Abnormal account identification method and device, and storage medium

Abstract

The application discloses an abnormal account identification method and device and a storage medium. It relates to the field of big data. The method comprises the following steps: obtaining a plurality of to-be-confirmed transactions within a target date, identifying abnormal transactions from the plurality of to-be-confirmed transactions through a preset rule, and obtaining a plurality of abnormal transactions; obtaining transaction account information in all abnormal transactions, obtaining a plurality of groups of transaction account information, and generating a directed graph of the plurality of abnormal transactions according to the plurality of groups of transaction account information; classifying a plurality of nodes in the directed graph according to the connection relationship between the plurality of nodes, and calculating the importance of each node to obtain the target account type and the target account importance of each node; and determining an abnormal account from the plurality of transaction account information according to the target account type and the target account importance of each node. Through the application, the problem that the abnormal account cannot be accurately identified by analyzing single account information in the related art is solved.

Description

Technical Field

[0001] This application relates to the field of big data, and more specifically, to a method, apparatus, and storage medium for identifying abnormal accounts. Background Technology

[0002] Financial institutions have some clients and accounts that engage in illegal transactions. In order to protect the property security of the general public, it is necessary to identify abnormal accounts from a large number of financial institution accounts and deal with them in a timely manner.

[0003] Currently, the common method for identifying abnormal accounts is to identify transaction and customer information at the customer level, and then use basic statistical methods to analyze abnormalities in the source, amount, frequency, flow, and nature of funds in individual customer behavior and transactions to determine whether the account is abnormal. However, it may not be possible to identify all abnormal accounts based on a single customer identity and transaction information, resulting in some abnormal accounts still being able to trade normally.

[0004] There is currently no effective solution to the problem that analyzing single account information in related technologies cannot accurately identify abnormal accounts. Summary of the Invention

[0005] This application provides a method, apparatus, and storage medium for identifying abnormal accounts, in order to solve the problem that abnormal accounts cannot be accurately identified by analyzing single account information in related technologies.

[0006] According to one aspect of this application, a method for identifying abnormal accounts is provided. The method includes: acquiring multiple pending transactions within a target date, and identifying abnormal transactions from these pending transactions using preset rules to obtain multiple abnormal transactions. Each pending transaction includes transaction account information and basic transaction content, with the transaction account information including transaction originator information and transaction counterparty information. The method further includes: acquiring the transaction account information from all abnormal transactions to obtain multiple sets of transaction account information, and generating a directed graph of the multiple abnormal transactions based on these sets of information. Nodes in the directed graph represent transaction originator information and / or transaction counterparty information. The method also includes: classifying the multiple nodes based on the connections between them in the directed graph, calculating the importance of each node to obtain the target account type and target account importance for each node; and determining the abnormal account from the multiple transaction account information based on the target account type and target account importance of each node.

[0007] Optionally, identifying abnormal transactions from multiple pending transactions using preset rules to obtain multiple abnormal transactions includes: obtaining transaction-based information from each pending transaction to obtain multiple transaction-based information; determining the number of counterparty information associated with each transaction-based information based on the multiple pending transactions to obtain multiple first quantities; determining the total amount of multiple transactions associated with each transaction-based information based on the multiple pending transactions to obtain multiple total transaction amounts; inputting the total transaction amount and first quantities of each transaction-based information into a rule model to obtain multiple abnormal transaction-based information, wherein the rule model includes multiple preset rules for identifying abnormal transactions; and identifying pending transactions containing abnormal transaction-based information as abnormal transactions to obtain multiple abnormal transactions.

[0008] Optionally, generating a directed graph of multiple abnormal transactions based on multiple sets of transaction account information includes: determining the transaction originator information and the transaction counterparty information in each set of transaction account information as two nodes, and connecting the corresponding two nodes with directed edges according to the basic transaction content in each set of transaction account information to obtain multiple sets of sub-directed graphs, wherein the directed edges point to the transaction counterparty information; and connecting the multiple sets of sub-directed graphs with the same nodes to obtain a directed graph of multiple abnormal transactions.

[0009] Optionally, classifying multiple nodes based on the connections between them in the directed graph and calculating the importance of each node to obtain the target account type and target account importance for each node includes: setting an arbitrary account type for each node in the directed graph to obtain multiple initial account types; determining the transaction amount indicated by the directed edge of each node to obtain multiple sets of transaction amounts, wherein each set of transaction amounts includes at least one transaction amount; determining the maximum transaction amount in each set of transaction amounts and determining the directed edge containing each maximum transaction amount to obtain multiple target directed edges and the target node connected by each target directed edge; updating the initial account type of each node to the initial account type of the corresponding target node to obtain multiple updated initial account types; and repeating the steps of determining the maximum transaction amount in each set of transaction amounts to obtain the maximum transaction amount of each node and determining the directed edge containing each maximum transaction amount to obtain multiple target directed edges and the target node connected by each target directed edge, until the initial account type of each node no longer changes, thus obtaining the target account type for each node.

[0010] Optionally, classifying multiple nodes based on the connections between them in the directed graph and calculating the importance of each node to obtain the target account type and target account importance of each node includes: setting an initial importance for each node in the directed graph to obtain multiple initial importances; updating the initial importance of each node according to the direction of the directed edges between each node and its connected nodes to obtain multiple candidate importances; determining each candidate importance as the updated initial importance, and repeating the step of updating the initial importance of each node according to the direction of the directed edges between each node and its connected nodes to obtain multiple candidate importances, until the initial importance and candidate importance of each node are the same; and determining the candidate importance of each node as the target account importance of the node.

[0011] Optionally, updating the initial importance of each node based on the direction of the directed edges between each node and its connected nodes in the directed graph to obtain multiple candidate importances includes: for each node, obtaining the directed edges pointing to the node from the multiple directed edges connected to the node to obtain a set of candidate directed edges; obtaining the nodes connected to the endpoints from the set of candidate directed edges to obtain a set of candidate nodes; obtaining the number of outgoing edges of each candidate node to obtain multiple second quantities; and calculating the candidate importance of the node based on the initial importance and the second quantities of each candidate node.

[0012] Optionally, determining abnormal accounts from multiple transaction account information based on the target account type and target account importance of each node includes: obtaining nodes with a preset account type from multiple nodes in the directed graph to obtain multiple first nodes; obtaining nodes with a target account importance greater than a preset value from multiple first nodes to obtain multiple second nodes; and determining the account information represented by each second node as an abnormal account.

[0013] Optionally, after identifying abnormal accounts from multiple transaction account information based on the target account type and target account importance of each node, the method further includes: obtaining historical authentication information of the abnormal account from the database; if the historical authentication information of the abnormal account is normal, determining the current authentication information of the abnormal account as abnormal and storing it in the database; if the historical authentication information of the abnormal account is abnormal, issuing an alarm message, wherein the alarm message indicates that the abnormal account has unauthorized transaction permissions.

[0014] According to another aspect of this application, an abnormal account identification device is provided. The device includes: a first acquisition unit, configured to acquire multiple pending transactions within a target date, and identify abnormal transactions from the multiple pending transactions using preset rules to obtain multiple abnormal transactions, wherein each pending transaction includes transaction account information and basic transaction content, and the transaction account information includes transaction owner information and transaction counterparty information; a generation unit, configured to acquire the transaction account information from all abnormal transactions, obtain multiple sets of transaction account information, and generate a directed graph of multiple abnormal transactions based on the multiple sets of transaction account information, wherein the nodes in the directed graph are transaction owner information and / or transaction counterparty information; a calculation unit, configured to classify multiple nodes according to the connection relationships between the multiple nodes in the directed graph, and calculate the importance of each node to obtain the target account type and target account importance of each node; and a first determination unit, configured to determine abnormal accounts from the multiple transaction account information based on the target account type and target account importance of each node.

[0015] According to another aspect of the present invention, a computer storage medium is also provided for storing a program, wherein the program, when running, controls the device where the computer storage medium is located to execute an abnormal account identification method.

[0016] According to another aspect of the present invention, an electronic device is also provided, comprising one or more processors and a memory; the memory stores computer-readable instructions, and the processor is configured to execute the computer-readable instructions, wherein the computer-readable instructions execute an abnormal account identification method.

[0017] This application employs the following steps: First, it obtains multiple pending transactions within a target date. Then, it identifies abnormal transactions from these pending transactions using preset rules, resulting in multiple abnormal transactions. Each pending transaction includes transaction account information and basic transaction content. The transaction account information includes the transaction originator's information and the transaction counterparty's information. Second, it obtains the transaction account information from all abnormal transactions, resulting in multiple sets of transaction account information. Third, it generates a directed graph of the multiple abnormal transactions based on these sets of information. The nodes in the directed graph represent the transaction originator's information and / or the transaction counterparty's information. Fourth, it classifies the nodes based on the connections between them in the directed graph and calculates the importance of each node, obtaining the target account type and target account importance for each node. Finally, it identifies abnormal accounts from the multiple transaction account information based on the target account type and target account importance of each node. This solves the problem in related technologies where analyzing single account information fails to accurately identify abnormal accounts. By identifying abnormal transactions and generating a directed graph of accounts based on the transaction information within these abnormal transactions, and classifying multiple accounts according to the connections between multiple account nodes in the directed graph, accounts with close relationships are grouped together. The importance score of each account is calculated based on the relationship, and accounts are confirmed as abnormal based on their type according to both the importance score and the account type. Finally, by comprehensively judging accounts through transaction relationships and relationships between accounts, the effect of accurately identifying abnormal accounts is achieved. Attached Figure Description

[0018] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0019] Figure 1 This is a flowchart of an abnormal account identification method provided according to an embodiment of this application;

[0020] Figure 2 This is a schematic diagram of an optional directed graph provided according to an embodiment of this application. Figure 1 ;

[0021] Figure 3 This is a schematic diagram of an optional directed graph provided according to an embodiment of this application. Figure 2 ;

[0022] Figure 4 This is a flowchart of the importance calculation method provided according to the embodiments of this application;

[0023] Figure 5 This is a schematic diagram of an abnormal account identification device provided according to an embodiment of this application;

[0024] Figure 6This is a schematic diagram of an electronic device provided according to an embodiment of this application. Detailed Implementation

[0025] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0026] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0027] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0028] It should be noted that all information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) involved in this disclosure are information and data authorized by the user or fully authorized by all parties. For example, this system has an interface with relevant users or organizations. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain the relevant information after receiving consent information from the aforementioned user or organization.

[0029] It should be noted that the abnormal account identification method, device and storage medium determined in this disclosure can be used in the field of big data, or in any field other than big data. The application field of the abnormal account identification method, device and storage medium determined in this disclosure is not limited.

[0030] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0031] According to an embodiment of this application, an abnormal account identification method is provided.

[0032] Figure 1 This is a flowchart of an abnormal account identification method provided according to an embodiment of this application. For example... Figure 1 As shown, the method includes the following steps:

[0033] Step S101: Obtain multiple pending transactions within the target date, and identify abnormal transactions from the multiple pending transactions using preset rules to obtain multiple abnormal transactions. Each pending transaction includes transaction account information and basic transaction content. The transaction account information includes the transaction party information and the transaction counterparty information.

[0034] Specifically, the target date can be any historical calendar day. Multiple transactions occurring within a financial institution on that day can be retrieved, and abnormal transactions can be identified from these transactions using preset rules. Each transaction can include three parts: transaction initiator information, counterparty information, and basic transaction content. The transaction initiator information includes customer ID, customer name, account number, and identification number. The counterparty information includes counterparty name and account number. The basic transaction content includes the specific details of the transaction, including but not limited to the transaction date, time, amount, and currency. Table 1 is an optional transaction information table, including transaction element categories and elements. The detailed content of each transaction can be determined using the transaction information in Table 1.

[0035] Table 1

[0036]

[0037] Step S102: Obtain transaction account information from all abnormal transactions, obtain multiple sets of transaction account information, and generate a directed graph of multiple abnormal transactions based on the multiple sets of transaction account information. The nodes in the directed graph are the transaction party information and / or the transaction counterparty information.

[0038] Specifically, after identifying an abnormal transaction, the account information of the transacting party and the transacting counterparty in the abnormal transaction can be obtained. Since the transaction is directional, the transacting party and the transacting counterparty can be set as two account nodes, and the two nodes can be connected according to the transaction direction to generate a sub-directed graph corresponding to each abnormal transaction. The sub-directed graph includes two nodes and a directed edge between the two nodes.

[0039] Furthermore, the sub-directed graphs of multiple transaction information are combined to obtain the directed graphs corresponding to multiple abnormal transactions.

[0040] It should be noted that since the transaction-owning information in one abnormal transaction can be used as the transaction-partner information in another abnormal transaction, each node in the directed graph can represent either the transaction-owning information or the transaction-partner information.

[0041] Step S103: Classify multiple nodes according to the connection relationships between multiple nodes in the directed graph, and calculate the importance of each node to obtain the target account type and target account importance of each node.

[0042] Specifically, after obtaining the directed graph, nodes with high correlation can be grouped together based on the connection relationships between multiple nodes in the directed graph, thereby grouping a large number of nodes.

[0043] Figure 2 This is a schematic diagram of an optional directed graph provided according to an embodiment of this application. Figure 1 ,like Figure 2 As shown, each directed edge in the graph corresponds to a transaction. Since there are 3 transactions between node 1 and node 3, it can be shown that the correlation between node 1 and node 3 is relatively high. Therefore, the node types of node 1 and node 3 can be determined to be the same, so node 1 and node 3 can be combined for analysis.

[0044] Furthermore, after determining the node type, it is also necessary to determine the node importance. The method for determining node importance is to calculate the importance by means of the transaction volume, that is, the number of directed edges connected to the node, thereby determining the importance of each node.

[0045] Step S104: Identify abnormal accounts from multiple transaction account information based on the target account type and target account importance of each node.

[0046] Specifically, after determining the type and importance of each account, each account can be judged based on its importance and type. For example, if account A is confirmed to be an abnormal account, accounts of the same type as account A and with an importance of X or higher will also be identified as abnormal accounts. This allows illegal accounts to be selected from the many accounts that have transacted with account A, and also ensures that normal accounts that have only a few transacts with account A are not mistakenly judged.

[0047] The abnormal account identification method provided in this application obtains multiple pending transactions within a target date and identifies abnormal transactions from these transactions using preset rules, resulting in multiple abnormal transactions. Each pending transaction includes transaction account information and basic transaction content; the transaction account information includes the transaction originator's information and the transaction counterparty's information. The method acquires the transaction account information from all abnormal transactions, obtaining multiple sets of transaction account information, and generates a directed graph of multiple abnormal transactions based on these sets. Nodes in the directed graph represent the transaction originator's information and / or the transaction counterparty's information. The method classifies the nodes based on the connections between them in the directed graph and calculates the importance of each node, obtaining the target account type and target account importance for each node. Abnormal accounts are then identified from the multiple transaction account information based on the target account type and target account importance of each node. This method solves the problem in related technologies where analyzing single account information cannot accurately identify abnormal accounts. By identifying abnormal transactions and generating a directed graph of accounts based on the transaction information within these abnormal transactions, and classifying multiple accounts according to the connections between multiple account nodes in the directed graph, accounts with close relationships are grouped together. The importance score of each account is calculated based on the relationship, and accounts are confirmed as abnormal based on their type according to both the importance score and the account type. Finally, by comprehensively judging accounts through transaction relationships and relationships between accounts, the effect of accurately identifying abnormal accounts is achieved.

[0048] Optionally, in the abnormal account identification method provided in this application embodiment, identifying abnormal transactions from multiple pending confirmation transactions using preset rules to obtain multiple abnormal transactions includes: obtaining transaction-based information in each pending confirmation transaction to obtain multiple transaction-based information; determining the number of counterparty information associated with each transaction-based information based on the multiple pending confirmation transactions to obtain multiple first quantities; determining the total amount of multiple transactions associated with each transaction-based information based on the multiple pending confirmation transactions to obtain multiple total transaction amounts; inputting the total transaction amount and first quantities of each transaction-based information into a rule model to obtain multiple abnormal transaction-based information, wherein the rule model includes multiple preset rules for identifying abnormal transactions; and identifying pending confirmation transactions containing abnormal transaction-based information as abnormal transactions to obtain multiple abnormal transactions.

[0049] Specifically, the preset rules in the preset model can be the rules in Table 2. As shown in Table 2, firstly, all transaction-related information needs to be obtained from multiple abnormal transactions, and the transaction frequency and transaction amount of each transaction-related information need to be determined from multiple abnormal transactions. Based on the transaction frequency and transaction amount, it is determined whether each transaction-related information meets the preset rules. If any rule in Table 2 is met, the transaction-related information is determined to be abnormal information, and the transaction in which it is located is determined to be an abnormal transaction. The role of the transaction-related information in the abnormal transaction can be either the transaction-related party or the transaction-related party. That is, the transaction in which the information is located when it is the transaction-related party information is also an abnormal transaction.

[0050] Table 2

[0051]

[0052] Optionally, in the abnormal account identification method provided in this application embodiment, generating a directed graph of multiple abnormal transactions based on multiple sets of transaction account information includes: determining the transaction self information and transaction counterparty information in each set of transaction account information as two nodes, and connecting the corresponding two nodes through directed edges according to the basic transaction content in each set of transaction account information to obtain multiple sets of sub-directed graphs, wherein the directed edges point to the transaction counterparty information; and connecting the multiple sets of sub-directed graphs according to the same nodes between the multiple sets of sub-directed graphs to obtain a directed graph of multiple abnormal transactions.

[0053] Specifically, when generating a directed graph, the transaction information of the party and the other party in each abnormal transaction can be set as two nodes, and the two nodes can be connected according to the transaction direction to obtain a set of sub-directed graphs. After obtaining the sub-directed graphs of each abnormal transaction, the repeated nodes in the multiple sub-directed graphs are combined. That is, the multiple sub-directed graphs are combined and connected according to the repeated nodes to obtain a directed graph containing all transaction information corresponding to multiple abnormal transactions.

[0054] Optionally, in the abnormal account identification method provided in this application embodiment, classifying multiple nodes according to the connection relationship between multiple nodes in a directed graph and calculating the importance of each node to obtain the target account type and target account importance of each node includes: setting an arbitrary account type for each node in the directed graph to obtain multiple initial account types; determining the transaction amount indicated by the directed edge of each node to obtain multiple sets of transaction amounts, wherein each set of transaction amounts includes at least one transaction amount; determining the maximum transaction amount in each set of transaction amounts and determining the directed edge where each maximum transaction amount is located to obtain multiple target directed edges and the target node connected by each target directed edge; updating the initial account type of each node to the initial account type of the corresponding target node to obtain multiple updated initial account types; and re-executing the steps of determining the maximum transaction amount in each set of transaction amounts to obtain the maximum transaction amount of each node and determining the directed edge where each maximum transaction amount is located to obtain multiple target directed edges and the target node connected by each target directed edge, until the initial account type of each node no longer changes or the initial account type changes cyclically among multiple types, thereby obtaining the target account type of each node.

[0055] Specifically, when determining the account type for each node, an initial account type can be set for each node first. This initial account type can be anything, for example... Figure 3 This is a schematic diagram of an optional directed graph provided according to an embodiment of this application. Figure 2 ,like Figure 3 As shown, Figure 3 In the graph, node 1 has an initial account type of A, node 2 has an initial account type of B, node 3 has an initial account type of C, node 4 has an initial account type of D, node 5 has an initial account type of E, and so on. After setting the account types, it is necessary to determine the transaction amount between every two connected nodes in the directed graph. It should be noted that when there are multiple directed edges between two nodes, it indicates that there are multiple transactions between the accounts represented by these two nodes. Therefore, the transaction amount between these two nodes is the sum of the transaction amounts represented by the multiple directed edges. For example, Figure 3 There are three transactions between node 1 and node 3, each with a transaction amount of 10. Therefore, the total transaction amount between node 1 and node 3 is 30, which means that the transaction amount represented by the directed edge between node 1 and node 3 is 30.

[0056] Furthermore, after determining the initial account type and the transaction amount between nodes, it is necessary to determine the node corresponding to the directed edge with the largest transaction amount among the multiple nodes connected to each node. For example, in Figure 3In the example, the nodes connected to node 1 are node 2 and node 3. The transaction amount between node 1 and node 2 is 40, and the transaction amount between node 1 and node 3 is 30. Therefore, the target node corresponding to node 1 is node 2. Similarly, the target node of node 2 is node 1, the target node of node 3 is node 5, the target node of node 5 is node 3, and the target node of node 4 is node 3. The type of the node is changed to the type of the target node.

[0057] Furthermore, the above process needs to be repeated. At this time, since the target node does not change, the types of node 1 and node 2 are swapped, the types of node 3 and nodes 4 and 5 are swapped, and the above process is repeated in a loop. Therefore, the account types of node 1 and node 2 are the same, and the account types of nodes 3 to 5 are the same.

[0058] Optionally, in the abnormal account identification method provided in the embodiments of this application, Figure 4 This is a flowchart of the importance calculation method provided according to the embodiments of this application, such as... Figure 4 As shown, in step S103, multiple nodes are classified according to the connection relationships between them in the directed graph, and the importance of each node is calculated to obtain the target account type and target account importance of each node, including:

[0059] Step S401: Set an initial importance for each node in the directed graph to obtain multiple initial importance values;

[0060] Step S402: Update the initial importance of each node according to the direction of the directed edges between each node and the connected nodes in the directed graph to obtain multiple candidate importance values;

[0061] Step S403: Determine each candidate importance as the updated initial importance, and execute the step of updating the initial importance of each node according to the direction of the directed edge between each node and the connected nodes in the directed graph to obtain multiple candidate importances, until the initial importance and candidate importance of each node are the same.

[0062] Step S404: Determine the candidate importance of each node as the target account importance of the node.

[0063] Specifically, when calculating the importance of each node, an initial importance needs to be set for each node. The initial importance of each node can be the same value. Further, the initial importance of each node can be updated based on the direction of the directed edges between each node and its connected nodes, resulting in multiple candidate importance values. For example, the number of directed edges pointing to each node can be determined, and the initial importance of each node can be modified based on the number of nodes corresponding to those directed edges and the total number of directed edges. The directed edges pointing to each node are also the directed edges when the node acts as a counterparty in a transaction. Figure 2 As shown, Figure 2 The number of directed edges in node 3 is 5, the number of directed edges it points to is 4, and the number of nodes corresponding to the directed edges is 2.

[0064] After each node is calculated once, the initial importance of each node is updated, and the above process is repeated after the update until the value of the initial importance does not change, thus completing the calculation process of the target importance of each node.

[0065] Optionally, in the abnormal account identification method provided in this application embodiment, updating the initial importance of each node according to the direction of the directed edges between each node and connected nodes in the directed graph to obtain multiple candidate importances includes: for each node, obtaining the directed edges pointing to the node from the multiple directed edges connected to the node to obtain a set of candidate directed edges; obtaining the nodes connected to the endpoints from the set of candidate directed edges to obtain a set of candidate nodes; obtaining the number of outgoing edges of each candidate node to obtain multiple second quantities; and calculating the candidate importance of the node according to the initial importance and second quantities of each candidate node.

[0066] Specifically, when calculating candidate importance, the initial importance PR(x) of each node can be set to 1 / N, where N is the total number of nodes in the directed graph, and the candidate importance of each node can be updated using the following formula:

[0067]

[0068] In the formula, PR1(x) is the updated importance of node x, also known as the candidate importance; U(x) is the set of nodes pointing to node x; PR(u) is the initial importance of the nodes pointing to node x; and N(u) is the number of outgoing links of each node u pointing to node x, i.e., the number of directed edges that node u points to.

[0069] Optionally, in the abnormal account identification method provided in the embodiments of this application, determining abnormal accounts from multiple transaction account information based on the target account type and target account importance of each node includes: obtaining nodes with a preset account type from multiple nodes in a directed graph to obtain multiple first nodes; obtaining nodes with a target account importance greater than a preset value from multiple first nodes to obtain multiple second nodes; and determining the account information represented by each second node as an abnormal account.

[0070] Specifically, after obtaining the target account type and target account importance, we can first determine the account type of the identified abnormal account, and obtain accounts of the same type as that account to obtain multiple first nodes. From the multiple first nodes, we can obtain nodes whose target account importance is greater than a preset value to obtain multiple second nodes. Thus, the accounts corresponding to the second nodes can be identified as abnormal accounts.

[0071] Optionally, in the abnormal account identification method provided in this application embodiment, after determining the abnormal account from multiple transaction account information according to the target account type and target account importance of each node, the method further includes: obtaining the historical authentication information of the abnormal account in the database; if the historical authentication information of the abnormal account is normal, determining the current authentication information of the abnormal account as abnormal and storing it in the database; if the historical authentication information of the abnormal account is abnormal, issuing an alarm message, wherein the alarm message indicates that the abnormal account has unauthorized transaction permissions.

[0072] Specifically, once an abnormal account is identified, it is necessary to determine whether the account has already been recorded as an abnormal account in the historical records. At this point, it is necessary to retrieve the historical authentication information of the abnormal account from the database and determine whether the account is abnormal in the historical authentication information. If the account is not abnormal in the historical authentication information, the current authentication information of the abnormal account is identified as abnormal and stored in the database. Thus, the current authentication information replaces the historical authentication information, making the account's authentication information change to abnormal. If the account is abnormal in the historical authentication information, it indicates that the account is still engaging in illegal transactions despite being identified as an abnormal account. In this case, an alarm message needs to be issued to notify staff to manually handle the account.

[0073] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0074] This application also provides an abnormal account identification device. It should be noted that the abnormal account identification device of this application can be used to execute the abnormal account identification method provided in this application. The abnormal account identification device provided in this application is described below.

[0075] Figure 5 This is a schematic diagram of an abnormal account identification device provided according to an embodiment of this application. Figure 5 As shown, the device includes: a first acquisition unit 51, a generation unit 52, a calculation unit 53, and a first determination unit 54.

[0076] The first acquisition unit 51 is used to acquire multiple pending transactions within the target date, and to identify abnormal transactions from the multiple pending transactions through preset rules, thereby obtaining multiple abnormal transactions. Each pending transaction includes transaction account information and basic transaction content. The transaction account information includes transaction owner information and transaction counterparty information.

[0077] The generation unit 52 is used to obtain transaction account information from all abnormal transactions, obtain multiple sets of transaction account information, and generate a directed graph of multiple abnormal transactions based on the multiple sets of transaction account information. The nodes in the directed graph are transaction owner information and / or transaction counterparty information.

[0078] The calculation unit 53 is used to classify multiple nodes according to the connection relationship between multiple nodes in the directed graph, and calculate the importance of each node to obtain the target account type and target account importance of each node.

[0079] The first determining unit 54 is used to determine abnormal accounts from multiple transaction account information based on the target account type and target account importance of each node.

[0080] The abnormal account identification device provided in this application embodiment includes a first acquisition unit 51, which acquires multiple pending transactions within a target date and identifies abnormal transactions from these transactions using preset rules, resulting in multiple abnormal transactions. Each pending transaction includes transaction account information and basic transaction content, with the transaction account information including transaction owner information and transaction counterparty information. A generation unit 52 acquires the transaction account information from all abnormal transactions, obtaining multiple sets of transaction account information, and generates a directed graph of multiple abnormal transactions based on these sets of information. Nodes in the directed graph represent transaction owner information and / or transaction counterparty information. A calculation unit 53 classifies multiple nodes based on the connection relationships between them in the directed graph and calculates the importance of each node, obtaining the target account type and target account importance for each node. A first determination unit 54 determines abnormal accounts from the multiple transaction account information based on the target account type and target account importance of each node. This solves the problem in related technologies where analyzing single account information cannot accurately identify abnormal accounts. By identifying abnormal transactions and generating a directed graph of accounts based on the transaction information within these abnormal transactions, and classifying multiple accounts according to the connections between multiple account nodes in the directed graph, accounts with close relationships are grouped together. The importance score of each account is calculated based on the relationship, and accounts are confirmed as abnormal based on their type according to both the importance score and the account type. Finally, by comprehensively judging accounts through transaction relationships and relationships between accounts, the effect of accurately identifying abnormal accounts is achieved.

[0081] Optionally, in the abnormal account identification device provided in this application embodiment, the first acquisition unit 51 includes: a first acquisition module, used to acquire transaction-based information in each pending transaction to obtain multiple transaction-based information; a first determination module, used to determine the number of counterparty information associated with each transaction-based information based on multiple pending transactions to obtain multiple first quantities; a second determination module, used to determine the total amount of multiple transactions associated with each transaction-based information based on multiple pending transactions to obtain multiple total transaction amounts; an input module, used to input the total transaction amount and first quantities of each transaction-based information into a rule model to obtain multiple abnormal transaction-based information, wherein the rule model includes multiple preset rules for identifying abnormal transactions; and a third determination module, used to determine pending transactions containing abnormal transaction-based information as abnormal transactions to obtain multiple abnormal transactions.

[0082] Optionally, in the abnormal account identification device provided in this application embodiment, the generation unit 52 includes: a fourth determining module, used to determine the transaction self information and transaction counterparty information in each group of transaction account information as two nodes, and connect the corresponding two nodes through directed edges according to the basic transaction content in each group of transaction account information to obtain multiple groups of sub-directed graphs, wherein the directed edges point to the transaction counterparty information; and a connecting module, used to connect the multiple groups of sub-directed graphs according to the same nodes between the multiple groups of sub-directed graphs to obtain a directed graph of multiple abnormal transactions.

[0083] Optionally, in the abnormal account identification device provided in this application embodiment, the calculation unit 53 includes: a first setting module, used to set an arbitrary account type for each node in the directed graph to obtain multiple initial account types; a fifth determining module, used to determine the transaction amount indicated by the directed edge of each node to obtain multiple sets of transaction amounts, wherein each set of transaction amounts includes at least one transaction amount; a sixth determining module, used to determine the maximum transaction amount in each set of transaction amounts and determine the directed edge where each maximum transaction amount is located to obtain multiple target directed edges and target nodes connected by each target directed edge; a first updating module, used to update the initial account type of each node to the initial account type of the corresponding target node to obtain multiple updated initial account types; and a first execution module, used to execute again the steps of determining the maximum transaction amount in each set of transaction amounts, obtaining the maximum transaction amount of each node, and determining the directed edge where each maximum transaction amount is located to obtain multiple target directed edges and target nodes connected by each target directed edge, until the initial account type of each node no longer changes to obtain the target account type of each node.

[0084] Optionally, in the abnormal account identification device provided in this application embodiment, the calculation unit 53 includes: a second setting module, used to set an initial importance for each node in the directed graph to obtain multiple initial importances; a second updating module, used to update the initial importance of each node according to the direction of the directed edge between each node and the connected node in the directed graph to obtain multiple candidate importances; a second execution module, used to determine each candidate importance as the updated initial importance, and execute again the step of updating the initial importance of each node according to the direction of the directed edge between each node and the connected node in the directed graph to obtain multiple candidate importances, until the initial importance and candidate importance of each node are the same; and a seventh determining module, used to determine the candidate importance of each node as the target account importance of the node.

[0085] Optionally, in the abnormal account identification device provided in this application embodiment, the second update module includes: a first acquisition submodule, used to acquire, for each node, the directed edges pointing to the node from the multiple directed edges connected to the node, to obtain a candidate directed edge set; a second acquisition submodule, used to acquire the nodes connected to the endpoints from the candidate directed edge set, to obtain a set of candidate nodes; a third acquisition submodule, used to acquire the number of outgoing edges of each candidate node, to obtain multiple second quantities; and a calculation submodule, used to calculate the candidate importance of the node based on the initial importance and the second quantity of each candidate node.

[0086] Optionally, in the abnormal account identification device provided in the embodiments of this application, the first determining unit 54 includes: a second obtaining module, used to obtain nodes with a preset type of account from multiple nodes in a directed graph to obtain multiple first nodes; a third obtaining module, used to obtain nodes with a target account importance greater than a preset value from multiple first nodes to obtain multiple second nodes; and an eighth determining module, used to determine the account information represented by each second node as an abnormal account.

[0087] Optionally, in the abnormal account identification device provided in the embodiments of this application, the device further includes: a second acquisition unit, used to acquire historical authentication information of abnormal accounts in a database; a second determination unit, used to determine the current authentication information of abnormal accounts as abnormal when the historical authentication information of abnormal accounts is normal, and store it in the database; and an alarm unit, used to issue alarm information when the historical authentication information of abnormal accounts is abnormal, wherein the alarm information indicates that the abnormal account has unauthorized transaction permissions.

[0088] The aforementioned abnormal account identification device includes a processor and a memory. The first acquisition unit 51, generation unit 52, calculation unit 53, first determination unit 54, etc., are all stored in the memory as program units. The processor executes the aforementioned program units stored in the memory to realize the corresponding functions.

[0089] The processor contains a kernel, which retrieves the corresponding program units from memory. One or more kernels can be configured; adjusting kernel parameters can address the problem in related technologies where analyzing single account information is insufficient to accurately identify abnormal accounts.

[0090] The memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0091] This invention provides a computer-readable storage medium storing a program thereon, which, when executed by a processor, implements the abnormal account identification method.

[0092] This invention provides a processor for running a program, wherein the program executes the abnormal account identification method during runtime.

[0093] like Figure 6 As shown, this embodiment of the invention provides an electronic device 60, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, it performs the following steps: acquiring multiple pending transactions within a target date, and identifying abnormal transactions from these pending transactions using preset rules to obtain multiple abnormal transactions. Each pending transaction includes transaction account information and basic transaction content; the transaction account information includes transaction owner information and transaction counterparty information. The invention also acquires transaction account information from all abnormal transactions, obtaining multiple sets of transaction account information, and generates a directed graph of multiple abnormal transactions based on these sets of information. Nodes in the directed graph represent transaction owner information and / or transaction counterparty information. The invention further classifies multiple nodes based on the connections between them and calculates the importance of each node to obtain the target account type and target account importance for each node. Finally, the invention identifies abnormal accounts from the multiple transaction account information based on the target account type and target account importance of each node. The device described herein can be a server, PC, PAD, mobile phone, etc.

[0094] This application also provides a computer program product, which, when executed on a data processing device, is suitable for executing an initialization program with the following method steps: acquiring multiple pending transactions within a target date, and identifying abnormal transactions from the multiple pending transactions according to preset rules to obtain multiple abnormal transactions, wherein each pending transaction includes transaction account information and basic transaction content, and the transaction account information includes transaction owner information and transaction counterparty information; acquiring the transaction account information from all abnormal transactions to obtain multiple sets of transaction account information, and generating a directed graph of multiple abnormal transactions based on the multiple sets of transaction account information, wherein the nodes in the directed graph are transaction owner information and / or transaction counterparty information; classifying multiple nodes according to the connection relationships between multiple nodes in the directed graph, and calculating the importance of each node to obtain the target account type and target account importance of each node; and determining abnormal accounts from the multiple transaction account information based on the target account type and target account importance of each node.

[0095] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0096] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0097] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0098] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0099] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0100] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0101] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0102] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0103] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for identifying abnormal accounts, characterized in that, include: The system acquires multiple pending transactions within a target date and identifies abnormal transactions from these transactions using preset rules, resulting in multiple abnormal transactions. Each pending transaction includes transaction account information and basic transaction content, with the transaction account information including transaction owner information and transaction counterparty information. Obtain transaction account information from all abnormal transactions to obtain multiple sets of transaction account information, and generate a directed graph of the multiple abnormal transactions based on the multiple sets of transaction account information, wherein the nodes in the directed graph are the transaction itself information and / or the transaction counterparty information; The nodes are classified according to the connection relationships between the nodes in the directed graph, and the importance of each node is calculated to obtain the target account type and target account importance of each node. The importance of the node is calculated based on the transaction volume. The process of classifying the multiple nodes in the directed graph based on their connections and calculating the importance of each node to obtain the target account type and target account importance for each node includes: setting an initial importance for each node in the directed graph to obtain multiple initial importances; updating the initial importance of each node according to the direction of the directed edges between each node and its connected nodes to obtain multiple candidate importances; determining each candidate importance as the updated initial importance, and repeating the step of updating the initial importance of each node according to the direction of the directed edges between each node and its connected nodes to obtain multiple candidate importances, until the initial importance and candidate importance of each node are the same; and determining the candidate importance of each node as the target account importance of the node. Abnormal accounts are identified from multiple transaction account information based on the target account type and target account importance of each node.

2. The method according to claim 1, characterized in that, By identifying abnormal transactions from the multiple pending transactions using preset rules, several abnormal transactions are obtained, including: Obtain the transaction-owning party information for each pending transaction, resulting in multiple transaction-owning party information entries; Based on the multiple pending transactions, determine the number of counterparty information associated with each party's information in each transaction, and obtain multiple first quantities; Based on the multiple pending transactions, determine the total limit of multiple transactions associated with each transaction's own information, and obtain multiple total transaction limits; The total transaction amount and first quantity of each transaction's own information are input into the rule model to obtain multiple abnormal transaction's own information, wherein the rule model includes multiple preset rules for identifying abnormal transactions; The pending transactions containing the information of the party involved in the abnormal transaction are identified as abnormal transactions, thus obtaining the plurality of abnormal transactions.

3. The method according to claim 1, characterized in that, Generating a directed graph of the multiple abnormal transactions based on the multiple sets of transaction account information includes: The transaction owner's information and the transaction counterparty's information in each group of transaction account information are identified as two nodes. The corresponding two nodes are connected by directed edges according to the basic transaction content in each group of transaction account information to obtain multiple groups of sub-directed graphs, wherein the directed edges point to the transaction counterparty information. By connecting the multiple sets of directed subgraphs based on the common nodes among them, a directed graph of the multiple abnormal transactions is obtained.

4. The method according to claim 1, characterized in that, The nodes in the directed graph are classified according to their connections, and the importance of each node is calculated to obtain the target account type and target account importance for each node, including: By assigning an arbitrary account type to each node in the directed graph, multiple initial account types can be obtained; Determine the transaction amount indicated by the directed edge of each node to obtain multiple sets of transaction amounts, where each set of transaction amounts includes at least one transaction amount; Determine the maximum transaction amount in each group of transactions, and determine the directed edge containing each maximum transaction amount, thus obtaining multiple target directed edges and the target nodes connected by each target directed edge; Update the initial account type of each node to the initial account type of the corresponding target node, resulting in multiple updated initial account types; Repeat the steps of determining the maximum transaction amount in each group of transactions to obtain the maximum transaction amount of each node, and determine the directed edge where each maximum transaction amount is located to obtain multiple target directed edges and the target nodes connected by each target directed edge, until the initial account type of each node no longer changes, and obtain the target account type of each node.

5. The method according to claim 1, characterized in that, The initial importance of each node is updated based on the direction of the directed edges between each node and its connected nodes in the directed graph, resulting in multiple candidate importance values, including: For each node, obtain the directed edges pointing to the node from the multiple directed edges connected to the node, and obtain a candidate directed edge set; Obtain the nodes whose endpoints are connected from the candidate directed edge set to obtain a set of candidate nodes; Obtain the number of outgoing edges for each candidate node to get multiple second counts; The candidate importance of a node is calculated based on its initial importance and second number.

6. The method according to claim 1, characterized in that, Based on the target account type and target account importance of each node, abnormal accounts are identified from multiple transaction account information, including: From the multiple nodes in the directed graph, nodes with a preset account type are obtained to obtain multiple first nodes; From the plurality of first nodes, nodes whose target account importance is greater than a preset value are obtained to obtain a plurality of second nodes; The account information represented by each second node is identified as the abnormal account.

7. The method according to claim 1, characterized in that, After identifying abnormal accounts from multiple transaction account information based on the target account type and target account importance of each node, the method further includes: Retrieve the historical authentication information of the abnormal account from the database; If the historical authentication information of the abnormal account is normal, the current authentication information of the abnormal account is determined to be abnormal and stored in the database; If the historical authentication information of the abnormal account is abnormal, an alarm message is issued, wherein the alarm message indicates that the abnormal account has unauthorized transaction permissions.

8. An abnormal account identification device, characterized in that, include: The first acquisition unit is used to acquire multiple pending transactions within a target date, and to identify abnormal transactions from the multiple pending transactions according to preset rules, thereby obtaining multiple abnormal transactions. Each pending transaction includes transaction account information and basic transaction content. The transaction account information includes transaction owner information and transaction counterparty information. The generation unit is used to obtain transaction account information from all abnormal transactions, obtain multiple sets of transaction account information, and generate a directed graph of the multiple abnormal transactions based on the multiple sets of transaction account information, wherein the nodes in the directed graph are the transaction itself information and / or the transaction counterparty information; The calculation unit is used to classify the multiple nodes according to the connection relationship between the multiple nodes in the directed graph, and calculate the importance of each node to obtain the target account type and target account importance of each node, wherein the importance of the node is calculated based on the transaction volume; The calculation unit includes: a second setting module, used to set an initial importance for each node in the directed graph, obtaining multiple initial importances; a second updating module, used to update the initial importance of each node according to the direction of the directed edges between each node and its connected nodes in the directed graph, obtaining multiple candidate importances; a second execution module, used to determine each candidate importance as the updated initial importance, and to execute again the step of updating the initial importance of each node according to the direction of the directed edges between each node and its connected nodes in the directed graph, obtaining multiple candidate importances, until the initial importance and candidate importance of each node are the same; and a seventh determining module, used to determine the candidate importance of each node as the target account importance of the node. The first determining unit is used to determine abnormal accounts from multiple transaction account information based on the target account type and target account importance of each node.

9. A computer storage medium, characterized in that, The computer storage medium is used to store a program, wherein the program, when running, controls the device where the computer storage medium is located to execute the abnormal account identification method according to any one of claims 1 to 7.

Images