A method and system for identifying and warning abnormal behavior of electricity payment channels

Abstract

The application discloses a kind of electric fee channel payment abnormal behavior identification early warning method and system, method includes: to active transfer service monitoring identification: for active transfer electric fee service, set up business check rule, realize the accuracy and compliance control of active transfer service;Money laundering fraud behavior monitoring identification: user information characteristics, payment behavior characteristics and account association relationship characteristics are analyzed and scored, establish electric fee anti-washing fraud scoring early warning mechanism, according to score determine the possibility that user exists abnormal payment behavior;Small payment behavior monitoring identification of user: according to internal staff performance appraisal behavior, channel earns commission behavior and preferential activity abnormal participation behavior, establish small payment abnormal early warning mechanism, judge whether user exists payment abnormal behavior.The application solves the problem that current electric fee channel monitoring technology lacks real-time monitoring management of each channel payment and online service, early warning ability is not strong and accuracy is low.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field, and particularly relates to a method and system for identifying and early warning of abnormal behavior of electricity fee channel payment. BACKGROUND

[0002] With the development of the economic society, the demand of customer electricity service presents a diversification trend. In order to adapt to the different needs of various payment crowds, intelligent payment channels are continuously enriched, and the service and channel management pressure of payment channels is increasing. At the same time, the risk of money laundering and other criminal activities by means of new payment channels is increasing, which seriously endangers the financial security of the power grid and users, and leads to an increasing demand for channel monitoring and early warning.

[0003] A Chinese patent with publication number CN116150616A discloses an electricity fee abnormality accounting method and system. The method comprises: collecting user electricity fee data and a plurality of historical electricity fee data; determining a training data set, inputting each historical electricity fee data into a convolutional neural network model, and outputting an abnormal feature value; constructing an electricity fee abnormality accounting network model using the training data set; and inputting the user electricity fee data into the electricity fee abnormality accounting network model to determine an electricity fee abnormality result. The application predicts whether the user electricity fee is abnormal through a convolutional neural network, cooperates with actual user investigation, corrects model prediction errors and adds training data sets for iterative training. The accuracy of model prediction is improved, the workload of actual investigation is reduced, and an electricity fee abnormality accounting method based on a convolutional network is realized. However, the application only accounts by using electricity fee data, without considering other factors that may affect electricity fee abnormality, which limits the accuracy of the model in abnormality detection. Moreover, the convolutional neural network model is a black box model, and its prediction results lack interpretability. SUMMARY

[0004] The application provides a method and system for identifying and early warning of abnormal behavior of electricity fee channel payment, aiming to solve the problems of lack of real-time monitoring and management of various payment channels and online business services, weak early warning ability and low accuracy of the current electricity fee channel monitoring technology.

[0005] To solve the above technical problems, the application provides a method for identifying and early warning of abnormal behavior of electricity fee channel payment, comprising the following steps:

[0006] The identification and early warning of electricity fee payment abnormal behavior are divided into two categories, namely active transfer behavior and channel payment behavior.

[0007] The monitoring and identification of active transfer behavior specifically comprises: for active transfer electricity fee business, setting business verification rules to realize the control of the accuracy and compliance of active transfer business.

[0008] The monitoring and identification of money laundering and fraud behaviors in the channel payment behavior specifically comprises: analyzing the current situation of money laundering and fraud behaviors, summarizing the characteristics of money laundering and fraud behaviors, analyzing and scoring the user information characteristics, the payment behavior characteristics and the account association relationship characteristics, establishing an anti-money laundering and fraud scoring early warning mechanism, and judging the possibility of abnormal payment behavior of the user according to the score.

[0009] The monitoring and identification of small amount payment behavior of the user in the channel payment behavior specifically comprises: dividing the small amount abnormal payment behavior into internal employee performance evaluation behavior, channel commission earning behavior and abnormal participation in preferential activities according to the causes, establishing a small amount payment abnormal early warning mechanism, and judging whether the user has abnormal payment behavior.

[0010] Preferably, the analysis and scoring of the user information characteristics specifically comprises: grading and scoring according to whether the four elements of the user information characteristics, including the bank card number, the opening bank, the opening account name and the mobile phone number information, are complete and whether the bank card number and the mobile phone number are valid.

[0011] The analysis and scoring of the payment behavior characteristics specifically comprises: grading and scoring according to the set data range according to the payment frequency behavior characteristics of the electricity account, the payment amount behavior characteristics of the electricity account, the number of associated fund accounts of the electricity account, the payment frequency behavior characteristics of the fund account, the payment amount behavior characteristics of the fund account and the number of associated electricity accounts of the fund account.

[0012] The analysis and scoring of the account association relationship characteristics specifically comprises: dividing the account association relationship characteristics into the association degree with the users confirmed to be involved in money laundering and fraud, the association degree with the suspected users involved in money laundering and fraud, and the proportion of the first association relationship, and grading and scoring according to the set data range.

[0013] Preferably, the setting of the verification rules for the internal employee performance evaluation behavior specifically comprises: if the channel account and the mobile phone number registered by the internal employee are consistent and the monthly channel account payment frequency exceeds the set number threshold, the monthly channel account payment frequency exceeds the set number threshold and the channel account payment amount is lower than the set amount threshold, the electricity account and the identity card number registered by the internal employee are consistent and the monthly channel account payment frequency exceeds the set number threshold, the number of single channel account payment to different electricity accounts within a month exceeds the set number threshold and the channel account is a credit account, the internal employee performance evaluation behavior meeting any of the above conditions is determined to be abnormal payment behavior of the internal employee performance evaluation behavior.

[0014] The setting of the verification rules for the channel commission earning behavior specifically comprises: if the single payment amount is lower than the cost threshold and the weekly payment behavior with the payment amount lower than the cost threshold exceeds the set number threshold, the channel commission earning behavior is determined to be abnormal payment behavior.

[0015] The verification rule for the abnormal participation behavior of the preferential activity is specifically: if the same payment participates in the preferential activity and meets any of the following conditions, the electricity account has participated in the same preferential activity, the electricity account has participated in other preferential activities within a set time range, the channel account has participated in the same preferential activity, and the channel user has participated in other preferential activities within a set time range, then it is determined that the abnormal payment behavior is an abnormal participation behavior of the preferential activity.

[0016] Preferably, the monitoring and identification of money laundering and fraud behavior in the channel payment behavior also includes preprocessing the score data obtained according to the electricity anti-money laundering and fraud scoring early warning mechanism, and dividing it into a training set and a test set, establishing an electricity anti-money laundering and fraud scoring observation model to fit and train the training set data, obtaining the best model parameters, and inputting the test set data into the electricity anti-money laundering and fraud scoring observation model to obtain the observation score of the electricity anti-money laundering and fraud scoring early warning mechanism. According to the observation score, adjust the data range set by the existing electricity anti-money laundering and fraud scoring early warning mechanism, and the electricity anti-money laundering and fraud scoring early warning adjustment model is specifically:

[0017]

[0018] In the formula, x t is the observation score at time t, N is the autoregressive order, is the autoregressive coefficient, x t-1 is the score data at time t-1, a t is a normally distributed white noise sequence.

[0019] On the other hand, the present application provides an identification and early warning system for electricity channel payment abnormal behavior, which includes a proactive transfer business monitoring and identification module, a money laundering and fraud behavior monitoring and identification module, and a user small amount payment behavior monitoring and identification module.

[0020] The proactive transfer business monitoring and identification module is used for the proactive transfer of electricity business, and the accuracy and compliance of the proactive transfer business are controlled by setting business verification rules.

[0021] The money laundering and fraud behavior monitoring and identification module is used for analyzing the current situation of money laundering and fraud behavior, summarizing the characteristics of money laundering and fraud behavior, analyzing and scoring user information characteristics, payment behavior characteristics and account association characteristics, establishing an electricity anti-money laundering and fraud scoring early warning mechanism, and determining the possibility of abnormal payment behavior of the user according to the score.

[0022] The user small amount payment behavior monitoring and identification module is used for dividing small amount abnormal payment behavior into internal employee performance evaluation behavior, channel earning commission behavior and preferential activity abnormal participation behavior according to the causes, establishing a small amount payment abnormal early warning mechanism, and determining whether the user has payment abnormal behavior.

[0023] Preferably, the money laundering and fraud behavior monitoring and identification module analyzes and scores the user information features, specifically including: grading and scoring according to whether the four elements of the user information features, including the bank card number, the opening bank, the opening account name, and the mobile phone number information, are complete and whether the bank card number and the mobile phone number are valid.

[0024] The analysis and scoring of the payment behavior features specifically includes: grading and scoring the number of electricity account payment times behavior features, the electricity account payment amount behavior features, the number of electricity account associated fund account behavior features, the number of fund account payment times behavior features, the fund account payment amount behavior features, and the number of fund account associated electricity account behavior features according to the set data range.

[0025] The analysis and scoring of the account association relationship features specifically includes: dividing the account association relationship features into the association degree with confirmed money laundering and fraud users, the association degree with suspected money laundering and fraud users, and the proportion of first association relationship establishment, and grading and scoring according to the set data range.

[0026] Preferably, the user small payment behavior monitoring and identification module sets verification rules for internal employee performance evaluation behavior, specifically including: if the channel account and the mobile phone number registered by the internal employee are consistent, the number of monthly channel account payment times exceeds the set number threshold, the number of monthly channel account payment times exceeds the set number threshold and the channel account payment amount is lower than the set amount threshold, the electricity account and the ID number registered by the internal employee are consistent, the number of monthly channel account payment times exceeds the set number threshold, the number of single channel account payment to different electricity accounts within a month exceeds the set number threshold, and the channel account is a credit account, the internal employee performance evaluation behavior is determined as abnormal payment behavior of internal employee performance evaluation behavior.

[0027] The verification rules for channel commission earning behavior specifically include: if the single payment amount is lower than the cost threshold and the number of weekly payment behaviors with payment amount lower than the cost threshold exceeds the set number threshold, the channel commission earning behavior is determined as abnormal payment behavior.

[0028] The verification rules for preferential activity abnormal participation behavior specifically include: if the same payment participates in the preferential activity and meets any of the following conditions, the electricity account has participated in the same preferential activity, the electricity account has participated in other preferential activities within the set time range, the channel account has participated in the same preferential activity, and the channel user has participated in other preferential activities within the set time range, the preferential activity abnormal participation behavior is determined as abnormal payment behavior.

[0029] Preferably, the money laundering fraud behavior monitoring and identification module is also used for preprocessing the score data obtained according to the electricity anti-money laundering fraud score early warning mechanism, and dividing the score data into a training set and a test set, establishing an electricity anti-money laundering fraud score observation model to fit and train the training set data, obtaining the best model parameters, and inputting the test set data into the electricity anti-money laundering fraud score observation model to obtain the observation score of the electricity anti-money laundering fraud score early warning mechanism, and adjusting the data range set by the existing electricity anti-money laundering fraud score early warning mechanism according to the observation score, and the electricity anti-money laundering fraud score early warning adjustment model is specifically:

[0030]

[0031] In the formula, x t is the observation score at time t, N is the autoregressive order, is the autoregressive coefficient, x t-1 is the score data at time t-1, a t is a normal distribution white noise sequence.

[0032] In another aspect, the present application also provides an electronic device, comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor executes the computer program to realize the identification and early warning method of the abnormal behavior of the electricity channel as described in any one of the embodiments of the present application.

[0033] In another aspect, the present application also provides a computer readable storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to realize the identification and early warning method of the abnormal behavior of the electricity channel as described in any one of the embodiments of the present application.

[0034] Compared with the prior art, the present application has the following technical effects:

[0035] 1. The present application improves the operation efficiency and user satisfaction of the electricity channel through the research on the intelligent monitoring of the electricity channel, discovers and solves potential problems in time through the monitoring and early warning of the electricity channel, and avoids the occurrence of risks, and improves the stability and safety of the channel through the research on the abnormal control mechanism of the electricity channel.

[0036] 2. The present application uses historical data real-time analysis technology and other technologies to build a user-side channel risk monitoring and identification model, connects the online and offline transaction risk processing procedures, realizes the closed loop of the whole channel risk control, collects the transaction behaviors of customers in multiple channels through joint cooperation of business departments, jointly monitors the transaction of customers in multiple channels, actively identifies abnormal transactions, analyzes and judges and applies risk strategies, establishes an abnormal data early warning mechanism, and timely processes differentiated strategies. BRIEF DESCRIPTION OF DRAWINGS

[0037] Figure 1 is a whole flow chart of the method for identifying and warning abnormal behavior of electricity payment channels. DETAILED DESCRIPTION

[0038] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme of the present application will be described clearly and completely below by combining with specific embodiments of the present application and referring to the drawings.

[0039] Embodiment one

[0040] The embodiment provides a method for identifying and warning abnormal behavior of electricity payment channels, referring to FIG. 1, which comprises the following steps: Figure 1

[0041] The identification and warning of abnormal behavior of electricity payment is divided into two categories, namely, active transfer behavior and channel payment behavior.

[0042] The monitoring and identification of the active transfer behavior are specifically as follows: for the active transfer electricity payment service, the accuracy and compliance of the active transfer service are controlled by setting service verification rules. Specifically, whether the account statement remarks contain the energy card number information, whether the unique account number energy card information and the account number information in the account statement remarks are bound, and whether the transfer fee and the service fee are consistent are verified, and if they are inconsistent, it is determined that there is an abnormal transfer service.

[0043] The monitoring and identification of the money laundering and fraud behavior in the channel payment behavior are specifically as follows: by analyzing the current situation of money laundering and fraud behavior, the characteristics of money laundering and fraud behavior are summarized, the user information characteristics, the payment behavior characteristics and the account association relationship characteristics are analyzed and scored, the electricity anti-money laundering and fraud scoring warning mechanism is established, and the possibility of abnormal payment behavior of the user is determined according to the score.

[0044] By analyzing the current situation of money laundering and fraud behavior, it is concluded that the behavior of money laundering and fraud usually shows the following characteristics: 1, the user information is incomplete or inaccurate; 2, the payment frequency is high; 3, the payment amount is large; 4, a single fund account is paid to multiple electricity accounts; 5, a single electricity account is paid by multiple different fund accounts; and there is a transaction behavior with an account that has been confirmed as anti-money laundering.

[0045] Compared with other abnormal behavior monitoring, the identification and monitoring of money laundering and fraud behavior are more fuzzy, and it is difficult to determine the occurrence of money laundering and fraud behavior through a single behavior. Therefore, the electricity anti-money laundering and fraud scoring warning mechanism can be established by referring to the user anti-money laundering risk scoring mechanism of financial institutions, each item of user information and payment characteristics is scored, and finally the higher the score, the greater the possibility of abnormal payment behavior of the user.

[0046] ​As a preferred embodiment of the present embodiment, the analysis and scoring of the user information features links the electricity account and the bank account in the payment behavior, providing data and technical support for subsequent real-name authentication, monitoring of the bank account, and backtracking of the payment process. The effectiveness and completeness of the user information are ensured through verification of the four-element information. Specifically, the four-element information of the bank account includes the bank card number, the opening bank, the account holder's name, and the mobile phone number. The bank account is graded and scored according to whether the four-element information is complete and whether the bank card number and the mobile phone number are valid.

[0047] The analysis and scoring of the payment behavior features include grading and scoring the electricity account payment frequency behavior feature, the electricity account payment amount behavior feature, the number of associated bank accounts of the electricity account behavior feature, the bank account payment frequency behavior feature, the bank account payment amount behavior feature, and the number of associated electricity accounts of the bank account behavior feature according to the set data range.

[0048] The analysis and scoring of the account association relationship features include dividing the account association relationship features into the association degree with confirmed money laundering and fraud users, the association degree with suspected money laundering and fraud users, and the proportion of the first association relationship establishment, and grading and scoring according to the set data range.

[0049] The monitoring and identification of the user's small payment behavior in the channel payment behavior include dividing the small abnormal payment behavior into internal staff performance evaluation behavior, channel commission earning behavior, and abnormal participation in preferential activities, establishing a small payment abnormality early warning mechanism, and determining whether the user has abnormal payment behavior.

[0050] As a preferred embodiment of the present embodiment, the verification rules for internal staff performance evaluation behavior include the following conditions: the channel account number is consistent with the mobile phone number registered by the internal staff, and the monthly channel account payment frequency exceeds the set number threshold; the monthly channel account payment frequency exceeds the set number threshold, and the channel account payment amount is lower than the set amount threshold; the electricity account number is consistent with the ID number registered by the internal staff, and the monthly channel account payment frequency exceeds the set number threshold; the number of single channel account payments to different electricity accounts within a month exceeds the set number threshold, and the channel account is a credit account. If any of the above conditions is met, the internal staff performance evaluation behavior is determined to be abnormal payment behavior.

[0051] The verification rules for channel commission earning behavior include the following conditions: if the single payment amount is lower than the cost threshold, and the weekly payment behavior with the payment amount lower than the cost threshold exceeds the set number threshold, then the channel commission earning behavior is determined to be abnormal payment behavior.

[0052] The check rule for preferential activity abnormal participation behavior is specifically: if the same payment participates in the preferential activity and meets any of the following conditions, the electricity account has participated in the same preferential activity, the electricity account has participated in other preferential activities within a set time range, the channel account has participated in the same preferential activity, and the channel user has participated in other preferential activities within a set time range, then it is determined that the preferential activity abnormal participation behavior is an abnormal payment behavior.

[0053] As a preferred embodiment of the present embodiment, the monitoring and identification of money laundering and fraud behavior in channel payment behavior also includes preprocessing the score data obtained according to the electricity anti-money laundering and fraud scoring early warning mechanism, and dividing it into a training set and a test set, establishing an electricity anti-money laundering and fraud scoring observation model to fit and train the training set data, obtaining the best model parameters, and inputting the test set data into the electricity anti-money laundering and fraud scoring observation model to obtain the observation score of the electricity anti-money laundering and fraud scoring early warning mechanism. According to the observation score, adjust the data range set by the existing electricity anti-money laundering and fraud scoring early warning mechanism. The electricity anti-money laundering and fraud scoring early warning adjustment model is specifically:

[0054]

[0055] In the formula, x t is the observation score at time t, N is the autoregressive order, which is obtained by AIC criterion in the present embodiment; is the autoregressive coefficient, which is estimated by the least square method in the present embodiment; x t-1 is the score data at time t-1, a t is a normal distribution white noise sequence, which is obtained using a random number generator.

[0056] The AIC criterion function is specifically:

[0057]

[0058] In the formula, is the model residual variance, and M is the length of the time series.

[0059] Embodiment two

[0060] Correspondingly, the present embodiment provides an identification and early warning system for electricity channel payment abnormal behavior, which includes a proactive transfer business monitoring and identification module, a money laundering and fraud behavior monitoring and identification module, and a user small payment behavior monitoring and identification module.

[0061] The proactive transfer business monitoring and identification module is used for the proactive transfer electricity business, and the accuracy and compliance of the proactive transfer business are controlled by setting business check rules. This module is used to realize the function of monitoring and identifying proactive transfer business in embodiment one, and will not be described here.

[0062] The money laundering fraud behavior monitoring and identifying module is used for analyzing the current situation of money laundering and fraud behaviors, summarizing the characteristics of money laundering and fraud behaviors, analyzing and scoring the characteristics of user information, payment behavior and account association, establishing an electricity fee anti-money laundering fraud scoring early warning mechanism, and judging whether the user has abnormal payment behavior according to the score. The module is used to realize the function of monitoring and identifying money laundering fraud behaviors in embodiment one, and will not be described here.

[0063] The user small amount payment behavior monitoring and identifying module is used for classifying small amount abnormal payment behaviors into internal employee performance evaluation behaviors, channel earning commission behaviors and preferential activity abnormal participation behaviors according to causes, establishing a small amount payment abnormal early warning mechanism, and judging the possibility of user abnormal payment behavior. The module is used to realize the function of monitoring and identifying user small amount payment behavior in embodiment one, and will not be described here.

[0064] Embodiment three

[0065] The embodiment provides an electronic device, which comprises a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor realizes the identification and early warning method of the electricity fee channel payment abnormal behavior according to any embodiment of the application when executing the computer program.

[0066] Embodiment four

[0067] The embodiment provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to realize the identification and early warning method of the electricity fee channel payment abnormal behavior according to any embodiment of the application.

[0068] In the embodiment of the application, "at least one" means one or more, and "multiple" means two or more. The "and / or" describes the association relationship of the associated objects, which means that there can be three relationships, for example, A and / or B, which means that A exists alone, A and B exist together, and B exists alone. Wherein A and B can be singular or plural. The character " / " generally represents an "or" relationship between the associated objects before and after it. "At least one of the following" and similar expressions mean any combination of these items, including any combination of single or multiple items. For example, at least one of a, b and c can mean a, b, c, a and b, a and c, b and c, or a and b and c, wherein a, b and c can be single or multiple.

[0069] Those skilled in the art can clearly understand that the units and algorithm steps described in the embodiments disclosed herein can be realized by electronic hardware, computer software and a combination of the two. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0070] Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working processes of the above-described system, device and unit can refer to the corresponding processes in the foregoing method embodiments, which will not be described here.

[0071] In several embodiments provided in the present application, any function realized in the form of a software function unit and sold or used as an independent product can be stored in a computer-readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the parts that make contributions to the prior art or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0072] The above is only an embodiment of the present application, and does not limit the patent scope of the present application. Any equivalent structure or equivalent flow transformation, or direct or indirect application in other related technical fields, is also included in the patent protection scope of the present application.

Claims

1. A method for identifying and warning abnormal behavior in electricity bill payment channels, characterized in that: The following steps are involved: The identification and warning of abnormal electricity bill payment behavior are divided into two categories: active transfer behavior and channel payment behavior; The monitoring and identification of active transfer behavior is as follows: for active transfer electricity fee business, the accuracy and compliance of active transfer business can be controlled by setting business verification rules; The monitoring and identification of money laundering and fraud in electricity bill payment channels involves: analyzing the current status of money laundering and fraud, summarizing the characteristics of money laundering and fraud, analyzing and scoring user information characteristics, payment behavior characteristics, and account association characteristics, establishing an electricity bill anti-fraud scoring and early warning mechanism, and judging the possibility of users engaging in abnormal payment behavior based on the scores; The monitoring and identification of users' small-amount payment behaviors in channel payment behaviors are as follows: abnormal small-amount payment behaviors are classified into internal employee performance appraisal behaviors, channel commission earning behaviors, and abnormal participation in promotional activities according to the causes. An abnormal small-amount payment warning mechanism is established to determine whether users have abnormal payment behaviors; Analyzing and assigning points to the user information characteristics specifically includes: assigning points based on whether the four elements of the user information characteristics of the fund account are complete and whether the bank card number and mobile phone number of the fund account are valid. The four elements of the fund account include the bank card number, the opening bank, the account name, and the mobile phone number information; Analyzing and assigning points to the payment behavior characteristics specifically includes: assigning points to the behavior characteristics of the number of electricity bill account payments, the behavior characteristics of the amount of electricity bill account payments, the behavior characteristics of the number of capital accounts associated with the electricity bill account, the behavior characteristics of the number of capital account payments, the behavior characteristics of the amount of capital account payments, and the behavior characteristics of the number of electricity bill accounts associated with the capital account according to a set data range; Analyzing and assigning scores to the account association characteristics specifically includes: categorizing the account association characteristics into the degree of association with users confirmed to be involved in money laundering or fraud, the degree of association with users suspected to be involved in money laundering or fraud, and the proportion of first-time established associations, and assigning scores based on the set data range; The monitoring and identification of money laundering fraud in channel payment behavior also includes pre-processing the score data obtained according to the electricity bill anti-washing and anti-fraud scoring warning mechanism, dividing it into a training set and a test set, establishing an electricity bill anti-washing and anti-fraud scoring observation model to fit the training set data to obtain the optimal model parameters, and using the test set data to input the electricity bill anti-washing and anti-fraud scoring observation model to obtain the observation score of the electricity bill anti-washing and anti-fraud scoring warning mechanism, and adjusting the data range set by the existing electricity bill anti-washing and anti-fraud scoring warning mechanism according to the observation score. The electricity bill anti-washing and anti-fraud scoring warning adjustment model is specifically as follows: Where, for The observation score at the time, is the autoregressive order, is the autoregressive coefficient, for Score data at the moment, is a normally distributed white noise sequence.

2. The method for identifying and warning abnormal behavior of electricity bill payment channels according to claim 1 is characterized in that: The specific verification rules set for the performance appraisal behavior of internal employees are as follows: if the channel account is consistent with the mobile phone number registered by the internal employee and the monthly channel account payment times exceed the set times threshold, the monthly channel account payment times exceed the set times threshold and the channel account payment amount is lower than the set amount threshold, the electricity account is consistent with the ID card number registered by the internal employee and the monthly channel account payment times exceed the set times threshold, the number of payments made by a single channel account to different electricity accounts within a month exceeds the set number threshold and the channel account is a credit account, the internal employee performance appraisal behavior that meets any of the above conditions will be determined as abnormal payment behavior for the internal employee performance appraisal behavior; The verification rules for channel fee earning behavior are as follows: if the single payment amount is lower than the cost threshold and the weekly payment behavior with the payment amount lower than the cost threshold exceeds the set number threshold, it will be determined as abnormal payment behavior for channel fee earning behavior; The specific verification rules for abnormal participation in promotional activities are as follows: if the same payment participates in a promotional activity and meets any of the following conditions: the electricity bill account has participated in the same promotional activity, the electricity bill account has participated in other promotional activities within the set time range, the channel account has participated in the same promotional activity, and the channel user has participated in other promotional activities within the set time range, then it will be determined as an abnormal payment behavior of abnormal participation in the promotional activity.

3. A recognition and early warning system for abnormal payment behavior in electricity bill channels, characterized in that: The system is used to implement the identification and early warning method for abnormal payment behavior of electricity bill channels according to any one of claims 1 to 2, including an active transfer business monitoring and identification module, a money laundering fraud behavior monitoring and identification module, and a user small payment behavior monitoring and identification module; The active transfer business monitoring and identification module is used to control the accuracy and compliance of active transfer business by setting business verification rules for active transfer electricity fee business; The money laundering and fraud monitoring and identification module is used to analyze the current status of money laundering and fraud, summarize the characteristics of money laundering and fraud, analyze and score user information characteristics, payment behavior characteristics, and account association characteristics, establish an electricity bill anti-fraud scoring and early warning mechanism, and determine the possibility of abnormal user payment behavior based on the score; The user small payment behavior monitoring and identification module is used to classify small abnormal payment behaviors into internal employee performance appraisal behaviors, channel fee earning behaviors, and abnormal participation in promotional activities according to the causes, establish a small payment abnormality early warning mechanism, and determine whether the user has abnormal payment behavior.

4. The identification and early warning system for abnormal payment behavior of electricity bill channels according to claim 3 is characterized in that: The money laundering fraud monitoring and identification module analyzes and assigns points to the user information features, specifically including: grading and assigning points based on whether the four elements of the user information features of the fund account are complete and whether the bank card number and mobile phone number of the fund account are valid; the four elements of the fund account include the bank card number, the opening bank, the account name, and the mobile phone number; Analyzing and assigning points to the payment behavior characteristics specifically includes: assigning points to the behavior characteristics of the number of electricity bill account payments, the behavior characteristics of the amount of electricity bill account payments, the behavior characteristics of the number of capital accounts associated with the electricity bill account, the behavior characteristics of the number of capital account payments, the behavior characteristics of the amount of capital account payments, and the behavior characteristics of the number of electricity bill accounts associated with the capital account according to a set data range; The analysis and scoring of the account association relationship characteristics specifically include: dividing the account association relationship characteristics into the degree of association with users confirmed to be involved in money laundering and fraud, the degree of association with users suspected to be involved in money laundering and fraud, and the proportion of first-time association relationships, and grading and scoring according to the set data range.

5. The identification and early warning system for abnormal payment behavior of electricity bill channels according to claim 3 is characterized in that: The user small payment behavior monitoring and identification module sets verification rules for the internal employee performance appraisal behavior as follows: if the channel account is consistent with the mobile phone number registered by the internal employee and the monthly channel account payment frequency exceeds the set frequency threshold, the monthly channel account payment frequency exceeds the set frequency threshold and the channel account payment amount is lower than the set amount threshold, the electricity account is consistent with the ID card number registered by the internal employee and the monthly channel account payment frequency exceeds the set frequency threshold, the number of payments from a single channel account to different electricity accounts within a month exceeds the set frequency threshold and the channel account is a credit account, the internal employee performance appraisal behavior that meets any of the above conditions will be judged as abnormal payment behavior for the internal employee performance appraisal behavior; The verification rules for channel fee earning behavior are as follows: if the single payment amount is lower than the cost threshold and the weekly payment behavior with the payment amount lower than the cost threshold exceeds the set number threshold, it will be determined as abnormal payment behavior for channel fee earning behavior; The specific verification rules for abnormal participation in promotional activities are as follows: if the same payment participates in a promotional activity and meets any of the following conditions: the electricity bill account has participated in the same promotional activity, the electricity bill account has participated in other promotional activities within the set time range, the channel account has participated in the same promotional activity, and the channel user has participated in other promotional activities within the set time range, then it will be determined as an abnormal payment behavior of abnormal participation in the promotional activity.

6. The identification and early warning system for abnormal payment behavior of electricity bill channels according to claim 3 is characterized in that: The money laundering fraud behavior monitoring and identification module is also used to pre-process the score data obtained according to the electricity bill anti-washing and anti-fraud scoring warning mechanism, and divide it into a training set and a test set, establish an electricity bill anti-washing and anti-fraud scoring observation model to fit the training set data to obtain the optimal model parameters, and use the test set data to input the electricity bill anti-washing and anti-fraud scoring observation model to obtain the observation score of the electricity bill anti-washing and anti-fraud scoring warning mechanism, and adjust the data range set by the existing electricity bill anti-washing and anti-fraud scoring warning mechanism according to the observation score. The electricity bill anti-washing and anti-fraud scoring warning adjustment model is specifically as follows: Where, for The observation score at the time, is the autoregressive order, is the autoregressive coefficient, for Score data at the moment, is a normally distributed white noise sequence.

7. An electronic device, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the method for identifying and warning of abnormal behavior in electricity bill payment channels as described in any one of claims 1 to 2 is implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, a method for identifying and warning of abnormal behavior in electricity bill payment channels according to any one of claims 1 to 2 is implemented.

Images