Abnormal account identification method and related device

Abstract

The invention discloses an abnormal account identification method and a related device, and is applied to the field of artificial intelligence or finance. Obtaining a to-be-identified target account; obtaining a first number of transactions between the target account and the first account; obtaining a second transaction frequency of the abnormal access transaction executed by the target account; obtaining a third transaction frequency of the cross-provincial transaction executed by the target account; obtaining a fourth transaction frequency of the cash withdrawal abnormal transaction executed by the target account; obtaining a fifth transaction number of times of case-related account transactions executed by the target account; obtaining a first address number of IP addresses of devices logging in the target account within a fifth preset duration; acquiring a second address number of IP addresses of equipment logging in the target account within a fifth preset time length, wherein the IP addresses belong to the preset high-risk region; acquiring special transaction information corresponding to the target account; and inputting the obtained information into a pre-constructed abnormal account identification model to obtain a detection result. And manual troubleshooting is not needed, so that the troubleshooting efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to an abnormal account identification method and related devices. Background Art

[0002] In recent years, the screening of abnormal accounts suspected of fraud risks has been based on manual screening, resulting in low screening efficiency. Summary of the invention

[0003] In view of the above problems, the present application provides an abnormal account identification method and related devices to achieve the purpose of improving the ability to check whether an account is an abnormal account. The specific solution is as follows:

[0004] The first aspect of the present application provides a method for identifying abnormal accounts, comprising:

[0005] Obtain the target account to be identified;

[0006] Obtaining a first transaction number between the target account and a first account, wherein the first account is a long-term no-active-transaction account or a stopped payroll account, whose daily outflow amount is greater than or equal to a first preset threshold, whose daily transaction amount through non-counter transaction channels is greater than or equal to a second preset threshold, whose outflow amount within a first preset time period is greater than or equal to a third preset threshold, and whose transaction amount through non-counter transaction channels within the first preset time period is greater than or equal to a fourth preset threshold;

[0007] Acquire a second transaction number of abnormal deposit and access transactions executed by the target account, wherein the abnormal deposit and access transaction refers to a transaction in which cash with the target serial number is deposited into a second account again within a second preset time period after cash with the target serial number is withdrawn from the target account;

[0008] Obtaining a third transaction number of inter-provincial transactions executed by the target account, wherein the inter-provincial transactions include at least one third account performing a transfer transaction to the target account through a counter transaction channel greater than or equal to a fifth preset threshold within a third preset time period, or at least one fourth account performing a transfer transaction to the target account through an automatic teller machine (ATM) channel within the third preset time period with a transaction amount greater than or equal to a sixth preset threshold; the third account and the target account belong to different provinces, and the fourth account and the target account belong to different provinces;

[0009] Obtaining a fourth transaction number of abnormal cash withdrawal transactions executed by the target account, wherein the abnormal cash withdrawal transaction refers to a transaction in which cash is withdrawn from the target account for a preset multiple of the transaction amount within a fourth preset time period after the target account receives the transaction amount transferred from the fifth account, the preset multiple is within a preset interval, and the fifth account and the target account belong to different regions;

[0010] Obtaining a fifth transaction number of the involved account transactions executed by the target account, wherein the involved account transactions refer to transactions in which, after a sixth account that has been determined to be an abnormal account transfers a transaction amount to the target account, the balance of the sixth account is less than or equal to a seventh preset threshold;

[0011] Obtaining a first number of Internet Protocol addresses (IP addresses) of devices that log into the target account within a fifth preset time period;

[0012] Obtain the number of second addresses whose IP addresses of devices that log into the target account within the fifth preset time period belong to preset high-risk areas;

[0013] Acquiring special transaction information corresponding to the target account, the special transaction information including a sixth transaction number of executed counterparty concentrated transactions, wherein the counterparty concentrated transactions refer to the target account performing transfer transactions to one or two seventh accounts exceeding an eighth preset threshold number of times within a sixth preset time period, or the transfer transactions to the target account from one or two eighth accounts exceeding a ninth preset threshold number of times within the sixth preset time period;

[0014] Inputting the first transaction number, the second transaction number, the third transaction number, the fourth transaction number, the fifth transaction number, the first address number, the second address number, and the special transaction information into a pre-built abnormal account identification model; obtaining a detection result of the target account through the abnormal account identification model, the detection result being that the target account is an abnormal account or that the target account is not an abnormal account;

[0015] Among them, the abnormal account identification model takes the number of transactions between the sample account and the first account, the number of transactions that the sample account has executed the abnormal deposit and access transactions, the number of transactions that the sample account has executed the inter-provincial transactions, the number of transactions that the sample account has executed the abnormal cash withdrawal transactions, the number of transactions that the sample account has executed the account involved in the case, the number of IP addresses of the devices that logged into the sample account within the fifth preset time period, the number of addresses of the IP addresses of the devices that logged into the sample account within the fifth preset time period that belong to the preset high-risk areas, and the special transaction information corresponding to the sample account as input, and takes the labeling results of the sample accounts as training targets, and the labeling results obtained through training are that the sample account is an abnormal account or the sample account is not an abnormal account.

[0016] In a possible implementation, the special transaction information further includes:

[0017] The target account has executed the seventh transaction number of the first sensitive transaction, the first sensitive transaction being a transaction in which the total amount of transfers from the target account to the ninth account within the seventh preset time period is greater than or equal to the tenth preset threshold value, the number of transfers from the target account to the ninth account within the seventh preset time period is greater than or equal to the eleventh preset threshold value, and the transfer amount is an integer multiple of 10, and the account name of the ninth account is the name of an enterprise representing living expenses in a different province from that of the target account; and / or,

[0018] The target account has executed an eighth transaction number of a second sensitive transaction, wherein the second sensitive transaction refers to a transfer transaction from the target account to the tenth account greater than or equal to a twelfth preset threshold number of times within a single day, and the account name of the tenth account includes at least one keyword of loan, finance, and money; and / or,

[0019] whether the target account has executed a third sensitive transaction, wherein the target account has executed zero transactions within an eighth preset time period, and only a number of transfer transactions greater than or equal to a thirteenth preset threshold value is executed to the donation institution account within a ninth preset time period, and the amount of transfer to the donation institution account is less than or equal to a fourteenth preset threshold value, and the time corresponding to the eighth preset time period is earlier than the time corresponding to the ninth preset time period, and the time corresponding to the eighth preset time period is adjacent to the time corresponding to the ninth preset time period; and / or,

[0020] When the age of the customer of the target account is less than or equal to the preset age and the target account is a non-loan account, the target account has executed the ninth transaction number of frequent abnormal cash withdrawal transactions, and the frequent abnormal cash withdrawal transactions refer to cash withdrawal transactions executed from the target account greater than or equal to the fifteenth preset threshold number within the tenth preset time period, and different cash withdrawal transactions correspond to different ATM bank branches.

[0021] In a possible implementation, the method for determining the preset interval includes:

[0022] Acquire a first amount and a first transaction time of an abnormal withdrawal transaction of an abnormal account, wherein the abnormal withdrawal transaction refers to a transaction of withdrawing cash from the abnormal account within the second preset time period after the fifth account transfers the transaction amount to the abnormal account;

[0023] Acquire a second amount and a second transaction time of an abnormal payment collection transaction, wherein the abnormal payment collection transaction is a payment collection transaction in which the abnormal account receives an amount transferred from the fifth account;

[0024] Acquire multiple sets of abnormal transaction sets, wherein the abnormal transaction sets include one abnormal withdrawal transaction and one abnormal collection transaction, the first transaction time of the abnormal withdrawal transactions in the same abnormal transaction set is later than the second transaction time of the abnormal collection transaction, and there is no abnormal withdrawal transaction and no abnormal collection transaction between the first transaction time and the second transaction time;

[0025] Acquire a plurality of groups of sample points corresponding to the abnormal transaction sets, wherein the sample points corresponding to the abnormal transaction sets are ratios of the first amount of the abnormal withdrawal transactions in the abnormal transaction sets to the second amount of the abnormal receipt transactions in the abnormal transaction sets;

[0026] Determine a first number of clusters to be divided and initial center points corresponding to the first number of clusters respectively;

[0027] For each of the sample points, obtaining an absolute value of a difference between the sample point and the initial center points corresponding to the first number of clusters; dividing the sample points into clusters corresponding to the initial center points corresponding to the smallest absolute value of the difference, so as to obtain the first number of clusters;

[0028] For each cluster, determine the mean of the sample points included in the cluster as the updated center point of the cluster;

[0029] For each of the sample points, obtain the absolute value of the difference between the sample point and the update center points corresponding to the first number of clusters; divide the sample points into clusters corresponding to the update center points corresponding to the smallest absolute value of the difference to obtain the first number of clusters, return to the step for each cluster, determine the mean of the sample points included in the cluster as the update center point of the cluster, until the update center points corresponding to the first number of clusters are no longer changing;

[0030] The preset interval is determined based on the first number of clusters.

[0031] In a possible implementation, the preset interval is [0.8, 1.2].

[0032] In a possible implementation, the method further includes:

[0033] Obtaining multiple candidate attribute features of the sample account;

[0034] Acquire a plurality of linearly independent pending attribute features from the plurality of candidate attribute features;

[0035] Obtaining importance values ​​corresponding to the plurality of pending attribute features, respectively, where the importance values ​​of the pending attribute features represent the extent to which the pending attribute features affect whether the sample account is an abnormal account;

[0036] Acquire a plurality of attribute features whose importance values ​​are greater than or equal to a twentieth preset threshold value from the plurality of undetermined attribute features;

[0037] Among them, the multiple attribute characteristics include: the number of transactions with the first account, the number of transactions of the abnormal deposit and access transactions, the number of transactions of the inter-provincial transactions, the number of transactions of the abnormal cash withdrawal transactions, the number of transactions of the account involved in the case, the number of IP addresses of the devices that logged into the sample account within the fifth preset time period, the number of second addresses of the devices that logged into the sample account within the fifth preset time period whose IP addresses belong to the preset high-risk areas, and the special transaction information corresponding to the sample account.

[0038] A second aspect of the present application provides an abnormal account identification device, comprising:

[0039] A first acquisition module, used to acquire a target account to be identified;

[0040] The second acquisition module is used to acquire the first transaction number between the target account and the first account, the first account being a long-term no active transaction account or a stopped payroll account, whose daily transfer amount is greater than or equal to a first preset threshold, whose daily transaction amount through non-counter transaction channels is greater than or equal to a second preset threshold, whose transfer amount within a first preset time period is greater than or equal to a third preset threshold, and whose transaction amount through non-counter transaction channels within the first preset time period is greater than or equal to a fourth preset threshold;

[0041] a third acquisition module, configured to acquire a second transaction number of abnormal deposit and access transactions executed by the target account, wherein the abnormal deposit and access transaction refers to a transaction in which cash with the target serial number is deposited into a second account again within a second preset time period after cash with the target serial number is withdrawn from the target account;

[0042] a fourth acquisition module, configured to acquire a third transaction number of inter-provincial transactions executed by the target account, wherein the inter-provincial transactions include at least one third account performing a transfer transaction to the target account through an over-the-counter transaction channel greater than or equal to a fifth preset threshold number of times within a third preset time period, or at least one fourth account performing a transfer transaction to the target account through an ATM channel within the third preset time period with a transaction amount greater than or equal to a sixth preset threshold number; the third account and the target account belong to different provinces, and the fourth account and the target account belong to different provinces;

[0043] a fifth acquisition module, configured to acquire a fourth transaction number of abnormal cash withdrawal transactions executed by the target account, wherein the abnormal cash withdrawal transaction refers to a transaction in which cash is withdrawn from the target account for a preset multiple of the transaction amount within a fourth preset time period after the target account receives the transaction amount transferred from the fifth account, the preset multiple belongs to a preset interval, and the fifth account and the target account belong to different regions;

[0044] a sixth acquisition module, configured to acquire a fifth transaction number of the involved account transactions executed by the target account, wherein the involved account transactions refer to transactions in which, after a sixth account that has been determined to be an abnormal account transfers a transaction amount to the target account, the balance of the sixth account is less than or equal to a seventh preset threshold;

[0045] A seventh acquisition module, configured to acquire a first number of Internet Protocol addresses (IP addresses) of devices that log into the target account within a fifth preset time period;

[0046] An eighth acquisition module, configured to acquire the number of second addresses of which the IP addresses of the devices that log into the target account within the fifth preset time period belong to the preset high-risk areas;

[0047] a ninth acquisition module, configured to acquire special transaction information corresponding to the target account, wherein the special transaction information includes a sixth transaction number of executed counterparty concentrated transactions, wherein the counterparty concentrated transactions refer to the target account performing transfer transactions to one or two seventh accounts exceeding an eighth preset threshold number of times within a sixth preset time period, or the target account performing transfer transactions to one or two eighth accounts exceeding a ninth preset threshold number of times within the sixth preset time period;

[0048] a tenth acquisition module, configured to input the first transaction number, the second transaction number, the third transaction number, the fourth transaction number, the fifth transaction number, the first address number, the second address number, and the special transaction information into a pre-built abnormal account identification model; and obtain a detection result of the target account through the abnormal account identification model, wherein the detection result is that the target account is an abnormal account or the target account is not an abnormal account;

[0049] Among them, the abnormal account identification model takes the number of transactions between the sample account and the first account, the number of transactions that the sample account has executed the abnormal deposit and access transactions, the number of transactions that the sample account has executed the inter-provincial transactions, the number of transactions that the sample account has executed the abnormal cash withdrawal transactions, the number of transactions that the sample account has executed the account involved in the case, the number of IP addresses of the devices that logged into the sample account within the fifth preset time period, the number of addresses of the IP addresses of the devices that logged into the sample account within the fifth preset time period that belong to the preset high-risk areas, and the special transaction information corresponding to the sample account as input, and takes the labeling results of the sample accounts as training targets, and the labeling results obtained through training are that the sample account is an abnormal account or the sample account is not an abnormal account.

[0050] In a possible implementation, the method further includes:

[0051] an eleventh obtaining module, configured to obtain a first amount and a first transaction time of an abnormal withdrawal transaction of an abnormal account, wherein the abnormal withdrawal transaction refers to a transaction of withdrawing cash from the abnormal account within the second preset time period after the fifth account transfers the transaction amount to the abnormal account;

[0052] A twelfth acquisition module is used to acquire a second amount and a second transaction time of an abnormal payment collection transaction, wherein the abnormal payment collection transaction is a payment collection transaction in which the abnormal account receives an amount transferred from the fifth account;

[0053] A thirteenth acquisition module is used to acquire multiple groups of abnormal transaction sets, wherein the abnormal transaction set includes one abnormal withdrawal transaction and one abnormal collection transaction, the first transaction time of the abnormal withdrawal transactions in the same abnormal transaction set is later than the second transaction time of the abnormal collection transaction, and there is no abnormal withdrawal transaction and abnormal collection transaction between the first transaction time and the second transaction time;

[0054] A fourteenth acquisition module is used to acquire a plurality of sample points corresponding to the abnormal transaction sets, wherein the sample points corresponding to the abnormal transaction sets are ratios of the first amount of the abnormal withdrawal transactions in the abnormal transaction sets to the second amount of the abnormal receipt transactions in the abnormal transaction sets;

[0055] A first determining module, used to determine a first number of clusters to be divided and initial center points corresponding to the first number of clusters respectively;

[0056] A fifteenth acquisition module is used to acquire, for each of the sample points, an absolute value of a difference between the sample point and the initial center points corresponding to the first number of clusters; and divide the sample points into clusters corresponding to the initial center points corresponding to the smallest absolute value of the difference, so as to obtain the first number of clusters;

[0057] A second determination module is used to determine, for each cluster, a mean value of sample points included in the cluster as an updated center point of the cluster;

[0058] A sixteenth acquisition module is configured to acquire, for each of the sample points, an absolute value of a difference between the sample point and the update center points respectively corresponding to the first number of clusters; divide the sample points into clusters corresponding to the update center points corresponding to the smallest absolute value of the difference to obtain the first number of clusters, and trigger the second determination module until the update center points respectively corresponding to the first number of clusters no longer change;

[0059] The third determining module is configured to determine the preset interval based on the first number of clusters.

[0060] The third aspect of the present application provides a computer program product, including computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements the abnormal account identification method of the first aspect or any implementation of the first aspect.

[0061] A fourth aspect of the present application provides an electronic device, comprising at least one processor and a memory connected to the processor, wherein:

[0062] The memory is used to store computer programs;

[0063] The processor is used to execute the computer program so that the electronic device can implement the abnormal account identification method of the above-mentioned first aspect or any implementation method of the first aspect.

[0064] A fifth aspect of the present application provides a computer storage medium, which carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement the abnormal account identification method of the first aspect or any implementation of the first aspect.

[0065] By means of the above technical solution, the present application provides an abnormal account identification method, which obtains the target account to be identified; obtains the first transaction number between the target account and the first account; obtains the second transaction number of abnormal deposit and access transactions executed by the target account; obtains the third transaction number of cross-provincial transactions executed by the target account; obtains the fourth transaction number of abnormal cash withdrawal transactions executed by the target account; obtains the fifth transaction number of transactions of the account involved in the case executed by the target account; obtains the first address number of the IP address of the device that logs into the target account within the fifth preset time period; obtains the second address number of the IP address of the device that logs into the target account within the fifth preset time period that belongs to the preset high-risk area; obtains the special transaction information corresponding to the target account; inputs the above information obtained into the pre-built abnormal account identification model; obtains the detection result of the target account through the abnormal account identification model. There is no need to manually check whether the target account is an abnormal account, which improves the efficiency of investigation. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0067] Figure 1 A schematic diagram of a system architecture provided for this application;

[0068] Figure 2 A schematic diagram of an optional hardware structure of a terminal 100 provided in this application;

[0069] Figure 3 A schematic diagram of the structure of a server 200 provided in this application;

[0070] Figure 4 A flowchart of an abnormal account identification method provided for this application;

[0071] Figure 5 A schematic diagram of clustering of multiple sample points on a two-dimensional plane provided in this application;

[0072] Figure 6 A schematic diagram of clustering of multiple sample points on a one-dimensional plane provided in this application;

[0073] Figure 7 A schematic diagram of the structure of an abnormal account identification device provided by this application;

[0074] Figure 8 A schematic diagram of the structure of an electronic device provided in this application. DETAILED DESCRIPTION

[0075] The following describes the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. The terms used in the implementation method section of the present application are only used to explain the specific embodiments of the present application, and are not intended to limit the present application.

[0076] The embodiments of the present application are described below in conjunction with the accompanying drawings. Those skilled in the art will appreciate that, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0077] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, which is only to describe the distinction mode adopted by the objects of the same attributes when describing in the embodiments of the present application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0078] See also Figure 1 , Figure 1 1 shows a schematic diagram of a system architecture. The system may include a terminal 100 and a server 200. The server 200 may include one or more servers ( Figure 1 In the example, a server is included, and the server 200 can provide the method provided in the embodiment of the present application for one or more terminals.

[0079] Among them, an application can be installed on the terminal 100, and the above application can provide an interface. The terminal 100 can receive the target account entered on the interface and send the above target account to the server 200. The server 200 can obtain processing results, such as detection results, based on the received target account, and return the processing results to the terminal 100.

[0080] Exemplarily, the terminal 100 may be a terminal held by a teller at a bank branch, or a self-service device at a bank branch, or the terminal 100 may be a device held by a customer of the bank.

[0081] It should be understood that in some optional implementations, the terminal 100 can also complete the action of obtaining the processing result based on the received target account by itself without the cooperation of the server, and the embodiments of the present application are not limited thereto.

[0082] Next describe Figure 1 The product form of the mid-terminal 100;

[0083] The terminal 100 in the embodiment of the present application can be a mobile phone, a tablet computer, a wearable device, a vehicle-mounted device, an augmented reality (AR) / virtual reality (VR) device, a laptop computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), etc., and the embodiment of the present application does not impose any restrictions on this.

[0084] Figure 2 An optional hardware structure diagram of the terminal 100 is shown.

[0085] refer to Figure 2 As shown, the terminal 100 may include a radio frequency unit 110, a memory 120, an input unit 130, a display unit 140, a camera 150 (optional), an audio circuit 160 (optional), a speaker 161 (optional), a microphone 162 (optional), an earphone jack 163 (optional), a processor 170, an external interface 180, a power supply 190 and other components. Those skilled in the art will appreciate that Figure 2 This is merely an example of a terminal and does not constitute a limitation on the terminal. The terminal may include more or fewer components than shown in the figure, or a combination of certain components, or different components.

[0086] The input unit 130 can be used to receive input digital or character information, and generate key signal input related to the user settings and function control of the terminal. Specifically, the input unit 130 may include a touch screen 131 (optional) and / or other input devices 132. The touch screen 131 can collect the user's touch operations on or near it (such as the user's operation on or near the touch screen using any suitable object such as fingers, joints, stylus, etc.), and drive the corresponding connection device according to a pre-set program. The touch screen can detect the user's touch action on the touch screen, convert the touch action into a touch signal and send it to the processor 170, and can receive and execute the command sent by the processor 170; the touch signal at least includes the touch point coordinate information. The touch screen 131 can provide an input interface and an output interface between the terminal 100 and the user. In addition, the touch screen can be implemented using multiple types such as resistive, capacitive, infrared and surface acoustic wave. In addition to the touch screen 131, the input unit 130 can also include other input devices. Specifically, other input devices 132 may include, but are not limited to, one or more of a physical keyboard, function keys (such as a volume control key, a switch key, etc.), a trackball, a mouse, a joystick, and the like.

[0087] Among them, the input device 132 can receive input data and the like.

[0088] The display unit 140 may be used to display information input by the user or provided to the user, various menus of the terminal 100, interactive interfaces, file displays, and / or playback of any multimedia file. In an embodiment of the present application, the display unit 140 may be used to display an interface for obtaining a target account, processing results, and the like.

[0089] The memory 120 can be used to store instructions and data. The memory 120 can mainly include an instruction storage area and a data storage area. The data storage area can store various data, such as multimedia files, texts, etc.; the instruction storage area can store software units such as operating systems, applications, instructions required for at least one function, or their subsets and extensions. It can also include a non-volatile random access memory; provide the processor 170 with hardware, software and data resources including management of computing and processing equipment, and support control software and applications. It is also used for the storage of multimedia files, and the storage of running programs and applications.

[0090] The processor 170 is the control center of the terminal 100. It uses various interfaces and lines to connect various parts of the entire terminal 100. By running or executing instructions stored in the memory 120 and calling data stored in the memory 120, it executes various functions of the terminal 100 and processes data, thereby controlling the terminal device as a whole. Optionally, the processor 170 may include one or more processing units; preferably, the processor 170 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface and application program, and the modem processor mainly processes wireless communication. It is understandable that the above-mentioned modem processor may not be integrated into the processor 170. In some embodiments, the processor and the memory may be implemented on a single chip, and in some embodiments, they may also be implemented separately on separate chips. The processor 170 may also be used to generate corresponding operation control signals, send them to corresponding components of the computing and processing device, read and process data in the software, especially read and process data and programs in the memory 120, so that each functional module therein performs corresponding functions, thereby controlling the corresponding components to act according to the requirements of the instructions.

[0091] Among them, the memory 120 can be used to store software codes related to the abnormal account identification method, the processor 170 can execute the steps of the abnormal account identification method, and can also schedule other units (such as the above-mentioned input unit 130 and display unit 140) to implement corresponding functions.

[0092] The radio frequency unit 110 (optional) can be used for receiving and sending information or receiving and sending signals during a call, for example, after receiving the downlink information of the base station, it is sent to the processor 170 for processing; in addition, the designed uplink data is sent to the base station. Generally, the RF circuit includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier (Low Noise Amplifier, LNA), a duplexer, etc. In addition, the radio frequency unit 110 can also communicate with network devices and other devices through wireless communication. The wireless communication can use any communication standard or protocol, including but not limited to Global System of Mobile communication (Global System of Mobile communication, GSM), General Packet Radio Service (General Packet Radio Service, GPRS), Code Division Multiple Access (Code Division Multiple Access, CDMA), Wideband Code Division Multiple Access (Wideband Code Division Multiple Access, WCDMA), Long Term Evolution (Long Term Evolution, LTE), email, Short Messaging Service (SMS), etc.

[0093] In this embodiment of the present application, the RF unit 110 can send data to the server 200 and receive processing results sent by the server 200.

[0094] It should be understood that the radio frequency unit 110 is optional and can be replaced by other communication interfaces, such as a network port.

[0095] The terminal 100 also includes a power supply 190 (such as a battery) for supplying power to various components. Preferably, the power supply can be logically connected to the processor 170 through a power management system, so that the power management system can manage functions such as charging, discharging, and power consumption.

[0096] The terminal 100 further includes an external interface 180 , which may be a standard Micro USB interface or a multi-pin connector, and may be used to connect the terminal 100 to communicate with other devices, or to connect a charger to charge the terminal 100 .

[0097] Although not shown, the terminal 100 may also include a flashlight, a wireless fidelity (WiFi) module, a Bluetooth module, sensors with different functions, etc., which are not described in detail here. Some or all of the methods described below may be applied in the following embodiments. Figure 2 In the terminal 100 shown.

[0098] Next describe Figure 1 The product form of the server 200;

[0099] Figure 3 A structural diagram of a server 200 is provided, such as Figure 3 As shown, the server 200 includes a bus 201, a processor 202, a communication interface 203, and a memory 204. The processor 202, the memory 204, and the communication interface 203 communicate with each other via the bus 201.

[0100] The bus 201 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0101] The processor 202 may be any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0102] The memory 204 may include a volatile memory, such as a random access memory (RAM). The memory 204 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard drive (HDD), or a solid state drive (SSD).

[0103] The memory 204 may be used to store software codes related to the abnormal account identification method, the processor 202 may execute the steps of the abnormal account identification method of the chip, and may also schedule other units to implement corresponding functions.

[0104] It should be understood that the above-mentioned terminal 100 and server 200 can be centralized or distributed devices, and the processors in the above-mentioned terminal 100 and server 200 (such as processor 170 and processor 202) can be hardware circuits (such as application specific integrated circuit (ASIC), field-programmable gate array (FPGA), general-purpose processor, digital signal processor (DSP), microprocessor or microcontroller, etc.), or a combination of these hardware circuits. For example, the processor can be a hardware system with an instruction execution function, such as a CPU, DSP, etc., or a hardware system without an instruction execution function, such as an ASIC, FPGA, etc., or a combination of the above-mentioned hardware systems without an instruction execution function and hardware systems with an instruction execution function.

[0105] Reference Figure 4 , Figure 4 A flowchart of an abnormal account identification method provided in an embodiment of the present application is shown in FIG. Figure 4 As shown, an abnormal account identification method provided by an embodiment of the present application may include steps 401 to 410, and these steps are described in detail below.

[0106] Step 401: Obtain the target account to be identified.

[0107] For example, it is possible to identify whether an account is an abnormal account at a set time interval. In the embodiment of the present application, each account to be identified is referred to as a target account.

[0108] Exemplarily, suspected abnormal accounts and non-suspected abnormal accounts may be determined based on historical transaction information of the accounts. Exemplarily, the suspected abnormal accounts are target accounts.

[0109] Step 402: Obtain the first transaction number between the target account and the first account.

[0110] The first account is a long-term inactive transaction account or a stopped payroll account, whose daily transfer amount is greater than or equal to a first preset threshold, whose daily transaction amount through non-counter transaction channels is greater than or equal to a second preset threshold, whose transfer amount within a first preset time period is greater than or equal to a third preset threshold, and whose transaction amount through non-counter transaction channels within the first preset time period is greater than or equal to a fourth preset threshold.

[0111] Exemplarily, the first preset threshold, the second preset threshold, the third preset threshold, the first preset duration and the fourth preset threshold may be determined based on actual conditions and are not limited here.

[0112] The following is an explanation of accounts that have had no active transactions for a long time or accounts that have stopped paying payroll.

[0113] After a customer opens a bank card, he or she may no longer use the bank card after a period of time. For example, after a customer joins a company, he or she needs a bank card from XX Bank to receive salary, so he or she opens a bank card from XX Bank. However, after one year, the customer leaves the company and no longer uses bank card A and has not used bank card A for a long time. The account corresponding to bank card A is an account with no active transactions or a stopped payroll account. Fund transfer personnel may acquire accounts with no active transactions or stopped payroll accounts, and use these accounts to transfer funds.

[0114] The transaction situation of the long-term inactive transaction account or the account that has stopped payroll payment after the transfer funds are acquired by the fund transfer personnel is very different from the normal transaction situation of the long-term inactive transaction account or the account that has stopped payroll payment. In general, since customers do not use the long-term inactive transaction account or the account that has stopped payroll payment frequently, the balance of the long-term inactive transaction account or the account that has stopped payroll payment is generally very low, so the amount transferred out of the long-term inactive transaction account or the account that has stopped payroll payment is very low, and the amount transferred into the long-term inactive transaction account or the account that has stopped payroll payment is very low, or even 0. Based on this, the long-term inactive transaction account or the account that has stopped payroll payment that meets the following conditions is the first account: 1. The amount of transfers out on a single day is greater than or equal to the first preset threshold; 2. The amount of transactions conducted through non-counter transaction channels on a single day is greater than the second preset threshold; 3. The amount of transfers out within the first preset time period is greater than or equal to the third preset threshold; 4. The amount of transactions conducted through non-counter transaction channels within the first preset time period is greater than or equal to the fourth preset threshold.

[0115] Exemplarily, the first preset threshold is 3500, the second preset threshold is 5000, the first preset time period is 6 months, the third preset threshold is 10000, and the fourth preset threshold is 25000.

[0116] It is understood that customers can conduct transactions through a variety of channels, which are explained below.

[0117] Over-the-counter transaction channels refer to transactions conducted at the counter of a bank branch or through self-service equipment at a bank branch, such as ATM (Automated Teller Machine).

[0118] Non-counter transaction channels refer to transactions conducted through mobile banking applications or third-party payment applications.

[0119] Exemplarily, the more the number of first transactions between the target account and the first account is, the higher the probability that the target account is an abnormal account.

[0120] Step 403: Obtain a second transaction number of abnormal deposit and access transactions executed by the target account.

[0121] The abnormal deposit and access transaction refers to a transaction in which cash with the target serial number is deposited into a second account again within a second preset time period after cash with the target serial number is withdrawn from the target account.

[0122] Exemplarily, the second preset duration may be determined based on actual conditions and is not limited here. For example, the second preset duration is 1 hour.

[0123] It is understandable that the cash withdrawn from the target account through the ATM machine has a corresponding serial number. In this application, the serial number of the cash withdrawn from the target account is referred to as the target serial number. Under normal circumstances, after the customer withdraws cash from the target account, the cash will not be deposited into another account within the second preset time period; if the cash is deposited into another account within the second preset time period after the cash is withdrawn, it indicates that there is a transfer of funds.

[0124] Exemplarily, the more the number of second transactions of abnormal deposit and access transactions performed by the target account is, the higher the probability that the target account is an abnormal account.

[0125] Step 404: Obtain the third transaction number of the inter-provincial transactions executed by the target account.

[0126] The inter-provincial transaction includes at least one third account performing transfer transactions to the target account through the counter transaction channel within a third preset time period greater than or equal to a fifth preset threshold number of times, or at least one fourth account performing transfer transactions to the target account through an automatic teller machine (ATM) channel within the third preset time period with a transaction amount greater than or equal to a sixth preset threshold number; the third account and the target account belong to different provinces, and the fourth account and the target account belong to different provinces.

[0127] Exemplarily, the fifth preset threshold, the third preset duration, and the sixth preset threshold can be determined based on actual conditions and are not limited here. For example, the fifth preset threshold is 2, the third preset duration is 7 days, and the sixth preset threshold is 100,000.

[0128] In the embodiment of the present application, if the operation of "at least one third account performs a transfer transaction to the target account through the counter transaction channel within the third preset time period for a number greater than or equal to the fifth preset threshold" occurs once, the number of third transactions increases by 1; in the embodiment of the present application, if the operation of "at least one fourth account performs a transfer transaction to the target account through the ATM channel within the third preset time period for a transaction amount greater than or equal to the sixth preset threshold" occurs once, the number of third transactions increases by 1.

[0129] For example, under normal circumstances, most of the transfer transactions are conducted through non-counter transaction channels. After statistical analysis, the fund transfer personnel generally defraud the elderly from other provinces, which is not easy to trace; and the elderly will not conduct transfer transactions through non-counter transaction channels, so they will conduct transfer transactions through counter transaction channels.

[0130] Illustratively, the third account and the fourth account may be the same or different.

[0131] For example, the person transferring funds may request to conduct the transfer transaction through an over-the-counter transaction channel. Because the transfer transaction through the over-the-counter transaction channel is conducted in cash, the probability of the transfer transaction being intercepted due to the large amount of the transfer out of the account is low.

[0132] Exemplarily, the more third transactions the target account performs in cross-provincial transactions, the higher the probability that the target account is an abnormal account.

[0133] Step 405: Obtain the fourth transaction number of the abnormal cash withdrawal transaction executed by the target account.

[0134] The abnormal cash withdrawal transaction refers to a transaction in which cash is withdrawn from the target account for a preset multiple of the transaction amount within a fourth preset time period after the target account receives the transaction amount transferred from the fifth account, the preset multiple is within a preset range, and the fifth account and the target account belong to different regions.

[0135] Exemplarily, the fifth account and the target account belong to different regions, which may mean that the fifth account and the target account belong to the same province but different cities, or the fifth account and the target account belong to different provinces.

[0136] Exemplarily, the fourth preset duration may be determined based on actual conditions and is not limited here.

[0137] Exemplarily, the fifth account can transfer funds to the target account through a counter transaction channel or a non-counter transaction channel.

[0138] It is understandable that, under normal circumstances, after the target account receives the funds, that is, after the target account is credited, it may not be used within the fourth preset time period, or even if it is used within the fourth preset time period, most of the credited amount will not be withdrawn. Under abnormal circumstances, after the target account receives the funds, the fund transfer personnel may transfer the funds, but in order to circumvent the monitoring of the flow of funds, the withdrawal amount is intentionally inconsistent with the credited amount, and most of the credited amount will be withdrawn.

[0139] Exemplarily, the preset interval is [0.8, 1.2].

[0140] Exemplarily, the more fourth transactions the target account performs in abnormal cash withdrawal transactions, the higher the probability that the target account is an abnormal account.

[0141] Step 406: Obtain the fifth transaction number of the account-related transactions executed by the target account.

[0142] The account transaction involved in the case refers to a transaction in which, after the sixth account that has been determined to be an abnormal account transfers the transaction amount to the target account, the balance of the sixth account is less than or equal to the seventh preset threshold.

[0143] Exemplarily, the seventh preset threshold value may be determined based on actual conditions and is not limited here. For example, the seventh preset threshold value is 1.

[0144] It is understandable that if the balance of the sixth account is almost zero after the transaction amount is transferred from the sixth account to the target account, since the sixth account has been identified as an abnormal account, it means that the target account is the downstream destination of the funds involved in the case.

[0145] For example, the transfer transaction from the sixth account to the target account is the last transaction of the sixth account, after which the sixth account is frozen. In this case, it can be more clear that the target account is the downstream destination of the funds involved in the case.

[0146] Step 407: Obtain a first number of IP addresses of devices that log into the target account within a fifth preset time period.

[0147] Exemplarily, the fifth preset duration can be determined based on actual conditions and is not limited here. For example, the fifth preset duration is 2 hours.

[0148] It is understandable that, under normal circumstances, there is only one customer operating the same target account, so the geographical location of the customer does not change much or even does not change within the fifth preset time period; even if the customer logs in to the device through the target account multiple times, the IP address (Internet Protocol Address) of the device should be the same, that is, the number of first addresses should be 1. Under abnormal circumstances, there are multiple customers operating the same target account, and different customers may be in different geographical locations, so after different customers log in to the device through the target account respectively, the IP address of the device is different, that is, the number of first addresses is greater than or equal to 2.

[0149] In summary, the more first addresses there are, the more customers are operating the target account, and the greater the probability that the target account is an abnormal account.

[0150] Step 408: Obtain the number of second addresses whose IP addresses of devices that log into the target account within the fifth preset time period belong to the preset high-risk areas.

[0151] In the embodiment of the present application, it can be preset which areas are high-risk areas.

[0152] It is understandable that, under normal circumstances, there is only one customer operating the same target account, so the geographical location of the customer does not change much or even does not change within the fifth preset time period; even if the customer logs in to the device through the target account multiple times, the IP address of the device should be the same, and if the area corresponding to the IP address belongs to the preset high-risk area, the second address number is 1. Under abnormal circumstances, there are multiple customers operating the same target account, and the geographical locations of different customers may be different, so after different customers log in to the device through the target account respectively, the IP address of the device is different; the target area corresponding to the IP address of the target account logging in to the device can be found from the preset correspondence between the IP address and the area; the number of target areas that belong to the preset high-risk areas among the multiple target areas is determined as the second address number.

[0153] However, it is understandable that if the number of second addresses is larger, it means that there are more customers operating the target account in high-risk areas, which means that the probability that the target account is an abnormal account is greater.

[0154] Step 409: Acquire the special transaction information corresponding to the target account.

[0155] The special transaction information includes the sixth transaction number of executed counterparty concentrated transactions, and the counterparty concentrated transactions refer to the transfer transactions from the target account to one or two seventh accounts exceeding the eighth preset threshold number of times within the sixth preset time period, or the transfer transactions from one or two eighth accounts to the target account exceeding the ninth preset threshold number of times within the sixth preset time period.

[0156] For example, the eighth preset threshold, the sixth preset duration, and the ninth preset threshold can be determined based on actual conditions and are not limited here. For example, the sixth preset duration is 4 hours or 5 hours. The eighth preset threshold can be 5, and the ninth preset threshold can be 5.

[0157] Exemplarily, the eighth preset threshold and the ninth preset threshold may be the same or different.

[0158] Illustratively, the eighth account and the seventh account may be the same or different.

[0159] It is understandable that if one or two eighth accounts transfer funds to the target account for more than the ninth preset threshold number of times within the sixth preset time period, it means that funds are being transferred to the target account in a concentrated manner, which is very consistent with the situation where the victim transfers funds to abnormal accounts in a concentrated manner. If the target account transfers funds to one or two seventh accounts for more than the eighth preset threshold number of times within the sixth preset time period, it means that funds are being transferred out in a concentrated manner, which is very consistent with the situation where abnormal accounts transfer funds in a concentrated manner.

[0160] Therefore, the greater the number of transactions, the greater the probability that the target account is an abnormal account.

[0161] Exemplarily, the attribute features obtained in steps 402 to 409 in the embodiment of the present application can be obtained from bank financial data and case-related data released by public security and regulatory agencies obtained from different channels through RPA (Robotic Process Automation) robots, bank core system reports, third-party interfaces, etc.

[0162] Step 410: Input the first transaction number, the second transaction number, the third transaction number, the fourth transaction number, the fifth transaction number, the first address number, the second address number, and the special transaction information into a pre-built abnormal account identification model; obtain a detection result of the target account through the abnormal account identification model, and the detection result is that the target account is an abnormal account or the target account is not an abnormal account.

[0163] Among them, the abnormal account identification model takes the number of transactions between the sample account and the first account, the number of transactions that the sample account has executed the abnormal deposit and access transactions, the number of transactions that the sample account has executed the inter-provincial transactions, the number of transactions that the sample account has executed the abnormal cash withdrawal transactions, the number of transactions that the sample account has executed the account involved in the case, the number of IP addresses of the devices that logged into the sample account within the fifth preset time period, the number of addresses of the IP addresses of the devices that logged into the sample account within the fifth preset time period that belong to the preset high-risk areas, and the special transaction information corresponding to the sample account as input, and takes the labeling results of the sample accounts as training targets, and the labeling results obtained through training are that the sample account is an abnormal account or the sample account is not an abnormal account.

[0164] Exemplarily, the abnormal account identification model is obtained by pre-training a machine learning model through multiple sample accounts. The machine learning model may adopt at least one of a neural network model, a support vector machine (SVM), a decision tree, a logistic regression model, Adaboost, XGboost, and a Transformer-Encoder model.

[0165] The neural network model can be at least one of a convolutional neural network (CNN), an artificial neural network (ANN), or a recurrent neural network (RNN).

[0166] Exemplarily, the machine learning model can be at least one of an attention-based deep model, a memory network-based deep model, a deep learning-based short text classification model, a recurrent neural network-based model, a convolutional neural network-based model, and a deep hybrid model of a Transformer-encoder-based classification model.

[0167] Among them, the short text classification model based on deep learning is a recurrent neural network (RNN) or a convolutional neural network (CNN) or a variant based on the recurrent neural network or the convolutional neural network.

[0168] For example, some simple domain adaptation modifications can be made on the pre-trained model to obtain a machine learning model.

[0169] Exemplarily, “simple domain adaptation” includes but is not limited to re-pre-training an already pre-trained model using large-scale unsupervised domain corpus, and / or compressing an already pre-trained model by model distillation.

[0170] Exemplarily, the confusion matrix evaluation method can be used to improve the recall rate while ensuring the accuracy of the abnormal account identification model. That is, to ensure that the detection results output by the abnormal account identification model are accurate and to identify as many fund transfer personnel as possible. The confusion matrix is ​​a table used to evaluate the performance of a binary classification model. It compares the detection results with the annotation results and divides the detection results into four different categories: true positive examples (TP), false positive examples (FP), true negative examples (TN) and false negative examples (FN). On this basis, the precision calculation formula: TP / (TP+FP) and the recall calculation formula: TP / (TP+FN) can be obtained. Considering the situation that the indicators of the confusion matrix will be distorted in special cases, it is necessary to introduce the ROC (Receiver Operating Characteristic) curve and AUC (Area Under roc Curve) indicators for comprehensive judgment. The ROC curve is drawn by calculating the false positive rate FPR=FP / (FP+TN) and the true positive rate TPR=TP / (TP+FN). The larger the AUC area under the curve, the better the abnormal account identification model effect.

[0171] Exemplarily, the tuning method for the abnormal account identification model of the present application is to use the gradient descent method to adjust the C value (regularization strength) of the abnormal account identification model to reduce the loss function. After adjusting the parameters, the abnormal account identification model is retrained, and then the abnormal account identification model is re-evaluated using the confusion matrix and tuned using the gradient descent method. The two processes are repeated until the parameters in the abnormal account identification model are optimal.

[0172] The embodiment of the present application provides an abnormal account identification method, which obtains the target account to be identified; obtains the first transaction number between the target account and the first account; obtains the second transaction number of abnormal deposit and access transactions executed by the target account; obtains the third transaction number of cross-provincial transactions executed by the target account; obtains the fourth transaction number of abnormal cash withdrawal transactions executed by the target account; obtains the fifth transaction number of transactions of the account involved in the case executed by the target account; obtains the first address number of the IP address of the device that logs into the target account within the fifth preset time period; obtains the second address number of the IP address of the device that logs into the target account within the fifth preset time period that belongs to the preset high-risk area; obtains the special transaction information corresponding to the target account; inputs the above information obtained into the pre-built abnormal account identification model; obtains the detection result of the target account through the abnormal account identification model. There is no need to manually check whether the target account is an abnormal account, which improves the efficiency of investigation.

[0173] In an optional implementation, the special transaction information also includes one or more of the following information.

[0174] Information 1: The target account has executed the seventh transaction number of the first sensitive transaction.

[0175] The first sensitive transaction refers to a transaction in which the total amount of transfers from the target account to the ninth account within the seventh preset time period is greater than or equal to the tenth preset threshold, the number of transfers from the target account to the ninth account within the seventh preset time period is greater than or equal to the eleventh preset threshold, and the transfer amount is an integer multiple of 10, and the account name of the ninth account is the name of a company representing living expenses that belongs to a different province from that of the target account.

[0176] Exemplarily, the seventh preset time, the tenth preset threshold, and the eleventh preset threshold can be determined based on actual conditions and are not limited here. Assuming that the seventh preset time is 1 day, the tenth preset threshold is 3000, and the eleventh preset threshold is 3, then the first sensitive transaction is: more than 3 transfer transactions are made to the ninth account in a single day, and the cumulative payment amount to the ninth account in a single day exceeds 3000, and each payment amount to the ninth account is an integer multiple of 10.

[0177] Exemplarily, the name of the enterprise representing the living expenses may be a power supply company, a power supply bureau, a power company, a power company, a power company, a power supply branch, a water supply company, a gas company, etc. Exemplarily, in an embodiment of the present application, the name of the enterprise representing the living expenses may be obtained in advance.

[0178] It is understandable that in order to increase the difficulty of verification, fees are generally paid to the ninth account across provinces.

[0179] It can be understood that, under normal circumstances, fees will not be paid to the ninth account multiple times within the seventh preset time period, and the fees paid to the ninth account within the seventh preset time period will not exceed the tenth preset threshold. The more the seventh transaction times, the greater the probability that the target account is an abnormal account.

[0180] Information 2: The target account has executed the eighth transaction number of the second sensitive transaction.

[0181] The second sensitive transaction refers to the target account performing a transfer transaction to the tenth account greater than or equal to the twelfth preset threshold number of times in a single day, and the account name of the tenth account includes at least one keyword among loan, finance, and money.

[0182] Exemplarily, the twelfth preset threshold value may be determined based on actual conditions and is not limited here. For example, the twelfth preset threshold value is 3.

[0183] It is understandable that an account name containing at least one of the keywords "loan", "finance" and "money" may be an account name of an Internet lending platform, and fund transfer personnel often have financial transactions with Internet lending platforms. Therefore, the more transactions there are, the greater the probability that the target account is an abnormal account.

[0184] Information three: whether the target account has executed the third sensitive transaction.

[0185] The third sensitive transaction refers to the number of transactions within the eighth preset time period being zero, and within the ninth preset time period only a number of transfer transactions greater than or equal to the thirteenth preset threshold value is performed to the donation institution account, and the transfer amount to the donation institution account is less than or equal to the fourteenth preset threshold value, and the time corresponding to the eighth preset time period is earlier than the time corresponding to the ninth preset time period, and the time corresponding to the eighth preset time period is adjacent to the time corresponding to the ninth preset time period.

[0186] Exemplarily, the eighth preset time period, the ninth preset time period, the thirteenth preset threshold, and the fourteenth preset threshold can be determined based on actual conditions and are not limited here. For example, the eighth preset time period can be 1 month, the ninth preset time period can be 3 days, the thirteenth preset threshold can be 1, and the fourteenth preset threshold can be 100.

[0187] The following example illustrates that “the time corresponding to the eighth preset duration is earlier than the time corresponding to the ninth preset duration, and the time corresponding to the eighth preset duration is adjacent to the time corresponding to the ninth preset duration”.

[0188] Assuming that the time corresponding to the eighth preset time period is January 1 to January 31, 2024, the time corresponding to the ninth preset time period may be February 5 to February 8, 2024. No transaction occurred in the target account from February 1, 2024 to February 4, 2024, so the time corresponding to the eighth preset time period is adjacent to the time corresponding to the ninth preset time period.

[0189] It is understandable that if the number of transactions within the eighth preset time is zero, it means that the customer rarely uses the target account, and the customer only transfers a small amount to the donation agency account within the ninth preset time, which means that the customer tests the status of the target account by transferring money to the donation agency account, that is, whether the target account can make payments normally or is frozen. This means that the customer is already preparing for the fund transfer.

[0190] Information 4: When the age of the customer of the target account is less than or equal to the preset age and the target account is a non-loan account, the target account has executed the ninth transaction number of frequent abnormal cash withdrawal transactions.

[0191] The frequent abnormal cash withdrawal transactions refer to cash withdrawal transactions executed from the target account more than or equal to the fifteenth preset threshold number of times within the tenth preset time period, and different cash withdrawal transactions correspond to different ATM bank branches.

[0192] For example, the preset age, the tenth preset duration, and the fifteenth preset threshold value may be determined based on actual conditions and are not limited here. For example, the preset age is 35 years old, the tenth preset duration is 2 days, and the fifteenth preset threshold value is 3 times.

[0193] It is understandable that if the age of the customer of the target account is higher than the preset age, the customer may not be accustomed to using third-party payment applications for transactions and may be accustomed to using cash for transactions, so he may withdraw cash frequently; while customers whose age is lower than or equal to the preset age are accustomed to using third-party payment applications for transactions, so frequent cash withdrawals are abnormal.

[0194] It is understandable that if the target account is a loan account, such as a consumer loan account, the target account may frequently withdraw cash for transactions, so the loan account needs to be excluded.

[0195] It is understandable that, in general, the bank branches of ATMs where customers frequently withdraw cash should be the same or mostly the same. If different ATMs corresponding to different withdrawal transactions belong to different bank branches, it means that the funds are transferred in batches and locations in order to evade monitoring. Therefore, the greater the number of transactions, the greater the probability that the target account is an abnormal account.

[0196] Illustratively, different bank branches may belong to different banks or the same bank.

[0197] Information 5: The target account has executed the tenth quick cash withdrawal transaction.

[0198] The quick cash withdrawal transaction refers to a transaction in which the third amount of funds is withdrawn within the eleventh preset time period after the target account receives the third amount of funds.

[0199] Exemplarily, the eleventh preset duration can be determined based on actual conditions and is not limited here. For example, the eleventh preset duration is 2 hours.

[0200] It is understandable that if there is a rapid cash withdrawal transaction, it means that there may be a rapid transfer of funds to avoid the suspicion of the relevant authorities freezing the target account. Therefore, the greater the number of transactions, the greater the probability that the target account is an abnormal account.

[0201] Information 6: The target account has executed the eleventh large-amount cash withdrawal transaction.

[0202] Large withdrawal transactions refer to transactions in which the target account's daily withdrawal amount is greater than or equal to the sixteenth preset threshold and the weekly withdrawal amount is greater than or equal to the seventeenth preset threshold.

[0203] Exemplarily, the sixteenth preset threshold and the seventeenth preset threshold may be determined based on actual conditions and are not limited here. For example, the sixteenth preset threshold is 40,000 and the seventeenth preset threshold is 100,000.

[0204] Information 7: The twelfth transaction number of the non-counter special transaction executed by the target account.

[0205] Non-counter special transactions refer to the target account conducting transfer transactions to the same account through non-counter transaction channels greater than or equal to the eighteenth preset threshold number of times within a single day, or the target account receiving transfer transactions from the same account through non-counter transaction channels greater than or equal to the nineteenth preset threshold number of times within a single day.

[0206] Exemplarily, the eighteenth preset threshold and the nineteenth preset threshold can be determined based on actual conditions, which are not limited here. For example, the eighteenth preset threshold is 4, and the nineteenth preset threshold is 4. Exemplarily, the eighteenth preset threshold is the same as the nineteenth preset threshold; Exemplarily, the eighteenth preset threshold is different from the nineteenth preset threshold.

[0207] It is understandable that if the target account frequently transfers money to the same account in a single day, it means that there is a behavior of transferring funds from the target account; if the same account frequently transfers money to the target account in a single day, it means that there is a behavior of transferring funds from other accounts to the target account.

[0208] Information 8: The thirteenth transaction number of statistical abnormal transactions executed by the target account.

[0209] Abnormal transactions include: more than 10 inter-bank transactions and cash withdrawals in a single month, or more than 600 transactions in a single month, or more than 60 counterparties receiving payments in a single day.

[0210] Information 9: The fourteenth transaction number of the frequent transactions executed by the target account.

[0211] Frequent trading means that the target account has more than 10 transactions within 3 hours.

[0212] Information 10: The fourteenth transaction number of the special amount transaction executed by the target account.

[0213] Special amount transaction means that the value after the decimal point of the transaction amount recorded within the twelfth preset time period is any one of: 98, 99, 01, 02.

[0214] Exemplarily, the twelfth preset time period may be determined based on actual conditions and is not limited here. For example, the twelfth preset time period is 1 month.

[0215] For example, the transaction amounts are 99.98, 99.99, 100.01, 100.02 and 199.98, 199.99, 200.01, 200.02. This is a method used to circumvent the integer amount screening.

[0216] In an optional implementation, the special transaction information also includes one or more of the following information.

[0217] Information 11: customer attribute information of the target account, including but not limited to: age, gender, occupation, and place of birth.

[0218] Information 12: Account attribute information of the target account, the account attribute information including the total number of accounts opened by the customer of the target account in various banks.

[0219] Information 13: Whether the target account has a sudden surge in transactions.

[0220] A sudden surge in transactions refers to transactions with relatively small transaction amounts in the first time period, and a sudden increase in transaction amounts in the second time period after the first time period, which is equivalent to an idle account suddenly starting up after a small trial transaction, with large amounts of funds being received or paid. Alternatively, a sudden surge in transactions refers to transactions with relatively small transaction times in the first time period, and a sudden increase in transaction times in the second time period after the first time period, which is equivalent to an idle account suddenly starting up after a small trial transaction, with large amounts of funds being received or paid.

[0221] Exemplarily, the first time period may be [first time, second time), and the second time period may be [second time, current time].

[0222] Information 14: Whether the target account has decentralized transfer-in and centralized transfer-out transactions.

[0223] A decentralized transfer-in and centralized transfer-out transaction refers to a situation where a large number of payer transfers are received within a certain period of time, but the target account only transfers almost all of the amount to one or two accounts.

[0224] It is understandable that there are many attribute features corresponding to the target account, such as those mentioned in the above embodiments: the first transaction number, the second transaction number, the third transaction number, the fourth transaction number, the fifth transaction number, the number of first addresses, the number of second addresses, and special transaction information. In addition to the attribute features mentioned in the above embodiments, there are also the following attribute features: account status, account category, account opening date, number of customer resignations. So which attribute features to choose to train the abnormal account identification model is a technical problem in this field. Therefore, the embodiment of the present application also provides the following method, which includes the following steps A1 to A4.

[0225] Step A1: Obtain multiple candidate attribute features of the sample account.

[0226] Multiple candidate attribute features of the sample account include: the first transaction number, the second transaction number, the third transaction number, the fourth transaction number, the fifth transaction number, the number of first addresses, the number of second addresses and special transaction information, as well as account status, account category, account opening date and other features.

[0227] It is understandable that there are many candidate attribute features, and the embodiments of the present application will not list them one by one.

[0228] In order to comprehensively and accurately extract the behavioral characteristics of suspicious fund transfer personnel from the financial behavior, the following candidate attribute characteristics are usually used: customer information, account information and transaction information. Customer information includes gender, age, place of birth, occupation, etc. Account information mainly involves personal accounts, corporate accounts, debit card accounts, credit card accounts, foreign currency financial management and other financial asset accounts, as well as third-party accounts such as electricity and water bills. Transaction information may come from multiple channels such as account transactions, debit card transactions, credit card transactions, cross-border remittances, ATM transactions, counter transactions, online banking transactions, intra-bank remittances, and inter-bank remittances. Some of these data can be directly downloaded from the bank's internal reporting platform; some need to use RPA robots to log in to the relevant business system to capture them regularly. All data mining work is handled by the bank's internal system to ensure that information is secure and controllable. After obtaining the information, it is imported into the relational database according to the data type to facilitate subsequent related extraction. The competent authority and the bank have established a verification interface. Through privacy computing technology, banks can query whether customers are suspected of transferring funds without leaving the domain of customer information.

[0229] Exemplarily, after obtaining multiple candidate attribute features, the candidate attribute features need to be cleaned. Usually, the following four types of data are cleaned, as shown in Table 1.

[0230] Table 1

[0231]

[0232]

[0233] In order to improve data value, reduce redundancy and noise, and enhance the predictive ability of the abnormal account identification model, it is necessary to perform certain transformations on the preferred attribute features, as shown in Table 2.

[0234] Table 2

[0235]

[0236] Step A2: Acquire a plurality of linearly independent pending attribute features from the plurality of candidate attribute features.

[0237] Exemplarily, if the multiple candidate attribute features include multiple linearly correlated candidate attribute features, it is necessary to remove at least one of the multiple linearly correlated candidate attribute features and retain the linearly independent target candidate attribute feature; and determine the target candidate attribute feature as the pending attribute feature.

[0238] Assume that the multiple candidate attribute features include: candidate attribute feature 01, candidate attribute feature 02, candidate attribute feature 03, and candidate attribute feature 04.

[0239] Assume that candidate attribute feature 04 is linearly independent from candidate attribute feature 01, candidate attribute feature 02, and candidate attribute feature 03, and there are coefficients a, b, and c that are not all zero, so that a*candidate attribute feature 01+candidate*undetermined attribute feature 02+c*candidate attribute feature 03=0, then candidate attribute feature 01, candidate attribute feature 02 are linearly dependent on candidate attribute feature 03. If after deleting candidate attribute feature 03, there are no coefficients d and e that are not all zero, so that d*candidate attribute feature 01+e*candidate attribute feature 02=0, that is, candidate attribute feature 01 and candidate attribute feature 02 are linearly independent, then candidate attribute feature 01, candidate attribute feature 02, and candidate attribute feature 04 are target candidate attribute features, and these three features are all undetermined attribute features.

[0240] Exemplarily, there are multiple methods for checking whether multiple candidate attribute features are linearly correlated. The embodiments of the present disclosure provide but are not limited to the following two methods: the first method is to check through tolerance; the second method is to check through variance inflation factor (VIF).

[0241] Exemplarily, if step A2 finds that candidate attribute feature 01, candidate attribute feature 02 and candidate attribute feature 03 are linearly correlated, exemplary, the importance values ​​corresponding to the multiple candidate attribute features can be obtained. If the importance value of candidate attribute feature 03 is less than the importance value of candidate attribute feature 01 and the importance value of candidate attribute feature 03 is less than the importance value of candidate attribute feature 02, then candidate attribute feature 03 is deleted and candidate attribute feature 01 and candidate attribute feature 02 are retained.

[0242] Step A3: Obtain importance values ​​corresponding to the multiple pending attribute features respectively, where the importance values ​​of the pending attribute features represent the extent to which the pending attribute features affect whether the sample account is an abnormal account.

[0243] In the embodiment of the present application, each undetermined attribute feature has an importance value, and the importance value represents the degree to which the undetermined attribute feature affects whether the sample account is an abnormal account. In one example, the greater the importance value, the greater the degree to which the undetermined attribute feature affects whether the sample account is an abnormal account, and the smaller the importance value, the smaller the degree to which the undetermined attribute feature affects whether the sample account is an abnormal account.

[0244] Exemplarily, importance values ​​corresponding to a plurality of undetermined attribute features may be obtained based on a decision tree.

[0245] Step A4: Acquire multiple attribute features whose importance values ​​are greater than or equal to a twentieth preset threshold from the multiple undetermined attribute features.

[0246] Among them, the multiple attribute characteristics include: the number of transactions with the first account, the number of transactions of the abnormal deposit and access transactions, the number of transactions of the inter-provincial transactions, the number of transactions of the abnormal cash withdrawal transactions, the number of transactions of the account involved in the case, the number of IP addresses of the devices that logged into the sample account within the fifth preset time period, the number of second addresses of the devices that logged into the sample account within the fifth preset time period whose IP addresses belong to the preset high-risk areas, and the special transaction information corresponding to the sample account.

[0247] Exemplarily, the twentieth preset threshold value may be determined based on actual conditions and is not limited here.

[0248] It is understandable that the pending attribute features with low importance values ​​are not beneficial to the training of the machine learning model. For example, the above-mentioned pending attribute feature "number of customer resignations" has no effect on whether the account is an abnormal account and has nothing to do with the pending attribute feature "number of customer resignations", that is, the pending attribute feature "number of customer resignations" has no effect on determining whether the account is an abnormal account. If the importance value of the pending attribute feature is less than or equal to the twentieth preset threshold, it means that the pending attribute feature has no effect or little effect on determining whether the account is an abnormal account. If a machine learning model is trained using a pending attribute feature with an importance value less than or equal to the twentieth preset threshold, it will not only reduce the accuracy of the detection results output by the machine learning model, but also increase the amount of data in the process of training the machine learning model. Therefore, multiple attribute features with importance values ​​greater than or equal to the twentieth preset threshold are selected from multiple pending attribute features, and multiple attribute features are used to train the machine learning model, which greatly reduces the amount of data in the process of training the machine learning model and improves the accuracy of the detection results output by the machine learning model.

[0249] In an optional implementation, the method for determining the preset interval includes the following steps B1 to B9.

[0250] Step B1: Obtain a first amount and a first transaction time of an abnormal withdrawal transaction of an abnormal account, wherein the abnormal withdrawal transaction refers to a transaction of withdrawing cash from the abnormal account within the second preset time period after the fifth account transfers the transaction amount to the abnormal account.

[0251] Step B2: obtaining a second amount and a second transaction time of an abnormal payment collection transaction, wherein the abnormal payment collection transaction is a payment collection transaction in which the abnormal account receives an amount transferred from the fifth account.

[0252] Exemplarily, the fifth account may be any account that transfers money to the target account.

[0253] Exemplarily, the fifth account is an account that has been confirmed to belong to the victim.

[0254] Step B3: Acquire multiple groups of abnormal transaction sets, wherein the abnormal transaction sets include the first amount of an abnormal withdrawal transaction and the second amount of an abnormal collection transaction, the first transaction time of the abnormal withdrawal transactions in the same abnormal transaction set is later than the second transaction time of the abnormal collection transactions, and there are no abnormal withdrawal transactions and abnormal collection transactions between the first transaction time and the second transaction time.

[0255] The following example illustrates the process of obtaining multiple sets of abnormal transaction sets.

[0256] At 10:00 on January 1, 2024, the fifth account 001 transferred 10,000 to the target account, and at 15:00 on January 1, 2024, 8,000 was transferred out from the target account; at 17:00 on January 1, 2024, 2,000 was transferred out from the target account; at 10:00 on January 2, 2024, the fifth account 002 transferred 20,000 to the target account, and at 15:00 on January 3, 2024, 18,000 was transferred out from the target account; at 10:00 on January 5, 2024, the fifth account 003 transferred 30,000 to the target account, and at 15:00 on January 6, 2024, 32,000 was transferred out from the target account.

[0257] Assume that the abnormal collection transaction is represented by {second transaction time, transfer account, second amount}, and the abnormal withdrawal transaction is represented by {first transaction time, target account, first amount}. Through the above transaction process, the abnormal collection transactions are {20241110:00, fifth account 001, 10000}, {2021.1.2.10:00, fifth account 002, 20000}, {2024.1.5.10:00, fifth account 003, 30000}; the abnormal withdrawal transactions are {2024.1.1.15:00, target account, 8000}, {2024.1.1.17:00, target account, 2000}, {2024.1.3.15:00, target account, 18000}, {2024.1.6.15:00, target account, 32000}.

[0258] Since there is no abnormal withdrawal transaction and abnormal collection transaction between the first transaction time of the abnormal withdrawal transaction and the second transaction time of the abnormal collection transaction in each abnormal transaction set, and the first transaction time is later than the second transaction time, assuming that the abnormal transaction set is represented by [abnormal collection transaction, abnormal withdrawal transaction], three sets of abnormal transaction sets can be obtained, and they are as follows:

[0259] [{2024.1.1.10:00, fifth account 001, 10000}, {2024.1.1.15:00, target account, 8000}], [{2021.1.2.10:00, fifth account 002, 20000}, {2024.1.3.15:00, target account, 18000}], [{2024.1.5.10:00, fifth account 003, 30000}, {2024.1.6.15:00, target account, 32000}].

[0260] Step B4: obtaining a plurality of sample points corresponding to the abnormal transaction sets respectively, wherein the sample points corresponding to the abnormal transaction sets are the ratios of the first amount of the abnormal withdrawal transactions in the abnormal transaction sets to the second amount of the abnormal receipt transactions in the abnormal transaction sets.

[0261] Taking the three sets of abnormal transaction sets as [{2024.1.1.10:00, fifth account 001, 10000}, {2024.1.1.15:00, target account, 8000}], [{2021.1.2.10:00, fifth account 002, 20000}, {2024.1.3.15:00, target account, 18000}], [{2024.1.5.10:00, fifth account 003, 30000}, {2024.1.6.15:00, target account, 32000}] as an example, then [{2024.1.1.10:00, fifth account 001, 20000}, {2024.1.3.15:00, target account, 18000}] , 10000}, {2024.1.1.15:00, target account, 8000}] The corresponding sample point = 8000 / 10000 = 0.8; the corresponding sample point of [{2021.1.2.10:00, fifth account 002, 20000}, {2024.1.3.15:00, target account, 18000}] = 18000 / 20000 = 0.9; the corresponding sample point of [{2024.1.5.10:00, fifth account 003, 30000}, {2024.1.6.15:00, target account, 32000}] = 32000 / 30000 = 1.07.

[0262] Step B5: Determine a first number of clusters to be divided and initial center points corresponding to the first number of clusters.

[0263] Exemplarily, the first number is determined based on human experience.

[0264] Illustratively, the first number is determined using an elbow method.

[0265] The principle of the elbow method is based on the relationship between the sum of squared errors (SSE) and the number of clusters. As the number of clusters increases, the division of sample points becomes more refined, and the degree of aggregation of each cluster increases, resulting in a gradual decrease in the sum of squared errors (SSE). When the number of clusters reaches the true first number, the decrease in SSE decreases sharply and tends to be flat as the number of clusters continues to increase. In this process, the relationship between SSE and the number of clusters presents an elbow shape, and the value corresponding to this elbow is the first number.

[0266] Exemplarily, the initial center points corresponding to the first number of clusters may be determined based on human experience. For example, the first number is 5, and the 5 initial center points are 0.4, 0.7, 1, 1.3, and 1.6, respectively.

[0267] Step B6: for each of the sample points, obtain the absolute value of the difference between the sample point and the initial center points corresponding to the first number of clusters; divide the sample points into clusters corresponding to the initial center points corresponding to the smallest absolute value of the difference, so as to obtain the first number of clusters.

[0268] The following example illustrates that there are three sample points, namely 0.8, 0.9 and 1.07. For sample point 0.8, the absolute values ​​of the differences between sample point 0.8 and the above five initial center points are calculated, namely, |0.8-0.4|, |0.8-0.7|, |0.8-0.1|, |0.8-1.3|, |0.8-1.6|. The absolute value of the minimum difference is 0.1, and the initial center point corresponding to the absolute value of the minimum difference is 0.7. Then 0.8 is divided into the cluster with the initial center point 0.7.

[0269] Step B7: For each cluster, determine the mean value of the sample points included in the cluster as the updated center point of the cluster.

[0270] Step B8: For each of the sample points, obtain the absolute value of the difference between the sample point and the update center points corresponding to the first number of clusters; divide the sample points into clusters corresponding to the update center points corresponding to the smallest absolute value of the difference to obtain the first number of clusters, and return to step B7 until the update center points corresponding to the first number of clusters no longer change.

[0271] For example, if the update center points corresponding to the first number of clusters are not changing, it means that the first number of clusters have converged. At this time, it is necessary to use the SSE error square sum silhouette coefficient method to analyze whether the inter-cluster distance and the distance of the sample points within the cluster of the first number of clusters after convergence can meet expectations. The inter-cluster distance refers to the distance between the update center points of any two clusters. The distance of the sample points within the cluster refers to the distance between each sample point in the same cluster and the update center point.

[0272] It is understandable that if the inter-cluster distance is larger and the distance between sample points within a cluster is smaller, the expectation can be met more effectively. If the inter-cluster distance and the distance between sample points within a cluster of the first number of clusters cannot meet expectations, the values ​​of the first number of initial center points are adjusted, and steps B5 to B8 are performed again.

[0273] Step B9: Determine the preset interval based on the first number of clusters.

[0274] In order for those skilled in the art to better understand steps B8 to B9 provided in the embodiments of the present application, the inventor conducted an experiment. The first number determined by the inventor based on experience is 5, and the 5 initial center points selected are: 0.4, 0.7, 1, 1.3, and 1.6, respectively. Five clusters were obtained through step B8. In order for those skilled in the art to better understand the clustering of each sample point in the embodiments of the present application, the sample point is used as the horizontal coordinate, and a virtual vertical coordinate is created for each sample point (for example, the first transaction time or the second transaction time corresponding to the sample point can be used as the vertical coordinate). The clustering of multiple sample points is first displayed on a two-dimensional plane, as shown in FIG. Figure 5 , which is a schematic diagram of clustering of multiple sample points on a two-dimensional plane provided in an embodiment of the present application.

[0275] Figure 5 In the example, points of different styles are used to represent sample points belonging to different clusters. For example, sample points with a dot style belong to the first cluster, sample points with a five-pointed star style belong to the second cluster, sample points with a plus sign style belong to the third cluster, sample points with an overturned triangle style belong to the fourth cluster, and sample points with an upright triangle style belong to the fifth cluster.

[0276] In reality, the above-mentioned multiple sample points are located in a one-dimensional coordinate system, such as Figure 6 FIG. 1 is a schematic diagram of clustering of multiple sample points on a one-dimensional plane provided in an embodiment of the present application. Figure 6 That is Figure 5 The projection of all sample points on the horizontal axis.

[0277] pass Figure 5 and Figure 6 It can be seen that the sample points are more obviously clustered in the second cluster, the third cluster, and the fourth cluster, and their update center points are 0.8548, 0.9606, and 1.1225 respectively; it is understandable that if the preset interval is too large, more normal transactions will be included, reducing the characteristic attributes, so according to Figure 6 Based on the clustering of sample points, the preset interval is determined to be [0.8, 1.2], because the preset interval [0.8, 1.2] can cover most of the sample points and the interval range is not very large.

[0278] An abnormal account identification method provided by an embodiment of the present application is introduced above. The following will introduce a device for executing the above abnormal account identification method.

[0279] See also Figure 7 , Figure 7 This is a schematic diagram of the structure of an abnormal account identification device provided in an embodiment of the present application. Figure 7 As shown, the abnormal account identification device includes:

[0280] A first acquisition module 701 is used to acquire a target account to be identified;

[0281] The second acquisition module 702 is used to acquire the first transaction number between the target account and the first account, the first account being a long-term no active transaction account or a stopped payroll account, whose daily outflow amount is greater than or equal to a first preset threshold, whose daily transaction amount through non-counter transaction channels is greater than or equal to a second preset threshold, whose outflow amount within a first preset time period is greater than or equal to a third preset threshold, and whose transaction amount through non-counter transaction channels within the first preset time period is greater than or equal to a fourth preset threshold;

[0282] The third acquisition module 703 is used to acquire a second transaction number of abnormal deposit and access transactions executed by the target account, wherein the abnormal deposit and access transaction refers to a transaction in which the cash with the target serial number is deposited into the second account again within a second preset time after the cash with the target serial number is withdrawn from the target account;

[0283] The fourth acquisition module 704 is used to acquire the third transaction number of the inter-provincial transactions executed by the target account, wherein the inter-provincial transactions include at least one third account performing a transfer transaction to the target account through a counter transaction channel within a third preset time period greater than or equal to a fifth preset threshold number of times, or at least one fourth account performing a transfer transaction to the target account through an ATM channel within the third preset time period with a transaction amount greater than or equal to a sixth preset threshold number; the third account and the target account belong to different provinces, and the fourth account and the target account belong to different provinces;

[0284] a fifth acquisition module 705, configured to acquire a fourth transaction number of abnormal cash withdrawal transactions executed by the target account, wherein the abnormal cash withdrawal transaction refers to a transaction in which cash is withdrawn from the target account within a fourth preset time period after the target account receives the transaction amount transferred from the fifth account, and the preset multiple belongs to a preset interval, and the fifth account and the target account belong to different regions;

[0285] A sixth acquisition module 706 is used to acquire a fifth transaction number of the account-involved transaction executed by the target account, wherein the account-involved transaction refers to a transaction in which, after a sixth account that has been determined to be an abnormal account transfers a transaction amount to the target account, the balance of the sixth account is less than or equal to a seventh preset threshold;

[0286] A seventh acquisition module 707, configured to acquire a first number of IP addresses of devices that log in to the target account within a fifth preset time period;

[0287] An eighth acquisition module 708, configured to acquire the number of second addresses of which the IP addresses of the devices that logged into the target account within the fifth preset time period belong to the preset high-risk areas;

[0288] A ninth acquisition module 709 is used to acquire special transaction information corresponding to the target account, wherein the special transaction information includes a sixth transaction number of executed counterparty concentrated transactions, wherein the counterparty concentrated transactions refer to the target account performing transfer transactions to one or two seventh accounts exceeding an eighth preset threshold number of times within a sixth preset time period, or the target account performing transfer transactions to one or two eighth accounts exceeding a ninth preset threshold number of times within the sixth preset time period;

[0289] a tenth acquisition module 710, configured to input the first transaction number, the second transaction number, the third transaction number, the fourth transaction number, the fifth transaction number, the first address number, the second address number, and the special transaction information into a pre-built abnormal account identification model; and obtain a detection result of the target account through the abnormal account identification model, wherein the detection result is that the target account is an abnormal account or the target account is not an abnormal account;

[0290] Among them, the abnormal account identification model takes the number of transactions between the sample account and the first account, the number of transactions that the sample account has executed the abnormal deposit and access transactions, the number of transactions that the sample account has executed the inter-provincial transactions, the number of transactions that the sample account has executed the abnormal cash withdrawal transactions, the number of transactions that the sample account has executed the account involved in the case, the number of IP addresses of the devices that logged into the sample account within the fifth preset time period, the number of addresses of the IP addresses of the devices that logged into the sample account within the fifth preset time period that belong to the preset high-risk areas, and the special transaction information corresponding to the sample account as input, and takes the labeling results of the sample accounts as training targets, and the labeling results obtained through training are that the sample account is an abnormal account or the sample account is not an abnormal account.

[0291] In an optional implementation, the special transaction information further includes:

[0292] The target account has executed the seventh transaction number of the first sensitive transaction, the first sensitive transaction being a transaction in which the total amount of transfers from the target account to the ninth account within the seventh preset time period is greater than or equal to the tenth preset threshold value, the number of transfers from the target account to the ninth account within the seventh preset time period is greater than or equal to the eleventh preset threshold value, and the transfer amount is an integer multiple of 10, and the account name of the ninth account is the name of an enterprise representing living expenses in a different province from that of the target account; and / or,

[0293] The target account has executed an eighth transaction number of a second sensitive transaction, wherein the second sensitive transaction refers to a transfer transaction from the target account to the tenth account greater than or equal to a twelfth preset threshold number of times within a single day, and the account name of the tenth account includes at least one keyword of loan, finance, and money; and / or,

[0294] whether the target account has executed a third sensitive transaction, wherein the target account has executed zero transactions within an eighth preset time period, and only a number of transfer transactions greater than or equal to a thirteenth preset threshold value is executed to the donation institution account within a ninth preset time period, and the amount of transfer to the donation institution account is less than or equal to a fourteenth preset threshold value, and the time corresponding to the eighth preset time period is earlier than the time corresponding to the ninth preset time period, and the time corresponding to the eighth preset time period is adjacent to the time corresponding to the ninth preset time period; and / or,

[0295] When the age of the customer of the target account is less than or equal to the preset age and the target account is a non-loan account, the target account has executed the ninth transaction number of frequent abnormal cash withdrawal transactions, and the frequent abnormal cash withdrawal transactions refer to cash withdrawal transactions executed from the target account greater than or equal to the fifteenth preset threshold number within the tenth preset time period, and different cash withdrawal transactions correspond to different ATM bank branches.

[0296] In an optional implementation, the preset interval is [0.8, 1.2].

[0297] In an optional implementation, the method further includes:

[0298] an eleventh obtaining module, configured to obtain a first amount and a first transaction time of an abnormal withdrawal transaction of an abnormal account, wherein the abnormal withdrawal transaction refers to a transaction of withdrawing cash from the abnormal account within the second preset time period after the fifth account transfers the transaction amount to the abnormal account;

[0299] A twelfth acquisition module is used to acquire a second amount and a second transaction time of an abnormal payment collection transaction, wherein the abnormal payment collection transaction is a payment collection transaction in which the abnormal account receives an amount transferred from the fifth account;

[0300] A thirteenth acquisition module is used to acquire multiple groups of abnormal transaction sets, wherein the abnormal transaction set includes one abnormal withdrawal transaction and one abnormal collection transaction, the first transaction time of the abnormal withdrawal transactions in the same abnormal transaction set is later than the second transaction time of the abnormal collection transaction, and there is no abnormal withdrawal transaction and abnormal collection transaction between the first transaction time and the second transaction time;

[0301] A fourteenth acquisition module is used to acquire a plurality of sample points corresponding to the abnormal transaction sets, wherein the sample points corresponding to the abnormal transaction sets are ratios of the first amount of the abnormal withdrawal transactions in the abnormal transaction sets to the second amount of the abnormal receipt transactions in the abnormal transaction sets;

[0302] A first determining module, used to determine a first number of clusters to be divided and initial center points corresponding to the first number of clusters respectively;

[0303] A fifteenth acquisition module is used to acquire, for each of the sample points, an absolute value of a difference between the sample point and the initial center points corresponding to the first number of clusters; and divide the sample points into clusters corresponding to the initial center points corresponding to the smallest absolute value of the difference, so as to obtain the first number of clusters;

[0304] A second determination module is used to determine, for each cluster, a mean value of sample points included in the cluster as an updated center point of the cluster;

[0305] A sixteenth acquisition module is configured to acquire, for each of the sample points, an absolute value of a difference between the sample point and the update center points respectively corresponding to the first number of clusters; divide the sample points into clusters corresponding to the update center points corresponding to the smallest absolute value of the difference to obtain the first number of clusters, and trigger the second determination module until the update center points respectively corresponding to the first number of clusters no longer change;

[0306] The third determining module is configured to determine the preset interval based on the first number of clusters.

[0307] In an optional implementation, the method further includes:

[0308] A seventeenth acquisition module, used to acquire a plurality of candidate attribute features of the sample account;

[0309] An eighteenth acquisition module, used for acquiring a plurality of linearly independent pending attribute features from the plurality of candidate attribute features;

[0310] A nineteenth acquisition module is used to acquire importance values ​​corresponding to the plurality of pending attribute features, respectively, wherein the importance values ​​of the pending attribute features represent the degree to which the pending attribute features affect whether the sample account is an abnormal account;

[0311] A twentieth acquisition module, used for acquiring a plurality of attribute features whose importance values ​​are greater than or equal to a twentieth preset threshold value from the plurality of undetermined attribute features;

[0312] Among them, the multiple attribute characteristics include: the number of transactions with the first account, the number of transactions of the abnormal deposit and access transactions, the number of transactions of the inter-provincial transactions, the number of transactions of the abnormal cash withdrawal transactions, the number of transactions of the account involved in the case, the number of IP addresses of the devices that logged into the sample account within the fifth preset time period, the number of second addresses of the devices that logged into the sample account within the fifth preset time period whose IP addresses belong to the preset high-risk areas, and the special transaction information corresponding to the sample account.

[0313] The present application also provides an electronic device in an embodiment. Figure 8 As shown, it shows a schematic diagram of the structure of an electronic device suitable for implementing the embodiments of the present application. The electronic device in the embodiments of the present application may include but is not limited to fixed terminals such as mobile phones, notebook computers, PDAs (personal digital assistants), PADs (tablet computers), desktop computers, etc. Figure 8 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0314] like Figure 8 As shown, the electronic device may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage device 808 to a random access memory (RAM) 803. When the electronic device is powered on, various programs and data required for the operation of the electronic device are also stored in the RAM 803. The processing device 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0315] Typically, the following devices may be connected to the I / O interface 805: input devices 806 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 807 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 808 including, for example, a memory card, a hard disk, etc.; and communication devices 809. The communication device 809 may allow the electronic device to communicate with other devices wirelessly or by wire to exchange data. Although Figure 8 An electronic device having various devices is shown, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0316] An embodiment of the present application also provides a computer program product including computer-readable instructions. When the computer-readable instructions are executed on an electronic device, the electronic device implements any abnormal account identification method provided in the embodiment of the present application.

[0317] A computer-readable storage medium is also provided in an embodiment of the present application. The storage medium carries one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device can implement any abnormal account identification method provided in the embodiment of the present application.

[0318] It should be noted that the abnormal account identification method and related devices provided by the present invention can be used in the field of artificial intelligence or finance. The above is only an example and does not limit the application field of the abnormal account identification method and related devices provided by the present invention.

[0319] It should also be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the drawings of the device embodiments provided by the present application, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.

[0320] Through the description of the above implementation mode, the technicians in the field can clearly understand that the present application can be implemented by means of software plus necessary general hardware, and of course, it can also be implemented by special hardware including special integrated circuits, special CPUs, special memories, special components, etc. In general, all functions completed by computer programs can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be various, such as analog circuits, digital circuits or special circuits. However, for the present application, software program implementation is a better implementation mode in more cases. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer floppy disk, a U disk, a mobile hard disk, a ROM, a RAM, a disk or an optical disk, etc., including a number of instructions to enable a computer device (which can be a personal computer, a training device, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0321] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0322] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a training device, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, training device, or data center. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device, a data center, etc. that includes one or more available media integrations. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.

Claims

1. A method for identifying abnormal accounts, characterized in that: include: Obtain the target account to be identified; Obtaining a first transaction number between the target account and a first account, wherein the first account is a long-term no-active-transaction account or a stopped payroll account, whose daily outflow amount is greater than or equal to a first preset threshold, whose daily transaction amount through non-counter transaction channels is greater than or equal to a second preset threshold, whose outflow amount within a first preset time period is greater than or equal to a third preset threshold, and whose transaction amount through non-counter transaction channels within the first preset time period is greater than or equal to a fourth preset threshold; Acquire a second transaction number of abnormal deposit and access transactions executed by the target account, wherein the abnormal deposit and access transaction refers to a transaction in which cash with the target serial number is deposited into a second account again within a second preset time period after cash with the target serial number is withdrawn from the target account; Obtaining a third transaction number of inter-provincial transactions executed by the target account, wherein the inter-provincial transactions include at least one third account performing a transfer transaction to the target account through a counter transaction channel greater than or equal to a fifth preset threshold within a third preset time period, or at least one fourth account performing a transfer transaction to the target account through an automatic teller machine (ATM) channel within the third preset time period with a transaction amount greater than or equal to a sixth preset threshold; the third account and the target account belong to different provinces, and the fourth account and the target account belong to different provinces; Obtaining a fourth transaction number of abnormal cash withdrawal transactions executed by the target account, wherein the abnormal cash withdrawal transaction refers to a transaction in which cash is withdrawn from the target account for a preset multiple of the transaction amount within a fourth preset time period after the target account receives the transaction amount transferred from the fifth account, the preset multiple is within a preset interval, and the fifth account and the target account belong to different regions; Obtaining a fifth transaction number of the involved account transactions executed by the target account, wherein the involved account transactions refer to transactions in which, after a sixth account that has been determined to be an abnormal account transfers a transaction amount to the target account, the balance of the sixth account is less than or equal to a seventh preset threshold; Obtaining a first number of Internet Protocol addresses (IP addresses) of devices that log into the target account within a fifth preset time period; Obtain the number of second addresses whose IP addresses of devices that log into the target account within the fifth preset time period belong to preset high-risk areas; Acquiring special transaction information corresponding to the target account, the special transaction information including a sixth transaction number of executed counterparty concentrated transactions, wherein the counterparty concentrated transactions refer to the target account performing transfer transactions to one or two seventh accounts exceeding an eighth preset threshold number of times within a sixth preset time period, or the transfer transactions to the target account from one or two eighth accounts exceeding a ninth preset threshold number of times within the sixth preset time period; Inputting the first transaction number, the second transaction number, the third transaction number, the fourth transaction number, the fifth transaction number, the first address number, the second address number, and the special transaction information into a pre-built abnormal account identification model; obtaining a detection result of the target account through the abnormal account identification model, the detection result being that the target account is an abnormal account or that the target account is not an abnormal account; Among them, the abnormal account identification model takes the number of transactions between the sample account and the first account, the number of transactions that the sample account has executed the abnormal deposit and access transactions, the number of transactions that the sample account has executed the inter-provincial transactions, the number of transactions that the sample account has executed the abnormal cash withdrawal transactions, the number of transactions that the sample account has executed the account involved in the case, the number of IP addresses of the devices that logged into the sample account within the fifth preset time period, the number of addresses of the IP addresses of the devices that logged into the sample account within the fifth preset time period that belong to the preset high-risk areas, and the special transaction information corresponding to the sample account as input, and takes the labeling results of the sample accounts as training targets, and the labeling results obtained through training are that the sample account is an abnormal account or the sample account is not an abnormal account.

2. The abnormal account identification method according to claim 1, characterized in that: The special transaction information also includes: The target account has executed the seventh transaction number of the first sensitive transaction, the first sensitive transaction being a transaction in which the total amount of transfers from the target account to the ninth account within the seventh preset time period is greater than or equal to the tenth preset threshold value, the number of transfers from the target account to the ninth account within the seventh preset time period is greater than or equal to the eleventh preset threshold value, and the transfer amount is an integer multiple of 10, and the account name of the ninth account is the name of an enterprise representing living expenses in a different province from that of the target account; and / or, The target account has executed an eighth transaction number of a second sensitive transaction, wherein the second sensitive transaction refers to a transfer transaction from the target account to the tenth account greater than or equal to a twelfth preset threshold number of times within a single day, and the account name of the tenth account includes at least one keyword of loan, finance, and money; and / or, whether the target account has executed a third sensitive transaction, wherein the target account has executed zero transactions within an eighth preset time period, and only a number of transfer transactions greater than or equal to a thirteenth preset threshold value is executed to the donation institution account within a ninth preset time period, and the amount of transfer to the donation institution account is less than or equal to a fourteenth preset threshold value, and the time corresponding to the eighth preset time period is earlier than the time corresponding to the ninth preset time period, and the time corresponding to the eighth preset time period is adjacent to the time corresponding to the ninth preset time period; and / or, When the age of the customer of the target account is less than or equal to the preset age and the target account is a non-loan account, the target account has executed the ninth transaction number of frequent abnormal cash withdrawal transactions, and the frequent abnormal cash withdrawal transactions refer to cash withdrawal transactions executed from the target account greater than or equal to the fifteenth preset threshold number within the tenth preset time period, and different cash withdrawal transactions correspond to different ATM bank branches.

3. The abnormal account identification method according to claim 1 or 2, characterized in that: The method for determining the preset interval includes: Acquire a first amount and a first transaction time of an abnormal withdrawal transaction of an abnormal account, wherein the abnormal withdrawal transaction refers to a transaction of withdrawing cash from the abnormal account within the second preset time period after the fifth account transfers the transaction amount to the abnormal account; Acquire a second amount and a second transaction time of an abnormal payment collection transaction, wherein the abnormal payment collection transaction is a payment collection transaction in which the abnormal account receives an amount transferred from the fifth account; Acquire multiple sets of abnormal transaction sets, wherein the abnormal transaction sets include one abnormal withdrawal transaction and one abnormal collection transaction, the first transaction time of the abnormal withdrawal transactions in the same abnormal transaction set is later than the second transaction time of the abnormal collection transaction, and there is no abnormal withdrawal transaction and no abnormal collection transaction between the first transaction time and the second transaction time; Acquire a plurality of groups of sample points corresponding to the abnormal transaction sets, wherein the sample points corresponding to the abnormal transaction sets are ratios of the first amount of the abnormal withdrawal transactions in the abnormal transaction sets to the second amount of the abnormal receipt transactions in the abnormal transaction sets; Determine a first number of clusters to be divided and initial center points corresponding to the first number of clusters respectively; For each of the sample points, obtaining an absolute value of a difference between the sample point and the initial center points corresponding to the first number of clusters; dividing the sample points into clusters corresponding to the initial center points corresponding to the smallest absolute value of the difference, so as to obtain the first number of clusters; For each cluster, determine the mean of the sample points included in the cluster as the updated center point of the cluster; For each of the sample points, obtain the absolute value of the difference between the sample point and the update center points corresponding to the first number of clusters; divide the sample points into clusters corresponding to the update center points corresponding to the smallest absolute value of the difference to obtain the first number of clusters, return to the step for each cluster, determine the mean of the sample points included in the cluster as the update center point of the cluster, until the update center points corresponding to the first number of clusters are no longer changing; The preset interval is determined based on the first number of clusters.

4. The abnormal account identification method according to claim 3, characterized in that: The preset interval is [0.8, 1.2].

5. The abnormal account identification method according to claim 1, characterized in that: Also includes: Obtaining multiple candidate attribute features of the sample account; Acquire a plurality of linearly independent pending attribute features from the plurality of candidate attribute features; Obtaining importance values ​​corresponding to the plurality of pending attribute features, respectively, where the importance values ​​of the pending attribute features represent the extent to which the pending attribute features affect whether the sample account is an abnormal account; Acquire a plurality of attribute features whose importance values ​​are greater than or equal to a twentieth preset threshold value from the plurality of undetermined attribute features; Among them, the multiple attribute characteristics include: the number of transactions with the first account, the number of transactions of the abnormal deposit and access transactions, the number of transactions of the inter-provincial transactions, the number of transactions of the abnormal cash withdrawal transactions, the number of transactions of the account involved in the case, the number of IP addresses of the devices that logged into the sample account within the fifth preset time period, the number of second addresses of the devices that logged into the sample account within the fifth preset time period whose IP addresses belong to the preset high-risk areas, and the special transaction information corresponding to the sample account.

6. An abnormal account identification device, characterized in that: include: A first acquisition module, used to acquire a target account to be identified; The second acquisition module is used to acquire the first transaction number between the target account and the first account, the first account being a long-term no active transaction account or a stopped payroll account, whose daily transfer amount is greater than or equal to a first preset threshold, whose daily transaction amount through non-counter transaction channels is greater than or equal to a second preset threshold, whose transfer amount within a first preset time period is greater than or equal to a third preset threshold, and whose transaction amount through non-counter transaction channels within the first preset time period is greater than or equal to a fourth preset threshold; a third acquisition module, configured to acquire a second transaction number of abnormal deposit and access transactions executed by the target account, wherein the abnormal deposit and access transaction refers to a transaction in which cash with the target serial number is deposited into a second account again within a second preset time period after cash with the target serial number is withdrawn from the target account; a fourth acquisition module, configured to acquire a third transaction number of inter-provincial transactions executed by the target account, wherein the inter-provincial transactions include at least one third account performing a transfer transaction to the target account through an over-the-counter transaction channel greater than or equal to a fifth preset threshold number of times within a third preset time period, or at least one fourth account performing a transfer transaction to the target account through an ATM channel within the third preset time period with a transaction amount greater than or equal to a sixth preset threshold number; the third account and the target account belong to different provinces, and the fourth account and the target account belong to different provinces; a fifth acquisition module, configured to acquire a fourth transaction number of abnormal cash withdrawal transactions executed by the target account, wherein the abnormal cash withdrawal transaction refers to a transaction in which cash is withdrawn from the target account within a fourth preset time period after the target account receives the transaction amount transferred from the fifth account, and the preset multiple belongs to a preset interval, and the fifth account and the target account belong to different regions; a sixth acquisition module, configured to acquire a fifth transaction number of the involved account transactions executed by the target account, wherein the involved account transactions refer to transactions in which, after a sixth account that has been determined to be an abnormal account transfers a transaction amount to the target account, the balance of the sixth account is less than or equal to a seventh preset threshold; A seventh acquisition module, configured to acquire a first number of Internet Protocol addresses (IP addresses) of devices that log into the target account within a fifth preset time period; An eighth acquisition module, configured to acquire the number of second addresses of which the IP addresses of the devices that log into the target account within the fifth preset time period belong to the preset high-risk areas; a ninth acquisition module, configured to acquire special transaction information corresponding to the target account, wherein the special transaction information includes a sixth transaction number of executed counterparty concentrated transactions, wherein the counterparty concentrated transactions refer to the target account performing transfer transactions to one or two seventh accounts exceeding an eighth preset threshold number of times within a sixth preset time period, or the target account performing transfer transactions to one or two eighth accounts exceeding a ninth preset threshold number of times within the sixth preset time period; a tenth acquisition module, configured to input the first transaction number, the second transaction number, the third transaction number, the fourth transaction number, the fifth transaction number, the first address number, the second address number, and the special transaction information into a pre-built abnormal account identification model; and obtain a detection result of the target account through the abnormal account identification model, wherein the detection result is that the target account is an abnormal account or the target account is not an abnormal account; Among them, the abnormal account identification model takes the number of transactions between the sample account and the first account, the number of transactions that the sample account has executed the abnormal deposit and access transactions, the number of transactions that the sample account has executed the inter-provincial transactions, the number of transactions that the sample account has executed the abnormal cash withdrawal transactions, the number of transactions that the sample account has executed the account involved in the case, the number of IP addresses of the devices that logged into the sample account within the fifth preset time period, the number of addresses of the IP addresses of the devices that logged into the sample account within the fifth preset time period that belong to the preset high-risk areas, and the special transaction information corresponding to the sample account as input, and takes the labeling results of the sample accounts as training targets, and the labeling results obtained through training are that the sample account is an abnormal account or the sample account is not an abnormal account.

7. The abnormal account identification method according to claim 6, characterized in that: Also includes: an eleventh obtaining module, configured to obtain a first amount and a first transaction time of an abnormal withdrawal transaction of an abnormal account, wherein the abnormal withdrawal transaction refers to a transaction of withdrawing cash from the abnormal account within the second preset time period after the fifth account transfers the transaction amount to the abnormal account; A twelfth acquisition module is used to acquire a second amount and a second transaction time of an abnormal payment collection transaction, wherein the abnormal payment collection transaction is a payment collection transaction in which the abnormal account receives an amount transferred from the fifth account; A thirteenth acquisition module is used to acquire multiple groups of abnormal transaction sets, wherein the abnormal transaction set includes one abnormal withdrawal transaction and one abnormal collection transaction, the first transaction time of the abnormal withdrawal transactions in the same abnormal transaction set is later than the second transaction time of the abnormal collection transaction, and there is no abnormal withdrawal transaction and abnormal collection transaction between the first transaction time and the second transaction time; A fourteenth acquisition module is used to acquire a plurality of sample points corresponding to the abnormal transaction sets, wherein the sample points corresponding to the abnormal transaction sets are ratios of the first amount of the abnormal withdrawal transactions in the abnormal transaction sets to the second amount of the abnormal receipt transactions in the abnormal transaction sets; A first determining module, used to determine a first number of clusters to be divided and initial center points corresponding to the first number of clusters respectively; A fifteenth acquisition module is used to acquire, for each of the sample points, an absolute value of a difference between the sample point and the initial center points corresponding to the first number of clusters; and divide the sample points into clusters corresponding to the initial center points corresponding to the smallest absolute value of the difference, so as to obtain the first number of clusters; A second determination module is used to determine, for each cluster, a mean value of sample points included in the cluster as an updated center point of the cluster; A sixteenth acquisition module is configured to acquire, for each of the sample points, an absolute value of a difference between the sample point and the update center points respectively corresponding to the first number of clusters; divide the sample points into clusters corresponding to the update center points corresponding to the smallest absolute value of the difference to obtain the first number of clusters, and trigger the second determination module until the update center points respectively corresponding to the first number of clusters no longer change; The third determining module is configured to determine the preset interval based on the first number of clusters.

8. A computer program product, characterized in that It includes computer-readable instructions, and when the computer-readable instructions are executed on an electronic device, the electronic device implements the abnormal account identification method as described in any one of claims 1 to 5.

9. An electronic device, characterized in that: The method comprises at least one processor and a memory connected to the processor, wherein: The memory is used to store computer programs; The processor is used to execute the computer program so that the electronic device can implement the abnormal account identification method as described in any one of claims 1 to 5.

10. A computer storage medium, characterized in that: The storage medium carries one or more computer programs, and when the one or more computer programs are executed by an electronic device, the electronic device can implement the abnormal account identification method as described in any one of claims 1 to 5.

Images