Abnormal transaction account identification method and device, equipment, storage medium and program product

Abstract

The embodiment of the invention provides an abnormal transaction account identification method and device, equipment, a storage medium and a program product. Relates to the field of artificial intelligence. The method comprises the following steps: acquiring transaction flow data of a to-be-identified account in a to-be-identified time period; extracting transaction time sequence features corresponding to the transaction flow data, and determining corresponding transaction behavior features based on the transaction flow data by adopting at least one unsupervised learning algorithm; fusing the transaction time sequence feature with the at least one transaction behavior feature to obtain a target transaction feature; and identifying whether the to-be-identified account is an abnormal transaction account or not based on the target transaction feature by adopting an abnormal transaction account identification model trained to be converged, so as to obtain a first identification result. According to the method provided by the invention, the artificial features and the features extracted by the algorithm are fused to increase the abnormal transaction information, and the abnormal behavior in the account transaction can be fully mined according to the fused features to improve the accuracy of abnormal transaction account identification.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a method, device, equipment, storage medium and program product for identifying abnormal transaction accounts. Background Art

[0002] In recent years, the number of trading accounts in the financial system has been growing rapidly year by year, and the number of abnormal trading accounts has also been increasing rapidly. With the rapid development of network technology and artificial intelligence, the means of abnormal transactions have become more complicated, which has brought great challenges to the financial system in identifying abnormal transactions.

[0003] The identification of abnormal trading accounts in the financial system mainly relies on the preset rules based on the experience of experts. However, this method of identifying abnormal trading accounts through artificial preset rules is difficult to cope with the ever-changing abnormal trading behaviors, and cannot fully identify abnormal trading accounts, resulting in a low accuracy rate in identifying abnormal trading accounts. Summary of the invention

[0004] The present application provides an apparatus, a device, a storage medium and a program product to solve the problem that the prior art cannot fully identify abnormal transaction accounts, resulting in a low accuracy rate in identifying abnormal transaction accounts.

[0005] In a first aspect, the present application provides a method for identifying abnormal transaction accounts, comprising:

[0006] Obtain transaction flow data of the account to be identified within the time period to be identified;

[0007] Extracting transaction time series features corresponding to the transaction flow data, and using at least one unsupervised learning algorithm to determine corresponding transaction behavior features based on the transaction flow data;

[0008] fusing the transaction time series feature with at least one transaction behavior feature to obtain a target transaction feature;

[0009] An abnormal transaction account identification model trained to convergence is used to identify whether the account to be identified is an abnormal transaction account based on the target transaction feature to obtain a first identification result, wherein the abnormal transaction account identification model is a preset supervised learning model.

[0010] In a possible design, extracting transaction time series features corresponding to the transaction flow data includes:

[0011] Using a retrieval tool of a preset database to search the transaction flow data in multiple preset data dimensions in a slicing or sliding window manner to obtain transaction time series data;

[0012] The transaction time series data is discretized to obtain transaction time series features.

[0013] In one possible design, the unsupervised learning algorithm includes a first unsupervised learning algorithm, a second unsupervised learning algorithm and a third unsupervised learning algorithm;

[0014] The using at least one unsupervised learning algorithm to determine the corresponding transaction behavior characteristics based on the transaction flow data includes:

[0015] Inputting the transaction flow data into a first unsupervised learning algorithm, and using the first unsupervised learning algorithm to determine a first transaction behavior feature, wherein the first transaction behavior feature is whether the account to be identified is an account with a clearing behavior feature;

[0016] Inputting the transaction flow data into a second unsupervised learning algorithm, and using the second unsupervised learning algorithm to determine a second transaction behavior feature, wherein the second transaction behavior feature is whether the account to be identified is an account with abnormal group suspicion features;

[0017] The transaction flow data is input into a third unsupervised learning algorithm, and the third unsupervised learning algorithm is used to determine a third transaction behavior feature, wherein the third transaction behavior feature is whether the account to be identified is an account with a silent period greater than a preset time length and explosive transaction characteristics before or after the silent period.

[0018] In a possible design, the fusion of the transaction time series feature with at least one transaction behavior feature to obtain a target transaction feature includes:

[0019] The transaction time series feature and at least one transaction behavior feature are spliced ​​in a preset order to obtain a target transaction feature.

[0020] In a possible design, the abnormal transaction account identification model trained to convergence is obtained by stage training. The training steps of the abnormal transaction account identification model in the current stage include:

[0021] Acquire current-stage training samples corresponding to the abnormal transaction account identification model, wherein the current-stage training samples include positive samples and negative samples, wherein the negative samples are samples of suspicious accounts identified by the abnormal transaction account identification model in the previous stage and confirmed by the regulatory subject; the current-stage training samples include sample transaction features and sample category labels, wherein the sample transaction features are obtained by fusing the transaction time series features of the sample account in the current stage with at least one transaction behavior feature, wherein the at least one transaction behavior feature is determined based on the transaction flow data of the sample account by using at least one unsupervised learning algorithm;

[0022] The abnormal transaction account identification model trained in the previous stage is trained using the current stage training samples to obtain the abnormal transaction account identification model trained in the current stage.

[0023] In a possible design, after the abnormal transaction account identification model trained in the previous stage is trained using the current stage training samples, the method further includes:

[0024] Using the abnormal transaction account identification model trained in the current stage to identify whether the predicted sample is a suspicious account, so as to obtain a second identification result;

[0025] sending the top N suspicious account information with higher suspicion in the second identification result to the supervised device, so that the supervised device determines whether the suspicious account is an abnormal transaction account based on the suspicious account information;

[0026] Receiving a determination result sent by a supervised object device, wherein the determination result includes abnormal transaction account information;

[0027] Negative samples of training samples in the next stage are determined based on the abnormal transaction account information.

[0028] In a possible design, before using the abnormal transaction account identification model trained to convergence and identifying whether the account to be identified is an abnormal transaction account based on the target transaction feature to obtain a first identification result, the method further includes:

[0029] Obtain the model file, dependency packages, and Docker image of the abnormal trading account identification model that has been trained to convergence;

[0030] Deploy the model file, dependent packages and Docker image to the preset operating environment;

[0031] The step of using the abnormal transaction account identification model trained to convergence and identifying whether the account to be identified is an abnormal transaction account based on the target transaction feature to obtain a first identification result includes:

[0032] In a preset operating environment, an abnormal transaction account identification model trained to convergence is used to identify whether the account to be identified is an abnormal transaction account based on the target transaction feature to obtain a first identification result.

[0033] In a possible design, the preset supervised learning model is a lightweight gradient boosting machine LightGBM.

[0034] In one possible design, the training step of the abnormal transaction account identification model is performed on a software as a service (SaaS) platform.

[0035] In a second aspect, the present application provides a device for identifying abnormal transaction accounts, comprising:

[0036] An acquisition module is used to acquire transaction flow data of the account to be identified within the time period to be identified;

[0037] An extraction module, used to extract transaction time series features corresponding to the transaction flow data, and determine corresponding transaction behavior features based on the transaction flow data using at least one unsupervised learning algorithm;

[0038] A fusion module, used for fusing the transaction time series feature with at least one transaction behavior feature to obtain a target transaction feature;

[0039] The identification module is used to use the abnormal transaction account identification model trained to convergence and identify whether the account to be identified is an abnormal transaction account based on the target transaction feature to obtain a first identification result, wherein the abnormal transaction account identification model is a preset supervised learning model.

[0040] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0041] The memory stores computer-executable instructions;

[0042] The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of the first aspects.

[0043] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the method described in the first aspect.

[0044] In a fifth aspect, the present application provides a computer program product, including a computer program, which implements the method described in the first aspect when executed by a processor.

[0045] The abnormal transaction account identification method, device, equipment, storage medium and program product provided by the present application obtain the transaction flow data of the account to be identified within the time period to be identified; extract the transaction time series features corresponding to the transaction flow data, and use at least one unsupervised learning algorithm to determine the corresponding transaction behavior features based on the transaction flow data; fuse the transaction time series features with at least one transaction behavior feature to obtain the target transaction feature; use the abnormal transaction account identification model trained to convergence and identify whether the account to be identified is an abnormal transaction account based on the target transaction feature to obtain the first identification result, and the abnormal transaction account identification model is a preset supervised learning model. The transaction time series features are fused with at least one transaction feature, and by analyzing the fused features, it not only makes up for the deficiency of abnormal transaction feature information caused by relying only on artificial preset rules, but also can more comprehensively characterize the transaction features of normal customers and abnormal customers. Therefore, when the abnormal transaction account identification model based on the fused features is trained and identified, the fused features can provide the model with richer transaction information features. Therefore, the application of the abnormal transaction account identification model can more accurately identify abnormal transaction accounts and improve the accuracy of abnormal transaction account identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0047] Figure 1 An application scenario diagram of the abnormal transaction account identification method provided in an embodiment of the present application;

[0048] Figure 2 A flowchart of a method for identifying abnormal transaction accounts provided in one embodiment of the present application;

[0049] Figure 3 A flowchart of a method for identifying abnormal transaction accounts provided in another embodiment of the present application;

[0050] Figure 4 A schematic diagram of a device for an abnormal transaction account identification method provided in an embodiment of the present application;

[0051] Figure 5 It is a schematic diagram of the structure of an electronic device provided in one embodiment of the present application.

[0052] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0053] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0054] In the technical solution of this application, the collection, storage, use, processing, transmission, provision and disclosure of information such as financial data or user data involved shall comply with the provisions of relevant laws and regulations and shall not violate public order and good morals.

[0055] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0056] First, the terms involved in this application are explained:

[0057] SaaS: It is the abbreviation of Software-as-a-Service, which means software as a service, that is, providing software services through the Internet.

[0058] lightGBM: It is the abbreviation of Light Gradient Boosting Machine. It is a distributed gradient boosting framework based on the decision tree algorithm, also known as a lightweight gradient boosting machine.

[0059] Postgresql: Postgresql is a free software object-relational database management system with a very complete set of features. It is an object-relational database management system.

[0060] Docker: It is an open source application container engine that allows developers to package their applications and dependent packages into a portable image, and then publish it to any popular Linux or Windows operating system machine, and can also achieve virtualization. The container is completely sandboxed, and there is no interface between them.

[0061] In order to clearly understand the technical solution of the present application, the solution of the prior art is first introduced in detail.

[0062] In the financial system, when judging abnormal transaction behaviors, abnormal transaction accounts are often judged by artificial preset rules. The method of confirming abnormal transaction accounts based on artificial preset rules is determined based on the experience and knowledge of experts in a specific field and the need to comply with the conventional logic of financial institutions' business operations. For example, based on past abnormal transaction behaviors, it is known that abnormal transaction behaviors usually involve abnormal transaction amounts, transaction times, transaction locations or transaction parties; or, any transaction exceeding a certain amount requires additional identity verification; or accounts that conduct multiple small transactions in a short period of time will be marked as suspicious, etc. This method of judging the abnormal transaction list only by artificial preset rules is difficult to identify the ever-changing abnormal transaction behaviors, resulting in a low accuracy rate in identifying abnormal transaction accounts.

[0063] Therefore, in the face of existing technical problems, in order to improve the accuracy of abnormal transaction account identification, more abundant transaction features associated with abnormal transactions can be extracted, and the transaction time series features extracted based on transaction flow data can reflect the characteristics of dynamic changes in transaction behavior, and various unsupervised learning algorithms can dig out features with typical abnormal transaction behaviors, so the transaction time series features can be fused with the transaction behavior features extracted by at least one unsupervised learning algorithm, effectively enriching the extracted target transaction features. The supervised learning model has the characteristics of strong recognition ability and high precision, so the fused features can be input into the supervised learning model trained to convergence and identify whether the account to be identified is an abnormal transaction account based on the target transaction features, which can more accurately identify abnormal transaction accounts and improve the accuracy of abnormal transaction account identification.

[0064] Figure 1 The following is an application scenario diagram of the abnormal transaction account identification method provided in the embodiment of the present application. In this application scenario, a terminal device 101, a response server 102 and a computing server 103 may be included. The computing server 103 may be integrated with a high-performance computing platform (for example, a SaaS platform); the SaaS platform may Figure 1An application scenario diagram of the abnormal transaction account identification method provided in the embodiment of the present application, in which a terminal device 101, a response server 102 and a computing server 103 may be included. The computing server 103 may integrate a high-performance computing platform (e.g., a SaaS platform); the SaaS platform may store and process data through a database (e.g., a Postgresql database), and may also perform algorithmic operations, etc. The response server 102 is used to obtain the transaction flow data generated by the terminal device and report the transaction flow data to the computing server 103. Specifically, the user conducts transactions through the financial system webpage or the financial system APP on the terminal device 101, the response server 102 records the transaction flow data of the terminal device 101, and transmits it to the computing server 103, and the computing server 103 stores the transaction flow data through the Postgresql database. When the abnormal transaction account screening conditions are met, the Postgresql of the computing server 103 extracts the transaction flow data of each account within the preset time and generates transaction time series features; the algorithm operation module of the computing server 103 obtains the transaction flow data from the Postgresql database and inputs it into at least one unsupervised algorithm model, which can determine at least one transaction behavior feature; the algorithm operation module of the computing server 103 merges the transaction time series with the transaction behavior feature to generate the target transaction feature, and then inputs the target transaction feature into the abnormal transaction account identification model trained to convergence to generate the first identification result. Among them, the preset time can be one month, one quarter, etc., which is not limited here.

[0065] It is understandable that in another application scenario, only the terminal device 101 and the response server 102 may be included. Then, the abnormal transaction account identification method of this solution may also be executed in the response server 102, which is not limited in the embodiments of the present application.

[0066] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0067] Figure 2 A flowchart of abnormal transaction account identification provided in an embodiment of the application is as follows: Figure 2As shown, the execution subject of this embodiment is an abnormal transaction account identification device, which can be implemented by a computer program; it can also be implemented by a medium storing relevant computer programs, such as a USB flash drive and / or a CD, or it can also be implemented by a physical device integrated or installed with relevant computer programs, such as a chip or an abnormal transaction account identification device. The abnormal transaction account identification device can be a server (such as a computing server 103, a response server 102, etc.), a server cluster or other electronic devices, etc. The abnormal transaction account identification method provided in this embodiment includes the following steps:

[0068] Step S201: Acquire transaction flow data of the account to be identified within the time period to be identified;

[0069] The account to be identified may be a public account or a private account. A public account is an account opened by an enterprise in a financial institution for daily business, and a private account is an account opened by an individual user in a financial institution.

[0070] The time period to be identified refers to a preset period of time, which can be the most recent month, the most recent quarter, the most recent year, etc., and can be set according to actual needs.

[0071] Transaction flow data refers to a data set containing detailed information about each transaction of a corresponding account. Transaction flow data may include account information, date and time of account business operations, deposit amount and number of deposits when the account business operation is a deposit, withdrawal amount and number of withdrawals when the account business operation is a withdrawal, transfer amount and number of transfers when the account business operation is a transfer, etc.;

[0072] Specifically, the database of the server retrieves each account to be identified in its data storage table, and extracts all transaction flow data of each account to be identified according to the time period to be identified.

[0073] Step S202: extracting transaction time series features corresponding to the transaction flow data, and using at least one unsupervised learning algorithm to determine corresponding transaction behavior features based on the transaction flow data;

[0074] Among them, the transaction time series features are transaction features in the form of a sequence determined by the transaction time dimension, and may include: the total deposit amount features, total withdrawal amount features, total transfer amount features, total withdrawal times features, total deposit times features, total transfer times features, whether the account performs account business operations on a working day and whether it is a working time feature, etc., of the account in each statistical time period divided by the time period to be identified.

[0075] Among them, the transaction behavior characteristics refer to the behavioral characteristics of whether there is suspicion of abnormal transaction accounts.

[0076] Optionally, in this embodiment, the database in the server converts the transaction flow data into transaction time series features through database operations. The algorithm operation module of the server obtains the transaction flow data from the database, and inputs the transaction flow data into at least one unsupervised learning algorithm, and generates corresponding transaction behavior features through prediction by the unsupervised learning algorithm.

[0077] Step S203: Fusing the transaction time series feature with at least one transaction behavior feature to obtain a target transaction feature;

[0078] The target transaction feature is the transaction feature ultimately used when identifying the account to be identified, which is the feature obtained by fusing the transaction time transaction sequence with at least one transaction behavior feature.

[0079] Optionally, in this embodiment, the transaction time series feature and at least one transaction behavior feature may be normalized, and sorted after the normalization, and the sorted features may be determined as target transaction features.

[0080] Step S204: using the abnormal transaction account identification model trained to convergence and identifying whether the account to be identified is an abnormal transaction account based on the target transaction features to obtain a first identification result, wherein the abnormal transaction account identification model is a preset supervised learning model.

[0081] The first identification result refers to: the result generated by predicting the characteristics of the account to be identified by the abnormal transaction account identification model that has been trained to convergence.

[0082] The abnormal transaction account identification model is a model for identifying whether the account to be identified is an abnormal transaction account. The abnormal transaction account identification model trained to convergence is a model trained to convergence of the preset abnormal transaction account model, which is used to identify abnormal transaction accounts.

[0083] Optionally, the abnormal transaction account identification model is preset with a supervised learning model, such as LightGBM, logistic regression, support vector machine, etc., which is not limited in this embodiment.

[0084] Specifically, the target transaction features generated in step 203 are input into the trained converged abnormal transaction account model, and the trained converged abnormal transaction account model is used to process and classify the target transaction features, and output whether the account to be identified is an abnormal transaction account or not. Alternatively, the probability of being an abnormal transaction account is output, and whether it is an abnormal transaction account is determined based on the probability of the abnormal transaction account and the preset probability threshold. The preset probability threshold can be 95%, 90%, etc., which is not limited in this embodiment.

[0085] In this embodiment, the transaction flow data of the account to be identified within the time period to be identified is obtained;

[0086] The transaction time series features corresponding to the transaction flow data are extracted, and at least one unsupervised learning algorithm is used to determine the corresponding transaction behavior features based on the transaction flow data; the transaction time series features are fused with at least one transaction behavior feature to obtain the target transaction feature; the abnormal transaction account identification model trained to convergence is used to identify whether the account to be identified is an abnormal transaction account based on the target transaction feature to obtain the first identification result, and the abnormal transaction account identification model is a preset supervised learning model. The use of an unsupervised learning algorithm to determine the transaction behavior features can deeply explore the potential rules and anomalies in the account transaction pattern; the fusion of the transaction time series features and the transaction behavior features can obtain a richer target transaction feature solution that can cover all transaction activities of the account within the time period, ensuring the comprehensiveness of the target transaction features; and then the abnormal account transaction identification model trained to convergence is used to identify the fused features, which can more accurately identify abnormal transaction accounts. In this way, the recognition accuracy of abnormal transaction accounts is improved.

[0087] As an optional implementation, based on the above embodiment, extracting transaction time series features corresponding to the transaction flow data includes:

[0088] Use the search tool of the preset database to search the transaction flow data in multiple preset data dimensions in a slice or sliding window manner to obtain transaction time series data;

[0089] The transaction time series data is discretized to obtain the transaction time series characteristics.

[0090] The preset database may be Postgresql or other databases with search tools, which is not limited in this embodiment.

[0091] The database search tool refers to a tool that implements data operations and other functions through structured query statements. Optionally, the search tool can be used to search for transaction flow data within an identified time period based on the account name, and the transaction time series data can be extracted in a slice or sliding window manner based on the searched transaction flow data.

[0092] Optionally, the transaction flow data is sliced ​​to extract transaction time series data, which can be specifically: the transaction flow data is divided or sampled at fixed time intervals, such as dividing the transaction flow data from January to March at fixed time intervals such as weekly or half-monthly, or sampling the transaction flow data from January to March at weekly or half-monthly intervals, such as sampling the transaction flow data from January 1 to January 15 and January 20 to February 4. Multi-dimensional statistics are performed based on the divided transaction flow data or the sampled transaction flow data to obtain transaction time series features.

[0093] Among them, multi-dimensional statistics are performed based on the divided transaction flow data or the sampled transaction flow data to obtain transaction timing characteristics, specifically, the divided or sampled transaction flow data are counted according to the date and time of account business operations in the fixed time period of division or sampling, the total amount of deposits, the total amount of withdrawals, the total amount of transfers, the total number of withdrawals, the total number of deposits, the total number of transfers, whether the account business operations are performed on working days and whether it is working hours, etc., to obtain transaction timing characteristics.

[0094] Optionally, if the account performs account business operations on a working day, it can be represented as 1, and if it is not a working day, it can be represented as 0. If it is working time, it can be represented as 1, and if it is not working time, it can be represented as 0.

[0095] Optionally, a sliding window method is used to extract transaction time series data from transaction flow data, specifically: the window length and step length of the sliding window are preset, and the sliding window is allowed to slide according to the corresponding step length. Multi-dimensional statistics are performed on the transaction flow data where each sliding window is located, and the statistical features corresponding to each sliding window constitute the transaction time series features.

[0096] The statistical features corresponding to each sliding window are similar to the statistical features corresponding to the slice, which is not limited in this embodiment.

[0097] Among them, the step size can be a fixed step size or a step size set according to a preset rule. For example, the preset rule can be a gradually increasing step size set according to an arithmetic progression. Optionally, the end time of the previous sliding window and the start time of the next sliding window can be the same or overlap, which is not limited in this embodiment.

[0098] Discretization is the process of converting continuous values ​​into discrete values. Optionally, it can include bucket statistics.

[0099] For example, in this embodiment, the total amount of deposits for account business operations performed by an account in each fixed time period or in a sliding window can be discretized by bucketing statistics. The bucketing width can be set, and the amount within each width range can be regarded as a category, i.e., a bucket; each bucket can be subjected to a labeling operation similar to labeling, and can be marked as 0, 1, 2, etc.; the specific bucketing width or labeling method can be set according to needs and is not limited here. The total amount of withdrawals, total amount of transfers, total number of withdrawals, total number of deposits, total number of transfers, etc. for account business operations performed by an account in each fixed time period or in a sliding window can all be applied to the bucketing discretization operation, which will not be repeated here.

[0100] Optionally, another discretization operation may include discretizing continuous data according to categories. For example, working hours and working days may be marked as 1, and non-working hours and non-working days may be marked as 0; other similar forms of data may be processed in this manner.

[0101] In this embodiment, the transaction time series features corresponding to the transaction flow data are extracted, including: using a retrieval tool of a preset database to retrieve the transaction flow data in multiple preset data dimensions in a slicing or sliding window manner to obtain the transaction time series data; discretizing the transaction time series data to obtain the transaction time series features. By using the retrieval tool to retrieve the transaction flow data in multiple preset data dimensions in a slicing or sliding window manner, the transaction time series data can be obtained more quickly, and the transaction flow data can be simplified by discretization, making the mining of transaction time series features more efficient. The transaction time series features can more intuitively reflect the distribution and change rules of the transaction data, so that the abnormal transaction identification model can learn more comprehensive transaction behavior features, thereby further improving the accuracy of the abnormal transaction identification model in identifying abnormal transaction accounts.

[0102] As an optional implementation, based on the above embodiment, the unsupervised learning algorithm includes a first unsupervised learning algorithm, a second unsupervised learning algorithm and a third unsupervised learning algorithm;

[0103] At least one unsupervised learning algorithm is used to determine corresponding transaction behavior characteristics based on transaction flow data, including:

[0104] Inputting the transaction flow data into a first unsupervised learning algorithm, and using the first unsupervised learning algorithm to determine a first transaction behavior feature, the first transaction behavior feature being whether the account to be identified is an account with a clearing behavior feature;

[0105] Inputting the transaction flow data into a second unsupervised learning algorithm, and using the second unsupervised learning algorithm to determine a second transaction behavior feature, the second transaction behavior feature being whether the account to be identified is an account with characteristics of an abnormal group suspicion;

[0106] The transaction flow data is input into a third unsupervised learning algorithm, and the third unsupervised learning algorithm is used to determine a third transaction behavior feature, where the third transaction behavior feature is whether the account to be identified is an account with a silent period greater than a preset time period and explosive transaction characteristics before or after the silent period.

[0107] It is understandable that the steps of determining corresponding transaction behavior features based on transaction flow data through the first unsupervised learning algorithm and the second unsupervised learning algorithm can be performed in parallel.

[0108] The first unsupervised learning algorithm is an algorithm for identifying whether the account to be identified is an account with clearing behavior characteristics. It can be an unsupervised learning algorithm based on rule definition.

[0109] Specifically, the information of each transaction within the time to be identified is obtained from the transaction flow data; then any transaction in the account is extracted, and the execution status of the transaction is determined according to the phenomenon after the transaction is executed; the phenomenon after the transaction is executed is a phenomenon reflected by the changes before and after the transaction is executed; the execution type is up-crossing or down-crossing. If the account status after the transaction is executed is an increase in the account amount, the execution type of the transaction is determined to be up-crossing, and the execution status corresponding to the transaction is an up-crossing state; if the account status after the transaction is executed is a decrease in the account amount, the execution type of the transaction is determined to be down-crossing, and the execution status corresponding to the transaction is a down-crossing state. If the account status after the transaction is executed is neither an increase in the account amount nor a decrease in the account amount, the execution status of the previous transaction of the transaction is set as the execution status of the transaction.

[0110] If the execution status is a downward crossing status, when the amount of account transfer reduction is greater than the threshold of the allowed transfer amount, it is considered to be an abnormal downward crossing status; if the execution status is an upward crossing status, when the amount of transfer increase is greater than the threshold of the allowed transfer amount, it is considered to be an abnormal upward crossing status; and the number of abnormal upward and downward crossings of the current account transaction is counted; when the number of abnormal upward or downward crossings exceeds the set abnormal number threshold, the account can be marked as an account with clearing behavior characteristics, and whether it has the clearing behavior characteristics can be used as the first behavior feature.

[0111] If the first behavior feature is an account with a clearing behavior feature, it can be marked as 1; if the first behavior feature is not an account with a clearing behavior feature, it can be marked as 0. The first behavior feature can also be marked in other forms, such as marking Y and N, which is not limited here.

[0112] The second unsupervised learning algorithm is an algorithm for identifying whether the account to be identified is an account with abnormal group suspicion characteristics. It can be an algorithm used by combining a greedy algorithm with a graph computing method.

[0113] Specifically, the transaction amount and transaction time of the upstream account flowing into the downstream account through the target account in the corresponding transaction flow data within the time to be identified, as well as the transaction amount and transaction time of the upstream account flowing into the target account but not into the downstream account are extracted. Among them, the upstream account is the account that provides the transaction amount. The target account is the transfer party that transfers the transaction amount of the upstream account to the downstream account. The downstream account is used to receive the target account and is the final recipient of the transaction amount. The above transaction flow data is input into the greedy algorithm. In the process of training the greedy algorithm, the greedy algorithm constructs a binary tree for the data set composed of the above upstream account, target account, and downstream account according to the feature learning and extraction of the input data and calculation of the group suspicion. The child nodes of the constructed binary tree record all the data, and the root node records the minimum value of the data in its child nodes. Among them, the child node records the group suspicion data calculated in all the data. After the binary tree is constructed, the child node corresponding to the minimum suspiciousness value, i.e., the child node corresponding to the account with the lowest group suspiciousness, can be quickly located according to the global minimum value recorded in the root node during the iterative training process; and the child node corresponding to the minimum suspiciousness value is deleted from the graph, and the graph state that maximizes the suspiciousness is dynamically recorded. Among them, the graph state is a graph structure that can contain information such as upstream accounts, target accounts, downstream accounts, and their respective associations and suspiciousness. After all nodes are iteratively removed, the graph state that maximizes the suspiciousness in this process is traced back according to the records, and the graph state with the maximum suspiciousness is used as the output of the greedy algorithm. After obtaining the maximum graph state, the connected subgraph splitting algorithm can be applied to split the graph containing the maximum state, and the splitting result is multiple connected subgraphs, that is, starting from any node in the subgraph, any other node in the subgraph can be reached, that is, it can be considered that the accounts in the same subgraph are associated with each other, and then the accounts associated with the connected subgraph are determined as abnormal group suspected feature accounts, and whether there are abnormal group suspected feature accounts can be used as the second behavioral feature.

[0114] If the second behavior feature is a feature of an abnormal group suspected account, it can be marked as 1; if the second behavior feature is not a feature of an abnormal group suspected account, it can be marked as 0. The second behavior feature can also be marked in other forms, for example, it can be marked as Y and N, etc., which is not limited here.

[0115] The third unsupervised learning algorithm is used to identify whether the account to be identified is an account with a silent period greater than a preset time and explosive trading characteristics before or after the silent period. It can use a mean shift clustering algorithm to perform time series analysis on transaction flow data.

[0116] Specifically, the transaction flow data of the account to be identified extracted according to the time to be identified is used as a transaction sequence; wherein each transaction sequence may include a transaction time node and an account balance; and the corresponding account balance in the transaction sequence is numerically normalized. Then the transaction sequence after numerical normalization is input into the mean shift algorithm, and the encoded transaction sequence is clustered and grouped using the mean shift algorithm. The output of clustering and grouping is the start time of at least one transaction cycle, the peak time of the transaction cycle and its corresponding transaction amount, etc. Among them, the start time of the transaction cycle can be used as the awakening time node, which is the transaction start time of the first non-zero transaction sequence in the transaction sequence. The peak time of the transaction cycle can be used as the outbreak time node, which is the transaction time corresponding to the transaction sequence with the highest transaction amount in a transaction cycle. After the transaction cycle is determined, the difference between the account balance at the awakening and outbreak time nodes of each transaction cycle is calculated, and the above difference result is used as the target transaction amount and the corresponding transaction cycle is used as the target transaction cycle. After the confirmation of the target trading cycle is completed, the difference between the awakening time point corresponding to the target trading cycle and the earliest trading time point ranked by trading time in all trading sequences is used as the silent period time of the target transaction.

[0117] Finally, the target transaction amount is looked up in the comparison table of the pre-stored transaction amount and the silent time threshold, and the target silent time threshold corresponding to the target transaction amount is found. If the target transaction silent time is greater than or equal to the target silent time threshold, it can be considered that the account has the longest silent time and the largest target transaction amount, and is an account with a silent period greater than the preset time and explosive transactions before or after the silent period. Whether the account has a silent period greater than the preset time and explosive transactions before or after the silent period is used as the third behavior feature.

[0118] If the third behavior feature is a feature that the silent period is greater than the preset time and the account is traded in bursts before or after the silent period, it can be marked as 1; if the third behavior feature is a feature that the silent period is not greater than the preset time and the account is traded in bursts before or after the silent period, it can be marked as 0. The third behavior feature can also be marked in other forms, such as Y and N, which are not limited here.

[0119] In this embodiment, the unsupervised learning algorithm includes a first unsupervised learning algorithm, a second unsupervised learning algorithm and a third unsupervised learning algorithm; at least one unsupervised learning algorithm is used to determine the corresponding transaction behavior characteristics based on the transaction flow data, including: inputting the transaction flow data into the first unsupervised learning algorithm, and using the first unsupervised learning algorithm to determine the first transaction behavior characteristic, the first transaction behavior characteristic is whether the account to be identified is an account with a clearing behavior characteristic; inputting the transaction flow data into the second unsupervised learning algorithm, and using the second unsupervised learning algorithm to determine the second transaction behavior characteristic, the second transaction behavior characteristic is whether the account to be identified is an account with abnormal group suspicion characteristics; inputting the transaction flow data into the third unsupervised learning algorithm, and using the third unsupervised learning algorithm to determine the third transaction behavior characteristic, the third transaction behavior characteristic is whether the account to be identified is an account with a silent period greater than a preset time length and explosive transaction characteristics before or after the silent period. Based on the first, second and third unsupervised learning algorithms, the first, second and third transaction behavior features are extracted respectively, which can deeply explore the typical abnormal transaction behavior features, and then provide more comprehensive and typical abnormal transaction behavior features for the training of supervised models, which makes up for the deficiency of the confirmation method for abnormal transaction accounts based on manually preset rules that is difficult to identify the ever-changing abnormal transaction behaviors, and further improves the accuracy of identifying abnormal transaction accounts.

[0120] As an optional implementation, based on the above embodiment, the transaction time series feature is fused with at least one transaction behavior feature to obtain the target transaction feature, including:

[0121] The transaction time series feature and at least one transaction behavior feature are spliced ​​in a preset order to obtain the target transaction feature.

[0122] Specifically, the transaction time series features corresponding to the account to be identified are spliced ​​with at least one transaction behavior feature of the account to be identified generated by an unsupervised learning algorithm in a preset order. Optionally, the transaction time series features and at least one transaction behavior feature of the corresponding account generated by an unsupervised learning algorithm are spliced ​​front and back; or, the transaction time series features are inserted into multiple transaction behavior features to form a target transaction feature spliced ​​in a preset order.

[0123] In this embodiment, the transaction time series features and at least one transaction behavior feature are spliced ​​in a preset order to obtain the target transaction features; the transaction time series features and transaction behavior features can be more comprehensively retained, and the generalization ability of the model can be improved by extracting diverse and complex features, which in turn helps to improve the accuracy of identifying abnormal account transactions.

[0124] Figure 3This is a flowchart of an abnormal transaction account identification method provided in another embodiment of the present application, specifically a scheme for training an abnormal transaction account identification model. When the abnormal transaction account identification model is trained, it is obtained by stage training. The abnormal transaction account identification method provided in this embodiment includes the following steps:

[0125] Step 301, obtaining the current stage training samples corresponding to the abnormal transaction account identification model, the current stage training samples include positive samples and negative samples, negative samples are samples of suspicious accounts identified by the abnormal transaction account identification model in the previous stage and confirmed by the regulatory object; the current stage training samples include sample transaction features and sample category labels, the sample transaction features are obtained by fusing the transaction time series features of the sample account in the current stage with at least one transaction behavior feature, and the at least one transaction behavior feature is determined based on the transaction flow data of the sample account using at least one unsupervised learning algorithm.

[0126] Among them, positive samples refer to samples of accounts without abnormal trading behavior.

[0127] The current stage may be a time period to be identified, or may be a certain stage during the training of the abnormal transaction account identification model.

[0128] The previous stage refers to: the stage before the current stage.

[0129] The current stage training samples refer to the samples used to train the abnormal transaction account identification model in the current stage. They include positive samples and negative samples, among which the acquisition of negative samples has a time lag. The time lag can be explained as follows: since it takes a certain amount of time for the regulatory object to confirm suspicious accounts, it is impossible to directly obtain the accurate negative samples and their corresponding categories in the previous stage. It is necessary to update the negative samples in the previous stage according to the list of suspicious accounts in the previous stage provided by the regulatory object, so as to obtain the real samples in the previous stage and use them as the training samples in the current stage.

[0130] It can be understood that the positive samples in the current stage may be the same as the positive samples in the previous stage or may be updated regularly, which is not limited in this embodiment.

[0131] Among them, in the current stage training samples, the sample category label of the positive sample can be marked as 0, and the sample category label of the negative sample can be marked as 1; when marking the label, a binary classification marking method can be used, or it can be marked as other marking forms, which is not limited here.

[0132] Step 302: Use the current stage training samples to train the abnormal transaction account identification model trained in the previous stage to obtain the abnormal transaction account identification model trained in the current stage.

[0133] Optionally, the preset supervised learning model is a lightweight gradient boosting machine LightGBM, so the abnormal transaction account identification model after training in the previous stage is the LightGBM after training in the previous stage.

[0134] Among them, LightGBM is a machine learning algorithm based on the gradient boosting framework. It is a fast, distributed, high-performance gradient boosting framework specifically designed to solve classification, regression and other problems. It contains multiple sub-algorithms for supervised learning training. It gradually improves the prediction performance of the model by iteratively training multiple weak learners. In each iteration, the algorithm updates the model based on the prediction error of the current model to reduce the prediction error and improve accuracy.

[0135] Specifically, a portion of the current training samples generated in step 301 is extracted as test set samples, and the test set samples are used to verify the training accuracy of the model. The proportion of the test set to the test set may not exceed 30%, which can be set according to actual needs and is not limited here. Then the current stage training samples are input as training sets into the abnormal transaction model of the previous stage for iterative training.

[0136] For example, in each iteration of training, LightGBM calculates the gradient of the loss function of the current model with respect to the input features. These gradients reflect the prediction error of the model on the current data set; based on the calculated gradient information, LightGBM generates a new decision tree. This decision tree is designed to fit the error of the current model, that is, the gradient information; the newly generated decision tree will be added to the current model to update the model's predictive ability. This process is achieved by adjusting the model parameters so that the prediction error of the model on the training set gradually decreases; after each iteration, LightGBM will use the validation set to evaluate the updated model to monitor the performance changes of the model; when the conditions for training convergence are met, this model is considered to be the abnormal trading account identification model after training in the current stage.

[0137] Among them, the condition for judging the convergence of the abnormal transaction account identification model may be that the prediction accuracy of the validation set for the abnormal transaction account model reaches a preset probability threshold, and the preset probability threshold may be set to 95%, 90%, etc., which is not limited here.

[0138] In addition, the condition for judging the convergence of the abnormal trading account identification model may also be that the loss function reaches the minimum, etc., which is not limited here.

[0139] Step 303: Use the abnormal transaction account identification model trained in the current stage to identify whether the predicted sample is a suspicious account to obtain a second identification result.

[0140] Among them, the prediction samples are the samples used by the abnormal transaction account identification model trained in the current stage for identification.

[0141] The second recognition result is generated by predicting the characteristics of the account to be identified using the abnormal transaction account recognition model trained in the current stage.

[0142] Among them, the prediction sample includes: prediction sample transaction features, which are obtained by integrating the transaction time series features of the account corresponding to the prediction sample with at least one transaction behavior feature, and the at least one transaction behavior feature is determined based on the transaction flow data of the sample account using at least one unsupervised learning algorithm.

[0143] Specifically, in this embodiment, the predicted samples are input into the abnormal transaction account identification model trained in the current stage for identification, and the second identification result can be output after identification by the abnormal transaction account identification model. The second identification result includes the degree of suspicion of each predicted sample being an abnormal transaction account. The degree of suspicion of each predicted sample being an abnormal transaction account can be sorted to obtain the top N predicted samples with higher suspicion, and determine the account information corresponding to the top N predicted samples with higher suspicion.

[0144] Wherein, N is a positive integer, such as 10, 20, etc., or other suitable values, which are not limited in this embodiment.

[0145] Among them, the suspicion degree can be expressed by the probability of abnormal transaction accounts.

[0146] The account information may be an account number, a mobile phone number, or other information that represents a unique account.

[0147] Step 304: Send the top N suspicious account information with higher suspicion in the second identification result to the supervised device, so that the supervised device determines whether the suspicious account is an abnormal transaction account based on the suspicious account information.

[0148] The supervised object device refers to the device used in the supervised object for supervising whether it is an abnormal transaction account. It can be used to determine whether a suspicious account is an abnormal transaction account.

[0149] Specifically, the abnormal transaction account identification device can establish a communication connection with the supervision object device, and actively send the information of the top N suspicious accounts with higher suspicion to the supervision object device. The supervision object device displays the information of the top N suspicious accounts with higher suspicion, and the supervision device can retrieve other relevant business information of the top N suspicious accounts with higher suspicion from the database used by the supervision object; the supervision object device analyzes the other relevant business information and the transaction flow information of the suspicious accounts to confirm whether the top N suspicious accounts with higher suspicion are abnormal transaction accounts.

[0150] Step 305, receiving the identification result sent by the supervised object device, wherein the identification result includes abnormal transaction account information;

[0151] Optionally, the method of receiving the identification result sent by the supervised object device may include that the supervised object device uploads it to its external interactive system, and the abnormal transaction account identification device logs in to the external interactive system of the supervised object and downloads and obtains it by itself. Alternatively, the supervisory device directly sends it to the receiving end server through network protocol transmission, etc. It can also be other, which is not limited here.

[0152] Step 306: determine negative samples of training samples for the next stage based on the abnormal transaction account information.

[0153] It should be noted that the abnormal transaction account identification model at each stage can be trained with updated training samples until the conditions for no longer training are met.

[0154] The condition for not training any more may be that the top N suspicious account information with a high degree of suspicion identified multiple times are all abnormal transaction account information determined by the supervision object device. Or the ratio of the top N suspicious account information with a high degree of suspicion identified by the trained abnormal transaction account identification model to the abnormal transaction account information determined by the supervision object device is greater than a preset ratio threshold, etc. The preset ratio threshold may be, for example, 95%, 90%, etc. Specifically, after receiving the list of abnormal transaction accounts provided by the supervision object, the negative samples of the current stage are updated as negative samples of the training samples of the next stage.

[0155] In this embodiment, the current stage training samples corresponding to the abnormal transaction account identification model are obtained. The current stage training samples include positive samples and negative samples. The negative samples are samples of suspicious accounts identified by the abnormal transaction account identification model in the previous stage and confirmed by the regulatory object; the current stage training samples include sample transaction features and sample category labels. The sample transaction features are obtained by integrating the transaction time series features of the sample account in the current stage with at least one transaction behavior feature. The at least one transaction behavior feature is determined based on the transaction flow data of the sample account using at least one unsupervised learning algorithm. The negative samples for training are marked with samples of suspicious accounts identified by the abnormal transaction account identification model in the previous stage and confirmed by the regulatory object, which enhances the accuracy of negative sample information and can provide more realistic negative sample data features for the abnormal transaction account identification model. It improves the problem of nearly relying on artificial preset rules to mark abnormal transaction accounts. This method is difficult to cope with the ever-changing abnormal transaction means, resulting in the problem of fewer abnormal transaction sample features that can be obtained. In this way, the abnormal account transaction model can learn rich negative sample features, and then accurately identify abnormal transaction accounts through the abnormal account transaction model.

[0156] The abnormal transaction account identification model trained in the previous stage is trained by using the training samples in the current stage to obtain the abnormal transaction account identification model trained in the current stage. Optionally, the preset supervised learning model is a lightweight gradient boosting machine LightGBM, so the abnormal transaction account identification model trained in the previous stage is the LightGBM trained in the previous stage. LightGBM has a strong feature extraction capability, can continuously adapt to the changes in abnormal transaction behavior characteristics, and can deeply explore the laws of abnormal transaction behavior in rich sample features, which helps to maintain a high accuracy rate of abnormal transaction account identification when facing new abnormal transaction behavior characteristics.

[0157] Finally, the abnormal transaction account recognition model trained in the current stage is used to identify whether the predicted sample is a suspicious account, and a second recognition result can be obtained. By screening and confirming the suspicious list through the second recognition result, the efficiency of the regulatory department's investigation can be improved. Then, the top N suspicious account information with a higher degree of suspicion in the second recognition result is sent to the regulatory object device, so that the regulatory object device determines whether the suspicious account is an abnormal transaction account based on the suspicious account information. Receive the discrimination result sent by the regulatory object device, which includes the abnormal transaction account information; determine the negative sample of the training sample in the next stage based on the abnormal transaction account information. As the list of negative samples fed back by the regulatory object device is updated, the training model is also iteratively updated, so that the model can be continuously learned and improved, thereby obtaining a more accurate second recognition result, thereby realizing the application of the abnormal transaction account recognition model to improve the accuracy of identifying abnormal transaction accounts.

[0158] Optionally, the training step of the abnormal transaction account identification model is performed on a software as a service (SaaS) platform. The SaaS platform is a platform that allows various applications to be used anytime and anywhere by simply accessing the network. It can provide an easy-to-use management interface for accounts, allowing accounts to quickly configure and deploy services, and has high availability. It can support database and algorithm operations, etc.

[0159] Specifically, in a SaaS environment, a database for storing transaction flows and an algorithm model operation tool may be deployed, and steps S301-306 may be executed, which will not be described in detail here.

[0160] In this embodiment, the training step of the abnormal transaction account identification model is performed on the Software as a Service (SaaS) platform. SaaS can effectively and quickly train the abnormal transaction account identification model, which can effectively save the time of model training when processing huge transaction flow data.

[0161] As an optional implementation, based on the above embodiment, the abnormal transaction account identification model trained to convergence is used to identify whether the account to be identified is an abnormal transaction account based on the target transaction feature, so as to obtain the first identification result, the method further includes:

[0162] Obtain the model file, dependency packages, and Docker image of the abnormal trading account identification model that has been trained to convergence;

[0163] Deploy model files, dependency packages, and Docker images to the preset operating environment;

[0164] Using the abnormal transaction account identification model trained to convergence and identifying whether the account to be identified is an abnormal transaction account based on the target transaction feature, to obtain a first identification result, including:

[0165] In a preset operating environment, an abnormal transaction account identification model trained to convergence is used to identify whether the account to be identified is an abnormal transaction account based on target transaction features to obtain a first identification result.

[0166] The model file is a file containing metadata, indexes, and weight data of the model, and may be a file storing training parameters of the abnormal trading account identification model.

[0167] Dependency packages refer to the software packages required for the installation and operation of Docker itself, as well as the dependencies required for the operation of applications inside the container.

[0168] Specifically, when configuring the Docker container environment, it is necessary to install the dependency package, select a lightweight base image, and on this basis, write a Docker build process text file, which is used to build the image. Run the Docker text file to generate the Docker image. Finally, package the Docker image, abnormal transaction account identification model file, and dependency package into a compressed file. The Docker image, abnormal transaction account identification model file, and dependency package can be deployed in any environment where Docker is running. Exemplarily, it can be deployed in the server by installing the Docker engine and starting and configuring Docker. After the deployment is completed, the target transaction feature can be input into the abnormal transaction account identification model trained to convergence, and abnormal transaction account identification can be performed to obtain a first identification result.

[0169] In this embodiment, before using the abnormal transaction account identification model trained to convergence and identifying whether the account to be identified is an abnormal transaction account based on the target transaction characteristics to obtain the first identification result, the method also includes: obtaining the model file, dependent package and Docker image of the abnormal transaction account identification model trained to convergence; deploying the model file, dependent package and Docker image to a preset operating environment; using the abnormal transaction account identification model trained to convergence and identifying whether the account to be identified is an abnormal transaction account based on the target transaction characteristics to obtain the first identification result, including: in the preset operating environment, using the abnormal transaction account identification model trained to convergence and identifying whether the account to be identified is an abnormal transaction account based on the target transaction characteristics to obtain the first identification result. The model is deployed by the Docker container, so that the algorithm model can be flexibly migrated, and a high-efficiency and high-precision identification environment is provided for the abnormal transaction account identification algorithm.

[0170] Figure 4 The structure diagram of the abnormal transaction account identification device provided in one embodiment of the present application is shown in FIG. 4 . The abnormal transaction account identification device provided in this embodiment is located in an abnormal transaction account identification device. The abnormal transaction account identification device 40 provided in this embodiment includes: an acquisition module 401, an extraction module 402, a fusion module 403, and an identification module 404.

[0171] Among them, the acquisition module 401 is used to obtain the transaction flow data of the account to be identified within the time period to be identified; the extraction module 402 is used to extract the transaction time series features corresponding to the transaction flow data, and use at least one unsupervised learning algorithm to determine the corresponding transaction behavior features based on the transaction flow data; the fusion module 403 is used to fuse the transaction time series features with at least one transaction behavior feature to obtain the target transaction feature; the identification module 404 is used to use the abnormal transaction account identification model trained to convergence and identify whether the account to be identified is an abnormal transaction account based on the target transaction feature to obtain a first identification result, and the abnormal transaction account identification model is a preset supervised learning model.

[0172] Optionally, the extraction module 402, when extracting the transaction time series features corresponding to the transaction flow data, is specifically used to:

[0173] The retrieval tool of the preset database is used to retrieve the transaction flow data in multiple preset data dimensions in a slice or sliding window manner to obtain the transaction time series data. The transaction time series data is discretized to obtain the transaction time series features.

[0174] Optionally, in the abnormal transaction account identification device provided in this embodiment, the unsupervised learning algorithm includes a first unsupervised learning algorithm, a second unsupervised learning algorithm and a third unsupervised learning algorithm;

[0175] Accordingly, when the extraction module 402 uses at least one unsupervised learning algorithm to determine the corresponding transaction behavior characteristics based on the transaction flow data, it is specifically used to:

[0176] Inputting the transaction flow data into a first unsupervised learning algorithm, and using the first unsupervised learning algorithm to determine a first transaction behavior feature, the first transaction behavior feature being whether the account to be identified is an account with a clearing behavior feature;

[0177] Inputting the transaction flow data into a second unsupervised learning algorithm, and using the second unsupervised learning algorithm to determine a second transaction behavior feature, the second transaction behavior feature being whether the account to be identified is an account with characteristics of an abnormal group suspicion;

[0178] The transaction flow data is input into a third unsupervised learning algorithm, and the third unsupervised learning algorithm is used to determine a third transaction behavior feature, where the third transaction behavior feature is whether the account to be identified is an account with a silent period greater than a preset time period and explosive transaction characteristics before or after the silent period.

[0179] Optionally, the fusion module 403, when fusing the transaction time series feature with at least one transaction behavior feature to obtain the target transaction feature, is specifically used to:

[0180] The transaction time series feature and at least one transaction behavior feature are spliced ​​in a preset order to obtain the target transaction feature.

[0181] Optionally, the abnormal transaction account identification device provided in this embodiment further includes a training module

[0182] Among them, the abnormal transaction account identification model trained to convergence is obtained by stage-by-stage training, and the training module is specifically used when executing the training steps of the abnormal transaction account identification model in the previous stage.

[0183] The current stage training samples corresponding to the abnormal transaction account identification model are obtained. The current stage training samples include positive samples and negative samples. Negative samples are samples of suspicious accounts identified by the abnormal transaction account identification model in the previous stage and confirmed by the regulatory subject. The current stage training samples include sample transaction features and sample category labels. The sample transaction features are obtained by fusing the transaction time series features of the sample account in the current stage with at least one transaction behavior feature. The at least one transaction behavior feature is determined based on the transaction flow data of the sample account using at least one unsupervised learning algorithm.

[0184] The abnormal transaction account identification model trained in the previous stage is trained using the current stage training samples to obtain the abnormal transaction account identification model trained in the current stage.

[0185] Optionally, the preset supervised learning model may be a lightweight gradient boosting machine LightGBM.

[0186] Optionally, the training step of the abnormal transaction account identification model is performed on a Software as a Service (SaaS) platform.

[0187] Optionally, the abnormal transaction account identification device provided in this embodiment further includes: a sending module, a receiving module and a determining module.

[0188] Among them, the identification module is also used to use the abnormal transaction account identification model trained in the current stage to identify whether the predicted sample is a suspicious account, so as to obtain a second identification result; the sending module is used to send the top N suspicious account information with higher suspicion in the second identification result to the supervision object device, so that the supervision object device determines whether the suspicious account is an abnormal transaction account based on the suspicious account information; the receiving module is used to receive the judgment result sent by the supervision object device, and the judgment result includes the abnormal transaction account information; based on the abnormal transaction account information, determine the negative sample of the training sample in the next stage.

[0189] Optionally, the abnormal transaction account identification device provided by this embodiment further includes: a deployment module.

[0190] Correspondingly, the acquisition module is used to obtain the model file, dependent package and Docker image of the abnormal transaction account identification model trained to convergence; the deployment module is used to deploy the model file, dependent package and Docker image to a preset operating environment; the identification module, when using the abnormal transaction account identification model trained to convergence and identifying whether the account to be identified is an abnormal transaction account based on the target transaction characteristics to obtain a first identification result, is specifically used to: in a preset operating environment, use the abnormal transaction account identification model trained to convergence and identify whether the account to be identified is an abnormal transaction account based on the target transaction characteristics to obtain a first identification result.

[0191] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown in FIG. Figure 5 As shown, the electronic device 50 provided in this embodiment includes: a processor 501 and a memory 502 communicatively connected to the processor 501 .

[0192] The memory 502 is used to store computer-executable instructions; the processor 501 is used to execute the computer-executable instructions stored in the memory 502 to implement the abnormal transaction account identification method provided by any of the above embodiments. For details, please refer to the relevant description in the above method embodiment, and no further details will be given here.

[0193] The program may include program codes, and the program codes include computer-executable instructions. The memory 502 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0194] In this embodiment, the memory 502 is connected to the processor 501 via a bus. The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0195] The embodiment of the present application also provides a computer-readable storage medium, in which computer-executable instructions are stored, and when the computer-executable instructions are executed by a processor, they are used to implement the abnormal transaction account identification method provided in any of the above embodiments. For example, the computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0196] An embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the abnormal transaction account identification method provided in any one of the above embodiments.

[0197] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0198] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to implement the solution of this embodiment.

[0199] In addition, each functional module in each embodiment of the present application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The above-mentioned module-composed unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

[0200] The above-mentioned integrated module implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the methods of various embodiments of the present application.

[0201] It should be understood that the above processor can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in the invention can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor.

[0202] The memory may include a high-speed RAM memory, and may also include a non-volatile storage NVM, such as at least one disk memory, and may also be a USB flash drive, a mobile hard disk, a read-only memory, a magnetic disk or an optical disk, etc.

[0203] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of this application is not limited to only one bus or one type of bus.

[0204] The above storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk. The storage medium can be any available medium that can be accessed by a general or special purpose computer.

[0205] An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an application specific integrated circuit (ASIC). Of course, the processor and the storage medium can also exist as discrete components in an electronic control unit or a main control device.

[0206] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0207] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for identifying abnormal transaction accounts, characterized in that: include: Obtain transaction flow data of the account to be identified within the time period to be identified; Extracting transaction time series features corresponding to the transaction flow data, and using at least one unsupervised learning algorithm to determine corresponding transaction behavior features based on the transaction flow data; fusing the transaction time series feature with at least one transaction behavior feature to obtain a target transaction feature; An abnormal transaction account identification model trained to convergence is used to identify whether the account to be identified is an abnormal transaction account based on the target transaction feature to obtain a first identification result, wherein the abnormal transaction account identification model is a preset supervised learning model.

2. The method according to claim 1, characterized in that The extracting transaction time series features corresponding to the transaction flow data includes: Using a retrieval tool of a preset database to search the transaction flow data in multiple preset data dimensions in a slicing or sliding window manner to obtain transaction time series data; The transaction time series data is discretized to obtain transaction time series features.

3. The method according to claim 1, characterized in that The unsupervised learning algorithm includes a first unsupervised learning algorithm, a second unsupervised learning algorithm and a third unsupervised learning algorithm; The using at least one unsupervised learning algorithm to determine the corresponding transaction behavior characteristics based on the transaction flow data includes: Inputting the transaction flow data into a first unsupervised learning algorithm, and using the first unsupervised learning algorithm to determine a first transaction behavior feature, wherein the first transaction behavior feature is whether the account to be identified is an account with a clearing behavior feature; Inputting the transaction flow data into a second unsupervised learning algorithm, and using the second unsupervised learning algorithm to determine a second transaction behavior feature, wherein the second transaction behavior feature is whether the account to be identified is an account with abnormal group suspicion features; The transaction flow data is input into a third unsupervised learning algorithm, and the third unsupervised learning algorithm is used to determine a third transaction behavior feature, wherein the third transaction behavior feature is whether the account to be identified is an account with a silent period greater than a preset time length and explosive transaction characteristics before or after the silent period.

4. The method according to claim 1, characterized in that: The step of fusing the transaction time series feature with at least one transaction behavior feature to obtain a target transaction feature includes: The transaction time series feature and at least one transaction behavior feature are spliced ​​in a preset order to obtain a target transaction feature.

5. The method according to any one of claims 1 to 4, characterized in that: The abnormal transaction account identification model trained to convergence is obtained by stage training. The training steps for the abnormal transaction account identification model in the current stage include: Acquire current-stage training samples corresponding to the abnormal transaction account identification model, wherein the current-stage training samples include positive samples and negative samples, wherein the negative samples are samples of suspicious accounts identified by the abnormal transaction account identification model in the previous stage and confirmed by the regulatory subject; the current-stage training samples include sample transaction features and sample category labels, wherein the sample transaction features are obtained by fusing the transaction time series features of the sample account in the current stage with at least one transaction behavior feature, wherein the at least one transaction behavior feature is determined based on the transaction flow data of the sample account by using at least one unsupervised learning algorithm; The training samples of the current stage are used to train the abnormal transaction account identification model trained in the previous stage to obtain the abnormal transaction account identification model trained in the current stage.

6. The method according to claim 5, characterized in that After the abnormal transaction account identification model trained in the previous stage is trained using the current stage training samples, the method further includes: Using the abnormal transaction account identification model trained in the current stage to identify whether the predicted sample is a suspicious account, so as to obtain a second identification result; sending the top N suspicious account information with higher suspicion in the second identification result to the supervised device, so that the supervised device determines whether the suspicious account is an abnormal transaction account based on the suspicious account information; Receiving a determination result sent by a supervised object device, wherein the determination result includes abnormal transaction account information; Negative samples of training samples in the next stage are determined based on the abnormal transaction account information.

7. The method according to claim 1, characterized in that Before the abnormal transaction account identification model trained to convergence is used to identify whether the account to be identified is an abnormal transaction account based on the target transaction feature to obtain a first identification result, the method further includes: Obtain the model file, dependency packages, and Docker image of the abnormal trading account identification model that has been trained to convergence; Deploy the model file, dependent packages and Docker image to the preset operating environment; The step of using the abnormal transaction account identification model trained to convergence and identifying whether the account to be identified is an abnormal transaction account based on the target transaction feature to obtain a first identification result includes: In a preset operating environment, an abnormal transaction account identification model trained to convergence is used to identify whether the account to be identified is an abnormal transaction account based on the target transaction feature to obtain a first identification result.

8. The method according to any one of claims 1 to 4, characterized in that: The preset supervised learning model is a lightweight gradient boosting machine LightGBM.

9. The method according to any one of claims 1 to 4, characterized in that: The training step of the abnormal transaction account identification model is performed on a Software as a Service (SaaS) platform.

10. An abnormal transaction account identification device, characterized in that: include: An acquisition module is used to acquire transaction flow data of the account to be identified within the time period to be identified; An extraction module, used to extract transaction time series features corresponding to the transaction flow data, and determine corresponding transaction behavior features based on the transaction flow data using at least one unsupervised learning algorithm; A fusion module, used for fusing the transaction time series feature with at least one transaction behavior feature to obtain a target transaction feature; The identification module is used to use the abnormal transaction account identification model trained to convergence and identify whether the account to be identified is an abnormal transaction account based on the target transaction feature to obtain a first identification result, wherein the abnormal transaction account identification model is a preset supervised learning model.

11. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 9 when executed by a processor.

13. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 9 when being executed by a processor.

Images