A method and device for identifying multi-user joint fraud

Abstract

The present invention discloses a multi-user terminal joint fraud identification method and device, the method comprising: obtaining the behavior information, order and payment information of the service provider and the service recipient of each order from the login to the fulfillment completion link, and extracting order features therefrom; constructing a training set and a test set based on the order features and cheating possibility of each order, and using the training set to train a cheating identification model, wherein the cheating identification model adopts a LightGBM model; based on the trained cheating identification model, predicting the cheating probability of each order in the test set, thereby obtaining the cheating probability effective interval; combining the cheating probability effective interval with a predetermined rule group to obtain a globally optimal combination method; obtaining the order to be identified, and based on the globally optimal combination method, performing cheating identification of the order to be identified. By embedding the model into the original rule system to select the globally optimal combination method, the accuracy and recall rate of cheating identification can be improved well.

Description

Technical Field

[0001] The present invention belongs to the technical field of abnormal behavior recognition, and in particular, relates to a method and device for multi-user terminal joint fraud recognition. Background Art

[0002] The O2O form of platform economy is an important component of the development of the Internet in recent years. The O2O business model is characterized by the combination of online and offline and the interaction of multiple user terminals. With the above characteristics, it is very easy for multiple user terminals to collaborate and cheat, and then obtain the marketing rewards of the O2O platform by forging false orders.

[0003] In a normal O2O trading platform, the service recipient places an order on the platform through the service recipient user terminal, and the service provider receives the order through the service provider user terminal. The service provider and the service recipient complete the order through behavioral interaction, and the service recipient pays the service fee. In order to stimulate the volume of transaction orders, the platform will increase the order income for the service provider and the service recipient through marketing subsidies, which will lead to the service provider and the service recipient jointly forging false orders to obtain platform marketing subsidies.

[0004] For this type of scenario of joint forged fake orders, the industry usually analyzes the behavioral characteristics of the service provider and the service recipient, and combines expert experience to identify fake orders through rules. Although this method can efficiently identify low-level forged orders, it is less effective for identifying high-level forged orders. It is difficult to improve the recognition accuracy by only combining rules. Therefore, this paper introduces a model to enhance the recognition ability, which can effectively improve the generalization ability of cheating recognition.

[0005] Specifically, the prior art has the following problems:

[0006] (1) It is necessary to screen the characteristics of the joint fraudulent behavior of the service provider and the service recipient. Although the traditional expert experience screening method has good interpretability, it is difficult to improve the accuracy and is prone to large-scale missed identification;

[0007] (2) In recent years, model recognition has been gradually applied to abnormal behavior recognition. However, the joint fraud recognition mentioned in this article has the characteristics of high data complexity, multi-user interaction, and many high-dimensional features. In addition, most models will have speed and efficiency problems when faced with large-scale data sets and high-dimensional features.

[0008] (3) Although the application of the model can significantly improve the recognition accuracy and recall rate, the model has the problem of low interpretability during the application process. Summary of the invention

[0009] In view of the problems existing in the prior art, the purpose of the embodiments of the present application is to provide a method and device for identifying fraud in conjunction with multiple users.

[0010] According to a first aspect of an embodiment of the present application, a method for identifying joint fraud by multiple users is provided, comprising:

[0011] Obtain the behavior information, order and payment information of the service provider and the service recipient of each order from login to fulfillment completion, and extract order features from them;

[0012] A training set and a test set are constructed based on the order features and cheating possibility of each order, and a cheating identification model is trained using the training set, wherein the cheating identification model adopts the LightGBM model;

[0013] Based on the trained fraud detection model, the fraud probability of each order in the test set is predicted to obtain the effective range of the fraud probability.

[0014] Combining the cheating probability effective interval with a predetermined rule group to obtain a globally optimal combination;

[0015] Obtain the order to be identified, and perform fraud identification on the order to be identified based on the global optimal combination method.

[0016] Furthermore, the behavior information, order and payment information of the service provider and the service recipient of each order from login to fulfillment completion are obtained, and order features are extracted from them, including:

[0017] Based on expert experience, we collect the behavioral information, order and payment information required by the service provider and the service recipient from login to fulfillment completion;

[0018] Perform data preprocessing on the collected information;

[0019] The preprocessed information is processed through data onehot or label encoding, thereby including service provider behavior characteristics, service recipient behavior characteristics, and order characteristics of order and payment characteristics.

[0020] Furthermore, based on the order features of each order, the fraud identification model is trained, including:

[0021] Set the cheating probability for each order based on expert experience;

[0022] Construct a training set based on the order characteristics and cheating possibility of each order;

[0023] The training set is used to perform supervised training on the cheating recognition model.

[0024] Furthermore, based on the trained fraud identification model, the fraud probability of each order in the test set is predicted, thereby obtaining the effective range of the fraud probability, which is specifically:

[0025] Based on the trained fraud detection model, predict the fraud probability of each order in the test set;

[0026] Draw the receiver operating characteristic curve based on the cheating probability of each order in the test set;

[0027] The area under the receiver operating characteristic curve (AUC) was calculated, and AUC~1 was taken as the effective interval of cheating probability.

[0028] Furthermore, the predicted value of the trained cheating recognition model is combined with the predetermined rule group to obtain the globally optimal combination, including:

[0029] The following traversal process is performed on all rules in the predetermined rule group: a rule is combined with the predicted value of the trained fraud identification model to obtain a combined rule, the combined rule is combined with the remaining rules in the rule group to form a combined rule group, the combined rule group is used to determine whether the order is fraudulent, and the value of the combined rule group is obtained;

[0030] Compare the value of each combination rule group to obtain the combination rule group with the highest value as the global optimal combination.

[0031] Furthermore, the value of the combined rule group is accuracy or recall.

[0032] According to a second aspect of an embodiment of the present application, a multi-user terminal joint fraud identification device is provided, comprising:

[0033] The information acquisition and feature extraction module is used to obtain the behavior information, order and payment information of the service provider and the service recipient of each order from login to fulfillment completion, and extract order features from them;

[0034] A model training module is used to construct a training set and a test set based on the order characteristics and cheating possibility of each order, and use the training set to train a cheating identification model, wherein the cheating identification model adopts the LightGBM model;

[0035] The cheating probability effective interval calculation module is used to predict the cheating probability of each order in the test set based on the trained cheating identification model, so as to obtain the cheating probability effective interval;

[0036] A combination optimization module is used to combine the cheating probability effective interval with a predetermined rule group to obtain a globally optimal combination mode;

[0037] The fraud identification module is used to obtain the order to be identified, and perform fraud identification on the order to be identified based on the global optimal combination method.

[0038] According to a third aspect of an embodiment of the present application, a computer program product is provided, comprising a computer program / instruction, which implements the method described in the first aspect when executed by a processor.

[0039] According to a fourth aspect of an embodiment of the present application, there is provided an electronic device, including:

[0040] one or more processors;

[0041] A memory for storing one or more programs;

[0042] When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in the first aspect.

[0043] According to a fifth aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which computer instructions are stored, and when the instructions are executed by a processor, the steps of the method described in the first aspect are implemented.

[0044] The technical solution provided by the embodiments of the present application may have the following beneficial effects:

[0045] It can be seen from the above embodiments that this application introduces the LightGBM model, combines the prediction results of the model with multiple core rules, and innovatively adopts the globally optimal traction strategy after the combination to achieve the best overall recognition effect, that is, the globally optimal combination method is screened out by embedding the model into the original rule system. The above method can better improve the accuracy and recall rate of cheating identification, and has better interpretability for abnormal identification results.

[0046] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0048] Figure 1 The present invention is a flowchart of a method for identifying joint fraud of multiple users according to an exemplary embodiment.

[0049] Figure 2 The present invention is a block diagram of a multi-user terminal joint fraud identification device according to an exemplary embodiment.

[0050] Figure 3The diagram is a schematic diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0051] Here, exemplary embodiments are described in detail, and examples thereof are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application.

[0052] The terms used in this application are for the purpose of describing specific embodiments only and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0053] It should be understood that although the terms first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0054] The process of joint fraud by multiple users is usually as follows: the service recipient places an order on the platform and pays a deposit in advance, and the service provider obtains the order through the platform and completes the contract through offline services. In order to encourage the service recipient and the service provider to trade, the platform usually reduces the payment cost of the service recipient and increases the service remuneration of the service provider through marketing subsidies. Then, the service provider and the service recipient will jointly forge false orders to obtain marketing subsidies. Taking the takeaway scenario in O2O as an example, the service recipient places an order and pays a deposit through the takeaway platform, and the service provider completes the order by forging food and delivery. The joint fraud between the service recipient and the service provider effectively obtains the marketing subsidy of the platform, causing actual economic losses to the platform.

[0055] Based on the above-mentioned joint fraudulent behaviors, the offline fulfillment process forged by the service recipients and service providers is usually different from the normal fulfillment process, such as fulfillment time, fulfillment mileage, etc. And under the governance of platform abnormal identification and control, the service recipients and service providers will gradually upgrade the "hiddenness" of their own behaviors.

[0056] Based on this, this application proposes a multi-user joint fraud identification method, such as Figure 1 As shown, the method includes:

[0057] Step S1: Obtain the behavior information, order and payment information of the service provider and the service recipient of each order from login to fulfillment completion, and extract order features from them;

[0058] Specifically, based on expert experience, the behavioral information, order and payment information required by the service provider and the service recipient from login to fulfillment are collected, and data preprocessing is performed, that is, missing value processing, outlier processing, data type conversion, etc., and then the data is converted into features through data onehot or label encoding, partial feature normalization, etc. This method can better complete the construction of all features required for identification, and split the features into service provider behavior features, service recipient behavior features, order and payment features according to the classification of features in business scenarios. The above three types of features for each order are combined to form order features. Business experts will output expert experience based on the business characteristics and historical experience of the scenario, combine the features that have completed data preprocessing, and then form recognition rules to realize the recognition of abnormal behavior by rules.

[0059] Step S2: construct a training set and a test set based on the order features and cheating possibility of each order, and use the training set to train a cheating identification model, wherein the cheating identification model adopts the LightGBM model;

[0060] Specifically, in order to improve the recognition ability, based on the characteristics of high data complexity, multi-user interaction, and many high-dimensional features in the cheating scenario in this application, the LightGBM model is introduced here. This model uses the negative gradient of the loss function as the residual approximation of the current decision tree to fit the new decision tree. Compared with classification models such as XGBoost, the LightGBM model is better in speed and efficiency, and is more suitable for scene recognition such as this application with large-scale data sets and high-dimensional features. The possibility of cheating for each order is set according to expert experience, combined with the order features extracted in step S1, and split 7:3 to form a training set and a test set.

[0061] The formula is as follows:

[0062] The mathematical model formula of LightGBM can be expressed as:

[0063] in, is the value of the target variable, i.e., the possibility of cheating in the order; is the input feature vector, i.e., the order features, It is The predicted value of a decision tree, is the number of decision trees. This formula shows how the LightGBM model generates the final prediction result by adding the prediction values ​​of multiple decision trees.

[0064] The cheating identification model is trained in a supervised manner based on the order features of each order in the training set and the cheating possibility set according to expert experience.

[0065] Step S3: Based on the trained fraud identification model, predict the fraud probability of each order in the test set, so as to obtain the effective range of the fraud probability;

[0066] Specifically, based on the trained fraud identification model, the fraud probability of each order in the test set is predicted, the area under the receiver operating characteristic curve (ROC curve) AUC is calculated, and AUC~1 is used as the effective interval of the fraud probability.

[0067] Step S4: combining the cheating probability effective interval with a predetermined rule group to obtain a globally optimal combination;

[0068] After the model training is completed, this application finds the global optimal combination method by traversing and fusing the model with multiple main rules. After evaluating and scoring the recognition rules combined by expert experience in real transactions, the core rules with the best impact on recognition are screened out, and then the predicted values ​​output by the LightGBM model are combined and tuned with all the core rules to screen out the combination method that can achieve the global optimality.

[0069] For example, in the original main rules, experts found through business experience that features such as IP or device association between the service provider and the service recipient, short order duration, and high frequency of orders between the service provider and the service recipient have a significant impact on judging whether cheating occurs, so the above features are combined and used as the main rules for judging whether a behavior is cheating. However, in some specific scenarios, the rules formed by the combination of the above features still have the problem of misjudgment, so the model judgment result is used as one of the features and integrated into the rules output by expert experience to improve the overall recognition and recall capabilities.

[0070] The formula is shown below:

[0071] After combining the predicted value output by the LightGBM model with all core rules, the global optimal value is output

[0072] The value measurement unit of the global optimality is V, and the value of the original rule combination for the global output is , the data result value of the LightGBM model is y, and the value of the global output after the model is applied to each core rule is , then the global optimal value after y is applied to each core rule is

[0073] For example, there are 10 rules formed by combining features based on expert experience, namely In a set of rules, the relationship between the rules is "or". If one of the rules is considered cheating, then the whole set of rules is considered cheating. Applying the 10 rules to the business scenario of the test set, the global output result is , where the result value can be accuracy or recall; if the result value y output by LightGBM is used as a feature and Combining to form new rules (For example, if the model prediction value is greater than 60% and the service provider and the service recipient have IP or device associations, With the original Applied to the business scenario of the test set, the global output result is , and so on. In this way, we can exhaustively enumerate the global impact of combining the LightGBM model with all rules, and then calculate the combination of the LightGBM model and the rules by finding the maximum value.

[0074] Step S5: obtaining the order to be identified, and performing fraud identification on the order to be identified based on the global optimal combination method;

[0075] Specifically, for the order to be identified, its order features are extracted by referring to the process of step S1, and cheating identification is performed according to the global optimal combination method to obtain an identification result.

[0076] Based on the fraudulent behaviors of the service provider and the service recipient in the above scenarios and the related features in the order and payment process, we first extract the core features through expert experience to complete the rule combination, and verify the effects of multiple rules through online real-time transactions. Then, we preprocess the data set and build a model, and use the model output results to traverse, fuse and optimize with the core rules that have been launched, so as to achieve the global optimal recognition effect.

[0077] In summary, this application can achieve:

[0078] 1) Cheating in online platforms is usually one-sided arbitrage, that is, users forge false transactions through client operations to obtain platform benefits; the joint cheating behavior of service providers and service recipients has the characteristics of multi-user terminal interaction, high data complexity, and many high-dimensional features. Traditional classification models have low modeling efficiency and poor classification effect. This application innovatively introduces the LightGBM model, which is better in solving this type of scene recognition with large-scale data sets and high-dimensional feature characteristics; although the LightGBM model has a wide range of applications, the industry has not introduced this model into the joint cheating identification of multiple user terminals.

[0079] 2) Although the application of the model can significantly improve the accuracy and recall of recognition, the model has the problem of low interpretability during application. Therefore, this application adopts a method of combining the model output value with historically verified rules, which can better balance the requirements of accuracy and interpretability.

[0080] 3) When combining the model output value with historically verified rules, this application adopts a "two-round screening" mechanism, that is, firstly evaluating the effectiveness and scoring the effects of all expert experience-related rules, and then combining the predicted value of the model output with the head rule with a better effect score, and exploring the globally optimal combination method through online verification.

[0081] Corresponding to the aforementioned embodiment of the multi-user terminal joint fraud identification method, the present application also provides an embodiment of the multi-user terminal joint fraud identification device.

[0082] Figure 2 is a block diagram of a multi-user terminal joint fraud identification device according to an exemplary embodiment. Figure 2 , the device may include:

[0083] The information acquisition and feature extraction module 21 is used to obtain the behavior information, order and payment information of the service provider and the service recipient of each order from login to fulfillment completion, and extract order features therefrom;

[0084] A model training module 22 is used to construct a training set and a test set based on the order characteristics and cheating possibility of each order, and use the training set to train a cheating identification model, wherein the cheating identification model adopts a LightGBM model;

[0085] The cheating probability effective interval calculation module 23 is used to predict the cheating probability of each order in the test set based on the trained cheating identification model, so as to obtain the cheating probability effective interval;

[0086] A combination optimization module 24 is used to combine the cheating probability effective interval with a predetermined rule group to obtain a globally optimal combination mode;

[0087] The fraud identification module 25 is used to obtain the order to be identified, and perform fraud identification on the order to be identified based on the global optimal combination method.

[0088] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0089] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present application scheme. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0090] Accordingly, the present application also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the multi-user terminal joint fraud identification method as described above.

[0091] Accordingly, the present application also provides an electronic device, comprising: one or more processors; a memory for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors implement the above-mentioned multi-user terminal joint fraud identification method. Figure 3 As shown in the figure, a hardware structure diagram of a multi-user terminal joint fraud identification device provided by an embodiment of the present invention is provided in any device with data processing capability, except Figure 3 In addition to the processor, memory and network interface shown, any device with data processing capability in which the apparatus in the embodiment is located may also include other hardware, generally based on the actual functions of the device with data processing capability, which will not be described in detail.

[0092] Correspondingly, the present application also provides a computer-readable storage medium on which computer instructions are stored, and when the instructions are executed by the processor, the multi-user terminal joint fraud identification method as described above is implemented. The computer-readable storage medium can be an internal storage unit of any device with data processing capabilities described in any of the aforementioned embodiments, such as a hard disk or a memory. The computer-readable storage medium can also be an external storage device, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), an SD card, a flash card (Flash Card), etc. equipped on the device. Furthermore, the computer-readable storage medium can also include both an internal storage unit and an external storage device of any device with data processing capabilities. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capabilities, and can also be used to temporarily store data that has been output or is to be output.

[0093] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the contents disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application, which follow the general principles of the present application and include common knowledge or customary technical means in the art that are not disclosed in the present application.

[0094] It should be understood that the present application is not limited to the exact construction that has been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof.

Claims

1. A multi-user joint fraud identification method, characterized in that: include: Obtain the behavior information, order and payment information of the service provider and the service recipient of each order from login to fulfillment completion, and extract order features from them; A training set and a test set are constructed based on the order features and cheating possibility of each order, and a cheating identification model is trained using the training set, wherein the cheating identification model adopts the LightGBM model; Based on the trained fraud detection model, the fraud probability of each order in the test set is predicted to obtain the effective range of the fraud probability. Combining the cheating probability effective interval with a predetermined rule group to obtain a globally optimal combination; Obtaining an order to be identified, and performing fraud identification on the order to be identified based on the global optimal combination method; Among them, based on the trained fraud identification model, the fraud probability of each order in the test set is predicted, so as to obtain the effective range of the fraud probability, which is specifically: Based on the trained fraud detection model, predict the fraud probability of each order in the test set; Draw the receiver operating characteristic curve based on the cheating probability of each order in the test set; Calculate the area under the receiver operating characteristic curve (AUC), and take AUC~1 as the effective interval of cheating probability; The predicted value of the trained cheating recognition model is combined with the predetermined rule group to obtain the global optimal combination, including: The following traversal process is performed on all rules in the predetermined rule group: a rule is combined with the predicted value of the trained fraud identification model to obtain a combined rule, the combined rule is combined with the remaining rules in the rule group to form a combined rule group, the combined rule group is used to determine whether the order is fraudulent, and the value of the combined rule group is obtained; Compare the value of each combination rule group to obtain the combination rule group with the highest value as the global optimal combination.

2. The method according to claim 1, characterized in that Obtain the behavior information, order and payment information of the service provider and the service recipient of each order from login to fulfillment completion, and extract order features from them, including: Based on expert experience, we collect the behavioral information, order and payment information required by the service provider and the service recipient from login to fulfillment completion; Perform data preprocessing on the collected information; The preprocessed information is processed through data onehot or label encoding, thereby including service provider behavior characteristics, service recipient behavior characteristics, and order characteristics of order and payment characteristics.

3. The method according to claim 1, characterized in that: The fraud detection model is trained based on the order features of each order, including: Set the cheating probability for each order based on expert experience; Construct a training set based on the order characteristics and cheating possibility of each order; The training set is used to perform supervised training on the cheating recognition model.

4. The method according to claim 1, characterized in that The value of the combined rule group is the precision or the recall.

5. A multi-user joint fraud identification device, characterized in that: include: The information acquisition and feature extraction module is used to obtain the behavior information, order and payment information of the service provider and the service recipient of each order from login to fulfillment completion, and extract order features from them; A model training module is used to construct a training set and a test set based on the order characteristics and cheating possibility of each order, and use the training set to train a cheating identification model, wherein the cheating identification model adopts the LightGBM model; The cheating probability effective interval calculation module is used to predict the cheating probability of each order in the test set based on the trained cheating identification model, so as to obtain the cheating probability effective interval; A combination optimization module is used to combine the cheating probability effective interval with a predetermined rule group to obtain a globally optimal combination mode; A fraud identification module, used for obtaining an order to be identified, and performing fraud identification on the order to be identified based on the global optimal combination method; Among them, based on the trained fraud identification model, the fraud probability of each order in the test set is predicted, so as to obtain the effective range of the fraud probability, which is specifically: Based on the trained fraud detection model, predict the fraud probability of each order in the test set; Draw the receiver operating characteristic curve based on the cheating probability of each order in the test set; Calculate the area under the receiver operating characteristic curve (AUC), and take AUC~1 as the effective interval of cheating probability; The predicted value of the trained cheating recognition model is combined with the predetermined rule group to obtain the global optimal combination, including: The following traversal process is performed on all rules in the predetermined rule group: a rule is combined with the predicted value of the trained fraud identification model to obtain a combined rule, the combined rule is combined with the remaining rules in the rule group to form a combined rule group, the combined rule group is used to determine whether the order is fraudulent, and the value of the combined rule group is obtained; Compare the value of each combination rule group to obtain the combination rule group with the highest value as the global optimal combination.

6. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the method according to any one of claims 1 to 4 is implemented.

7. An electronic device, characterized in that: include: one or more processors; A memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 4.

8. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the instruction is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images