Abnormal resource transfer behavior identification method and device and computer device

Abstract

The application relates to an abnormal resource transfer behavior identification method, an abnormal resource transfer behavior identification model training method and device, computer equipment, a storage medium and a computer program product, and relates to the technical field of computers and can be used in the field of financial technology and other related fields. The abnormal resource transfer behavior identification method comprises the following steps: determining a first type feature of a to-be-identified transfer behavior based on a first behavior feature of the to-be-identified transfer behavior and a second behavior feature of an abnormal transfer behavior sample; determining a second type feature and a third type feature of the to-be-identified transfer behavior based on the first behavior feature and a third behavior feature of a historical transfer behavior sample received by a historical receiving object of a resource receiving object of the to-be-identified transfer behavior; and determining an identification result of the to-be-identified transfer behavior based on the first type feature, the second type feature, the third type feature and a pre-trained abnormal resource transfer behavior identification model. By using the method, the identification accuracy of abnormal resource transfer behavior can be improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a method for identifying abnormal resource transfer behavior, a method for training an abnormal resource transfer behavior identification model, an apparatus, a computer device, a storage medium, and a computer program product. Background Technology

[0002] Abnormal resource transfer behavior refers to the act of holders of prepaid resources realizing the monetization of these resources through resource transfers with merchants; for example, a credit card holder makes a payment to a merchant using their credit card, and then the merchant transfers the corresponding amount of money back to the credit card holder, thereby realizing the monetization of the credit card limit. Therefore, it is necessary to identify abnormal resource transfers to prevent their proliferation.

[0003] In related technologies, the determination of whether a resource transfer behavior is abnormal is generally based on the feature information of a single resource transfer behavior. However, resource transfer behaviors are often correlated, and abnormal resource transfer methods based on related technologies tend to ignore this correlation, resulting in a low accuracy rate in identifying abnormal resource transfer behaviors. Summary of the Invention

[0004] Based on this, it is necessary to provide an abnormal resource transfer behavior identification method, abnormal resource transfer behavior identification model training method, device, computer equipment, computer-readable storage medium, and computer program product that can improve the identification accuracy of abnormal resource transfer behavior in response to the above-mentioned technical problems.

[0005] Firstly, this application provides a method for identifying abnormal resource transfer behavior. The method includes:

[0006] The process involves acquiring the first behavioral feature of the transfer behavior to be identified, the second behavioral feature of the abnormal transfer behavior sample, and the third behavioral feature of the historical transfer behavior sample received by the resource receiving object of the transfer behavior to be identified; the transfer behavior to be identified is a transfer behavior of pre-funded resources.

[0007] Based on the first behavioral feature and the second behavioral feature, a first type of feature is determined for the transfer behavior to be identified; the first type of feature characterizes the degree of similarity between the transfer behavior to be identified and the abnormal transfer behavior sample.

[0008] Based on the first behavioral feature and the third behavioral feature, a second type of feature and a third type of feature of the transfer behavior to be identified are determined; the second type of feature characterizes the degree of abnormality of the transfer behavior to be identified in the feature dimension, and the third type of feature characterizes the degree of abnormality of the transfer behavior to be identified in the time dimension;

[0009] Based on the first type of features, the second type of features, the third type of features, and the pre-trained abnormal resource transfer behavior recognition model, the recognition result for the transfer behavior to be identified is determined.

[0010] In one embodiment, determining the first type of feature of the transfer behavior to be identified based on the first behavioral feature and the second behavioral feature includes:

[0011] Based on the first behavioral feature and the second behavioral feature, a knowledge graph of transfer behavior is constructed;

[0012] Based on the knowledge graph of the transfer behavior, the distance between the transfer to be identified and the abnormal transfer behavior sample is obtained, as well as the number of neighbor nodes between the transfer to be identified and the abnormal transfer behavior sample.

[0013] From the distances mentioned, a target distance that meets the preset conditions is determined;

[0014] The target distance and the number of neighboring nodes are determined as the first type of features of the transfer behavior to be identified.

[0015] In one embodiment, obtaining the distance between the transfer to be identified and the abnormal transfer behavior sample based on the transfer behavior knowledge graph includes:

[0016] In the knowledge graph of transfer behavior, the path between the transfer behavior to be identified and the abnormal transfer behavior sample is determined;

[0017] The distance between the transfer behavior to be identified and the abnormal transfer behavior sample is obtained by calculating the weights along the path.

[0018] Determining the target distance that meets the preset conditions from the distances includes:

[0019] From the distances, the distances whose corresponding values ​​are less than the values ​​of the other distances are identified as the target distances that meet the preset conditions.

[0020] In one embodiment, determining the second type of feature of the transfer behavior to be identified based on the first behavioral feature and the third behavioral feature includes:

[0021] Based on the first behavioral feature and the third behavioral feature of the historical transfer behavior sample, the first sub-feature of the transfer behavior to be identified under the first type of feature is determined;

[0022] From the historical transfer behavior samples, normal transfer behavior samples are identified. Based on the first behavior feature and the third behavior feature of the normal transfer behavior samples, the second sub-feature of the transfer behavior to be identified under the first type of feature is determined.

[0023] The first sub-feature and the second sub-feature are determined as the second type of features of the transfer behavior to be identified.

[0024] In one embodiment, determining the first sub-feature of the transfer behavior to be identified under the first type of feature based on the first behavioral feature and the third behavioral feature of the historical transfer behavior sample includes:

[0025] Based on the third behavioral feature of the historical transfer behavior samples, an isolated forest corresponding to the resource receiving object is constructed; the isolated forest includes multiple trees, each tree is obtained based on a historical transfer behavior sample received by the resource receiving object in the past, and the historical transfer behavior sample includes normal transfer behavior samples and abnormal transfer behavior samples;

[0026] Based on the first behavioral feature, the transfer behavior to be identified is descended along the path of each tree in the isolated forest to obtain the path length that the transfer behavior to be identified can match on each tree;

[0027] The average value of each path length is obtained, and based on the average value, the first sub-feature of the transfer behavior to be identified under the first type of feature is obtained.

[0028] In one embodiment, determining the second sub-feature of the transfer behavior to be identified under the first type of feature based on the first behavioral feature and the third behavioral feature of the normal transfer behavior sample includes:

[0029] An autoencoder is trained based on the third behavioral features of the normal transfer behavior samples.

[0030] The autoencoder is used to reconstruct the transfer behavior to be identified, thereby obtaining the reconstructed behavior of the transfer behavior to be identified.

[0031] Based on the error between the reconstruction behavior and the transfer behavior to be identified, a second sub-feature of the transfer behavior to be identified under the first type of feature is obtained.

[0032] In one embodiment, the third type of feature is obtained in the following manner:

[0033] Based on the third behavioral feature of the historical transfer behavior sample, the resource quantity time series and behavior quantity time series of the transfer behavior sample are obtained; the resource quantity time series is composed of the resource transfer quantity of the transfer behavior sample in multiple preset time intervals, and the behavior quantity time series is composed of the behavior quantity of the transfer behavior sample in multiple preset time intervals.

[0034] Determine the target time interval corresponding to the transfer behavior to be identified under the resource quantity time series or the behavior quantity time series;

[0035] Based on the resource quantity time series within the target time interval, the resource quantity time series feature of the transfer behavior to be identified is obtained, and based on the behavior quantity time series within the target interval, the behavior quantity time series feature of the transfer behavior to be identified is obtained.

[0036] The time-series characteristics of the resource quantity and the time-series characteristics of the behavior quantity are determined as the third type of characteristics of the transfer behavior to be identified.

[0037] In one embodiment, obtaining the resource quantity time-series features of the transfer behavior to be identified based on the resource quantity time series within the target time interval includes:

[0038] Based on the resource quantity time series within the target time interval, the predicted value of resource transfer quantity, the upper limit threshold of resource transfer quantity, and the lower limit threshold of resource transfer quantity corresponding to the target time interval are obtained.

[0039] Based on the resource transfer quantity of the transfer behavior to be identified, the predicted value of the resource transfer quantity, the upper limit threshold of the resource transfer quantity, and the lower limit threshold of the resource transfer quantity, the time-series characteristics of the resource quantity of the transfer behavior to be identified are obtained.

[0040] In one embodiment, obtaining the temporal feature of the behavior quantity of the transfer behavior to be identified based on the behavior quantity time series within the target interval includes:

[0041] Based on the number of behaviors in the target time interval according to the behavior quantity time series, the predicted value of the behavior quantity, the upper limit threshold of the behavior quantity, and the lower limit threshold of the behavior quantity corresponding to the target time interval are obtained.

[0042] Based on the total number of transfer behaviors within the time interval in which the transfer behavior to be identified occurs, the predicted value of the number of behaviors, the upper limit threshold of the number of behaviors, and the lower limit threshold of the number of behaviors, the temporal characteristics of the number of transfer behaviors to be identified are obtained.

[0043] Secondly, this application also provides a method for training an abnormal resource transfer behavior recognition model. The method includes:

[0044] The first type of sample features, the second type of sample features, and the third type of sample features of the transfer behavior sample are obtained. The first type of sample features characterize the similarity between the transfer behavior sample and the abnormal transfer behavior sample in the transfer behavior sample. The second type of sample features characterize the abnormality of the transfer behavior sample in the feature dimension. The third type of sample features characterize the abnormality of the transfer behavior sample in the time dimension.

[0045] Based on the first type of sample features, the second type of sample features, and the third type of sample features, the abnormal resource transfer behavior recognition model to be trained is trained to obtain the trained abnormal resource transfer behavior recognition model; the trained abnormal resource transfer behavior recognition model is the pre-trained abnormal resource transfer behavior recognition model in the abnormal resource transfer behavior recognition method.

[0046] In one embodiment, before training the abnormal resource transfer behavior recognition model based on the first type of sample features, the second type of sample features, and the third type of sample features, the method further includes:

[0047] Oversampling is performed on the abnormal transfer behavior samples in the transfer behavior samples to obtain new abnormal transfer behavior samples;

[0048] The new abnormal transfer behavior sample and the normal transfer behavior sample in the transfer behavior sample are combined to form the transfer behavior sample.

[0049] Thirdly, this application also provides an anomalous resource transfer behavior identification device. The device includes:

[0050] The behavior feature acquisition module is used to acquire the first behavior feature of the transfer behavior to be identified, the second behavior feature of the abnormal transfer behavior sample, and the third behavior feature of the historical transfer behavior sample received by the resource receiving object of the transfer behavior to be identified; the transfer behavior to be identified is the transfer behavior of pre-funded resources.

[0051] A similarity feature determination module is used to determine a first type of feature of the transfer behavior to be identified based on the first behavioral feature and the second behavioral feature; the first type of feature characterizes the degree of similarity between the transfer behavior to be identified and the abnormal transfer behavior sample;

[0052] An abnormal feature determination module is used to determine a second type of feature and a third type of feature of the transfer behavior to be identified based on the first behavioral feature and the third behavioral feature; the second type of feature characterizes the degree of abnormality of the transfer behavior to be identified in the feature dimension, and the third type of feature characterizes the degree of abnormality of the transfer behavior to be identified in the time dimension;

[0053] The identification result determination module is used to determine the identification result for the transfer behavior to be identified based on the first type of features, the second type of features, the third type of features, and the pre-trained abnormal resource transfer behavior identification model.

[0054] Fourthly, this application also provides a training device for an abnormal resource transfer behavior recognition model. The device includes:

[0055] The sample feature acquisition module is used to acquire a first type of sample feature, a second type of sample feature, and a third type of sample feature of the transfer behavior sample; the first type of sample feature represents the similarity between the transfer behavior sample and the abnormal transfer behavior sample in the transfer behavior sample, the second type of sample feature represents the abnormality of the transfer behavior sample in the feature dimension, and the third type of sample feature represents the abnormality of the transfer behavior sample in the time dimension.

[0056] The identification model training module is used to train the abnormal resource transfer behavior identification model to be trained based on the first type of sample features, the second type of sample features, and the third type of sample features, to obtain the trained abnormal resource transfer behavior identification model; the trained abnormal resource transfer behavior identification model is the pre-trained abnormal resource transfer behavior identification model in the abnormal resource transfer behavior identification method.

[0057] Fifthly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0058] The process involves acquiring the first behavioral feature of the transfer behavior to be identified, the second behavioral feature of the abnormal transfer behavior sample, and the third behavioral feature of the historical transfer behavior sample received by the resource receiving object of the transfer behavior to be identified; the transfer behavior to be identified is a transfer behavior of pre-funded resources.

[0059] Based on the first behavioral feature and the second behavioral feature, a first type of feature is determined for the transfer behavior to be identified; the first type of feature characterizes the degree of similarity between the transfer behavior to be identified and the abnormal transfer behavior sample.

[0060] Based on the first behavioral feature and the third behavioral feature, a second type of feature and a third type of feature of the transfer behavior to be identified are determined; the second type of feature characterizes the degree of abnormality of the transfer behavior to be identified in the feature dimension, and the third type of feature characterizes the degree of abnormality of the transfer behavior to be identified in the time dimension;

[0061] Based on the first type of features, the second type of features, the third type of features, and the pre-trained abnormal resource transfer behavior recognition model, the recognition result for the transfer behavior to be identified is determined.

[0062] Sixthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0063] The process involves acquiring the first behavioral feature of the transfer behavior to be identified, the second behavioral feature of the abnormal transfer behavior sample, and the third behavioral feature of the historical transfer behavior sample received by the resource receiving object of the transfer behavior to be identified; the transfer behavior to be identified is a transfer behavior of pre-funded resources.

[0064] Based on the first behavioral feature and the second behavioral feature, a first type of feature is determined for the transfer behavior to be identified; the first type of feature characterizes the degree of similarity between the transfer behavior to be identified and the abnormal transfer behavior sample.

[0065] Based on the first behavioral feature and the third behavioral feature, a second type of feature and a third type of feature of the transfer behavior to be identified are determined; the second type of feature characterizes the degree of abnormality of the transfer behavior to be identified in the feature dimension, and the third type of feature characterizes the degree of abnormality of the transfer behavior to be identified in the time dimension;

[0066] Based on the first type of features, the second type of features, the third type of features, and the pre-trained abnormal resource transfer behavior recognition model, the recognition result for the transfer behavior to be identified is determined.

[0067] Seventhly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, performs the following steps:

[0068] The process involves acquiring the first behavioral feature of the transfer behavior to be identified, the second behavioral feature of the abnormal transfer behavior sample, and the third behavioral feature of the historical transfer behavior sample received by the resource receiving object of the transfer behavior to be identified; the transfer behavior to be identified is a transfer behavior of pre-funded resources.

[0069] Based on the first behavioral feature and the second behavioral feature, a first type of feature is determined for the transfer behavior to be identified; the first type of feature characterizes the degree of similarity between the transfer behavior to be identified and the abnormal transfer behavior sample.

[0070] Based on the first behavioral feature and the third behavioral feature, a second type of feature and a third type of feature of the transfer behavior to be identified are determined; the second type of feature characterizes the degree of abnormality of the transfer behavior to be identified in the feature dimension, and the third type of feature characterizes the degree of abnormality of the transfer behavior to be identified in the time dimension;

[0071] Based on the first type of features, the second type of features, the third type of features, and the pre-trained abnormal resource transfer behavior recognition model, the recognition result for the transfer behavior to be identified is determined.

[0072] The aforementioned abnormal resource transfer behavior identification method, abnormal resource transfer behavior identification model training method, device, computer equipment, storage medium, and computer program product first acquire the first behavioral features of the transfer behavior to be identified, the second behavioral features of the abnormal transfer behavior samples, and the third behavioral features of the historical transfer behavior samples received by the resource receiving object of the transfer behavior to be identified; the transfer behavior to be identified is a transfer behavior of pre-borrowed resources; then, based on the first and second behavioral features, the first type of features of the transfer behavior to be identified are determined; the first type of features characterizes the similarity between the transfer behavior to be identified and the abnormal transfer behavior samples; then, based on the first and third behavioral features, the second and third type of features of the transfer behavior to be identified are determined; the second type of features characterizes the degree of abnormality of the transfer behavior to be identified in the feature dimension, and the third type of features characterizes the degree of abnormality of the transfer behavior to be identified in the time dimension; finally, based on the first type of features, the second type of features, the third type of features, and the pre-trained abnormal resource transfer behavior identification model, the identification result for the transfer behavior to be identified is determined. In this way, based on the first, second and third features of the transfer behavior to be identified, the similarity between the transfer behavior to be identified and the abnormal behavior samples can be fully explored, as well as the abnormality of the transfer behavior to be identified in the feature dimension and time dimension. Thus, based on the correlation between different resource transfer behaviors, the abnormal resource transfer behavior identification model can be used to reasonably determine whether the resource transfer behavior is abnormal, thereby improving the identification accuracy of abnormal resource transfer behavior. Attached Figure Description

[0073] Figure 1 This is a flowchart illustrating an abnormal resource transfer behavior identification method in one embodiment;

[0074] Figure 2 This is a flowchart illustrating the steps for determining a first type of feature of a transfer behavior to be identified in one embodiment;

[0075] Figure 3 This is a schematic diagram of a knowledge graph of transfer behavior in one embodiment;

[0076] Figure 4 This is a flowchart illustrating the steps for determining a second type of feature of a transfer behavior to be identified in one embodiment;

[0077] Figure 5 This is a flowchart illustrating the steps for determining the first sub-feature of the transfer behavior to be identified under the first type of feature in one embodiment;

[0078] Figure 6(a) is a schematic diagram of trees in an isolated forest of receiving objects in one embodiment;

[0079] Figure 6(b) is a schematic diagram of another tree in an isolated forest of the receiving object in one embodiment;

[0080] Figure 6(c) is a schematic diagram of another tree in an isolated forest of receiving objects in one embodiment;

[0081] Figure 7 This is a flowchart illustrating the steps for determining the second sub-feature of the transfer behavior to be identified under the first type of feature in one embodiment;

[0082] Figure 8 This is a flowchart illustrating the steps for determining a third type of feature of a transfer behavior to be identified in one embodiment;

[0083] Figure 9 This is a flowchart illustrating an abnormal resource transfer behavior identification method in another embodiment;

[0084] Figure 10 This is a flowchart illustrating a method for identifying abnormal credit card transactions in one embodiment;

[0085] Figure 11 This is a flowchart illustrating a method for training an abnormal resource transfer behavior recognition model in one embodiment.

[0086] Figure 12 This is a structural block diagram of an abnormal resource transfer behavior identification device in one embodiment;

[0087] Figure 13 This is a structural block diagram of a training device for an abnormal resource transfer behavior recognition model in one embodiment.

[0088] Figure 14 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0089] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0090] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions. It should also be noted that the abnormal resource transfer behavior identification method, abnormal resource transfer behavior identification model training method, device, computer equipment, storage medium and computer program products provided in this application can be applied in the field of fintech, such as determining whether credit card transactions between credit card holders and merchants are abnormal credit card transactions; they can also be applied in other related fields, such as in the field of computer technology, where the abnormal resource transfer behavior identification method provided in this application can be used to identify abnormal virtual resources.

[0091] Abnormal resource transfer behavior refers to the behavior of holders of prepaid resources realizing the monetization of prepaid resources through resource transfer between them and merchants. The abnormal resource transfer behavior identification method provided in this application is described in detail in the context of credit card transactions between credit card holders and merchants. For example, a credit card holder makes a payment to a merchant through a credit card, and then the merchant transfers the corresponding amount of money to the credit card holder. In this way, although the credit card holder does not receive any products from the merchant, he / she can turn his / her credit card limit into money that can be used for consumption.

[0092] In one exemplary embodiment, such as Figure 1 As shown, this application provides a method for identifying abnormal resource transfer behavior. This embodiment illustrates the application of this method to a server; it is understood that this method can also be applied to a terminal, and can also be applied to a system including a server and a terminal, and is implemented through interaction between the server and the terminal. The server can be a standalone server or a server cluster composed of multiple servers; the terminal can be, but is not limited to, various personal computers, laptops, smartphones, and tablets. In this embodiment, the method includes the following steps:

[0093] Step S102: Obtain the first behavioral feature of the transfer behavior to be identified, the second behavioral feature of the abnormal transfer behavior sample, and the third behavioral feature of the historical transfer behavior sample received by the resource receiving object of the transfer behavior to be identified.

[0094] Among them, the transfer behavior to be identified is the transfer behavior of pre-paid resources; pre-paid resources refer to resources that the holder of the resources obtains from enterprises or institutions in advance; such as credit card limits obtained through bank credit cards, or Huabei limits obtained through Alipay, etc.

[0095] Among them, behavioral characteristics refer to the characteristic information of the transfer behavior, such as the resource provider, the resource recipient, the resource account and mobile phone number used by the resource provider and the resource recipient, the amount of resources transferred during the transfer behavior, and the time and place of the transfer.

[0096] Specifically, the server first identifies abnormal transfer behavior samples that correspond to abnormal resource transfer behavior from the transfer behavior samples, and identifies transfer behavior samples whose corresponding resource receiving objects are the same as the resource receiving objects of the transfer behavior to be identified, as historical transfer behavior samples received by the resource receiving objects of the transfer behavior to be identified; then, the server obtains the feature information of the transfer behavior to be identified as the first behavior feature, obtains the feature information of the abnormal transfer behavior samples as the second behavior feature, and obtains the behavior features of the historical transfer behavior samples as the third feature information.

[0097] Step S104: Based on the first behavioral feature and the second behavioral feature, determine the first type of feature of the transfer behavior to be identified.

[0098] The first type of feature characterizes the similarity between the transfer behavior to be identified and the abnormal transfer behavior samples; for example, the distance between the transfer behavior to be identified and the abnormal transfer behavior samples, the number of behavioral features shared by the transfer behavior to be identified and the abnormal transfer behavior, etc.

[0099] Specifically, the server maps the transfer behavior to be identified and the abnormal transfer behavior sample to a planar coordinate system based on the first behavioral feature of the transfer behavior to be identified and the second behavioral feature of the abnormal transfer behavior sample, thereby calculating the distance between the transfer behavior to be identified and the abnormal transfer behavior sample. Then, the server identifies the same behavioral features from the first and second behavioral features as shared behavioral features between the transfer behavior to be identified and the abnormal transfer behavior, and counts the number of shared behavioral features between the transfer behavior to be identified and the abnormal transfer behavior sample. Through the above distance and the number of shared behavioral features, the server obtains a first type of feature that characterizes the similarity between the transfer behavior to be identified and the abnormal transfer behavior sample.

[0100] For example, the server converts the first and second behavioral features into vector form. Using these vector forms, it calculates the distance between the target transfer behavior and the abnormal transfer behavior samples. A smaller distance indicates a higher degree of similarity between the two. Simultaneously, based on the vector forms of the first and second behavioral features, the server counts the number of shared behavioral features between the two samples. A higher number of shared behavioral features also indicates a greater degree of similarity. The greater the similarity between the target transfer behavior and the abnormal transfer behavior samples, the higher the probability that the target transfer behavior belongs to an abnormal resource transfer behavior.

[0101] Step S106: Based on the first behavioral feature and the third behavioral feature, determine the second type of feature and the third type of feature of the transfer behavior to be identified.

[0102] The second type of feature characterizes the degree of abnormality of the transfer behavior to be identified under the feature dimension; for example, the degree of abnormality of the transfer behavior to be identified relative to historical transfer behavior samples under the feature dimension, and the degree of abnormality of the transfer behavior to be identified relative to normal transfer behavior samples in the historical transfer behavior samples under the feature dimension.

[0103] The third type of feature characterizes the degree of anomaly of the transfer behavior to be identified in the time dimension. For example, within the time interval in which the transfer behavior to be identified occurs, the degree of anomaly of behavioral characteristics such as the number of resource transfers, the total number of transfer behaviors, the location of resource transfers, the resource provider, and the resource recipient involved in the transfer behavior to be identified. The total number of transfer behaviors involved in the transfer behavior to be identified is the total number of transfer behaviors within the time interval in which the transfer behavior to be identified occurs.

[0104] Specifically, the server first determines the distribution of normal and abnormal transfer behavior samples in the historical transfer behavior samples based on the third behavioral feature. Then, based on the first behavioral feature, the server determines the distribution of the transfer behavior to be identified in the historical transfer behavior samples. Next, the server compares the differences between the transfer behavior to be identified and the normal transfer behavior samples in the historical transfer behavior samples using the first and third behavioral features. Based on the above distribution and differences, the server obtains the degree of abnormality of the transfer behavior to be identified in the feature dimension, which is the second type of feature of the transfer behavior to be identified.

[0105] Simultaneously, based on the third behavioral feature of historical transfer behavior samples, the server determines the number of resource transfers and the total number of transfer behaviors in each time interval of the historical transfer behavior samples, thus obtaining the temporal information of the historical transfer behavior samples. Furthermore, based on the first behavioral feature of the transfer behavior to be identified, the server determines the number of resource transfers and the total number of transfer behaviors corresponding to the transfer behavior to be identified, thus obtaining the temporal information of the transfer behavior to be identified. Then, the server compares the temporal information of the transfer behavior to be identified with the temporal information of the historical transfer behavior samples to obtain the degree of abnormality of the transfer behavior to be identified in the time dimension, i.e., the third type of feature of the transfer behavior to be identified.

[0106] For example, based on the first and third behavioral features, the server determines the distribution of the transfer behavior to be identified within historical transfer behavior samples, and assesses the difference between the transfer behavior to be identified and normal transfer behavior samples within those historical samples. The closer the distribution of the transfer behavior to be identified within historical transfer behavior samples is to abnormal transfer behavior samples, the greater the degree of abnormality of the transfer behavior in terms of feature dimension. Similarly, the greater the difference between the transfer behavior to be identified and normal transfer behavior samples within historical samples, the greater the degree of abnormality of the transfer behavior in terms of feature dimension. Likewise, the server compares the temporal information of the transfer behavior to be identified with the temporal information of historical transfer behavior samples. The greater the difference in temporal information between the two, the greater the degree of abnormality of the transfer behavior in terms of time dimension. The greater the degree of abnormality of the transfer behavior to be identified, the higher the probability that it belongs to an abnormal resource transfer behavior.

[0107] Step S108: Based on the first type of features, the second type of features, the third type of features, and the pre-trained abnormal resource transfer behavior recognition model, determine the recognition result for the transfer behavior to be identified.

[0108] Among them, the pre-trained abnormal resource transfer behavior identification model is a model obtained by machine learning training on the first type of sample features, the second type of sample features, and the third type of sample features of the transfer behavior samples.

[0109] The identification result of the transfer behavior to be identified is used to characterize whether the transfer behavior to be identified is an abnormal resource transfer behavior.

[0110] Specifically, the server aggregates the first, second, and third types of features of the transfer behavior to be identified to obtain a comprehensive feature of the transfer behavior, and then inputs the comprehensive feature of the transfer behavior to the preprocessor.

[0111] The abnormal resource transfer behavior identification model is trained first. The probability that the transfer behavior to be identified belongs to abnormal resource transfer behavior is obtained through the pre-trained abnormal resource transfer behavior identification model. If the probability is greater than the preset probability threshold, the transfer behavior to be identified is determined to be abnormal resource transfer behavior.

[0112] For example, assuming the preset probability threshold is 0.8, if the probability of the transfer behavior to be identified being an abnormal resource transfer behavior is 0.95 obtained through the pre-trained abnormal resource transfer behavior identification model, then the transfer behavior to be identified is an abnormal resource transfer behavior; if the probability of the transfer behavior to be identified being an abnormal resource transfer behavior is 0.53 obtained through the pre-trained abnormal resource transfer behavior identification model, then the transfer behavior to be identified is a normal resource transfer behavior.

[0113] In the abnormal resource transfer behavior identification method provided in the above embodiments, the server first obtains the first behavioral features of the transfer behavior to be identified, the second behavioral features of the abnormal transfer behavior samples, and the third behavioral features of the historical transfer behavior samples received by the resource receiving object of the transfer behavior to be identified. Then, based on the first and second behavioral features, the server determines the first type of features of the transfer behavior to be identified. Next, based on the first and third behavioral features, the server determines the second and third type of features of the transfer behavior to be identified. Finally, based on the first, second, and third type of features and the pre-trained abnormal resource transfer behavior identification model, the server determines the identification result for the transfer behavior to be identified. In this way, based on the first, second, and third type of features of the transfer behavior to be identified, the server can fully explore the similarity between the transfer behavior to be identified and the abnormal behavior samples, as well as the abnormality of the transfer behavior to be identified in the feature dimension and time dimension. Therefore, based on the correlation between different resource transfer behaviors, and through the pre-trained abnormal resource transfer behavior identification model, the server can reasonably determine whether a resource transfer behavior is abnormal, thereby improving the accuracy of abnormal resource transfer behavior identification.

[0114] like Figure 2 As shown, in an exemplary embodiment, step S104 above, which determines the first type of feature of the transfer behavior to be identified based on the first behavioral feature and the second behavioral feature, specifically includes the following steps:

[0115] Step S202: Construct a knowledge graph of transfer behavior based on the first behavioral feature and the second behavioral feature.

[0116] Step S204: Based on the knowledge graph of transfer behavior, obtain the distance between the transfer to be identified and the abnormal transfer behavior sample, and obtain the number of neighbor nodes between the transfer to be identified and the abnormal transfer behavior sample.

[0117] Step S206: Determine the target distance that meets the preset conditions from the distances.

[0118] Step S208: The target distance and the number of neighboring nodes are determined as the first type of features of the transfer behavior to be identified.

[0119] In this knowledge graph, each node represents a transfer behavior and its characteristics.

[0120] The number of neighboring nodes between the transfer and abnormal transfer behavior samples is the number of nodes that directly connect the transfer and abnormal transfer behavior samples.

[0121] Specifically, based on the first and second behavioral features, the server determines the entities and attributes corresponding to the samples of the transfer behavior to be identified and the abnormal transfer behavior, as well as the relationships between the entities and attributes. Then, the server constructs a structure using entities and attributes as nodes and the relationships between entities and attributes as edges, as follows: Figure 3 The server then uses the knowledge graph of transfer behavior to obtain the distance between the transfer behavior to be identified and each abnormal transfer behavior sample, as well as to count the number of neighboring nodes between the transfer behavior to be identified and each abnormal transfer behavior sample. From the distance between the transfer behavior to be identified and each abnormal transfer behavior sample, the server determines the target distance that meets the preset conditions. Finally, the server determines the target distance and the number of neighboring nodes as the first type of feature of the transfer behavior to be identified.

[0122] For example, see [link / reference] Figure 3 The server assigns weights to edges in the knowledge graph of transfer behaviors based on the degree of influence of attributes on entities. Weights represent the distance between nodes; the smaller the weight, the smaller the distance. When multiple connection paths exist between two transfer behaviors, the shortest path distance is used to represent the distance between the two transfer behaviors. Taking transfer behavior 1 to be identified as an example, its distance to abnormal transfer behavior sample 1 is 0.2, and its distance to abnormal transfer behavior sample 2 is 1.2. Therefore, the target distance for transfer behavior 1 to be identified is 0.2. The number of neighboring nodes between transfer behavior 1 to be identified and each abnormal transfer behavior sample is 3 (the neighboring nodes of abnormal transfer behavior sample 1 are: the resource provider's mobile phone number and the resource provider; the neighboring node of abnormal transfer behavior sample 2 is: the transfer address).

[0123] In this embodiment, the server, based on the knowledge graph of transfer behavior, can represent the first behavioral feature of the transfer to be identified and the second behavioral feature of the abnormal transfer behavior sample through a weighted vertex-edge graph. This allows the server to quickly obtain the target distance between the transfer behavior to be identified and the abnormal transfer behavior, as well as the number of neighboring nodes between them. This yields a first type of feature that represents the similarity between the transfer behavior to be identified and the abnormal transfer behavior sample. Based on this first type of feature, the server can fully explore the correlation between the transfer behavior to be identified and the abnormal transfer behavior sample, thereby improving the accuracy of identifying abnormal resource transfer behavior.

[0124] In an exemplary embodiment, step S204 above, which obtains the distance between the transfer behavior to be identified and the abnormal transfer behavior sample based on the transfer behavior knowledge graph, specifically includes the following: determining the path between the transfer behavior to be identified and the abnormal transfer behavior sample in the transfer behavior knowledge graph; and obtaining the distance between the transfer behavior to be identified and the abnormal transfer behavior sample along the weights on the path.

[0125] Step S206 above, determining the target distance that meets the preset conditions from the distances, specifically includes the following: identifying the distances whose corresponding values ​​are less than the corresponding values ​​of the other distances, as the target distances that meet the preset conditions.

[0126] Specifically, the server determines the path between the transfer behavior to be identified and each abnormal transfer behavior sample in the transfer behavior knowledge graph, and adds up the weights on each path to obtain the distance between the transfer behavior to be identified and each abnormal transfer behavior sample; then, the server identifies the distance with the smallest value from all the distances as the target distance that meets the preset conditions.

[0127] For example, see [link / reference] Figure 3 The server uses the knowledge graph of transfer behavior to obtain the distances between the transfer behavior to be identified 1 and the abnormal transfer behavior sample 1 as 0.2, 0.4 and 3.8, respectively. Therefore, the distance between the transfer behavior to be identified 1 and the abnormal transfer behavior sample 1 is 0.2. At the same time, it can also obtain the distance between the transfer behavior to be identified 1 and the abnormal transfer behavior sample 2 as 1.2. Therefore, the server determines the target distance as 0.2 between the distances of 0.2 and 1.2.

[0128] In this embodiment, the server can determine the distance between the transfer behavior to be identified and the abnormal transfer behavior samples by using the weights of the edges in the transfer behavior knowledge graph, thereby measuring the similarity between the transfer behavior to be identified and the abnormal transfer behavior samples by distance.

[0129] like Figure 4As shown, in an exemplary embodiment, step S106 above, which determines the second type of feature of the transfer behavior to be identified based on the first behavioral feature and the third behavioral feature, specifically includes the following steps: step S402, which determines the first sub-feature of the transfer behavior to be identified under the first type of feature based on the first behavioral feature and the third behavioral feature of the historical transfer behavior sample.

[0130] Step S404: From the historical transfer behavior samples, identify normal transfer behavior samples. Based on the first behavior feature and the third behavior feature of the normal transfer behavior samples, determine the second sub-feature of the transfer behavior to be identified under the first type of feature.

[0131] Step S406: The first sub-feature and the second sub-feature are determined as the second type of features of the transfer behavior to be identified.

[0132] The first sub-feature is used to characterize the degree of abnormality of the transfer behavior to be identified relative to historical transfer behavior samples under the feature dimension; the second sub-feature is used to characterize the degree of abnormality of the transfer behavior to be identified relative to normal transfer behavior samples in the historical transfer behavior samples under the feature dimension.

[0133] Specifically, the server first compares the transfer behavior to be identified with the historical transfer behavior samples based on the first behavioral feature and the third behavioral feature of the historical transfer behavior samples to obtain the difference in behavioral features between the two, thereby obtaining the first sub-feature of the transfer behavior to be identified under the second type of features; then, the server identifies normal transfer behavior samples from the historical transfer behavior samples, and compares the transfer behavior to be identified with the normal transfer behavior samples in the historical transfer behavior samples based on the first behavioral feature and the third sub-feature of the normal transfer behavior samples in the historical transfer behavior samples to obtain the difference in behavioral features between the two, thereby obtaining the second sub-feature of the transfer behavior to be identified under the second type of features; finally, the server determines the above first sub-feature and second sub-feature as the second type of features of the transfer behavior to be identified.

[0134] In this embodiment, the server, by using the first behavioral feature of the transfer behavior to be identified and the third behavioral feature of historical transfer behavior samples, can obtain the differences between the transfer behavior to be identified and historical transfer behavior samples, as well as the differences between the transfer behavior to be identified and normal transfer behavior samples in the historical transfer behavior, starting from the same receiving object. This results in obtaining a second type of feature that characterizes the degree of abnormality of the transfer behavior to be identified in the feature dimension. Based on the second type of feature, the server can fully explore the correlation between the transfer behavior to be identified and historical transfer behavior samples in the feature dimension, thereby improving the accuracy of identifying abnormal resource transfer behavior.

[0135] like Figure 5As shown, in an exemplary embodiment, step S402 above, based on the first behavioral feature and the third behavioral feature of historical transfer behavior samples, determines the first sub-feature of the transfer behavior to be identified under the first type of feature, specifically including the following steps:

[0136] Step S502: Construct an isolated forest corresponding to the resource receiving object based on the third behavioral characteristics of the historical transfer behavior samples.

[0137] Step S504: Based on the first behavioral feature, the transfer behavior to be identified is descended along the path of each tree in the isolated forest to obtain the path length that the transfer behavior to be identified can match on each tree.

[0138] Step S506: Obtain the average value of each path length, and based on the average value, obtain the first sub-feature of the transfer behavior to be identified under the first type of feature.

[0139] The isolated forest consists of multiple trees, each derived from a historical transfer behavior sample received by the resource receiving object. This historical transfer behavior sample includes both normal and abnormal transfer behavior samples. Understandably, in the isolated forest, the greater the degree of anomalousness of a behavior, the earlier it will be isolated; that is, the greater the degree of anomalousness, the shorter the corresponding matchable path length.

[0140] Specifically, taking the construction process of each tree as an example, the server first randomly selects multiple historical transfer behavior samples from the historical transfer behavior samples and places them into the root node of the tree; then, based on the third behavior feature of a historical transfer behavior sample in the root node, the server divides the historical transfer behavior samples in the root node into two subsets, each subset corresponding to a child node of the root node. Each child node can contain at least one historical transfer behavior sample. Then, the historical transfer behavior samples in each child node are further divided into two subsets, and the above steps are repeated until the final subset obtained by the server contains only one historical transfer behavior sample, or the final subset obtained by the server contains... Once the height of the corresponding node in the tree reaches a preset height threshold, the server obtains an isolated forest containing multiple trees based on the above process. Next, the server adds the transfer behavior to be identified to the isolated forest, and based on the first feature of the transfer behavior, it descends along the path of each tree in the isolated forest to obtain the height of the node corresponding to the transfer behavior in each tree, which is used as the path length that can be matched for the transfer behavior in each tree. Finally, the server calculates the average of each path length, which is the average height of the node corresponding to the transfer behavior in each tree, as the first sub-feature of the transfer behavior under the first type of feature.

[0141] For example, as shown in Figures 6(a), 6(b), and 6(c), these are schematic diagrams of the trees in the isolated forest of the receiving objects obtained by the server. In these trees, behaviors 1 to 9 are historical transfer behavior samples, and behavior 10 is the transfer behavior to be identified. According to Figures 6(a), 6(b), and 6(c), the server can obtain the path lengths that behavior 10 can match on each tree as 3, 2, and 1, respectively. Therefore, the average value of each path length of behavior 10 is 2, that is, the first sub-feature of behavior 10 under the first type of feature is 2.

[0142] In this embodiment, the server, through an isolated forest corresponding to the resource receiving object, can determine the degree of abnormality of the transfer behavior to be identified based on the distribution of normal transfer behavior samples and abnormal transfer behavior samples in the historical transfer behavior samples.

[0143] like Figure 7 As shown, in an exemplary embodiment, step S404 above, based on the first behavioral feature and the third behavioral feature of the normal transfer behavior sample, determines the second sub-feature of the transfer behavior to be identified under the first type of feature, specifically including the following steps:

[0144] Step S702: Based on the third behavioral features of the normal transfer behavior samples, an autoencoder is trained.

[0145] Step S704: The transfer behavior to be identified is reconstructed using an autoencoder to obtain the reconstructed behavior of the transfer behavior to be identified.

[0146] Step S706: Based on the error between the reconstruction behavior and the transfer behavior to be identified, the second sub-feature of the transfer behavior to be identified under the first type of feature is obtained. Specifically, the server takes the third behavioral feature of the normal transfer behavior sample as the input feature and inputs it into the autoencoder to be trained. Through the fully connected layer of the autoencoder, the third behavioral feature of the normal transfer behavior sample is encoded into a low-dimensional latent variable. Then, the server passes the low-dimensional latent variable of the normal transfer behavior sample through the fully connected layer to decode it into an output feature with the same dimension as the third behavioral feature of the normal transfer behavior sample, thus obtaining the reconstructed behavior sample of the normal transfer behavior sample. Next, the server calculates the loss value between the input feature and the output feature of the normal transfer behavior sample using mean squared error, thus obtaining the reconstruction error between the normal transfer behavior sample and the reconstructed behavior sample. Based on the loss value, the server trains the autoencoder to be trained so that the output feature of the normal transfer behavior sample is as close as possible to the input feature, thus obtaining the trained autoencoder. Finally, the server reconstructs the transfer behavior to be identified based on the trained autoencoder, thus obtaining the reconstructed behavior of the transfer behavior to be identified, and determines the reconstruction error between the transfer behavior to be identified and the reconstructed behavior as the second sub-feature of the transfer behavior to be identified under the second type of feature.

[0147] In this embodiment, the server obtains an autoencoder that enables the normal transfer behavior sample to remain consistent before and after reconstruction by using the third behavioral feature of the normal transfer behavior sample, and obtains a second sub-feature that can characterize the error before and after reconstruction of the transfer behavior to be identified based on the autoencoder.

[0148] like Figure 8 As shown, in an exemplary embodiment, the third type of feature in step S106 above is obtained in the following manner:

[0149] Step S802: Based on the third behavioral characteristics of historical transfer behavior samples, obtain the resource quantity time series and behavior quantity time series of transfer behavior samples.

[0150] Step S804: Determine the target time interval corresponding to the transfer behavior to be identified in the resource quantity time series or behavior quantity time series.

[0151] Step S806: Based on the resource quantity time series within the target time interval, obtain the resource quantity time series characteristics of the transfer behavior to be identified, and based on the behavior quantity time series within the target interval, obtain the behavior quantity time series characteristics of the transfer behavior to be identified.

[0152] Step S808: The time-series characteristics of resource quantity and the time-series characteristics of behavior quantity are determined as the third type of characteristics of the transfer behavior to be identified.

[0153] The resource quantity time series is composed of the number of resource transfers in multiple preset time intervals based on the transfer behavior samples; the behavior quantity time series is composed of the number of behaviors in multiple preset time intervals based on the transfer behavior samples.

[0154] Among them, the resource quantity time-series feature of the transfer behavior to be identified is used to characterize the degree of abnormality of the resource quantity involved in the transfer behavior to be identified within the corresponding target time interval; the behavior quantity time-series feature of the transfer behavior to be identified is used to characterize the degree of abnormality of the total number of transfer behaviors within the time interval in which the transfer behavior to be identified occurs within the corresponding target time interval.

[0155] The resource transfer quantity set is the set of all resource quantities involved in all transfer activities that occur within a certain time interval.

[0156] The number of behaviors is the sum of the number of all transfer behaviors that occur within a certain time interval.

[0157] Specifically, the server first extracts the resource transfer quantity and behavior quantity of historical transfer behavior samples from the third behavior feature of the historical transfer behavior samples under multiple preset time intervals. Based on the resource transfer quantity under multiple time intervals, a resource quantity time series is formed, and based on the behavior quantity under multiple time intervals, a behavior quantity time series is formed. Next, the server determines the target time interval corresponding to the transfer behavior to be identified in the resource quantity time series or behavior quantity time series, based on the time interval in which the transfer behavior to be identified occurs. Based on the resource transfer quantity set in the resource quantity time series within the target time interval, the server obtains the resource quantity time series feature of the transfer behavior to be identified, and based on the behavior quantity time series within the target interval, the server obtains the behavior quantity time series feature of the transfer behavior to be identified. Finally, the server determines the above resource quantity time series feature and behavior quantity time series feature as the third type feature of the transfer behavior to be identified.

[0158] For example, assuming the preset time interval is one hour, then a natural day will be divided into 24 time intervals; assuming the transfer behavior to be identified occurs between 1 a.m. and 2 a.m., then "1 a.m. to 2 a.m." is the target time interval; the server determines the resource quantity time sequence characteristics of the transfer behavior to be identified based on the resource quantity time series within the resource quantity time series between 1 a.m. and 2 a.m.; and the server determines the behavior quantity time sequence characteristics of the transfer behavior to be identified based on the behavior quantity time series within the behavior quantity time series between 1 a.m. and 2 a.m.

[0159] In this embodiment, the server can obtain a third type of feature by using the resource quantity time series and behavior quantity time series obtained from historical transfer behavior samples. This feature represents the degree of abnormality of the number of resource transfers and the total number of transfer behaviors involved in the transfer behavior to be identified within the corresponding target time interval. Based on the third type of feature, the server can fully explore the correlation between the transfer behavior to be identified and the historical transfer behavior samples in the time dimension, thereby improving the accuracy of identifying abnormal resource transfer behaviors.

[0160] In an exemplary embodiment, step S806 above, obtaining the resource quantity time series characteristics of the transfer behavior to be identified based on the resource quantity time series within the target time interval, specifically includes the following: obtaining the predicted value of the resource transfer quantity, the upper limit threshold of the resource transfer quantity, and the lower limit threshold of the resource transfer quantity corresponding to the target time interval based on the resource transfer quantity within the target time interval; and obtaining the resource quantity time series characteristics of the transfer behavior to be identified based on the resource transfer quantity, the predicted value of the resource transfer quantity, the upper limit threshold of the resource transfer quantity, and the lower limit threshold of the resource transfer quantity.

[0161] Among them, the predicted value of the number of resource transfers is the expected value of the number of resource transfers involved in the transfer behavior to be identified; for example, the median or average number of resource transfers of each historical transfer behavior sample within the target time interval.

[0162] The upper limit threshold for the number of resource transfers is the maximum value of the expected number of resource transfers for the transfer behavior to be identified; for example, the maximum value of the number of resource transfers for each historical transfer behavior sample within the target time interval.

[0163] The lower limit threshold for the number of resource transfers is the minimum value of the expected number of resource transfers for the transfer behavior to be identified; for example, the minimum value of the number of resource transfers for each historical transfer behavior sample within the target time interval.

[0164] Assuming the resource transfer quantity set is {25, 35, 55, 15}, then the predicted resource transfer quantity is the average of the four values ​​of 25, 35, 55, and 15, which is 32.5. The upper limit threshold for the resource transfer quantity is the maximum value of 55, and the lower limit threshold for the resource transfer quantity is the minimum value of 15.

[0165] Understandably, the server can also determine the predicted resource transfer quantity corresponding to the target time interval based on the resource quantity time series of the receiving object over a previous period (the previous three days or the previous seven days): For the resource quantity time series of the receiving object over the previous three days, the server obtains the predicted sub-resource transfer quantity for each resource quantity time series within the target time interval, and then uses the average of these predicted sub-resource transfer quantity values ​​as the predicted resource transfer quantity for the target time interval. For example, assuming the server obtains the predicted sub-resource transfer quantity values ​​for each resource quantity time series within the target time interval as {33, 35, 38} based on the resource quantity time series of the receiving object over the previous three days, then the server can use the average of 33, 35, and 38, 35.3, as the predicted resource transfer quantity for the target time interval. Similarly, the upper and lower limits of the resource transfer quantity thresholds can also be obtained based on the resource quantity time series of the receiving object over a previous period.

[0166] Specifically, the server obtains the predicted value of the resource transfer quantity, the upper limit threshold of the resource transfer quantity, and the lower limit threshold of the resource transfer quantity corresponding to the target time interval based on the resource transfer quantity time series within the target time interval.

[0167] Then, based on the resource transfer quantity of the identified transfer behavior, the predicted resource transfer quantity, and Formula 1, the server obtains the first resource error between the resource transfer quantity of the identified transfer behavior and the predicted resource transfer quantity:

[0168] (Formula 1)

[0169] Wherein, PredictRatevalue is the first resource error between the number of resource transfers of the transfer behavior to be identified and the predicted value of the number of resource transfers, Predictvalue is the predicted value of the number of resource transfers, and Actualvalue is the number of resource transfers of the transfer behavior to be identified.

[0170] Next, based on the number of resource transfers for the identified transfer behavior, the upper limit threshold for the number of resource transfers, and Formula 2, the server obtains the second resource error between the number of resource transfers for the identified transfer behavior and the upper limit threshold for the number of resource transfers:

[0171] (Formula 2)

[0172] Wherein, UpperRatevalue is the second resource error between the number of resource transfers for the identified transfer behavior and the upper limit threshold for the number of resource transfers, and PredictUppervalue is the upper limit threshold for the number of resource transfers. Next, based on the number of resource transfers for the identified transfer behavior, the lower limit threshold for the number of resource transfers, and Formula 3, the server obtains the third resource error between the number of resource transfers for the identified transfer behavior and the lower limit threshold for the number of resource transfers.

[0173] (Formula 3)

[0174] Wherein, LowerRatevalue is the third resource error between the number of resource transfers of the transfer behavior to be identified and the lower limit threshold of the number of resource transfers, and PredictLowervalue is the lower limit threshold of the number of resource transfers.

[0175] Finally, the server identifies the first resource error, the second resource error, and the third resource error as the temporal characteristics of the resource quantity of the transfer behavior to be identified.

[0176] It is understandable that if the number of resource transfers received by a receiving object is usually relatively stable, but suddenly increases or decreases within a certain period of time, then the probability that the resource transfer behavior during that period is abnormal is relatively high. In this embodiment, the server can determine whether the number of resource transfers in the identified transfer behavior is abnormal relative to the time interval in which the transfer behavior occurred by using the resource quantity time series within the target time interval.

[0177] In an exemplary embodiment, step S806 above, obtaining the temporal characteristics of the behavior quantity of the transfer behavior to be identified based on the behavior quantity time series within the target interval, specifically includes the following: obtaining the predicted value of the behavior quantity, the upper limit threshold of the behavior quantity, and the lower limit threshold of the behavior quantity corresponding to the target time interval based on the behavior quantity time series within the target time interval; obtaining the temporal characteristics of the behavior quantity of the transfer behavior to be identified based on the total number of transfer behaviors, the predicted value of the behavior quantity, the upper limit threshold of the behavior quantity, and the lower limit threshold of the behavior quantity within the time interval in which the transfer behavior to be identified occurs.

[0178] The total number of transfer behaviors refers to the total number of transfer behaviors occurring within the time interval during which the transfer behaviors to be identified occurred. For example, if the transfer behaviors to be identified occurred between 1 a.m. and 2 a.m., and there were 50 transfer behaviors during that time period, then the total number of transfer behaviors would be 50.

[0179] Among them, the predicted value of the number of behaviors is the expected value of the total number of transfer behaviors in the time interval in which the transfer behavior to be identified occurs; for example, the average value of the total number of transfer behaviors in the time interval corresponding to the transfer behavior to be identified in the daily historical transfer behaviors received by the receiving object.

[0180] Among them, the upper limit threshold for the number of behaviors is the maximum value of the total number of transfer behaviors within the time interval in which the expected transfer behavior to be identified occurs; for example, the maximum value of the total number of transfer behaviors in the time interval corresponding to the transfer behavior to be identified among the transfer behaviors received by the receiving object in its history of daily transfer behaviors.

[0181] Among them, the lower limit threshold for the number of behaviors is the minimum total number of transfer behaviors within the time interval in which the expected transfer behavior to be identified occurs; for example, the minimum total number of transfer behaviors in the time interval corresponding to the transfer behavior to be identified among the transfer behaviors received by the receiving object in its history of daily transfer behaviors.

[0182] Assuming that the total number of transfers occurring between 1 AM and 2 AM in the first three days are {44, 58, 50}, the server can confirm the predicted number of actions as the average of 44, 58, and 50, which is 51. The upper limit threshold for the number of actions is confirmed as the maximum value of 58, and the lower limit threshold for the number of actions is confirmed as the minimum value of 44.

[0183] Specifically, the server obtains the predicted value of the number of behaviors, the upper limit threshold of the number of behaviors, and the lower limit threshold of the number of behaviors corresponding to the target time interval based on the number of behaviors in the time series of behaviors within the target time interval.

[0184] Then, based on the total number of transfer behaviors corresponding to the transfer behavior to be identified, the predicted number of behaviors, and Formula 4, the server obtains the first behavior error between the total number of transfer behaviors and the predicted number of behaviors corresponding to the transfer behavior to be identified:

[0185] (Formula 4)

[0186] Where PredictRatetrade is the first behavior error between the total number of transfer behaviors corresponding to the transfer behavior to be identified and the predicted number of behaviors, Predicttrade is the predicted number of behaviors, and Actualtrade is the total number of transfer behaviors corresponding to the transfer behavior to be identified. Next, based on the total number of transfer behaviors corresponding to the transfer behavior to be identified, the upper limit threshold for the number of behaviors, and Formula 5, the server obtains the second behavior error between the total number of transfer behaviors corresponding to the transfer behavior to be identified and the upper limit threshold for the number of behaviors.

[0187] (Formula 5)

[0188] Where UpperRatetrade is the second behavior error between the total number of transfer behaviors corresponding to the transfer behavior to be identified and the upper limit threshold of the behavior number, and PredictUppertrade is the upper limit threshold of the behavior number.

[0189] Next, based on the total number of transfer behaviors corresponding to the transfer behavior to be identified, the lower limit threshold of the number of behaviors, and Formula 6, the server obtains the third behavior error between the total number of transfer behaviors corresponding to the transfer behavior to be identified and the lower limit threshold of the number of behaviors:

[0190] (Formula 6)

[0191] Wherein, LowerRatetrade is the third behavior error between the total number of transfer behaviors corresponding to the transfer behavior to be identified and the lower limit threshold of the behavior number, and PredictLowertrade is the lower limit threshold of the behavior number.

[0192] Finally, the server identifies the first, second, and third line errors as the temporal characteristics of the number of transfer behaviors to be identified.

[0193] It is understandable that if the number of actions involved in a receiving object is usually relatively stable, but suddenly increases or decreases within a certain period of time, then the probability that the resource transfer behavior during that period is abnormal is relatively high. In this embodiment, the server can determine whether the total number of transfer behaviors corresponding to the identified transfer behavior is abnormal relative to the time interval in which the transfer behavior to be identified occurred, by using the number of behaviors in the behavior time series within the target time interval.

[0194] In one exemplary embodiment, such as Figure 9 As shown, another method for identifying abnormal resource transfer behavior is provided. Taking the application of this method to a server as an example, the method includes the following steps:

[0195] Step S901: Obtain the first behavioral feature of the transfer behavior to be identified, the second behavioral feature of the abnormal transfer behavior sample, and the third behavioral feature of the historical transfer behavior sample received by the resource receiving object of the transfer behavior to be identified.

[0196] Step S902: Construct a transfer behavior knowledge graph based on the first behavior feature and the second behavior feature. Based on the transfer behavior knowledge graph, obtain the target distance between the transfer to be identified and the abnormal transfer behavior sample that meets the preset conditions, and obtain the number of neighbor nodes between the transfer to be identified and the abnormal transfer behavior sample.

[0197] Step S903: The target distance and the number of neighboring nodes are determined as the first type of features of the transfer behavior to be identified.

[0198] Step S904: Construct an isolated forest corresponding to the resource receiving object based on the third behavior features of the historical transfer behavior samples, and train an autoencoder based on the third behavior features of the normal transfer behavior samples in the historical transfer behavior samples.

[0199] Step S905: Based on the first behavioral feature, the transfer behavior to be identified is descended along the path of each tree in the isolated forest to obtain the path length of the transfer behavior to be identified on each tree. Based on the average of each path length, the first sub-feature of the transfer behavior to be identified under the first type of feature is obtained.

[0200] Step S906: The transfer behavior to be identified is reconstructed using an autoencoder to obtain the reconstructed behavior of the transfer behavior to be identified. Based on the error between the reconstructed behavior and the transfer behavior to be identified, the second sub-feature of the transfer behavior to be identified under the first type of feature is obtained.

[0201] Step S907: The first sub-feature and the second sub-feature are identified as the second type of features of the transfer behavior to be identified.

[0202] Step S908: Based on the third behavioral feature of historical transfer behavior samples, obtain the resource quantity time series and behavior quantity time series of the transfer behavior samples, and determine the target time interval corresponding to the transfer behavior to be identified under the resource quantity time series or behavior quantity time series. Step S909: Based on the resource transfer quantity set within the target time interval of the resource quantity time series, obtain the resource quantity time series feature of the transfer behavior to be identified; and based on the behavior quantity time series within the target interval of the behavior quantity time series, obtain the behavior quantity time series feature of the transfer behavior to be identified.

[0203] Step S910: The time-series characteristics of resource quantity and behavior quantity are determined as the third type of characteristics of the transfer behavior to be identified.

[0204] Step S911: Based on the first type of features, the second type of features, the third type of features, and the pre-trained abnormal resource transfer behavior recognition model, determine the recognition result for the transfer behavior to be identified.

[0205] In this embodiment, firstly, based on the knowledge graph of transfer behavior, the server can represent the first behavioral feature of the transfer to be identified and the second behavioral feature of the abnormal transfer behavior sample through a weighted point-edge graph. This allows for the rapid acquisition of the target distance between the transfer behavior to be identified and the abnormal transfer behavior, as well as the number of neighboring nodes between them, thus obtaining a first type of feature representing the similarity between the transfer behavior to be identified and the abnormal transfer behavior sample. Secondly, through the isolated forest and autoencoder corresponding to the resource receiving object, the server can obtain the differences between the transfer behavior to be identified and historical transfer behavior samples, as well as the differences between the transfer behavior to be identified and normal transfer behavior samples in the historical transfer behavior, starting from the same receiving object. This yields a second type of feature representing the degree of abnormality of the transfer behavior to be identified in the feature dimension. Thirdly, by using the resource quantity time series and behavior quantity time series obtained from the historical transfer behavior samples, the server can obtain a third type of feature representing the degree of abnormality of the number of resource transfers and behaviors involved in the transfer behavior to be identified in the corresponding target time interval. Based on the above first, second, and third types of features, the server can fully explore the correlation between the transfer behavior to be identified and the transfer behavior sample, thereby improving the accuracy of identifying abnormal resource transfer behavior.

[0206] To more clearly illustrate the abnormal resource transfer behavior identification method provided in the embodiments of this application, the following specific embodiment is used to describe the method in detail. However, it should be understood that the embodiments of this application are not limited thereto. Figure 10 As shown in an exemplary embodiment, this application also provides a method for identifying abnormal credit card transactions, specifically including the following steps:

[0207] Step 1: Collect credit card transaction data.

[0208] The server stores each credit card transaction in a data lake or data warehouse. Credit card transaction data includes at least: credit card holder ID, credit card holder mobile phone number, transaction card number, transaction time, transaction amount, transaction address, store, store address, merchant company, and merchant industry. Real-time data can be written to the data warehouse in real-time or near real-time using Flink (a framework and distributed processing engine for stateful computation on unbounded and bounded data streams) and Spark Streaming (a framework for high-throughput, fault-tolerant real-time streaming data processing). Offline data can be written to a unified data warehouse in batches at scheduled times using Hive (a data warehouse tool for data extraction, transformation, and loading) or Spark (a fast and general-purpose computing engine for large-scale data processing). This ensures that subsequent data used by the server originates from a unified data address, reducing the complexity and difficulty of feature calculation and model recognition integration.

[0209] Step 2: Knowledge graph feature extraction.

[0210] It's understandable that if a customer makes an unusual credit card transaction at the same store, other credit card transactions from the same customer and at the same store could also be unusual. Therefore, the server selects entities and attributes related to credit card transactions, such as transaction behavior, card number, name, phone number, issuing bank, card type, merchant, and traded item, as nodes in the knowledge graph. It also selects relationships between entities and attributes, such as transaction-card number, transaction-merchant, and card number-customer, as edges in the knowledge graph. Next, the server assigns a weight to each edge based on the degree of influence of each relationship on unusual credit card transactions. Lower weights indicate closer distances between nodes, meaning more similar transaction behaviors.

[0211] After obtaining the knowledge graph, the server uses Dijkstra's algorithm to calculate the shortest path length between each credit card transaction and known abnormal credit card transactions in the knowledge graph, as the distance score; and the server calculates the number of neighbor nodes shared by each credit card transaction and known abnormal credit card transactions in the knowledge graph, as the similarity score.

[0212] Step 3: Unsupervised feature extraction.

[0213] The server groups credit card transactions according to the merchants involved. For all credit card transactions within a single merchant, the server first uses the Isolation Forest algorithm to obtain the average path length of the credit card transaction descending along each tree in the Isolation Forest, which is used as the anomaly score. Next, the server trains an autoencoder using normal credit card transactions within the merchant, and reconstructs all credit card transactions within the merchant based on the autoencoder, thereby obtaining the error before and after the credit card transaction reconstruction, which is used as the anomaly coefficient.

[0214] Step 4: Time series feature extraction.

[0215] It's understandable that if a merchant's credit card transaction volume and amount are usually stable, but suddenly increase or decrease within a certain period, then the probability of the credit card transactions during that period being abnormal credit card transactions is relatively high.

[0216] For all credit card transactions within a merchant's system, the server extracts the transaction volume and transaction amount for each minute, forming a transaction volume time series and a transaction amount time series, respectively. Then, the server uses the Prophet algorithm (a time series prediction algorithm) to learn and predict the transaction volume and transaction amount time series, obtaining predicted transaction volume data, upper and lower bounds for each minute, and predicted transaction amount data, upper and lower bounds for each transaction amount. For each credit card transaction, the server calculates the errors between the actual transaction volume and the predicted transaction volume data, the errors between the actual transaction volume and the upper bound of the predicted transaction volume, and the errors between the actual transaction volume and the lower bound of the predicted transaction volume, based on the actual transaction volume at the time of the transaction, thus obtaining the transaction volume time significance feature set for that credit card transaction. Similarly, for each credit card transaction, the server calculates the errors between the actual transaction amount and the predicted transaction amount data, the errors between the actual transaction amount and the upper bound of the predicted transaction amount, and the errors between the actual transaction amount and the lower bound of the predicted transaction amount, thus obtaining the transaction amount time significance feature set for that credit card transaction.

[0217] Step 5: Feature aggregation.

[0218] The server aggregates the aforementioned distance score, similarity score, anomaly score, anomaly coefficient, transaction volume time significance feature group, and transaction amount time significance feature group into a comprehensive feature of credit card transactions.

[0219] Step 6: Data oversampling.

[0220] It is understandable that since abnormal credit card transactions account for a relatively small percentage of all credit card transactions, directly using the raw data for model training would result in data imbalance. Furthermore, based on the experience of business experts, abnormal credit card transactions are always relatively large in amount. Therefore, credit card transactions with amounts less than 50 yuan are first removed. Then, the data is oversampled using the Borderline-SMOTE algorithm (a widely used oversampling method to handle data imbalance) to increase the number of abnormal credit card transactions and enhance the model's ability to identify a small amount of data.

[0221] Step 7: Build the recognition model.

[0222] The server uses the LightGBM algorithm (LightGradientBoostingMachine) to train the extracted comprehensive features of credit card transactions, resulting in a trained abnormal credit card transaction identification model and a preset risk probability threshold for determining whether a credit card transaction is abnormal.

[0223] Step 8: Credit Card Transaction Recognition.

[0224] The server inputs the comprehensive features of the credit card transaction to be identified into the trained abnormal credit card transaction identification model. The abnormal risk probability of the credit card transaction to be identified is obtained through the trained abnormal credit card transaction identification model. If the abnormal risk probability is greater than the preset risk probability threshold, the credit card transaction to be identified is determined to be an abnormal credit card transaction.

[0225] In this embodiment, firstly, the server uses a knowledge graph to extract correlation information between credit card transactions. Based on the relationships between different entities, it determines the degree of connection between credit card transactions and known credit card transactions, thereby increasing the relevance and interpretability of detecting abnormal credit card transactions. Secondly, the server uses an isolated forest and AutoEncoder algorithms for unsupervised feature extraction, enabling it to determine the abnormality of credit card transactions based on the data distribution of each merchant, thus improving the efficiency and accuracy of credit card transaction detection. Thirdly, the server utilizes time-series information to extract temporal features, enabling it to determine the abnormality of transactions based on changes in transaction volume and transaction amount for each merchant, thereby reducing the risk of overfitting the model to training data patterns. Furthermore, the server uses an oversampling algorithm to balance the ratio of positive and negative samples in the dataset, thereby improving the model's classification accuracy. Based on the above process, the method for identifying abnormal credit card transactions fully considers the relationships between credit card transaction behaviors, improving the accuracy of identifying abnormal credit card transactions.

[0226] In one exemplary embodiment, such as Figure 11As shown, this application also provides a method for training an abnormal resource transfer behavior recognition model. This embodiment illustrates the application of this method to a server; it is understood that this method can also be applied to a terminal, and can also be applied to a system including a server and a terminal, and is implemented through the interaction between the server and the terminal. The server can be a standalone server or a server cluster composed of multiple servers; the terminal can be, but is not limited to, various personal computers, laptops, smartphones, and tablets. In this embodiment, the method includes the following steps:

[0227] Step S1102: Obtain the first type of sample features, the second type of sample features, and the third type of sample features of the transfer behavior samples.

[0228] Step S1104: Based on the first type of sample features, the second type of sample features, and the third type of sample features, train the abnormal resource transfer behavior recognition model to be trained to obtain the trained abnormal resource transfer behavior recognition model.

[0229] Among them, the first type of sample features characterizes the similarity between the transfer behavior samples and the abnormal transfer behavior samples, the second type of sample features characterizes the degree of abnormality of the transfer behavior samples in the feature dimension, and the third type of sample features characterizes the degree of abnormality of the transfer behavior samples in the time dimension.

[0230] Among them, the abnormal resource transfer behavior recognition model that has been trained is the pre-trained abnormal resource transfer behavior recognition model in the above-mentioned abnormal resource transfer behavior recognition method.

[0231] Specifically, the process of obtaining the features of the first type of samples is as follows: First, the server identifies abnormal transfer behavior samples and normal transfer behavior samples from the transfer behavior samples. Then, the server randomly selects multiple abnormal transfer behavior samples as reference transfer behavior samples, and confirms the remaining abnormal transfer behavior samples and normal transfer behavior samples as transfer behavior samples to be confirmed. Next, the server constructs a transfer behavior knowledge graph based on the reference transfer behavior samples and the transfer behavior samples to be confirmed, and based on the transfer behavior knowledge graph, confirms the shortest distance and the number of neighboring nodes between each transfer behavior sample to be confirmed and the reference transfer behavior samples, thereby obtaining the shortest distance and the number of neighboring nodes for each transfer behavior sample (for the reference transfer behavior sample, its corresponding shortest distance is 0, and the number of neighboring nodes is...).

[0232] The server uses the LightGBM algorithm (LightGradientBoostingMachine) to train the extracted comprehensive features of credit card transactions, resulting in a trained abnormal credit card transaction identification model and a preset risk probability threshold for determining whether a credit card transaction is abnormal.

[0233] Step 8: Credit Card Transaction Recognition.

[0234] The server inputs the comprehensive features of the credit card transaction to be identified into the trained abnormal credit card transaction identification model. The abnormal risk probability of the credit card transaction to be identified is obtained through the trained abnormal credit card transaction identification model. If the abnormal risk probability is greater than the preset risk probability threshold, the credit card transaction to be identified is determined to be an abnormal credit card transaction.

[0235] In this embodiment, firstly, the server uses a knowledge graph to extract correlation information between credit card transactions. Based on the relationships between different entities, it determines the degree of connection between credit card transactions and known credit card transactions, thereby increasing the relevance and interpretability of detecting abnormal credit card transactions. Secondly, the server uses an isolated forest and AutoEncoder algorithms for unsupervised feature extraction, enabling it to determine the abnormality of credit card transactions based on the data distribution of each merchant, thus improving the efficiency and accuracy of credit card transaction detection. Thirdly, the server utilizes time-series information to extract temporal features, enabling it to determine the abnormality of transactions based on changes in transaction volume and transaction amount for each merchant, thereby reducing the risk of overfitting the model to training data patterns. Furthermore, the server uses an oversampling algorithm to balance the ratio of positive and negative samples in the dataset, thereby improving the model's classification accuracy. Based on the above process, the method for identifying abnormal credit card transactions fully considers the relationships between credit card transaction behaviors, improving the accuracy of identifying abnormal credit card transactions.

[0236] In one exemplary embodiment, such as Figure 11 As shown, this application also provides a method for training an abnormal resource transfer behavior recognition model. This embodiment illustrates the application of this method to a server; it is understood that this method can also be applied to a terminal, and can also be applied to a system including a server and a terminal, and is implemented through the interaction between the server and the terminal. The server can be a standalone server or a server cluster composed of multiple servers; the terminal can be, but is not limited to, various personal computers, laptops, smartphones, and tablets. In this embodiment, the method includes the following steps:

[0237] Step S1102: Obtain the first type of sample features, the second type of sample features, and the third type of sample features of the transfer behavior samples.

[0238] Step S1104: Based on the first type of sample features, the second type of sample features, and the third type of sample features, train the abnormal resource transfer behavior recognition model to be trained to obtain the trained abnormal resource transfer behavior recognition model.

[0239] Among them, the first type of sample features characterizes the similarity between the transfer behavior samples and the abnormal transfer behavior samples, the second type of sample features characterizes the degree of abnormality of the transfer behavior samples in the feature dimension, and the third type of sample features characterizes the degree of abnormality of the transfer behavior samples in the time dimension.

[0240] Among them, the abnormal resource transfer behavior recognition model that has been trained is the pre-trained abnormal resource transfer behavior recognition model in the above-mentioned abnormal resource transfer behavior recognition method.

[0241] Specifically, the process of obtaining the first type of sample features is as follows: The server first identifies abnormal transfer behavior samples and normal transfer behavior samples from the transfer behavior samples; then, the server randomly selects multiple abnormal transfer behavior samples as reference transfer behavior samples from the abnormal transfer behavior samples, and confirms the remaining abnormal transfer behavior samples and normal transfer behavior samples as transfer behavior samples to be confirmed; next, the server constructs a transfer behavior knowledge graph based on the reference transfer behavior samples and the transfer behavior samples to be confirmed, and confirms the shortest distance and the number of neighboring nodes between each transfer behavior sample to be confirmed and the reference transfer behavior sample based on the transfer behavior knowledge graph, thereby obtaining the shortest distance and the number of neighboring nodes for each transfer behavior sample (for the reference transfer behavior sample, its corresponding shortest distance is 0, and the number of neighboring nodes is 1 for the sample).

[0242] Specifically, since abnormal transfer behavior samples account for a small proportion of transfer behavior samples, directly using transfer behavior samples for model training would result in an imbalanced data problem. Therefore, the server oversamples the abnormal transfer behavior samples in the transfer behavior samples to generate abnormal transfer behavior simulation samples. Then, the abnormal transfer behavior samples in the transfer behavior samples and the newly generated abnormal transfer behavior simulation samples are combined to form new abnormal transfer behavior samples. Finally, the new abnormal transfer behavior samples and the normal transfer behavior samples in the transfer behavior samples are combined to form new transfer behavior samples.

[0243] In this embodiment, the server increases the number of abnormal transfer behavior samples in the transfer behavior sample by oversampling the abnormal transfer behavior samples, thereby enhancing the ability of the abnormal resource transfer behavior identification model to identify a small amount of data and improving the identification accuracy of the abnormal resource transfer behavior identification model.

[0244] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0245] Based on the same inventive concept, this application also provides an abnormal resource transfer behavior identification device for implementing the abnormal resource transfer behavior identification method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more embodiments of the abnormal resource transfer behavior identification device provided below can be found in the limitations of the abnormal resource transfer behavior identification method described above, and will not be repeated here.

[0246] In one exemplary embodiment, such as Figure 12 As shown, an abnormal resource transfer behavior identification device is provided, including: a behavior feature acquisition module 1202, a similar feature determination module 1204, an abnormal feature determination module 1206, and an identification result determination module 1208, wherein:

[0247] The behavior feature acquisition module 1202 is used to acquire the first behavior feature of the transfer behavior to be identified, the second behavior feature of the abnormal transfer behavior sample, and the third behavior feature of the historical transfer behavior sample received by the resource receiving object of the transfer behavior to be identified; the transfer behavior to be identified is the transfer behavior of pre-funded resources.

[0248] The similarity feature determination module 1204 is used to determine the first type of features of the transfer behavior to be identified based on the first behavioral features and the second behavioral features; the first type of features characterizes the degree of similarity between the transfer behavior to be identified and the abnormal transfer behavior samples.

[0249] The abnormal feature determination module 1206 is used to determine the second type of features and the third type of features of the transfer behavior to be identified based on the first behavioral features and the third behavioral features; the second type of features characterizes the degree of abnormality of the transfer behavior to be identified in the feature dimension, and the third type of features characterizes the degree of abnormality of the transfer behavior to be identified in the time dimension.

[0250] The identification result determination module 1208 is used to determine the identification result for the transfer behavior to be identified based on the first type of features, the second type of features, the third type of features and the pre-trained abnormal resource transfer behavior identification model.

[0251] In an exemplary embodiment, the similarity feature determination module 1204 is further configured to construct a transfer behavior knowledge graph based on the first behavior feature and the second behavior feature; based on the transfer behavior knowledge graph, obtain the distance between the transfer to be identified and the abnormal transfer behavior sample, and obtain the number of neighboring nodes between the transfer to be identified and the abnormal transfer behavior sample; determine the target distance that meets the preset conditions from the distance; and determine the target distance and the number of neighboring nodes as the first type of feature of the transfer behavior to be identified.

[0252] In an exemplary embodiment, the similarity feature determination module 1204 is further configured to determine the path between the transfer behavior to be identified and the abnormal transfer behavior sample in the transfer behavior knowledge graph; obtain the distance between the transfer behavior to be identified and the abnormal transfer behavior sample along the weights on the path; and identify the distance whose corresponding value is less than the corresponding value of the other distances from the distances as the target distance that meets the preset conditions.

[0253] In an exemplary embodiment, the abnormal feature determination module 1206 is further configured to: determine a first sub-feature of the transfer behavior to be identified under a first type of feature based on the first behavioral feature and the third behavioral feature of the historical transfer behavior samples; determine normal transfer behavior samples from the historical transfer behavior samples; determine a second sub-feature of the transfer behavior to be identified under a first type of feature based on the first behavioral feature and the third behavioral feature of the normal transfer behavior samples; and determine the first sub-feature and the second sub-feature as the second type of feature of the transfer behavior to be identified.

[0254] In an exemplary embodiment, the abnormal feature determination module 1206 is further configured to construct an isolated forest corresponding to the resource receiving object based on the third behavioral feature of the historical transfer behavior samples; the isolated forest includes multiple trees, each tree being obtained based on a historical transfer behavior sample received by the resource receiving object in the past, the historical transfer behavior samples including normal transfer behavior samples and abnormal transfer behavior samples; based on the first behavioral feature, the transfer behavior to be identified is descended along the path of each tree in the isolated forest to obtain the path length that the transfer behavior to be identified can match on each tree; the average value of each path length is obtained, and based on the average value, the first sub-feature of the transfer behavior to be identified under the first type of feature is obtained.

[0255] In an exemplary embodiment, the abnormal feature determination module 1206 is further configured to train an autoencoder based on the third behavioral features of normal transfer behavior samples; reconstruct the transfer behavior to be identified through the autoencoder to obtain the reconstructed behavior of the transfer behavior to be identified; and obtain the second sub-feature of the transfer behavior to be identified under the first type of features based on the error between the reconstructed behavior and the transfer behavior to be identified.

[0256] In an exemplary embodiment, the anomaly feature determination module 1206 is further configured to obtain a resource quantity time series and a behavior quantity time series of the transfer behavior sample based on the third behavior feature of the historical transfer behavior sample; the resource quantity time series is composed of the resource transfer quantity of the transfer behavior sample under multiple preset time intervals, and the behavior quantity time series is composed of the behavior quantity of the transfer behavior sample under multiple preset time intervals; determine the target time interval corresponding to the transfer behavior to be identified under the resource quantity time series or the behavior quantity time series; obtain the resource quantity time series feature of the transfer behavior to be identified based on the resource transfer quantity set in the target time interval of the resource quantity time series, and obtain the behavior quantity time series feature of the transfer behavior to be identified based on the behavior quantity time series in the target interval; and determine the resource quantity time series feature and the behavior quantity time series feature as the third type of feature of the transfer behavior to be identified.

[0257] In an exemplary embodiment, the anomaly feature determination module 1206 is further configured to obtain, based on the resource transfer quantity set within the target time interval, a predicted value of the resource transfer quantity, an upper limit threshold of the resource transfer quantity, and a lower limit threshold of the resource transfer quantity corresponding to the target time interval; and to obtain the resource quantity time series feature of the transfer behavior to be identified based on the resource transfer quantity, the predicted value of the resource transfer quantity, the upper limit threshold of the resource transfer quantity, and the lower limit threshold of the resource transfer quantity.

[0258] In an exemplary embodiment, the anomaly feature determination module 1206 is further configured to obtain, based on the number of behaviors in the target time interval, a predicted value of the number of behaviors, an upper limit threshold of the number of behaviors, and a lower limit threshold of the number of behaviors corresponding to the target time interval; and to obtain the temporal features of the number of behaviors of the transfer behavior to be identified based on the total number of transfer behaviors, the predicted value of the number of behaviors, the upper limit threshold of the number of behaviors, and the lower limit threshold of the number of behaviors in the time interval where the transfer behavior to be identified is located.

[0259] Based on the same inventive concept, this application also provides an abnormal resource transfer behavior recognition model training device for implementing the above-mentioned abnormal resource transfer behavior recognition model training method. The solution provided by this device is similar to the solution described in the above method. Therefore, the specific limitations in one or more embodiments of the abnormal resource transfer behavior recognition model training device provided below can be found in the limitations of the abnormal resource transfer behavior recognition model training method described above, and will not be repeated here.

[0260] In one exemplary embodiment, such as Figure 13 As shown, an abnormal resource transfer behavior recognition model training device is provided, including: a sample feature acquisition module 1302 and a recognition model training module 1304, wherein:

[0261] The sample feature acquisition module 1302 is used to acquire the first type of sample features, the second type of sample features, and the third type of sample features of the transfer behavior sample based on the behavioral features of the transfer behavior sample. The first type of sample features characterizes the similarity between the transfer behavior sample and the abnormal transfer behavior sample in the transfer behavior sample. The second type of sample features characterizes the degree of abnormality of the transfer behavior sample in the feature dimension. The third type of sample features characterizes the degree of abnormality of the transfer behavior sample in the time dimension.

[0262] The identification model training module 1304 is used to train the abnormal resource transfer behavior identification model to be trained based on the first type of sample features, the second type of sample features, and the third type of sample features, so as to obtain the trained abnormal resource transfer behavior identification model; the trained abnormal resource transfer behavior identification model is the pre-trained abnormal resource transfer behavior identification model in the above-mentioned abnormal resource transfer behavior identification method.

[0263] In an exemplary embodiment, the abnormal resource transfer behavior recognition model training device further includes a sample oversampling module, which is used to oversample the abnormal transfer behavior samples in the transfer behavior samples to obtain new abnormal transfer behavior samples; and to combine the new abnormal transfer behavior samples and the normal transfer behavior samples in the transfer behavior samples to form a transfer behavior sample.

[0264] Each module in the aforementioned abnormal resource transfer behavior identification device and abnormal resource transfer behavior identification model training device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module. In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 14As shown, the computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores data such as transfer behaviors to be identified and transfer behavior samples. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements an abnormal resource transfer behavior identification method and an abnormal resource transfer behavior identification model training method.

[0265] Those skilled in the art will understand that Figure 14 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0266] In one exemplary embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0267] In one exemplary embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above-described method embodiments.

[0268] In one exemplary embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above-described method embodiments.

[0269] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0270] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0271] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for identifying abnormal resource transfer behavior, characterized in that, The method includes: The process involves acquiring the first behavioral feature of the transfer behavior to be identified, the second behavioral feature of the abnormal transfer behavior sample, and the third behavioral feature of the historical transfer behavior sample received by the resource receiving object of the transfer behavior to be identified; the transfer behavior to be identified is a transfer behavior of pre-funded resources. Based on the first behavioral feature and the second behavioral feature, a first type of feature is determined for the transfer behavior to be identified; the first type of feature characterizes the degree of similarity between the transfer behavior to be identified and the abnormal transfer behavior sample. Based on the first behavioral feature and the third behavioral feature, a second type of feature and a third type of feature of the transfer behavior to be identified are determined; the second type of feature characterizes the degree of abnormality of the transfer behavior to be identified in the feature dimension, and the third type of feature characterizes the degree of abnormality of the transfer behavior to be identified in the time dimension; Based on the first type of features, the second type of features, the third type of features, and the pre-trained abnormal resource transfer behavior identification model, the identification result for the transfer behavior to be identified is determined. The step of determining the second type of feature of the transfer behavior to be identified based on the first behavioral feature and the third behavioral feature includes: Based on the first behavioral feature and the third behavioral feature of the historical transfer behavior sample, the first sub-feature of the transfer behavior to be identified under the first type of feature is determined; From the historical transfer behavior samples, normal transfer behavior samples are identified. Based on the first behavior feature and the third behavior feature of the normal transfer behavior samples, the second sub-feature of the transfer behavior to be identified under the first type of feature is determined. The first sub-feature and the second sub-feature are determined as the second type of features of the transfer behavior to be identified.

2. The method according to claim 1, characterized in that, The step of determining the first type of feature of the transfer behavior to be identified based on the first behavioral feature and the second behavioral feature includes: Based on the first behavioral feature and the second behavioral feature, a knowledge graph of transfer behavior is constructed; Based on the knowledge graph of the transfer behavior, the distance between the transfer to be identified and the abnormal transfer behavior sample is obtained, as well as the number of neighbor nodes between the transfer to be identified and the abnormal transfer behavior sample. From the distances mentioned, a target distance that meets the preset conditions is determined; The target distance and the number of neighboring nodes are determined as the first type of features of the transfer behavior to be identified.

3. The method according to claim 2, characterized in that, The step of obtaining the distance between the transfer to be identified and the abnormal transfer behavior sample based on the transfer behavior knowledge graph includes: In the knowledge graph of transfer behavior, the path between the transfer behavior to be identified and the abnormal transfer behavior sample is determined; The distance between the transfer behavior to be identified and the abnormal transfer behavior sample is obtained by calculating the weights along the path. Determining the target distance that meets the preset conditions from the distances includes: From the distances, the distances whose corresponding values ​​are less than the values ​​of the other distances are identified as the target distances that meet the preset conditions.

4. The method according to claim 1, characterized in that, The step of determining the first sub-feature of the transfer behavior to be identified under the first type of feature based on the first behavioral feature and the third behavioral feature of the historical transfer behavior sample includes: Based on the third behavioral feature of the historical transfer behavior samples, an isolated forest corresponding to the resource receiving object is constructed; the isolated forest includes multiple trees, each tree is obtained based on a historical transfer behavior sample received by the resource receiving object in the past, and the historical transfer behavior sample includes normal transfer behavior samples and abnormal transfer behavior samples; Based on the first behavioral feature, the transfer behavior to be identified is descended along the path of each tree in the isolated forest to obtain the path length that the transfer behavior to be identified can match on each tree; The average value of each path length is obtained, and based on the average value, the first sub-feature of the transfer behavior to be identified under the first type of feature is obtained.

5. The method according to claim 1, characterized in that, The step of determining the second sub-feature of the transfer behavior to be identified under the first type of feature based on the first behavioral feature and the third behavioral feature of the normal transfer behavior sample includes: An autoencoder is trained based on the third behavioral features of the normal transfer behavior samples. The autoencoder is used to reconstruct the transfer behavior to be identified, thereby obtaining the reconstructed behavior of the transfer behavior to be identified. Based on the error between the reconstruction behavior and the transfer behavior to be identified, a second sub-feature of the transfer behavior to be identified under the first type of feature is obtained.

6. The method according to claim 1, characterized in that, The third type of feature is obtained in the following manner: Based on the third behavioral feature of the historical transfer behavior sample, the resource quantity time series and behavior quantity time series of the transfer behavior sample are obtained; the resource quantity time series is composed of the resource transfer quantity of the transfer behavior sample in multiple preset time intervals, and the behavior quantity time series is composed of the behavior quantity of the transfer behavior sample in multiple preset time intervals. Determine the target time interval corresponding to the transfer behavior to be identified under the resource quantity time series or the behavior quantity time series; Based on the resource quantity time series within the target time interval, the resource quantity time series feature of the transfer behavior to be identified is obtained, and based on the behavior quantity time series within the target time interval, the behavior quantity time series feature of the transfer behavior to be identified is obtained. The time-series characteristics of the resource quantity and the time-series characteristics of the behavior quantity are determined as the third type of characteristics of the transfer behavior to be identified.

7. The method according to claim 6, characterized in that, The process of obtaining the resource quantity time-series features of the transfer behavior to be identified based on the resource quantity time series within the target time interval includes: Based on the resource quantity time series within the target time interval, the predicted value of resource transfer quantity, the upper limit threshold of resource transfer quantity, and the lower limit threshold of resource transfer quantity corresponding to the target time interval are obtained. Based on the resource transfer quantity of the transfer behavior to be identified, the predicted value of the resource transfer quantity, the upper limit threshold of the resource transfer quantity, and the lower limit threshold of the resource transfer quantity, the time-series characteristics of the resource quantity of the transfer behavior to be identified are obtained.

8. The method according to claim 6, characterized in that, The step of obtaining the temporal feature of the number of behaviors to be identified based on the number of behaviors within the target time interval according to the time series of the behavior count includes: Based on the number of behaviors in the target time interval according to the behavior quantity time series, the predicted value of the behavior quantity, the upper limit threshold of the behavior quantity, and the lower limit threshold of the behavior quantity corresponding to the target time interval are obtained. Based on the total number of transfer behaviors within the time interval in which the transfer behavior to be identified occurs, the predicted value of the number of behaviors, the upper limit threshold of the number of behaviors, and the lower limit threshold of the number of behaviors, the temporal characteristics of the number of transfer behaviors to be identified are obtained.

9. A training method for an abnormal resource transfer behavior recognition model, characterized in that, The method includes: The first type of sample features, the second type of sample features, and the third type of sample features of the transfer behavior sample are obtained. The first type of sample features characterize the similarity between the transfer behavior sample and the abnormal transfer behavior sample in the transfer behavior sample. The second type of sample features characterize the abnormality of the transfer behavior sample in the feature dimension. The third type of sample features characterize the abnormality of the transfer behavior sample in the time dimension. Based on the first type of sample features, the second type of sample features, and the third type of sample features, the abnormal resource transfer behavior recognition model to be trained is trained to obtain the trained abnormal resource transfer behavior recognition model; the trained abnormal resource transfer behavior recognition model is the pre-trained abnormal resource transfer behavior recognition model in the method of any one of claims 1 to 8.

10. The method according to claim 9, characterized in that, Before training the abnormal resource transfer behavior recognition model based on the first type of sample features, the second type of sample features, and the third type of sample features, the training also includes: Oversampling is performed on the abnormal transfer behavior samples in the transfer behavior samples to obtain new abnormal transfer behavior samples; The new abnormal transfer behavior sample and the normal transfer behavior sample in the transfer behavior sample are combined to form the transfer behavior sample.

11. A device for identifying abnormal resource transfer behavior, characterized in that, The device includes: The behavior feature acquisition module is used to acquire the first behavior feature of the transfer behavior to be identified, the second behavior feature of the abnormal transfer behavior sample, and the third behavior feature of the historical transfer behavior sample received by the resource receiving object of the transfer behavior to be identified; the transfer behavior to be identified is the transfer behavior of pre-funded resources. A similarity feature determination module is used to determine a first type of feature of the transfer behavior to be identified based on the first behavioral feature and the second behavioral feature; the first type of feature characterizes the degree of similarity between the transfer behavior to be identified and the abnormal transfer behavior sample; An abnormal feature determination module is used to determine a second type of feature and a third type of feature of the transfer behavior to be identified based on the first behavioral feature and the third behavioral feature; the second type of feature characterizes the degree of abnormality of the transfer behavior to be identified in the feature dimension, and the third type of feature characterizes the degree of abnormality of the transfer behavior to be identified in the time dimension; The identification result determination module is used to determine the identification result for the transfer behavior to be identified based on the first type of features, the second type of features, the third type of features and the pre-trained abnormal resource transfer behavior identification model; The abnormal feature determination module is further configured to determine, based on the first behavioral feature and the third behavioral feature of the historical transfer behavior sample, a first sub-feature of the transfer behavior to be identified under the first type of feature; determine normal transfer behavior samples from the historical transfer behavior samples; determine, based on the first behavioral feature and the third behavioral feature of the normal transfer behavior sample, a second sub-feature of the transfer behavior to be identified under the first type of feature; and determine the first sub-feature and the second sub-feature as the second type of feature of the transfer behavior to be identified.

12. A training device for an abnormal resource transfer behavior recognition model, characterized in that, The device includes: The sample feature acquisition module is used to acquire a first type of sample feature, a second type of sample feature, and a third type of sample feature of the transfer behavior sample; the first type of sample feature represents the similarity between the transfer behavior sample and the abnormal transfer behavior sample in the transfer behavior sample, the second type of sample feature represents the abnormality of the transfer behavior sample in the feature dimension, and the third type of sample feature represents the abnormality of the transfer behavior sample in the time dimension. The identification model training module is used to train the abnormal resource transfer behavior identification model to be trained based on the first type of sample features, the second type of sample features, and the third type of sample features, to obtain the trained abnormal resource transfer behavior identification model; the trained abnormal resource transfer behavior identification model is the pre-trained abnormal resource transfer behavior identification model in the method of any one of claims 1 to 9.

13. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the abnormal resource transfer behavior identification method according to any one of claims 1 to 8, or the steps of the abnormal resource transfer behavior identification model training method according to any one of claims 9 to 10.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the abnormal resource transfer behavior identification method according to any one of claims 1 to 8, or the steps of the abnormal resource transfer behavior identification model training method according to any one of claims 9 to 10.

15. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the abnormal resource transfer behavior identification method according to any one of claims 1 to 8, or the steps of the abnormal resource transfer behavior identification model training method according to any one of claims 9 to 10.

Images