Client abnormal behavior processing method and device, electronic equipment and storage medium

Abstract

The application discloses a customer abnormal behavior processing method and device, electronic equipment and a storage medium. The method comprises the following steps: acquiring customer feature data; generating a local resultant force change rate according to the customer feature data; and judging customer abnormal behavior in the customer feature data according to the local resultant force change rate. The application realizes automatic identification of customer abnormal behavior. The application can be used in the financial field.

Description

Technical Field

[0001] This application relates to the field of customer abnormal behavior handling technology, and in particular to a customer abnormal behavior handling method, device, electronic device, and storage medium. Background Technology

[0002] As banking applications expand, the volume of banking transaction data is gradually entering the era of big data. However, the rapid increase in abnormal transaction volume has also brought significant risks to the banking industry and endless hidden dangers to customer funds and property losses.

[0003] For traditional banks, digitizing customer information allows for a more comprehensive analysis of customer behavior characteristics. Traditional detection methods utilize a large number of samples with known labeled attributes to train a model.

[0004] However, in reality, due to privacy restrictions or customers concealing default information for various reasons, banks cannot obtain the default label for each customer, but only know the default rate among all samples. This increases the predictive difficulty of customer classification models in supervised and semi-supervised learning scenarios. At the same time, the high-dimensional and complex features of customer information also increase the difficulty of detecting abnormal customer behavior. Summary of the Invention

[0005] This application provides a method, apparatus, electronic device, and storage medium for handling abnormal customer behavior, so as to achieve automatic identification of abnormal customer behavior.

[0006] The embodiments of this application adopt the following technical solutions:

[0007] In a first aspect, embodiments of this application provide a method for handling abnormal customer behavior, wherein the method includes:

[0008] Obtain customer characteristic data;

[0009] Based on the customer characteristic data, generate the local resultant force change rate;

[0010] Based on the rate of change of the local resultant force, abnormal customer behavior in the customer characteristic data is determined.

[0011] In some embodiments, the rate of change of the local resultant force is:

[0012] LFV(i,j)=|ΘLF(i,M)-ΘLF(j,M)|

[0013] The total change in the local resultant force is:

[0014]

[0015] The change in the local resultant force is:

[0016] ΔLF(i,m)=||LF(i,m)|-|LF(i,m+1)||,m=1,2,...,M-1;

[0017] The local resultant force is:

[0018]

[0019] In some embodiments, the local resultant force further includes:

[0020] The charge Q of point charge i i Defined as:

[0021] Among them, Q i Let R be the charge of point charge i. ij Let be the distance between point charge i and point charge j.

[0022] In some embodiments, determining abnormal customer behavior in the customer characteristic data based on the local resultant force change rate includes:

[0023] The local resultant force change rate LFV(i,j) is sorted in ascending order to obtain LFVList;

[0024] Define the threshold for the rate of change of local resultant force:

[0025] α=ω×σ(LFVList)+EX(LFVList)

[0026] If the rate of change of the local resultant force is greater than α, then abnormal customer behavior is considered to exist.

[0027] In some embodiments, the local resultant force LF(i,m) includes:

[0028] If the region where the anomaly point is located is a low-density region, the corresponding local resultant force LF(i,m) will be larger.

[0029] If the normal point is in a high-density region, the corresponding local resultant force LF(i,m) will be smaller.

[0030] In some embodiments, the charge Q i ,include:

[0031] For a point within a low-density region, due to its greater distance from neighboring points, its charge Q i The smaller the value;

[0032] Points within a high-density region have a higher charge Q because they are closer to their neighbors. i The larger the value, the better.

[0033] In some embodiments, the customer characteristic data includes at least one of the following: gender, age, education level, number of family members, annual income, type of employer, occupation information, credit rating, whether or not they have financial products, whether or not they have a credit card, total bank loan amount, and average daily deposit over the past year.

[0034] Secondly, embodiments of this application also provide a customer abnormal behavior processing device, wherein the device includes:

[0035] The acquisition module is used to acquire customer characteristic data;

[0036] The generation module is used to generate the local resultant force change rate based on the customer characteristic data;

[0037] The discrimination module is used to determine abnormal customer behavior in the customer characteristic data based on the local resultant force change rate.

[0038] Thirdly, embodiments of this application also provide an electronic device, including: a processor; and a memory arranged to store computer-executable instructions, which, when executed, cause the processor to perform the above-described method.

[0039] Fourthly, embodiments of this application also provide a computer-readable storage medium that stores one or more programs, which, when executed by an electronic device including multiple applications, cause the electronic device to perform the above-described method.

[0040] The at least one technical solution adopted in this application embodiment can achieve the following beneficial effects: acquiring customer feature data; generating a local resultant force change rate based on the customer feature data; and determining abnormal customer behavior in the customer feature data based on the local resultant force change rate. Using the above method, when the customer data distribution presents a complex distribution or there are no abnormal customer data labels, methods based solely on distance or density are prone to misjudging samples and are difficult to effectively detect abnormal customer behavior. By calculating the difference in local resultant force change rates to identify anomalies, the effect of effectively judging abnormal customer behavior is achieved even in complex sample distribution scenarios. Attached Figure Description

[0041] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0042] Figure 1 This is a schematic diagram of the partial resultant force in an embodiment of this application;

[0043] Figure 2(a)-Figure 2(b)This is a schematic diagram of the local resultant force of abnormal and normal points in an embodiment of this application;

[0044] Figure 3 This is a schematic diagram of the distribution of the customer's artificial dataset DS in the embodiments of this application;

[0045] Figure 4 This is a schematic diagram illustrating the total changes in LF at abnormal and normal points in the embodiments of this application;

[0046] Figure 5 This is a schematic diagram of the LFVList of the dataset DS in the embodiments of this application;

[0047] Figure 6 This is a graph showing the experimental results of ω values ​​in the embodiments of this application;

[0048] Figure 7 This is a schematic diagram of the customer abnormal behavior handling method in the embodiments of this application;

[0049] Figure 8 This is a schematic diagram of the customer abnormal behavior processing device in the embodiments of this application;

[0050] Figure 9 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0052] The technical terms used in this application's embodiments are as follows:

[0053] Outliers: Points that deviate from the normal data. These points exhibit significantly different behavior from other normal data and are usually considered as anomalies.

[0054] Abnormal customer behavior refers to deviations in a customer's trading behavior from their historical trading habits and transaction amounts. Examples include a single transaction exceeding the single transaction limit, a cumulative or continuous number of transactions exceeding the limit within a day, or a customer's investment strategy for a particular asset class being inconsistent with their historical trading habits.

[0055] Local force (LF): The resultant force exerted on a point by its neighboring sample points within a local region.

[0056] Local resultant force change ΔLF: The change in the local resultant force of a sample point due to a change in the number of its neighbors.

[0057] Total local resultant force change ΘLF: The sum of the local resultant force changes corresponding to the number of nearest neighbors of a sample point from 1 to the maximum value.

[0058] Local resultant force change rate (LFV): The difference in the total change of local resultant force at the sample point.

[0059] Currently, based on their underlying principles, machine learning-based methods for detecting anomalies in bank customer behavior are mainly classified into three categories, both domestically and internationally:

[0060] (1) A method based on classification.

[0061] (2) The method based on the nearest neighbor idea.

[0062] (3) Methods based on clustering.

[0063] The technical background of each technology will be introduced in detail below:

[0064] Classification-based methods learn a model from a set of labeled data and then use the learned model to classify test samples into a specific class. They are based on the assumption that a classifier capable of distinguishing between normal and abnormal classes can be learned from an existing data feature space. Currently, classic classification methods include support vector machine (SVM)-based methods, neural network-based methods, Bayesian network-based methods, and rule-based methods. SVM-based methods are commonly used for single-class classification problems. These techniques utilize a first-class learning method of SVM to learn a region containing the boundaries of the training data samples. Neural network-based methods train a neural network on normal data to learn different normal classes. Each test sample is fed as input to the neural network, and the network determines whether the sample is normal or abnormal based on whether it accepts the test input.

[0065] The nearest neighbor-based approach assumes that normal samples are located in densely distributed data regions, while anomalous samples are located far from their nearest neighbors. Nearest neighbor-based anomaly detection methods require defining a distance or similarity metric between two data samples, which can be broadly categorized into two types: one uses the distance from a data sample to its k-th nearest neighbor as the anomaly value (e.g., k-nearest neighbor); the other calculates the relative density of each data sample to calculate its anomaly value (e.g., Local Outlier Factor, LOF). The k-nearest neighbor and LOF methods are classic approaches, and researchers have subsequently optimized them. Optimizations to the k-nearest neighbor method include reducing the sample search space and partitioning the samples to improve detection efficiency and reduce complexity. Researchers have transformed the degree of anomaly in the k-nearest neighbor method into the degree of deviation from the neighborhood centroid, enhancing its ability to detect local anomalies and improving its anomaly detection performance. However, because the method itself is insensitive to anomaly clusters, it cannot effectively detect clustered anomalies. Improvements to the LOF method include optimizations to local detection methods and improvements to the neighborhood calculation method. Researchers modified the original neighborhood calculation method of the LOF method to incremental calculation, and improved the anomaly detection performance by using chain distance.

[0066] Clustering-based methods can be categorized into three main types based on their underlying assumptions. The first type assumes normal data belongs to a cluster, while anomalous data does not (e.g., Density-Based Spatial Clustering of Applications with Noise, DBSCAN). This approach applies a known clustering method to the dataset and declares data samples that do not belong to any cluster as anomalous. A drawback of this type is that it doesn't actively seek out anomalies, as its primary goal is to find clusters, making it less sensitive to anomalies. The second type places normal data near the nearest cluster center, while anomalous data is far from it (e.g., k-means). This method uses clustering to group the data, and for each data sample, its distance to the nearest cluster center is used as its anomalous score. The third type places normal data in large, dense clusters, while anomalous data in small, sparse clusters (e.g., Cluster-Based Local Outlier Factor, CBLOF). Researchers improved upon the k-means clustering method by iteratively removing outliers to obtain higher-density cluster centers. Building upon previous methods, they innovatively proposed a novel clustering approach. To better detect global anomalies, they iteratively defined cluster boundaries using cluster centers and boundary points, using this as an effective means of distinguishing between positive and negative clusters. However, this method has poor detection capabilities for potential local anomalies.

[0067] During their research, the inventors discovered that although the three solutions mentioned above solved the problem of detecting abnormal bank customers to some extent, they also had some shortcomings.

[0068] First, while classification-based methods offer faster detection speeds during the testing phase, they still face challenges in detecting abnormal customer behavior in the banking sector. These challenges include difficulty in obtaining positive and abnormal sample labels, the significant impact of threshold settings on results, and the difficulty in obtaining highly correlated abnormal scores. Furthermore, some classification methods struggle to effectively identify specific anomalies, such as localized anomalies.

[0069] Secondly, the advantage of nearest neighbor-based methods is that they make no assumptions about the data's generation and distribution, relying purely on the data itself. Furthermore, because they can utilize numerous methods for calculating distances between data points, they are easily applied to domains with diverse data types. However, nearest neighbor-based methods heavily depend on the defined distance metric between samples. When the data distribution is complex, defining this distance metric is often difficult, leading to poor detection performance. In addition, these methods are slow in anomaly detection, computationally complex, and susceptible to the curse of dimensionality.

[0070] Finally, clustering-based methods can operate in unsupervised mode, do not require labels for positive and outlier data, adapt to complex data types, and have a relatively fast detection speed. However, the performance of this method is highly dependent on the effectiveness of the clustering method in capturing the cluster structure of normal samples; when more complex anomaly types occur, the detection effect is poor.

[0071] To address the aforementioned shortcomings, the customer abnormal behavior processing method in this application mainly solves the problem of detecting customer abnormal behavior under unlabeled and complex data distribution conditions. By using a customer abnormal behavior analysis method based on local resultant force offset, a threshold is automatically determined to achieve automatic identification of customer abnormal behavior.

[0072] The technical solutions provided by the various embodiments of this application are described in detail below with reference to the accompanying drawings.

[0073] This application provides a method for handling abnormal customer behavior, such as... Figure 7 As shown, a flowchart of a customer abnormal behavior handling method in an embodiment of this application is provided. The method includes at least the following steps S710 to S730:

[0074] Step S710: Obtain customer characteristic data.

[0075] Customer characteristic data includes multiple dimensions and can be obtained through various customer acquisition channels. Furthermore, customer characteristic data does not include tag data.

[0076] Step S720: Generate the local resultant force change rate based on the customer characteristic data.

[0077] The local resultant force change rate is further generated based on the aforementioned customer characteristic data. The local resultant force change rate is determined based on the total local change, which includes multiple local resultant force changes. Furthermore, these multiple local resultant force changes are determined by the local resultant force. It can be understood that the local resultant force is determined based on the amount of charge.

[0078] Step S730: Based on the local resultant force change rate, determine the abnormal customer behavior in the customer characteristic data.

[0079] Based on the local resultant force change rate, further determine the relevant threshold range, and based on the local resultant force change rate and the relevant threshold range, determine the abnormal customer behavior in the customer characteristic data.

[0080] Using the methods described above, outliers in abnormal transaction behaviors can be efficiently identified and captured, and an anomaly risk capture model based on local synergy can be constructed, addressing situations where it is difficult to obtain abnormal customer tags or where customer data distribution is complex.

[0081] Furthermore, the outlier detection process summarized by the above method differs from conventional clustering algorithms. It identifies outliers by analyzing the rate of change of local resultant forces between sample points and calculating the difference in the rate of change. By adjusting the size of the number of neighbors, it can simultaneously achieve effective identification of both global and local outliers.

[0082] In one embodiment of this application, the rate of change of the local resultant force is:

[0083] LFV(i,j)=|ΘLF(i,M)-ΘLF(j,M)|

[0084] The total change in the local resultant force is:

[0085]

[0086] The change in the local resultant force is:

[0087] ΔLF(i,m)=||LF(i,m)|-|LF(i,m+1)||,m=1,2,...,M-1;

[0088] The local resultant force is:

[0089] In practical implementation, the local resultant force (LF) between point charge i and its m nearest neighbors can be calculated as follows:

[0090]

[0091] Unit vector This encapsulates the direction information and distance between point i and its neighbors, where m is the number of i's neighbors. Generally, points with larger charges are less affected by their neighbors but have a larger influence on their neighbors; points with smaller charges are more affected by their neighbors. Therefore, LF is defined as:

[0092]

[0093] In one embodiment of this application, the local resultant force further includes: reducing the charge Q of point charge i. iDefined as: Among them, Q i Let R be the charge of point charge i. ij Let be the distance between point charge i and point charge j.

[0094] In practical implementation, the charge Q of point charge i is... i Defined as:

[0095] In one embodiment of this application, determining abnormal customer behavior in the customer characteristic data based on the local resultant force change rate includes: sorting the local resultant force change rates LFV(i,j) in ascending order to obtain LFVList; and defining a threshold for the local resultant force change rate.

[0096] α=ω×σ(LFVList)+EX(LFVList)

[0097] If the rate of change of the local resultant force is greater than α, then abnormal customer behavior is considered to exist.

[0098] In practice, the LF is sorted in ascending order. For the sorted list, assuming its size is n, for each adjacent LF(i) and LF(i+1) in the LF list, the LFV(i,j) of each point is calculated. Thus, a list of LFV(i,j) of size n-1 (denoted as LFVList) is obtained. Each element in LFVList corresponds to two points in the original dataset. The threshold α of LFV is defined as follows:

[0099] α=ω×σ(LFVList)+EX(LFVList)

[0100] Where ω is the coefficient, σ is the standard deviation, and EX is the expected value. For example... Figure 5 As shown, the sharp waves fluctuate slightly around the expected value of LFVList, and the width of the sharp waves is much smaller than the width ratio of the smooth lines.

[0101] In one embodiment of this application, the local resultant force LF(i,m) includes: if the region where the abnormal point is located is a low-density region, the corresponding local resultant force LF(i,m) is larger; if the normal point is located in a high-density region, the corresponding local resultant force LF(i,m) is smaller.

[0102] Since the areas where anomalies are located are often low-density areas with uneven density distribution, the directions of the forces exerted on them by their neighbors are roughly the same, resulting in a larger local resultant force LF(i,m). Conversely, normal points are often located in high-density areas with relatively even density distribution, resulting in greater differences in the directions of the forces exerted on them by their neighbors, thus leading to a smaller local resultant force LF(i,m).

[0103] In one embodiment of this application, the charge quantity Q i This includes: for points in low-density regions, due to their greater distance from neighboring points, their charge Q is... i The smaller the value, the higher the charge Q of points within a high-density region, due to their closer proximity to neighboring points. i The larger the value, the better.

[0104] Points in low-density regions have smaller charge values ​​because they are farther away from their neighboring points. Conversely, points in high-density regions have larger charge values ​​because they are closer to their neighboring points.

[0105] In one embodiment of this application, the customer characteristic data includes at least one of the following: gender, age, education level, number of family members, annual income, type of employer, occupational information, credit rating, whether or not they have financial products, whether or not they have a credit card, total amount of bank loans, and average daily deposits over the past year.

[0106] It is understood that the above customer characteristic data is only an example and is not intended to limit the scope of protection in the embodiments of this application.

[0107] This application embodiment also provides a customer abnormal behavior processing device 800, such as Figure 8 As shown, a schematic diagram of the customer abnormal behavior processing device 800 in this application embodiment is provided. The customer abnormal behavior processing device 800 includes at least: an acquisition module 810, a generation module 820, and a discrimination module 830, wherein:

[0108] In one embodiment of this application, the acquisition module 810 is specifically used to: acquire customer characteristic data.

[0109] Customer characteristic data includes multiple dimensions and can be obtained through various customer acquisition channels. Furthermore, customer characteristic data does not include tag data.

[0110] In one embodiment of this application, the generation module 820 is specifically used to: generate a local resultant force change rate based on the customer characteristic data.

[0111] The local resultant force change rate is further generated based on the aforementioned customer characteristic data. The local resultant force change rate is determined based on the total local change, which includes multiple local resultant force changes. Furthermore, these multiple local resultant force changes are determined by the local resultant force. It can be understood that the local resultant force is determined based on the amount of charge.

[0112] In one embodiment of this application, the discrimination module 830 is specifically used to: determine abnormal customer behavior in the customer characteristic data based on the local resultant force change rate.

[0113] Based on the local resultant force change rate, further determine the relevant threshold range, and based on the local resultant force change rate and the relevant threshold range, determine the abnormal customer behavior in the customer characteristic data.

[0114] It is understood that the above-mentioned customer abnormal behavior processing device can implement each step of the customer abnormal behavior processing method provided in the foregoing embodiments. The relevant explanations of the customer abnormal behavior processing method are applicable to the customer abnormal behavior processing device, and will not be repeated here.

[0115] To better illustrate the implementation process of the customer abnormal behavior handling method in the embodiments of this application, the following detailed description is provided in conjunction with the accompanying drawings.

[0116] The local net force shift in bank customer data reflects the relationship between a sample point and its neighbors. For a more intuitive understanding, in the embodiments of this application, customer data is considered as point charges with different amounts of charge depending on their distribution area, with abnormal samples located in sparse regions and normal samples in dense regions. According to the Coulomb force formula, the force between two point charges is expressed as:

[0117]

[0118] Where F ij K represents the force between point charges i and j. e Q is the coulomb constant. i and Q j Let R be the charge of point charge i and point charge j, respectively. ij Let i be the distance between point charges i and j. It is the unit vector on the line connecting the two charges. If, within a local region, the distance between a point charge and its different neighboring charges does not change significantly, equation (1) can be simplified to:

[0119]

[0120] Specifically, such as Figure 1 Schematic diagram of local resultant force (P1-P4 are sample points, F12, F13, and F14 are the forces between P1 and its adjacent points P2, P3, and P4, respectively, and LF is the local resultant force of the other three points on P1)

[0121] like Figure 1 As shown, the local resultant force (LF) between a point charge i and its m nearest neighbors can be calculated as follows:

[0122]

[0123] Unit vector This encapsulates the direction information and distance between point i and its neighbors, where m is the number of i's neighbors. Generally, points with larger charges are less affected by their neighbors but have a larger influence on their neighbors; points with smaller charges are more affected by their neighbors. Therefore, LF is defined as:

[0124]

[0125] The charge Q of point charge i i Defined as:

[0126]

[0127] Points in low-density regions have smaller charges due to their greater distance from neighboring points, while points in high-density regions have larger charges due to their closer proximity to neighboring points. Since anomalous points are often located in low-density regions with uneven density distribution, the directions of the forces exerted on them by their neighbors are roughly the same, resulting in a larger local resultant force LF(i,m). Conversely, normal points are often located in high-density regions with more even density distribution, leading to greater differences in the directions of the forces exerted on them by their neighbors, resulting in a smaller local resultant force LF(i,m). Figures 2(a)-(b) illustrate this result visually.

[0128] As shown in Figures 2(a)-(b), the local resultant forces of the abnormal point and the normal point are illustrated (P1-P7 are sample points; in Figure 2(a), LF1-LF5 represent the local resultant forces generated by 1 to 5 neighbors of the abnormal point P1; in Figure 2(b), LF1-LF5 represent the local resultant forces generated by 1 to 5 neighbors of the normal point P2).

[0129] Further examining the influence of the number of neighbors *m* on the local resultant force *LF*, we assign *LF1*, *LF2*, *LF3*, *LF4*, and *LF5* to represent the local resultant forces with 1, 2, 3, 4, and 5 neighbors, respectively. Figures 2(a)-(b) show that for a normal point located in a dense region, the change in the local resultant force *LF* is relatively small; conversely, for an abnormal point located in a sparse region, the change in the local resultant force *LF* is relatively large. Figures 2(a)-(b) also show that the magnitude of the local resultant force at point P1 is much greater than that at point P2.

[0130] Since the directions of the LF forces at outliers are roughly the same, their local resultant force is approximately proportional to the number of neighbors. Conversely, since the directions of the LF forces at normal points are inconsistent, the LF force at normal points remains largely unchanged with the increase in the number of neighbors. Therefore, the change in LF, ΔLF(i,m), is defined as follows:

[0131] ΔLF(i,m)=||LF(i,m)|-|LF(i,m+1)||,m=1,2,...,M-1 (6)

[0132] Where LF(i,m) represents the magnitude of the local resultant force LF at point i, and M represents the maximum number of neighbors, with a value ranging from [2,100]. Larger values ​​of M can be used for global outlier detection, while smaller values ​​can be used for local outlier detection. By summing all ΔLF(i,m), the total change in LF as m increases sequentially from 1 to M-1 can be obtained. In the embodiments of this application, the total change in LF, ΘLF, is defined as follows:

[0133]

[0134] like Figure 3 The figure shows the distribution of the artificial dataset DS. Figure 4 As shown, this displays the total change in LF at each point on the dataset DS, such as... Figure 4 As shown, the total variation of the left LF (left lateral distance) for outliers is very high, while the total variation of the left LF for interior points is very low. Since the variation of the left LF is quantified cumulatively from m from 1 to M-1, the detection method proposed in this embodiment is insensitive to the number of neighbors m. This avoids the subjectivity of manually selecting parameters, eliminates the parameter sensitivity of traditional methods, and solves the problem of parameter sensitivity in outlier detection under complex data distributions.

[0135] Preferably, it effectively eliminates the shortcomings of traditional anomaly detection methods, such as sensitivity to parameters and the need for manual parameter selection. It can solve the problem of outlier detection being sensitive to parameter m under complex data distributions.

[0136] Based on the above model, this application proposes a customer anomaly behavior analysis method based on local gravity (CABALG) in its embodiments. To automatically detect anomalies, a horizontal segmentation method is used to search for a threshold for the rate of change of LF. The rate of change of LF of i relative to j, LFV(i,j), is defined as follows:

[0137] LFV(i,j)=|ΘLF(i,M)-ΘLF(j,M)| (8)

[0138] Sort the LF in ascending order. For the sorted list, assuming its size is n, for each adjacent LF(i) and LF(i+1) in the LF list, calculate the LFV(i,j) of each point. This results in a list of LFV(i,j) of size n-1 (denoted as LFVList), where each element in LFVList corresponds to two points in the original dataset. Draw the LFVList of the dataset DS, as shown below. Figure 5 As shown.

[0139] exist Figure 5 As can be seen, the LFVList is divided into two parts: those with sharp fluctuations and those with smooth fluctuations. Sharp fluctuations represent outliers, while smooth fluctuations represent normal points. The threshold α for LFV is defined as follows:

[0140] α=ω×σ(LFVList)+EX(LFVList) (9)

[0141] Where ω is the coefficient, σ is the standard deviation, and EX is the expected value. For example... Figure 5 As shown, the sharp waves exhibit slight fluctuations around the expected value of LFVList, and the width of the sharp waves is much smaller than the width ratio of the smooth line. Therefore, a positive coefficient is added to detect outliers, with ω ranging from (0,3]. After extensive experimentation, as shown... Figure 6 As shown, when ω is 2.5, good results are obtained in most datasets. By defining a threshold, sample points in the LFVList that exceed this threshold are classified as outliers. Preferably, a hierarchical partitioning method is used, automatically determining the threshold through experiments, thus avoiding the subjectivity of manually setting the threshold and automatically identifying outliers. That is, the threshold is automatically calculated and determined through a list of local resultant force change rates, avoiding the subjectivity of manually setting the threshold.

[0142] Algorithm 1 illustrates the pseudocode for the CABALG method. Unlike existing density-based and distance-based methods, CABALG in this embodiment is insensitive to the number of neighbors m. Furthermore, based on the horizontal partitioning method, outliers can be automatically selected, avoiding the subjectivity of manually determining thresholds.

[0143]

[0144]

[0145] Figure 9 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Please refer to it. Figure 9At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and memory. The memory may include main memory, such as high-speed random-access memory (RAM), or non-volatile memory, such as at least one disk drive. Of course, the electronic device may also include other hardware required for other business operations.

[0146] The processor, network interface, and memory can be interconnected via an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 9 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0147] Memory is used to store programs. Specifically, programs may include program code, which includes computer operation instructions. Memory may include main memory and non-volatile memory, and provides instructions and data to the processor.

[0148] The processor reads the corresponding computer program from non-volatile memory into main memory and then executes it, forming a client exception handling mechanism at the logical level. The processor executes the program stored in memory and specifically performs the following operations:

[0149] Obtain customer characteristic data;

[0150] Based on the customer characteristic data, generate the local resultant force change rate;

[0151] Based on the rate of change of the local resultant force, abnormal customer behavior in the customer characteristic data is determined.

[0152] The above is as stated in this application. Figure 7The customer abnormal behavior handling device disclosed in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of this application can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0153] The electronic device can also perform Figure 7 The method for handling abnormal customer behavior in a system, and the implementation of the abnormal customer behavior handling device in... Figure 7 The functions of the embodiments shown are not described in detail here.

[0154] This application also proposes a computer-readable storage medium that stores one or more programs, the programs including instructions that, when executed by an electronic device including multiple applications, enable the electronic device to perform... Figure 7 The method executed by the customer abnormal behavior handling device in the illustrated embodiment is specifically used to perform:

[0155] Obtain customer characteristic data;

[0156] Based on the customer characteristic data, generate the local resultant force change rate;

[0157] Based on the rate of change of the local resultant force, abnormal customer behavior in the customer characteristic data is determined.

[0158] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0159] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0160] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0161] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0162] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0163] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0164] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0165] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0166] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0167] The above description is merely an embodiment of this application and is not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for handling abnormal customer behavior, wherein, The method includes: Obtain customer characteristic data; Based on the customer characteristic data, generate the local resultant force change rate; Based on the local resultant force change rate, determine the abnormal customer behavior in the customer characteristic data; The rate of change of the local resultant force is: ， The total change in the local resultant force is: ； in, This represents the total change in the local resultant force of j adjacent to i; The change in the local resultant force is: ； The local resultant force is: ; Represents a unit vector. Represents a point charge. yes The number of neighbors; The local resultant force also includes: point charge charge Defined as: in, Point charge The amount of charge, Point charge With point charge The distance between them; The step of determining abnormal customer behavior in the customer characteristic data based on the local resultant force change rate includes: For the local resultant force change rate Sort in ascending order to get ; Define the threshold for the rate of change of local resultant force: ， It is a coefficient. It is the standard deviation. It is the mathematical expectation. The rate of change of the local resultant force The results obtained by sorting in ascending order; if the rate of change of local resultant force is greater than If so, it is considered that there is abnormal customer behavior; The local resultant force This includes: if the region where the anomaly is located is a low-density region, the corresponding local resultant force. The larger the value; if the normal point is in a high-density region, the corresponding local resultant force is... The smaller; The amount of charge This includes: for points in low-density regions, due to their greater distance from neighboring points, their charge... The smaller the value, the higher the charge of points within a high-density region, due to their proximity to neighboring points. The larger the value, the better.

2. The method as described in claim 1, wherein, The customer characteristic data shall include at least one of the following: gender, age, education level, number of family members, annual income, type of employer, occupation information, credit rating, whether or not they have financial products, whether or not they have a credit card, total amount of bank loans, and average daily deposits over the past year.

3. A device for handling abnormal customer behavior, wherein, The device includes: The acquisition module is used to acquire customer characteristic data; The generation module is used to generate the local resultant force change rate based on the customer characteristic data; The discrimination module is used to determine abnormal customer behavior in the customer feature data based on the local resultant force change rate. The rate of change of the local resultant force is: ， The total change in the local resultant force is: ； in, This represents the total change in the local resultant force of j adjacent to i; The change in the local resultant force is: ； The local resultant force is: ; Represents a unit vector. Represents a point charge. yes The number of neighbors; The local resultant force also includes: point charge charge Defined as: in, Point charge The amount of charge, Point charge With point charge The distance between them; The step of determining abnormal customer behavior in the customer characteristic data based on the local resultant force change rate includes: For the local resultant force change rate Sort in ascending order to get ; Define the threshold for the rate of change of local resultant force: ， It is a coefficient. It is the standard deviation. It is the mathematical expectation. The rate of change of the local resultant force The results obtained by sorting in ascending order; if the rate of change of local resultant force is greater than If so, it is considered that there is abnormal customer behavior; The local resultant force This includes: if the region where the anomaly is located is a low-density region, the corresponding local resultant force. The larger the value; if the normal point is in a high-density region, the corresponding local resultant force is... The smaller; The amount of charge This includes: for points in low-density regions, due to their greater distance from neighboring points, their charge... The smaller the value, the higher the charge of points within a high-density region, due to their proximity to neighboring points. The larger the value, the better.

4. An electronic device, comprising: processor; as well as A memory configured to store computer-executable instructions, which, when executed, cause the processor to perform the method of any one of claims 1 to 2.

5. A computer-readable storage medium storing one or more programs, which, when executed by an electronic device including a plurality of applications, cause the electronic device to perform the method of any one of claims 1 to 2.

Images