Account exception identification method and device, electronic equipment and readable storage medium
By annotating and pre-processing the transaction data of bank account and identifying abnormal transactions using an abnormal identification model, the problem of false alarms and underreporting by banks when identifying economic illegal acts is solved, and the recognition efficiency and accuracy are improved.
Patent Information
- Application Number
- CN202310754531.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2023-06-25
- Publication Date
- 2024-12-27
AI Technical Summary
When existing banks identify economic illegal acts, simple quantitative indicators are easily evaded, and the quality of manual identification is uneven, resulting in serious false alarms and missed alarms, making it difficult to effectively detect illegal acts.
By obtaining account transaction data, labeling and preprocessing, the data is input into the pre-trained exception recognition model, using historical transaction data to train the model, construct a feature matrix and perform normalization processing, initially identify abnormal transaction data, and reduce the amount of labeled data , improve identification efficiency and accuracy.
It improves the speed and efficiency of abnormal transaction data identification, improves the accuracy of abnormal transaction behavior identification, and reduces false alarms and missed reports.
Smart Images
Figure CN119205321A_ABST
Abstract
Description
Technical Field
[0001] The present disclosure relates to the technical field of anomaly identification, and in particular to an account anomaly identification method, device, electronic device and readable storage medium. Background Art
[0002] Economic violations often require that the illegal income be concealed through banks, securities, etc. to conceal the source of funds and allow the funds to flow into different forms and fields. Due to the huge transaction volume of major banks, illegal activities are difficult to detect.
[0003] In order to timely discover the above-mentioned economic illegal activities, banks often use simple quantitative indicators or manual identification. However, simple quantitative indicators are often circumvented by illegal persons, and the quality of identification personnel varies, resulting in a large number of false positives and missed positives. Summary of the invention
[0004] In order to solve the problems in the related art, the embodiments of the present disclosure provide a method, device, electronic device and readable storage medium for identifying account anomalies.
[0005] In a first aspect, an embodiment of the present disclosure provides a method for identifying anomalies in an account, comprising:
[0006] Get account transaction data;
[0007] Marking the selected transaction data from the account transaction data, where the marking content at least includes the industry of the trader, the loan amount, and the bank rating;
[0008] Preprocess the labeled transaction data, then input the preprocessed data into a pretrained anomaly recognition model, and output a recognition result; wherein the anomaly recognition model is trained using historical transaction data and its corresponding labeled content as a training set.
[0009] According to an embodiment of the present disclosure, the preprocessing of the labeled transaction data includes:
[0010] Process the marked content numerically;
[0011] Constructing a feature matrix of the transaction data and the numerically processed annotation content;
[0012] The feature matrix is normalized.
[0013] According to an embodiment of the present disclosure, before marking the selected transaction data in the account transaction data, the method further includes:
[0014] Randomly select several transaction data from the account transaction data;
[0015] Preliminarily identify whether the transaction data is abnormal;
[0016] If so, the transaction data is taken as a marking object.
[0017] According to an embodiment of the present disclosure, the preliminary identification of whether the transaction data is abnormal includes:
[0018] Identify whether there is an abnormality based on the comparison between the current transaction amount and the maximum transaction amount in history; or,
[0019] Identify whether there is an abnormality based on the comparison of the amount fluctuation range calculated based on the current transaction amount and the previous transaction amount with the maximum amount fluctuation range in history; or
[0020] Identify whether there is an abnormality based on the comparison results of the transaction frequency in the current period with the maximum transaction frequency in the same period.
[0021] According to an embodiment of the present disclosure, the anomaly recognition model is trained in the following manner:
[0022] Constructing a historical feature matrix using the historical transaction data and its corresponding annotation content;
[0023] Dividing the historical feature matrix into training samples and test samples;
[0024] The training samples are used to train the anomaly recognition model, and the test samples are used to perform the test, so as to finally obtain the trained anomaly recognition model.
[0025] According to an embodiment of the present disclosure, the using the training sample to train the anomaly recognition model includes:
[0026] Dividing the training samples into positive samples and negative samples, wherein the positive samples are selected samples of normal transaction data, and the negative samples are selected samples of abnormal transaction data;
[0027] The positive samples and negative samples are used to train an anomaly recognition model.
[0028] In a second aspect, an embodiment of the present disclosure provides an account abnormality identification device, including:
[0029] An acquisition module, configured to acquire account transaction data;
[0030] a marking module configured to mark the selected transaction data in the account transaction data, wherein the marking content at least includes the industry of the trader, the loan amount, and the bank rating;
[0031] The training module is configured to pre-process the labeled transaction data, then input the pre-processed data into a pre-trained anomaly recognition model, and output a recognition result; wherein the anomaly recognition model is trained using historical transaction data and its corresponding labeled content as a training set.
[0032] According to an embodiment of the present disclosure, the part of the training module that pre-processes the labeled transaction data is configured as follows:
[0033] Process the marked content numerically;
[0034] Constructing a feature matrix of the transaction data and the numerically processed annotation content;
[0035] The feature matrix is normalized.
[0036] In a third aspect, an embodiment of the present disclosure provides an electronic device, comprising a memory and a processor, wherein the memory is used to store one or more computer instructions, and wherein the one or more computer instructions are executed by the processor to implement a method as described in any one of the first aspects.
[0037] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium on which computer instructions are stored. When the computer instructions are executed by a processor, the method described in any one of the first aspects is implemented.
[0038] According to the technical solution provided by the embodiment of the present disclosure, a method for identifying account anomalies is disclosed, including obtaining account transaction data; annotating selected transaction data from the account transaction data, wherein the annotated content at least includes the industry of the trader, the loan amount, and the bank rating; preprocessing the annotated transaction data, and then inputting the preprocessed data into a pre-trained anomaly recognition model, and outputting the recognition result; wherein the anomaly recognition model is trained using historical transaction data and its corresponding annotated content as a training set. The technical solution of the present disclosure can improve the recognition speed and efficiency of abnormal transaction data and improve the recognition accuracy of abnormal transaction behavior.
[0039] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS
[0040] Other features, objectives and advantages of the present disclosure will become more apparent through the following detailed description of non-limiting embodiments in conjunction with the accompanying drawings. In the accompanying drawings:
[0041] Figure 1 A flowchart showing a method for identifying anomalies in an account according to an embodiment of the present disclosure
[0042] Figure 2A structural block diagram of an account anomaly identification device according to an embodiment of the present disclosure is shown.
[0043] Figure 3 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown.
[0044] Figure 4 A schematic diagram showing the structure of a computer system suitable for implementing the method according to an embodiment of the present disclosure is shown. DETAILED DESCRIPTION
[0045] Hereinafter, exemplary embodiments of the present disclosure will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily implement them. In addition, for the sake of clarity, parts not related to the description of the exemplary embodiments are omitted in the accompanying drawings.
[0046] In the present disclosure, it should be understood that terms such as "include" or "have" are intended to indicate the presence of features, numbers, steps, behaviors, components, parts, or a combination thereof disclosed in the present specification, and are not intended to exclude the possibility that one or more other features, numbers, steps, behaviors, components, parts, or a combination thereof exist or are added.
[0047] It should also be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present disclosure may be combined with each other. The present disclosure will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.
[0048] In the present disclosure, if it involves operations of obtaining user information or user data or displaying user information or user data to others, the operations are all authorized and confirmed by the user, or actively selected by the user.
[0049] Economic violations often require that the illegal income be concealed through banks, securities, etc. to conceal the source of funds and allow the funds to flow into different forms and fields. Due to the huge transaction volume of major banks, illegal activities are difficult to detect.
[0050] In order to timely discover the above-mentioned economic illegal activities, banks often use simple quantitative indicators or manual identification. However, simple quantitative indicators are often circumvented by illegal persons, and the quality of identification personnel varies, resulting in a large number of false positives and missed positives.
[0051] In order to solve the above technical problems, the present application discloses a method for identifying account anomalies, including: obtaining account transaction data; annotating selected transaction data in the account transaction data, wherein the annotated content at least includes the industry of the trader, the loan amount, and the bank rating; preprocessing the annotated transaction data, and then inputting the preprocessed data into a pre-trained anomaly recognition model, and outputting the recognition result; wherein the anomaly recognition model is trained using historical transaction data and its corresponding annotated content as a training set. The present application obtains account transaction data, identifies and annotates abnormal transaction data in the account transaction data, forms a historical feature matrix, divides it into training samples and test samples, and then trains the anomaly recognition model to obtain a trained anomaly recognition model, thereby improving the recognition speed and efficiency of abnormal transaction data and the recognition accuracy of abnormal transaction behavior.
[0052] Figure 1 A flowchart of a method for identifying anomalies in an account according to an embodiment of the present disclosure is shown. Figure 1 As shown, the account abnormality identification method includes the following steps S101-S103:
[0053] In step S101, account transaction data is obtained;
[0054] In step S102, the selected transaction data in the account transaction data is annotated, and the annotated content at least includes the industry of the trader, the loan amount, and the bank rating;
[0055] In step S103, the labeled transaction data is preprocessed, and then the preprocessed data is input into a pre-trained anomaly recognition model to output a recognition result; wherein the anomaly recognition model is trained using historical transaction data and its corresponding labeled content as a training set.
[0056] In the disclosed method, the account transaction data obtained can come from the user's main account, or from the main account and related sub-accounts bound to the user at the same time. The main account / sub-account can store account transaction data such as the trader's account number, the transaction time of each transaction, the transaction amount, the transaction object (financial products or services), etc., as well as special information such as the trader's industry, loan amount, bank rating, etc. In the disclosed method, with the authorization of the user, the account containing special data is obtained first, and the account transaction data is obtained from the account. The basic information in the account can be partially missing, such as the lack of transaction time, which does not affect the subsequent abnormal identification.
[0057] In the disclosed method, after obtaining the account transaction data, the account transaction data are analyzed to make a preliminary judgment on the account abnormality. The specific technical details will be described in detail later. After the initial judgment of the abnormality, the account transaction data related to the abnormality can be selected for annotation, that is, the account transaction data is labeled, and then used as a training sample for the abnormality recognition model. Among them, the annotation content is obtained from the special information stored in the user's main account / sub-account, and at least the content of the trader's industry, loan amount, and bank rating is annotated for each account transaction data.
[0058] According to an embodiment of the present disclosure, the preprocessing of the labeled transaction data includes:
[0059] Process the marked content numerically;
[0060] Constructing a feature matrix of the transaction data and the numerically processed annotation content;
[0061] The feature matrix is normalized.
[0062] In the disclosed method, the marked content is numerically processed. For example, if the trader's industry is construction, it is converted to 1, the loan amount of 100,000 to 500,000 is converted to 2, and the bank rating is gold level, it is converted to 2, then the marked content is converted to 122; for another example, if the trader's industry is finance, it is converted to 3, the loan amount of 500,000 to 1,000,000 is converted to 3, and the bank rating is diamond level, it is converted to 4, then the marked content is converted to 334.
[0063] Each account transaction data is usually digitized. If it contains non-numerical content, it will be digitized accordingly. For example, the transaction objects mentioned above can be represented by numbers. For details, please refer to the relevant content of the prior art. It is not the focus of this application and will not be elaborated here.
[0064] After the transaction data and its annotation content are digitized, a feature matrix is constructed and normalized, and then they can be used as input data for the anomaly recognition model, thereby improving the efficiency of anomaly recognition.
[0065] According to an embodiment of the present disclosure, before marking the selected transaction data in the account transaction data, the account anomaly identification method further includes:
[0066] Randomly select several transaction data from the account transaction data;
[0067] Preliminarily identify whether the transaction data is abnormal;
[0068] If so, the transaction data is taken as a marking object.
[0069] In the disclosed method, it is necessary to select abnormal account transaction data, annotate them and use them for abnormality recognition model training. In view of reducing the amount of data to be annotated and reducing data processing costs, the account transaction data can be screened before annotating them, and only the account transaction data that may be abnormal can be annotated.
[0070] According to an embodiment of the present disclosure, the preliminary identification of whether the transaction data is abnormal includes:
[0071] Identify whether there is an abnormality based on the comparison between the current transaction amount and the maximum transaction amount in history; or,
[0072] Identify whether there is an abnormality based on the comparison of the amount fluctuation range calculated based on the current transaction amount and the previous transaction amount with the maximum amount fluctuation range in history; or
[0073] Identify whether there is an abnormality based on the comparison results of the transaction frequency in the current period with the maximum transaction frequency in the same period.
[0074] In the disclosed method, in order to preliminarily identify abnormal transaction data, by comparing the current transaction amount in the transaction data with the maximum amount of historical transactions, the current transaction amount, the amount fluctuation range calculated by the previous transaction amount and the maximum fluctuation range of the historical amount, or the transaction frequency of the current period and the maximum transaction frequency of the same period, analyze whether the transaction data belongs to abnormal transaction data. For example, when the current transaction amount is 30% or less higher than the maximum amount of historical transactions, it is low risk, when it is higher than 30% and lower than 60%, it is medium risk, and when it is greater than 60%, it is high risk; or, when the amount fluctuation range calculated by the current transaction amount and the previous transaction amount is higher than the maximum fluctuation range of the historical amount by less than 10%, it is low risk, when it is higher than 10% and lower than 40%, it is medium risk, and when it is greater than 40%, it is high risk; or, when the transaction frequency of the current period is 20% or less higher than the maximum transaction frequency of the same period, it is low risk, when it is higher than 20% and lower than 50%, it is medium risk, and when it is greater than 50%, it is high risk. The risk level is determined based on the above transaction data, and the transaction data identified as medium risk and high risk are labeled. For example, medium risk transaction data is labeled as N, and high risk transaction data is labeled as H. The labeled transaction data is then used to train the anomaly recognition model.
[0075] According to an embodiment of the present disclosure, the abnormality recognition model is trained in the following manner:
[0076] Constructing a historical feature matrix using the historical transaction data and its corresponding annotation content;
[0077] Dividing the historical feature matrix into training samples and test samples;
[0078] The training samples are used to train the anomaly recognition model, and the test samples are used to perform the test, so as to finally obtain the trained anomaly recognition model.
[0079] In the disclosed method, the network parameters are adjusted using the back propagation algorithm, and then retraining is performed until convergence or the number of training times is reached. At the same time, the abnormal recognition model is a deep neural network model with converged training; during the training process, the network nodes of the deep neural network model before training need to be compressed first. In this embodiment, the network nodes of all layers are compressed by dividing them by 2. Node compression can achieve model training convergence using less sample data, and can reduce the probability of overfitting during training; after node compression, the relevant loss function is selected. In this embodiment, the classic loss function of the deep neural network is used; at the same time, the loss function needs to be updated. In this embodiment, when updating, the regularization rule is used to regularize the network nodes of all layers of the neural network model before training to form a regularization term, and the regularization term is added to the original loss function to form an updated loss function.
[0080] According to an embodiment of the present disclosure, the using the training sample to train the anomaly recognition model includes:
[0081] Dividing the training samples into positive samples and negative samples, wherein the positive samples are selected samples of normal transaction data, and the negative samples are selected samples of abnormal transaction data;
[0082] The positive samples and negative samples are used to train an anomaly recognition model.
[0083] Figure 2 The structural block diagram of the account abnormality identification device according to the embodiment of the present disclosure is shown. The device can be implemented as part or all of the electronic device through software, hardware or a combination of both.
[0084] like Figure 2 As shown, the account anomaly identification device 200 includes an acquisition module 210 , a labeling module 220 , and a training module 230 .
[0085] An acquisition module 210 is configured to acquire account transaction data;
[0086] The marking module 220 is configured to mark the selected transaction data in the account transaction data, and the marking content at least includes the industry of the trader, the loan amount, and the bank rating;
[0087] The training module 230 is configured to pre-process the labeled transaction data, then input the pre-processed data into a pre-trained anomaly recognition model, and output a recognition result; wherein the anomaly recognition model is trained using historical transaction data and its corresponding labeled content as a training set.
[0088] In the disclosed method, the account transaction data obtained can come from the user's main account, or from the main account and related sub-accounts bound to the user at the same time. The main account / sub-account can store account transaction data such as the trader's account number, the transaction time of each transaction, the transaction amount, the transaction object (financial products or services), etc., as well as special information such as the trader's industry, loan amount, bank rating, etc. In the disclosed method, with the authorization of the user, the account containing special data is obtained first, and the account transaction data is obtained from the account. The basic information in the account can be partially missing, such as the lack of transaction time, which does not affect the subsequent abnormal identification.
[0089] In the disclosed method, after obtaining the account transaction data, the account transaction data are analyzed to make a preliminary judgment on the account abnormality. The specific technical details will be described in detail later. After the initial judgment of the abnormality, the account transaction data related to the abnormality can be selected for annotation, that is, the account transaction data is labeled, and then used as a training sample for the abnormality recognition model. Among them, the annotation content is obtained from the special information stored in the user's main account / sub-account, and at least the content of the trader's industry, loan amount, and bank rating is annotated for each account transaction data.
[0090] According to an embodiment of the present disclosure, the preprocessing of the labeled transaction data includes:
[0091] Process the marked content numerically;
[0092] Constructing a feature matrix of the transaction data and the numerically processed annotation content;
[0093] The feature matrix is normalized.
[0094] In the disclosed method, the marked content is numerically processed. For example, if the trader's industry is construction, it is converted to 1, the loan amount of 100,000 to 500,000 is converted to 2, and the bank rating is gold level, it is converted to 2, then the marked content is converted to 122; for another example, if the trader's industry is finance, it is converted to 3, the loan amount of 500,000 to 1,000,000 is converted to 3, and the bank rating is diamond level, it is converted to 4, then the marked content is converted to 334.
[0095] Each account transaction data is usually digitized. If it contains non-numerical content, it will be digitized accordingly. For example, the transaction objects mentioned above can be represented by numbers. For details, please refer to the relevant content of the prior art. It is not the focus of this application and will not be elaborated here.
[0096] After the transaction data and its annotation content are digitized, a feature matrix is constructed and normalized, and then they can be used as input data for the anomaly recognition model, thereby improving the efficiency of anomaly recognition.
[0097] According to an embodiment of the present disclosure, the account abnormality identification device further includes:
[0098] The anomaly identification module is configured to randomly select a number of transaction data from the account transaction data;
[0099] Preliminarily identify whether the transaction data is abnormal;
[0100] If so, the transaction data is taken as a marking object.
[0101] In the disclosed method, it is necessary to select abnormal account transaction data, annotate them and use them for abnormality recognition model training. In view of reducing the amount of data to be annotated and reducing data processing costs, the account transaction data can be screened before annotating them, and only the account transaction data that may be abnormal can be annotated.
[0102] According to an embodiment of the present disclosure, the preliminary identification of whether the transaction data is abnormal includes:
[0103] Identify whether there is an abnormality based on the comparison between the current transaction amount and the maximum transaction amount in history; or,
[0104] Identify whether there is an abnormality based on the comparison of the amount fluctuation range calculated based on the current transaction amount and the previous transaction amount with the maximum amount fluctuation range in history; or
[0105] Identify whether there is an abnormality based on the comparison results of the transaction frequency in the current period with the maximum transaction frequency in the same period.
[0106] In the disclosed method, in order to preliminarily identify abnormal transaction data, by comparing the current transaction amount in the transaction data with the maximum amount of historical transactions, the current transaction amount, the amount fluctuation range calculated by the previous transaction amount and the maximum fluctuation range of the historical amount, or the transaction frequency of the current period and the maximum transaction frequency of the same period, analyze whether the transaction data belongs to abnormal transaction data. For example, when the current transaction amount is 30% or less higher than the maximum amount of historical transactions, it is low risk, when it is higher than 30% and lower than 60%, it is medium risk, and when it is greater than 60%, it is high risk; or, when the amount fluctuation range calculated by the current transaction amount and the previous transaction amount is higher than the maximum fluctuation range of the historical amount by less than 10%, it is low risk, when it is higher than 10% and lower than 40%, it is medium risk, and when it is greater than 40%, it is high risk; or, when the transaction frequency of the current period is 20% or less higher than the maximum transaction frequency of the same period, it is low risk, when it is higher than 20% and lower than 50%, it is medium risk, and when it is greater than 50%, it is high risk. The risk level is determined based on the above transaction data, and the transaction data identified as medium risk and high risk are labeled. For example, medium risk transaction data is labeled as N, and high risk transaction data is labeled as H. The labeled transaction data is then used to train the anomaly recognition model.
[0107] According to an embodiment of the present disclosure, the abnormality recognition model is trained in the following manner:
[0108] Constructing a historical feature matrix using the historical transaction data and its corresponding annotation content;
[0109] Dividing the historical feature matrix into training samples and test samples;
[0110] The training samples are used to train the anomaly recognition model, and the test samples are used to perform the test, so as to finally obtain the trained anomaly recognition model.
[0111] In the disclosed method, the network parameters are adjusted using the back propagation algorithm, and then retraining is performed until convergence or the number of training times is reached. At the same time, the abnormal recognition model is a deep neural network model with converged training; during the training process, the network nodes of the deep neural network model before training need to be compressed first. In this embodiment, the network nodes of all layers are compressed by dividing them by 2. Node compression can achieve model training convergence using less sample data, and can reduce the probability of overfitting during training; after node compression, the relevant loss function is selected. In this embodiment, the classic loss function of the deep neural network is used; at the same time, the loss function needs to be updated. In this embodiment, when updating, the regularization rule is used to regularize the network nodes of all layers of the neural network model before training to form a regularization term, and the regularization term is added to the original loss function to form an updated loss function.
[0112] According to an embodiment of the present disclosure, the using the training sample to train the anomaly recognition model includes:
[0113] Dividing the training samples into positive samples and negative samples, wherein the positive samples are selected samples of normal transaction data, and the negative samples are selected samples of abnormal transaction data;
[0114] The positive samples and negative samples are used to train an anomaly recognition model.
[0115] The present disclosure also discloses an electronic device, Figure 3 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown.
[0116] like Figure 3 As shown, the electronic device includes a memory and a processor, wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method according to an embodiment of the present disclosure.
[0117] Get account transaction data;
[0118] Marking the selected transaction data from the account transaction data, where the marking content at least includes the industry of the trader, the loan amount, and the bank rating;
[0119] Preprocess the labeled transaction data, then input the preprocessed data into a pretrained anomaly recognition model, and output a recognition result; wherein the anomaly recognition model is trained using historical transaction data and its corresponding labeled content as a training set.
[0120] The present invention obtains account transaction data, identifies and marks abnormal transaction data in the account transaction data, forms a historical feature matrix, divides the matrix into training samples and test samples, and then trains an abnormality recognition model to obtain a trained abnormality recognition model, thereby improving the recognition speed and efficiency of abnormal transaction data and the recognition accuracy of abnormal transaction behavior.
[0121] According to an embodiment of the present disclosure, the preprocessing of the labeled transaction data includes:
[0122] Process the marked content numerically;
[0123] Constructing a feature matrix of the transaction data and the numerically processed annotation content;
[0124] The feature matrix is normalized.
[0125] According to an embodiment of the present disclosure, before marking the selected transaction data in the account transaction data, the method further includes:
[0126] Randomly select several transaction data from the account transaction data;
[0127] Preliminarily identify whether the transaction data is abnormal;
[0128] If so, the transaction data is taken as a marking object.
[0129] According to an embodiment of the present disclosure, the preliminary identification of whether the transaction data is abnormal includes:
[0130] Identify whether there is an abnormality based on the comparison between the current transaction amount and the maximum transaction amount in history; or,
[0131] Identify whether there is an abnormality based on the comparison of the amount fluctuation range calculated based on the current transaction amount and the previous transaction amount with the maximum amount fluctuation range in history; or
[0132] Identify whether there is an abnormality based on the comparison results of the transaction frequency in the current period with the maximum transaction frequency in the same period.
[0133] According to an embodiment of the present disclosure, the anomaly recognition model is trained in the following manner:
[0134] Constructing a historical feature matrix using the historical transaction data and its corresponding annotation content;
[0135] Dividing the historical feature matrix into training samples and test samples;
[0136] The training samples are used to train the anomaly recognition model, and the test samples are used to perform the test, so as to finally obtain the trained anomaly recognition model.
[0137] According to an embodiment of the present disclosure, the using the training sample to train the anomaly recognition model includes:
[0138] Dividing the training samples into positive samples and negative samples, wherein the positive samples are selected samples of normal transaction data, and the negative samples are selected samples of abnormal transaction data;
[0139] The positive samples and negative samples are used to train an anomaly recognition model.
[0140] Figure 4 A schematic diagram showing the structure of a computer system suitable for implementing the method according to an embodiment of the present disclosure is shown.
[0141] like Figure 4 As shown, the computer system includes a processing unit, which can perform the various methods in the above-mentioned embodiments according to the program stored in the read-only memory (ROM) or the program loaded from the storage part into the random access memory (RAM). In the RAM, various programs and data required for the operation of the computer system are also stored. The processing unit, ROM and RAM are connected to each other through a bus. The input / output (I / O) interface is also connected to the bus.
[0142] The following components are connected to the I / O interface: an input part including a keyboard, a mouse, etc.; an output part including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage part including a hard disk, etc.; and a communication part including a network interface card such as a LAN card, a modem, etc. The communication part performs a communication process via a network such as the Internet. The drive is also connected to the I / O interface as needed. Removable media, such as disks, optical disks, magneto-optical disks, semiconductor memories, etc., are installed on the drive as needed so that the computer program read therefrom is installed into the storage part as needed. Among them, the processing unit can be implemented as a processing unit such as a CPU, a GPU, a TPU, an FPGA, an NPU, etc.
[0143] In particular, according to an embodiment of the present disclosure, the method described above can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program tangibly contained on a machine-readable medium, and the computer program includes a program code for executing the above method. In such an embodiment, the computer program can be downloaded and installed from a network through a communication part, and / or installed from a removable medium.
[0144] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.
[0145] The units or modules involved in the embodiments described in the present disclosure may be implemented by software or programmable hardware. The units or modules described may also be set in a processor, and the names of these units or modules do not constitute limitations on the units or modules themselves in some cases.
[0146] As another aspect, the present disclosure further provides a computer-readable storage medium, which may be a computer-readable storage medium included in the electronic device or computer system in the above embodiment; or a computer-readable storage medium that exists independently and is not assembled into a device. The computer-readable storage medium stores one or more programs, and the programs are used by one or more processors to execute the method described in the present disclosure.
[0147] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present disclosure is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the inventive concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other.
Claims
1. A method for identifying account anomalies, characterized in that: include: Get account transaction data; Marking the selected transaction data from the account transaction data, where the marking content at least includes the industry of the trader, the loan amount, and the bank rating; Preprocess the labeled transaction data, then input the preprocessed data into a pretrained anomaly recognition model, and output a recognition result; wherein the anomaly recognition model is trained using historical transaction data and its corresponding labeled content as a training set.
2. The method for identifying account anomalies according to claim 1, characterized in that: The preprocessing of the labeled transaction data includes: Process the marked content numerically; Constructing a feature matrix of the transaction data and the numerically processed annotation content; The feature matrix is normalized.
3. The method for identifying account anomalies according to claim 1, characterized in that: Before marking the selected transaction data in the account transaction data, the method further includes: Randomly select several transaction data from the account transaction data; Preliminarily identify whether the transaction data is abnormal; If so, the transaction data is taken as a marking object.
4. The method for identifying account anomalies according to claim 3, characterized in that: The preliminary identification of whether the transaction data is abnormal includes: Identify whether there is an abnormality based on the comparison between the current transaction amount and the maximum transaction amount in history; or, Identify whether there is an abnormality based on the comparison of the amount fluctuation range calculated based on the current transaction amount and the previous transaction amount with the maximum amount fluctuation range in history; or Identify whether there is an abnormality based on the comparison results of the transaction frequency in the current period with the maximum transaction frequency in the same period.
5. The method for identifying account anomalies according to claim 1, characterized in that: The anomaly recognition model is trained in the following way: Constructing a historical feature matrix using the historical transaction data and its corresponding annotation content; Dividing the historical feature matrix into training samples and test samples; The training samples are used to train the anomaly recognition model, and the test samples are used to perform the test, so as to finally obtain the trained anomaly recognition model.
6. The method for identifying account anomalies according to claim 5, characterized in that: The using the training samples to train the anomaly recognition model includes: Dividing the training samples into positive samples and negative samples, wherein the positive samples are selected samples of normal transaction data, and the negative samples are selected samples of abnormal transaction data; The positive samples and negative samples are used to train an anomaly recognition model.
7. An account abnormality identification device, characterized in that: include: an acquisition module, configured to acquire account transaction data; a marking module configured to mark the selected transaction data in the account transaction data, wherein the marking content at least includes the industry of the trader, the loan amount, and the bank rating; The training module is configured to pre-process the labeled transaction data, then input the pre-processed data into a pre-trained anomaly recognition model, and output a recognition result; wherein the anomaly recognition model is trained using historical transaction data and its corresponding labeled content as a training set.
8. The device for identifying abnormal accounts according to claim 7, characterized in that: The part of the training module that pre-processes the labeled transaction data is configured as follows: Process the marked content numerically; Constructing a feature matrix of the transaction data and the numerically processed annotation content; The feature matrix is normalized.
9. An electronic device, characterized in that: The method comprises a memory and a processor; wherein the memory is used to store one or more computer instructions, wherein the one or more computer instructions are executed by the processor to implement the method steps described in any one of claims 1-6.
10. A computer-readable storage medium having computer instructions stored thereon, characterized in that: When the computer instructions are executed by a processor, the method steps described in any one of claims 1 to 6 are implemented.