A method and related device for processing characteristic value transfer events

Abstract

Embodiments of the present application disclose a feature value transfer event processing method and related device, which are applied to artificial intelligence scenarios or vehicle-mounted scenarios. In the execution process of a target feature value transfer event in which a first account transfers a feature value to a second account, a target event feature of the target feature value transfer event is predicted for risk, to obtain a first target risk level of the target feature value transfer event; when the first target risk level is lower than a preset risk level, diffusion is performed through the first account, the second account and a preset association mode, to obtain an associated feature value transfer event with a higher risk level; similarity calculation is performed on the target event feature and an associated event feature of the associated feature value transfer event, to obtain a similarity; when the similarity is greater than or equal to a preset similarity, the first target risk level is updated to a second target risk level with a higher risk level. The method can improve the accuracy of the risk level of the obtained feature value transfer event, thereby improving the accuracy of the countermeasure.

Description

Technical Field

[0001] The present application relates to the field of data processing, and in particular to a method and related device for processing eigenvalue transfer events. Background Art

[0002] As the fight against abnormal feature value transfer events grows, abnormal accounts tend to use normal accounts to perform abnormal feature value transfer events. Since abnormal accounts aren't used directly, normal accounts perform more normal feature value transfer events and fewer abnormal feature value transfer events. Consequently, the number of abnormal features is reduced, making abnormal feature value transfer events more concealed and more difficult to combat, resulting in a lower probability of abnormal feature value transfer events being predicted as risks.

[0003] In the related art, for the above situation, usually during the execution of any eigenvalue transfer event, the event characteristics of the eigenvalue transfer event are collected, the risk of the event characteristics is predicted, and the risk level of the eigenvalue transfer event is obtained, so as to carry out corresponding countermeasures against the eigenvalue transfer event according to the risk level.

[0004] However, the above method relies on the event characteristics of the characteristic value transfer event. For the situation where the abnormal account rents a normal account to perform the abnormal characteristic value transfer event, the event characteristic coverage of the characteristic value transfer event is insufficient, and the normal account cannot be associated with the abnormal account, or the data information of the abnormal account cannot be obtained, etc., resulting in a decrease in the accuracy of the risk level of the obtained characteristic value transfer event, thereby reducing the accuracy of the confrontation. Summary of the Invention

[0005] In order to solve the above technical problems, the present application provides a method and related device for processing characteristic value transfer events. For the situation where an abnormal account rents a normal account to perform an abnormal characteristic value transfer event, the risk level accuracy of the obtained characteristic value transfer event can be improved, thereby improving the accuracy of the confrontation.

[0006] The embodiments of this application disclose the following technical solutions:

[0007] In one aspect, the present application provides a method for processing a feature value transfer event, the method comprising:

[0008] During the execution of a target feature value transfer event, risk prediction is performed based on target event features of the target feature value transfer event to obtain a first target risk level of the target feature value transfer event; the target feature value transfer event indicates that a feature value of a first account is transferred to a second account;

[0009] If the first target risk level is lower than a preset risk level, diffusion is performed based on the first account, the second account, and a preset association pattern to obtain an associated characteristic value transfer event of the target characteristic value transfer event; the associated risk level of the associated characteristic value transfer event is higher than the first target risk level;

[0010] Calculating similarity based on the target event feature and the associated event feature of the associated feature value transfer event to obtain the similarity between the target feature value transfer event and the associated feature value transfer event;

[0011] If the similarity is greater than or equal to a preset similarity, the first target risk level is updated to a second target risk level; the second target risk level is higher than the first target risk level.

[0012] On the other hand, the present application provides a device for processing a feature value transfer event, the device comprising: a prediction unit, a diffusion unit, a calculation unit, and an update unit;

[0013] The prediction unit is configured to perform risk prediction based on the target event characteristics of the target feature value transfer event during the execution of the target feature value transfer event to obtain a first target risk level of the target feature value transfer event; the target feature value transfer event indicates that the feature value of the first account is transferred to the second account;

[0014] The diffusion unit is configured to, if the first target risk level is lower than a preset risk level, perform diffusion based on the first account, the second account, and a preset association pattern to obtain an associated characteristic value transfer event of the target characteristic value transfer event; the associated risk level of the associated characteristic value transfer event is higher than the first target risk level;

[0015] The calculation unit is configured to perform similarity calculation based on the target event feature and the associated event feature of the associated feature value transfer event to obtain the similarity between the target feature value transfer event and the associated feature value transfer event;

[0016] The updating unit is configured to update the first target risk level to a second target risk level if the similarity is greater than or equal to a preset similarity; the second target risk level is higher than the first target risk level.

[0017] On the other hand, the present application provides a device for processing a feature value transfer event, the device comprising a processor and a memory:

[0018] The memory is used to store program code and transmit the program code to the processor;

[0019] The processor is configured to execute the method for processing a characteristic value transfer event according to the instructions in the program code.

[0020] On the other hand, an embodiment of the present application provides a computer-readable storage medium, which is used to store a computer program. When the computer program is executed by a processor, it executes the method for processing the characteristic value transfer event described in the above aspect.

[0021] On the other hand, an embodiment of the present application provides a computer program product, which includes a computer program or instructions; when the computer program or instructions are executed by a processor, the method for processing the characteristic value transfer event described in the above aspect is executed.

[0022] It can be seen from the above technical solution that during the execution of the target characteristic value transfer event of transferring the characteristic value from the first account to the second account, the target event characteristics of the target characteristic value transfer event are risk predicted to obtain the first target risk level of the target characteristic value transfer event; when the first target risk level is lower than the preset risk level, it is diffused through the first account, the second account and the preset association pattern to obtain an associated characteristic value transfer event with a higher risk level; the similarity between the target event characteristics and the associated event characteristics of the associated characteristic value transfer event is calculated to obtain the similarity; when the similarity is greater than or equal to the preset similarity, the first target risk level is updated to the second target risk level with a higher risk level.

[0023] It can be seen that after the risk prediction obtains the first target risk level of the medium-low risk level based on the target event characteristics of the target eigenvalue transfer event, the diffusion of the eigenvalue transfer event is introduced through the preset association pattern, and the associated eigenvalue transfer events of higher risk levels are mined to make up for the insufficient coverage of the target event characteristics; when the target eigenvalue transfer event and the associated eigenvalue transfer event are relatively similar, the first target risk level is increased to a more accurate second target risk level. Based on this, this method can improve the accuracy of the risk level of the obtained eigenvalue transfer event in the case where an abnormal account rents a normal account to execute an abnormal eigenvalue transfer event, thereby improving the accuracy of the confrontation. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0025] Figure 1A schematic diagram of an application scenario of a method for processing a feature value transfer event provided in an embodiment of the present application;

[0026] Figure 2 A flowchart of a method for processing a feature value transfer event provided in an embodiment of the present application;

[0027] Figure 3 A schematic diagram of a risk level prediction provided in an embodiment of the present application;

[0028] Figure 4 A schematic diagram of a same-account association mode and a same-environment association mode based on a first account provided in an embodiment of the present application;

[0029] Figure 5 A schematic diagram of a same-account association mode and a same-environment association mode based on a second account provided in an embodiment of the present application;

[0030] Figure 6 A schematic diagram of obtaining an associated eigenvalue transfer event of a target eigenvalue transfer event provided in an embodiment of the present application;

[0031] Figure 7 A schematic diagram of constructing an associated feature vector for an associated feature value transfer event provided in an embodiment of the present application;

[0032] Figure 8 A schematic diagram of prompting risk levels during the execution of a target feature value transfer event provided in an embodiment of the present application;

[0033] Figure 9 A schematic diagram of a device for processing a feature value transfer event provided in an embodiment of the present application;

[0034] Figure 10 A schematic diagram of the structure of a server provided in an embodiment of the present application;

[0035] Figure 11 A schematic diagram of the structure of a terminal device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0036] The embodiments of the present application are described below with reference to the accompanying drawings.

[0037] Currently, there are increasing cases of abnormal accounts using normal accounts to execute abnormal feature value transfer events. For example, a normal account helps an abnormal account receive feature values ​​and then transfers them to the abnormal account. To address this situation, during the execution of any feature value transfer event, the event characteristics of the feature value transfer event are generally collected, and risk prediction is performed on these event characteristics to determine the risk level of the feature value transfer event, so that corresponding countermeasures can be taken against the feature value transfer event according to the risk level.

[0038] After research, it was found that the above method relies on the event characteristics of the characteristic value transfer event. For the situation where the abnormal account rents the normal account to perform the abnormal characteristic value transfer event, the event characteristic coverage of the characteristic value transfer event is insufficient, and the normal account and the abnormal account cannot be associated, or the data information of the abnormal account cannot be obtained, etc., resulting in a decrease in the accuracy of the risk level of the obtained characteristic value transfer event, thereby reducing the accuracy of the confrontation.

[0039] In view of this, the present application proposes a method and related device for processing characteristic value transfer events. After risk prediction obtains a first target risk level of medium and low risk levels based on the target event characteristics of the target characteristic value transfer event, the diffusion of characteristic value transfer events is introduced through a preset association pattern, and associated characteristic value transfer events of higher risk levels are mined to make up for the insufficient coverage of the target event characteristics. When the target characteristic value transfer event and the associated characteristic value transfer event are relatively similar, the first target risk level is increased to a more accurate second target risk level. Based on this, this method can improve the accuracy of the risk level of the obtained characteristic value transfer event in the case where an abnormal account rents a normal account to execute an abnormal characteristic value transfer event, thereby improving the accuracy of the confrontation.

[0040] In order to facilitate understanding of the technical solution of the present application, the following describes a method for processing a feature value transfer event provided in an embodiment of the present application in combination with actual application scenarios.

[0041] See also Figure 1 , Figure 1 A schematic diagram of an application scenario of a method for processing a feature value transfer event provided in an embodiment of the present application. Figure 1 The application scenario shown includes a terminal device 101, a server 102, and a terminal device 103. For a target characteristic value transfer event in which a characteristic value is transferred from a first account to a second account, the terminal device 101 serves as a user device for the first account, the terminal device 103 serves as a user device for the second account, and the server 102 serves as a processing device for the characteristic value transfer event.

[0042] During the execution of the target characteristic value transfer event, the server 102 performs risk prediction based on the target event characteristics of the target characteristic value transfer event to obtain the first target risk level of the target characteristic value transfer event; the target characteristic value transfer event indicates that the characteristic value is transferred from the first account of the terminal device 101 to the second account of the terminal device 103. As an example, the first account is "Account A", the second account is "Account B", and the characteristic value is "X yuan", that is, during the execution of the target characteristic value transfer event of transferring "X yuan" from "Account A" to "Account B", the server 102 can collect the target event characteristics of the target characteristic value transfer event for risk prediction. The target event characteristics include, for example, the transfer characteristics and account characteristics of the target characteristic value transfer event, so as to obtain the first target risk level of the target characteristic value transfer event as "target risk level 1".

[0043] If the first target risk level is lower than the preset risk level, the server 102 diffuses the event based on the first account, the second account, and the preset association pattern to obtain an associated characteristic value transfer event of the target characteristic value transfer event; the associated risk level of the associated characteristic value transfer event is higher than the first target risk level. As an example, the preset risk level is an unremovable interception level, and the preset association pattern includes a same account association pattern and a same environment association pattern. Based on the above example, when "target risk level 1" is a reminder level or a removable interception level, the server 102 can diffuse the event through "account A", the same account association pattern, and the same environment association pattern to obtain a first characteristic value transfer event of a higher risk level; and diffuse the event through "account B", the same account association pattern, and the same environment association pattern to obtain a second characteristic value transfer event of a higher risk level; and determine the first characteristic value transfer event and the second characteristic value transfer event as associated characteristic value transfer events.

[0044] Among them, the associated risk level of the associated characteristic value transfer event is "associated risk level y". When "target risk level 1" is the warning level, "associated risk level y" is the releasable interception level or the non-releasable interception level; when "target risk level 1" is the releasable interception level, "associated risk level y" is the non-releasable interception level.

[0045] Server 102 performs a similarity calculation based on the target event features and the associated event features of the associated feature value transfer event to obtain the similarity between the target feature value transfer event and the associated feature value transfer event. As an example, based on the above example, the associated event features include, for example, the transfer features and account features of the associated feature value transfer event. Server 102 may perform a similarity calculation on the target event features and the associated event features of the associated feature value transfer event to obtain a similarity "similarity a1" between the target feature value transfer event and the associated feature value transfer event.

[0046] If the similarity is greater than or equal to the preset similarity, server 102 updates the first target risk level to a second target risk level; the second target risk level is higher than the first target risk level. As an example, the preset similarity is "similarity a." Based on the above example, if "similarity a1" is greater than or equal to "similarity a," server 102 may update "target risk level 1" to "target risk level 2," a higher risk level.

[0047] Among them, "Target Risk Level 1" is the reminder level, and when "Associated Risk Level y" is the removable interception level, "Target Risk Level 2" is the removable interception level; "Target Risk Level 1" is the reminder level, and when "Associated Risk Level y" is the non-removable interception level, "Target Risk Level 2" is the non-removable interception level; when "Target Risk Level 1" is the removable interception level, "Target Risk Level 2" is the non-removable interception level.

[0048] It can be seen that after the server 102 relies on the target event characteristics of the target characteristic value transfer event and predicts the first target risk level of the medium and low risk level, it introduces the diffusion of the characteristic value transfer event through the preset association mode, and mines the associated characteristic value transfer events of higher risk levels to make up for the insufficient coverage of the target event characteristics; when the target characteristic value transfer event and the associated characteristic value transfer event are relatively similar, the first target risk level is increased to a more accurate second target risk level, so that the more accurate second target risk level can be prompted to the first account through the terminal device 101 later, and the target characteristic value transfer event is confronted accordingly according to the more accurate second target risk level. Based on this, this method can improve the accuracy of the risk level of the obtained characteristic value transfer event in the case where an abnormal account rents a normal account to execute an abnormal characteristic value transfer event, thereby improving the accuracy of the confrontation.

[0049] The method for processing characteristic value transfer events provided in this application can be applied to processing devices for characteristic value transfer events with data processing capabilities, such as servers and terminal devices. Among them, the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services, etc., but is not limited to this; terminal devices include but are not limited to mobile phones, tablets, computers, computers, smart cameras, smart voice interaction devices, smart home appliances, vehicle-mounted terminals, aircraft, etc., but are not limited to this. Terminal devices and servers can be directly or indirectly connected through wired or wireless communication, and this application does not limit this.

[0050] The method for processing eigenvalue transfer events provided in this application can be applied to various scenarios, including but not limited to cloud technology, artificial intelligence, in-vehicle scenarios, smart transportation, assisted driving, etc.

[0051] The following describes in detail the method for processing a characteristic value transfer event provided in an embodiment of the present application, using a server as a device for processing the characteristic value transfer event.

[0052] See also Figure 2 , which is a flow chart of a method for processing a feature value transfer event provided by an embodiment of the present application. Figure 2 As shown, the method for processing the characteristic value transfer event includes the following steps:

[0053] S201: During the execution of a target characteristic value transfer event, risk prediction is performed based on target event characteristics of the target characteristic value transfer event to obtain a first target risk level of the target characteristic value transfer event; the target characteristic value transfer event indicates that a first account transfers a characteristic value to a second account.

[0054] In an embodiment of the present application, a characteristic value transfer event in which a characteristic value is transferred from any first account to a second account is taken as a target characteristic value transfer event. During the execution of the target characteristic value transfer event, the transfer characteristics and account characteristics of the target characteristic value transfer event can be collected from multiple characteristic dimensions as the target event characteristics of the target characteristic value transfer event. The target event characteristics are risk predicted to obtain the risk level of the target characteristic value transfer event as the first target risk level of the target characteristic value transfer event.

[0055] When S201 is specifically implemented, the risk prediction model obtained by training the preset model can be firstly obtained by using the normal event features and normal label data of the normal feature value transfer event, and the abnormal event features and risk label data of the abnormal feature value transfer event, and then risk prediction is performed on the target event features of the target feature value transfer event to obtain risk prediction data, which serves as the target risk prediction data of the target feature value transfer event; then, the risk level corresponding to the target risk prediction data is determined through the data intervals corresponding to each risk level, which serves as the first target risk level of the target feature value transfer event. Therefore, the present application provides a possible implementation method, and S201 can, for example, include the following S2011-S2012:

[0056] S2011: Perform risk prediction on target event characteristics through a risk prediction model to obtain target risk prediction data for target feature value transfer events; the risk prediction model is obtained by training a preset model based on normal event characteristics and normal label data of normal feature value transfer events, and abnormal event characteristics and risk label data of abnormal feature value transfer events.

[0057] The training process of the risk prediction model comprises the following steps: first, obtaining training samples for training the preset model, i.e., normal event features and normal label data of the normal feature value transition event, and abnormal event features and risk label data of the abnormal feature value transition event; second, inputting the normal event features into the preset model for risk prediction, and outputting first risk prediction data of the normal feature value transition event; and inputting the abnormal event features into the preset model for risk prediction, and outputting second risk prediction data of the abnormal feature value transition event; third, determining whether the first risk prediction data matches the normal label data, and determining whether the second risk prediction data matches the risk label data; if not, it indicates that the risk prediction capability of the preset model does not reach the training target, and the model parameters of the preset model need to be iteratively trained through the loss function of the preset model until a preset iteration number or preset model convergence is reached; and finally, determining the trained preset model as the risk prediction model. Therefore, the present application provides a possible implementation manner, and the training steps of the risk prediction model comprise the following S1-S4:

[0058] S1: obtaining normal event features and normal label data, and abnormal event features and risk label data.

[0059] S2: inputting the normal event features and the abnormal event features into the preset model for risk prediction, and outputting first risk prediction data of the normal feature value transition event and second risk prediction data of the abnormal feature value transition event.

[0060] S3: if the first risk prediction data does not match the normal label data, or the second risk prediction data does not match the risk label data, iteratively training the model parameters of the preset model through the loss function of the preset model.

[0061] S4: determining the trained preset model as the risk prediction model.

[0062] S2012: determining a first target risk level according to the target risk prediction data and data intervals corresponding to respective risk levels.

[0063] The respective risk levels may comprise, for example, a reminding level, a resolvable interception level and a non-resolvable interception level. The reminding level represents a low risk level requiring reminding intervention, the resolvable interception level represents a medium risk level requiring resolvable interception intervention, and the non-resolvable interception level represents a high risk level requiring non-resolvable interception intervention.

[0064] For S201, as an example, refer to Figure 3A schematic diagram of a predicted risk level is shown. During the execution of a target characteristic value transfer event in which a characteristic value is transferred from a first account to a second account, the target characteristic value transfer event is firstly collected from multiple characteristic dimensions, such as the protection angle of the first account (payer), the malicious angle of the second account (payee), and the untrustworthy angle, as target event features of the target characteristic value transfer event, namely, payment communication features, payment behavior features, payment and collection relationship features, payment payment features, payee features, and payment identity tags; then, the target event features are risk predicted using a risk prediction model to obtain target risk prediction data for the target characteristic value transfer event; finally, the risk level corresponding to the target risk prediction data is determined through the data intervals corresponding to the reminder level, the releasable interception level, and the non-releasable interception level, as the first target risk level of the target characteristic value transfer event.

[0065] Among them, the risk prediction of the target event characteristics is performed through the risk prediction model to obtain the target risk prediction data of the target feature value transfer event. For example, the communication anomaly prediction model in the risk prediction model can be used to perform communication anomaly prediction on the payment communication characteristics and payment behavior characteristics to obtain communication anomaly prediction data; and the transfer anomaly prediction model in the risk prediction model can be used to perform transfer anomaly prediction on the payment-collection relationship characteristics, payment characteristics and payee characteristics to obtain transfer anomaly prediction data; and the communication anomaly prediction data, transfer anomaly prediction data and payment identity label are risk predicted to obtain the target risk prediction data of the target feature value transfer event.

[0066] Among them, payment communication labels may include, for example, communication labels with unknown accounts, communication labels with high-risk accounts, and communication labels with low-quality accounts; payment behavior characteristics may include, for example, adding friends, noting friends, and group behavior; payment relationship characteristics may include, for example, payment days, historical payment amounts, and friend days; payment payment characteristics may include, for example, abnormal large payments, abnormal scenario payments, and multiple consecutive payments; payee characteristics may include, for example, account quality, account blacklisting behavior, and account adding friends behavior.

[0067] S202: If the first target risk level is lower than the preset risk level, diffusion is performed according to the first account, the second account and the preset association mode to obtain an associated characteristic value transfer event of the target characteristic value transfer event; the associated risk level of the associated characteristic value transfer event is higher than the first target risk level.

[0068] Since S201 relies on the target event characteristics of the target characteristic value transfer event, for the case where an abnormal account rents a normal account to execute an abnormal characteristic value transfer event, the target event characteristic coverage of the target characteristic value transfer event is insufficient, and the normal account cannot be associated with the abnormal account, or the data information of the abnormal account cannot be obtained, etc., resulting in a decrease in the accuracy of the first target risk level of the obtained target characteristic value transfer event, thereby reducing the accuracy of the confrontation.

[0069] Therefore, in an embodiment of the present application, in order to make up for the insufficient coverage of the target event features, when the first target risk level of the target characteristic value transfer event is lower than the preset risk level, indicating that the first target risk level of the target characteristic value transfer event is a medium-low risk level, the target characteristic value transfer event of transferring the characteristic value from the first account to the second account can be based on the target characteristic value transfer event, and the diffusion of the characteristic value transfer event can be introduced through the preset association pattern to mine associated characteristic value transfer events with higher risk levels; that is, the associated risk level of the associated characteristic value transfer event is higher than the first target risk level of the target characteristic value transfer event.

[0070] Among them, on the basis that the above-mentioned various risk levels include the reminder level, the releasable interception level and the non-releasable interception level, the preset risk level represents the highest risk level, that is, the preset risk level is the non-releasable interception level, then the first target risk level is lower than the preset risk level. For example, it can be specifically: the first target risk level is the reminder level or the releasable interception level. Based on this, the present application provides a possible implementation method, when the first target risk level is the reminder level, the associated risk level is the releasable interception level or the non-releasable interception level; when the first target risk level is the releasable interception level, the associated risk level is the non-releasable interception level.

[0071] Among them, diffusion refers to searching for characteristic value transfer events associated with the first account and characteristic value transfer events associated with the second account based on the target characteristic value transfer event of transferring characteristic values ​​from the first account to the second account, so as to mine associated characteristic value transfer events with higher risk levels; that is, diffusion actually means associated search.

[0072] When S202 is specifically implemented, since the preset association pattern can introduce the diffusion of characteristic value transfer events, on the basis of the target characteristic value transfer event, the characteristic value transfer event can be diffused based on the same account or based on the same environment; therefore, the preset association pattern includes the same account association pattern and the same environment association pattern. Based on this, for the target characteristic value transfer event of transferring characteristic values ​​from the first account to the second account, first, it can be divided into diffusing the first account, the same account association pattern and the same environment association pattern to obtain a first characteristic value transfer event with a higher risk level, and diffusing the second account, the same account association pattern and the same environment association pattern to obtain a second characteristic value transfer event with a higher risk level; then, the first characteristic value transfer event and the second characteristic value transfer event are determined as associated characteristic value transfer events of the target characteristic value transfer event. That is, the present application provides a possible implementation method, the preset association pattern includes the same account association pattern and the same environment association pattern, and S202 can, for example, include the following S2021-S2023:

[0073] S2021: Diffusion is performed according to the first account, the same account association pattern, and the same environment association pattern to obtain a first eigenvalue transfer event associated with the target eigenvalue transfer event.

[0074] As an example, see Figure 4 The diagram shows a same account association mode and a same environment association mode based on a first account. Figure 4 (a) represents a target feature value transfer event for transferring feature values ​​from a first account to a second account. Based on the same account association pattern of the first account, a feature value transfer event for transferring feature values ​​from the first account to a third account is obtained as the first feature value transfer event. Figure 4 In (b), for the target characteristic value transfer event of transferring characteristic values ​​from the first account to the second account, based on the same environment association pattern of the first account, a characteristic value transfer event of transferring characteristic values ​​from the fourth account in the same environment as the first account to the fifth account is obtained, which is also regarded as the first characteristic value transfer event.

[0075] S2022: Diffusion is performed according to the second account, the same account association pattern, and the same environment association pattern to obtain a second eigenvalue transfer event associated with the target eigenvalue transfer event.

[0076] As an example, see Figure 5 The diagram shows a same account association mode and a same environment association mode based on a second account. Figure 5In (a), for the target feature value transfer event of transferring the feature value from the first account to the second account, based on the same account association mode of the second account, a feature value transfer event of transferring the feature value from the sixth account to the second account is obtained as the second feature value transfer event. Figure 5 In (b), for the target feature value transfer event of transferring the feature value from the first account to the second account, based on the same environment association mode of the second account, a feature value transfer event of transferring the feature value from the seventh account to the eighth account in the same environment as the second account is obtained as the second feature value transfer event.

[0077] S2023: Determine the associated feature value transfer event based on the first feature value transfer event and the second feature value transfer event.

[0078] For S2021-S2023, as an example, refer to Figure 6 The schematic diagram of obtaining the associated feature value transfer event of the target feature value transfer event is shown in FIG. 1. For the target feature value transfer event of transferring the feature value from the first account to the second account, by the first account, Figure 4 The first feature value transfer event 1, the first feature value transfer event 2, …, and the first feature value transfer event M are obtained by the same account association mode and the same environment association mode of the first account, as shown in FIG. 2; by the second account, Figure 5 The second feature value transfer event 1, the second feature value transfer event 2, …, and the second feature value transfer event N are obtained by the same account association mode and the same environment association mode of the second account, as shown in FIG. 3; and the first feature value transfer event 1, the first feature value transfer event 2, …, and the first feature value transfer event M, and the second feature value transfer event 1, the second feature value transfer event 2, …, and the second feature value transfer event N are determined as the associated feature value transfer event of the target feature value transfer event.

[0079] S203: Similarity calculation is performed according to the target event feature and the associated event feature of the associated feature value transfer event, to obtain the similarity of the target feature value transfer event and the associated feature value transfer event.

[0080] In an embodiment of the present application, after obtaining the associated characteristic value transfer event of the target characteristic value transfer event in S202, since the associated characteristic value transfer event of a higher risk level can make up for the insufficient coverage of the target event feature; therefore, it is also necessary to determine whether the target characteristic value transfer event is similar to the associated characteristic value transfer event. Based on this, referring to the target event feature of the target characteristic value transfer event in S201, the transfer features and account features of the associated characteristic value transfer event are also collected from multiple feature dimensions as the associated event features of the associated characteristic value transfer event; the target event features of the target characteristic value transfer event and the associated event features of the associated characteristic value transfer event are calculated for similarity to obtain the similarity between the target characteristic value transfer event and the associated characteristic value transfer event.

[0081] In the specific implementation of S203, the target feature vector of the target feature value transfer event can be constructed based on the target event features of the target feature value transfer event, and the associated feature vector of the associated feature value transfer event can be constructed based on the associated event features of the associated feature value transfer event; then, similarity calculation is performed based on the target feature vector and the associated feature vector to obtain the similarity between the target feature value transfer event and the associated feature value transfer event.

[0082] Among them, see Figure 7 A schematic diagram of constructing an associated feature vector for an associated feature value transfer event is shown. Referring to the example of S201, transfer features and account features of the associated feature value transfer event, namely, payment communication features, payment behavior features, payment relationship features, payment features, payee features, and payment identity tags, are collected as associated event features of the associated feature value transfer event. The associated event features are processed through encoding, binning, and normalization in feature engineering to construct an associated feature vector for the associated feature value transfer event.

[0083] As an example, the similarity can be calculated using the following formula:

[0084]

[0085] Wherein, T(A, B) represents the similarity between the target eigenvalue transfer event and the associated eigenvalue transfer event, A represents the target eigenvalue transfer event's target eigenvalue transfer vector, and B represents the associated eigenvalue transfer event's associated eigenvalue transfer vector.

[0086] In addition, when S203 is specifically implemented, for example, any one of the following three specific implementation methods may be adopted:

[0087] The first specific implementation method is that since the target event characteristics are constructed by collecting the transfer characteristics and account characteristics of the target feature value transfer event from multiple feature dimensions, and the associated event characteristics are constructed by collecting the transfer characteristics and account characteristics of the associated feature value transfer event from multiple feature dimensions; that is, the target event characteristics and the associated event characteristics both include characteristics of each dimension, and different dimensional characteristics have different degrees of influence on the calculation of the similarity between the target feature value transfer event and the associated feature value transfer event, it is necessary to determine the various weight coefficients corresponding to the various dimensional characteristics. Based on this, on the basis of the target event characteristics and the associated event characteristics, the similarity is calculated in combination with the various weight coefficients corresponding to the various dimensional characteristics to obtain the similarity between the target feature value transfer event and the associated feature value transfer event, so as to further improve the accuracy of the calculated similarity. Therefore, the present application provides a possible implementation method, and S203 may, for example, include the following S2031-S2032:

[0088] S2031: Determine the weight coefficients corresponding to the various dimensional features in the target event features and the associated event features.

[0089] S2032: Calculate similarity based on the target event features, the associated event features, and each weight coefficient to obtain similarity.

[0090] As an example, the similarity can be calculated using the following formula:

[0091]

[0092] Among them, T(A, B) represents the similarity between the target eigenvalue transfer event and the associated eigenvalue transfer event, A represents the target eigenvalue transfer event's target eigenvalue transfer event's target eigenvalue transfer event's target eigenvalue transfer event's target eigenvalue transfer event's associated event feature, and a i represents the i-th dimension feature in the target feature vector A, b i Represents the i-th dimension feature in the associated feature vector B.

[0093] The second specific implementation method is that since there is a time difference between the target execution time of the target eigenvalue transfer event and the interception execution time of the associated eigenvalue transfer event, the smaller the time difference is, the closer the target execution time of the target eigenvalue transfer event is to the interception execution time of the associated eigenvalue transfer event, and the greater the similarity probability between the target eigenvalue transfer event and the associated eigenvalue transfer event; conversely, the larger the time difference is, the smaller the similarity probability between the target eigenvalue transfer event and the associated eigenvalue transfer event. Based on this, first, a time decay coefficient can be introduced through the target execution time of the target eigenvalue transfer event and the interception execution time of the associated eigenvalue transfer event; then, based on the target event features and the associated event features, the time decay coefficient is combined to perform similarity calculation to obtain the similarity between the target eigenvalue transfer event and the associated eigenvalue transfer event, so as to further improve the accuracy of the calculated similarity. Therefore, the present application provides a possible implementation method, and S203 may, for example, include the following S2033-S2034:

[0094] S2033: Determine a time decay coefficient according to the target execution time of the target eigenvalue transfer event and the interception execution time of the associated eigenvalue transfer event.

[0095] S2034: Calculate similarity based on the target event feature, the associated event feature, and the time decay coefficient to obtain similarity.

[0096] As an example, the similarity can be calculated using the following formula:

[0097]

[0098] Among them, T(A, B) represents the similarity between the target eigenvalue transfer event and the associated eigenvalue transfer event, A represents the target eigenvalue transfer event's target eigenvalue transfer vector, B represents the associated eigenvalue transfer event's associated eigenvalue transfer vector, t A represents the target execution time of the target eigenvalue transfer event, t B represents the intercept execution time of the associated eigenvalue transfer event, and e represents a natural constant.

[0099] The third specific implementation method combines the first specific implementation method and the second specific implementation method above. Based on the target event characteristics and the associated event characteristics, not only the weight coefficients corresponding to the various dimensional features in the target event characteristics and the associated event characteristics are considered, but also the time decay coefficient is considered. A comprehensive similarity calculation is performed to obtain the similarity between the target feature value transfer event and the associated feature value transfer event, thereby further improving the accuracy of the similarity calculation. Therefore, this application provides a possible implementation method. For example, S203 may include the following S2035-S2037:

[0100] S2035: Determine each weight coefficient corresponding to each dimension feature in the target event feature and the associated event feature.

[0101] S2036: According to the target execution time of the target feature value transfer event and the interception execution time of the associated feature value transfer event, determine a time decay coefficient.

[0102] S2037: According to the target event feature, the associated event feature, each weight coefficient and the time decay coefficient, perform similarity calculation to obtain a similarity.

[0103] As an example, the following formula can be used for similarity calculation:

[0104]

[0105] Wherein, T(A, B) represents the similarity of the target feature value transfer event and the associated feature value transfer event, A represents the target feature vector of the target feature value transfer event, B represents the associated feature vector of the associated feature value transfer event, a i represents the i-th dimension feature in the target feature vector A, b i represents the i-th dimension feature in the associated feature vector B, t A represents the target execution time of the target feature value transfer event, t B represents the interception execution time of the associated feature value transfer event, and e represents a natural constant.

[0106] S204: If the similarity is greater than or equal to a preset similarity, update the first target risk level to a second target risk level; the second target risk level is higher than the first target risk level.

[0107] In the embodiment of the present application, after obtaining the similarity of the target feature value transfer event and the associated feature value transfer event in S204, a similarity lower limit value representing similarity is preset as a preset similarity, and it is judged that the obtained similarity is greater than or equal to the preset similarity, indicating that the target feature value transfer event is similar to the associated feature value transfer event with a higher risk level; At this time, it is necessary to improve the first target risk level of the target feature value transfer event to a higher risk level to obtain the second target risk level of the target feature value transfer event; That is, the first target risk level of the target feature value transfer event is updated to the second target risk level. This way, for the case of abnormal account renting normal account executing abnormal feature value transfer event, the accuracy of the risk level of the obtained feature value transfer event can be improved, and the normal feature value transfer event is not affected, thereby improving the accuracy of the confrontation.

[0108] In addition, in an embodiment of the present application, after the first target risk level of the target characteristic value transfer event is updated to the second target risk level in S204, in order for the first account to obtain the second target risk level of the target characteristic value transfer event during the execution of the target characteristic value transfer event in order to combat abnormal characteristic value transfer events; during the execution of the target characteristic value transfer event, it is also necessary to prompt the first account with the second target risk level of the target characteristic value transfer event. Therefore, the present application provides a possible implementation method, and the method may further include S5: during the execution of the target characteristic value transfer event, prompting the first account with the second target risk level.

[0109] In addition, in the embodiment of the present application, corresponding to S204, there is also a situation where the similarity is less than the preset similarity, indicating that the target characteristic value transfer event is not similar to the associated characteristic value transfer event of a higher risk level; at this time, there is no need to increase the first target risk level of the target characteristic value transfer event to a higher risk level, and continue to maintain the first target risk level of the target characteristic value transfer event. Based on this, in order for the first account to obtain the first target risk level of the target characteristic value transfer event during the execution of the target characteristic value transfer event, so as to combat abnormal characteristic value transfer events; during the execution of the target characteristic value transfer event, it is also necessary to prompt the first account with the first target risk level of the target characteristic value transfer event. Therefore, the present application provides a possible implementation method, and the method may also include S6: if the similarity is less than the preset similarity, during the execution of the target characteristic value transfer event, prompt the first account with the first target risk level.

[0110] As an example, see Figure 8 The schematic diagram of a target feature value transfer event prompting a risk level during the execution process is shown. The target feature value transfer event is the transfer of feature values ​​from a first account to a second account. Figure 8 (a) indicates that during the execution of the target feature value transfer event, a reminder level is prompted to the first account. The prompt content corresponding to the reminder level may be, for example, "Please verify the identity of the second account before transferring money, and be careful of abnormal transfers." Figure 8 (b) indicates that during the execution of the target feature value transfer event, the first account is prompted that the interception level can be released. The prompt content corresponding to the interception level can be, for example, "Please verify the identity of the second account. If it is confirmed to be safe, you can click "Remove interception"; Figure 8 (c) indicates that during the execution of the target characteristic value transfer event, the first account is prompted that the interception level cannot be lifted. The prompt content corresponding to the interception level that cannot be lifted may be, for example: The current transfer is abnormal. To ensure the safety of your funds, the transfer cannot be completed temporarily. Be careful of abnormal transfers.

[0111] The method for processing characteristic value transfer events provided in the above embodiment is, during the execution process of the target characteristic value transfer event in which the characteristic value is transferred from the first account to the second account, a risk prediction is performed on the target event characteristics of the target characteristic value transfer event to obtain a first target risk level of the target characteristic value transfer event; when the first target risk level is lower than the preset risk level, it is diffused through the first account, the second account and the preset association pattern to obtain an associated characteristic value transfer event of a higher risk level; a similarity calculation is performed on the target event characteristics and the associated event characteristics of the associated characteristic value transfer event to obtain a similarity; when the similarity is greater than or equal to the preset similarity, the first target risk level is updated to a second target risk level of a higher risk level.

[0112] It can be seen that after the risk prediction obtains the first target risk level of the medium-low risk level based on the target event characteristics of the target eigenvalue transfer event, the diffusion of the eigenvalue transfer event is introduced through the preset association pattern, and the associated eigenvalue transfer events of higher risk levels are mined to make up for the insufficient coverage of the target event characteristics; when the target eigenvalue transfer event and the associated eigenvalue transfer event are relatively similar, the first target risk level is increased to a more accurate second target risk level. Based on this, this method can improve the accuracy of the risk level of the obtained eigenvalue transfer event in the case where an abnormal account rents a normal account to execute an abnormal eigenvalue transfer event, thereby improving the accuracy of the confrontation.

[0113] In response to the method for processing a characteristic value transfer event provided in the above embodiment, an embodiment of the present application further provides a device for processing a characteristic value transfer event.

[0114] See also Figure 9 , Figure 9 Schematic diagram of a device for processing a feature value transfer event provided in an embodiment of the present application. Figure 9 As shown, the device 900 for processing a feature value transfer event includes: a prediction unit 901, a diffusion unit 902, a calculation unit 903, and an update unit 904;

[0115] Prediction unit 901 is configured to perform risk prediction based on target event characteristics of a target feature value transfer event during the execution of the target feature value transfer event to obtain a first target risk level for the target feature value transfer event; the target feature value transfer event indicates that a feature value of a first account is transferred to a second account;

[0116] A diffusion unit 902 is configured to, if the first target risk level is lower than a preset risk level, perform diffusion based on the first account, the second account, and the preset association pattern to obtain an associated characteristic value transfer event of the target characteristic value transfer event; the associated risk level of the associated characteristic value transfer event is higher than the first target risk level;

[0117] A calculation unit 903 is configured to perform similarity calculation based on the target event feature and the associated event feature of the associated feature value transfer event to obtain the similarity between the target feature value transfer event and the associated feature value transfer event;

[0118] The updating unit 904 is configured to update the first target risk level to a second target risk level if the similarity is greater than or equal to a preset similarity; the second target risk level is higher than the first target risk level.

[0119] As a possible implementation, the preset association mode includes a same account association mode and a same environment association mode, and the diffusion unit 902 includes: a first diffusion subunit, a second diffusion subunit, and a first determination subunit;

[0120] A first diffusion subunit is configured to perform diffusion according to the first account, the same-account association pattern, and the same-environment association pattern to obtain a first eigenvalue transfer event associated with the target eigenvalue transfer event;

[0121] A second diffusion subunit is configured to diffuse according to the second account, the same account association pattern, and the same environment association pattern to obtain a second eigenvalue transfer event associated with the target eigenvalue transfer event;

[0122] The first determining subunit is configured to determine a correlated eigenvalue transfer event based on the first eigenvalue transfer event and the second eigenvalue transfer event.

[0123] As a possible implementation method, when the preset risk level is an unreleasable interception level and the first target risk level is a warning level, the associated risk level is an unreleasable interception level or an unreleasable interception level; when the first target risk level is a releasable interception level, the associated risk level is an unreleasable interception level.

[0124] As a possible implementation, the calculation unit 903 includes: a second determination subunit and a first calculation subunit;

[0125] The second determining subunit is used to determine the weight coefficients corresponding to the various dimensional features in the target event features and the associated event features;

[0126] The second calculation subunit is used to perform similarity calculation based on the target event feature, the associated event feature and each weight coefficient to obtain the similarity.

[0127] As a possible implementation, the calculation unit 903 includes: a third determination subunit and a second calculation subunit;

[0128] a third determining subunit, configured to determine a time decay coefficient according to a target execution time of the target eigenvalue transfer event and an intercept execution time of the associated eigenvalue transfer event;

[0129] The second calculation subunit is used to perform similarity calculation based on the target event feature, the associated event feature and the time decay coefficient to obtain the similarity.

[0130] As a possible implementation, the calculation unit 903 includes: a fourth determining subunit, a fifth determining subunit, and a third calculation subunit;

[0131] A fourth determining subunit is used to determine the weight coefficients corresponding to the various dimensional features in the target event features and the associated event features;

[0132] a fifth determining subunit, configured to determine a time decay coefficient according to a target execution time of the target eigenvalue transfer event and an intercept execution time of the associated eigenvalue transfer event;

[0133] The third calculation subunit is used to perform similarity calculation based on the target event feature, the associated event feature, each weight coefficient and the time decay coefficient to obtain the similarity.

[0134] As a possible implementation, the prediction unit 901 includes: a prediction subunit and a sixth determination subunit;

[0135] The prediction subunit is used to perform risk prediction on the target event characteristics through a risk prediction model to obtain target risk prediction data for the target feature value transfer event; the risk prediction model is obtained by training a preset model based on the normal event characteristics and normal label data of the normal feature value transfer event, and the abnormal event characteristics and risk label data of the abnormal feature value transfer event;

[0136] The sixth determining subunit is configured to determine a first target risk level based on the target risk prediction data and the data intervals corresponding to the risk levels.

[0137] As a possible implementation, the apparatus further includes a training unit, which is configured to:

[0138] Obtain normal event features and normal label data, as well as abnormal event features and risk label data;

[0139] Input the normal event characteristics and the abnormal event characteristics into a preset model for risk prediction, and output first risk prediction data of normal feature value transfer events and second risk prediction data of abnormal feature value transfer events;

[0140] If the first risk prediction data does not match the normal label data, or the second risk prediction data does not match the risk label data, iteratively training the model parameters of the preset model using the loss function of the preset model;

[0141] The trained preset model is determined as the risk prediction model.

[0142] As a possible implementation manner, the target event features include the transfer features and account features of the target feature value transfer event; the associated event features include the transfer features and account features of the associated feature value transfer event.

[0143] As a possible implementation, the device further includes: a first prompting unit;

[0144] The first prompting unit is configured to prompt the first account with a second target risk level during the execution of the target characteristic value transfer event.

[0145] As a possible implementation, the device further includes: a second prompting unit;

[0146] The second prompting unit is configured to prompt the first account of the first target risk level during the execution of the target feature value transfer event if the similarity is less than a preset similarity.

[0147] The device for processing characteristic value transfer events provided by the above embodiment performs risk prediction on the target event characteristics of the target characteristic value transfer event during the execution process of the target characteristic value transfer event in which the characteristic value is transferred from the first account to the second account, and obtains a first target risk level of the target characteristic value transfer event; when the first target risk level is lower than the preset risk level, it is diffused through the first account, the second account and the preset association pattern to obtain an associated characteristic value transfer event of a higher risk level; similarity calculation is performed on the target event characteristics and the associated event characteristics of the associated characteristic value transfer event to obtain similarity; when the similarity is greater than or equal to the preset similarity, the first target risk level is updated to a second target risk level of a higher risk level.

[0148] It can be seen that after the risk prediction obtains the first target risk level of the medium-low risk level based on the target event characteristics of the target eigenvalue transfer event, the diffusion of the eigenvalue transfer event is introduced through the preset association pattern, and the associated eigenvalue transfer events of higher risk levels are mined to make up for the insufficient coverage of the target event characteristics; when the target eigenvalue transfer event and the associated eigenvalue transfer event are relatively similar, the first target risk level is increased to a more accurate second target risk level. Based on this, this method can improve the accuracy of the risk level of the obtained eigenvalue transfer event in the case where an abnormal account rents a normal account to execute an abnormal eigenvalue transfer event, thereby improving the accuracy of the confrontation.

[0149] In response to the method for processing characteristic value transfer events described above, an embodiment of the present application also provides a processing device for characteristic value transfer events, so that the method for processing characteristic value transfer events described above can be implemented and applied in practice. The computer device provided by the embodiment of the present application will be introduced below from the perspective of hardware instantiation.

[0150] See also Figure 10 , Figure 10 This is a schematic diagram of a server structure provided in an embodiment of the present application. The server 1000 may have relatively large differences due to different configurations or performances, and may include one or more central processing units (CPUs) 1022 (for example, one or more processors) and a memory 1032, and one or more storage media 1030 (for example, one or more massive storage devices) for storing application programs 1042 or data 1044. Among them, the memory 1032 and the storage medium 1030 can be short-term storage or persistent storage. The program stored in the storage medium 1030 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the server. Furthermore, the central processing unit 1022 can be configured to communicate with the storage medium 1030 to execute a series of instruction operations in the storage medium 1030 on the server 1000.

[0151] The server 1000 may also include one or more power supplies 1026, one or more wired or wireless network interfaces 1050, one or more input and output interfaces 1058, and / or one or more operating systems 1041, such as Windows Server 2003. TM , Mac OS X TM , Unix TM , Linux TM , FreeBSD TM etc.

[0152] The steps performed by the server in the above embodiment can be based on the Figure 10 The server structure shown.

[0153] The CPU 1022 is configured to execute the following steps:

[0154] During the execution of the target characteristic value transfer event, risk prediction is performed based on the target event characteristics of the target characteristic value transfer event to obtain a first target risk level of the target characteristic value transfer event; the target characteristic value transfer event indicates that the characteristic value of the first account is transferred to the second account;

[0155] If the first target risk level is lower than the preset risk level, diffusion is performed based on the first account, the second account, and the preset association pattern to obtain an associated characteristic value transfer event of the target characteristic value transfer event; the associated risk level of the associated characteristic value transfer event is higher than the first target risk level;

[0156] Calculating similarity based on the target event feature and the associated event feature of the associated feature value transfer event to obtain the similarity between the target feature value transfer event and the associated feature value transfer event;

[0157] If the similarity is greater than or equal to the preset similarity, the first target risk level is updated to the second target risk level; the second target risk level is higher than the first target risk level.

[0158] Optionally, the CPU 1022 may also execute the method steps of any specific implementation of the method for processing a feature value transfer event in the embodiment of the present application.

[0159] See also Figure 11 , Figure 11 This is a schematic diagram of the structure of a terminal device provided in an embodiment of the present application. For ease of explanation, only the parts related to the embodiment of the present application are shown. For specific technical details not disclosed, please refer to the method section of the embodiment of the present application. The terminal device can be any terminal device including a mobile phone, tablet computer, PDA, etc. Taking the terminal device as a mobile phone as an example:

[0160] Figure 11 The block diagram shows a partial structure of a mobile phone related to the terminal device provided in the embodiment of the present application. Figure 11 The mobile phone includes components such as a radio frequency (RF) circuit 1110, a memory 1120, an input unit 1130, a display unit 1140, a sensor 1150, an audio circuit 1160, a wireless fidelity (WiFi) module 1170, a processor 1180, and a power supply 1190. Those skilled in the art will appreciate that Figure 11 The mobile phone structure shown in the figure does not constitute a limitation to the mobile phone, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0161] The following combination Figure 11 A detailed introduction to the various components of a mobile phone:

[0162] The RF circuit 1110 can be used to receive and send signals during information transmission or calls. In particular, after receiving downlink information from the base station, it is sent to the processor 1180 for processing. In addition, the designed uplink data is sent to the base station. Generally, the RF circuit 1110 includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier (LNA), a duplexer, etc. In addition, the RF circuit 1110 can also communicate with the network and other devices through wireless communication. The above-mentioned wireless communication can use any communication standard or protocol, including but not limited to Global System of Mobile Communication (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), email, Short Messaging Service (SMS), etc.

[0163] The memory 1120 can be used to store software programs and modules. The processor 1180 implements various functional applications and data processing of the mobile phone by running the software programs and modules stored in the memory 1120. The memory 1120 may mainly include a program storage area and a data storage area. The program storage area may store an operating system and at least one application required for a function (such as a sound playback function, an image playback function, etc.); the data storage area may store data created based on the use of the mobile phone (such as audio data, a phone book, etc.). In addition, the memory 1120 may include high-speed random access memory and may also include non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage device.

[0164] The input unit 1130 can be used to receive input digital or character information, and to generate key signal input related to the user settings and function control of the mobile phone. Specifically, the input unit 1130 may include a touch panel 1131 and other input devices 1132. The touch panel 1131, also known as a touch screen, can collect user touch operations on or near it (such as operations performed by the user using a finger, stylus, or any other suitable object or accessory on or near the touch panel 1131) and drive the corresponding connection device according to a pre-set program. Optionally, the touch panel 1131 may include two parts: a touch detection device and a touch controller. The touch detection device detects the user's touch direction and detects the signal generated by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device and converts it into touch point coordinates, which are then sent to the processor 1180. It can also receive commands sent by the processor 1180 and execute them. In addition, the touch panel 1131 can be implemented using various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the touch panel 1131, the input unit 1130 may further include other input devices 1132. Specifically, the other input devices 1132 may include, but are not limited to, one or more of a physical keyboard, function keys (such as volume control keys, power keys, etc.), a trackball, a mouse, and a joystick.

[0165] The display unit 1140 can be used to display information input by the user or information provided to the user and various menus of the mobile phone. The display unit 1140 may include a display panel 1141. Optionally, the display panel 1141 may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), etc. Further, the touch panel 1131 may cover the display panel 1141. When the touch panel 1131 detects a touch operation on or near it, it is transmitted to the processor 1180 to determine the type of touch event. Subsequently, the processor 1180 provides corresponding visual output on the display panel 1141 according to the type of touch event. Although in Figure 10 In the embodiment, the touch panel 1131 and the display panel 1141 are used as two independent components to realize the input and output functions of the mobile phone, but in some embodiments, the touch panel 1131 and the display panel 1141 can be integrated to realize the input and output functions of the mobile phone.

[0166] The mobile phone may also include at least one sensor 1150, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 1141 according to the brightness of the ambient light, and the proximity sensor may turn off the display panel 1141 and / or the backlight when the mobile phone is moved to the ear. As a type of motion sensor, the accelerometer sensor can detect the magnitude of acceleration in all directions (generally three axes), and can detect the magnitude and direction of gravity when stationary. It can be used for applications that identify the posture of the mobile phone (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; as for other sensors that the mobile phone can also be configured with, such as gyroscopes, barometers, hygrometers, thermometers, infrared sensors, etc., they will not be described here.

[0167] Audio circuit 1160, speaker 1161, and microphone 1162 provide an audio interface between the user and the phone. Audio circuit 1160 converts received audio data into electrical signals and transmits them to speaker 1161, which then converts them into sound signals for output. Microphone 1162, on the other hand, converts collected sound signals into electrical signals, which are then received by audio circuit 1160 and converted into audio data. The audio data is then processed by processor 1180 and transmitted to, for example, another phone via RF circuit 1110, or stored in memory 1120 for further processing.

[0168] WiFi is a short-range wireless transmission technology. The mobile phone can help users send and receive emails, browse the web and access streaming media through the WiFi module 1170. It provides users with wireless broadband Internet access. Figure 11 A WiFi module 1170 is shown, but it is understandable that it is not an essential component of the mobile phone and can be omitted as needed without changing the essence of the invention.

[0169] Processor 1180 is the control center of the phone, connecting all parts of the phone using various interfaces and circuits. By running or executing software programs and / or modules stored in memory 1120 and accessing data stored in memory 1120, it executes various phone functions and processes data, thereby providing overall control of the phone. Optionally, processor 1180 may include one or more processing units; preferably, processor 1180 may integrate an application processor and a modem processor. The application processor primarily handles the operating system, user interface, and application programs, while the modem processor primarily handles wireless communications. It is understood that the modem processor may not be integrated into processor 1180.

[0170] The mobile phone also includes a power supply 1190 (such as a battery) for supplying power to various components. Preferably, the power supply can be logically connected to the processor 1180 through a power management system, thereby managing charging, discharging, and power consumption through the power management system.

[0171] Although not shown, the mobile phone may also include a camera, a Bluetooth module, etc., which will not be described in detail here.

[0172] In the embodiment of the present application, the memory 1120 included in the mobile phone can store program codes and transmit the program codes to the processor.

[0173] The processor 1180 included in the mobile phone can execute the method for processing the characteristic value transfer event provided in the above embodiment according to the instructions in the program code.

[0174] An embodiment of the present application further provides a computer-readable storage medium for storing a computer program, wherein the computer program is used to execute the method for processing a feature value transfer event provided in the above embodiment.

[0175] The present application also provides a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the method for processing a feature value transfer event provided in various optional implementations of the above aspects.

[0176] A person skilled in the art will understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the above-mentioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the above-mentioned storage medium can be at least one of the following media: read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, etc., various media that can store program codes.

[0177] It should be noted that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments. The device and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. A person of ordinary skill in the art can understand and implement it without expending creative work.

[0178] The above is merely one specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A method for processing a feature value transfer event, characterized in that: The method comprises: During the execution of a target feature value transfer event, risk prediction is performed based on target event features of the target feature value transfer event to obtain a first target risk level of the target feature value transfer event; the target feature value transfer event indicates that a feature value of a first account is transferred to a second account; If the first target risk level is lower than a preset risk level, diffusion is performed based on the first account, the second account, and a preset association pattern to obtain an associated characteristic value transfer event of the target characteristic value transfer event; the associated risk level of the associated characteristic value transfer event is higher than the first target risk level; the preset association pattern includes a same-account association pattern and a same-environment association pattern; performing similarity calculation based on the target event features and the associated event features of the associated feature value transfer event to obtain the similarity between the target feature value transfer event and the associated feature value transfer event; the target event features include the transfer features and account features of the target feature value transfer event; the associated event features include the transfer features and account features of the associated feature value transfer event; If the similarity is greater than or equal to a preset similarity, the first target risk level is updated to a second target risk level; the second target risk level is higher than the first target risk level.

2. The method according to claim 1, characterized in that The step of performing diffusion according to the first account, the second account, and a preset association pattern to obtain an associated characteristic value transfer event of the target characteristic value transfer event includes: Diffusion is performed according to the first account, the same account association pattern, and the same environment association pattern to obtain a first eigenvalue transfer event associated with the target eigenvalue transfer event; Diffusion is performed according to the second account, the same account association pattern, and the same environment association pattern to obtain a second eigenvalue transfer event associated with the target eigenvalue transfer event; The associated eigenvalue transfer event is determined based on the first eigenvalue transfer event and the second eigenvalue transfer event.

3. The method according to claim 1, characterized in that The preset risk level is the non-removable interception level. When the first target risk level is the reminder level, the associated risk level is the removable interception level or the non-removable interception level; when the first target risk level is the removable interception level, the associated risk level is the non-removable interception level.

4. The method according to claim 1, wherein The performing similarity calculation based on the target event feature and the associated event feature of the associated feature value transfer event to obtain the similarity between the target feature value transfer event and the associated feature value transfer event includes: Determine each weight coefficient corresponding to each dimensional feature in the target event feature and the associated event feature; A similarity calculation is performed based on the target event feature, the associated event feature, and the respective weight coefficients to obtain the similarity.

5. The method according to claim 1, wherein The performing similarity calculation based on the target event feature and the associated event feature of the associated feature value transfer event to obtain the similarity between the target feature value transfer event and the associated feature value transfer event includes: determining a time decay coefficient according to a target execution time of the target eigenvalue transfer event and an intercept execution time of the associated eigenvalue transfer event; A similarity calculation is performed based on the target event feature, the associated event feature, and the time decay coefficient to obtain the similarity.

6. The method according to claim 1, characterized in that The performing similarity calculation based on the target event feature and the associated event feature of the associated feature value transfer event to obtain the similarity between the target feature value transfer event and the associated feature value transfer event includes: Determine each weight coefficient corresponding to each dimensional feature in the target event feature and the associated event feature; determining a time decay coefficient according to a target execution time of the target eigenvalue transfer event and an intercept execution time of the associated eigenvalue transfer event; A similarity calculation is performed based on the target event feature, the associated event feature, the respective weight coefficients, and the time decay coefficient to obtain the similarity.

7. The method according to claim 1, characterized in that The performing risk prediction according to the target event feature of the target feature value transfer event to obtain a first target risk level of the target feature value transfer event includes: Performing risk prediction on the target event features through a risk prediction model to obtain target risk prediction data for the target feature value transfer event; the risk prediction model is obtained by training a preset model based on normal event features and normal label data of normal feature value transfer events, and abnormal event features and risk label data of abnormal feature value transfer events; The first target risk level is determined according to the target risk prediction data and the data intervals corresponding to each risk level.

8. The method according to claim 7, characterized in that The risk prediction model training step includes: Acquire the normal event characteristics and the normal label data, as well as the abnormal event characteristics and the risk label data; Inputting the normal event feature and the abnormal event feature into the preset model for risk prediction, and outputting first risk prediction data of the normal feature value transfer event and second risk prediction data of the abnormal feature value transfer event; If the first risk prediction data does not match the normal label data, or the second risk prediction data does not match the risk label data, iteratively training the model parameters of the preset model using the loss function of the preset model; The trained preset model is determined as the risk prediction model.

9. The method according to any one of claims 1 to 8, characterized in that The method further comprises: During the execution of the target characteristic value transfer event, the second target risk level is prompted to the first account.

10. The method according to any one of claims 1 to 8, characterized in that The method further comprises: If the similarity is less than the preset similarity, during the execution of the target feature value transfer event, the first target risk level is prompted to the first account.

11. A device for processing a feature value transfer event, characterized in that: The device comprises: a prediction unit, a diffusion unit, a calculation unit and an update unit; The prediction unit is configured to perform risk prediction based on the target event characteristics of the target feature value transfer event during the execution of the target feature value transfer event to obtain a first target risk level of the target feature value transfer event; the target feature value transfer event indicates that the feature value of the first account is transferred to the second account; The diffusion unit is configured to, if the first target risk level is lower than a preset risk level, perform diffusion based on the first account, the second account, and a preset association pattern to obtain an associated characteristic value transfer event of the target characteristic value transfer event; the associated risk level of the associated characteristic value transfer event is higher than the first target risk level; the preset association pattern includes a same-account association pattern and a same-environment association pattern; The calculation unit is configured to perform similarity calculation based on the target event features and the associated event features of the associated feature value transfer event to obtain the similarity between the target feature value transfer event and the associated feature value transfer event; the target event features include the transfer features and account features of the target feature value transfer event; and the associated event features include the transfer features and account features of the associated feature value transfer event. The updating unit is configured to update the first target risk level to a second target risk level if the similarity is greater than or equal to a preset similarity; the second target risk level is higher than the first target risk level.

12. The device according to claim 11, characterized in that The diffusion unit comprises: a first diffusion subunit, configured to perform diffusion according to the first account, the same-account association pattern, and the same-environment association pattern, to obtain a first eigenvalue transfer event associated with the target eigenvalue transfer event; a second diffusion subunit, configured to perform diffusion according to the second account, the same-account association pattern, and the same-environment association pattern, to obtain a second eigenvalue transfer event associated with the target eigenvalue transfer event; The first determining subunit is configured to determine the associated eigenvalue transfer event based on the first eigenvalue transfer event and the second eigenvalue transfer event.

13. The device according to claim 11, characterized in that The preset risk level is the non-removable interception level. When the first target risk level is the reminder level, the associated risk level is the removable interception level or the non-removable interception level; when the first target risk level is the removable interception level, the associated risk level is the non-removable interception level.

14. The device according to claim 11, characterized in that The computing unit comprises: A second determining subunit is configured to determine weight coefficients corresponding to the target event features and the associated event features. The first calculation subunit is configured to perform similarity calculation based on the target event feature, the associated event feature, and the weight coefficients to obtain the similarity.

15. The device according to claim 11, characterized in that The computing unit comprises: a third determining subunit, configured to determine a time decay coefficient according to a target execution time of the target eigenvalue transfer event and an intercept execution time of the associated eigenvalue transfer event; The second calculation subunit is configured to perform similarity calculation based on the target event feature, the associated event feature, and the time decay coefficient to obtain the similarity.

16. The device according to claim 11, characterized in that The computing unit comprises: A fourth determining subunit is configured to determine weight coefficients corresponding to the target event features and the associated event features. a fifth determining subunit, configured to determine a time decay coefficient according to a target execution time of the target eigenvalue transfer event and an intercept execution time of the associated eigenvalue transfer event; The third calculation subunit is configured to perform similarity calculation based on the target event feature, the associated event feature, the weight coefficients, and the time decay coefficient to obtain the similarity.

17. The device according to claim 11, characterized in that The prediction unit includes: A prediction subunit is configured to perform risk prediction on the target event characteristics through a risk prediction model to obtain target risk prediction data for the target feature value transfer event; the risk prediction model is obtained by training a preset model based on normal event characteristics and normal label data of normal feature value transfer events, and abnormal event characteristics and risk label data of abnormal feature value transfer events; The sixth determining subunit is configured to determine the first target risk level according to the target risk prediction data and the data intervals corresponding to the respective risk levels.

18. The device according to claim 17, characterized in that The apparatus further includes a training unit; the training unit is configured to: Acquire the normal event characteristics and the normal label data, as well as the abnormal event characteristics and the risk label data; Inputting the normal event feature and the abnormal event feature into the preset model for risk prediction, and outputting first risk prediction data of the normal feature value transfer event and second risk prediction data of the abnormal feature value transfer event; If the first risk prediction data does not match the normal label data, or the second risk prediction data does not match the risk label data, iteratively training the model parameters of the preset model using the loss function of the preset model; The trained preset model is determined as the risk prediction model.

19. The device according to any one of claims 11 to 18, characterized in that The device further comprises: The first prompting unit is configured to prompt the first account with the second target risk level during the execution of the target characteristic value transfer event.

20. The device according to any one of claims 11 to 18, characterized in that The device further comprises: The second prompting unit is configured to prompt the first account with the first target risk level during the execution of the target feature value transfer event if the similarity is less than the preset similarity.

21. A computer device, characterized in that: The device includes a processor and a memory: The memory is used to store program code and transmit the program code to the processor; The processor is configured to execute the method for processing a characteristic value transfer event according to any one of claims 1 to 10 according to instructions in the program code.

22. A computer-readable storage medium, characterized in that The computer-readable storage medium is used to store a computer program. When the computer program is executed by a processor, the method for processing a feature value transfer event according to any one of claims 1 to 10 is executed.

23. A computer program product, characterized in that The method comprises a computer program or an instruction; when the computer program or the instruction is executed by a processor, the method for processing a characteristic value transfer event according to any one of claims 1 to 10 is executed.

Images