A method, apparatus, device, and storage medium for identifying team fraud.

Abstract

This specification relates to the field of computer technology, and more particularly to a method, apparatus, device, and storage medium for identifying group fraud. It includes: extracting business log information for each user when multiple users conduct business online; analyzing the business log information of each user to obtain behavioral information for each user; grouping the multiple users according to the behavioral information to obtain at least one user group; extracting team characteristics for each user group, and inputting the team characteristics corresponding to each user group into a pre-trained group fraud identification model for calculation to obtain the group fraud identification result for each user group. This specification embodiment can automatically determine the analysis object corresponding to the team, and the determined user group has team characteristics, rather than dispersed user characteristics, thereby improving the timeliness and accuracy of identifying group fraud.

Description

Technical Field

[0001] The embodiments in this specification relate to the field of computer technology, and in particular to a method, apparatus, device, and storage medium for identifying team fraud. Background Technology

[0002] In recent years, with the development of internet and audio-visual technologies, remote business processing has gradually become a hot topic in the financial industry. In this rapidly changing era, the traditional offline business processing model can no longer meet the needs of society, and remote audio-visual processing is such an innovative way to reshape the touchpoint between banks and users. It achieves a high degree of freedom in time and space through internet and audio-visual technologies, allowing banks to connect with users "without being limited by time and space," and enabling users to receive the same services and resources anywhere as they would at a branch.

[0003] Meanwhile, with the rapid development of information technology, financial transactions have gradually become online and digitalized, but this has also provided opportunities for organized fraud. Traditional fraud detection methods often rely on manual review and rule-based judgment, which are insufficient to address the complex and ever-changing nature of organized fraud. Existing technologies still face certain limitations and challenges in identifying organized fraud. On the one hand, the collection and processing of user data needs to consider privacy protection and information security; on the other hand, organized fraud is often covert and complex, requiring a comprehensive analysis using multiple technologies.

[0004] How to accurately identify fraudulent activities by teams is a technical problem that urgently needs to be solved. Summary of the Invention

[0005] To address the current problem that relying on manual review and rule-based judgment for identifying fraudulent activities by groups is insufficient to handle complex and ever-changing situations, leading to inaccurate identification, this specification provides a method, apparatus, device, and storage medium for identifying fraudulent activities by groups. The method acquires business log information from users' online transactions, then clusters users based on this log information to obtain multiple user groups. Fraudulent activities are then identified within these user groups. This pre-grouping of users highlights group characteristics, thereby improving the accuracy of identifying fraudulent activities within groups.

[0006] To solve any of the above-mentioned technical problems, the specific technical solutions of the embodiments in this specification are as follows:

[0007] On the one hand, the embodiments of this specification provide a method for identifying team fraud, including,

[0008] When multiple users conduct business online, extract the business log information of each user separately;

[0009] The business log information of each user is analyzed separately to obtain the behavioral information of each user;

[0010] Based on the behavioral information, multiple users are grouped to obtain at least one user group;

[0011] Extract the team features of each user group, and input the team features corresponding to each user group into a pre-trained team fraud behavior recognition model for calculation to obtain the team fraud behavior recognition result for each user group.

[0012] Furthermore, grouping multiple users based on the behavioral information to obtain at least one user group further includes:

[0013] By treating the users as nodes in the graph structure, determining the edges between corresponding nodes in the graph structure based on the correlation between the users' behavioral information and calculating the edge weights, the graph structure corresponding to multiple users is obtained.

[0014] The graph structure is iteratively calculated based on the edge weights to obtain at least one user group.

[0015] Furthermore, determining the edges between corresponding nodes in the graph structure based on the correlation between the user's behavioral information and calculating the edge weights further includes:

[0016] When the correlation degree exceeds a predetermined threshold, it is determined that there is an edge between the nodes corresponding to the correlation degree, and the edge weight of the edge is calculated based on the correlation degree.

[0017] Furthermore, by iteratively calculating the graph structure based on the edge weights, at least one user group is obtained, which further includes:

[0018] Take one node in the graph structure as the first node, and take all nodes adjacent to the first node as the second nodes respectively;

[0019] For each second node, the clustering degree is calculated based on the edge weights between the first node and the second node, the sum of the edge weights between the first node and all its neighboring nodes, the sum of the edge weights between the second node and all its neighboring nodes, and the sum of all edge weights in the graph structure.

[0020] Determine if there is a clustering degree that meets the requirements among all clustering degrees. If so, select the clustering degree with the highest clustering degree from the clustering degrees that meet the predetermined requirements as the target clustering degree. Then, divide the second node corresponding to the target clustering degree and the first node into a user group. Update the sum of all edge weights in the graph structure and the edge weights between the user group and all its adjacent nodes or user groups.

[0021] The user group is taken as the first node, and all nodes or user groups adjacent to the user group in the graph structure are taken as the second nodes. The step of calculating the clustering degree is repeated until there is no clustering degree that meets the requirements, so as to obtain at least one user group.

[0022] Furthermore, determining whether a clustering degree that meets the requirements exists among all clustering degrees further includes:

[0023] Determine whether the clustering degree is greater than 0;

[0024] If so, then the clustering degree meets the requirements;

[0025] If not, then the clustering degree does not meet the requirements.

[0026] Furthermore, by analyzing the business log information of each user separately, the user behavior information for each user is further included:

[0027] Extract the service processing time, user's network address, and service type from the user's service log information;

[0028] The user's business processing time, network address, and business type are used as the user's behavioral information.

[0029] Furthermore, the step of calculating the correlation degree includes:

[0030] Calculate the time correlation based on the respective business processing time of the two users;

[0031] Calculate the network address correlation based on the network addresses of the two users;

[0032] Calculate the business type correlation degree based on the respective business types of the two users;

[0033] The correlation between the time correlation, network address correlation, and service type correlation is weighted and summed to obtain the correlation between the two users.

[0034] Furthermore, extracting team characteristics for each user group further includes:

[0035] Extract the number of users in the user group, the activity frequency of the user group, and the user information of each user in the user group;

[0036] The number of users, the activity frequency of the user group, and the user information of each user in the user group are used as the team characteristics.

[0037] Furthermore, the team characteristics corresponding to each user group are input into a pre-trained team fraud behavior identification model for calculation, and the team fraud behavior identification results for each user group further include:

[0038] The team features are input into the team fraud behavior recognition model for convolution and pooling calculations, and finally input into a fully connected layer. The team fraud behavior recognition result is output through an activation function.

[0039] Furthermore, the steps for training the team fraud behavior identification model include:

[0040] Analyze the historical business log information of multiple historical users in advance and construct historical user groups;

[0041] Historical team features of the historical user group are extracted and input into the team fraud behavior recognition model to be trained for convolution and pooling calculations. Finally, the prediction results corresponding to the historical team features are output through a fully connected layer. The loss value is calculated based on the prediction results and actual results of the historical team features. If the loss value does not meet the requirements, the model parameters of the team fraud behavior recognition model to be trained are adjusted and iterative training is performed until the loss value meets the requirements, thus obtaining the trained team fraud behavior recognition model.

[0042] On the other hand, embodiments of this specification also provide a team fraud detection device, the device comprising:

[0043] The business log information extraction unit is used to extract the business log information of each user when multiple users conduct business online.

[0044] The behavior information analysis unit is used to analyze the business log information of each user to obtain the behavior information of each user;

[0045] The user grouping unit is used to group multiple users according to the behavioral information to obtain at least one user group.

[0046] The team fraud behavior identification unit is used to extract the team characteristics of each user group, and input the team characteristics corresponding to each user group into the pre-trained team fraud behavior identification model for calculation to obtain the team fraud behavior identification result for each user group.

[0047] On the other hand, embodiments of this specification also provide a computer device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the above-described method.

[0048] On the other hand, embodiments of this specification also provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0049] Using the embodiments of this specification, firstly, business log information from multiple users' online transactions is acquired. Then, this business log information is analyzed to obtain user behavior information. Based on this behavior information, users are grouped to obtain at least one user group. Users within a user group exhibit the same or similar behaviors, thereby identifying the analysis targets for identifying group fraud. Compared to traditional methods that manually analyze each user to identify group fraud, this embodiment can automatically determine the analysis targets corresponding to the group, and the identified user groups possess group characteristics rather than fragmented user characteristics, thus improving the timeliness and accuracy of group fraud identification. This embodiment extracts the group characteristics of each user group, uses a group fraud identification model to calculate these characteristics, and obtains the group fraud behavior identification results for the user group. This enables timely detection of group fraud, improving the accuracy and efficiency of group fraud identification. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments of this specification or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0051] Figure 1 The diagram shown is a schematic representation of an implementation system for a team fraud detection method as described in this specification.

[0052] Figure 2 The diagram shown is a flowchart illustrating a method for identifying team fraud according to an embodiment of this specification.

[0053] Figure 3 The diagram shown is a flowchart illustrating the process of grouping multiple users based on the behavioral information to obtain at least one user group in an embodiment of this specification.

[0054] Figure 4 The diagram shown is a flowchart illustrating the process of analyzing the business log information of each user to obtain the user behavior information of each user in an embodiment of this specification.

[0055] Figure 5 The diagram shown is a flowchart illustrating the calculation of the correlation degree in an embodiment of this specification.

[0056] Figure 6 The diagram shown is a flowchart illustrating the process of extracting team characteristics for each user group in an embodiment of this specification.

[0057] Figure 7 The diagram shown is a flowchart illustrating the process of training the team fraud detection model in an embodiment of this specification.

[0058] Figure 8 The diagram shown is a structural schematic of a team fraud detection device according to an embodiment of this specification.

[0059] Figure 9 The diagram shown is a structural schematic of the computer device in an embodiment of this specification.

[0060] [Explanation of Figure Markers]:

[0061] 101. Terminal;

[0062] 102. Server;

[0063] 801. Business Log Information Extraction Unit;

[0064] 802. Behavioral Information Analysis Unit;

[0065] 803. User Segmentation Unit;

[0066] 804. Team Fraud Behavior Detection Unit;

[0067] 902. Computer equipment;

[0068] 904. Processing equipment;

[0069] 906. Storage resources;

[0070] 908. Drive mechanism;

[0071] 910. Input / Output Module;

[0072] 912. Input devices;

[0073] 914. Output devices;

[0074] 916. Presentation equipment;

[0075] 918. Graphical User Interface;

[0076] 920. Network interface;

[0077] 922. Communication link;

[0078] 924. Communication bus. Detailed Implementation

[0079] The technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the embodiments of this specification, and not all embodiments. Based on the embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of the embodiments of this specification.

[0080] It should be noted that the terms "first," "second," etc., in the description, claims, and accompanying drawings of the embodiments herein are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, apparatus, product, or device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0081] It should be noted that the acquisition, storage, use, and processing of data in the technical solutions of the embodiments of this specification all comply with the relevant provisions of national laws and regulations.

[0082] It should be noted that in the embodiments of this specification, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, they do not mean that the applicant has used or necessarily used the solution.

[0083] like Figure 1 The diagram illustrates an implementation system for a team fraud identification method according to an embodiment of this specification, including a terminal 101 and a server 102. The terminal 101 and the server 102 can communicate via a network, which may include a local area network (LAN), a wide area network (WAN), the Internet, or a combination thereof, and is connected to a website, user equipment (e.g., a computing device), and a backend system.

[0084] Terminal 101 can be a business log information collection interface. Server 102 collects users' business log information by calling the collection interface. Then, server 102 analyzes the business log information of multiple users to determine whether there is team fraud among multiple users.

[0085] Alternatively, server 102 may be a node of a cloud computing system (not shown in the figure), or each server may be a separate cloud computing system comprising multiple computers interconnected by a network and operating as a distributed processing system.

[0086] In addition, it should be noted that, Figure 1 The example shown is merely one application environment provided by the embodiments in this specification. In actual applications, other scenarios may also be included, and this specification does not impose any limitations.

[0087] To address the problems existing in the prior art, this specification provides a method for identifying team fraud behavior. The method involves acquiring business log information from users' online transactions, then clustering users based on this log information to obtain multiple user groups. Fraud behavior is then identified within each user group. This pre-grouping of users highlights team characteristics, thereby improving the accuracy of identifying fraudulent activities within a team. Figure 2 The diagram illustrates a flowchart of a method for identifying team fraud according to an embodiment of this specification. The diagram describes the process of identifying whether team fraud exists among multiple users based on their business log information. The order of steps listed in the embodiment is merely one possible execution order among many steps and does not represent the only possible execution order. In actual system or device products, the method can be executed sequentially or in parallel according to the embodiment or the accompanying drawings. Specifically, as shown... Figure 2 As shown, the method can be executed by server 102 and may include:

[0088] Step 201: When multiple users conduct business online, extract the business log information for each user separately;

[0089] Step 202: Analyze the business log information of each user to obtain the behavioral information of each user;

[0090] Step 203: Based on the behavioral information, group the multiple users to obtain at least one user group;

[0091] Step 204: Extract the team features of each user group, and input the team features corresponding to each user group into the pre-trained team fraud behavior recognition model for calculation to obtain the team fraud behavior recognition result for each user group.

[0092] Using the embodiments of this specification, firstly, business log information from multiple users' online transactions is acquired. Then, this business log information is analyzed to obtain user behavior information. Based on this behavior information, users are grouped to obtain at least one user group. Users within a user group exhibit the same or similar behaviors, thereby identifying the analysis targets for identifying group fraud. Compared to traditional methods that manually analyze each user to identify group fraud, this embodiment can automatically determine the analysis targets corresponding to the group, and the identified user groups possess group characteristics rather than fragmented user characteristics, thus improving the timeliness and accuracy of group fraud identification. This embodiment extracts the group characteristics of each user group, uses a group fraud identification model to calculate these characteristics, and obtains the group fraud behavior identification results for the user group. This enables timely detection of group fraud, improving the accuracy and efficiency of group fraud identification.

[0093] In the embodiments of this specification, users can conduct business online via audio or remote video, such as through online banking or mobile banking APP clients. When processing online business, the bank's business system first verifies the user's information and uses existing risk identification models to identify the user's risk profile, thereby achieving user identity verification. After successful identity verification, the user's business is completed. The bank's business system also records the user's business log information, including the business processing time, the user's network address, and the business type. The user's network address refers to the network address of the user's terminal, such as an IP address. This IP address refers to the peer IP address of the bank's business system when the user's terminal establishes a network connection with the bank's business system. This IP address can be the actual IP address of the user's terminal or the gateway address of the network where the user's terminal is located.

[0094] The types of business may include loan business, transfer business, inquiry business, remittance business, etc., and the embodiments in this specification are not limited thereto.

[0095] Team fraud refers to situations where users in a team log into a banking system using legitimate identity information to conduct business, but the business conducted by the entire team is illegal, such as fraud. Although the banking system may verify the user's identity information, it is still necessary to verify whether team fraud exists.

[0096] Currently, in group fraud, the transactions processed by multiple users often exhibit a certain correlation. For example, they may be of the same or related service type, or their network addresses may be related. For instance, multiple users in a group fraud scheme might be on the same network segment, meaning they are conducting group fraud in the same room. Alternatively, the timing of their transactions might be related, such as multiple users engaging in group fraud within the same time period. For example, if multiple users in a group are in the same room and process related transactions within the same timeframe, the group is more likely to be involved in group fraud, and therefore, this group can be used as the subject of analysis for group fraud.

[0097] The purpose of determining the user group in the embodiments of this specification is to identify the analysis target of team fraud. After the analysis target is determined, the feature of the analysis target can be directly extracted and the team fraud behavior can be identified, thereby improving the identification speed of team fraud behavior.

[0098] Specifically, the embodiments of this specification analyze the business log information of each user to obtain the behavioral information of each user. The behavioral information of a user can indicate what business a user handled at what time and place. Then, the users are grouped according to the behavioral information to obtain at least one user group.

[0099] Alternatively, the k-means clustering algorithm can be used to cluster users based on their behavioral information, resulting in multiple user categories, with each user category being treated as a user group.

[0100] However, the k-means clustering algorithm requires pre-determining the number of clusters K. Users need to specify the number of clusters K, which may be uncertain in practice, and the clustering results are easily affected by the initial cluster centers. Since the initial cluster centers are randomly selected, this can cause the algorithm to get stuck in a local optimum rather than a global optimum. Therefore, the k-means clustering algorithm can only guarantee a local optimum, not a global optimum. In scenarios involving the identification of group fraud, errors in the clustering results can lead criminals to change their methods and strategies, such as adding normal business activities to disrupt the clustering, making it impossible for the k-means clustering algorithm to identify the true groups.

[0101] To address the aforementioned issues, this specification introduces a graph structure iterative calculation method. This method constructs a graph structure based on user and behavioral information, then iteratively calculates the graph structure to continuously compress the graph distribution, resulting in at least one user group. This method eliminates the need to select initial cluster centers, thereby ensuring accurate user grouping.

[0102] Specifically, according to one embodiment of this specification, such as Figure 3 As shown, grouping multiple users based on the behavioral information to obtain at least one user group further includes:

[0103] Step 301: Using the users as nodes in the graph structure, determine the edges between corresponding nodes in the graph structure based on the correlation between the user's behavior information and calculate the edge weights to obtain the graph structure corresponding to multiple users;

[0104] In this step, determining the edges between corresponding nodes in the graph structure and calculating edge weights based on the correlation between the user's behavioral information further includes:

[0105] When the correlation degree exceeds a predetermined threshold, it is determined that there is an edge between the nodes corresponding to the correlation degree, and the edge weight of the edge is calculated based on the correlation degree.

[0106] This can be understood as follows: although there is a correlation between the behavioral characteristics of some users, such as all of them handling the same business or handling business at the same branch, the existence of correlation does not mean that these users belong to the same team. Therefore, in this step, a predetermined threshold value is used to filter the correlation. It is assumed that there is an edge between corresponding nodes whose correlation exceeds the predetermined threshold value, and the edge weight is calculated based on the correlation.

[0107] In the embodiments of this specification, the predetermined threshold value can be an empirical value or an experimental value, and can be set according to the actual situation. This specification does not impose any restrictions on the embodiments.

[0108] Furthermore, the correlation can be quantified to obtain the edge weights. The specific quantification method is a conventional means in this field, such as using a normalization function for quantification. The embodiments in this specification are not limited.

[0109] It should be noted that the larger the edge weight, the higher the correlation between the two nodes corresponding to that edge.

[0110] Step 302: Iteratively calculate the graph structure based on the edge weights to obtain at least one user group.

[0111] In the embodiments of this specification, the purpose of iteratively calculating the graph structure based on the edge weights is to group the nodes into the same group according to the degree of association between them.

[0112] Specifically, according to one embodiment of this specification, iteratively calculating the graph structure based on the edge weights to obtain at least one user group further includes:

[0113] Take one node in the graph structure as the first node, and take all nodes adjacent to the first node as the second nodes respectively;

[0114] For each second node, the clustering degree is calculated based on the edge weights between the first node and the second node, the sum of the edge weights between the first node and all its neighboring nodes, the sum of the edge weights between the second node and all its neighboring nodes, and the sum of all edge weights in the graph structure.

[0115] Determine if there is a clustering degree that meets the requirements among all clustering degrees. If so, select the clustering degree with the highest clustering degree from the clustering degrees that meet the predetermined requirements as the target clustering degree. Then, divide the second node corresponding to the target clustering degree and the first node into a user group. Update the sum of all edge weights in the graph structure and the edge weights between the user group and all its adjacent nodes or user groups.

[0116] The user group is taken as the first node, and all nodes or user groups adjacent to the user group in the graph structure are taken as the second nodes. The step of calculating the clustering degree is repeated until there is no clustering degree that meets the requirements, so as to obtain at least one user group.

[0117] In the embodiments of this specification, a node in the graph structure is first designated as the first node, and all nodes adjacent to the first node are designated as second nodes. The clustering degree between the first and second nodes is then calculated. It is then determined whether a clustering degree that meets the requirements exists. If so, the highest clustering degree is selected as the target clustering degree, and the second and first nodes corresponding to the target clustering degree are grouped into the same user group. This can be understood as the embodiments of this specification calculating the clustering degree between any node in the graph structure and all its adjacent nodes. In other words, each node in the graph structure is used as the first node to calculate multiple corresponding clustering degrees, and then the nodes are divided based on these clustering degrees. Compared to the k-means clustering algorithm, the iterative calculation method for the graph structure in the embodiments of this specification does not require pre-determining the initial cluster centroids; instead, each node is used as a centroid, thus avoiding the influence of centroid selection issues on the clustering results and thereby obtaining the true user group.

[0118] In the embodiments of this specification, for a first node, it is first necessary to determine whether there is a clustering degree that meets the requirements among all its adjacent second nodes, so as to filter out nodes that do not meet the clustering requirements. The specific requirement can be a predetermined threshold. If the clustering degree exceeds the predetermined threshold, the requirement is met; otherwise, the requirement is not met.

[0119] In the embodiments of this specification, as the user groups are divided, the nodes, edges, and edge weights in the graph structure will change. Assigning multiple second nodes to the same group as a corresponding first node in one iteration may affect the accuracy of the grouping. Therefore, in each iteration, this embodiment of the specification assigns only one adjacent second node to any first node to the same user group.

[0120] However, it should be noted that during a single iteration, more than two nodes may be grouped into the same user group. For example, in a graph structure containing nodes 1, 2, 3, and 4, there are edges between nodes 1 and 2, 2 and 3, and 1 and 4. When node 1 is taken as the first node, the corresponding second nodes include nodes 2 and 4. Then, the clustering degree between nodes 1 and 2, and between nodes 1 and 4, is calculated. If the clustering degree between nodes 1 and 2 is greater than the calculated clustering degree between nodes 1 and 4, and a predetermined requirement is met, then nodes 1 and 2 are grouped into the same user group.

[0121] However, in this iteration, node 2 is also used as the first node, and the corresponding second nodes are node 1 and node 3. Then, the clustering degree between node 2 and node 1, and the clustering degree between node 2 and node 3 are calculated. If the clustering degree between node 2 and node 3 is greater than the clustering degree between node 2 and node 1 and meets the predetermined requirements, then node 2 and node 3 are assigned to the same user group.

[0122] Therefore, this iteration calculates that node 1 and node 2 should be assigned to the same user group, and node 2 and node 3 should also be assigned to the same user group. Thus, this iteration will assign node 1, node 2, and node 3 to the same user group.

[0123] Specifically, in this embodiment of the specification, the highest clustering degree among the clustering degrees that meet the predetermined requirements is selected as the target clustering degree, and the second node corresponding to the target clustering degree is assigned to the first node and then assigned to the same user group.

[0124] After this iteration calculates the clustering, it is also necessary to update the sum of all edge weights in the graph structure and the edge weights between the user group and all its adjacent nodes or user groups. Specifically, the edge weight between the two nodes assigned to the same user group is subtracted from the sum of all edge weights in the graph structure, and the edge weight of the node commonly adjacent to these two nodes is updated to the sum of the two edge weights between these two nodes and the corresponding two edges of that node. For example, if nodes 1 and 2 are assigned to the same user group, and nodes 1 and 3 are adjacent, and nodes 2 are also adjacent to nodes 3, then the edge weight between this user group and node 3 = the edge weight between nodes 1 and 3 + the edge weight between nodes 2 and 3.

[0125] In other words, the embodiments of this specification treat multiple nodes in a user group as a whole, and then perform the next iteration calculation until there is no grouping degree that meets the requirements, thus obtaining at least one user group.

[0126] In this embodiment of the specification, the formula for calculating the clustering degree based on the edge weight between the first node and the second node, the sum of the edge weights between the first node and all its neighboring nodes, the sum of the edge weights between the second node and all its neighboring nodes, and the sum of all edge weights in the graph structure is as follows:

[0127]

[0128] Among them, Q xy a represents the clustering degree corresponding to nodes x and y. xy A represents the edge weight between point x and node y. x Let A represent the sum of the edge weights between node x and all its neighboring nodes. y Let A represent the sum of the edge weights between node y and all its neighboring nodes. 总 This represents the sum of the weights of all edges in the graph structure.

[0129] Furthermore, determining whether a clustering degree that meets the requirements exists among all clustering degrees further includes:

[0130] Determine whether the clustering degree is greater than 0;

[0131] If so, then the clustering degree meets the requirements;

[0132] If not, then the clustering degree does not meet the requirements.

[0133] This can be understood as follows: if the clustering degree is greater than 0, it means that the two corresponding nodes may be assigned to the same user group. However, it is necessary to select the two nodes with the highest clustering degree from the multiple clustering degrees greater than 0 and assign them to the same user group. Then, the edge weights are updated until the next iteration. When all the clustering degrees corresponding to all the first nodes are calculated, there is no clustering degree that meets the above requirements, indicating that the user group division is complete.

[0134] You can also determine whether the clustering degree has converged during the iterative calculation process. If the clustering degree has converged, it means that the user group division is complete.

[0135] According to one embodiment of this specification, such as Figure 4 As shown, the business log information of each user is analyzed separately, and the user behavior information of each user is further included:

[0136] Step 401: Extract the service processing time, the user's network address, and the service type from the user's service log information;

[0137] Step 402: Use the business processing time, network address, and business type corresponding to the user as the user's behavioral information.

[0138] Furthermore, such as Figure 5 As shown, the steps for calculating the correlation degree include:

[0139] Step 501: Calculate the time correlation based on the respective business processing times of the two users;

[0140] Step 502: Calculate the network address correlation based on the network addresses of the two users;

[0141] Step 503: Calculate the business type correlation degree based on the respective business types of the two users;

[0142] Step 504: Perform a weighted summation of the time correlation, network address correlation, and service type correlation to obtain the correlation between the two users.

[0143] This specification can be understood as follows: the embodiments divide user groups based on three dimensions: business processing time, network address, and business type. Time correlation can be achieved by identifying the time pattern of business processing, such as periodicity or concentration. Network address correlation can determine whether IP addresses belong to the same network segment or the same subnet; if so, it is set to the corresponding predetermined network address correlation.

[0144] Business type correlation can be discovered through techniques such as association rule mining and frequent itemset mining to identify the correlation between the business types of services a user handles. Then, these three correlations are weighted and summed, where the weight of each item can be an empirical or experimental value and can be set according to actual circumstances; this specification does not impose such limitations on the embodiments.

[0145] In some other embodiments of this specification, when a user conducts business, the user's video and audio information can also be obtained for subsequent traceability.

[0146] In the embodiments of this specification, the objective patterns of multiple users' business transactions have been identified using a graph structure iterative calculation method, resulting in user groups with the same objective patterns. However, this does not necessarily mean that a user group is a fraudulent group. Therefore, it is necessary to analyze the team characteristics of the user group to determine whether it is a fraudulent group.

[0147] In the embodiments of this specification, team characteristics can reflect the objective situation of team members in team fraud, such as the number of team members, the frequency of team activities, and the user information of each user in the team. User information may include age, gender, education level, and user bank account information, such as account balance. The embodiments of this specification utilize machine learning models to extract feature data of team characteristics, thereby identifying whether team fraud exists.

[0148] Specifically, according to one embodiment of this specification, such as Figure 6 As shown, extracting team characteristics for each user group further includes:

[0149] Step 601: Extract the number of users in the user group, the activity frequency of the user group, and the user information of each user in the user group;

[0150] Step 602: Use the number of users, the activity frequency of the user group, and the user information of each user in the user group as the team characteristics.

[0151] Furthermore, the team characteristics corresponding to each user group are input into a pre-trained team fraud behavior identification model for calculation, and the team fraud behavior identification results for each user group further include:

[0152] The team features are input into the team fraud behavior recognition model for convolution and pooling calculations, and finally input into a fully connected layer. The team fraud behavior recognition result is output through an activation function.

[0153] In the embodiments of this specification, the team fraud behavior identification model can be an LSTM neural network model, including convolutional layers, pooling layers and fully connected layers. The convolutional layers and pooling layers are used to extract feature parameters of the input data, and the feature parameters are input into the fully connected layer. The identification result is output through the softmax activation function.

[0154] like Figure 7 As shown, the steps for training the team fraud behavior identification model include:

[0155] Step 701: Analyze the historical business log information of multiple historical users in advance and construct a historical user group;

[0156] Step 702: Extract the historical team features of the historical user group, input the historical team features into the team fraud behavior recognition model to be trained for convolution and pooling calculations, and finally output the prediction results corresponding to the historical team features through a fully connected layer. Calculate the loss value based on the prediction results and actual results of the historical team features. If the loss value does not meet the requirements, adjust the model parameters of the team fraud behavior recognition model to be trained and perform iterative training until the loss value meets the requirements, thus obtaining the trained team fraud behavior recognition model.

[0157] According to one embodiment of this specification, in order to improve the recognition accuracy of the team fraud behavior recognition model, the team fraud behavior recognition model in this embodiment is a neural network cascade model. The trained neural network cascade model includes at least one serial target sub-neural network model. The output of the previous target sub-neural network model is the input of the next target sub-neural network model. Each target sub-neural network model outputs its own predicted value. The predicted values ​​of each target sub-neural network model are integrated to obtain the final recognition result.

[0158] The steps for training a cascaded neural network model include:

[0159] Initialize and establish a cascaded neural network model to be trained. The cascaded neural network model to be trained includes multiple cascaded sub-neural network models to be trained and preset basic ensemble weights corresponding to each sub-neural network model to be trained.

[0160] Multiple historical team features from multiple historical user groups are input into a cascaded neural network model to be trained for calculation, resulting in the output results of multiple sub-neural network models to be trained in the cascaded neural network model. The output results of the multiple sub-neural network models to be trained are aggregated according to the preset basic ensemble weights to obtain the recognition result. The error between the recognition result and the corresponding actual result is calculated, and it is determined whether the error meets the preset accuracy requirement. If it does not meet the requirement, the model parameters of each sub-neural network model to be trained are updated. The step of inputting multiple historical team features from multiple historical user groups into the cascaded neural network model to be trained for calculation is repeated until the error meets the preset accuracy requirement, resulting in a trained cascaded neural network model including multiple trained sub-neural network models.

[0161] Furthermore, when using a cascaded neural network model comprising multiple trained sub-neural network models to identify group fraud behavior, when the confidence level of any one of the trained sub-neural network models meets the corresponding confidence threshold, the calculation of subsequent trained sub-neural network models of that sub-neural network model is stopped, and the trained sub-neural network model that has not stopped calculating is taken as the target sub-neural network model, thus obtaining a cascaded neural network model comprising at least one cascaded target sub-neural network model.

[0162] Specifically, the neural network cascade model to be trained is a neural network cascade model built using a Boosting structure, but other structures can also be used to build the neural network cascade model. This specification does not limit the examples.

[0163] For cascaded neural network models, model ensembles can reduce computational cost while achieving the same performance, and multiple sub-neural network models can be computed in parallel for further acceleration. Furthermore, the total training time for model ensembles is also superior to that of a single model.

[0164] Based on the same inventive concept, embodiments of this specification also provide a device for identifying team fraudulent behavior, such as... Figure 8 As shown, it includes:

[0165] The business log information extraction unit 801 is used to extract the business log information of each user when multiple users conduct business online.

[0166] The behavior information analysis unit 802 is used to analyze the business log information of each user to obtain the behavior information of each user;

[0167] User grouping unit 803 is used to group multiple users according to the behavioral information to obtain at least one user group;

[0168] The team fraud behavior identification unit 804 is used to extract the team features of each user group and input the team features corresponding to each user group into the pre-trained team fraud behavior identification model for calculation to obtain the team fraud behavior identification result of each user group.

[0169] Since the principle of the above-mentioned device in solving the problem is similar to that of the above-mentioned method, the implementation of the above-mentioned device can refer to the implementation of the above-mentioned method, and the repeated parts will not be described again.

[0170] like Figure 9The diagram illustrates the structure of a computer device according to an embodiment of this specification. The apparatus in this embodiment can be the computer device described above, executing the methods described in the embodiments of this specification. The computer device 902 may include one or more processing devices 904, such as one or more central processing units (CPUs), each of which can implement one or more hardware threads. The computer device 902 may also include any storage resource 906 for storing information of any kind, such as code, settings, data, etc. Without limitation, for example, the storage resource 906 may include any one or more combinations of the following: any type of RAM, any type of ROM, flash memory, hard disk, optical disk, etc. More generally, any storage resource can use any technology to store information. Furthermore, any storage resource can provide volatile or non-volatile retention of information. Further, any storage resource may represent a fixed or removable component of the computer device 902. In one case, when the processing device 904 executes associated instructions stored in any storage resource or combination of storage resources, the computer device 902 can perform any operation of the associated instructions. The computer device 902 also includes one or more drive mechanisms 908 for interacting with any storage resource, such as a hard disk drive mechanism, an optical disk drive mechanism, etc.

[0171] Computer device 902 may also include an input / output module 910 (I / O) for receiving various inputs (via input device 912) and providing various outputs (via output device 914). A specific output mechanism may include a presentation device 916 and an associated graphical user interface (GUI) 918. In other embodiments, the input / output module 910 (I / O), input device 912, and output device 914 may be omitted, and the device may function solely as a computer device within a network. Computer device 902 may also include one or more network interfaces 920 for exchanging data with other devices via one or more communication links 922. One or more communication buses 924 couple the components described above together.

[0172] Communication link 922 can be implemented in any way, such as via a local area network (LAN), a wide area network (WAN) (e.g., the Internet), a point-to-point connection, or any combination thereof. Communication link 922 may include any combination of hardwired links, wireless links, routers, gateway functions, name servers, etc., governed by any protocol or combination of protocols.

[0173] This specification also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.

[0174] This specification also provides computer-readable instructions, wherein when a processor executes the instructions, the program therein causes the processor to perform the above-described method.

[0175] It should be understood that in the various embodiments of this specification, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this specification.

[0176] It should also be understood that, in the embodiments of this specification, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Furthermore, in the embodiments of this specification, the character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0177] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this specification can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of the embodiments in this specification.

[0178] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0179] In the embodiments provided in this specification, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the couplings or direct couplings or communication connections shown or discussed may be indirect couplings or communication connections through some interfaces, devices, or units, or they may be electrical, mechanical, or other forms of connection.

[0180] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the embodiments described in this specification, depending on actual needs.

[0181] Furthermore, the functional units in the various embodiments of this specification can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0182] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this specification, in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this specification. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0183] This specification describes the principles and implementation methods of the embodiments using specific examples. The above descriptions of the embodiments are only for the purpose of helping to understand the methods and core ideas of the embodiments in this specification. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the embodiments in this specification. Therefore, the content of this specification should not be construed as a limitation on the embodiments in this specification.

Claims

1. A method for identifying team fraud, characterized in that, The method includes: When multiple users conduct business online, extract the business log information of each user separately; The business log information of each user is analyzed separately to obtain the behavioral information of each user; Based on the behavioral information, multiple users are grouped to obtain at least one user group; Extract the team features of each user group, and input the team features corresponding to each user group into the pre-trained team fraud behavior recognition model for calculation to obtain the team fraud behavior recognition result for each user group. Based on the behavioral information, multiple users are grouped to obtain at least one user group, which further includes: By treating the users as nodes in the graph structure, determining the edges between corresponding nodes in the graph structure based on the correlation between the users' behavioral information and calculating the edge weights, the graph structure corresponding to multiple users is obtained. Based on the edge weights, the graph structure is iteratively calculated to obtain at least one user group that takes one node in the graph structure as the first node x and all nodes adjacent to the first node as the second node y. For each second node, based on the edge weights between the first node and that second node... The sum of the edge weights between the first node and all its adjacent nodes. The sum of the edge weights between the second node and all its adjacent nodes. and the sum of the weights of all edges in the graph structure. Calculate clustering degree The formula is as follows: Determine if there is a clustering degree that meets the requirements among all clustering degrees. If so, select the clustering degree with the highest clustering degree from the clustering degrees that meet the predetermined requirements as the target clustering degree. Then, divide the second node corresponding to the target clustering degree and the first node into a user group. Update the sum of all edge weights in the graph structure and the edge weights between the user group and all its adjacent nodes or user groups. The user group is taken as the first node, and all nodes or user groups adjacent to the user group in the graph structure are taken as the second nodes. The step of calculating the clustering degree is repeated until there is no clustering degree that meets the requirements, so as to obtain at least one user group.

2. The method according to claim 1, characterized in that, Determining the edges between corresponding nodes in the graph structure based on the correlation between the user's behavioral information and calculating the edge weights further includes: When the correlation degree exceeds a predetermined threshold, it is determined that there is an edge between the nodes corresponding to the correlation degree, and the edge weight of the edge is calculated based on the correlation degree.

3. The method according to claim 1, characterized in that, Determining whether a clustering degree that meets the requirements exists among all clustering degrees further includes: Determine whether the clustering degree is greater than 0; If so, then the clustering degree meets the requirements; If not, then the clustering degree does not meet the requirements.

4. The method according to claim 1, characterized in that, Analyzing the business log information for each user separately yields user behavior information for each user, which further includes: Extract the service processing time, user's network address, and service type from the user's service log information; The user's business processing time, network address, and business type are used as the user's behavioral information.

5. The method according to claim 4, characterized in that, The steps for calculating the correlation degree include: Calculate the time correlation based on the respective business processing time of the two users; Calculate the network address correlation based on the network addresses of the two users; Calculate the business type correlation degree based on the respective business types of the two users; The correlation between the time correlation, network address correlation, and service type correlation is weighted and summed to obtain the correlation between the two users.

6. The method according to claim 1, characterized in that, Extracting team characteristics for each user group further includes: Extract the number of users in the user group, the activity frequency of the user group, and the user information of each user in the user group; The number of users, the activity frequency of the user group, and the user information of each user in the user group are used as the team characteristics.

7. The method according to claim 1, characterized in that, The team characteristics corresponding to each user group are input into a pre-trained team fraud behavior identification model for calculation. The team fraud behavior identification results for each user group further include: The team features are input into the team fraud behavior recognition model for convolution and pooling calculations, and finally input into a fully connected layer. The team fraud behavior recognition result is output through an activation function.

8. The method according to claim 7, characterized in that, The steps for training the team fraud detection model include: Analyze the historical business log information of multiple historical users in advance and construct historical user groups; Historical team features of the historical user group are extracted and input into the team fraud behavior recognition model to be trained for convolution and pooling calculations. Finally, the prediction results corresponding to the historical team features are output through a fully connected layer. The loss value is calculated based on the prediction results and actual results of the historical team features. If the loss value does not meet the requirements, the model parameters of the team fraud behavior recognition model to be trained are adjusted and iterative training is performed until the loss value meets the requirements, thus obtaining the trained team fraud behavior recognition model.

9. A device for identifying team fraud, characterized in that, The device includes: The business log information extraction unit is used to extract the business log information of each user when multiple users conduct business online. The behavior information analysis unit is used to analyze the business log information of each user to obtain the behavior information of each user; The user grouping unit is used to group multiple users according to the behavioral information to obtain at least one user group. The team fraud behavior identification unit is used to extract the team characteristics of each user group, and input the team characteristics corresponding to each user group into the pre-trained team fraud behavior identification model for calculation to obtain the team fraud behavior identification result of each user group. The user segmentation unit is specifically used for: By treating the users as nodes in the graph structure, determining the edges between corresponding nodes in the graph structure based on the correlation between the users' behavioral information and calculating the edge weights, the graph structure corresponding to multiple users is obtained. Take one node in the graph structure as the first node x, and take all the nodes adjacent to the first node as the second nodes y respectively; For each second node, based on the edge weights between the first node and that second node... The sum of the edge weights between the first node and all its adjacent nodes. The sum of the edge weights between the second node and all its adjacent nodes. and the sum of the weights of all edges in the graph structure. Calculate clustering degree The formula is as follows: , Determine if there is a clustering degree that meets the requirements among all clustering degrees. If so, select the clustering degree with the highest clustering degree from the clustering degrees that meet the predetermined requirements as the target clustering degree. Then, divide the second node corresponding to the target clustering degree and the first node into a user group. Update the sum of all edge weights in the graph structure and the edge weights between the user group and all its adjacent nodes or user groups. The user group is taken as the first node, and all nodes or user groups adjacent to the user group in the graph structure are taken as the second nodes. The step of calculating the clustering degree is repeated until there is no clustering degree that meets the requirements, so as to obtain at least one user group.

10. A computer device comprising a memory, a processor, and a computer program stored in the memory, characterized in that, When the processor executes the computer program, it implements the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method of any one of claims 1 to 8.

Images