects belonging to a first subject type based on manual review, subjects belonging to the first subject type predicted by a model with a prediction accuracy exceeding a predetermined accuracy, and subjects belonging to a second subject type different from the first subject type based on manual review.

[0078] Based on the characteristics of the subject to be identified (i.e., the second subject), machine learning can be used to intelligently identify the subject type. According to some embodiments of this application, determining the subject type of the second subject based on the similarity between the second subject and the third subject, and the subject characteristics of the second subject, can include: inputting the similarity between the second subject and the third subject, and the historical resource transfer feature information of the second subject, into a subject classification model to determine the subject type of the second subject. The subject classification model can be used as a classifier model to predict subject types. The subject classification model can determine whether the subject types of the second subject and the third subject are the same based on the subject characteristics of the second subject and the similarity between the second and third subjects, that is, whether the subject type of the second subject is the same as the first subject type to which the third subject belongs. The subject classification model can be trained using an active learning method, wherein the initial training samples include subjects belonging to the first subject type based on manual review, subjects belonging to the first subject type predicted by a model with a prediction accuracy exceeding a predetermined accuracy, and subjects belonging to the second subject type, which is different from the first subject type, based on manual review.

[0079] The embodiments of this application do not limit the specific form of the classifier model used in the main classification model. The classifier model can be a model built based on any suitable classification algorithm or neural network algorithm. Examples of classifier models include, but are not limited to, XGBoost network, Long Short-Term Memory (LSTM) network, Gated Recurrent Unit (GRU), Temporal Delay Neural Network (TDNN), Convolutional Neural Network (CNN), Random Forest classifier, LightGBM classifier, etc.

[0080] Based on the subject characteristics of the subject to be identified (the second subject) and its similarity with the third subject (a subject with a known subject type, for example, the third subject is known to be of the first subject type), the subject characteristics and similarity can be vectorized, which is beneficial for subject identification using a subject classification model. For example, based on the aforementioned examples of subject characteristics such as the object characteristics of historical resource transfers, total resource transfer volume, and average resource transfer volume, as well as the similarity between the second and third subjects in terms of registration name, registration identity, registration time, registration number, and registration address, and similarity examples such as the similarity of the operation objects of historical resource transfers, the similarity of the average resource transfer volume of each resource transfer, the similarity of the cumulative resource transfer volume, and the relevance of the resource transfer medium, the subject characteristics and similarity can be concretized into an n-dimensional vector so that they can be input into the subject classification model to obtain the subject identification result.

[0081] In some embodiments, since the subject classification model is trained based on a training sample set, the subject classification model can output an evaluation value indicating whether the subject belongs to a certain type of subject based on the subject characteristics and similarity of the subject to be identified, and identify the subject to be identified with an evaluation value higher than the evaluation threshold as the subject of that type.

[0082] In some embodiments, since similarity determination between the second and third subjects requires significant computational and network resources, for resource conservation, similarity detection between the second and third subjects may be omitted. Instead, the subject type of the second subject can be determined solely by the interval between the time of the first and second resource transfer operations, the difference between the resource transfer amounts of the first and second resource transfer operations, and whether the second subject is a trusted subject. Specifically, in some embodiments, determining the subject type of the second subject based at least on the association information of the second resource transfer operation includes: determining that the subject type of the second subject is a second subject type different from the first subject type in response to at least one of the following conditions: the interval between the time of the first and second resource transfer operations is less than or equal to a time interval threshold; the difference between the resource transfer amounts of the first and second resource transfer operations is less than or equal to a resource transfer amount threshold; and the identity information of the second subject indicates that the subject type of the second subject is a second subject type, such as a trusted subject. These conditions can quickly exclude cases where the second subject is determined not to be a subject type different from the third subject. Since the determination of the subject attribute value of the first subject has largely confirmed that the second resource transfer operation is a resource transfer operation of the first operation type, the result obtained in this embodiment has a high degree of certainty even with reduced resource utilization.

[0083] Figure 7 The diagram illustrates the training process of a subject classification model based on an active learning approach, according to some disclosed embodiments. For example... Figure 7 As shown, the training process of the subject classification model includes: 701, Training Model: The current classifier model is trained using the current training sample set to update the current classifier model; wherein the initial training sample set includes manually labeled or pre-predicted samples, such as feature vectors of subjects belonging to the first subject type based on manual review, feature vectors of subjects belonging to the first subject type predicted by the model with a prediction accuracy exceeding the predetermined accuracy, and feature vectors of subjects belonging to the second subject type different from the first subject type based on manual review. 702, Test Model, which means testing the current classifier model using the current test sample set to obtain the classification result; 703. Determine if the classification result meets the model performance requirements, such as whether the subject evaluation value is in the ideal range for determining whether it is a certain type of subject (e.g., the classification probability value is greater than 0.9 or less than 0.1); if yes, proceed to 708 to end training; otherwise, proceed to 706. 704. Extracting unsatisfactory samples: In response to the current classifier model's classification results meeting the model performance requirements, based on the classification results and a preset classification threshold, samples with unsatisfactory classification results (i.e., those with high uncertainty, such as classification probability values ​​below the classification threshold) are extracted from the current test sample set. 705, Manual annotation, which means manually annotating the unsatisfactory samples and adding them to the current training sample set, then moving to 702 to continue training the model; 706, End and deploy the model. This means that in response to the classification results of the current classifier model meeting the model performance requirements, training ends, and the current classifier model is used as the main classification model.

[0084] Figure 8 An example block diagram of a subject classification device 800 according to some embodiments of this application is illustrated schematically. The subject classification device 800 may include a first acquisition module 810, a first determination module 820, a second acquisition module 830, and a second determination module 840.

[0085] The first acquisition module 810 can be configured to acquire resource transfer history information of a first entity performing a first resource transfer operation of a first operation type. The first determination module 820 can be configured to determine a subject attribute value of the first entity based on the resource transfer history information of the first entity, wherein the subject attribute value indicates the likelihood that the first entity will perform another resource transfer operation of the first operation type after the first resource transfer operation of the first operation type is blocked. The second acquisition module 830 can be configured to, in response to the subject attribute value of the first entity being greater than or equal to a subject attribute threshold, acquire association information of a second resource transfer operation performed between the first entity and a second entity after the first resource transfer operation of the first operation type was blocked; and the second determination module 840 can be configured to determine the subject type of the second entity based at least on the association information of the second resource transfer operation.

[0086] It should be noted that the various modules described above can be implemented in software, hardware, or a combination of both. Multiple different modules can be implemented in the same software or hardware architecture, or a single module can be implemented by multiple different software or hardware architectures.

[0087] The subject classification device provided in this application focuses more on the actions of a resource-transferring subject after a prior resource transfer operation of a certain operation type has been stopped, essentially predicting subsequent resource transfer operations. When a subsequent resource transfer operation does occur, this method can identify the subject type of the resource transfer object earlier and stop it. Since the subsequent resource transfer operation is initiated by a resource-transferring subject highly addicted to performing resource transfer operations of that type, the new resource transfer object can be quickly identified as a subject of the same type as the object of the prior resource transfer operation. The subsequent resource transfer operation with this new resource transfer object can be blocked in real time before it is completed, greatly advancing the stop point for certain types of resource transfer operations and curbing this type of resource transfer operation earlier, because the identification of the subject type of the new resource transfer object does not require it to have performed a certain amount of resource transfer operations as a basis.

[0088] In addition, the subject classification method proposed in this application analyzes the association information of subsequent resource transfer operations. Only when a subsequent resource transfer operation meets certain conditions, and / or the object of the subsequent resource transfer operation meets certain conditions, will the object of the subsequent resource transfer operation be identified as a subject of the same subject category as the object of the preceding resource transfer operation. This improves the accuracy of identification and reduces the impact on normal resource transfer operations.

[0089] Figure 9An example block diagram of a computing device 900 according to some embodiments of this application is illustrated schematically. The computing device 900 may represent a device for implementing the various apparatuses or modules described herein and / or performing the various methods described herein. The computing device 900 may be, for example, a server, desktop computer, laptop computer, tablet, smartphone, smartwatch, wearable device, or any other suitable computing device or computing system, which may include various levels of devices ranging from full-resource devices with large storage and processing resources to low-resource devices with limited storage and / or processing resources. In some embodiments, the above regarding... Figure 8 The main classification device 800 described can be implemented in one or more computing devices 900.

[0090] like Figure 9 As shown, the example computing device 900 includes a processing system 901 communicatively coupled to each other, one or more computer-readable media 902, and one or more I / O interfaces 903. Although not shown, the computing device 900 may also include a system bus or other data and command transfer system that couples the various components to each other. The system bus may include any or a combination of different bus architectures, such as a memory bus or memory controller, a peripheral bus, a universal serial bus, and / or a processor or local bus utilizing any of a variety of bus architectures. Alternatively, it may also include control and data lines.

[0091] Processing system 901 represents the functionality of performing one or more operations using hardware. Therefore, processing system 901 is illustrated as including hardware elements 904 that can be configured as processors, function blocks, etc. This may include other logic devices implemented in hardware as application-specific integrated circuits (ASICs) or formed using one or more semiconductors. Hardware element 904 is not limited by the materials in which it is formed or the processing mechanism employed therein. For example, a processor may consist of semiconductors and / or transistors (e.g., integrated circuits (ICs)). In such a context, processor-executable instructions may be electronically executable instructions.

[0092] Computer-readable medium 902 is illustrated as including memory / storage device 905. Memory / storage device 905 represents a memory / storage device associated with one or more computer-readable media. Memory / storage device 905 may include volatile media (such as random access memory (RAM)) and / or non-volatile media (such as read-only memory (ROM), flash memory, optical disk, magnetic disk, etc.). Memory / storage device 905 may include fixed media (e.g., RAM, ROM, fixed hard disk drive, etc.) and removable media (e.g., flash memory, removable hard disk drive, optical disk, etc.). Exemplarily, memory / storage device 905 may be used to store first audio of a first category of users mentioned in the above embodiments, a queue list of requests, etc. Computer-readable medium 902 may be configured in various other ways as further described below.

[0093] One or more I / O (input / output) interfaces 903 represent the functionality that allows a user to type commands and information into a computing device 900 and also allows information to be displayed to the user and / or sent to other components or devices using various input / output devices. Examples of input devices include keyboards, cursor control devices (e.g., mice), microphones (e.g., for voice input), scanners, touch functionality (e.g., capacitive or other sensors configured to detect physical touch), cameras (e.g., capable of detecting non-touch-related movements as gestures using visible or invisible wavelengths (such as infrared frequencies), network interface cards (NICs), receivers, and so on). Examples of output devices include display devices (e.g., monitors or projectors), speakers, printers, haptic-responsive devices, network interface cards (NICs), transmitters, and so on. Exemplarily, in the embodiments described above, both the first category of users and the second category of users can input through the input interfaces on their respective terminal devices to initiate requests and record audio and / or video, and can view various notifications and watch videos or listen to audio, etc., through the output interfaces.

[0094] The computing device 900 also includes a subject classification strategy 906. The subject classification strategy 906 can be stored as computing program instructions in a memory / storage device 905, or it can be hardware or firmware. The subject classification strategy 906, together with the processing system 901, can implement [the following]: Figure 8 The description covers all the functions of each module of the main classification device 800.

[0095] This document describes various technologies in the general context of software, hardware, components, or program modules. Generally, these modules include routines, programs, objects, elements, components, data structures, etc., that perform specific tasks or implement specific abstract data types. The terms "module," "function," etc., as used herein generally refer to software, firmware, hardware, or a combination thereof. The technologies described herein are platform-independent, meaning that these technologies can be implemented on a variety of computing platforms with various processors.

[0096] Implementations of the described modules and technologies may be stored on or transmitted across some form of computer-readable medium. Computer-readable medium may include a variety of media accessible by the computing device 900. By way of example and not limitation, computer-readable medium may include "computer-readable storage medium" and "computer-readable signal medium".

[0097] In contrast to simple signal transmission, carrier waves, or signals themselves, a "computer-readable storage medium" refers to a medium and / or device capable of persistently storing information, and / or a tangible storage device. Therefore, a computer-readable storage medium refers to a non-signal-bearing medium. Computer-readable storage media include hardware such as volatile and non-volatile, removable and non-removable media and / or storage devices implemented using methods or techniques suitable for storing information (such as computer-readable instructions, data structures, program modules, logic elements / circuits, or other data). Examples of computer-readable storage media may include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical storage devices, hard disks, cassette tapes, magnetic tapes, disk storage devices or other magnetic storage devices, or other storage devices, tangible media, or articles of art suitable for storing desired information and accessible by a computer.

[0098] "Computer-readable signal medium" refers to a signal-bearing medium configured to transmit instructions, such as via a network, to computing device 900. A signal medium typically embodies computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave, data signal, or other transmission mechanism. Signal media also includes any information transmission medium. By way of example and not limitation, signal media includes wired media such as wired networks or direct connections, and wireless media such as acoustic, RF, infrared, and other wireless media.

[0099] As previously described, hardware element 904 and computer-readable medium 902 represent instructions, modules, programmable device logic, and / or fixed device logic implemented in hardware, which in some embodiments can be used to implement at least some aspects of the techniques described herein. Hardware elements may include components of integrated circuits or systems-on-a-chip, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), complex programmable logic devices (CPLDs), and other implementations or other hardware devices in silicon. In this context, hardware elements can serve as processing devices for executing program tasks defined by instructions, modules, and / or logic embodied by the hardware element, and as hardware devices for storing instructions for execution, such as the previously described computer-readable storage medium.

[0100] The foregoing combinations can also be used to implement the various techniques and modules described herein. Therefore, software, hardware, or program modules and other program modules can be implemented as one or more instructions and / or logic embodied on some form of computer-readable storage medium and / or by one or more hardware elements 904. The computing device 900 can be configured to implement specific instructions and / or functions corresponding to the software and / or hardware modules. Thus, modules can be implemented at least partially in hardware as modules executable as software by the computing device 900, for example, by using the computer-readable storage medium and / or hardware elements 904 of a processing system. Instructions and / or functions can be executed / operated by, for example, one or more computing devices 900 and / or processing system 901 to implement the techniques, modules, and examples described herein.

[0101] The techniques described herein can be supported by these various configurations of computing device 900, and are not limited to specific examples of the techniques described herein.

[0102] In particular, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer programs. For example, embodiments of this application provide a computer program product including a computer program carried on a computer-readable medium, the computer program containing program code for performing at least one step in the method embodiments of this application.

[0103] In some embodiments of this application, one or more computer-readable storage media are provided, on which computer-readable instructions are stored, which, when executed, implement the subject classification method according to some embodiments of this application. The various steps of the subject classification method according to some embodiments of this application can be programmed into computer-readable instructions and stored in the computer-readable storage medium. When such a computer-readable storage medium is read or accessed by a computing device or computer, the computer-readable instructions therein are executed by a processor on the computing device or computer to implement the subject classification method according to some embodiments of this application.

[0104] In the description of this specification, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to a specific feature, structure, material, or characteristic described in connection with that embodiment or example, which is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0105] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of the preferred embodiments of this application includes additional implementations in which functions may be performed not in the order shown or discussed (including substantially simultaneously or in reverse order depending on the functions involved), as will be understood by those skilled in the art to which embodiments of this application pertain.

[0106] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-including system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0107] It should be understood that various parts of this application can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (FPGAs), field-programmable gate arrays (FPGAs), etc.

[0108] Those skilled in the art will understand that all or part of the steps of the methods described in the above embodiments can be implemented by hardware associated with program instructions. The program can be stored in a computer-readable storage medium, and when executed, the program includes performing one or a combination of the steps of the method embodiments.

[0109] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

Claims

1. A method for identifying abnormal entities based on machine learning, characterized in that, The method is applied to a computer system for resource transfer security control, the computer system including at least a server, and the method includes: The server receives information from a first entity via a terminal device regarding its intended first resource transfer operation, and inputs at least one of the following into the operation type identification model: information of the resource transfer entity, resource transfer amount, and information of the resource transfer object. If the first resource transfer operation is determined to be a resource transfer operation of a first operation type, the server blocks the first resource transfer operation and obtains the resource transfer history information of the first entity that performed the first resource transfer operation of the first operation type from the resource transfer transaction record. The resource transfer history information includes at least one of the following: the number of times the first entity has performed the resource transfer operation of the first operation type, the frequency, the average resource transfer amount, the cumulative resource transfer amount, the time when the first entity first performed the resource transfer operation of the first operation type, and the time when the first entity last performed the resource transfer operation of the first operation type. The resource transfer history information is subjected to feature extraction, multi-model prediction and weighted fusion processing through multiple machine learning-based subject attribute determination models to determine the subject attribute value of the first subject, wherein the subject attribute value indicates the probability that the first subject will perform another resource transfer operation of the first operation type after the first resource transfer operation of the first operation type is blocked. In response to the first subject's subject attribute value being greater than or equal to a subject attribute threshold, association information of a second resource transfer operation between the first subject and a second subject after the first resource transfer operation of the first operation type was blocked is obtained. The subject attribute threshold is set based on the first subject's operation after the first resource transfer operation was blocked. The association information includes the time of the second resource transfer operation, the amount of resource transferred, the identity information of the second subject, and the similarity between the second subject and a third subject, where the third subject is a subject that interacted with the first subject in the first resource transfer operation and belongs to the first subject type. In response to at least one of the following conditions being met, a first feature vector indicating the similarity between the second subject and the third subject is extracted from the association information of the second resource transfer operation; a second feature vector indicating the subject characteristics of the second subject is obtained; and the first feature vector and the second feature vector are input into a subject classification model pre-trained based on an active learning mechanism to determine the subject type of the second subject. The second feature vector represents at least one of the object characteristics of the second subject's historical resource transfers, the total resource transfer amount, and the average resource transfer amount. The conditions include: the interval between the time of the first resource transfer operation and the time of the second resource transfer operation is less than or equal to a time interval threshold; and the difference between the resource transfer amount of the first resource transfer operation and the resource transfer amount of the second resource transfer operation is less than or equal to a resource transfer amount threshold. In response to determining that the second entity belongs to the first entity type, each resource transfer operation of the second entity is intercepted in real time, or the second entity is directly disabled.

2. The method as described in claim 1, wherein, The step of determining the subject attribute values ​​of the first subject by performing feature extraction, multi-model prediction, and weighted fusion processing on the resource transfer history information through multiple machine learning-based subject attribute determination models includes: The resource transfer history information is input into multiple subject attribute determination models to obtain multiple subject attribute initial values, wherein each of the multiple subject attribute determination models represents a model used to predict the probability of the first subject performing a resource transfer operation of the first operation type. The accuracy of each of the multiple subject attributes is determined based on the multiple subject attributes, and the initial values ​​of the multiple subject attributes are weighted. Based on the multiple weighted initial values ​​of the subject attributes, the subject attribute values ​​of the first subject are determined.

3. The method of claim 1, wherein the subject classification model is obtained by training a classifier model through active learning, wherein the initial training samples include subjects belonging to the first subject type based on manual review, subjects belonging to the first subject type predicted by a model with a prediction accuracy exceeding a predetermined accuracy, and subjects belonging to a second subject type different from the first subject type based on manual review.

4. The method according to claim 1, wherein, The similarity between the second entity and the third entity includes at least one of the following: the similarity of the registration information of the second entity and the third entity, and the similarity of the resource transfer history information of the second entity and the third entity.

5. The method of claim 4, wherein, The similarity of the registration information of the second entity and the third entity includes the similarity or relevance of the second entity and the third entity in at least one of the following: registration name, registration identity, registration time, registration number, and registration address.

6. The method of claim 4, wherein, The similarity of the resource transfer history information of the second subject and the third subject includes at least one of the following: object similarity of historical resource transfer operations, average resource transfer amount similarity of each resource transfer operation, cumulative resource transfer amount similarity, time similarity of the first resource transfer operation, and similarity or correlation of resource transfer medium.

7. An anomaly identification device based on machine learning, characterized in that, The device is applied to a computer system for resource transfer security and control, the computer system including at least a server, and the device includes: The receiving module is configured to allow the server to receive information about a first resource transfer operation intended to be performed by a first entity via a terminal device, and to input at least one of the following: information about the resource transfer entity, the amount of resource transfer, and information about the resource transfer object, into an operation type identification model. If the first resource transfer operation is determined to be a resource transfer operation of a first operation type, the server blocks the first resource transfer operation. The first obtaining module is configured to allow the server to obtain the resource transfer history information of the first entity that performed the first resource transfer operation of the first operation type from the resource transfer transaction records. The resource transfer history information includes at least one of the following: the number of times the first entity has performed the resource transfer operation of the first operation type, the frequency, the average amount of resource transfer, the cumulative amount of resource transfer, the time when the first entity first performed the resource transfer operation of the first operation type, and the time when the first entity last performed the resource transfer operation of the first operation type. The first determining module is configured to perform feature extraction, multi-model prediction, and weighted fusion processing on the resource transfer history information through multiple machine learning-based subject attribute determining models to determine the subject attribute value of the first subject, wherein the subject attribute value indicates the probability that the first subject will perform another resource transfer operation of the first operation type after the first resource transfer operation of the first operation type is blocked. The second acquisition module is configured to, in response to the first subject's subject attribute value being greater than or equal to a subject attribute threshold, acquire association information of a second resource transfer operation between the first subject and the second subject after the first resource transfer operation of the first operation type is blocked. The subject attribute threshold is set based on the first subject's operations after the first resource transfer operation is blocked. The association information includes the time of the second resource transfer operation, the amount of resource transferred, the identity information of the second subject, and the similarity between the second subject and a third subject, where the third subject is a subject that interacted with the first subject in the first resource transfer operation and belongs to the first subject type. The second determining module is configured to, in response to at least one of the following conditions being met, extract a first feature vector indicating the similarity between the second subject and the third subject from the association information of the second resource transfer operation, obtain a second feature vector indicating the subject characteristics of the second subject, and input the first feature vector and the second feature vector into a subject classification model pre-trained based on an active learning mechanism to determine the subject type of the second subject, wherein the second feature vector represents at least one of the object characteristics of the historical resource transfers of the second subject, the total resource transfer amount, and the average resource transfer amount, the conditions including: the interval between the time of the first resource transfer operation and the time of the second resource transfer operation is less than or equal to a time interval threshold; the difference between the resource transfer amount of the first resource transfer operation and the resource transfer amount of the second resource transfer operation is less than or equal to a resource transfer amount threshold; in response to determining that the second subject belongs to the first subject type, intercept each resource transfer operation of the second subject in real time, or directly disable the second subject.

8. A computing device, comprising: Memory configured to store computer-executable instructions; as well as A processor configured to perform the method as described in any one of claims 1-6 when the computer-executable instructions are executed by the processor.

9. A computer-readable storage medium having stored thereon computer-executable instructions that, when executed, perform the method as described in any one of claims 1-6.

10. A computer program product comprising computer instructions that, when executed by a processor, implement the steps of the method according to any one of claims 1 to 6.

Images