Abnormal account detection method, electronic device, and storage medium

Abstract

The present application discloses an abnormal account detection method, an electronic device, and a storage medium, the method comprising: extracting features from the transaction data of a target account to obtain target feature data of the target account; matching the target feature data with abnormal rules to obtain a rule domain matching result, wherein the rule domain matching result is used to characterize whether the target account is abnormal; and performing abnormal detection on the target feature data using an abnormal detection model to obtain an algorithm domain detection result, wherein the algorithm domain detection result is used to characterize whether the target account is abnormal; based on the rule domain matching result and the algorithm domain detection result, determining whether the target account is abnormal. The above scheme can improve the accuracy of account detection.

Description

Technical Field

[0001] The present application relates to the field of anomaly detection, and in particular to an abnormal account detection method, an electronic device, and a storage medium. Background Art

[0002] In the prior art, in order to detect whether a target account is abnormal, the transaction data of the target account is usually analyzed manually to determine whether the target account is abnormal. For example, in the financial field, in order to detect whether an account has abnormal behavior such as fraud, it is often necessary to rely on manual rules and static data to analyze the transaction data of the target account, which has limited effect on complex and real-time abnormal behavior detection and has limited accuracy in identifying abnormal behavior. Summary of the invention

[0003] The present application at least provides an abnormal account detection method, an electronic device, and a storage medium, which can improve the accuracy of account detection.

[0004] The first aspect of the present application provides an abnormal account detection method, including: extracting features from transaction data of a target account to obtain target feature data of the target account; matching the target feature data with abnormal rules to obtain a rule domain matching result, wherein the rule domain matching result is used to characterize whether the target account has an abnormality; and performing anomaly detection on the target feature data using an anomaly detection model to obtain an algorithm domain detection result, wherein the algorithm domain detection result is used to characterize whether the target account has an abnormality; and determining whether the target account has an abnormality based on the rule domain matching result and the algorithm domain detection result.

[0005] The target feature data includes at least one of historical feature data and real-time feature data. The historical feature data is obtained by counting the historical transaction data of the target account, and the real-time feature data is obtained by counting the real-time transaction data of the target account. The real-time transaction data is obtained when the transaction corresponding to the real-time transaction data occurs.

[0006] When the target characteristic data includes historical characteristic data, feature extraction is performed on the transaction data of the target account to obtain the target characteristic data of the target account, including: feature extraction is performed on the historical transaction data to obtain a plurality of first features, wherein different first features correspond to different data fields in the historical transaction data; at least one combination is performed on the plurality of first features to obtain at least one combined feature, wherein each combined feature includes at least two first features; and statistics are respectively performed on the historical transaction data that meets each combined feature to obtain the historical characteristic data of the target account.

[0007] Wherein, when the target characteristic data includes real-time characteristic data, feature extraction is performed on the transaction data of the target account to obtain the target characteristic data of the target account, including: using the current real-time transaction data of the target account to obtain statistics on the transaction status of the target account with preset transaction behaviors within the target time period as the real-time characteristic data of the target account; wherein the real-time characteristic data includes at least one of the following: the number of transactions of the first transaction behavior occurring within the first target time period within each target cycle, the number of transactions of the second transaction behavior occurring within the most recent second target time period, the number of transactions of continuous abnormal transaction behaviors occurring within the most recent third target time period, the first transaction behavior and the second transaction behavior being transfer-in or transfer-out, and the continuous abnormal transaction behavior being at least two abnormal transaction behaviors occurring in sequence.

[0008] Among them, performing abnormal rule matching on the target feature data to obtain a rule domain matching result includes: using at least one abnormal rule to match the target feature data respectively to obtain a matching result corresponding to each abnormal rule, wherein each matching result represents whether the target account has an abnormal transaction behavior corresponding to the abnormal rule; using the rule weight of each abnormal rule, weighting the matching result corresponding to each abnormal rule to obtain a rule domain matching result.

[0009] Among them, before using the rule weight of each abnormal rule to weight the matching results corresponding to each abnormal rule to obtain the rule domain matching result, it also includes: obtaining the initial weight corresponding to each abnormal rule as the current weight of each abnormal rule; obtaining the degree of association between each abnormal rule and whether the account is abnormal, and using the degree of association of each abnormal rule to optimize the current weight of each abnormal rule, repeating this step until the optimization end condition is met, and using the current weight of each abnormal rule finally optimized as the rule weight of each abnormal rule.

[0010] Among them, obtaining the degree of association between each abnormal rule and whether an account is abnormal includes: obtaining the hit rate of each abnormal rule in a number of reference accounts as the degree of association, the hit rate corresponding to the abnormal rule represents the ratio between the number of abnormal accounts and the number of reference accounts matched by the abnormal rule, the number of abnormal accounts is the number of reference accounts determined to have abnormalities, and whether the reference account is abnormal is determined based on the current weight of each abnormal rule and the matching result of each abnormal rule to the reference account; and / or, optimizing the current weight of each abnormal rule using the degree of association of each abnormal rule, including: constructing an objective function with the weight of each abnormal rule as the optimization variable, the objective function represents the weighting of the degree of association of each abnormal rule using the weight of each abnormal rule; optimizing the optimization variable in the objective function using a preset optimization algorithm.

[0011] Among them, there is at least one anomaly detection model, and the anomaly detection model is used to perform anomaly detection on the target feature data to obtain an algorithm domain detection result, including: for each anomaly detection model, anomaly detection is performed based on the model feature data corresponding to the anomaly detection model to obtain the anomaly detection result of the anomaly detection model, the model feature data is at least one feature data in the target feature data, and the anomaly detection result includes the prediction confidence of whether the target account has an anomaly; using the model weight of each anomaly detection model, the prediction confidence corresponding to each anomaly detection model is weighted to obtain the algorithm domain confidence as the algorithm domain detection result.

[0012] Among them, there are different sample transaction data between the sample data sets of different anomaly detection models; and / or, there are multiple anomaly detection models, and the network structures of at least two anomaly detection models are different; and / or, the training steps of the anomaly detection model include: obtaining target feature data corresponding to the sample transaction data of the sample account; screening the target feature data corresponding to the sample transaction data to obtain model feature data corresponding to the sample transaction data; using the anomaly detection model to perform anomaly detection on the model feature data corresponding to the sample transaction data to obtain a sample anomaly detection result; and adjusting the parameters of the anomaly detection model based on the sample anomaly detection result.

[0013] Wherein, based on the rule domain matching result and the algorithm domain detection result, determining whether the target account has an abnormality includes: in response to the rule domain matching result being greater than or equal to the first preset threshold, or the algorithm domain detection result being greater than or equal to the second preset threshold, determining that the target account has an abnormality.

[0014] The method further includes at least one step: in response to a rule domain matching result being greater than or equal to a first preset threshold, and an algorithm domain detection result being greater than or equal to a second preset threshold, fusing the rule domain matching result and the algorithm domain detection result to obtain a fusion result of the target account, and feeding back at least one of the fusion result, the rule domain matching result and the algorithm domain detection result of the target account to a preset object; in response to a rule domain matching result being greater than or equal to a first preset threshold, and an algorithm domain detection result being less than a second preset threshold, at least feeding back the rule domain matching result of the target account to the preset object; in response to a rule domain matching result being less than the first preset threshold, and an algorithm domain detection result being greater than or equal to a second preset threshold, at least feeding back the matching result of the algorithm domain detection result of the target account to the preset object.

[0015] A second aspect of the present application provides an electronic device, comprising a memory and a processor coupled to each other, wherein the processor is used to execute program instructions stored in the memory to implement the abnormal account detection method in the first aspect above.

[0016] A third aspect of the present application provides a computer-readable storage medium having program instructions stored thereon, which, when executed by a processor, implements the abnormal account detection method in the first aspect.

[0017] The above scheme obtains the target feature data of the target account by extracting features from the transaction data of the target account, and then performs anomaly rule matching on the target feature data to obtain the rule domain matching result. At the same time, the anomaly detection model is used to perform anomaly detection on the target feature data to obtain the algorithm domain detection result. Finally, a judgment is made based on the rule domain matching result and the algorithm domain detection result to determine whether the target account has anomalies. The multi-dimensional output results are combined to make the detection of the target account more accurate.

[0018] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings herein are incorporated into the specification and constitute a part of the specification. These drawings illustrate embodiments consistent with the present application and are used together with the specification to illustrate the technical solution of the present application.

[0020] Figure 1 It is a flowchart of an embodiment of the abnormal account detection method of the present application;

[0021] Figure 2 It is a flowchart of an embodiment of the historical feature data extraction method of the present application;

[0022] Figure 3 It is a flowchart of another embodiment of the abnormal account detection method of the present application;

[0023] Figure 4 This is a flow chart of an embodiment of an abnormal account detection device of the present application;

[0024] Figure 5 It is a schematic diagram of the framework of an embodiment of the electronic device of the present application;

[0025] Figure 6 It is a schematic diagram of a framework of an embodiment of a computer-readable storage medium of the present application. DETAILED DESCRIPTION

[0026] The scheme of the embodiment of the present application is described in detail below in conjunction with the drawings of the specification.

[0027] In the following description, for the purpose of explanation rather than limitation, specific details such as specific system structures, interfaces, and technologies are provided to facilitate a thorough understanding of the present application.

[0028] The term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the objects associated before and after are in an "or" relationship. In addition, "many" in this article means two or more than two. In addition, the term "at least one" in this article means any combination of at least two of any one or more of a plurality of, for example, including at least one of A, B, and C, can mean including any one or more elements selected from the set consisting of A, B, and C.

[0029] See also Figure 1 , Figure 1 This is a flow chart of an embodiment of the abnormal account detection method of the present application. Specifically, it may include the following steps:

[0030] Step S110: extracting features from the transaction data of the target account to obtain target feature data of the target account.

[0031] This application can be applied to scenarios such as financial transactions where there are transactions between accounts, and is used to analyze the transaction behavior of the target account based on the transaction data of the target account, so as to determine whether the target account is an abnormal account or a risky account.

[0032] In some embodiments, the target feature data may include at least one of historical feature data and real-time feature data, wherein the historical feature data is obtained by counting the historical transaction data of the target account, and the real-time feature data is obtained by counting the real-time transaction data of the target account, and the real-time transaction data is obtained when the transaction corresponding to the real-time transaction data occurs. The historical transaction data is updated once every preset time period.

[0033] For example, the target account's transaction data for the past 30 days can be counted as historical transaction data, and each preset time interval can be one day. Therefore, the historical transaction data needs to be input in batches every day, and only needs to be input once a day. In addition, the historical transaction data can also be all transaction data for the past 7 days, 10 days, etc., which is not specifically limited here.

[0034] In a specific embodiment, when the target feature data includes historical feature data, in order to extract features from the historical transaction data of the target account to obtain the historical feature data, the historical transaction data may be firstly subjected to feature extraction to obtain a plurality of first features, wherein different first features correspond to different data fields in the historical transaction data. The plurality of first features are then subjected to at least one combination to obtain at least one combined feature, wherein each combined feature includes at least two first features. The historical transaction data that meets each combined feature is then statistically analyzed to obtain the historical feature data of the target account.

[0035] Among them, the several first characteristics include at least two of the transaction date range characteristics, the transaction time period characteristics, the transaction direction characteristics and the basic transaction characteristics, and the basic transaction characteristics include at least one of the number of transactions, the transaction amount, the ratio of the amount transferred out to the amount transferred in, the balance after the transaction, the number of the other party to the transaction, the integer multiple number of transactions, and the number and amount of large transactions.

[0036] Please refer to Figure 2 The historical feature domain is constructed by combining the transaction date interval feature, transaction time period feature, transaction direction feature and basic flow feature, wherein the transaction date interval feature includes sub-feature options such as today, yesterday, the past 3 days, the past 7 days, and the past 30 days, the transaction time period feature includes sub-feature options such as 23:00-6:00, 19:00-0:00, and all day, the transaction direction feature includes sub-feature options such as transfer-in, transfer-out, and total amount, and the basic flow feature includes sub-feature options such as the number of transactions, transaction amount, ratio of the amount of transfer-out to the amount of transfer-in, balance after transaction, number of the other party to the transaction, number of integer multiples, and number and amount of large transactions. The historical transaction data is input into the historical feature domain, and the historical feature domain parses the different data fields of the historical transaction data, thereby selecting the sub-feature options corresponding to the historical transaction data from the transaction date interval feature, transaction time period feature, transaction direction feature, and basic flow feature as the corresponding four first features, and then combining the four first features to obtain the corresponding combined features of the historical transaction data. Among them, the combined features can be:

[0037] 1. The number of transactions transferred in between 23:00 and 6:00 in the past 30 days;

[0038] 2. The number of outgoing transactions between 23:00 and 6:00 in the past 30 days;

[0039] 3. The transaction amount transferred in between 19:00 and 0:00 in the past 14 days;

[0040] 4. The amount of transactions transferred out within 19:00-00:00 in the past 14 days;

[0041] 5. Ratio of outgoing amount to incoming amount in the past 7 days.

[0042] Afterwards, the historical transaction data that meets the characteristics of each combination are counted to obtain the historical characteristic data of the target account.

[0043] For example, the final historical feature data is shown in Table 1:

[0044] Table 1

[0045]

[0046] In another specific embodiment, when the target characteristic data includes real-time characteristic data, in order to obtain the real-time characteristic data, the current real-time transaction data of the target account can be used to obtain the transaction status of the target account in the target time period as the real-time characteristic data of the target account. In addition, the target time period can be a short time such as 3s or 5s.

[0047] The real-time characteristic data includes at least one of the following: the number of transactions of the first transaction behavior in the first target time period in each target cycle, the number of transactions of the second transaction behavior in the most recent second target time period, and the number of transactions of continuous abnormal transaction behaviors in the most recent third target time period, the first transaction behavior and the second transaction behavior are transfer-in or transfer-out, and the continuous abnormal transaction behavior is at least two abnormal transaction behaviors occurring in sequence. The first target time period, the most recent second target time period, and the most recent third target time period in each target cycle are target time periods, and the first transaction behavior, the second transaction behavior, and the continuous abnormal transaction behavior are preset transaction behaviors.

[0048] For example, assuming that the target cycle is one day and the first target time period is nighttime, then "the number of transactions in which the first transaction behavior occurs in the first target time period within each target cycle" is the "number of transfer-in transactions that occur at night every day"; assuming that the second target time period is 5 seconds and the second transaction behavior is a transfer-in behavior, then "the number of transactions in which the second transaction behavior occurs in the most recent second target time period" is the "number of transfer-in transactions that occur in the most recent 5 seconds"; assuming that the third target time period is 5 seconds and the continuous abnormal transaction behavior is a small transfer-out followed by a transfer-in behavior, then "the number of transactions in which continuous abnormal transaction behavior occurs in the most recent third target time period" is the "number of transfer-in transactions that occur in the most recent 5 seconds after a small transfer-out". Therefore, the real-time feature data includes: the number of transfer-in transactions that occur at night every day, the number of transfer-in transactions that occur in the most recent 5 seconds, and the number of transfer-in transactions that occur in the most recent 5 seconds after a small transfer-out. After feature extraction of the real-time transaction data, the obtained real-time feature data can be shown in Table 2:

[0049] Table 2

[0050]

[0051] Furthermore, in order to obtain the number of transactions that occurred in the first target time period, the second target time period, or the third target time period, a sliding window method can be used to obtain the number of transactions. Specifically, a time window method can be used, and the time window can represent a night time period or a time period of 3 seconds, 5 seconds, etc. For example, the time period represented by the time window is 5 seconds, so the time window can be used to select all transaction data of the target account within 5 seconds before the moment.

[0052] In other embodiments, in order to comprehensively analyze the transaction data of the target account, feature extraction may be performed on historical transaction data to obtain historical feature data, and feature extraction may be performed on real-time transaction data to obtain real-time feature data.

[0053] Step S120: performing abnormal rule matching on the target feature data to obtain a rule domain matching result, wherein the rule domain matching result is used to characterize whether there is an abnormality in the target account.

[0054] In some embodiments, after obtaining the target feature data, the target feature data is analyzed and judged to determine whether the target account has any abnormality. Specifically, the target feature data can be matched with the set abnormality rules to obtain a matching result, and the matching result can be analyzed to determine whether the target account has any abnormality. Please refer to step S121 to step S122.

[0055] Step S121: Matching the target feature data with at least one abnormal rule respectively to obtain matching results corresponding to each abnormal rule, wherein each matching result indicates whether the target account has abnormal transaction behavior corresponding to the abnormal rule.

[0056] In some embodiments, the abnormal rules can be obtained by summarizing and concluding the experience of business experts and stored in the rule domain. After receiving the target feature data, the rule domain calculates the similarity between the target feature data and the abnormal rules stored in the rule domain to obtain a matching result, wherein one target feature data may be similar to multiple abnormal rules, so the abnormal rule with the highest similarity can be used as the matching result of the target feature data.

[0057] In other embodiments, multiple exception rules are stored in the rule domain, and the multiple exception rules are matched with the target feature data. If the match is successful, the value of the corresponding exception rule is set to 1; if the match fails, the value of the corresponding exception rule is set to 0.

[0058] Furthermore, in order to improve the matching efficiency, the rule domain can be used to identify the specified fields in the target feature data to obtain the recognition results, the target feature data can be divided according to the recognition results, and the target feature data can be input into the corresponding classification model for further precise matching.

[0059] For example, the rule domain includes a nighttime abnormal transaction identification model, which can determine whether the target account is suspected of nighttime abnormal transactions based on the transaction flow of the target account. The rule domain first identifies the time field in the target feature data. If the time field in the target feature data is identified as 23:00-6:00, the target feature data can be input into the nighttime abnormal transaction identification model. The nighttime abnormal transaction identification model identifies the target feature data according to its configured parameters to output a matching result. The configurable parameters in the nighttime abnormal transaction identification model are:

[0060] 1. "Integer multiple transfer" feature parameters: N (configurable) or more transfer transactions with a single amount of M (configurable) and an amount not less than Y (configurable) yuan;

[0061] 2. "Quick In and Quick Out" feature parameters: the number of active transfer-in and transfer-out transactions is N1 (configurable) or more, the amount of a single transaction is greater than Y1 (configurable) yuan, and the ratio of the credit amount to the debit amount is between B1-B2 (configurable, such as 0.95-1.05);

[0062] 3. Transaction number characteristic parameter: The total number of transactions exceeds N3 (configurable).

[0063] The corresponding output of the nighttime abnormal transaction identification model is:

[0064] 1. Whether the target account is suspected of abnormal transactions;

[0065] 2. Whether the target account's transactions that night meet the requirement of integer multiple transfer-in transactions;

[0066] 3. Whether the target account's transactions that night meet the requirement of integer multiple transfers;

[0067] 4. Whether the ratio of the target account's credit amount to debit amount that night is between B1 and B2;

[0068] 5. Whether there is any fast-in and fast-out trading in the target account that night;

[0069] 6. Whether the number of transactions of the target account exceeds XX transactions that night;

[0070] 7. Whether there are integer multiple transfers in the target account that night.

[0071] It can be understood that the rule domain may include not only the nighttime abnormal transaction identification model, but also the small-amount tentative transaction identification model, the abnormal cash withdrawal identification model, the running point platform monitoring model and other models, which are not specifically limited here.

[0072] Step S122: using the rule weights of the abnormal rules, weighting the matching results corresponding to the abnormal rules to obtain the rule domain matching results.

[0073] In some embodiments, after obtaining the matching results of each abnormal rule for the target feature data, the matching results corresponding to each abnormal rule are weighted using the rule weight of each abnormal rule to obtain the rule domain matching result. The rule weight of each abnormal rule is updateable, so after obtaining the rule domain matching result, the rule weight at this time is first determined. Specifically, please refer to step S1221 to step S1222.

[0074] Step S1221: Acquire the initial weight corresponding to each abnormal rule as the current weight of each abnormal rule.

[0075] You can set the initial weight for each exception rule .

[0076] Step S1222: Obtain the degree of association between each abnormal rule and whether the account is abnormal, and use the degree of association of each abnormal rule to optimize the current weight of each abnormal rule. Repeat this step until the optimization end condition is met, and use the current weight of each abnormal rule finally optimized as the rule weight of each abnormal rule.

[0077] In some embodiments, in order to obtain the degree of correlation between each abnormal rule and whether an account is abnormal, the hit rate of each abnormal rule in a number of reference accounts can be obtained as the degree of correlation. The hit rate corresponding to the abnormal rule represents the ratio between the number of abnormal accounts and the number of reference accounts matched by the abnormal rule. The number of abnormal accounts is the number of reference accounts determined to have abnormalities. Whether the reference account is abnormal is determined based on the current weight of each abnormal rule and the matching result of each abnormal rule on the reference account. For example, there are 10 abnormal accounts in a batch of transaction data, and the abnormal rule If it exists in 5 of these accounts, the hit rate is .

[0078] In addition, an objective function can be constructed with the weight of each abnormal rule as the optimization variable , the objective function represents the weighting of the association degree of each abnormal rule using the weight of each abnormal rule, that is, ,in, Indicates the hit rate, represents the current weight, and 𝑖 represents the number of abnormal rules.

[0079] Afterwards, the optimization variables in the objective function are optimized using a preset optimization algorithm. It is understandable that the optimization algorithm for the objective function may be a gradient descent algorithm, a stochastic gradient descent algorithm, a conjugate gradient algorithm, etc., which are not specifically limited here.

[0080] Iterate step S1221 to step S1222 repeatedly until the optimization end condition is met (for example, the maximum number of iterations is reached or the objective function no longer changes significantly). After the iteration is completed, the current weight of each abnormal rule is obtained as the rule weight of each abnormal rule.

[0081] Finally, the obtained rule weights are used to weight the matching results corresponding to each abnormal rule to obtain the rule domain matching results.

[0082] For example, for each exception rule Corresponding rule weight (The weight value is between 0 and 1, and the sum of the weights of each rule is equal to 1). Finally, the output of each rule for each account is weighted to obtain the rule domain matching result. , which is the final output confidence. The rule domain matching results are shown in Table 3:

[0083] Table 3

[0084]

[0085] Step S130: Use the anomaly detection model to perform anomaly detection on the target feature data to obtain an algorithm domain detection result, wherein the algorithm domain detection result is used to characterize whether there is an anomaly in the target account.

[0086] In some embodiments, there is at least one anomaly detection model. To obtain the algorithm domain detection result, anomaly detection can be performed on each anomaly detection model based on the model feature data corresponding to the anomaly detection model to obtain the anomaly detection result of the anomaly detection model. The model feature data is at least one feature data in the target feature data. The anomaly detection result includes the prediction confidence of whether the target account has an anomaly. Afterwards, the prediction confidence corresponding to each anomaly detection model is weighted using the model weight of each anomaly detection model to obtain the algorithm domain confidence as the algorithm domain detection result.

[0087] The feature data to be detected in each anomaly detection model may not be completely the same, but at least contain feature data in the target feature data. Therefore, when each anomaly detection model is used to detect the target feature data, the anomaly detection results output by each anomaly detection model are different. Therefore, the algorithm domain confidence can be obtained by weighting each anomaly detection result as the algorithm domain detection result.

[0088] In some embodiments, the training step of the anomaly detection model includes steps S131 to S133.

[0089] Step S131: Obtain target feature data corresponding to sample transaction data of a sample account;

[0090] In some embodiments, in order to make the training process of the anomaly detection model more realistic, the sample accounts may include positive sample accounts and negative sample accounts. Negative sample accounts are obtained from the abnormal date based on the historical notification of abnormal accounts, and the complete transaction flow data of the previous month is used as negative sample accounts. Generally speaking, the number of abnormal accounts is small, so it may be necessary to use a list of all abnormal accounts in the past year; otherwise, due to the small number of negative sample accounts, more abnormal transaction behaviors cannot be covered in the future, resulting in low prediction accuracy of the anomaly detection model. The sample transaction data of the positive sample account is the transaction flow data of the normal account in the past month. The base number of positive sample accounts is large, so only some accounts need to be used. Here, a stratified sampling method can be used for sampling to obtain the flow of the positive sample account. Specific operation: obtain the date of involvement of each blacklist account, and randomly select normal accounts in the same period at a ratio of 1:50, that is, each blacklist account corresponds to 50 whitelist accounts.

[0091] Furthermore, there are different sample transaction data between the sample data sets of different anomaly detection models. Therefore, after obtaining the sample transaction data of the positive sample account and the negative sample account, the sample transaction data of the positive sample account and the sample transaction data of the negative sample account can be divided. For example, the sample transaction data of the positive sample account and the sample transaction data of the negative sample account are randomly divided into 4 parts according to the account, and then every 3 parts are merged. Based on the above, 4 different training data sets (sample set 1, sample set 2, sample set 3, sample set 4) can be constructed. The purpose here is to ensure that the training data of each subsequent anomaly detection model is slightly different, so that the trained anomaly detection model has certain differences. Among them, there are multiple anomaly detection models, and at least two anomaly detection models have different network structures.

[0092] Afterwards, feature extraction is performed on sample set 1, sample set 2, sample set 3, and sample set 4 to obtain multiple target feature data.

[0093] Step S132: Screening the target feature data corresponding to the sample transaction data to obtain model feature data corresponding to the sample transaction data;

[0094] After obtaining multiple target feature data, the purpose of this solution is to construct as many features as possible in order to more comprehensively and from more dimensions to mine the potential features of abnormal trading behavior. However, for model building, the more features, the better. Too many features in the training model will affect the training and prediction performance of the model, and too many irrelevant features will affect the accuracy of the model. Therefore, it is necessary to filter the target feature data here and keep as many highly relevant features as possible as model feature data.

[0095] The screening method may be variance selection method, correlation coefficient, mutual information, chi-square test, model-based feature selection, recursive feature elimination and the like, which are not specifically limited here.

[0096] Step S133: Use the anomaly detection model to perform anomaly detection on the model feature data corresponding to the sample transaction data to obtain a sample anomaly detection result.

[0097] Among them, there are multiple anomaly detection models, and at least two anomaly detection models have different network structures.

[0098] For example, the LightGBM and Random Forest algorithms are used to perform anomaly detection on the model feature data of four sample sets to obtain sample anomaly detection results.

[0099] Step S134: adjusting parameters of the anomaly detection model based on the sample anomaly detection result.

[0100] In some embodiments, parameters of each anomaly detection model may be adjusted based on the difference between the sample anomaly detection result and the labeling result.

[0101] In other embodiments, the parameters of the anomaly detection model also include hyperparameters. To adjust the hyperparameters, grid search, random search, Bayesian optimization, evolutionary algorithms (such as genetic algorithms), gradient enhancement optimization, model-based methods (such as SMAC (Sequential Model-based Algorithm Configuration) and TPE (Tree-structured Parzen Estimator), learning curve analysis, etc. can be used, without specific limitation here.

[0102] After completing the parameter adjustment of the anomaly detection model, the anomaly detection model can be trained iteratively on a regular basis. Through continuous learning and optimization, the model can gradually improve its performance on the training data and generalize to new, unseen data.

[0103] The reason for regular model iteration here is that the characteristics of abnormal transaction behavior will continue to change over time. The purpose of regular model iteration is to continuously learn and train recent abnormal transaction behaviors to ensure that the model can adapt to new abnormal accounts.

[0104] The specific operation process is basically the same as the model training process. The only difference is the expansion of training samples. Specifically, new positive and negative sample transaction flow data are added on the basis of the previous version of training samples. Other operations remain the same.

[0105] After obtaining four anomaly detection models through the above training method, the anomaly detection models are used to perform anomaly detection on the target feature data to obtain four algorithm domain detection results. Afterwards, the model weights of each anomaly detection model are used (The weight value is between 0 and 1, and the sum of the weights is equal to 1). The prediction confidence corresponding to each anomaly detection model is weighted to obtain the algorithm domain confidence ( ), as the algorithm domain detection result.

[0106] In one implementation scenario, the above step S120 and step S130 may be performed in a sequential order, for example, step S120 is performed first and then step S130; or, step S130 is performed first and then step S120. In another implementation scenario, the above step S120 and step S130 may also be performed simultaneously, which may be specifically set according to actual applications and is not limited here.

[0107] Step S140: Based on the rule domain matching result and the algorithm domain detection result, determine whether there is any abnormality in the target account.

[0108] In some embodiments, in response to a rule domain matching result being greater than or equal to a first preset threshold, or an algorithm domain detection result being greater than or equal to a second preset threshold, it is determined that an abnormality exists in the target account, such as determining that fraud exists in the target account.

[0109] In addition, for target accounts with abnormalities, their relevant results can be fed back to the preset object. Among them, for target accounts with abnormal rule domain matching results and algorithm domain detection results, the rule domain matching results and algorithm domain detection results can be fused and the fusion results can be fed back to the preset object.

[0110] In some specific embodiments, in response to the rule domain matching result being greater than or equal to the first preset threshold, and the algorithm domain detection result being greater than or equal to the second preset threshold, the rule domain matching result and the algorithm domain detection result are fused to obtain a fusion result of the target account, and at least one of the fusion result, the rule domain matching result, and the algorithm domain detection result of the target account is fed back to the preset object. The fusion result may be obtained by weighting the target account that exists in both the rule domain matching result and the algorithm domain detection result.

[0111] In some specific embodiments, in response to the rule domain matching result being greater than or equal to the first preset threshold and the algorithm domain detection result being less than the second preset threshold, at least the rule domain matching result of the target account is fed back to the preset object. Of course, the algorithm domain detection result can also be fed back to the preset object.

[0112] In some specific embodiments, in response to the rule domain matching result being less than the first preset threshold and the algorithm domain detection result being greater than or equal to the second preset threshold, at least the matching result of the algorithm domain detection result of the target account is fed back to the preset object. Of course, the rule domain matching result can also be fed back to the preset object.

[0113] See also Figure 3 , Figure 3 This is a flow chart of another embodiment of the abnormal account detection method of the present application. Specifically, it may include the following steps:

[0114] Step S310: Screen the accounts to be detected to obtain target accounts.

[0115] In some embodiments, the account to be detected is screened according to a preset screening rule. For example, the preset screening rule may be that the account to be detected has no more than 5 transactions in the past 30 days, so that the account to be detected is regarded as an inactive account, and the inactive account and its transaction data are deleted. For another example, the preset screening rule may be that the account to be detected has no more than 7 transactions in the past 30 days and the transactions all occur during the day, so that the account to be detected that meets the screening rule is deleted.

[0116] Step S320: extracting features from the transaction data of the target account to obtain target feature data of the target account.

[0117] This step is the same as the above step S110 and will not be described again here.

[0118] Step S330: Perform abnormal rule matching on the target feature data to obtain a rule domain matching result.

[0119] This step is the same as the above step S120 and will not be described again here.

[0120] Step S340: Use the anomaly detection model to perform anomaly detection on the target feature data to obtain an algorithm domain detection result.

[0121] This step is the same as the above step S130 and will not be described again here.

[0122] Step S350: Fusing the rule domain matching result and the algorithm domain detection result to obtain a fusion result.

[0123] In some embodiments, the rule domain matching results and the algorithm domain detection results are screened, and the rule domain matching results greater than or equal to the first threshold are used as the target rule domain matching results; the algorithm domain detection results greater than or equal to the second threshold are used as the target algorithm domain detection results. The results of the target accounts that exist in both the target rule domain matching results and the target algorithm domain detection results are weighted to obtain the fusion results of the target accounts, and the fusion results are output.

[0124] Overall, this solution constructs features from the perspective of historical data and real-time data, makes full use of abnormal rules, builds multiple anomaly detection models and fully overlaps the models, ensuring the accuracy and interpretability of the prediction results. It avoids business problems caused by inaccurate predictions caused by using only single-dimensional information. This solution uses historical data and real-time data to more comprehensively extract and mine abnormal transaction behavior features, reducing the situation where normal accounts are misjudged due to low model accuracy caused by incomplete mining of abnormal account features.

[0125] In this solution, different samples are used to train multiple anomaly detection models. Each anomaly detection model has certain differences in samples and algorithms. Fusing multiple output results can reduce the error of the anomaly detection model and can more fully and comprehensively learn and predict the abnormal behavior of the account.

[0126] It is understandable that in the above method of the specific implementation mode, the writing order of each step does not mean a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each step should be determined by its function and possible internal logic.

[0127] See also Figure 4 , Figure 4It is a flow chart of an embodiment of an abnormal account detection device of the present application. The abnormal account detection device 400 includes a feature extraction module 410, a rule matching module 420, an anomaly detection module 430 and a fusion module 440. The feature extraction module 410 performs feature extraction on the transaction data of the target account to obtain the target feature data of the target account. The rule matching module 420 performs abnormal rule matching on the target feature data to obtain the rule domain matching result, wherein the rule domain matching result is used to characterize whether the target account has an abnormality. The anomaly detection module 430 performs anomaly detection on the target feature data using an anomaly detection model to obtain the algorithm domain detection result, wherein the algorithm domain detection result is used to characterize whether the target account has an abnormality. The fusion module 440 performs determination of whether the target account has an abnormality based on the rule domain matching result and the algorithm domain detection result.

[0128] In some embodiments, the feature extraction module 410 executes target feature data including at least one of historical feature data and real-time feature data. The historical feature data is obtained by statistics of historical transaction data of the target account, and the real-time feature data is obtained by statistics of real-time transaction data of the target account. The real-time transaction data is obtained when the transaction corresponding to the real-time transaction data occurs.

[0129] In some embodiments, the feature extraction module 410 executes target feature data including historical feature data; performs feature extraction on the transaction data of the target account to obtain the target feature data of the target account, including: performing feature extraction on the historical transaction data to obtain a plurality of first features, wherein different first features correspond to different data fields in the historical transaction data; performing at least one combination of the plurality of first features to obtain at least one combined feature, wherein each combined feature includes at least two first features; and performing statistics on the historical transaction data that meets each combined feature to obtain the historical feature data of the target account.

[0130] In some embodiments, the feature extraction module 410 executes several first features including at least two of transaction date interval features, transaction time period features, transaction direction features and basic flow features, the basic flow features including at least one of the number of transactions, transaction amount, ratio of outgoing amount to incoming amount, balance after transaction, number of other parties to the transaction, integer multiple number of transactions, and number and amount of large transactions; and / or, the historical transaction data is updated once every preset time period.

[0131] In some embodiments, the feature extraction module 410 executes target feature data including real-time feature data; performs feature extraction on the transaction data of the target account to obtain the target feature data of the target account, including: using the current real-time transaction data of the target account to obtain statistics on the transaction status of the target account with preset transaction behaviors within the target time period as the real-time feature data of the target account.

[0132] In some embodiments, the feature extraction module 410 executes real-time feature data including at least one of the following: the number of transactions of the first transaction behavior occurring in the first target time period within each target cycle, the number of transactions of the second transaction behavior occurring in the most recent second target time period, the number of transactions of continuous abnormal transaction behaviors occurring in the most recent third target time period, the first transaction behavior and the second transaction behavior are transfers in or out, and the continuous abnormal transaction behavior is at least two abnormal transaction behaviors occurring in sequence.

[0133] In some embodiments, the rule matching module 420 performs abnormal rule matching on the target feature data to obtain a rule domain matching result, including: using at least one abnormal rule to match the target feature data respectively to obtain a matching result corresponding to each abnormal rule, wherein each matching result represents whether the target account has an abnormal transaction behavior corresponding to the abnormal rule; using the rule weight of each abnormal rule to weight the matching result corresponding to each abnormal rule to obtain a rule domain matching result.

[0134] In some embodiments, the rule matching module 420 executes, before using the rule weight of each abnormal rule to weight the matching results corresponding to each abnormal rule to obtain the rule domain matching result, it also includes: obtaining the initial weight corresponding to each abnormal rule as the current weight of each abnormal rule; obtaining the degree of association between each abnormal rule and whether the account is abnormal, and using the degree of association of each abnormal rule to optimize the current weight of each abnormal rule, repeating this step until the optimization end condition is met, and using the current weight of each abnormal rule finally optimized as the rule weight of each abnormal rule.

[0135] In some embodiments, the rule matching module 420 executes to obtain the degree of association between each abnormal rule and whether the account is abnormal, including: obtaining the hit rate of each abnormal rule in a number of reference accounts as the degree of association, the hit rate corresponding to the abnormal rule represents the ratio between the number of abnormal accounts and the number of reference accounts matched by the abnormal rule, the number of abnormal accounts is the number of reference accounts determined to have abnormalities, and whether the reference account is abnormal is determined based on the current weight of each abnormal rule and the matching result of each abnormal rule for the reference account; and / or, optimizing the current weight of each abnormal rule using the degree of association of each abnormal rule, including: constructing an objective function with the weight of each abnormal rule as the optimization variable, the objective function represents the weighting of the degree of association of each abnormal rule using the weight of each abnormal rule; optimizing the optimization variables in the objective function using a preset optimization algorithm.

[0136] In some embodiments, the anomaly detection module 430 executes at least one anomaly detection model, and uses the anomaly detection model to perform anomaly detection on the target feature data to obtain an algorithm domain detection result, including: for each anomaly detection model, anomaly detection is performed based on the model feature data corresponding to the anomaly detection model to obtain the anomaly detection result of the anomaly detection model, the model feature data is at least one feature data in the target feature data, and the anomaly detection result includes the predicted confidence of whether the target account has an anomaly; using the model weight of each anomaly detection model, the predicted confidence corresponding to each anomaly detection model is weighted to obtain the algorithm domain confidence as the algorithm domain detection result.

[0137] In some embodiments, there are different sample transaction data between the sample data sets of different anomaly detection models executed by the anomaly detection module 430; and / or, there are multiple anomaly detection models, and the network structures of at least two anomaly detection models are different; and / or, the training steps of the anomaly detection model include: obtaining target feature data corresponding to the sample transaction data of the sample account; screening the target feature data corresponding to the sample transaction data to obtain model feature data corresponding to the sample transaction data; using the anomaly detection model to perform anomaly detection on the model feature data corresponding to the sample transaction data to obtain a sample anomaly detection result; and adjusting the parameters of the anomaly detection model based on the sample anomaly detection result.

[0138] In some embodiments, the fusion module 440 determines whether there is an abnormality in the target account based on the rule domain matching result and the algorithm domain detection result, including: in response to the rule domain matching result being greater than or equal to the first preset threshold, or the algorithm domain detection result being greater than or equal to the second preset threshold, determining that there is an abnormality in the target account.

[0139] In some embodiments, the fusion module 440 execution method also includes at least one step: in response to the rule domain matching result being greater than or equal to a first preset threshold, and the algorithm domain detection result being greater than or equal to a second preset threshold, fusing the rule domain matching result and the algorithm domain detection result to obtain the fusion result of the target account, and feeding back at least one of the fusion result, the rule domain matching result and the algorithm domain detection result of the target account to the preset object; in response to the rule domain matching result being greater than or equal to the first preset threshold, and the algorithm domain detection result being less than the second preset threshold, at least feeding back the rule domain matching result of the target account to the preset object; in response to the rule domain matching result being less than the first preset threshold, and the algorithm domain detection result being greater than or equal to the second preset threshold, at least feeding back the matching result of the algorithm domain detection result of the target account to the preset object.

[0140] See also Figure 5 , Figure 5: is a schematic diagram of a framework of an embodiment of an electronic device 50 of the present application. The electronic device 50 includes a memory 51 and a processor 52 coupled to each other, and the processor 52 is used to execute program instructions stored in the memory 51 to implement the steps in any of the above abnormal account detection method embodiments. In a specific implementation scenario, the electronic device 50 may include but is not limited to: a microcomputer, a server, and in addition, the electronic device 50 may also include a mobile device such as a laptop computer and a tablet computer, which is not limited here.

[0141] Specifically, the processor 52 is used to control itself and the memory 51 to implement the steps in any of the above-mentioned abnormal account detection method embodiments. The processor 52 can also be called a CPU (Central Processing Unit). The processor 52 may be an integrated circuit chip with signal processing capabilities. The processor 52 can also be a general-purpose processor, a digital signal processor (Digital Signal Processor, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field-programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. In addition, the processor 52 can be implemented by an integrated circuit chip.

[0142] See also Figure 6 , Figure 6 Schematic diagram of a framework of an embodiment of a computer-readable storage medium 60 of the present application. The computer-readable storage medium 60 stores program instructions 601 that can be executed by a processor, and the program instructions 601 are used to implement the steps in any of the above-mentioned abnormal account detection method embodiments.

[0143] In some embodiments, the functions or modules included in the device provided by the embodiments of the present disclosure can be used to execute the method described in the above method embodiments. The specific implementation can refer to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0144] The above description of various embodiments tends to emphasize the differences between the various embodiments. The same or similar aspects can be referenced to each other, and for the sake of brevity, they will not be repeated herein.

[0145] In the several embodiments provided in the present application, it should be understood that the disclosed methods and devices can be implemented in other ways. For example, the device implementation described above is only schematic. For example, the division of modules or units is only a logical function division. There may be other division methods in actual implementation, such as units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or units can be electrical, mechanical or other forms.

[0146] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0147] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) or a processor to execute all or part of the steps of each implementation method of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program code.

Claims

1. A method for detecting abnormal accounts, characterized in that: include: Extracting features from the transaction data of the target account to obtain target feature data of the target account; Performing abnormal rule matching on the target feature data to obtain a rule domain matching result, wherein the rule domain matching result is used to characterize whether the target account has an abnormality; performing abnormal rule matching on the target feature data to obtain a rule domain matching result includes: using at least one abnormal rule to match the target feature data respectively to obtain a matching result corresponding to each abnormal rule, wherein each matching result characterizes whether the target account has an abnormal transaction behavior corresponding to the abnormal rule; obtaining an initial weight corresponding to each abnormal rule as a current weight of each abnormal rule; obtaining a correlation degree between each abnormal rule and whether the account is abnormal, and optimizing the current weight of each abnormal rule using the correlation degree of each abnormal rule, repeating this step until an optimization end condition is met, and using the current weight of each abnormal rule finally optimized as a rule weight of each abnormal rule; using the rule weight of each abnormal rule to weight the matching result corresponding to each abnormal rule to obtain the rule domain matching result; and, Performing anomaly detection on the target feature data using an anomaly detection model to obtain an algorithm domain detection result, wherein the algorithm domain detection result is used to characterize whether the target account has an anomaly; Based on the rule domain matching result and the algorithm domain detection result, determine whether the target account has any abnormality.

2. The method according to claim 1, characterized in that The target feature data includes at least one of historical feature data and real-time feature data, wherein the historical feature data is obtained by counting historical transaction data of the target account, and the real-time feature data is obtained by counting real-time transaction data of the target account, and the real-time transaction data is obtained when a transaction corresponding to the real-time transaction data occurs; When the target feature data includes historical feature data, extracting features from the transaction data of the target account to obtain the target feature data of the target account includes: Performing feature extraction on the historical transaction data to obtain a plurality of first features, wherein different first features correspond to different data fields in the historical transaction data; Perform at least one combination on a plurality of the first features to obtain at least one combined feature, wherein each of the combined features includes at least two first features; The historical transaction data meeting each of the combination characteristics are counted respectively to obtain the historical characteristic data of the target account.

3. The method according to claim 1, characterized in that When the target feature data includes real-time feature data, extracting features from the transaction data of the target account to obtain the target feature data of the target account includes: Using the current real-time transaction data of the target account, statistically obtain the transaction status of the target account in which the preset transaction behavior occurs within the target time period, as the real-time characteristic data of the target account; Among them, the real-time characteristic data includes at least one of the following: the number of transactions of the first transaction behavior occurring in the first target time period within each target cycle, the number of transactions of the second transaction behavior occurring in the most recent second target time period, and the number of transactions of continuous abnormal transaction behaviors occurring in the most recent third target time period, wherein the first transaction behavior and the second transaction behavior are transfers in or out, and the continuous abnormal transaction behavior is at least two abnormal transaction behaviors occurring in sequence.

4. The method according to claim 1, characterized in that: The obtaining of the correlation between each of the abnormal rules and whether the account is abnormal includes: Obtaining a hit rate of each of the abnormal rules in a number of reference accounts as the degree of association, wherein the hit rate corresponding to the abnormal rule represents the ratio between the number of abnormal accounts and the number of reference accounts matched by the abnormal rule, wherein the number of abnormal accounts is the number of reference accounts determined to have abnormalities, and whether the reference account is abnormal is determined based on the current weight of each of the abnormal rules and the matching result of each of the abnormal rules on the reference account; And / or, optimizing the current weight of each of the abnormal rules by using the association degree of each of the abnormal rules includes: Constructing an objective function with the weight of each of the abnormal rules as an optimization variable, wherein the objective function represents weighting the association degree of each of the abnormal rules by using the weight of each of the abnormal rules; The optimization variables in the objective function are optimized using a preset optimization algorithm.

5. The method according to claim 1, characterized in that The anomaly detection model has at least one, and the anomaly detection is performed on the target feature data using the anomaly detection model to obtain an algorithm domain detection result, including: For each of the anomaly detection models, anomaly detection is performed based on model feature data corresponding to the anomaly detection model to obtain an anomaly detection result of the anomaly detection model, wherein the model feature data is at least one feature data in the target feature data, and the anomaly detection result includes a prediction confidence of whether the target account has an anomaly; The prediction confidences corresponding to the anomaly detection models are weighted by using the model weights of the anomaly detection models to obtain the algorithm domain confidence as the algorithm domain detection result.

6. The method according to claim 5, characterized in that There are different sample transaction data between the sample data sets of different anomaly detection models; And / or, there are multiple anomaly detection models, and at least two of the anomaly detection models have different network structures; And / or, the training step of the anomaly detection model includes: Obtain target feature data corresponding to sample transaction data of sample accounts; Screening the target feature data corresponding to the sample transaction data to obtain model feature data corresponding to the sample transaction data; Using the anomaly detection model to perform anomaly detection on the model feature data corresponding to the sample transaction data to obtain a sample anomaly detection result; Parameters of the anomaly detection model are adjusted based on the sample anomaly detection result.

7. The method according to claim 1, characterized in that The determining whether the target account has an abnormality based on the rule domain matching result and the algorithm domain detection result includes: In response to the rule domain matching result being greater than or equal to a first preset threshold, or the algorithm domain detection result being greater than or equal to a second preset threshold, it is determined that an abnormality exists in the target account.

8. The method according to claim 7, characterized in that The method further comprises at least one step: In response to the rule domain matching result being greater than or equal to a first preset threshold, and the algorithm domain detection result being greater than or equal to a second preset threshold, fusing the rule domain matching result and the algorithm domain detection result to obtain a fusion result of the target account, and feeding back at least one of the fusion result of the target account, the rule domain matching result and the algorithm domain detection result to a preset object; In response to the rule domain matching result being greater than or equal to a first preset threshold and the algorithm domain detection result being less than a second preset threshold, at least feeding back the rule domain matching result of the target account to a preset object; In response to the rule domain matching result being less than a first preset threshold and the algorithm domain detection result being greater than or equal to a second preset threshold, at least the matching result of the algorithm domain detection result of the target account is fed back to a preset object.

9. An electronic device, characterized in that: It comprises a memory and a processor coupled to each other, wherein the processor is used to execute program instructions stored in the memory to implement the abnormal account detection method according to any one of claims 1 to 8.

10. A computer-readable storage medium having program instructions stored thereon, characterized in that: When the program instructions are executed by a processor, the abnormal account detection method according to any one of claims 1 to 8 is implemented.

Images