Method and apparatus for identifying abnormal account

Abstract

The application provides an abnormal account identification method and device. The abnormal account identification method comprises the following steps: obtaining a plurality of to-be-identified account features of a to-be-identified account; obtaining a weight coefficient and a preset feature threshold value of each to-be-identified account feature; classifying each to-be-identified account feature according to each preset feature threshold value to obtain a first classification result of each to-be-identified account feature; and performing weighted voting on the first classification result of each to-be-identified account feature according to each weight coefficient to obtain a second identification result of the to-be-identified account. The application can accurately identify account abnormalities by using simple logical judgment, and can improve the efficiency of the abnormal account identification method compared with complex machine learning algorithm prediction or lengthy manual identification.

Description

Technical Field

[0001] This application mainly relates to the field of account recognition technology, specifically to a method and apparatus for identifying abnormal accounts. Background Technology

[0002] In the logistics sector, some corporate clients with high shipping demands sign agreements with logistics companies and register accounts to obtain shipping discounts. Some clients may open multiple sub-accounts. Identifying the transfer of shipping behavior between accounts can be used to monitor clients' shipping patterns, facilitating the identification of abnormal accounts. Furthermore, identifying account transfers can also help determine risk scenarios such as internal staff poaching clients or collusion between staff and clients to deliberately offer lower prices. The main challenge in this scenario is how to uncover the flow of shipping behavior from multiple accounts belonging to the same client, i.e., changes in the primary shipping account. Current solutions involve extracting and analyzing data from all accounts that have shown shipping activity, supplemented by feedback from local staff, or using simple machine learning algorithms for abnormal account identification. Both manual and machine learning algorithm-based identification methods are lengthy and inefficient.

[0003] In other words, existing methods for identifying abnormal accounts are inefficient. Summary of the Invention

[0004] This application provides a method and apparatus for identifying abnormal accounts, aiming to solve the problem of low efficiency in existing methods for identifying abnormal accounts.

[0005] Firstly, this application provides a method for identifying abnormal accounts, the method comprising:

[0006] Obtain multiple characteristics of the account to be identified;

[0007] Obtain the weight coefficients and preset feature thresholds for each feature of the account to be identified;

[0008] The features of each account to be identified are classified according to each preset feature threshold, and the first classification result of each account to be identified is obtained.

[0009] The first classification results of each account feature to be identified are weighted and voted on based on each weight coefficient to obtain the second identification result of the account to be identified.

[0010] Optionally, obtaining the weight coefficients and preset feature thresholds for each feature of the account to be identified includes:

[0011] Obtain a first sample training set, which includes multiple first training samples, each of which includes multiple first sample account features, and each of which is labeled with a sample tag.

[0012] A preset decision tree model is trained based on the first sample training set to obtain the target decision tree model;

[0013] Obtain the importance coefficients of each feature of the first sample account in the target decision tree model;

[0014] The weight coefficients of each feature of the account to be identified are determined based on the importance coefficients of each feature of the first sample account.

[0015] Optionally, obtaining the weight coefficients and preset feature thresholds for each feature of the account to be identified includes:

[0016] Based on the importance coefficients of each first sample account feature, the first sample account features are sorted from largest to smallest to obtain multiple sorted first sample account features.

[0017] The first preset number of first sample account features that rank first among multiple sorted first sample account features are determined as multiple second sample account features.

[0018] The preset feature threshold for each account feature to be identified is determined based on the first feature value of multiple second sample account features of each first training sample.

[0019] Optionally, determining the preset feature threshold for each account feature to be identified based on the first feature values ​​of multiple second sample account features from each first training sample includes:

[0020] Each feature of the second sample account is determined as the feature of the target account;

[0021] Obtain the second feature values ​​of the target account features for each of the first training samples;

[0022] Each second feature value is determined as the target feature threshold, and each first training sample is classified to obtain the classification error rate corresponding to each second feature value.

[0023] The second feature value corresponding to the minimum classification error rate among the classification error rates corresponding to each second feature value is determined as the preset feature threshold of the target account feature, thus obtaining the preset feature threshold of each second sample account feature;

[0024] The preset feature thresholds for each account to be identified are determined based on the preset feature thresholds for each second sample account feature.

[0025] Optionally, obtaining the first sample training set includes:

[0026] Obtain multiple second training samples and multiple third training samples, wherein the second training samples are labeled with sample tags, and the third training samples are not labeled with sample tags;

[0027] Cluster the multiple second training samples and multiple third training samples to obtain multiple second sample training sets;

[0028] Multiple second training samples from the second training set that meet the preset sample conditions are selected as the first training set.

[0029] Optionally, the account to be identified includes at least two sub-accounts, and obtaining multiple account features of the account to be identified includes:

[0030] Obtain the two sub-accounts of the account to be identified;

[0031] Based on preset division conditions, the two sub-accounts are divided into a quantity transfer-out sub-account and a quantity transfer-in sub-account;

[0032] Multiple characteristics of the account to be identified are determined based on the mail receiving and sending information of the sub-accounts for transferring out and receiving mail.

[0033] Optionally, the multiple characteristics of the account to be identified include at least one of the following: the difference in quantity change between the quantity change value of the sub-account from which the quantity is transferred out and the quantity change value of the sub-account from which the quantity is transferred in, the difference in the items consigned between the sub-account from which the quantity is transferred out and the sub-account from which the quantity is transferred in, and the difference in the sender between the sub-account from which the quantity is transferred out and the sub-account from which the quantity is transferred in.

[0034] Secondly, this application provides a device for identifying abnormal accounts, the device comprising:

[0035] The first acquisition unit is used to acquire multiple characteristics of the account to be identified.

[0036] The second acquisition unit is used to acquire the weight coefficients and preset feature thresholds of each feature of the account to be identified;

[0037] The classification unit is used to classify the features of each account to be identified according to each preset feature threshold, and obtain the first classification result of each account feature to be identified;

[0038] The weighted voting unit is used to perform weighted voting on the first classification results of each account feature to be identified based on each weight coefficient, so as to obtain the second identification result of the account to be identified.

[0039] Optionally, the second acquisition unit is configured to:

[0040] Obtain a first sample training set, which includes multiple first training samples, each of which includes multiple first sample account features, and each of which is labeled with a sample tag.

[0041] A preset decision tree model is trained based on the first sample training set to obtain the target decision tree model;

[0042] Obtain the importance coefficients of each feature of the first sample account in the target decision tree model;

[0043] The weight coefficients of each feature of the account to be identified are determined based on the importance coefficients of each feature of the first sample account.

[0044] Optionally, the second acquisition unit is configured to:

[0045] Based on the importance coefficients of each first sample account feature, the first sample account features are sorted from largest to smallest to obtain multiple sorted first sample account features.

[0046] The first preset number of first sample account features that rank first among multiple sorted first sample account features are determined as multiple second sample account features.

[0047] The preset feature threshold for each account feature to be identified is determined based on the first feature value of multiple second sample account features of each first training sample.

[0048] Optionally, the second acquisition unit is configured to:

[0049] Each feature of the second sample account is determined as the feature of the target account;

[0050] Obtain the second feature values ​​of the target account features for each of the first training samples;

[0051] Each second feature value is determined as the target feature threshold, and each first training sample is classified to obtain the classification error rate corresponding to each second feature value.

[0052] The second feature value corresponding to the minimum classification error rate among the classification error rates corresponding to each second feature value is determined as the preset feature threshold of the target account feature, thus obtaining the preset feature threshold of each second sample account feature;

[0053] The preset feature thresholds for each account to be identified are determined based on the preset feature thresholds for each second sample account feature.

[0054] Optionally, the second acquisition unit is configured to:

[0055] Obtain multiple second training samples and multiple third training samples, wherein the second training samples are labeled with sample tags, and the third training samples are not labeled with sample tags;

[0056] Cluster the multiple second training samples and multiple third training samples to obtain multiple second sample training sets;

[0057] Multiple second training samples from the second training set that meet the preset sample conditions are selected as the first training set.

[0058] Optionally, the account to be identified includes at least two sub-accounts, and the first acquisition unit is used for:

[0059] Obtain the two sub-accounts of the account to be identified;

[0060] Based on preset division conditions, the two sub-accounts are divided into a quantity transfer-out sub-account and a quantity transfer-in sub-account;

[0061] Multiple characteristics of the account to be identified are determined based on the mail receiving and sending information of the sub-accounts for transferring out and receiving mail.

[0062] Optionally, the multiple characteristics of the account to be identified include at least one of the following: the difference in quantity change between the quantity change value of the sub-account from which the quantity is transferred out and the quantity change value of the sub-account from which the quantity is transferred in, the difference in the items consigned between the sub-account from which the quantity is transferred out and the sub-account from which the quantity is transferred in, and the difference in the sender between the sub-account from which the quantity is transferred out and the sub-account from which the quantity is transferred in.

[0063] Thirdly, this application provides a computer device, the computer device comprising:

[0064] One or more processors;

[0065] Memory; and

[0066] One or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the processor to implement the method for identifying abnormal accounts as described in any of the first aspects.

[0067] Fourthly, this application provides a computer-readable storage medium storing a plurality of instructions adapted for loading by a processor to perform the steps of the abnormal account identification method described in any one of the first aspects.

[0068] This application provides a method and apparatus for identifying abnormal accounts. The method includes: acquiring multiple features of an account to be identified; acquiring weight coefficients and preset feature thresholds for each feature; classifying each feature according to the preset feature thresholds to obtain a first classification result for each feature; and weighting the first classification results based on the weight coefficients to obtain a second identification result for the account. In contrast to the lengthy and inefficient manual and machine learning algorithm-based identification of abnormal accounts in existing technologies, this application creatively proposes a method for identifying abnormal accounts. It classifies each feature according to preset feature thresholds across dimensions to obtain a first classification result for each feature dimension. Then, it weights the first classification results based on weight coefficients to obtain a second identification result for the account. This method uses simple logical judgment to accurately identify abnormal accounts, significantly improving efficiency compared to complex machine learning algorithms or lengthy manual identification. Attached Figure Description

[0069] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0070] Figure 1 This is a schematic diagram of a scenario for the abnormal account identification system provided in this application embodiment;

[0071] Figure 2 This is a schematic flowchart of an embodiment of the abnormal account identification method provided in this application.

[0072] Figure 3 This is a schematic diagram of an embodiment of the abnormal account identification device provided in this application.

[0073] Figure 4 This is a schematic diagram of an embodiment of the computer device provided in this application. Detailed Implementation

[0074] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0075] In the description of this application, it should be understood that the terms "center," "longitudinal," "lateral," "length," "width," "thickness," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," and "outer," etc., indicating orientation or positional relationships based on the orientation or positional relationships shown in the accompanying drawings, are used only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this application. Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, features defined with "first" and "second" may explicitly or implicitly include one or more features. In the description of this application, "a plurality of" means two or more, unless otherwise explicitly specified.

[0076] In this application, the term "exemplary" is used to mean "used as an example, illustration, or description." Any embodiment described as "exemplary" in this application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is provided to enable any person skilled in the art to make and use this application. Details are set forth in the following description for purposes of explanation. It should be understood that those skilled in the art will recognize that this application can be made without using these specific details. In other instances, well-known structures and processes are not described in detail to avoid obscuring the description of this application with unnecessary detail. Therefore, this application is not intended to be limited to the embodiments shown, but is consistent with the broadest scope of the principles and features disclosed in this application.

[0077] This application provides a method and apparatus for identifying abnormal accounts, which will be described in detail below.

[0078] Please see Figure 1 , Figure 1 This is a schematic diagram of a scenario for an abnormal account identification system provided in an embodiment of this application. The abnormal account identification system may include a computer device 100, which integrates an abnormal account identification device.

[0079] In this embodiment, the computer device 100 can be a standalone server, a server network, or a server cluster. For example, the computer device 100 described in this embodiment includes, but is not limited to, a computer, a network host, a single network server, a set of multiple network servers, or a cloud server composed of multiple servers. The cloud server is composed of a large number of computers or network servers based on cloud computing.

[0080] In this embodiment, the computer device 100 described above can be a general-purpose computer device or a special-purpose computer device. In specific implementations, the computer device 100 can be a desktop computer, a portable computer, a network server, a handheld computer (Personal Digital Assistant, PDA), a mobile phone, a tablet computer, a wireless terminal device, a communication device, an embedded device, etc. This embodiment does not limit the type of computer device 100.

[0081] Those skilled in the art will understand that Figure 1 The application environment shown is merely one application scenario of the solution in this application and does not constitute a limitation on the application scenario of the solution in this application. Other application environments may include more than one application scenario. Figure 1 The number of computer devices shown is more or less, for example Figure 1 Only one computer device is shown in the document. It is understood that the identification system for the abnormal account may also include one or more other computer devices capable of processing data, which are not specifically limited here.

[0082] In addition, such as Figure 1 As shown, the abnormal account identification system may also include a memory 200 for storing data.

[0083] It should be noted that, Figure 1 The schematic diagram of the abnormal account identification system shown is merely an example. The abnormal account identification system and scenario described in this application embodiment are for the purpose of more clearly illustrating the technical solutions of this application embodiment and do not constitute a limitation on the technical solutions provided in this application embodiment. As those skilled in the art will know, with the evolution of abnormal account identification systems and the emergence of new business scenarios, the technical solutions provided in this application embodiment are also applicable to similar technical problems.

[0084] First, this application provides a method for identifying abnormal accounts. The method includes: obtaining multiple features of an account to be identified; obtaining weight coefficients and preset feature thresholds for each feature; classifying each feature according to the preset feature thresholds to obtain a first classification result for each feature; and weighting the first classification result of each feature according to the weight coefficients to obtain a second identification result for the account to be identified.

[0085] like Figure 2 As shown, Figure 2 This is a flowchart illustrating an embodiment of the abnormal account identification method in this application. The abnormal account identification method includes the following steps S201 to S204:

[0086] S201. Obtain multiple characteristics of the account to be identified.

[0087] In this embodiment, the account to be identified may include one sub-account or at least two sub-accounts. For example, in the logistics field, some corporate clients with high shipping demand will sign agreements with logistics companies and register accounts to obtain shipping discounts. Some shipping clients will open multiple sub-accounts according to the logistics company's sales strategy. Identifying the transfer of shipping behavior between sub-accounts can be used to monitor the client's shipping behavior patterns, facilitating client retention and adjustments to sales strategies.

[0088] The account to be identified may include information such as account name and sender's phone number. The account to be identified includes at least two sub-accounts that share the same sender's phone number as the account to be identified. Since some customers may use other people's accounts to send packages, this application associates accounts through the sender's phone number of the account to be identified, that is, multiple sub-accounts using the same sender's phone number as the account to be identified are combined into at least two sub-accounts under the account to be identified.

[0089] In one specific embodiment, the account to be identified includes at least two sub-accounts, and obtaining multiple account characteristics of the account to be identified may include:

[0090] (1) Obtain the two sub-accounts of the account to be identified.

[0091] In this embodiment of the application, the two sub-accounts are any two of the at least two sub-accounts under the account to be identified.

[0092] (2) Based on the preset division conditions, the two sub-accounts are divided into a quantity transfer-out sub-account and a quantity transfer-in sub-account.

[0093] In one specific embodiment, the month-on-month change information of the shipment volume of two sub-accounts is obtained. The sub-account with a month-on-month increase in shipment volume is identified as the shipment volume transfer-out sub-account; the sub-account with a month-on-month decrease in shipment volume is identified as the shipment volume transfer-in sub-account. Of course, in other embodiments, to simplify calculations, either of the two sub-accounts can be designated as the shipment volume transfer-out sub-account, and the other as the shipment volume transfer-in sub-account. The shipment volume transfer-out sub-account and the shipment volume transfer-in sub-account constitute an account pair.

[0094] (3) Determine multiple characteristics of the account to be identified based on the mailing and receiving information of the sub-accounts for which the volume is transferred out and the sub-accounts for which the volume is transferred in.

[0095] In this embodiment, the multiple characteristics of the account to be identified may include at least one of the following: the difference in quantity change between the quantity change value of the sub-account transferring out and the quantity change value of the sub-account transferring in; the difference in the number of items shipped between the sub-accounts transferring out and those transferring in; and the difference in the sender and recipient between the sub-accounts transferring out and those transferring in. These characteristics can be combined arbitrarily and are not limited herein. Of course, the multiple characteristics of the account to be identified may also include basic statistical data and cross-statistical data that can measure customer shipping behavior, such as the number of items shipped by the sub-account transferring out, order weight, and order shipping cost.

[0096] In one specific embodiment, multiple characteristics of the account to be identified may include: the change value D of the quantity transferred out of the sub-account. A The change in quantity D of the quantity transferred to the sub-account B The difference in shipment volume, diff_rate. Assuming the shipment volume of the account to be identified changes from shipment volume transfer-out sub-account A to shipment volume transfer-in sub-account B, then the change in shipment volume D for shipment volume transfer-out sub-account A is... A The change in quantity D of the quantity transferred to sub-account B B The difference should be minimal. (Difference in quantity variation) A -D B This feature can depict the relationship between the shipment volume changes of two sub-accounts, and the difference in shipment volume changes between the two sub-accounts can be used to measure whether there are any anomalies between them. To eliminate the difference in shipment volume changes caused by differences in the basic shipment volume, this feature needs to be standardized. Specifically, it obtains the shipment volume change value D of the shipment volume transfer sub-account A within the target time period relative to the previous time period. A Get the change in the number of items transferred to sub-account B within the target time period relative to the previous time period, represented by item D. B The target time period can be this month, this week, etc., and can be set according to the specific situation. The difference in the quantity change, diff_rate, is obtained using formula (1).

[0097]

[0098] In one specific embodiment, multiple characteristics of the account to be identified may include: the difference in the types of items shipped by the sub-accounts that transfer out and the sub-accounts that transfer in shipments. The types of items frequently shipped by customers of the same company generally do not fluctuate significantly in a short period of time; therefore, the relationship between two sub-accounts can be measured by comparing changes in the types of items shipped.

[0099] Specifically, the first set of consignment categories C for sub-account A within the target time period is obtained. A The acquired items are transferred to sub-account B, which contains the second set of consignment items C within the target time period. BCalculate the first set of consignment categories C. A Second set of consignment categories C B The similarity between them is based on the first set of consignment categories C. A Second set of consignment categories C B The similarity between them determines the difference in the number of items transferred out and the number of items transferred in sub-accounts. The first set of item types C can be used as a reference. A Second set of consignment categories C B The Jaccard distance is defined as the similarity of consigned items between the outgoing and incoming sub-accounts. Jaccard distance is a metric used to measure the difference between two sets; it is the complement of the Jaccard similarity coefficient and is defined as 1 minus the Jaccard similarity coefficient. The Jaccard similarity coefficient, also known as the Jaccard index, is another metric used to measure the similarity between two sets. Further, the quantity of each consigned item type in the outgoing sub-account A within the target time period is obtained. These consigned item types are then sorted from largest to smallest, and the second-preset quantity of consigned item types at the top of the sorted list is used as the first set of consigned item types C. A ; Obtain the quantity of each type of item transferred to sub-account B within the target time period, sort the items by quantity from largest to smallest, and obtain the second preset quantity of the top-ranked item types as the second set of item types C. B The second preset quantity can be 10, 5, etc., depending on the specific situation. Removing some types of consignments with a small quantity can enhance the generalization of the features. Specifically, the consignment difference degree cons_dist between the quantity transfer-out sub-account and the quantity transfer-in sub-account is calculated according to formula (2).

[0100]

[0101] In one specific embodiment, multiple characteristics of the account to be identified may include: the difference in senders between the sub-accounts for which shipments are transferred out and the sub-accounts for which shipments are transferred in. Since the senders entered by customers of the same company generally do not fluctuate significantly in a short period, the relationship between two sub-accounts can be measured by comparing changes in the entered senders. Of course, multiple characteristics of the account to be identified may also include: the difference in sender and recipient information between the sub-accounts for which shipments are transferred out and the sub-accounts for which shipments are transferred in.

[0102] Specifically, obtain the first set of senders N for sub-account A within the target time period.A The number of items acquired is transferred to sub-account B, which is the second set of senders N within the target time period. B The first set of senders N from sub-account A is used to calculate the number of items transferred. A The set of N second senders to which the quantity of mail transferred to sub-account B is located. B The similarity between them is determined by the first set of senders N for sub-account A, based on the number of items transferred. A The set of N second senders to which the quantity of mail transferred to sub-account B is located. B The similarity between them determines the difference in senders between the sub-accounts for which shipments are transferred out and the sub-accounts for which shipments are transferred in. This can be achieved by considering the first set of shipment types, C. A Second set of consignment categories C B The Jaccard distance is determined as the similarity of the items consigned by the sub-accounts transferring out and receiving items. Further, the number of each sender for sub-account A transferring out within the target time period is obtained, and these senders are sorted from largest to smallest. The second preset number of senders at the top of the sorted list is then used as the first set N of senders for sub-account A transferring out within the target time period. A ; Obtain the number of each sender in sub-account B within the target time period, sort the senders in sub-account B from largest to smallest, and obtain the second preset number of senders at the top of the sorted list as the second set N of senders in sub-account B within the target time period. B The second preset quantity can be 10, 5, etc., depending on the specific situation. Removing some senders with a small number of items can enhance the generalization of the features. Specifically, the sender difference name_dist between the sub-accounts for transferring out and the sub-accounts for transferring in is calculated according to formula (3).

[0103]

[0104] In one specific embodiment, multiple characteristics of the account to be identified may include: the difference in discount rates between the sub-accounts transferring out and receiving orders. Customers typically transfer accounts for profit, and the higher discounts of the new accounts are one such benefit; therefore, the difference in discount rates between accounts can be considered an important feature. Specifically, the first discount rate R of the sub-account A transferring out is obtained within the target time period. A The volume of items transferred to sub-account B will be subject to the second discount rate R within the target time period. B The first discount rate R A Second discount rate R B The difference is determined as the discount rate difference degree, discount_diff. Specifically, the discount rate difference degree, discount_diff, is determined according to formula (4).

[0105] discount_diff = R A -R B (4)

[0106] S202. Obtain the weight coefficients and preset feature thresholds for each feature of the account to be identified.

[0107] In this embodiment, the weight coefficients and preset feature thresholds of each account feature to be identified can be set based on human experience or determined using machine learning algorithms based on the training set.

[0108] In a specific embodiment, obtaining the weight coefficients and preset feature thresholds for each feature of the account to be identified may include:

[0109] (1) Obtain the first sample training set.

[0110] In this embodiment, the first sample training set includes multiple first training samples, each of which includes multiple first sample account features. Each first training sample is labeled with a sample tag. The sample tags can be of anomaly or normal type. Samples with anomaly tags are positive samples (represented by "1"), and samples with normal tags are negative samples (represented by "0"). The sample tags for the first training samples can be annotated by specific business entities. The first sample account features may include: the difference in quantity changes between the outgoing and incoming sub-accounts, and / or the difference in the items shipped between the outgoing and incoming sub-accounts, and / or the difference in the sender and recipient between the outgoing and incoming sub-accounts. Of course, the multiple account features to be identified may also include basic statistical data and cross-statistical data that can measure customer shipping behavior, such as the number of items shipped by the outgoing sub-account, order weight, and order shipping costs.

[0111] When there are too many training samples in the training set, labeling all of them will consume a lot of time, reducing the time for abnormal account identification and thus reducing the efficiency of abnormal account identification. To improve the efficiency of abnormal account identification, in a specific embodiment, obtaining the first training set may include: obtaining multiple second training samples and multiple third training samples, clustering the multiple second training samples and multiple third training samples to obtain multiple second training sets, and determining multiple third training samples in the second training sets that meet preset sample conditions as the first training set.

[0112] First, multiple second training samples and multiple third training samples are obtained. The second training samples are labeled, while the third training samples are not. Specifically, multiple second and third training samples are determined based on the first order data within a preset historical period. The preset historical period can be 2 months, 3 months, etc., and can be adjusted according to business needs.

[0113] In one specific embodiment, considering certain special business scenarios, the data source for account pairing needs to undergo some cleaning. Specifically, second order data within a preset time period is obtained; order data in the second order data whose sender phone numbers meet preset abnormal number conditions are deleted to obtain first order data. The preset abnormal number conditions can be that the sender phone number is shorter than a preset length, or the sender phone number is a spam sender phone number. For example, spam sender phone numbers like 1111 and 1. Based on the second order data, the number of shipments for each sender phone number in each sub-account within the preset time period is calculated. Sub-accounts with shipment volumes lower than the preset shipment volume are deleted to obtain the shipment volume for each sender phone number in each sub-account within the preset time period. For example, if a sender phone number only sent one order using that account last month, then that phone number is considered not the primary sender for that account last month and can be deleted.

[0114] Furthermore, the second order data includes orders within a preset time period. Optionally, the second order data includes prepaid orders within a preset time period. Prepaid orders are selected because some companies use their own accounts when providing return cash-on-delivery services to their customers. If only the relationship between the sender and the account is considered, the company's customers would be associated with the company's account. Therefore, this application only selects prepaid orders, making the selected features more targeted and improving the efficiency of identifying abnormal accounts.

[0115] After acquiring multiple second training samples and multiple third training samples, clustering is performed on these samples based on a third preset number to obtain a third preset number of second sample training sets. Specifically, the third preset number K can be determined manually. For example, the third preset number K is 3 or 4. Preferably, multiple different clustering numbers are used to cluster the multiple second training samples and multiple third training samples respectively, resulting in multiple clustering results. The sum of squared errors (SSE) of the multiple clustering results is determined using the elbow method, and the optimal number of clusters is determined based on the sum of squared errors (SSE) of the multiple clustering results, which is then set as the third preset number. When the number of clusters is the optimal number, the curve formed by plotting the sum of squared errors (SSE) on the ordinate and the number of clusters on the abscissa has the highest curvature. Of course, in other embodiments, the optimal number of clusters can also be obtained using the contour method.

[0116] In this embodiment, after obtaining multiple second sample training sets, the number of second training samples in each second sample training set is obtained. Multiple second training samples in the second sample training sets that meet preset sample conditions are determined as the first sample training set. The preset sample conditions can be that the number of second training samples in each second sample training set is the highest, and the total number of samples is the highest. The second sample training set with the highest number of second training samples and the highest total number of samples is determined as the candidate sample training set; the set of second training samples in the candidate sample training set is determined as the first sample training set. The candidate sample training set is the set with the highest number of second training samples and the highest total number of samples in each second sample training set. Samples not belonging to the candidate sample training set are outliers, and their removal ensures the accuracy and efficiency of subsequent calculations.

[0117] (2) Train the preset decision tree model based on the first sample training set to obtain the target decision tree model.

[0118] Decision tree models use a tree-like structure to represent class partitioning. Building the tree can be viewed as a variable selection process. Internal nodes indicate which variables are chosen for partitioning, leaf nodes represent class labels, and the top level is the root node. Decision trees classify data through a series of rules. They provide a rule-based approach to predicting values ​​under certain conditions. Decision tree algorithms belong to supervised learning, meaning the original data must contain both predictor and target variables. Decision trees are divided into classification decision trees (target variables are categorical numerical values) and regression decision trees (target variables are continuous variables). In classification decision trees, the mode of the output variable in the samples contained in the leaf nodes is the classification result; in regression trees, the average of the output variable in the samples contained in the leaf nodes is the prediction result.

[0119] In an optional embodiment, the default decision tree model is the CART decision tree model (Classification and Regression Trees). Of course, the default decision tree model can also be ID3, C4.5, or other models. CART decision trees, also known as classification and regression trees, are regression trees when the dependent variable of the dataset is a continuous numerical value, using the mean of the leaf node observations as the predicted value; when the dependent variable of the dataset is a discrete numerical value, the tree algorithm is a classification tree, which can effectively solve classification problems.

[0120] (3) Obtain the importance coefficient of each first sample account feature in the target decision tree model.

[0121] In this embodiment, the importance coefficient is the feature importance score of the target decision tree model. Specifically, during the formation of the decision tree, a strategy is needed to select one feature from m features as the splitting attribute during the splitting process at each node. To ensure that the selected feature is the optimal splitting attribute, the strategy may include, for example, using the ID3 algorithm based on information gain, the C4.5 algorithm based on information gain ratio, and a branching algorithm based on the Gini index, etc.

[0122] In a specific embodiment, the importance coefficient of the first sample account feature in the target decision tree model is the sum of the importance coefficients of the first sample account feature in each leaf node of the target decision tree model. The importance coefficient of the first sample account feature in a leaf node is the change in the Gini index before and after the leaf node is branched. The Gini index (also known as Gini impurity, Gini uncertainty, etc.) is a measure of data uncertainty. The smaller the Gini index, the better the certainty of the sample set and the lower the probability of error; the larger the Gini index, the greater the uncertainty of the sample set and the higher the probability of error. Therefore, it is easy to understand that if the difference between the current Gini index of the sample set at a node (e.g., node m) and the Gini index of the sample sets of the left and right child nodes after splitting based on the selected customer feature is larger, the selected account feature is more important.

[0123] (4) Determine the weight coefficient of each feature of the account to be identified based on the importance coefficient of each feature of the first sample account.

[0124] In this embodiment, the importance coefficients of the first sample account features corresponding to each account feature to be identified are determined as the weight coefficients of each account feature to be identified. Specifically, the importance coefficients of the first sample account features corresponding to each account feature to be identified are assigned one-to-one as the weight coefficients of each account feature to be identified. Further, the importance coefficients of the first sample account features corresponding to each account feature to be identified are normalized and then assigned one-to-one as the weight coefficients of each account feature to be identified. Normalization transforms the numbers into decimals between (0, 1). This is primarily for ease of data processing, mapping the data to the range of 0 to 1 for processing, making it more convenient and faster. Of course, in other embodiments, the importance coefficients of each first sample account feature can also be mapped to the weight coefficients of each account feature to be identified according to a preset mapping relationship, which can be determined based on manual experience.

[0125] Furthermore, obtaining the weight coefficients and preset feature thresholds for each feature of the account to be identified may also include:

[0126] (1) Sort the features of each first sample account from largest to smallest based on the importance coefficient of each feature of the first sample account to obtain multiple sorted features of the first sample account.

[0127] (2) The first preset number of first sample account features ranked first among the multiple sorted first sample account features are determined as multiple second sample account features.

[0128] The higher the ranking of the features of the first sample account, the more important the feature is. The first preset number can be a preset percentage of the number of features of the first sample account, for example, 5%. Extracting the top 5% of the more important features for subsequent calculations significantly improves the calculation speed and efficiency of abnormal account identification without significantly reducing the calculation accuracy.

[0129] (3) Determine the preset feature threshold of each account feature to be identified based on the first feature value of multiple second sample account features of each first training sample.

[0130] In this embodiment of the application, the first feature value is the feature value of the second sample account feature. For example, the second sample account feature is the difference in the quantity of items diff_rate, and the first feature value is 0.1; the second sample account feature is the consignment difference degree cons_dist, and the first feature value is 0.2.

[0131] In one specific embodiment, determining a preset feature threshold for each account feature to be identified based on the first feature values ​​of multiple second sample account features of each first training sample includes: determining the average value of the first feature values ​​of each first training sample of the second sample account features as the preset feature threshold for the account feature to be identified.

[0132] In another specific embodiment, determining a preset feature threshold for each account feature to be identified based on the first feature values ​​of multiple second sample account features of each first training sample includes: determining the median of the first feature values ​​of each first training sample of the second sample account features as the preset feature threshold for the account feature to be identified.

[0133] In yet another specific embodiment, determining a preset feature threshold for each feature of the account to be identified based on the first feature values ​​of multiple second sample account features of each first training sample may include:

[0134] (1) Determine the features of each second sample account as the features of the target account.

[0135] Specifically, the features of each second sample account are determined as the features of the target account, and the preset feature thresholds of each second sample account feature can be calculated in parallel.

[0136] (2) Obtain the second feature values ​​of the target account features of each first training sample.

[0137] For example, the target account feature is the difference in item quantity change, diff_rate. Multiple first training samples are sample X1, sample X2, and sample X3. Sample X1 has a second feature value of 0.2 for diff_rate; sample X2 has a second feature value of 0.1 for diff_rate.

[0138] (3) Each second feature value is determined as the target feature threshold to classify each first training sample, and the classification error rate corresponding to each second feature value is obtained.

[0139] Specifically, each second feature value is determined as a target feature threshold; each first training sample is classified based on the target feature threshold and multiple preset classification strategies; the classification error rate of the target feature threshold under each preset classification strategy is obtained; the minimum classification error rate of the target feature threshold under each preset classification strategy is determined as the classification error rate corresponding to the target feature threshold; and the classification error rate corresponding to each second feature value is obtained. For example, the multiple preset classification strategies can be two preset classification strategies, one of which determines the prediction result of the first training sample with a second feature value greater than the target feature threshold as normal, and the prediction result of the first training sample with a second feature value less than the target feature threshold as abnormal; the other preset classification strategy determines the prediction result of the first training sample with a second feature value greater than the target feature threshold as abnormal, and the prediction result of the first training sample with a second feature value less than the target feature threshold as normal. Of course, in other embodiments, there can also be only one preset classification strategy.

[0140] For example, the item quantity change difference, `diff_rate`, is a target account feature. The item quantity change difference `diff_rate` and sample labels for the five first training samples are: 0.1, abnormal; 0.2, normal; 0.3, abnormal; 0.4, normal; 0.5, abnormal. First, using 0.1 as the target feature threshold, first training samples with a second feature value <= 0.1 are identified as abnormal, and those with a second feature value > 0.1 are identified as normal, resulting in a classification error rate of 0.4. Then, first training samples with a second feature value <= 0.1 are identified as normal, and those with a second feature value <= 0.1 are identified as abnormal, resulting in a classification error rate of 0.6. This process is repeated, using each second feature value as the target feature threshold, to calculate the classification error rate for each second feature value.

[0141] (4) The second feature value corresponding to the minimum classification error rate among the classification error rates of each second feature value is determined as the preset feature threshold of the target account feature, and the preset feature threshold of each second sample account feature is obtained.

[0142] By identifying the features of each second sample account as the features of the target account, the preset feature thresholds for each second sample account feature can be obtained.

[0143] (5) Determine the preset feature threshold of each account to be identified based on the preset feature threshold of each second sample account feature.

[0144] Specifically, the preset feature threshold of the second sample account feature corresponding to the account feature to be identified is determined as the preset feature threshold of the account feature to be identified. For example, if the second sample account feature is the difference in quantity change (diff_rate), the corresponding preset feature threshold is 0.3; if the account feature to be identified is the difference in quantity change (diff_rate), then the preset feature threshold corresponding to the account feature to be identified is 0.3.

[0145] Specifically, the preset feature thresholds of each second sample account feature are mapped one-to-one to the preset feature thresholds of each account to be identified. Further, the preset feature thresholds of each second sample account feature are normalized and then mapped one-to-one to the preset feature thresholds of each account to be identified. Normalization transforms numbers into decimals between (0, 1). This is primarily for ease of data processing, mapping data to the range of 0-1 for faster and more convenient processing. Of course, in other embodiments, the preset feature thresholds of each second sample account feature can also be mapped to the preset feature thresholds of each account to be identified based on a preset mapping relationship. This mapping relationship can be determined based on manual experience.

[0146] S203. Classify the features of each account to be identified according to each preset feature threshold to obtain the first classification result of each account to be identified.

[0147] Specifically, each feature to be identified is classified according to its preset feature threshold and corresponding preset classification strategy, resulting in a first classification result for each feature. The specific value of the first classification result is either normal or abnormal.

[0148] In one specific embodiment, the preset classification strategy is as follows: the first classification result of the account feature to be identified with a feature value greater than a preset feature threshold is determined as normal, and the first classification result of the account feature to be identified with a feature value not greater than the preset feature threshold is determined as abnormal. Of course, in other embodiments, the preset classification strategy can be set manually, and is not limited here.

[0149] S204. Based on the weight coefficients, the first classification results of each account feature to be identified are weighted and voted to obtain the second identification result of the account to be identified.

[0150] Specifically, a weighted vote is performed on the first classification results of each account feature to be identified based on various weight coefficients to obtain the voting weight of each first classification result; the first classification result with the highest voting weight is determined as the second identification result for the account to be identified. Specifically, each first classification result is determined as the target classification result, and the features of each target account to be identified that are classified as target classification results are obtained; the weight coefficients corresponding to each target account feature to be identified are added together to obtain the voting weight of the target classification result, thereby obtaining the voting weight of each first classification result.

[0151] For example, if there are 5 features of an account to be identified, and the first classification result of 2 features is abnormal, with weight coefficients of 0.2 and 0.9 respectively, then the voting weight for the first classification result of abnormal is 1.1; if the first classification result of 3 features is normal, with weight coefficients of 0.2, 0.1 and 0.5 respectively, then the voting weight for the first classification result of normal is 0.8; the voting weight for the first classification result of abnormal is the highest, and the second identification result of the account to be identified is abnormal.

[0152] This application provides a method and apparatus for identifying abnormal accounts. The method includes: acquiring multiple features of an account to be identified; acquiring weight coefficients and preset feature thresholds for each feature; classifying each feature according to the preset feature thresholds to obtain a first classification result for each feature; and weighting the first classification results based on the weight coefficients to obtain a second identification result for the account. In contrast to the lengthy and inefficient manual and machine learning algorithm-based identification of abnormal accounts in existing technologies, this application creatively proposes a method for identifying abnormal accounts. It classifies each feature according to preset feature thresholds across dimensions to obtain a first classification result for each feature dimension. Then, it weights the first classification results based on weight coefficients to obtain a second identification result for the account. This method uses simple logical judgment to accurately identify abnormal accounts, significantly improving efficiency compared to complex machine learning algorithms or lengthy manual identification.

[0153] To better implement the abnormal account identification method in the embodiments of this application, based on the abnormal account identification method, the embodiments of this application also provide an abnormal account identification device, such as... Figure 3As shown, the abnormal account identification device 300 includes:

[0154] The first acquisition unit 301 is used to acquire multiple characteristics of the account to be identified.

[0155] The second acquisition unit 302 is used to acquire the weight coefficients and preset feature thresholds of each feature of the account to be identified;

[0156] The classification unit 303 is used to classify each feature of the account to be identified according to each preset feature threshold, and obtain the first classification result of each feature of the account to be identified.

[0157] The weighted voting unit 304 is used to perform weighted voting on the first classification results of each account feature to be identified according to each weight coefficient, so as to obtain the second identification result of the account to be identified.

[0158] Optionally, the second acquisition unit 302 is used for:

[0159] Obtain the first sample training set, which includes multiple first training samples, each of which includes multiple first sample account features, and each first training sample is labeled with a sample tag.

[0160] The target decision tree model is obtained by training a pre-set decision tree model based on the first sample training set.

[0161] Obtain the importance coefficients of each feature of the first sample account in the target decision tree model;

[0162] The weight coefficients of each feature of the account to be identified are determined based on the importance coefficients of each feature of the first sample account.

[0163] Optionally, the second acquisition unit 302 is used for:

[0164] Based on the importance coefficients of each first sample account feature, the first sample account features are sorted from largest to smallest to obtain multiple sorted first sample account features.

[0165] The first preset number of first sample account features that rank first among multiple sorted first sample account features are determined as multiple second sample account features.

[0166] The preset feature threshold for each account feature to be identified is determined based on the first feature value of multiple second sample account features of each first training sample.

[0167] Optionally, the second acquisition unit 302 is used for:

[0168] Each feature of the second sample account is determined as the feature of the target account;

[0169] Obtain the second feature values ​​of the target account features for each of the first training samples;

[0170] Each second feature value is determined as the target feature threshold, and each first training sample is classified to obtain the classification error rate corresponding to each second feature value.

[0171] The second feature value corresponding to the minimum classification error rate among the classification error rates corresponding to each second feature value is determined as the preset feature threshold of the target account feature, thus obtaining the preset feature threshold of each second sample account feature;

[0172] The preset feature thresholds for each account to be identified are determined based on the preset feature thresholds for each second sample account.

[0173] Optionally, the second acquisition unit 302 is used for:

[0174] Obtain multiple second training samples and multiple third training samples, wherein the second training samples are labeled, and the third training samples are not labeled;

[0175] Clustering multiple second training samples and multiple third training samples yields multiple second sample training sets;

[0176] Multiple second training samples that meet the preset sample conditions in the second sample training set are determined as the first sample training set.

[0177] Optionally, the account to be identified includes at least two sub-accounts, and the first acquisition unit 301 is used for:

[0178] Retrieve the two sub-accounts of the account to be identified;

[0179] Based on preset division criteria, the two sub-accounts are divided into a sub-account for transferring out of the quantity and a sub-account for transferring in the quantity.

[0180] Multiple characteristics of the accounts to be identified are determined based on the mail receiving and sending information of the sub-accounts for which the volume is transferred out and the sub-accounts for which the volume is transferred in.

[0181] Optionally, the multiple characteristics of the account to be identified include at least one of the following: the difference in quantity change between the quantity change value of the sub-account transferring out and the quantity change value of the sub-account transferring in, the difference in the consigned items between the sub-account transferring out and the sub-account transferring in, and the difference in the sender between the sub-account transferring out and the sub-account transferring in.

[0182] This application also provides a computer device that integrates any of the abnormal account identification devices provided in this application. The computer device includes:

[0183] One or more processors;

[0184] Memory; and

[0185] One or more applications, wherein the applications are stored in memory and configured to be executed by a processor, wherein the steps of the abnormal account identification method in any of the embodiments described above are performed.

[0186] like Figure 4 As shown, it illustrates a structural schematic diagram of the computer device involved in the embodiments of this application, specifically:

[0187] The computer device may include components such as a processor 401 with one or more processing cores, a memory 402 with one or more computer-readable storage media, a power supply 403, and an input unit 404. Those skilled in the art will understand that the computer device structure shown in the figures does not constitute a limitation on the computer device, and may include more or fewer components than shown, or combine certain components, or have different component arrangements. Wherein:

[0188] Processor 401 is the control center of the computer device. It connects various parts of the computer device via various interfaces and lines, and performs various functions and processes data by running or executing software programs and / or modules stored in memory 402, and by calling data stored in memory 402, thereby providing overall monitoring of the computer device. Optionally, processor 401 may include one or more processing cores; processor 401 may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor. Preferably, processor 401 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the aforementioned modem processor may not be integrated into processor 401.

[0189] The memory 402 can be used to store software programs and modules. The processor 401 executes various functional applications and data processing by running the software programs and modules stored in the memory 402. The memory 402 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, application programs required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 402 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory 402 may also include a memory controller to provide the processor 401 with access to the memory 402.

[0190] The computer device also includes a power supply 403 that supplies power to the various components. Preferably, the power supply 403 can be logically connected to the processor 401 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system. The power supply 403 may also include one or more DC or AC power supplies, recharging systems, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components.

[0191] The computer device may also include an input unit 404, which can be used to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function control.

[0192] Although not shown, the computer device may also include a display unit, etc., which will not be described in detail here. Specifically, in this embodiment, the processor 401 in the computer device loads the executable files corresponding to the processes of one or more applications into the memory 402 according to the following instructions, and the processor 401 runs the applications stored in the memory 402 to realize various functions, as follows:

[0193] Obtain multiple features of the account to be identified; obtain the weight coefficient and preset feature threshold of each feature; classify each feature according to the preset feature threshold to obtain the first classification result of each feature; perform weighted voting on the first classification result of each feature according to the weight coefficient to obtain the second identification result of the account to be identified.

[0194] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be performed by instructions, or by instructions controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor.

[0195] Therefore, embodiments of this application provide a computer-readable storage medium, which may include: read-only memory (ROM), random access memory (RAM), a disk, or an optical disk, etc. A computer program is stored thereon, and the computer program is loaded by a processor to execute the steps in any of the abnormal account identification methods provided in embodiments of this application. For example, the computer program loaded by the processor can execute the following steps:

[0196] Obtain multiple features of the account to be identified; obtain the weight coefficient and preset feature threshold of each feature; classify each feature according to the preset feature threshold to obtain the first classification result of each feature; perform weighted voting on the first classification result of each feature according to the weight coefficient to obtain the second identification result of the account to be identified.

[0197] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the detailed descriptions of other embodiments above, which will not be repeated here.

[0198] In practice, each of the above units or structures can be implemented as an independent entity or can be arbitrarily combined to be implemented as the same or several entities. For the specific implementation of each of the above units or structures, please refer to the previous method embodiments, which will not be repeated here.

[0199] For details on the implementation of each of the above operations, please refer to the previous examples, which will not be repeated here.

[0200] The above provides a detailed description of the method and apparatus for identifying abnormal accounts provided in the embodiments of this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for identifying abnormal accounts, characterized in that, include: Obtain multiple characteristics of the account to be identified; wherein, the account to be identified includes at least two sub-accounts, the at least two sub-accounts are divided into a shipment transfer-out sub-account and a shipment transfer-in sub-account, and the multiple characteristics of the account to be identified include at least one of the following: the shipment change value of the shipment transfer-out sub-account and the shipment change value of the shipment transfer-in sub-account, the consignment difference degree of the shipment transfer-out sub-account and the shipment transfer-in sub-account, and the sender difference degree of the shipment transfer-out sub-account and the shipment transfer-in sub-account; Obtain the weight coefficients and preset feature thresholds for each feature of the account to be identified; The features of each account to be identified are classified according to each preset feature threshold, and the first classification result of each account to be identified is obtained. The first classification results of each account feature to be identified are weighted and voted on based on each weight coefficient to obtain the second identification result of the account to be identified.

2. The method for identifying abnormal accounts according to claim 1, characterized in that, The process of obtaining the weight coefficients and preset feature thresholds for each feature of the account to be identified includes: Obtain a first sample training set, which includes multiple first training samples, each of which includes multiple first sample account features, and each of which is labeled with a sample tag. A preset decision tree model is trained based on the first sample training set to obtain the target decision tree model; Obtain the importance coefficients of each feature of the first sample account in the target decision tree model; The weight coefficients of each feature of the account to be identified are determined based on the importance coefficients of each feature of the first sample account.

3. The method for identifying abnormal accounts according to claim 2, characterized in that, The process of obtaining the weight coefficients and preset feature thresholds for each feature of the account to be identified includes: Based on the importance coefficients of each first sample account feature, the first sample account features are sorted from largest to smallest to obtain multiple sorted first sample account features. The first preset number of first sample account features that rank first among multiple sorted first sample account features are determined as multiple second sample account features. The preset feature threshold for each account feature to be identified is determined based on the first feature value of multiple second sample account features of each first training sample.

4. The method for identifying abnormal accounts according to claim 3, characterized in that, The process of determining the preset feature threshold for each account feature to be identified based on the first feature values ​​of multiple second sample account features from each first training sample includes: Each feature of the second sample account is determined as the feature of the target account; Obtain the second feature values ​​of the target account features for each of the first training samples; Each second feature value is determined as the target feature threshold, and each first training sample is classified to obtain the classification error rate corresponding to each second feature value. The second feature value corresponding to the minimum classification error rate among the classification error rates corresponding to each second feature value is determined as the preset feature threshold of the target account feature, thus obtaining the preset feature threshold of each second sample account feature; The preset feature thresholds for each account to be identified are determined based on the preset feature thresholds for each second sample account feature.

5. The method for identifying abnormal accounts according to claim 2, characterized in that, The process of obtaining the first sample training set includes: Obtain multiple second training samples and multiple third training samples, wherein the second training samples are labeled with sample tags, and the third training samples are not labeled with sample tags; Cluster the multiple second training samples and multiple third training samples to obtain multiple second sample training sets; Multiple second training samples from the second training set that meet the preset sample conditions are selected as the first training set.

6. The method for identifying abnormal accounts according to claim 1, characterized in that, The acquisition of multiple account features of the account to be identified includes: Obtain the two sub-accounts of the account to be identified; Based on preset division conditions, the two sub-accounts are divided into the sub-account for transferring out the quantity and the sub-account for transferring in the quantity; Multiple characteristics of the account to be identified are determined based on the mail receiving and sending information of the sub-accounts for transferring out and receiving mail.

7. A device for identifying abnormal accounts, characterized in that, The device for identifying abnormal accounts includes: The first acquisition unit is used to acquire multiple characteristics of the account to be identified; wherein, the account to be identified includes at least two sub-accounts, the at least two sub-accounts are divided into a shipment transfer-out sub-account and a shipment transfer-in sub-account, and the multiple characteristics of the account to be identified include at least one of the following: the difference in shipment change value between the shipment change value of the shipment transfer-out sub-account and the shipment change value of the shipment transfer-in sub-account, the difference in the consigned items between the shipment transfer-out sub-account and the shipment transfer-in sub-account, and the difference in the sender between the shipment transfer-out sub-account and the shipment transfer-in sub-account; The second acquisition unit is used to acquire the weight coefficients and preset feature thresholds of each feature of the account to be identified; The classification unit is used to classify the features of each account to be identified according to each preset feature threshold, and obtain the first classification result of each account feature to be identified; The weighted voting unit is used to perform weighted voting on the first classification results of each account feature to be identified based on each weight coefficient, so as to obtain the second identification result of the account to be identified.

8. A computer device, characterized in that, The computer device includes: One or more processors; Memory; and One or more applications, wherein the one or more applications are stored in the memory and configured to be executed by the processor to implement the method for identifying abnormal accounts as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, It stores a computer program, which is loaded by a processor to perform the steps in the method for identifying abnormal accounts as described in any one of claims 1 to 6.

Images