A method and apparatus for business risk control

Abstract

This specification discloses a business risk control method. After obtaining business requests from each user, the server clusters the users' business behaviors based on the business environment information on which each user executes the business requests, obtaining at least one user group to be detected. After obtaining the user groups to be detected, the server selects business features from candidate business features to identify abnormal user groups based on the business operation information of users within the at least one user group to be detected when executing business requests, using these features as target features. For each user group to be detected, the server determines whether the user group is an abnormal user group based on the obtained target features. If the user group is determined to be an abnormal user group, business risk control is applied to the users within that user group. The abnormal user group includes users who engage in malicious order-brushing behavior.

Description

Technical Field

[0001] This specification relates to the field of computer technology, and in particular to a method and apparatus for business risk control. Background Technology

[0002] With the development of e-commerce, platforms and merchants have launched various promotional activities to attract users, promote products, and stimulate consumption. For example, new users can receive benefits upon registration; or they can receive merchant benefits after watching advertisements.

[0003] This operating model has led to the emergence of many abnormal user groups. For example, some users maliciously place orders, immediately requesting refunds after purchase to boost the merchant's sales ranking on the platform. These behaviors severely impact the normal operation of both the platform and the merchants.

[0004] Currently, the main approach to dealing with such abnormal behavior is to predict and determine whether an abnormal behavior exists in a single order based on a pre-built supervised model. However, the accuracy of this method decreases when the way abnormal behavior is detected changes, and it requires detection for each order, consuming significant resources.

[0005] Therefore, how to achieve a high accuracy rate in detecting abnormal behavior when the manner of abnormal behavior changes, while simultaneously reducing resource consumption, is an urgent problem to be solved. Summary of the Invention

[0006] This specification provides a method and apparatus for business risk control, which partially solves the aforementioned problems existing in the prior art.

[0007] The following technical solution is adopted in this specification:

[0008] This manual provides a business risk control method, including:

[0009] Obtain the business requests from each user;

[0010] Based on the business environment information on which each user executes the business corresponding to the business request, the users are clustered in terms of business behavior to obtain at least one user group to be detected.

[0011] Based on the business operation information of users in the at least one user group to be detected when performing the business, business features for identifying abnormal user groups are selected from each candidate business feature and used as target features.

[0012] For each user group to be detected, determine whether the user group to be detected is an abnormal user group based on the target characteristics.

[0013] If the user group to be tested is determined to be an abnormal user group, business risk control will be carried out on the users included in the user group to be tested.

[0014] Optionally, the business environment information includes the spatiotemporal information on which the user performs the business;

[0015] Based on the business environment information on which each user executes the business corresponding to the business request, the users are clustered according to their business behavior to obtain at least one user group to be detected, specifically including:

[0016] Users whose spatiotemporal information matches are clustered to obtain at least one user group to be detected.

[0017] Optionally, users whose spatiotemporal information matches are clustered to obtain at least one user group to be detected, specifically including:

[0018] By treating each user as a vertex and constructing edges based on the matching degree between the spatiotemporal information of any two users, a user association graph is obtained.

[0019] With the constraint that the matching degree between the time information of any two users is not less than a first set matching degree, at least one maximum correlation graph is searched in the user association graph.

[0020] For each found correlated maxima, the user group to be detected is determined based on the user corresponding to each vertex in the correlated maxima.

[0021] Optionally, with the constraint that the matching degree between the time information of any two users is not less than a first preset matching degree, at least one maximum correlation graph is searched in the user association graph, specifically including:

[0022] For each vertex contained in the user association graph, a vertex with a set adjacency relationship with that vertex is determined in the user association graph and is regarded as the associated vertex corresponding to that vertex;

[0023] Determine the average matching degree of the vertex based on the associated vertices of the vertex.

[0024] Based on the average matching degree of each vertex contained in the user association graph, a seed vertex is determined in the user association graph;

[0025] Using the seed vertex as the base point and with the constraint that the matching degree between the time information of any two users is not less than a first set matching degree, at least one maximum correlation graph is searched in the user association graph.

[0026] Optionally, seed vertices are determined in the user association graph based on the average matching degree of each vertex contained therein, specifically including:

[0027] Sort each vertex according to its average matching degree from largest to smallest, and obtain the sorting result;

[0028] Vertices that are located before the set rank in the sorting results and whose corresponding number of associated vertices is not less than the set number are designated as seed vertices.

[0029] Optionally, based on the business operation information of users included in the at least one user group to be detected when performing the business, business features for identifying abnormal user groups are selected from each candidate business feature as target features, specifically including:

[0030] For each candidate business feature, determine the average business operation information of all user groups to be detected under that candidate business feature;

[0031] For each user group to be detected, the deviation between the business operation information of the user group to be detected under the candidate business feature and the average business operation information is determined, and is used as the deviation of the user group to be detected for the candidate business feature.

[0032] The discriminant value of a candidate business feature is determined based on the deviation of each user group to be detected for that candidate business feature.

[0033] Candidate business features with a discrimination score not lower than the set discrimination score are used as target features.

[0034] Optionally, for each user group to be detected, based on the target characteristics, it is determined whether the user group to be detected is an abnormal user group, specifically including:

[0035] Determine the anomaly detection conditions corresponding to the target features;

[0036] For each user group to be detected, determine whether the user group to be detected is an abnormal user group based on the anomaly detection conditions corresponding to the target features.

[0037] This specification provides a business risk control device, including:

[0038] The request retrieval module is used to retrieve business requests from each user;

[0039] The clustering module is used to cluster the users based on the business environment information on which each user executes the business corresponding to the business request, and obtain at least one user group to be detected.

[0040] The feature selection module is used to select business features for identifying abnormal user groups from each candidate business feature based on the business operation information of users included in the at least one user group to be detected when performing the business, and to use these as target features.

[0041] The judgment module is used to determine whether each user group to be detected is an abnormal user group based on the target characteristics.

[0042] The risk control module is used to perform business risk control on the users included in the user group to be detected if it is determined that the user group to be detected is an abnormal user group.

[0043] This specification provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned business risk control method.

[0044] This specification provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the aforementioned business risk control method.

[0045] The above-mentioned technical solutions adopted in this specification can achieve the following beneficial effects:

[0046] The business risk control method provided in this specification involves the server, after obtaining business requests from each user, clustering each user's business behavior based on the business environment information on which each user executes the business corresponding to the business request, thus obtaining at least one user group to be detected. After obtaining the user groups to be detected, the server, based on the business operation information of the users included in the at least one user group to be detected during business execution, filters out business features used to identify abnormal user groups from each candidate business feature, as target features. For each user group to be detected, the server determines whether the user group to be detected is an abnormal user group based on the obtained target features. If the user group to be detected is determined to be an abnormal user group, business risk control is performed on the users included in the user group to be detected.

[0047] As can be seen from the above method, the server clusters users into multiple user groups to be detected based on the correlation between the information generated when each user executes a business request. Then, it filters out target features that can identify these user groups. Based on these target features, it identifies abnormal user groups from the user groups to be detected and performs business risk control on the users within these abnormal user groups. This changes the target object of abnormal behavior detection from each individual to each group, saving resource consumption. Furthermore, the target features used to identify abnormal user groups can change according to the method of implementing the abnormal behavior, thus ensuring the accuracy of abnormal behavior identification even when the method of implementing the abnormal behavior changes. Attached Figure Description

[0048] The accompanying drawings, which are included to provide a further understanding of this specification and form part of this specification, illustrate exemplary embodiments and are used to explain this specification, but do not constitute an undue limitation thereof. In the drawings:

[0049] Figure 1 This is a flowchart illustrating one of the business risk control methods provided in this specification;

[0050] Figure 2 This document provides an implementation flowchart for a business risk control method.

[0051] Figure 3 This is a schematic diagram of a business risk control device provided in this specification;

[0052] Figure 4 This specification provides a corresponding Figure 1 A schematic diagram of an electronic device. Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of this specification clearer, the technical solutions of this specification will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of them. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this specification.

[0054] The technical solutions provided in the various embodiments of this specification are described in detail below with reference to the accompanying drawings.

[0055] Figure 1 This is a flowchart illustrating a business risk control method provided in this specification, including the following steps:

[0056] S101: Obtain the business requests of each user.

[0057] In this manual, the subject implementing the business risk control method can be a server, desktop computer, laptop computer, or other device set up on the business platform. For ease of description, the following explanation will only use a server as an example to illustrate the business risk control method provided in this manual.

[0058] Currently, the main method for detecting abnormal user behavior involves inputting various user data into a pre-trained model and then detecting abnormal behavior based on the model's output indicating whether the user is an abnormal user. This method requires inputting all user data into the model, which is a significant workload. Furthermore, the accuracy of the pre-trained model in detecting abnormal behavior decreases when the abnormal behavior changes.

[0059] To address this, this specification provides a business risk control method that clusters individual users into a group of users to be monitored, transforming abnormal behavior targeting each individual user into abnormal behavior targeting each group, significantly reducing the workload required for abnormal behavior detection. Furthermore, as abnormal behavior changes, the target characteristics for identifying abnormal user groups also change, ensuring the accuracy of abnormal behavior identification remains high even when abnormal behavior changes.

[0060] Abnormal user behavior can refer to actions that pose risks to business operations, such as malicious order placement, boosting merchant rankings, taking out malicious loans, or committing insurance fraud.

[0061] Before clustering individual users into a group of users to be tested, it is necessary to obtain various types of user information.

[0062] After receiving a business request from a user to the platform, the server collects business environment information and user behavior information at the time the user sent the business request. The business environment information may include: the user's geographical location when the business request was sent, the time information when the business request was sent, and the business type corresponding to the business request.

[0063] User behavior information can include: the time a user spends on a page while performing a service, and the sequence of actions a user takes while performing a service. The sequence of actions a user takes while performing a service can be the order in which the user performs various operations. For example, when a user purchases goods on the platform, after entering the platform page, they select a product category. After selecting a category, they click on a product link on the page displaying products within that category to select the desired item. Then, after claiming the merchant's discounts, they pay the required amount for the selected item, thus completing the purchase. This series of actions is considered the user's sequence of actions when performing a purchase.

[0064] S102: Based on the business environment information on which each user is based when executing the business corresponding to the business request, cluster the users in terms of business behavior to obtain at least one user group to be detected.

[0065] After obtaining the business environment information when a user sends a business request, the server can cluster users whose spatiotemporal information matches the information in the business environment information. The spatiotemporal information refers to the geographical location and time information of the user when sending the business request, as mentioned above.

[0066] Specifically, the methods for clustering users into the user group to be detected can be as follows:

[0067] The server can use each user as a vertex and construct edges based on the matching degree between any two users' spatiotemporal information to obtain a user association graph. The matching degree can be calculated based on the spatiotemporal information between users.

[0068] With the constraint that the matching degree between the time information of any two users is not less than a first set matching degree, at least one maximal relational graph is searched in the user association graph. Then, for each found maximal relational graph, the server can determine the user group to be detected corresponding to the maximal relational graph based on the users corresponding to each vertex contained in the maximal relational graph.

[0069] The matching degree between users can be calculated based on the spatiotemporal information between users and the number of times users perform the same business. The more times users perform the same business, the shorter the time interval between performing the same business, and the closer the geographical locations when performing the business, the higher the matching degree between users.

[0070] Please refer to the following formula for details:

[0071]

[0072] In the above formula, sim represents the matching degree between users, p represents users, where pi and pj represent any two users, b represents the same business performed by users, t represents the time information when users perform the same business, s represents the geographical location of users when performing the same business, and c represents the total number of businesses performed by users within the specified time.

[0073] In this specification, the server can treat each user as a vertex, obtaining a fully connected graph that connects all user vertices to each other. After calculating the matching degree between users according to the above formula, the server can delete edges in the fully connected graph where the matching degree between users is lower than a first set matching degree, thus obtaining the user association graph. This process can be understood as the fully connected graph actually connecting any two users, while the user association graph actually only connecting users with high correlation to each other. The server can find at least one maximal association graph within the user association graph it obtains. A maximal association graph is a graph where every two vertices are connected by an edge, and it cannot be expanded by adding a vertex.

[0074] For each obtained correlated maxima graph, the server can treat all users corresponding to the vertices contained in that correlated maxima graph as a group of users to be detected.

[0075] In determining the aforementioned maximal associative graph, the server can identify, for each vertex in the user associative graph, the vertices in the user associative vertices that have a defined adjacency relationship with that vertex. The defined adjacency relationship can be set according to actual needs, such as a first-order adjacency relationship.

[0076] The server can calculate the average matching degree of a vertex based on its associated vertices. The average matching degree can be obtained using the following formula:

[0077]

[0078] in, sim represents the average matching degree, where n represents all associated vertices corresponding to that vertex. i This represents the matching degree between the i-th associated vertex and this vertex. Taking a first-order adjacency relationship as an example, assuming there are three associated vertices with a first-order adjacency relationship to this vertex, the matching degrees between this vertex and these three associated vertices are summed and averaged, and the resulting value is used as the average matching degree of this vertex. The average matching degree of this vertex actually reflects the comprehensive similarity in business behavior between the user corresponding to this vertex and the users corresponding to these associated vertices.

[0079] After calculating the average matching degree of the vertices using the above formula, the vertices are sorted from largest to smallest according to their average matching degree, and the vertices ranked higher than the pre-set rank are designated as seed vertices. The number of associated vertices corresponding to each seed vertex is no less than the pre-set number.

[0080] After obtaining the seed vertex, using the seed vertex as the base point, find all associated vertices corresponding to the seed vertex. From the association graph formed by these seed vertices and all associated vertices corresponding to the seed vertex, find at least one association maxima graph.

[0081] For each obtained correlated maxima, the users corresponding to all vertices contained in the correlated maxima are considered as a group of users to be detected.

[0082] Of course, there are other ways to cluster users into groups of users to be detected than those mentioned above, and we will not go into detail about them here.

[0083] S103: Based on the business operation information of users in the at least one user group to be detected when performing the business, select the business features used to identify the abnormal user group from each candidate business feature and use them as target features.

[0084] After obtaining at least one user group to be detected, the server selects candidate business features that can identify abnormal user groups from multiple candidate business features of the user groups to be detected, according to a preset business feature filtering method, and uses these as target features.

[0085] In this specification, the target feature can be selected using the following methods:

[0086] After obtaining at least one group of users to be detected, the server acquires the business operation information of these users for each candidate business feature. For example, if a candidate business feature is the time a user spends on a page, the server needs to obtain the specific duration of each user's stay on the page in the user group to be detected. This specific duration is the business operation information under that candidate business feature.

[0087] After obtaining the business operation information of each user in the user group to be tested for each candidate business feature, the business operation information of each user group to be tested for each candidate business feature is calculated separately.

[0088] Continuing with the previous example, if the candidate business feature is the time a user spends on a page, for each user group to be tested, after obtaining the specific duration of each user's stay on the page, these specific durations can be summed and divided by the number of users in the user group to be tested to obtain the average time a user spends on a page for that user group (i.e., the business operation information of the user group to be tested under the candidate business feature, which can be understood as the average business operation information within the user group to be tested under the candidate business feature).

[0089] While obtaining the average business operation information for each user group to be tested regarding the same candidate business feature, the average business operation information for multiple user groups to be tested regarding the same candidate business feature will also be calculated. For example, the candidate business feature could be the time a user spends on a webpage.

[0090] After obtaining the business operation information of each user group to be tested for the candidate business feature and the above-mentioned average business operation information, the deviation between the business operation information of each user group to be tested for the candidate business feature and the average business operation information can be determined as the deviation of the user group to be tested for the candidate business feature.

[0091] The specific method for determining the deviation of the user group to be detected for the candidate business feature can be referred to the following formula:

[0092]

[0093] Among them, s j f represents the discriminative power for candidate business feature j, n represents the number of users to be detected, and f is the number of users to be detected. i,j This represents the business operation information of user group i to be detected for candidate business feature j, μ(f i ) represents the average business operation information of all user groups to be detected for candidate business feature j.

[0094] After obtaining the deviation of the user group to be detected from the candidate service feature, the discrimination of the candidate service feature can be further determined. The greater the deviation of the user group to be detected from the candidate service feature, the greater the discrimination of the candidate service.

[0095] Finally, candidate business features with a discrimination score no lower than the set discrimination score are selected as target features.

[0096] For ease of understanding, the above explanation only illustrates the candidate business feature as the user's page dwell time. In actual applications, there are many types of candidate business features, which will not be listed here.

[0097] Of course, there are other ways to filter target features than those mentioned above, which will not be listed here.

[0098] S104: For each user group to be detected, determine whether the user group to be detected is an abnormal user group based on the target characteristics.

[0099] After obtaining the target features, the server can determine whether each user group to be detected is an abnormal user group based on the obtained target features and the corresponding anomaly detection conditions.

[0100] In this specification, different anomaly detection conditions are applied to different target features. For example, if the target feature is the specific duration a user spends on a page, then users whose specific duration of page visit is less than a set threshold are considered anomaly users. As another example, if the target feature is a user behavior sequence, then users whose behavior sequence differs from that of the majority of users are considered anomaly users.

[0101] The server performs detection on all user groups to be detected based on the obtained target features and the corresponding anomaly detection conditions, and identifies the abnormal user groups within the user groups to be detected.

[0102] S105: If the user group to be detected is determined to be an abnormal user group, business risk control shall be carried out on the users included in the user group to be detected.

[0103] After obtaining information about an abnormal user group, the server performs business risk control on the users included in the abnormal user group. The risk control methods may include: interrupting the continued execution of business by the users included in the abnormal user group, or verifying the identity of the abnormal user group.

[0104] To further describe the business risk control methods described in this manual, a specific example will be used below to illustrate the processes involved in this manual, such as... Figure 2 As shown.

[0105] Figure 2 This document provides a flowchart for the implementation of a business risk control method.

[0106] After receiving each user's loan request, the server can obtain information about when the user sent the loan request, including the user's geographical location and the time when the loan request was sent.

[0107] For each loan user, the server can obtain information about users who were also sending loan requests at the same time as that user, based on the information obtained when the user sent the loan request. Then, based on the time information when these users sent their loan requests, the server can obtain the time interval between these users' loan requests and identify users whose time interval is less than a threshold as the user's associated users.

[0108] The server can treat each user as a vertex to obtain a fully connected graph that connects all the vertices corresponding to all users. After calculating the matching degree between users, the server can delete the edges in the fully connected graph where the matching degree between users is lower than a first set matching degree to obtain the user association graph.

[0109] For each vertex in the user association graph, the server can identify vertices with first-order adjacency to that vertex, designating them as associated vertices. Then, the server calculates the average matching degree of each vertex based on its associated vertices. After obtaining the average matching degree, the servers sort the vertices by their average matching degree from highest to lowest, selecting the top 30% as seed vertices. Each seed vertex has at least three associated vertices.

[0110] After obtaining the seed vertex, using the seed vertex as the base point, find all associated vertices corresponding to the seed vertex. From the association graph formed by these seed vertices and all associated vertices corresponding to the seed vertex, find at least one associated maximal graph. Then, for each obtained associated maximal graph, the users corresponding to all vertices contained in the associated maximal graph are taken as a user group to be detected.

[0111] After obtaining at least one user group to be detected, the server can determine the target feature for distinguishing the user groups from the candidate business features using the method described above. Assuming the target feature is the time users spend on the loan interface, user groups whose average dwell time is less than the average dwell time of all users can be identified as abnormal user groups, while user groups whose average dwell time is not less than the average dwell time of all users can be identified as normal user groups. This is because normal users are likely to carefully review the various terms and details of the loan application process, while users engaging in abnormal loan activities do not read these details themselves. Therefore, the time spent by users engaging in abnormal loan activities on the loan page will be less (or significantly less) than that of normal users.

[0112] Once an abnormal user group is identified, users within that group will be prohibited from engaging in loan transactions. This could involve refusing to issue loans to users in the abnormal user group or initiating more detailed identity verification procedures for those users. Alternatively, after identifying an abnormal user group, the information of the users within that group can be sent to security personnel for further security checks.

[0113] As can be seen from the methods mentioned above, the server clusters multiple individual users into a group of users to be detected based on preset conditions, transforming anomaly detection behavior from individual-based to group-based, thus reducing the resources required by the server when performing anomaly detection. Furthermore, appropriate target features can be selected to identify anomalous groups for different anomaly behaviors, ensuring the accuracy of anomaly detection even when the method of implementing anomaly changes.

[0114] It should be noted that all actions involving the acquisition of signals, information, or data in this application are carried out in compliance with the relevant data protection laws and policies of the country where the application is located, and with the authorization granted by the owner of the relevant device.

[0115] The above describes one or more embodiments of the business risk control method provided in this specification. Based on the same idea, this specification also provides a corresponding business risk control planning device, such as... Figure 3 As shown.

[0116] Figure 3 A schematic diagram of a business risk control device provided in this specification includes:

[0117] The request acquisition module 301 is used to acquire the business requests of each user.

[0118] Clustering module 302 is used to cluster the users based on the business environment information on which each user executes the business corresponding to the business request, and obtain at least one group of users to be detected.

[0119] The feature selection module 303 is used to select business features for identifying abnormal user groups from each candidate business feature based on the business operation information of users included in the at least one user group to be detected when performing the business, and use them as target features.

[0120] The judgment module 304 is used to determine whether each user group to be detected is an abnormal user group based on the target characteristics.

[0121] The risk control module 305 is used to perform business risk control on the users included in the user group to be detected if it is determined that the user group to be detected is an abnormal user group.

[0122] Optionally, the business environment information includes the spatiotemporal information on which the user performs the business;

[0123] The clustering module 302 is specifically used to cluster users whose spatiotemporal information matches to obtain at least one user group to be detected.

[0124] Optionally, the clustering module 302 is specifically used to: take each user as a vertex and construct edges based on the matching degree between the spatiotemporal information of any two users to obtain a user association graph; with the matching degree between the temporal information of any two users not being less than a first set matching degree as a constraint, search for at least one association maxima in the user association graph; for each searched association maxima, determine the user group to be detected corresponding to the association maxima based on the users corresponding to each vertex contained in the association maxima.

[0125] Optionally, the clustering module 302 is specifically configured to: for each vertex contained in the user association graph, determine vertices in the user association graph that have a set adjacency relationship with that vertex as associated vertices corresponding to that vertex; determine the average matching degree of that vertex based on the associated vertices corresponding to that vertex; determine seed vertices in the user association graph based on the average matching degree of each vertex contained in the user association graph; and, using the seed vertices as base points and with the constraint that the matching degree between the time information of any two users is not less than a first set matching degree, search for at least one association maxima in the user association graph.

[0126] Optionally, the clustering module 302 is specifically used to sort each vertex in descending order of average matching degree to obtain a sorting result; and to select vertices that are located before a set rank in the sorting result and whose number of corresponding associated vertices is not less than a set number as seed vertices.

[0127] Optionally, the feature selection module 303 is specifically configured to: for each candidate service feature, determine the average service operation information of all user groups to be detected under the candidate service feature; for each user group to be detected, determine the deviation between the service operation information of the user group to be detected under the candidate service feature and the average service operation information, as the deviation of the user group to be detected for the candidate service feature; determine the discrimination degree corresponding to the candidate service feature based on the deviation of each user group to be detected for the candidate service feature; and select candidate service features with a discrimination degree not lower than a set discrimination degree as target features.

[0128] Optionally, the judgment module 304 is specifically used to determine the anomaly detection conditions corresponding to the target feature; and for each user group to be detected, to determine whether the user group to be detected is an abnormal user group based on the anomaly detection conditions corresponding to the target feature.

[0129] This specification also provides a computer-readable storage medium storing a computer program that can be used to execute the above-described... Figure 1 This provides a method for business risk control.

[0130] This instruction manual also provides Figure 4 One of the corresponding Figure 1 A schematic diagram of the structure of an electronic device. (e.g.) Figure 4 At the hardware level, the electronic device includes a processor, an internal bus, a network interface, memory, and non-volatile storage, and may also include other hardware required for the business operations. The processor reads the corresponding computer program from the non-volatile storage into memory and then runs it to achieve the above-mentioned functions. Figure 1The business risk control method described herein. Of course, in addition to software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. In other words, the execution subject of the following processing flow is not limited to individual logic units, but can also be hardware or logic devices.

[0131] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0132] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0133] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0134] For ease of description, the above devices are described in terms of function, divided into various units. Of course, in implementing this specification, the functions of each unit can be implemented in one or more software and / or hardware.

[0135] Those skilled in the art will understand that embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0136] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0137] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0138] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0139] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0140] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0141] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0142] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0143] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0144] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0145] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0146] The above description is merely an embodiment of this specification and is not intended to limit this specification. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. A method for business risk control, characterized in that, include: Obtain the business requests from each user; Based on the business environment information on which each user executes the business corresponding to the business request, the users are clustered in terms of business behavior to obtain at least one user group to be detected. Based on the business operation information of users in the at least one user group to be detected when performing the business, business features for identifying abnormal user groups are selected from each candidate business feature and used as target features. For each user group to be detected, determine whether the user group to be detected is an abnormal user group based on the target characteristics. If the user group to be tested is determined to be an abnormal user group, business risk control will be carried out on the users included in the user group to be tested; The business environment information includes the spatiotemporal information on which the user executes the business, namely the geographical location and time information when the user sends the business request. Based on the business environment information on which each user executes the business corresponding to the business request, the users are clustered according to their business behavior to obtain at least one user group to be detected. This includes clustering users whose spatiotemporal information matches to obtain the at least one user group to be detected, specifically including: By treating each user as a vertex and constructing edges based on the matching degree between the spatiotemporal information of any two users, a user association graph is obtained. With the constraint that the matching degree between the time information of any two users is not less than a first set matching degree, at least one maximum correlation graph is searched in the user association graph. For each found correlated maxima, the user group to be detected is determined based on the user corresponding to each vertex in the correlated maxima. Based on the business operation information of users in the at least one user group to be detected during the execution of the business, business features for identifying abnormal user groups are selected from each candidate business feature as target features, specifically including: For each candidate business feature, determine the average business operation information of all user groups to be detected under that candidate business feature; For each user group to be detected, the deviation between the business operation information of the user group to be detected under the candidate business feature and the average business operation information is determined, and is used as the deviation of the user group to be detected for the candidate business feature. The discriminant value of a candidate business feature is determined based on the deviation of each user group to be detected for that candidate business feature. Candidate business features with a discrimination score no lower than the set discrimination score are used as target features.

2. The method as described in claim 1, characterized in that, Using the constraint that the matching degree between the time information of any two users is not less than a first preset matching degree, at least one maximum correlation graph is searched in the user association graph, specifically including: For each vertex contained in the user association graph, a vertex with a set adjacency relationship with that vertex is determined in the user association graph and is regarded as the associated vertex corresponding to that vertex; Determine the average matching degree of the vertex based on the associated vertices of the vertex. Based on the average matching degree of each vertex contained in the user association graph, a seed vertex is determined in the user association graph; Using the seed vertex as the base point and with the constraint that the matching degree between the time information of any two users is not less than a first set matching degree, at least one maximum correlation graph is searched in the user association graph.

3. The method as described in claim 2, characterized in that, Based on the average matching degree of each vertex in the user association graph, seed vertices are determined in the user association graph, specifically including: Sort each vertex according to its average matching degree from largest to smallest, and obtain the sorting result; Vertices that are located before the set rank in the sorting results and whose corresponding number of associated vertices is not less than the set number are designated as seed vertices.

4. The method as described in claim 1, characterized in that, For each user group to be detected, based on the target characteristics, it is determined whether the user group to be detected is an abnormal user group, specifically including: Determine the anomaly detection conditions corresponding to the target features; For each user group to be detected, determine whether the user group to be detected is an abnormal user group based on the anomaly detection conditions corresponding to the target features.

5. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the method described in any one of claims 1 to 4.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method described in any one of claims 1 to 4.

Images