Method and apparatus for determining abnormal users

Abstract

This application provides a method and apparatus for identifying abnormal users. The method includes: acquiring transaction records of all trading accounts within a preset time period as first data; constructing a left B+ tree and a right B+ tree based on the first data; determining a first trading account in the left B+ tree as a suspected abnormal trading account based on preset suspected abnormal user screening rules; and determining whether the first trading account is an abnormal user in the right B+ tree based on abnormal user determination rules. The method for identifying abnormal users provided by this application uses a double B+ tree structure constructed from user transaction records. After real-time statistical analysis of transaction records in the left B+ tree to output suspected abnormal transaction statements, the right tree is used to monitor the suspected abnormal transaction statements periodically. This method has lower computational load, lower complexity, and higher efficiency. Furthermore, it does not intrude on the original system during implementation and therefore will not affect the normal operation of the original business system.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a method and apparatus for identifying abnormal users. Background Technology

[0002] To improve the security of carrier services, it is typically necessary to monitor these services to detect abnormal activity, provide early warnings, and take preventative measures, thereby enhancing security. Furthermore, for timely protection, the anomaly monitoring system or personnel are usually required to detect abnormal activity in real time.

[0003] However, in practical applications, since it is unknown when abnormal business operations will occur, in order to solve the above technical problems, it is necessary to continuously monitor the transaction records generated by the business system. As a result, the business system needs to monitor all event information within the monitoring period in real time, which involves a lot of computation, consumes a lot of resources, and has a large processing latency, making it difficult to meet the real-time support requirements. Summary of the Invention

[0004] In view of the problems existing in the prior art, this application provides a method and apparatus for identifying abnormal users.

[0005] Firstly, this application provides a method for identifying abnormal users, including:

[0006] Retrieve transaction records from all trading accounts within a preset time period as the primary data;

[0007] Based on the first data, a left B+ tree and a right B+ tree are constructed; wherein, the left B+ tree is obtained by statistical analysis of the transaction accounts and transaction objects within the preset time period; and the right B+ tree is constructed based on the transaction records of each transaction account.

[0008] Based on preset suspected abnormal user screening rules, the first transaction account in the left B+ tree is determined; the first transaction account is a suspected abnormal transaction account.

[0009] Based on the abnormal user identification rules, it is determined whether the first transaction account is an abnormal user in the right B+ tree.

[0010] Optionally, constructing the left B+ tree and the right B+ tree based on the first data includes:

[0011] Based on the first data, a left B+ tree is constructed, with the transaction account as the primary key and the number of transactions, transaction amount, and transaction object as foreign keys, using the transaction account and transaction object as units;

[0012] Based on the first data, a right B+ tree is constructed, with each transaction record of the transaction account as a unit, consisting of the transaction account as the primary key and the transaction time, transaction time interval, number of transactions, transaction amount, and transaction object as foreign keys.

[0013] Optionally, before determining the first transaction account in the left B+ tree based on preset suspected abnormal user screening rules, the process includes:

[0014] Based on a preset sliding window time, the transaction time corresponding to the transaction record in the left B+ tree and the right B+ tree is marked as the transaction record within the preset sliding window time.

[0015] Based on the preset suspected abnormal user screening rules, and combined with the transaction records in the marked left B+ tree, the first transaction account in the left B+ tree is determined.

[0016] Based on the abnormal user identification rules and combined with the transaction records in the marked right B+ tree, it is determined whether the first transaction account is an abnormal user in the right B+ tree.

[0017] Optionally, the step of determining the first transaction account in the left B+ tree based on preset suspected abnormal user screening rules and combined with the transaction records in the marked left B+ tree includes:

[0018] Determine whether the transaction records in the marked left B+ tree meet the preset suspected abnormal user screening rules;

[0019] If the preset suspected abnormal user screening rules are met, the transaction account is determined to be the first transaction account;

[0020] The preset suspected abnormal user screening rules include any one or more of the following:

[0021] The number of transactions corresponding to the transaction account is greater than a preset first threshold for the number of transactions;

[0022] The transaction amount corresponding to the transaction account is greater than the preset second threshold for transaction amount;

[0023] The transactions associated with the trading account are pre-defined risk trading targets.

[0024] Optionally, before determining whether the first transaction account is an abnormal user in the right B+ tree based on the abnormal user determination rules and the transaction records in the marked right B+ tree, the process includes:

[0025] Determine whether the first transaction account exists in the transaction records of the right B+ tree;

[0026] If it does not exist, then filter the transaction records of the first transaction account from the first data, and the transaction time of the transaction record satisfies the sliding window time. After marking the transaction record, update the corresponding right B+ tree.

[0027] Optionally, the step of determining whether the first transaction account is an abnormal user based on the abnormal user determination rules and in conjunction with the transaction records in the marked right B+ tree includes:

[0028] In the right B+ tree, filter the marked transaction records corresponding to the first transaction account to determine whether the marked transaction records meet the abnormal user identification rules;

[0029] If the abnormal user determination rules are met, then the first transaction account is determined to be an abnormal user;

[0030] The rules for identifying abnormal users include any one or more of the following:

[0031] The number of transactions for the first trading account exceeds the preset third threshold for the number of transactions;

[0032] The transaction amount of the first transaction account is greater than the preset fourth threshold for transaction amount.

[0033] Optionally, the method further includes:

[0034] If the abnormal user exists, determine the specific abnormal type of the abnormal user's transaction records and send the corresponding warning information;

[0035] The abnormality types include: abnormal number of transactions, abnormal transaction amount, and abnormal transaction object.

[0036] Secondly, this application also provides an apparatus for identifying abnormal users, comprising:

[0037] The acquisition module is used to acquire the transaction records of all trading accounts within a preset time period as the first data.

[0038] A construction module is used to construct a left B+ tree and a right B+ tree based on the first data; wherein, the left B+ tree is obtained by statistical analysis of the transaction accounts and transaction objects within the preset time period; and the right B+ tree is constructed based on the transaction records of each transaction account.

[0039] The filtering module is used to determine the first transaction account in the left B+ tree based on preset suspected abnormal user filtering rules; the first transaction account is a suspected abnormal transaction account.

[0040] The determination module is used to determine whether the first transaction account is an abnormal user in the right B+ tree based on the abnormal user determination rules.

[0041] Thirdly, this application also provides an electronic device, including a processor and a memory storing a computer program, wherein the processor executes the computer program to implement the method for determining abnormal users as described in the first aspect.

[0042] Fourthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the method for determining abnormal users as described in the first aspect.

[0043] The method and apparatus for identifying abnormal users provided in this application construct a double B+ tree structure composed of user transaction records. After real-time statistical analysis of transaction records in the left B+ tree to output suspected abnormal transaction bills, the right tree performs periodic monitoring of these suspected abnormal transaction bills. This method involves less computation, lower complexity, and higher efficiency. Furthermore, since the implementation does not intrude on the original system, it will not affect the normal operation of the original business system. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 This is a flowchart illustrating the method for determining abnormal users provided in an embodiment of this application;

[0046] Figure 2 This is a schematic diagram illustrating the implementation process of the method for determining abnormal users provided in this application embodiment;

[0047] Figure 3 This is a schematic diagram of the device for determining abnormal users provided in an embodiment of this application;

[0048] Figure 4 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. Detailed Implementation

[0049] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0050] Figure 1 This is a flowchart illustrating the method for determining abnormal users provided in an embodiment of this application, as shown below. Figure 1 As shown, the method includes:

[0051] Step 101: Obtain the transaction records of all trading accounts within the preset time period as the first data;

[0052] Step 102: Based on the first data, construct a left B+ tree and a right B+ tree; wherein, the left B+ tree is obtained by statistical analysis of the transaction accounts and transaction objects within the preset time period; the right B+ tree is constructed based on the transaction records of each transaction account;

[0053] Step 103: Based on the preset suspected abnormal user screening rules, determine the first transaction account in the left B+ tree; the first transaction account is a suspected abnormal transaction account;

[0054] Step 104: Based on the abnormal user determination rules, determine whether the first transaction account is an abnormal user in the right B+ tree.

[0055] Specifically, transactions in business systems are typically stateless, continuous data streams. Real-time monitoring of these streams involves significant computation and resource consumption, and the processing latency of the business system is substantial, making it difficult to meet real-time support requirements. Therefore, this application segments the data streams in the business system. Based on actual needs, it determines whether there are any abnormal users within the time period A to be monitored. A preset time period A is set, and the transaction bills (transaction data / transaction records) of each user in the business system within this preset time period are obtained. The transaction bills include information such as transaction account, transaction time, transaction interval, number of transactions, transaction object, transaction amount, and transaction number, which are used as the primary data.

[0056] Then, each transaction record in the left B+ tree is obtained by classifying the transaction account and the transaction object; and the corresponding left B+ tree is generated for each transaction account's transaction records. Therefore, the records in the right B+ tree are more detailed.

[0057] First, by monitoring user transaction behavior in the left B+ tree and using pre-defined rules for screening suspected abnormal users, we can initially identify potentially abnormal transaction records and thus determine the accounts suspected of being abnormal. Then, we further monitor these potentially abnormal transaction accounts using the right B+ tree and, using rules for identifying abnormal users, determine the truly abnormal users within these potentially abnormal transaction accounts. This approach processes smaller amounts of data, is more targeted, and significantly reduces processing time, thereby noticeably lowering the processing latency of the business system.

[0058] The method for identifying abnormal users provided in this application constructs a double B+ tree structure composed of user transaction records. After real-time statistical analysis of transaction records in the left B+ tree to output suspected abnormal transaction bills, the right tree performs periodic monitoring of these suspected abnormal transaction bills. This method involves less computation, lower complexity, and higher efficiency. Furthermore, since the implementation does not intrude on the original system, it will not affect the normal operation of the original business system.

[0059] Optionally, constructing the left B+ tree and the right B+ tree based on the first data includes:

[0060] Based on the first data, a left B+ tree is constructed, with the transaction account as the primary key and the number of transactions, transaction amount, and transaction object as foreign keys, using the transaction account and transaction object as units;

[0061] Based on the first data, a right B+ tree is constructed, with each transaction record of the transaction account as a unit, consisting of the transaction account as the primary key and the transaction time, transaction time interval, number of transactions, transaction amount, and transaction object as foreign keys.

[0062] Specifically, considering that the left B+ tree can only record basic information that can initially screen out suspected abnormal trading accounts, the constructed left B+ tree is based on trading accounts and trading objects. That is, multiple transaction records between the same trading account and the same trading object are merged into a single transaction record. This transaction record specifically includes the trading account, number of transactions, transaction amount, and trading object. The number of transactions is the total number of transactions between the same trading account and the same trading object, and the transaction amount is the total transaction amount between the same trading account and the same trading object. The fields of each transaction record included in the left B+ tree are derived based on past experience and statistical results.

[0063] A right B+ tree can record more comprehensive transaction billing information, enabling accurate identification of abnormal transactions. Each transaction record in a right B+ tree includes the transaction account, transaction time, transaction interval, number of transactions, transaction amount, and transaction counterparty. The transaction time is the specific moment when the corresponding transaction occurred for that account; the transaction interval is the time interval between two adjacent transactions for that account; the number of transactions is the number of times the same account and the same counterparty generate transactions, usually expressed in an increasing order; and the transaction amount is the amount incurred for any transaction initiated by the account, such as the cost of a 5-minute phone call or 30 minutes of internet access.

[0064] Optionally, before determining the first transaction account in the left B+ tree based on preset suspected abnormal user screening rules, the process includes:

[0065] Based on a preset sliding window time, the transaction time corresponding to the transaction record in the left B+ tree and the right B+ tree is marked as the transaction record within the preset sliding window time.

[0066] Based on the preset suspected abnormal user screening rules, and combined with the transaction records in the marked left B+ tree, the first transaction account in the left B+ tree is determined.

[0067] Based on the abnormal user identification rules and combined with the transaction records in the marked right B+ tree, it is determined whether the first transaction account is an abnormal user in the right B+ tree.

[0068] Specifically, before analyzing and judging the transaction records in the generated left and right B+ trees, a preset sliding window time is used to reduce the amount of data analyzed and monitored in a single session, thereby improving the processing speed. The specific steps are as follows:

[0069] (1) Initialize the file identifier bits of the left and right B+ trees;

[0070] To ensure that files within the preset sliding window time can be processed individually, the file identifier bits of the left and right B+ trees can be initialized before the search is performed, that is, the file identifier bits of the left and right B+ trees are initialized to 0.

[0071] (2) Set the sliding window time and monitor the transaction records of the business system according to the sliding window time;

[0072] After initializing the file identifier bits of the left and right B+ trees to 0, a preset sliding window time can be established, and the search can begin after the preset sliding window time. The preset sliding window time is the duration for controlling the forward sliding window calculation during the search process. To meet real-time monitoring requirements, a smaller granular time can be used as the preset sliding window time, such as 1 minute.

[0073] (3) Obtain the file identifier corresponding to the transaction record of each B+ tree after the preset sliding window time, and determine whether the monitored transaction record is the transaction record information within the current preset sliding window time based on the file identifier.

[0074] Typically, if the file identifier bit of each B+ tree is 1, it indicates that the transaction record information is within the current preset sliding window time; if the file identifier bit of each B+ tree is 0, it indicates that the transaction record is not within the current preset sliding window time.

[0075] Then, in the marked left and right B+ trees, abnormal transaction records and corresponding abnormal users are identified according to the preset suspected abnormal user screening rules and abnormal user confirmation rules. The preset sliding window time can be set to a specific duration as needed, or an initial value can be set and dynamically adjusted based on the analysis results.

[0076] Optionally, based on preset suspected abnormal user screening rules and combined with the transaction records in the marked left B+ tree, the first transaction account in the left B+ tree is determined, including:

[0077] Determine whether the transaction records in the marked left B+ tree meet the preset suspected abnormal user screening rules;

[0078] If the preset suspected abnormal user screening rules are met, the transaction account is determined to be the first transaction account;

[0079] The preset suspected abnormal user screening rules include any one or more of the following:

[0080] The number of transactions corresponding to the transaction account is greater than a preset first threshold for the number of transactions;

[0081] The transaction amount corresponding to the transaction account is greater than the preset second threshold for transaction amount;

[0082] The transactions associated with the trading account are pre-defined risk trading targets.

[0083] Specifically, in the left B+ tree, for each marked transaction record, it is determined whether the number of transactions corresponding to each record exceeds a first threshold of preset transaction count, and / or whether the transaction amount exceeds a second threshold of preset transaction amount, and / or whether the transaction object is a preset risk transaction object. If one or more of these conditions are met, the transaction account is determined to be a suspected abnormal transaction account. Typically, in the left B+ tree, user transaction records are stored using the transaction account as the primary key. The aforementioned preset risk transaction objects can be accounts previously blacklisted in the business system, or accounts identified based on historical transaction records.

[0084] Optionally, based on the abnormal user identification rules and in conjunction with the transaction records in the marked right B+ tree, before determining whether the first transaction account is an abnormal user in the right B+ tree, the process includes:

[0085] Determine whether the first transaction account exists in the transaction records of the right B+ tree;

[0086] If it does not exist, then filter the transaction records of the first transaction account from the first data, and the transaction time of the transaction record satisfies the sliding window time. After marking the transaction record, update the corresponding right B+ tree.

[0087] Specifically, after identifying a suspected abnormal trading account in the left B+ tree, further judgment is needed in the right B+ tree. Before that, it is necessary to determine whether there are relevant transaction records for the suspected abnormal trading account in the right B+ tree. If not, the corresponding transaction records need to be filtered out from the first data according to the suspected abnormal trading account, and further judged according to the preset sliding window time. The transaction records within the preset sliding window time are then filtered out. Finally, the right B+ tree is updated with the transaction records of the suspected abnormal trading account that are within the preset sliding window time.

[0088] Optionally, based on the abnormal user determination rules and in conjunction with the transaction records in the marked right B+ tree, determining whether the first transaction account is an abnormal user in the right B+ tree includes:

[0089] In the right B+ tree, filter the marked transaction records corresponding to the first transaction account to determine whether the marked transaction records meet the abnormal user identification rules;

[0090] If the abnormal user determination rules are met, then the first transaction account is determined to be an abnormal user;

[0091] The rules for identifying abnormal users include any one or more of the following:

[0092] The number of transactions for the first trading account exceeds the preset third threshold for the number of transactions;

[0093] The transaction amount of the first transaction account is greater than the preset fourth threshold for transaction amount.

[0094] Specifically, within the preset sliding window time, considering that in practical applications, there might be a concentration of transaction records for a particular user within a certain period, or that the accumulated time might be too long, resulting in a large number of transactions, further judgment is needed for such transaction accounts. This involves filtering the marked transaction records corresponding to the first transaction account in the right B+ tree to determine whether the number of transactions for the first transaction account exceeds a preset third threshold for the number of transactions, or whether the transaction amount for the first transaction account exceeds a preset fourth threshold for the transaction amount. For example, for transaction records where the transaction amount is determined to be greater than the preset second threshold for the transaction amount in the left B+ tree, the single transaction amount can be further judged in the right B+ tree. If the single transaction amount exceeds the preset fourth threshold for the transaction amount, it is judged as an abnormal transaction, and the corresponding transaction account is an abnormal user. Alternatively, if the transaction object is determined to be a preset risk transaction object in the left B+ tree, the number of transactions with the preset risk transaction object is further judged in the right B+ tree. If the number of transactions for that transaction account exceeds the preset third threshold for the number of transactions, it is judged as an abnormal transaction, and the corresponding transaction account is an abnormal user. Of course, if it is determined that the number of transactions of the trading account is less than the preset third threshold of the number of transactions, the preset sliding window time can be adjusted, and then the same method can be used to judge based on the corresponding left B+ tree and right B+ tree within this adjusted preset sliding window time.

[0095] In addition, after the monitoring data in the right B+ tree is processed, the transaction records in the left B+ tree and the right B+ tree are deleted before the next preset sliding window time begins to count.

[0096] Optionally, the method further includes:

[0097] If the abnormal user exists, determine the specific abnormal type of the abnormal user's transaction records and send the corresponding warning information;

[0098] The abnormality types include: abnormal number of transactions, abnormal transaction amount, and abnormal transaction object.

[0099] Specifically, after identifying the specific abnormal user, the next step is to determine the type of abnormality in the user's transaction records, such as abnormal transaction frequency, abnormal transaction amount, or abnormal transaction object. Based on the different abnormality types, different levels or types of alarm messages are sent to the relevant alarm channels or systems to protect against abnormal transaction records.

[0100] The method for identifying abnormal users provided in this application constructs a double B+ tree structure composed of user transaction records. After real-time statistical analysis of transaction records in the left B+ tree to output suspected abnormal transaction bills, the right tree performs periodic monitoring of these suspected abnormal transaction bills. This method involves less computation, lower complexity, and higher efficiency. Furthermore, since the implementation does not intrude on the original system, it will not affect the normal operation of the original business system.

[0101] The following specific example illustrates the method for identifying abnormal users provided in this application.

[0102] Figure 2 This is a schematic diagram illustrating the implementation flow of the method for determining abnormal users provided in this application embodiment, as follows: Figure 2 As shown, the method includes the following steps:

[0103] Step 201: Obtain the transaction bills to be monitored for each user in the business system within a preset time period. The transaction bills include user identification information, transaction account number, transaction time, transaction time interval, number of transactions, transaction object, and transaction amount.

[0104] Step 202: Create the left B+ tree and right B+ tree in advance based on the transaction bill.

[0105] This application considers first monitoring user transaction behavior through the left B+ tree to identify suspected abnormal transaction bills, and then using the right B+ tree to perform trigger-based real-time sliding window monitoring on these suspected transaction bills according to a preset monitoring cycle. This aims to solve the problems faced by existing real-time full-data monitoring and processing technologies, such as the high cost of pre-storing large amounts of data storage, the huge computational load of full-data calculation, the high processing difficulty, and the large latency.

[0106] A left B+ tree can only record some basic information that can initially filter out suspected abnormal transaction bills, while a right B+ tree can record more comprehensive transaction bill information so that abnormal transaction bills can be accurately identified.

[0107] Specifically, a left B+ tree is constructed using the transaction account as the primary key and {number of transactions, transaction amount, transaction object} as foreign keys; simultaneously, a right B+ tree is constructed using the transaction account as the primary key and {transaction time, transaction interval, number of transactions, transaction amount, transaction object} as foreign keys.

[0108] Step 203: Based on the left B+ tree and right B+ tree created in the above steps, perform a search to determine abnormal business behavior.

[0109] The process of identifying abnormal business behavior by searching using the aforementioned left and right B+ trees includes the following steps:

[0110] (1) Initialize the file identifier bits of the left and right B+ trees;

[0111] To ensure that files within a preset time period can be processed individually, the file identifier bits of the left and right B+ trees can be initialized before searching, that is, the file identifier bits of the left and right B+ trees are initialized to 0.

[0112] (2) Set the sliding window time and monitor the transaction records of the business system according to the sliding window time;

[0113] After initializing the file identifier bits of the left and right B+ trees to 0, a preset sliding window time can be established, and the search can begin after the preset sliding window time. The preset sliding window time is the duration for controlling the forward sliding window calculation during the search process. The preset sliding window time can be set according to specific needs. To meet real-time monitoring requirements, a smaller granular time, such as 1 minute, can be used as the preset sliding window time.

[0114] (3) Obtain the file identifier of each B+ tree after the preset sliding window time, and determine whether the monitored transaction record is the transaction record information within the current preset sliding window time based on the file identifier.

[0115] Typically, if the file identifier bit of each B+ tree is 1, it indicates that the transaction record information is within the current preset sliding window time; if the file identifier bit of each B+ tree is 0, it indicates that the transaction record is not within the current preset sliding window time.

[0116] (4) Obtain transaction record information within the current preset sliding window time, determine the basic information of suspected abnormal transaction bills based on the left B+ tree; and search the right B+ tree based on the transaction account in the suspected abnormal transaction bill to determine whether there is a node of the transaction account to be monitored in the right B+ tree.

[0117] The first scenario: If the node of the suspected abnormal transaction account to be monitored does not exist in the right B+ tree, then the information of the suspected abnormal transaction account is filtered from the transaction records of all transaction accounts obtained in step 201, and the left B+ tree is updated within the preset sliding window time.

[0118] The second scenario: If the node of the suspected abnormal transaction account to be monitored exists in the right B+ tree, then based on the transaction account, count the values ​​matching the transaction account on the right B+ tree: {transaction time, transaction time interval, number of transactions, transaction amount, transaction object}.

[0119] The methods for using a left B+ tree to determine the basic information of suspected abnormal transaction bills include:

[0120] In the left B+ tree, determine whether the number of transactions exceeds a preset transaction number threshold; and / or, whether the transaction amount exceeds a preset transaction amount threshold; and / or, whether the transaction object is a preset risk transaction object.

[0121] When the above conditions are met, the transaction account is considered a suspected abnormal transaction account, and the transaction records in the right B+ tree are searched based on this suspected abnormal transaction account. Considering that in practical applications, there may be normal transaction statements with a large number of transactions due to long cumulative time, the right B+ tree can further focus on the number of transactions and the transaction time interval for suspected abnormal transaction statements with more than a preset transaction number threshold to avoid misjudgment.

[0122] For transaction bills in the left B+ tree where the transaction amount exceeds a preset transaction amount threshold, the amount of each individual transaction can be further determined in the right B+ tree. If the amount of an individual transaction exceeds the preset threshold, it is determined to be an abnormal transaction.

[0123] For transaction records where the transaction object in the left B+ tree is a preset risk transaction object, the number of transactions with the preset risk transaction object can be further determined in the right B+ tree. If the number of transactions exceeds a threshold, it is determined to be an abnormal transaction. Conversely, if the number of transactions is below the threshold, such as only once occasionally, the monitoring period can be extended, and further judgment can be made based on the monitoring results of subsequent monitoring periods.

[0124] When the monitoring duration of the monitoring node in the right B+ tree reaches T, the abnormal transaction bill information such as {transaction number, transaction account, transaction time, transaction interval, number of transactions, transaction amount, and transaction object} is output. Then, the node information related to the transaction number and transaction account in the right B+ tree is cleared, and the monitoring ends.

[0125] Step 204: After identifying the abnormal transaction bill, the detected abnormal transaction record data can be sent to the relevant alarm channel devices or systems through the alarm service to protect against abnormal transaction records.

[0126] Figure 3 This is a schematic diagram of the structure of the device for determining abnormal users provided in the embodiments of this application, as shown below. Figure 3 As shown, the device includes:

[0127] The acquisition module 301 is used to acquire the transaction records of all trading accounts within a preset time period as the first data;

[0128] The construction module 302 is used to construct a left B+ tree and a right B+ tree based on the first data; wherein, the left B+ tree is obtained by statistical analysis of the transaction accounts and transaction objects within the preset time period; and the right B+ tree is constructed based on the transaction records of each transaction account.

[0129] The filtering module 303 is used to determine the first transaction account in the left B+ tree based on a preset suspected abnormal user filtering rule; the first transaction account is a suspected abnormal transaction account.

[0130] The determination module 304 is used to determine whether the first transaction account is an abnormal user in the right B+ tree based on the abnormal user determination rules.

[0131] Optionally, during the process of constructing the left B+ tree and the right B+ tree based on the first data, the construction module 302 is further configured to:

[0132] Based on the first data, a left B+ tree is constructed, with the transaction account as the primary key and the number of transactions, transaction amount, and transaction object as foreign keys, using the transaction account and transaction object as units;

[0133] Based on the first data, a right B+ tree is constructed, with each transaction record of the transaction account as a unit, consisting of the transaction account as the primary key and the transaction time, transaction time interval, number of transactions, transaction amount, and transaction object as foreign keys.

[0134] Optionally, before determining the first transaction account in the left B+ tree based on preset suspected abnormal user filtering rules, the filtering module 303 is further configured to:

[0135] Based on a preset sliding window time, the transaction time corresponding to the transaction record in the left B+ tree and the right B+ tree is marked as the transaction record within the preset sliding window time.

[0136] Based on the preset suspected abnormal user screening rules, and combined with the transaction records in the marked left B+ tree, the first transaction account in the left B+ tree is determined.

[0137] Based on the abnormal user identification rules and combined with the transaction records in the marked right B+ tree, it is determined whether the first transaction account is an abnormal user in the right B+ tree.

[0138] Optionally, the filtering module 303, based on preset suspected abnormal user filtering rules and combined with the transaction records in the marked left B+ tree, determines the first transaction account in the left B+ tree, and is further configured to:

[0139] Determine whether the transaction records in the marked left B+ tree meet the preset suspected abnormal user screening rules;

[0140] If the preset suspected abnormal user screening rules are met, the transaction account is determined to be the first transaction account;

[0141] The preset suspected abnormal user screening rules include any one or more of the following:

[0142] The number of transactions corresponding to the transaction account is greater than a preset first threshold for the number of transactions;

[0143] The transaction amount corresponding to the transaction account is greater than the preset second threshold for transaction amount;

[0144] The transactions associated with the trading account are pre-defined risk trading targets.

[0145] Optionally, before determining whether the first transaction account is an abnormal user in the right B+ tree based on the abnormal user determination rules and the transaction records in the marked right B+ tree, the determining module 304 is further configured to:

[0146] Determine whether the first transaction account exists in the transaction records of the right B+ tree;

[0147] If it does not exist, then filter the transaction records of the first transaction account from the first data, and the transaction time of the transaction record satisfies the sliding window time. After marking the transaction record, update the corresponding right B+ tree.

[0148] Optionally, the determining module 304, in the process of determining whether the first transaction account is an abnormal user in the right B+ tree based on the abnormal user determination rules and in conjunction with the transaction records in the marked right B+ tree, is further configured to:

[0149] In the right B+ tree, filter the marked transaction records corresponding to the first transaction account to determine whether the marked transaction records meet the abnormal user identification rules;

[0150] If the abnormal user determination rules are met, then the first transaction account is determined to be an abnormal user;

[0151] The rules for identifying abnormal users include any one or more of the following:

[0152] The number of transactions for the first trading account exceeds the preset third threshold for the number of transactions;

[0153] The transaction amount of the first transaction account is greater than the preset fourth threshold for transaction amount.

[0154] Optionally, the device further includes an alarm module 305, used for:

[0155] If the abnormal user exists, determine the specific abnormal type of the abnormal user's transaction records and send the corresponding warning information;

[0156] The abnormality types include: abnormal number of transactions, abnormal transaction amount, and abnormal transaction object.

[0157] It should be noted that the device for determining abnormal users provided in this application embodiment can implement all the method steps implemented in the above-mentioned method embodiment for determining abnormal users, and can achieve the same technical effect. Here, the parts and beneficial effects that are the same as or corresponding to the method embodiment will not be described in detail.

[0158] Figure 4 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application, such as... Figure 4 As shown, the electronic device may include: a processor 410, a communications interface 420, a memory 430, and a communication bus 440, wherein the processor 410, the communications interface 420, and the memory 430 communicate with each other via the communication bus 440. The processor 410 can call logical instructions in the memory 430 to execute methods for mobile user data synchronization, such as:

[0159] Retrieve transaction records from all trading accounts within a preset time period as the primary data;

[0160] Based on the first data, a left B+ tree and a right B+ tree are constructed; wherein, the left B+ tree is obtained by statistically analyzing the transaction accounts and transaction objects; and the right B+ tree is constructed based on the transaction records of each transaction account.

[0161] Based on preset suspected abnormal user screening rules, the first transaction account in the left B+ tree is determined; the first transaction account is a suspected abnormal transaction account.

[0162] Based on the abnormal user identification rules, it is determined whether the first transaction account is an abnormal user in the right B+ tree.

[0163] Optionally, constructing the left B+ tree and the right B+ tree based on the first data includes:

[0164] Based on the first data, a left B+ tree is constructed, with the transaction account as the primary key and the number of transactions, transaction amount, and transaction object as foreign keys, using the transaction account and transaction object as units;

[0165] Based on the first data, a right B+ tree is constructed, with each transaction record of the transaction account as a unit, consisting of the transaction account as the primary key and the transaction time, transaction time interval, number of transactions, transaction amount, and transaction object as foreign keys.

[0166] Optionally, before determining the first transaction account in the left B+ tree based on preset suspected abnormal user screening rules, the process includes:

[0167] Based on a preset sliding window time, the transaction time corresponding to the transaction record in the left B+ tree and the right B+ tree is marked as the transaction record within the preset sliding window time.

[0168] Based on the preset suspected abnormal user screening rules, and combined with the transaction records in the marked left B+ tree, the first transaction account in the left B+ tree is determined.

[0169] Based on the abnormal user identification rules and combined with the transaction records in the marked right B+ tree, it is determined whether the first transaction account is an abnormal user in the right B+ tree.

[0170] Optionally, based on preset suspected abnormal user screening rules and combined with the transaction records in the marked left B+ tree, the first transaction account in the left B+ tree is determined, including:

[0171] Determine whether the transaction records in the marked left B+ tree meet the preset suspected abnormal user screening rules;

[0172] If the preset suspected abnormal user screening rules are met, the transaction account is determined to be the first transaction account;

[0173] The preset suspected abnormal user screening rules include any one or more of the following:

[0174] The number of transactions corresponding to the transaction account is greater than a preset first threshold for the number of transactions;

[0175] The transaction amount corresponding to the transaction account is greater than the preset second threshold for transaction amount;

[0176] The transactions associated with the trading account are pre-defined risk trading targets.

[0177] Optionally, based on the abnormal user identification rules and in conjunction with the transaction records in the marked right B+ tree, before determining whether the first transaction account is an abnormal user in the right B+ tree, the process includes:

[0178] Determine whether the first transaction account exists in the transaction records of the right B+ tree;

[0179] If it does not exist, then filter the transaction records of the first transaction account from the first data, and the transaction time of the transaction record satisfies the sliding window time. After marking the transaction record, update the corresponding right B+ tree.

[0180] Optionally, based on the abnormal user determination rules and in conjunction with the transaction records in the marked right B+ tree, determining whether the first transaction account is an abnormal user in the right B+ tree includes:

[0181] In the right B+ tree, filter the marked transaction records corresponding to the first transaction account to determine whether the marked transaction records meet the abnormal user identification rules;

[0182] If the abnormal user determination rules are met, then the first transaction account is determined to be an abnormal user;

[0183] The rules for identifying abnormal users include any one or more of the following:

[0184] The number of transactions for the first trading account exceeds the preset third threshold for the number of transactions;

[0185] The transaction amount of the first transaction account is greater than the preset fourth threshold for transaction amount.

[0186] Optionally, the method further includes:

[0187] If the abnormal user exists, determine the specific abnormal type of the abnormal user's transaction records and send the corresponding warning information;

[0188] The abnormality types include: abnormal number of transactions, abnormal transaction amount, and abnormal transaction object.

[0189] Furthermore, the logical instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0190] It should be noted that the electronic device provided in this application embodiment can implement all the steps of the method embodiment for judging abnormal users and can achieve the same technical effect. Therefore, the parts and beneficial effects that are the same as those in the method embodiment will not be described in detail here.

[0191] On the other hand, this application also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can perform the methods for judging abnormal users provided by the above methods.

[0192] Specifically, the computer program products provided in this application embodiment can implement all the methods implemented in the above method embodiments and can achieve the same technical effects. Here, the parts that are the same as those in the method embodiments and the beneficial effects will not be described in detail.

[0193] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0194] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0195] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for identifying abnormal users, characterized in that, include: Retrieve transaction records from all trading accounts within a preset time period as the primary data; The transaction record includes the transaction account, transaction time, transaction time interval, number of transactions, transaction counterparty, transaction amount, and transaction number; Based on the first data, a left B+ tree and a right B+ tree are constructed; wherein, the left B+ tree is obtained by statistically analyzing the transaction accounts and transaction objects, and is used to initially identify suspected abnormal transaction bills; the right B+ tree is constructed based on the transaction records of each transaction account, and is used to further monitor the suspected abnormal transaction bills. Based on preset suspected abnormal user screening rules, the first transaction account in the left B+ tree is determined; the first transaction account is a suspected abnormal transaction account. Based on the abnormal user identification rules, it is determined whether the first transaction account is an abnormal user in the right B+ tree; The construction of the left B+ tree and the right B+ tree based on the first data includes: Based on the first data, a left B+ tree is constructed, with the transaction account as the primary key and the number of transactions, transaction amount, and transaction object as foreign keys, for each transaction account and transaction object. Multiple transaction records between the same transaction account and the same transaction object are merged into one transaction record. Based on the first data, a right B+ tree is constructed, with each transaction record of the transaction account as the unit, consisting of the transaction account as the primary key and the transaction time, transaction time interval, transaction number, transaction amount, and transaction object as foreign keys. Before determining the first transaction account in the left B+ tree based on preset suspected abnormal user screening rules, the process includes: Based on a preset sliding window time, the transaction time corresponding to the transaction record in the left B+ tree and the right B+ tree is marked as the transaction record within the preset sliding window time. Based on the preset suspected abnormal user screening rules, and combined with the transaction records in the marked left B+ tree, the first transaction account in the left B+ tree is determined. Based on the abnormal user identification rules and combined with the transaction records in the marked right B+ tree, it is determined whether the first transaction account is an abnormal user in the right B+ tree.

2. The method for determining abnormal users according to claim 1, characterized in that, The method of determining the first transaction account in the left B+ tree based on preset suspected abnormal user screening rules and combined with the transaction records in the marked left B+ tree includes: Determine whether the transaction records in the marked left B+ tree meet the preset suspected abnormal user screening rules; If the preset suspected abnormal user screening rules are met, the transaction account is determined to be the first transaction account; The preset suspected abnormal user screening rules include any one or more of the following: The number of transactions corresponding to the transaction account is greater than a preset first threshold for the number of transactions; The transaction amount corresponding to the transaction account is greater than the preset second threshold for transaction amount; The transactions associated with the trading account are pre-defined risk trading targets.

3. The method for determining abnormal users according to claim 1, characterized in that, The step of determining whether the first transaction account is an abnormal user based on the abnormal user identification rules and in conjunction with the transaction records in the marked right B+ tree includes the following steps before determining whether the first transaction account is an abnormal user in the right B+ tree: Determine whether the first transaction account exists in the transaction records of the right B+ tree; If it does not exist, then filter the transaction records of the first transaction account from the first data, and the transaction time of the transaction record satisfies the sliding window time. After marking the transaction record, update the corresponding right B+ tree.

4. The method for determining abnormal users according to claim 3, characterized in that, The step of determining whether the first transaction account is an abnormal user based on the abnormal user identification rules and in conjunction with the transaction records in the marked right B+ tree includes: In the right B+ tree, filter the marked transaction records corresponding to the first transaction account to determine whether the marked transaction records meet the abnormal user identification rules; If the abnormal user determination rules are met, then the first transaction account is determined to be an abnormal user; The rules for identifying abnormal users include any one or more of the following: The number of transactions for the first trading account exceeds the preset third threshold for the number of transactions; The transaction amount of the first transaction account is greater than the preset fourth threshold for transaction amount.

5. The method for determining abnormal users according to claim 1, characterized in that, The method further includes: If the abnormal user exists, determine the specific abnormal type of the abnormal user's transaction records and send the corresponding warning information; The abnormality types include: abnormal number of transactions, abnormal transaction amount, and abnormal transaction object.

6. A device for identifying abnormal users, characterized in that, The device includes: The acquisition module is used to acquire the transaction records of all trading accounts within a preset time period as the first data; the transaction records include the trading account, transaction time, transaction time interval, number of transactions, trading object, transaction amount, and transaction number; The construction module is used to construct a left B+ tree and a right B+ tree based on the first data; wherein, the left B+ tree is obtained by statistical analysis of the transaction account and transaction object within the preset time period, and is used to initially identify suspected abnormal transaction bills; the right B+ tree is constructed based on the transaction records of each transaction account, and is used to further monitor the suspected abnormal transaction bills. The filtering module is used to determine the first transaction account in the left B+ tree based on preset suspected abnormal user filtering rules; the first transaction account is a suspected abnormal transaction account. The determination module is used to determine whether the first transaction account is an abnormal user in the right B+ tree based on the abnormal user determination rules; In the process of constructing the left B+ tree and the right B+ tree based on the first data, the construction module is further configured to: construct the left B+ tree based on the first data, with the transaction account and transaction object as units, consisting of transaction records with the transaction account as the primary key and the number of transactions, transaction amount, and transaction object as foreign keys; construct the right B+ tree based on the first data, with each transaction record of the transaction account as the unit, consisting of transaction records with the transaction account as the primary key and the transaction time, transaction time interval, number of transactions, transaction amount, and transaction object as foreign keys; and merge multiple transaction records between the same transaction account and the same transaction object into one transaction record. Before determining the first transaction account in the left B+ tree based on preset suspected abnormal user filtering rules, the filtering module is further configured to: mark transaction records in the left B+ tree and the right B+ tree whose transaction times are within the preset sliding window time, based on a preset sliding window time; determine the first transaction account in the left B+ tree based on the preset suspected abnormal user filtering rules and the marked transaction records in the left B+ tree; and determine whether the first transaction account is an abnormal user in the right B+ tree based on abnormal user determination rules and the marked transaction records in the right B+ tree.

7. An electronic device comprising a processor and a memory storing a computer program, characterized in that, When the processor executes the computer program, it implements the method for determining abnormal users as described in any one of claims 1 to 5.

8. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the method for determining abnormal users as described in any one of claims 1 to 5.

Images