Risk merchant clustering analysis method and device, electronic equipment and storage medium

Abstract

Embodiments of the present application disclose a risk merchant clustering analysis method and device, electronic equipment and a storage medium, wherein the method comprises: obtaining merchant transaction data; generating a double-mode network of merchants and transaction groups based on a preset Gaussian mixture model according to the merchant transaction data; clustering nodes in the double-mode network of merchants and transaction groups to obtain a clustering result of merchant nodes, wherein the clustering result of merchant nodes is used to identify risk merchants, and the potential risk merchants can be accurately mined by starting from the distribution of the merchant transactions themselves.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of risk analysis, and particularly relates to a risk merchant clustering analysis method and device, an electronic device and a storage medium. BACKGROUND

[0002] With the expansion of Internet transaction platforms and the increase in platform payment settlement demand, the transaction fund witnessing service of commercial banks is developing rapidly, which also splits the original direct transaction between consumers and merchants into two parts, i.e., consumers pay to banks, and banks pay to merchants, which weakens the control degree of banks on consumer transactions.

[0003] The commonly used risk merchant monitoring method is based on the business experience to propose related indicators and develop a risk scoring method, which requires a large amount of work and samples to train statistical models such as machine learning or design scoring rules, and the implementation is relatively complex. SUMMARY

[0004] The embodiments of the present application provide a risk merchant clustering analysis method and device, an electronic device and a storage medium, which can use a clustering analysis method to analyze the distribution of merchant transactions and accurately mine potential risk merchants.

[0005] In a first aspect, the embodiments of the present application provide a risk merchant clustering analysis method, which comprises:

[0006] obtaining merchant transaction data;

[0007] generating a dual-mode network of merchants and transaction groups based on the merchant transaction data according to a preset Gaussian mixture model;

[0008] clustering nodes in the dual-mode network of merchants and transaction groups to obtain a clustering result of merchant nodes, and the clustering result of merchant nodes is used to identify risk merchants.

[0009] In an optional implementation, the generating a dual-mode network of merchants and transaction groups based on the merchant transaction data according to a preset Gaussian mixture model comprises:

[0010] calculating a posterior probability that an i th transaction in the merchant transaction data belongs to a k th transaction group and a latent variable matrix of the transaction based on the preset Gaussian mixture model, wherein i and k are positive integers;

[0011] generating the dual-mode network of merchants and transaction groups based on the posterior probability that the i th transaction in the merchant transaction data belongs to the k th transaction group and the latent variable matrix of the transaction.

[0012] In an optional implementation, the generating of the dual-mode network of the merchant and the transaction group based on the posterior probability that the i-th transaction in the merchant transaction data belongs to the k-th transaction group and the latent variable matrix of the transaction includes:

[0013] defining a first dual-mode network of the merchant and the transaction;

[0014] constructing a second dual-mode network of the transaction and the transaction group based on the latent variable matrix of the transaction and the posterior probability that the i-th transaction in the merchant transaction data belongs to the k-th transaction group;

[0015] merging the first dual-mode network and the second dual-mode network according to the transaction node to obtain a three-mode network;

[0016] constructing a connection weight between the merchant node and the transaction group node in the three-mode network, projecting the three-mode network into a dual-mode network of the merchant and the transaction group, and constructing an adjacency matrix of the merchant and the transaction group.

[0017] In an optional implementation, the first dual-mode network of the merchant and the transaction includes two types of nodes: transaction nodes and merchant nodes.

[0018] There is no connection between the same type of nodes in the first dual-mode network of the merchant and the transaction, and there is a connection between different types of nodes, which indicates that a transaction occurs in a merchant.

[0019] In an optional implementation, in the second dual-mode network of the transaction and the transaction group, when the probability that a first transaction node comes from a first transaction group node is not 0 or greater than a first threshold value, the first transaction node and the first transaction group node have a connection, and the weight of the connection is the posterior probability that the first transaction node comes from the first transaction group node; the first transaction node is any transaction node, and the first transaction group is any transaction group node.

[0020] In an optional implementation, the merging of the first dual-mode network and the second dual-mode network according to the transaction node to obtain a three-mode network includes:

[0021] determining information propagation from the merchant to the transaction and information propagation from the transaction to the transaction group based on the first dual-mode network and the second dual-mode network;

[0022] merging the first dual-mode network and the second dual-mode network based on the information propagation from the merchant node to the transaction node and the information propagation from the transaction node to the transaction group node to obtain the three-mode network.

[0023] In an alternative embodiment, the first and second dual-mode networks are combined to obtain the triple-mode network based on the information propagation from the merchant nodes to the transaction nodes and the information propagation from the transaction nodes to the transaction group nodes, including:

[0024] determining the total information propagated from a first merchant node to a second transaction group node, the first merchant being any of the merchant nodes and the second transaction group node being any of the transaction group nodes;

[0025] establishing a connection between the merchant nodes and the transaction group nodes based on the total information propagated from each merchant node to each transaction group node; wherein a connection exists between the first merchant node and the second transaction group node if and only if the amount of information propagated from the first merchant node to the second transaction group node is greater than 0 or greater than a second threshold value, and the weight of the connection is equal to the amount of information propagated.

[0026] In an alternative embodiment, the posterior probability that the i-th transaction in the merchant transaction data belongs to the k-th transaction group and the latent variable matrix of the transaction are calculated based on the preset Gaussian mixture model, including:

[0027] calculating the Gaussian distribution density function of the k-th type in the merchant transaction data;

[0028] calculating the probability density function of the transaction amount of a single transaction in the merchant transaction data based on the Gaussian distribution density function of the k-th type;

[0029] calculating the posterior probability that the i-th transaction in the merchant transaction data belongs to the k-th transaction group based on the probability density function of the transaction amount of a single transaction;

[0030] calculating the latent variable matrix of the transaction based on the posterior probability that the i-th transaction in the merchant transaction data belongs to the k-th transaction group.

[0031] In an alternative embodiment, the nodes in the dual-mode network of the merchant and the transaction group are clustered to obtain the clustering result of the merchant nodes, including:

[0032] performing cluster analysis on the merchant nodes and the transaction group nodes in the dual-mode network of the merchant and the transaction group to obtain the clustering result of the merchant nodes and the clustering result of the transaction group nodes;

[0033] The method further includes:

[0034] restoring the clustering result of the merchant nodes and the clustering result of the transaction group nodes to the transaction group normal distribution parameters for analysis to obtain the transaction group attributes corresponding to different categories of merchants.

[0035] In a second aspect, the embodiments of the present application provide a risk merchant clustering analysis device, comprising:

[0036] an acquisition module configured to acquire merchant transaction data;

[0037] a network conversion module configured to generate a dual-mode network of merchants and transaction groups based on a preset Gaussian mixture model and the merchant transaction data;

[0038] a clustering analysis module configured to cluster nodes in the dual-mode network of merchants and transaction groups, and obtain a clustering result of merchant nodes, the clustering result of merchant nodes being used to identify risk merchants.

[0039] In a third aspect, the embodiments of the present application further provide an electronic device comprising a processor, an input device, an output device and a memory, which are connected to each other, wherein the memory is configured to store a computer program, the computer program comprises program instructions, and the processor is configured to invoke the program instructions to execute the method according to the first aspect and any possible implementation manner thereof.

[0040] In a fourth aspect, the embodiments of the present application provide a computer storage medium storing a computer program, the computer program comprising program instructions, and the program instructions, when executed by a processor, cause the processor to execute the method according to the first aspect and any possible implementation manner thereof.

[0041] The embodiments of the present application acquire merchant transaction data, generate a dual-mode network of merchants and transaction groups based on a preset Gaussian mixture model and the merchant transaction data, cluster nodes in the dual-mode network of merchants and transaction groups, and obtain a clustering result of merchant nodes, which is used to identify risk merchants. The dual-mode network of merchants and transaction groups can be constructed by means of network clustering, and the nodes can be clustered. The potential risk merchants can be accurately mined by analyzing the distribution of the merchant transaction itself, and the method is relatively simple. BRIEF DESCRIPTION OF DRAWINGS

[0042] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced.

[0043] Figure 1 is a flowchart of a risk merchant clustering analysis method provided by the embodiments of the present application;

[0044] Figure 2 is a structural diagram of a dual-mode network of merchants and transactions provided by the embodiments of the present application;

[0045] Figure 3 This is a schematic diagram of the structure of a dual-mode network for transaction-transaction groups provided in an embodiment of this application;

[0046] Figure 4 This is a schematic diagram illustrating the information dissemination among merchants, transactions, and transaction groups, provided in an embodiment of this application.

[0047] Figure 5 This is a schematic diagram of the structure of a risk merchant clustering analysis device provided in an embodiment of this application;

[0048] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0049] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. The term "embodiment" as used herein means that a specific feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of this application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment mutually exclusive with other embodiments. Those skilled in the art will explicitly and implicitly understand that the embodiments described herein can be combined with other embodiments.

[0050] Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0051] The terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or apparatuses.

[0052] It should also be understood that the terminology used in this specification is for the purpose of describing particular embodiments only and is not intended to limit the scope of the application. As used in this specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0053] It should also be further understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0054] As used in this specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrases "if determined" or "if [described condition or event] is detected" may be interpreted, depending on the context, as "once determined," "in response to determination," "once [described condition or event] is detected," or "in response to detection of [described condition or event]."

[0055] To better understand the embodiments of this application, the methods of applying the embodiments of this application will be described below.

[0056] The Gaussian Mixed Model (GMM), also known as a Gaussian mixture model, involved in the embodiments of this application is a statistical clustering model. Its main idea is that the samples in the data are assumed to come from different probability distribution populations according to the probability distribution, the data in the same class come from the same probability distribution population, and the probability distribution populations are independent of each other.

[0057] The terminal devices mentioned in the embodiments of this application include, but are not limited to, desktop computers and mobile terminals. The mobile terminals may include various handheld devices with wireless communication functions, computing devices such as laptops, or other processing devices connected to wireless modems, etc.

[0058] Please see Figure 1 This is a schematic flowchart of a risk merchant clustering analysis method provided in an embodiment of this application, such as... Figure 1 As shown, the method may include:

[0059] 101. Obtain merchant transaction data.

[0060] The entity executing the risk merchant clustering analysis method in this application embodiment can be a risk merchant clustering analysis device, which can be deployed in a transaction platform system or risk control system, and the specific processing steps can be executed by terminal equipment or server.

[0061] In this embodiment of the application, the transaction volume of merchants is affected by many factors such as the merchant's industry, location, price positioning and number of consumers, which is a typical complex distribution. A Gaussian mixture model can be used to fit it and cluster the transactions of all merchants.

[0062] The aforementioned merchant transaction data refers to the transaction flow data of each merchant, which mainly includes the transaction amount of each transaction from multiple merchants. Specifically, merchant transaction data within a specific period can be obtained for risk assessment of these merchants within that period.

[0063] 102. Based on the preset Gaussian mixture model, generate a dual-mode network of merchants and transaction groups according to the above merchant transaction data.

[0064] In this embodiment of the application, based on the difference in transaction distribution between normal merchants and risky merchants, cluster analysis can be used to distinguish between risky merchants and normal merchants.

[0065] This application embodiment utilizes the idea of ​​network clustering to construct a dual-mode network of merchants and transaction groups (merchant-transaction group dual-mode network), and uses community discovery methods to cluster nodes.

[0066] The aforementioned pre-defined Gaussian mixture model is primarily used to fit merchant transaction data and cluster transactions across all merchants. Specifically, we can assume the number of merchants is M, and the number of transactions for the m-th merchant is n. m Its transaction amount vector can be represented as The total number of transactions for all merchants is X m =(x1,x2,...,x M () represents the total transaction amount for all merchants.

[0067] In one implementation, the Gaussian mixture model in the embodiments of this application may assume:

[0068] The number of trading groups is K, and the transaction amounts of the k-th trading group independently follow a normal distribution N(u k ,∑ k The proportion of transactions in the k-th transaction group to all transactions is α. k All merchant transactions originate from K transaction groups, i.e.

[0069] In one optional implementation, step 102 includes:

[0070] 021. Based on the above-mentioned preset Gaussian mixture model, calculate the posterior probability that the i-th transaction in the above-mentioned merchant transaction data belongs to the k-th transaction group, as well as the latent variable matrix of the transaction, where i and k are positive integers.

[0071] 022. Based on the posterior probability that the i-th transaction in the above merchant transaction data belongs to the k-th transaction group, and the latent variable matrix of the above transactions, generate the bimodal network of the above merchants and transaction groups.

[0072] Specifically, the Gaussian mixture model in this embodiment involves the calculation of posterior probability and the expectation matrix of latent variables, which will be described in detail later. That is, for the application scenario in this embodiment, the above-mentioned preset Gaussian mixture model algorithm (formula) can include an expression for the posterior probability that the i-th transaction belongs to the k-th transaction group, and can solve for it to obtain the latent variable matrix of the transaction, constructing a feature extraction based on GMM.

[0073] The posterior probability mentioned in the embodiments of this application is one of the fundamental concepts in information theory. In a communication system, after receiving a message, the probability that the message was sent is called the posterior probability. The posterior probability can be calculated based on the prior probability, and can be calculated using Bayes' theorem, using the prior probability and the likelihood function.

[0074] After constructing the basic feature matrix using a Gaussian mixture model, it is also necessary to aggregate the latent variable matrix at the transaction level to the merchant level. This will be discussed in detail below.

[0075] Further optionally, step 022 above includes:

[0076] 031. Define the first dual-mode network for merchants and transactions;

[0077] 032. Using the latent variable matrix of the above transactions and the posterior probability that the i-th transaction in the above merchant transaction data belongs to the k-th transaction group, construct a second bimodal network of transactions and transaction groups;

[0078] 033. Based on the above transaction nodes, merge the first dual-mode network and the second dual-mode network to obtain a tri-mode network;

[0079] 034. Construct the connection weights between the merchant nodes and transaction group nodes in the above three-mode network, project the above three-mode network into a two-mode network of the above merchants and transaction groups, and construct the adjacency matrix of the above merchants and transaction groups.

[0080] In general, in this embodiment of the application, two bimode networks are first defined: a first bimode network of merchant-transaction and a second bimode network of transaction-transaction group. The two bimode networks are merged into a trimode network. Then, the connection weights between merchant nodes and transaction group nodes in the network are constructed using the idea of ​​information propagation. The trimode network is projected into a weighted undirected bimode network of transaction group and merchant, and an adjacency matrix of transaction group and merchant is constructed.

[0081] In the embodiments of this application, the terms "first" and "second" in the first dual-mode network and the second dual-mode network are mainly used to conveniently distinguish between the merchant-transaction network and the transaction-transaction group network.

[0082] In one alternative implementation, the aforementioned first dual-mode network for merchants and transactions includes two types of nodes: transaction nodes and merchant nodes.

[0083] In the first dual-mode network of the aforementioned merchants and transactions, there are no connections within the same type of node, but there are connections between different types of nodes. These connections indicate that a transaction occurs within a single merchant.

[0084] First, you can refer to Figure 2 , Figure 2 This is a schematic diagram of a merchant-transaction dual-mode network provided in an embodiment of this application. Figure 2 As shown, for a merchant-transaction network, the network is defined as consisting of two types of nodes: transaction nodes and merchant nodes. There are no connections within the same type of node; connections only exist between merchant and transaction nodes. When a transaction occurs within a merchant, a connection is established between that merchant and the merchant.

[0085] In an optional implementation, in the second dual-mode network of the transaction and the transaction group, when the probability that the first transaction node comes from the first transaction group node is not 0 or is greater than the first threshold, the first transaction node and the first transaction group node have a connection, and the weight of the connection is the posterior probability that the first transaction node comes from the first transaction group node; the first transaction node is any of the above-mentioned transaction nodes, and the first transaction group is any of the above-mentioned transaction group nodes.

[0086] Then, for the transaction-transaction group network, a bimodal network of transactions and transaction groups can be constructed using the latent variable matrix of transactions. If the probability that a transaction node comes from a certain transaction group is not 0 or is greater than a first threshold (which can be set as needed, such as 0.0001), then there is a connection between that transaction node and a node in the transaction group, and the weight of the connection is the posterior probability A of the transaction node coming from the transaction group. ij .

[0087] You can refer to this. Figure 3 The diagram shows a schematic of a dual-mode network structure for a transaction-transaction group. Figure 3 As shown in the embodiments of this application, if the probability that a transaction node comes from a certain transaction group is not 0 or is greater than a certain threshold (such as 0.0001), then there is a connection between the transaction node and the transaction group node. The weight of the connection is the posterior probability that the transaction node comes from the transaction group. The transaction-transaction group bimodal network can be defined as a weighted undirected bimodal network of G(V1,V2,E,A), where V1 and V2 represent the transaction node and the transaction group node, respectively, E represents the connection in the network, and the weight of the connection can be represented by the posterior probability A obtained by the Gaussian mixture model. Figure 3The diagram shows two trading nodes and three trading groups connected to these two nodes. In actual applications, there may be other nodes and connections; this is only for illustrative purposes.

[0088] In one optional implementation, step 033 above includes:

[0089] Based on the first dual-mode network and the second dual-mode network mentioned above, the information dissemination from merchants to transactions and the information dissemination from transactions to transaction groups are determined.

[0090] Based on the information propagation from the merchant node to the transaction node and from the transaction node to the transaction group node, the first dual-mode network and the second dual-mode network are merged to obtain the tri-mode network.

[0091] Specifically, for the merchant-transaction group network, the two dual-mode networks of merchants are merged mainly based on the transaction nodes. This includes determining the information propagation from the merchant to the transaction, and determining the information propagation from the transaction to the transaction group. Finally, the connection between the merchant and the transaction group is established.

[0092] Figure 4 This is a schematic diagram illustrating the information dissemination of merchants, transactions, and transaction groups, provided as an embodiment of this application.

[0093] like Figure 4 As shown:

[0094] Here, enterprise i and enterprise j are merchants, corresponding to the aforementioned merchant i and merchant j, respectively. Information propagation from merchant to transaction: Merchant information is evenly distributed to each transaction. Taking enterprise i as an example, each transaction node connected to it receives 1 / n of the information. i n i Let i be the number of transactions for merchant i.

[0095] Secondly, information dissemination from trade to trader groups: Because the trade-trading-group network is authoritative, all trades x i1 The sum of the holding information and the weights of all the trading groups it is connected to is Therefore x i1 The information conveyed to trading group j is equal to

[0096] In one optional implementation, based on the information propagation from the merchant node to the transaction node and the information propagation from the transaction node to the transaction group node, the first dual-mode network and the second dual-mode network are merged to obtain the tri-mode network, including:

[0097] Determine the total information that is propagated from the first merchant node to the second transaction group node, wherein the first merchant is any of the aforementioned merchant nodes and the second transaction group node is any of the aforementioned transaction group nodes;

[0098] Based on the total information propagated from each merchant node to each transaction group node, a connection is established between the aforementioned merchant nodes and the aforementioned transaction group nodes; wherein, a connection exists between the aforementioned first merchant node and the aforementioned second transaction group node if and only if the amount of information propagated from the aforementioned first merchant node to the aforementioned second transaction group node is greater than 0 or greater than a second threshold, and the weight of the aforementioned connection is equal to the amount of information propagated.

[0099] Finally, establish the connection between merchants and the trading group: starting from merchant i, the total information disseminated to trading group j is as follows: A connection exists between a merchant and a trading group if and only if the amount of information disseminated by the merchant to the trading group is greater than 0 or greater than a second threshold (which can be set as needed). The weight of the connection is equal to the amount of information disseminated.

[0100] In one alternative implementation, the above-mentioned 021 includes:

[0101] Calculate the Gaussian distribution density function of the k-th class in the above merchant transaction data;

[0102] Based on the Gaussian distribution density function of the kth class mentioned above, the probability density function of the transaction amount of a single transaction in the above merchant transaction data is calculated.

[0103] Based on the probability density function of the transaction amount of the above single transaction, the posterior probability that the i-th transaction in the above merchant transaction data belongs to the k-th transaction group is calculated.

[0104] Based on the posterior probability that the i-th transaction belongs to the k-th transaction group in the above merchant transaction data, the latent variable matrix of the above transactions is calculated.

[0105] Specifically, this is a Gaussian mixture model algorithm in an embodiment of this application:

[0106] Θ={(α k ,θ k ), k=1,2,...,K} represents the parameter space of all trading groups, θ k =(u k ,∑ k Let ) represent the distribution parameters of the k-th transaction group, then the transaction amount x of a single transaction is... i The probability density function is:

[0107]

[0108] in, Let be the Gaussian distribution density function of the k-th class. Since the transaction log data is a one-dimensional vector, Its probability density function can be written as:

[0109] Since X is known data, i.e., observed data, but the trading group from which each transaction originates is unknown (denoted as γ), γ is true if and only if the i-th transaction originates from the k-th trading group. ik =1, otherwise γ ik =0. According to Bayes' theorem, the posterior probability of the observed data, i.e., the posterior probability that the i-th transaction belongs to the k-th transaction group, can be obtained as:

[0110]

[0111] The EM algorithm can then be used to solve for the parameters Θ and the expected matrix E[γ|X,Θ] of the latent variables for all categories, and a feature extraction based on GMM can be constructed, that is, the basic feature matrix is ​​constructed using GMM.

[0112] 103. Cluster the nodes in the dual-mode network of the above-mentioned merchants and transaction groups to obtain the clustering results of the merchant nodes. The above-mentioned clustering results of the merchant nodes are used to identify risky merchants.

[0113] Specifically, the spectral clustering method in the dual-mode network can be used to cluster the nodes in the merchant-transaction group dual-mode network. The clustering results of the merchant nodes can distinguish between normal merchants and risky merchants.

[0114] In an optional implementation, step 103 includes:

[0115] Cluster analysis was performed on the merchant nodes and transaction group nodes in the dual-mode network of the above-mentioned merchants and transaction groups to obtain the clustering results of the merchant nodes and the transaction group nodes.

[0116] The above methods also include:

[0117] The clustering results of merchant nodes and transaction group nodes are analyzed by restoring them to the normal distribution parameters of the transaction group to obtain the transaction group attributes corresponding to different categories of merchants.

[0118] In this embodiment, the Co-clustering method can be used to simultaneously cluster the two types of nodes in the merchant-transaction group dual-mode network to obtain the clustering results of merchants and the clustering results of transaction groups. The clustering results are restored to the normal distribution parameters of the transaction groups, and then the transaction group attributes corresponding to different types of merchants can be used to further summarize the transaction behavior characteristics of risky merchants. This embodiment does not limit this.

[0119] The method in this application embodiment constructs a bimodal network of merchants and transaction groups using network clustering. It simultaneously clusters both types of nodes using community detection, which not only accurately identifies potentially risky merchants but also further summarizes and generalizes their transaction characteristics, obtaining relevant features of risky transaction behavior. This provides a reference for identifying risky merchants, offers more accurate data support for the practical experience of business personnel, and provides banks with reference suggestions for further strengthening merchant risk management.

[0120] Current risk transaction identification methods primarily rely on empirically derived indicators, neglecting to analyze the distribution of merchant transactions themselves. However, this application's embodiments consider the differences in transaction distribution between normal and risky merchants, thus utilizing cluster analysis to differentiate between them. The risk merchant clustering analysis method in this application employs network clustering principles, using a Gaussian mixture model to convert merchant transaction data into network data. It then leverages spectral clustering in a dual-mode network to simultaneously cluster both types of nodes within the merchant-transaction group dual-mode network. The clustering results for merchant nodes can distinguish between normal and risky merchants.

[0121] Based on the aforementioned method embodiments, this application also provides a risk merchant clustering analysis device.

[0122] Please see Figure 5 , Figure 5 This is a schematic diagram of a risk merchant clustering analysis device provided in an embodiment of this application. Figure 5 As shown, the risk merchant clustering analysis device 500 includes:

[0123] Module 510 is used to acquire merchant transaction data;

[0124] The network conversion module 520 generates a dual-mode network of merchants and transaction groups based on a preset Gaussian mixture model and the aforementioned merchant transaction data.

[0125] The clustering analysis module 530 is used to cluster the nodes in the dual-mode network of the merchants and transaction groups mentioned above, and obtain the clustering results of the merchant nodes. The clustering results of the merchant nodes are used to identify risky merchants.

[0126] According to the specific implementation of the embodiments of this application, Figure 1 The relevant steps in the illustrated embodiment can be derived from... Figure 5 The various modules in the risk merchant clustering analysis device 500 shown are used to perform this, which will not be elaborated here.

[0127] Through the risk merchant clustering analysis device 500 of this application embodiment, the risk merchant clustering analysis device 500 can acquire merchant transaction data; based on a preset Gaussian mixture model, it generates a bimodal network of merchants and transaction groups according to the merchant transaction data; it clusters the nodes in the bimodal network of merchants and transaction groups to obtain the clustering results of merchant nodes. The clustering results of merchant nodes are used to identify risky merchants. By using the idea of ​​network clustering, a bimodal network of merchants and transaction groups can be constructed, and node clustering can be performed. Starting from the distribution of merchant transactions themselves, the analysis can accurately discover potential risky merchants, which is relatively simple to implement.

[0128] Please see Figure 6 , Figure 6 This is a schematic diagram of the structure of an electronic device disclosed in an embodiment of this application. For example... Figure 6 As shown, the electronic device 600 includes a processor 601 and a memory 602. The electronic device 600 may also include a bus 603, through which the processor 601 and the memory 602 can be interconnected. The bus 603 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus 603 can be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, Figure 6 The bus is represented by a single thick line, but this does not indicate that there is only one bus or one type of bus. The electronic device 600 may further include an input / output device 604, which may include a display screen, such as a liquid crystal display (LCD). The memory 602 is used to store one or more programs containing instructions; the processor 601 is used to invoke the instructions stored in the memory 602 to execute programs such as… Figure 1 The illustrated embodiment includes some or all of the steps of a risk merchant clustering analysis method.

[0129] It should be understood that, in the embodiments of this application, the processor 601 may be a central processing unit (CPU), but it may also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0130] Input device 602 may include a touchpad, a fingerprint sensor (for collecting the user's fingerprint information and fingerprint orientation information), a microphone, etc., and output device 603 may include a display (LCD, etc.), a speaker, etc.

[0131] The memory 604 may include read-only memory and random access memory, and provides instructions and data to the processor 601. A portion of the memory 604 may also include non-volatile random access memory. For example, the memory 604 may also store device type information.

[0132] The electronic device 600 of this application embodiment acquires merchant transaction data; generates a bimodal network of merchants and transaction groups based on a preset Gaussian mixture model; clusters the nodes in the bimodal network of merchants and transaction groups to obtain clustering results for merchant nodes. The clustering results for merchant nodes are used to identify risky merchants. By using the idea of ​​network clustering, a bimodal network of merchants and transaction groups can be constructed, and node clustering can be performed. By analyzing the distribution of merchant transactions themselves, potential risky merchants can be accurately identified, which is relatively simple to achieve.

[0133] This application also provides a computer storage medium storing a computer program for electronic data interchange, which causes a computer to perform some or all of the steps of any of the risk merchant clustering analysis methods described in the above method embodiments.

[0134] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0135] In the several embodiments provided in this application, it should be understood that the disclosed apparatus can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or modules may be electrical or other forms.

[0136] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0137] If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned memory includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

Claims

1. A cluster analysis method for risky merchants, characterized in that, The method includes: Obtain merchant transaction data; Based on a preset Gaussian mixture model, a dual-mode network for merchants and transaction groups is generated according to the merchant transaction data; Clustering is performed on the nodes in the dual-mode network of the merchants and transaction groups to obtain the clustering results of the merchant nodes. The clustering results of the merchant nodes are used to identify risky merchants. The process of generating a dual-mode network for merchants and transaction groups based on a preset Gaussian mixture model and the merchant transaction data includes: Based on the preset Gaussian mixture model, the posterior probability that the i-th transaction in the merchant transaction data belongs to the k-th transaction group is calculated, as well as the latent variable matrix of the transaction, where i and k are positive integers; Based on the posterior probability that the i-th transaction in the merchant transaction data belongs to the k-th transaction group, and the latent variable matrix of the transaction, a bimodal network of the merchant and the transaction group is generated.

2. The method according to claim 1, characterized in that, The step of generating a bimodal network for the merchant and the transaction group based on the posterior probability of the i-th transaction belonging to the k-th transaction group in the merchant transaction data and the latent variable matrix of the transaction includes: Define the first dual-mode network for merchants and transactions; Using the latent variable matrix of the transactions and the posterior probability that the i-th transaction in the merchant transaction data belongs to the k-th transaction group, a second bimodal network of transactions and transaction groups is constructed. The first dual-mode network and the second dual-mode network are merged according to the transaction nodes to obtain a tri-mode network; Construct the connection weights between the merchant nodes and the transaction group nodes in the three-mode network, project the three-mode network into a two-mode network of the merchants and the transaction group, and construct the adjacency matrix of the merchants and the transaction group.

3. The method according to claim 2, characterized in that, The first dual-mode network for merchants and transactions includes two types of nodes: transaction nodes and merchant nodes; In the first dual-mode network of merchants and transactions, there are no connections within the same type of node, but there are connections between different types of nodes. The connection indicates that a transaction occurs within a single merchant.

4. The method according to claim 2, characterized in that, In the second dual-mode network of transactions and transaction groups, when the probability that the first transaction node comes from the first transaction group node is not 0 or is greater than the first threshold, the first transaction node and the first transaction group node have a connection, and the weight of the connection is the posterior probability that the first transaction node comes from the first transaction group node; the first transaction node is any of the transaction nodes, and the first transaction group is any of the transaction group nodes.

5. The method according to claim 2, characterized in that, The step of merging the first dual-mode network and the second dual-mode network according to the transaction node to obtain a tri-mode network includes: Based on the first dual-mode network and the second dual-mode network, the information propagation from merchants to transactions and the information propagation from transactions to transaction groups are determined. Based on the information propagation from the merchant node to the transaction node and from the transaction node to the transaction group node, the first dual-mode network and the second dual-mode network are merged to obtain the tri-mode network.

6. The method according to claim 5, characterized in that, The process of merging the first dual-mode network and the second dual-mode network based on the information propagation from the merchant node to the transaction node and the information propagation from the transaction node to the transaction group node to obtain the tri-mode network includes: Determine the total information propagated from the first merchant node to the second transaction group node, wherein the first merchant is any of the aforementioned merchant nodes and the second transaction group node is any of the aforementioned transaction group nodes; Based on the total information propagated from each merchant node to each transaction group node, a connection is established between the merchant node and the transaction group node; wherein, a connection exists between the first merchant node and the second transaction group node if and only if the amount of information propagated from the first merchant node to the second transaction group node is greater than 0 or greater than a second threshold, and the weight of the connection is equal to the amount of information propagated.

7. The method according to claim 1 or 2, characterized in that, The calculation of the posterior probability that the i-th transaction in the merchant transaction data belongs to the k-th transaction group, based on the preset Gaussian mixture model, and the latent variable matrix of the transactions, includes: Calculate the Gaussian distribution density function of the k-th class in the merchant transaction data; Based on the Gaussian distribution density function of the kth class, the probability density function of the transaction amount of a single transaction in the merchant transaction data is calculated. The posterior probability that the i-th transaction in the merchant's transaction data belongs to the k-th transaction group is calculated based on the probability density function of the transaction amount of the single transaction. Based on the posterior probability that the i-th transaction in the merchant transaction data belongs to the k-th transaction group, the latent variable matrix of the transaction is calculated.

8. The method according to claim 1, characterized in that, Clustering is performed on the nodes in the dual-mode network of merchants and transaction groups to obtain the clustering results for merchant nodes, including: Cluster analysis is performed on the merchant nodes and transaction group nodes in the dual-mode network of the merchants and transaction groups to obtain the clustering results of the merchant nodes and the transaction group nodes. The method further includes: The clustering results of merchant nodes and transaction group nodes are restored to the normal distribution parameters of the transaction group for analysis to obtain the transaction group attributes corresponding to different categories of merchants.

9. A risk merchant clustering analysis device, characterized in that, include: The acquisition module is used to acquire merchant transaction data; The network conversion module generates a dual-mode network for merchants and transaction groups based on a preset Gaussian mixture model and the merchant transaction data. The clustering analysis module is used to cluster the nodes in the dual-mode network of the merchants and transaction groups to obtain the clustering results of the merchant nodes. The clustering results of the merchant nodes are used to identify risky merchants. The network conversion module is specifically used for: Based on the preset Gaussian mixture model, the posterior probability that the i-th transaction in the merchant transaction data belongs to the k-th transaction group is calculated, as well as the latent variable matrix of the transaction, where i and k are positive integers; Based on the posterior probability that the i-th transaction in the merchant transaction data belongs to the k-th transaction group, and the latent variable matrix of the transaction, a bimodal network of the merchant and the transaction group is generated.

10. An electronic device, characterized in that, The system includes a processor, an input device, an output device, and a memory, which are interconnected. The memory is used to store a computer program, which includes program instructions. The processor is configured to invoke the program instructions to perform the method as described in any one of claims 1-8.

11. A computer storage medium, characterized in that, The computer storage medium stores a computer program, the computer program including program instructions, which, when executed by a processor, cause the processor to perform the method as described in any one of claims 1-8.

Images