Order type determination method and device, computer equipment and storage medium

Abstract

The invention relates to an order type determination method and device, computer equipment and a storage medium. The method comprises the steps of generating an order anomaly detection model based on a plurality of sample transaction orders and a sample weight of each sample transaction order; the order anomaly detection model comprises a plurality of detection sub-models; for each sample transaction order, updating a sample weight of the sample transaction order based on an order anomaly degree representation value of the sample transaction order detected by an order anomaly detection model; and based on the updated sample weight, returning to iteratively execute the step of generating the order anomaly detection model based on the plurality of sample transaction orders and the sample weight of each sample transaction order and subsequent steps so as to regenerate a new order anomaly detection model, and stopping iteration until a preset number of order anomaly detection models are generated. The preset number of order anomaly detection models are used for determining order types. By adopting the method, the order type detection accuracy can be improved.

Description

Technical Field

[0001] The present application relates to the field of payment finance, and in particular to an order type determination method, apparatus, computer equipment and storage medium. Background Art

[0002] With the development of computer and Internet technology, more and more transactions are conducted through the Internet. For example, payment can be made through the Internet to purchase goods. With the continuous development of Internet transactions, abnormal transaction orders continue to appear. For example, there are abnormal payment cases in social application payments.

[0003] In traditional technology, in order to detect abnormal transaction orders, transaction orders are usually scored to determine whether the transaction is an abnormal transaction order or a normal transaction order. However, the scoring mainly relies on experience and subjective factors, and the reliability of the scoring is low, resulting in low detection accuracy of the transaction order type. Summary of the invention

[0004] Based on this, it is necessary to provide an order type determination method, apparatus, computer device, computer-readable storage medium and computer program product that can improve the detection accuracy of order types in response to the above technical problems.

[0005] On the one hand, the present application provides a method for determining an order type. The method includes: generating an order anomaly detection model based on multiple sample transaction orders and sample weights of each of the sample transaction orders; the order anomaly detection model includes multiple detection sub-models, each detection sub-model in the order anomaly detection model is generated in sequence, and the generation process of the detection sub-model generated later depends on the detection sub-model generated earlier; the order anomaly degree characterization value detected by the order anomaly detection model is the combination of the detection values ​​of each detection sub-model in the order anomaly detection model; for each of the sample transaction orders, based on the order anomaly degree characterization value of the sample transaction order detected by the order anomaly detection model, the sample weight of the sample transaction order is updated; based on the updated sample weight, returning to iteratively execute the steps of generating an order anomaly detection model based on multiple sample transaction orders and sample weights of each of the sample transaction orders and subsequent steps to regenerate a new order anomaly detection model until a preset number of order anomaly detection models are generated and the iteration is stopped; the preset number of order anomaly detection models are used to determine the order type.

[0006] On the other hand, the present application also provides an order type determination device. The device includes: a model generation module, which is used to generate an order anomaly detection model based on multiple sample transaction orders and sample weights of each of the sample transaction orders; the order anomaly detection model includes multiple detection sub-models, each detection sub-model in the order anomaly detection model is generated in sequence, and the generation process of the detection sub-model generated later depends on the detection sub-model generated earlier; the order anomaly degree characterization value detected by the order anomaly detection model is the combination of the detection values ​​of each detection sub-model in the order anomaly detection model; a weight update module, which is used to update the sample weight of the sample transaction order based on the order anomaly degree characterization value of the sample transaction order detected by the order anomaly detection model for each of the sample transaction orders; an iteration module, which is used to return to iterate and execute the steps of generating the order anomaly detection model based on multiple sample transaction orders and the sample weights of each of the sample transaction orders and subsequent steps based on the updated sample weights, so as to regenerate a new order anomaly detection model until a preset number of order anomaly detection models are generated and the iteration stops; the preset number of order anomaly detection models are used to determine the order type.

[0007] In some embodiments, the model generation module is also used to generate a detection sub-model based on multiple sample transaction orders and sample weights of each of the sample transaction orders; add the detection sub-model to the current anomaly detection model to update the current anomaly detection model; when the current anomaly detection model does not meet the first iteration stop condition, return to the step of generating the detection sub-model based on multiple sample transaction orders and sample weights of each of the sample transaction orders; when the current anomaly detection model meets the first iteration stop condition, determine the current anomaly detection model as an order anomaly detection model.

[0008] In some embodiments, the model generation module is also used to generate a benchmark sub-model based on multiple sample transaction orders, update the benchmark sub-model to obtain at least one updated sub-model corresponding to the benchmark sub-model; for each updated sub-model, detect the sample transaction order through the updated sub-model and the current anomaly detection model to obtain a predicted abnormality degree characterization value of the sample transaction order; determine the sample prediction deviation value of the sample transaction order according to the predicted abnormality degree characterization value of the sample transaction order and the sample weight of the sample transaction order; generate a detection sub-model according to the sample prediction deviation value of each sample transaction order detected by each of the update sub-models and each of the update sub-models.

[0009] In some embodiments, the model generation module is also used to determine, for each of the update sub-models, an update gain value of the update sub-model based on the sample prediction deviation value of each of the sample transaction orders; when the second iteration stop condition is not met, select the update sub-model with the largest update gain value from each update sub-model as the new baseline sub-model, and return to the step of updating the baseline sub-model to obtain at least one update sub-model corresponding to the baseline sub-model; when the second iteration stop condition is met, determine the baseline sub-model as the detection sub-model.

[0010] In some embodiments, the benchmark sub-model belongs to a decision tree; the model generation module is also used to generate a benchmark sub-model based on multiple sample transaction orders; the benchmark sub-model includes a root node, and each of the sample transaction orders is divided into the root node; the order characteristics of the multiple sample transaction orders are obtained; the order characteristics of the sample transaction orders include the characteristic values ​​of the sample transaction orders under multiple preset order feature dimensions; a candidate splitting node is determined from the benchmark sub-model, and at least one splitting condition of the candidate splitting node is generated; the splitting condition includes a splitting order feature dimension and a splitting value corresponding to the splitting order feature dimension; the splitting order feature dimension belongs to the multiple preset order feature dimensions; for each splitting condition of the candidate splitting node, a child node is generated for the candidate splitting node in the benchmark sub-model according to the splitting condition, and an updated sub-model that meets the splitting condition is generated.

[0011] In some embodiments, the model generation module is also used to determine the difference between the predicted abnormality degree characterization value of the sample transaction order and the actual abnormality degree characterization value of the sample transaction order to obtain the characterization deviation value of the sample transaction order; based on the characterization deviation value of the sample transaction order and the sample weight of the sample transaction order, determine the sample prediction deviation value of the sample transaction order.

[0012] In some embodiments, the sample transaction order is a transaction order triggered by a social application; the multiple preset order feature dimensions include resource transfer account reliability, and the model generation module is further used to determine, for each of the sample transaction orders, a feature value of the sample transaction order under the resource transfer account reliability based on the social information of the resource transferee of the sample transaction order in the social application; and obtain the order feature of the sample transaction order according to the feature value of the sample transaction order under the resource transfer account reliability.

[0013] In some embodiments, the device also includes a sample determination module for determining multiple sample transaction orders, and the sample determination module is also used to obtain a first historical transaction order set; the order type of each historical transaction order in the first historical transaction order set is a normal order; obtain a second historical transaction order set; the order type of each historical transaction order in the second historical transaction order set is an abnormal order; obtain a first number of historical transaction orders from the first historical transaction order set, and obtain a second number of historical transaction orders from the second historical transaction order set; based on the first number of historical transaction orders and the second number of historical transaction orders, obtain the multiple sample transaction orders; the first number is different from the second number.

[0014] In some embodiments, the weight updating module is also used to determine the predicted order type of the sample transaction order based on the order anomaly degree characterization value of the sample transaction order detected by the order anomaly detection model; when the predicted order type of the sample transaction order is inconsistent with the actual order type of the sample transaction order, increase the sample weight of the sample transaction order.

[0015] In some embodiments, the device also includes an order type determination module, which is further used to determine the transaction order to be detected; for each of the order anomaly detection models, the transaction order is detected respectively by each detection sub-model in the order anomaly detection model to obtain the order anomaly degree characterization value of the transaction order detected by the order anomaly detection model; based on the order anomaly degree characterization value of the transaction order detected by each of the order anomaly detection models, the order type to which the transaction order belongs is determined.

[0016] In some embodiments, the order type determination module is further used to detect the transaction order respectively through each detection sub-model in the order anomaly detection model to obtain the detection value of each detection sub-model for the transaction order; and to count the detection value of each detection sub-model for the transaction order to obtain the order anomaly degree characterization value of the transaction order detected by the order anomaly detection model.

[0017] In some embodiments, the device further includes a model weight determination module, which is used to, for each of the sample transaction orders, based on the model weights of each of the order anomaly detection models, perform statistics on the abnormality degree characterization values ​​of each of the order anomaly detection models for the sample transaction order, to obtain the order abnormality degree statistical value of the sample transaction order; determine the difference between the order abnormality degree statistical value of the sample transaction order and the true abnormality degree characterization value of the sample transaction order, to obtain the statistical deviation value of the sample transaction order; determine the model weight loss value based on the statistical deviation value of each of the sample transaction orders, and update the model weight of each order anomaly detection model in the direction of reducing the model weight loss value, to obtain the detection model weight of each order anomaly detection model; the order type determination module is also used to perform statistics on the abnormality degree characterization values ​​of each of the order anomaly detection models for the transaction order, based on the detection model weights of each of the order anomaly detection models, to obtain the order abnormality degree statistical value of the transaction order; determine the order type to which the transaction order belongs according to the order abnormality degree statistical value of the transaction order.

[0018] On the other hand, the present application further provides a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps in the above order type determination method when executing the computer program.

[0019] On the other hand, the present application also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps in the above-mentioned order type determination method are implemented.

[0020] On the other hand, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps in the above order type determination method are implemented.

[0021] The above-mentioned order type determination method, device, computer equipment, storage medium and computer program product generate an order anomaly detection model based on multiple sample transaction orders and sample weights of each sample transaction order. The order anomaly detection model includes multiple detection sub-models. Each detection sub-model in the order anomaly detection model is generated in sequence. The generation process of the detection sub-model generated later depends on the detection sub-model generated earlier. The order anomaly degree characterization value detected by the order anomaly detection model is a combination of the detection values ​​of each detection sub-model in the order anomaly detection model. For each sample transaction order, based on the order anomaly degree characterization value of the sample transaction order detected by the order anomaly detection model, the sample weight of the sample transaction order is updated. Based on the updated sample weight, the iterative execution of the step of generating an order anomaly detection model based on multiple sample transaction orders and the sample weights of each sample transaction order and subsequent steps is returned to regenerate a new order anomaly detection model until a preset number of order anomaly detection models are generated and the iteration is stopped. The preset number of order anomaly detection models are used to determine the order type. Thus, multiple order anomaly detection models are iteratively generated. Since the characteristics of different sample transaction orders may be different, for example, some sample transaction orders are easier to identify the order type they belong to, while some sample transaction orders are not easy to identify the order type they belong to. Therefore, in each iteration, the sample weights of the sample transaction orders are updated based on the order anomaly degree characterization value of the sample transaction orders detected by the order anomaly detection model, so that the degree of attention of the order anomaly detection model to the sample orders can be updated, so that the degree of influence of the sample orders in the process of generating different order anomaly detection models can be reasonably changed, so that the preset number of order anomaly detection models generated can be suitable for predicting the order types to which transaction orders with different characteristics belong, thereby improving the detection accuracy of order types. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 A diagram of an application environment of a method for determining an order type in some embodiments;

[0023] Figure 2 A schematic diagram of a flow chart of a method for determining an order type in some embodiments;

[0024] Figure 3 A schematic diagram of a process for generating a preset number of order anomaly detection models in some embodiments;

[0025] Figure 4 A schematic diagram of a process for generating a preset number of order anomaly detection models in some embodiments;

[0026] Figure 5 A schematic diagram of a flow chart of a method for determining an order type in some embodiments;

[0027] Figure 6A schematic diagram of a process for generating an order anomaly detection model in some embodiments;

[0028] Figure 7 A schematic diagram of a flow chart of a method for determining an order type in some embodiments;

[0029] Figure 8 It is a structural block diagram of an order type determination device in some embodiments;

[0030] Fig. 9 is an internal structure diagram of a computer device in some embodiments;

[0031] Fig.10 1 is a diagram of the internal structure of a computer device in some embodiments. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0033] The order type determination method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown, the terminal 102 communicates with the server 104 through a network. The data storage system can store data that the server 104 needs to process. The data storage system can be integrated on the server 104, or placed on the cloud or other servers.

[0034] Specifically, the server 104 generates an order anomaly detection model based on multiple sample transaction orders and sample weights of each sample transaction order. For each sample transaction order, the server 104 updates the sample weight of the sample transaction order based on the order anomaly degree characterization value of the sample transaction order detected by the order anomaly detection model. Based on the updated sample weight, the server 104 returns to iteratively execute the steps of generating an order anomaly detection model based on multiple sample transaction orders and sample weights of each sample transaction order and subsequent steps to regenerate a new order anomaly detection model until a preset number of order anomaly detection models are generated and the iteration stops. Among them, the order anomaly detection model includes multiple detection sub-models, each detection sub-model in the order anomaly detection model is generated in sequence, the generation process of the detection sub-model generated later depends on the detection sub-model generated previously, and the order anomaly degree characterization value detected by the order anomaly detection model is the combination of the detection values ​​of each detection sub-model in the order anomaly detection model. The preset number of order anomaly detection models are used to determine the order type. The server 104 obtains the transaction order triggered by the terminal 102, and determines the order type to which the transaction order belongs through the preset number of order anomaly detection models. In the case that the order type to which the transaction order belongs is an abnormal order, the server 104 may send an order abnormality prompt message to the terminal 102, and may also send an order abnormality prompt message for the transaction order to a device used for security management.

[0035] The terminal 102 may be, but is not limited to, various desktop computers, laptop computers, smart phones, tablet computers, IoT devices, and portable wearable devices. The IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. The portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. The server 104 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0036] The order type determination method provided in the embodiment of the present application may involve the field of blockchain technology. For example, the server 104 may be a node in the blockchain. The server 104 may store the order type to which the detected transaction order belongs in the blockchain. The server 104 may also store the generated order anomaly detection models in the blockchain.

[0037] Among them, blockchain is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods. Each data block contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, platform product service layer, and application service layer.

[0038] In some embodiments, Figure 2 As shown, a method for determining an order type is provided. The method can be executed by a terminal or a server, or can be executed by the terminal and the server together. Figure 1 The server 104 in the example is used as an example to illustrate, and the following steps are included:

[0039] Step 202: Generate an order anomaly detection model based on multiple sample transaction orders and sample weights of each sample transaction order; the order anomaly detection model includes multiple detection sub-models, and each detection sub-model in the order anomaly detection model is generated sequentially, and the generation process of the detection sub-model generated later depends on the detection sub-model generated earlier; the order anomaly degree characterization value detected by the order anomaly detection model is the combination of the detection values ​​of each detection sub-model in the order anomaly detection model.

[0040] Among them, the transaction order can be an order for payment. The sample transaction order is a transaction order used to generate the order anomaly detection model. The sample weight of each sample transaction order can be the same or different. In the process of generating each order anomaly detection model, each sample transaction order can be updated. When generating the first order anomaly detection model, the sample weights of each sample transaction order can be the same, for example, 1 / N, where N refers to the number of sample transaction orders. For example, if there are 100 sample transaction orders, when generating the first order anomaly detection model, the sample weight of each sample transaction order is 1 / 100. In the process of generating each detection sub-model in the same order anomaly detection model, the sample weight of each sample transaction order remains unchanged. The larger the sample weight, the greater the role it plays in the process of generating the order anomaly detection model, and the greater the attention of the order anomaly detection model to the sample transaction order.

[0041] The order anomaly degree characterization value detected by the order anomaly detection model is the combination of the detection values ​​of each detection sub-model in the order anomaly detection model, and the combination is accumulation or sum. The detection sub-model can be a neural network model or a decision tree. The decision tree can be a classification and regression tree (CART) or other types of tree structures. The type of decision tree is not limited here.

[0042] The order abnormality degree characterization value is used to characterize the abnormality degree of the transaction order and to determine the order type to which the transaction order belongs. Order types are divided into normal orders and abnormal orders. Normal orders refer to reasonable and legal orders, such as reasonable and legal transaction orders, and abnormal orders refer to orders with unreasonable or illegal problems, such as transaction orders with social fraud problems. The multiple sample transaction orders include normal sample transaction orders and abnormal sample transaction orders. The number of normal sample transaction orders and the number of abnormal sample transaction orders may be the same or different. For example, the number of normal sample transaction orders is greater than the number of abnormal sample transaction orders. The order type of normal sample transaction orders is normal orders, and the order type of abnormal sample transaction orders is abnormal orders.

[0043] Specifically, the server can generate a detection sub-model based on multiple sample transaction orders and sample weights of each sample transaction order, and then, when entering the process of generating the detection sub-model, generate at least two detection sub-models, and the generated detection sub-models constitute an order anomaly detection model.

[0044] In some embodiments, the server may generate an initialized current anomaly detection model, generate an order anomaly detection model based on multiple sample transaction orders and sample weights of each sample transaction order, add the detection sub-model to the current anomaly detection model to update the current anomaly detection model, and when the current anomaly detection model does not meet the first iteration stop condition, return to the step of generating the detection sub-model based on multiple sample transaction orders and sample weights of each sample transaction order, and when the current anomaly detection model meets the first iteration stop condition, determine the current anomaly detection model as the order anomaly detection model. The first iteration stop condition includes that the number of detection sub-models in the current anomaly detection model reaches a specified number. The specified number can be determined as needed, for example, it can be 10 or 15, etc.

[0045] Step 204: for each sample transaction order, based on the order anomaly degree characterization value of the sample transaction order detected by the order anomaly detection model, update the sample weight of the sample transaction order.

[0046] Among them, after generating an order anomaly detection model, the sample weights of all or part of the sample transaction orders are updated. After the sample weights are updated, the order anomaly detection model is generated again based on multiple sample transaction orders and the sample weights of each sample transaction order.

[0047] Specifically, for each sample transaction order, after generating an order anomaly detection model, the server can detect each sample transaction order through the order anomaly detection model to obtain an order anomaly degree representation value of each sample transaction order detected by the order anomaly detection model.

[0048] In some embodiments, the server may predict the order type to which the sample transaction order belongs based on the order abnormality degree characterization value of the sample transaction order, and obtain the predicted order type of the sample transaction order. The server may compare the predicted order type of the sample transaction order with the real order type of the sample transaction order, where the real order type of the sample transaction order refers to the order type to which the sample transaction order actually belongs, and when the predicted order type of the sample transaction order is consistent with the real order type of the sample transaction order, the weight of the sample transaction order is updated based on the first update strategy. The first update strategy includes either keeping the sample weight unchanged or reducing the sample weight.

[0049] In some embodiments, when the predicted order type of the sample transaction order is inconsistent with the actual order type of the sample transaction order, the weight of the sample transaction order is updated based on a second update strategy. The second update strategy includes increasing the sample weight.

[0050] In some embodiments, for each sample transaction order, the server determines the order characteristics of the sample transaction order, inputs the order characteristics of the sample transaction order into an order anomaly detection model for detection, and obtains a characterization value of the degree of order anomaly of the sample transaction order.

[0051] In some embodiments, the server can obtain the order characteristics of the sample transaction order based on the characteristic values ​​of the sample transaction order under multiple preset order characteristic dimensions. There are multiple preset order characteristic dimensions, and multiple means at least two. The preset order characteristic dimensions may include characteristic dimensions related to the resource transferor, the resource transferee, and the relationship between the resource transferor and the resource transferor of the sample transaction order. The resource transferor is, for example, a payee, and the resource transferee is, for example, a payee. The characteristic dimensions related to the resource transferor include, but are not limited to, at least one of the basic account information of the payee, the fund flow of the payee, and the behavior of selling stolen goods. The characteristic dimensions related to the resource transferee include, but are not limited to, at least one of the basic account information of the payee, the degree of intimacy between the payer and the payee, the fund flow of the payee, and the behavior of selling stolen goods. The characteristic dimensions related to the relationship between the resource transferor and the resource transferor include, but are not limited to, the degree of intimacy between the payer and the payee. The degree of intimacy between the payer and the payee can be determined based on at least one of the kinship or social relationship between the payer and the payee. The social relationship includes, but is not limited to, offline interaction or online interaction. Online interaction can be, for example, telephone interaction, SMS interaction, or interaction in a social application. For example, the greater the degree of interaction in a social application, the greater the degree of intimacy. The characteristic value under the preset order characteristic dimension is obtained by encoding the value under the preset order characteristic dimension. The order characteristics of the sample transaction order include the characteristic values ​​of the sample transaction order under multiple preset order characteristic dimensions. Specifically, the server can determine the data of the sample transaction order under multiple preset order characteristic dimensions, encode the data under each preset order characteristic dimension respectively to obtain the characteristic value under each preset order characteristic dimension, and combine the obtained characteristic values ​​to obtain the order characteristics of the sample transaction order. For example, the multiple preset order feature dimensions are the account name of the payee, the account name of the payee, and the payment amount. In the sample transaction order, the account name of the payee is "Zhang San", the account name of the payee is "Li Si", and the payment amount is RMB 100. The server can encode "Zhang San", "Li Si", and "100" to obtain the feature values ​​corresponding to "Zhang San", "Li Si", and "100", respectively, and combine the feature values ​​of "Zhang San", "Li Si", and "100" to obtain the order features of the sample transaction order.

[0052] In some embodiments, the multiple preset order feature dimensions can be selected from multiple optional feature dimensions by information value (IV). Information value is also the amount of information. The multiple preset order feature dimensions can also be selected from multiple optional feature dimensions based on stability. The multiple preset order feature dimensions can be selected from multiple optional feature dimensions by information value and stability. For example, the server can select a feature dimension with greater information value and higher stability as the preset order feature dimension.

[0053] Step 206, based on the updated sample weights, returns to iteratively execute the step of generating an order anomaly detection model based on multiple sample transaction orders and the sample weights of each sample transaction order and subsequent steps to regenerate a new order anomaly detection model until a preset number of order anomaly detection models are generated and the iteration is stopped; the preset number of order anomaly detection models are used to determine the order type.

[0054] The preset number can be set as needed, for example, 5, 10, 15 or 20, etc. Before generating the next order anomaly detection model each time, the sample weights of some or all of the sample transaction orders are updated.

[0055] Specifically, after generating an order anomaly detection model, the server updates the sample weights of some or all sample transaction orders, and after the update, generates the next order anomaly detection model based on multiple sample transaction orders and the sample weights of each sample transaction order, and stops generating order anomaly detection models when a preset number of order anomaly detection models are generated. For example, the preset number is k, such as Figure 3 As shown in Figure 1, k order anomaly detection models are generated by updating the sample weights.

[0056] In some embodiments, the server determines the transaction order to be detected, and for each order anomaly detection model, the transaction order is detected by each detection sub-model in the order anomaly detection model, and the order anomaly degree characterization value of the transaction order detected by the order anomaly detection model is obtained. The server determines the order type to which the transaction order belongs based on the order anomaly degree characterization value of the transaction order detected by each order anomaly detection model. The server can combine the preset number of order anomaly detection models into a model called an integrated model, and predict the order type through the integrated model. In some embodiments, the order anomaly detection model is a model generated based on the XGB (Extreme Gradient Boosting) algorithm. The XGB algorithm is an integrated machine learning algorithm based on a decision tree, which adopts a gradient boosting (GradientBoost) framework. The preset number of order anomaly detection models are generated based on the adaptive boosting (AdaBoost) algorithm. Adaptive boosting (Adaptive Boosting, referred to as AdaBoost) is an integrated learning method that improves prediction performance by combining multiple basic learners (such as decision trees, logistic regression, etc.). The core idea of ​​AdaBoost is to assign weights to training samples in each round of iteration, and then train the next base learner according to these weights.

[0057] In this application, the basic learner can be a model trained by XGB. Thus, an adaptive enhanced XGB order type determination method is implemented, which can be used for anomaly detection. Anomaly detection is used to identify items, events or observations that do not conform to the expected pattern or are inconsistent with other items in the data set. It can also be regarded as a classification problem under severe data imbalance. In the anti-fraud anomaly detection scenario, there is usually a serious imbalance in the number of normal samples and abnormal samples. When processing unbalanced data, traditional XGBoost may over-focus on a large number of normal samples, resulting in insufficient recognition of a few abnormal samples. Adaptive XGBoost adjusts the sample weights so that the model pays more attention to those abnormal samples that are difficult to classify, thereby improving the recognition ability of abnormal samples. Adaptive XGBoost adopts an adaptive enhancement strategy, and adjusts the sample weights in each round of iteration according to the error of the sample in the previous round of classification. This enables the model to continuously learn and focus on difficult-to-identify samples during the training process, improving the performance of the model in anomaly detection tasks. Compared with traditional XGBoost, adaptive XGBoost has stronger robustness in the face of noise and outliers. By focusing on samples that are difficult to identify, Adaptive XGBoost can better identify potential abnormal samples and reduce false positive and false negative rates. Adaptive XGBoost allows users to customize the model to adapt to different anomaly detection tasks by adjusting hyperparameters such as weight adjustment factors, learning rates, etc. This allows Adaptive XGBoost to achieve better performance in different scenarios.

[0058] In some embodiments, Figure 4 , showing a flowchart of generating the preset number of order anomaly detection models, including step 402, initializing sample weights; step 404, training base learners, i.e. generating order anomaly detection models; step 406, calculating weights of base learners; step 408, updating weights; step 410, iterative training, i.e. iteratively generating a preset number of order anomaly detection models; step 412, integrating base learners, i.e. integrating the generated preset number of order anomaly detection models into one model.

[0059] In some embodiments, the order anomaly detection model is generated based on the order features of the multiple sample transaction orders. Figure 5 As shown, the steps of acquiring order features of each sample transaction order may include: step 502, data acquisition; step 504, data cleaning; step 506, feature screening and processing. After generating a preset number of order anomaly detection models, the preset number of order anomaly detection models can be evaluated, and the preset number of order anomaly detection models can be developed and launched online, and the model training process can be monitored and a report can be generated. Figure 5As shown, step 508, model construction, such as building an adaptive enhanced XGB model; step 510, model training, that is, generating a preset number of order anomaly detection models; step 512, model evaluation; step 514, monitoring and reporting; step 516, model online development; step 518, model online.

[0060] In the above-mentioned order type determination method, an order anomaly detection model is generated based on multiple sample transaction orders and sample weights of each sample transaction order. The order anomaly detection model includes multiple detection sub-models. Each detection sub-model in the order anomaly detection model is generated in sequence. The generation process of the detection sub-model generated later depends on the detection sub-model generated earlier. The order anomaly degree characterization value detected by the order anomaly detection model is a combination of the detection values ​​of each detection sub-model in the order anomaly detection model. For each sample transaction order, based on the order anomaly degree characterization value of the sample transaction order detected by the order anomaly detection model, the sample weight of the sample transaction order is updated. Based on the updated sample weight, the iterative execution of the step of generating an order anomaly detection model based on multiple sample transaction orders and the sample weights of each sample transaction order and subsequent steps is returned to regenerate a new order anomaly detection model until a preset number of order anomaly detection models are generated and the iteration is stopped. The preset number of order anomaly detection models are used to determine the order type. Thus, multiple order anomaly detection models are iteratively generated. Since the characteristics of different sample transaction orders may be different, for example, some sample transaction orders are easier to identify the order type they belong to, while some sample transaction orders are not easy to identify the order type they belong to. Therefore, in each iteration, the sample weights of the sample transaction orders are updated based on the order anomaly degree characterization value of the sample transaction orders detected by the order anomaly detection model, so that the degree of attention of the order anomaly detection model to the sample orders can be updated, so that the degree of influence of the sample orders in the process of generating different order anomaly detection models can be reasonably changed, so that the preset number of order anomaly detection models generated can be suitable for predicting the order types to which transaction orders with different characteristics belong, thereby improving the detection accuracy of order types.

[0061] In addition, since each detection sub-model in the order anomaly detection model is generated sequentially, the generation process of the detection sub-model generated later depends on the detection sub-model generated earlier, and the order anomaly degree characterization value detected by the order anomaly detection model is the combination of the detection values ​​of each detection sub-model in the order anomaly detection model. Therefore, each detection sub-model in the order anomaly detection model can be used to detect transaction orders in parallel, which improves the detection efficiency of the transaction type of the transaction order. Thus, the detection accuracy is improved while the detection efficiency is improved.

[0062] In some embodiments, generating an order anomaly detection model based on multiple sample transaction orders and sample weights of each sample transaction order includes: generating a detection sub-model based on multiple sample transaction orders and sample weights of each sample transaction order; adding the detection sub-model to the current anomaly detection model to update the current anomaly detection model; when the current anomaly detection model does not meet the first iteration stop condition, returning to the step of generating the detection sub-model based on multiple sample transaction orders and sample weights of each sample transaction order; when the current anomaly detection model meets the first iteration stop condition, determining the current anomaly detection model as the order anomaly detection model.

[0063] Among them, the current anomaly detection model is changing. The initial current anomaly detection model does not include the detection sub-model. And the detection value obtained by the initial current anomaly detection model for detecting the sample transaction order is 0.

[0064] Specifically, the server generates detection sub-models in sequence and adds the generated detection sub-models to the current anomaly detection model. When the first iteration stop condition is met, the process of generating the detection sub-model is no longer performed, and the current anomaly detection model is determined as the order anomaly detection model. The first iteration stop condition includes that the number of detection sub-models in the current anomaly detection model reaches a specified number. The specified number can be determined as needed, for example, it can be 10 or 15.

[0065] In some embodiments, the server generates a detection sub-model based on multiple sample transaction orders and sample weights of each sample transaction order, and adds the detection sub-model to the current anomaly detection model. If the first iteration stop condition is not met, the step of generating a detection sub-model based on multiple sample transaction orders and sample weights of each sample transaction order is performed again, so as to generate a new detection sub-model again, so that at least two detection sub-models are generated in the current anomaly detection model through iteration. When there are a specified number of detection sub-models in the current anomaly detection model, the current anomaly detection model is determined to be an order anomaly detection model. The method for generating each order anomaly detection model is the same. Taking the example of an order anomaly detection model generating m detection sub-models, such as Figure 6 As shown in the figure, a schematic diagram of the process of generating an order anomaly detection model is shown. When generating each detection sub-model in the same order anomaly detection model, the sample weight remains unchanged.

[0066] In some embodiments, the server may generate an order anomaly detection model using a greedy algorithm, for example, a decision tree may be generated using an exact greedy algorithm as the order anomaly detection model.

[0067] In this embodiment, each detection sub-model in the order anomaly detection model is generated based on the sample weight of the sample transaction order, so that the sample weight affects the generation of each detection sub-model, so that the generated order anomaly detection model is affected by the sample weight, thereby improving the rationality of the order anomaly detection model.

[0068] In some embodiments, generating a detection sub-model based on multiple sample transaction orders and sample weights of each sample transaction order includes: generating a benchmark sub-model based on multiple sample transaction orders, updating the benchmark sub-model to obtain at least one updated sub-model corresponding to the benchmark sub-model; for each updated sub-model, detecting the sample transaction order through the updated sub-model and the current anomaly detection model to obtain a predicted abnormality degree characterization value of the sample transaction order; determining the sample prediction deviation value of the sample transaction order according to the predicted abnormality degree characterization value of the sample transaction order and the sample weight of the sample transaction order; generating a detection sub-model according to the sample prediction deviation value of each sample transaction order detected by each updated sub-model and each updated sub-model.

[0069] The benchmark sub-model may be variable. The benchmark sub-model may be a decision tree. The initial benchmark sub-model may be a decision tree with only one root node, and in the initial benchmark sub-model, each sample transaction order is divided into the root node. When the initial benchmark sub-model is updated, two leaf nodes are generated for the root node, and each sample transaction order in the root node is divided into the two leaf nodes respectively. At least one updated sub-model is obtained for each update.

[0070] Specifically, for each updated sub-model and each sample transaction order, the server detects the sample transaction order through the updated sub-model to obtain a first detection value of the sample transaction order, and detects the sample transaction order through the current anomaly detection model to obtain a second detection value of the sample transaction order, and sums the first detection value of the sample transaction order and the second detection value of the sample transaction order, and uses the summed result as the predicted abnormality degree representation value of the sample transaction order. For a sample transaction order, if there are k1 updated sub-models, there are k1 predicted abnormality degree representation values ​​for the sample transaction order.

[0071] In some embodiments, for each updated sub-model, the sample prediction deviation value of the sample transaction order is determined according to the predicted abnormality degree characterization value of the sample transaction order and the sample weight of the sample transaction order. Specifically, the server calculates the difference between the predicted abnormality degree characterization value of the sample transaction order and the actual abnormality degree characterization value of the sample transaction order to obtain the characterization deviation value of the sample transaction order, and determines the sample prediction deviation value of the sample transaction order based on the characterization deviation value of the sample transaction order and the sample weight of the sample transaction order. The sample prediction deviation value is positively correlated with the sample weight and the characterization deviation value. For an updated sub-model, if there are k2 sample transaction orders, the sample prediction deviation values ​​of these k2 sample transaction orders are calculated respectively. The sample prediction deviation value is positively correlated with the sample weight.

[0072] In some embodiments, for each updated sub-model, the server determines the objective function corresponding to the updated sub-model and the current anomaly detection model as a whole. The objective function includes a loss function and a regularization term. For example, the objective function can be expressed as: Obj(Θ) = L(Θ) + Ω(Θ), wherein Obj(Θ) represents the objective function, L(Θ) represents the loss function, Ω(Θ) represents the regularization term, Θ represents the model parameters, and the model parameters represented by Θ include the model parameters of the current anomaly detection model and the model parameters of the updated sub-model. The loss function is used to measure the accuracy of the predicted abnormality representation value of the sample transaction order jointly predicted by the updated sub-model and the current anomaly detection model, and is used to improve the prediction accuracy of the order anomaly detection model. The regularization term is used to control the complexity of the order anomaly detection model. Among them, the loss function is positively correlated with the sample prediction deviation value of the sample transaction order.

[0073] In some embodiments, for regression tasks, the loss function may use square loss, for example, the loss function may be expressed as: For binary classification tasks, the loss function can use cross entropy loss. For example, the loss function can be expressed as: Where N is the number of sample transaction orders, y i Refers to the true abnormality level representation value, p i Refers to the predicted abnormality characterization value of the sample transaction order. i Refers to the sample weight of the i-th sample transaction order. p i -y i is the characterization value deviation of the i-th sample transaction order.

[0074] In some embodiments, the baseline sub-model, the update sub-model and the detection sub-model all belong to a decision tree. The regularization term can be expressed as: Wherein, T is the number of leaf nodes, and the T leaf nodes include the leaf nodes of the detection sub-model and the leaf nodes of the update sub-model in the current anomaly detection model. j is the weight of the jth leaf node, λ and γ are regularization parameters, and λ and γ can be set as needed.

[0075] In some embodiments, for each updated sub-model, when the preset iteration stop condition is not met, the server determines the value of the objective function corresponding to the updated sub-model, determines the updated sub-model corresponding to the minimum objective function value from each updated sub-model, uses the determined updated sub-model as a new baseline sub-model, and returns the step of updating the baseline sub-model to obtain at least one updated sub-model corresponding to the baseline sub-model. When the preset iteration stop condition is met, the baseline sub-model is determined as the detection sub-model. Among them, the preset iteration stop condition includes that the value of the minimum objective function is less than the preset value, and the preset value can be set as needed. Thereby preventing the detection sub-model from overfitting. By determining the updated sub-model corresponding to the minimum objective function value from each updated sub-model, and using the determined updated sub-model as a new baseline sub-model, the current anomaly detection model can be updated in the direction of reducing the objective function, thereby improving the detection accuracy of the generated order anomaly detection model.

[0076] In some embodiments, after obtaining the reference sub-model, if the depth of the reference sub-model is greater than or equal to the depth threshold or the minimum weight of the leaf node of the reference sub-model is less than or equal to the weight threshold, the process of updating the reference sub-model to generate the updated sub-model is stopped. If the depth of the reference sub-model is less than the depth threshold and the minimum weight of the leaf node of the reference sub-model is greater than the weight threshold, the process of updating the reference sub-model to obtain the updated sub-model is entered.

[0077] In this embodiment, since the sample prediction deviation value of the sample transaction order is determined according to the prediction abnormality degree characterization value of the sample transaction order and the sample weight of the sample transaction order, the rationality of the detection sub-model is improved.

[0078] In some embodiments, generating a detection submodel based on the sample prediction deviation value of each sample transaction order detected by each update submodel and each update submodel includes: for each update submodel, determining the update gain value of the update submodel based on the sample prediction deviation value of each sample transaction order; when the second iteration stop condition is not met, selecting the update submodel with the largest update gain value from each update submodel as a new baseline submodel, and returning to the step of updating the baseline submodel to obtain at least one update submodel corresponding to the baseline submodel; when the second iteration stop condition is met, determining the baseline submodel as the detection submodel.

[0079] Among them, the second iteration stop condition includes that each update gain value is greater than the gain threshold, and the gain threshold can be set as needed, for example, it can be a positive number close to 0. The second iteration stop condition can also include that the complexity of the update sub-model with the largest update gain value is less than the complexity threshold. The complexity can be determined according to the number of parameters of the update sub-model. The more the number of parameters, the higher the complexity. Therefore, the second iteration stop condition can also include that the number of parameters of the update sub-model with the largest update gain value is less than or equal to the parameter number threshold. The parameter number threshold can be set as needed, for example, 100 or 200. In the case where the update sub-model is a decision tree, the complexity can be determined according to the depth of the tree and the minimum weight of the leaf node. The greater the depth, the greater the complexity, and the smaller the minimum weight of the leaf node, the greater the complexity.

[0080] The update gain value of the update submodel is used to reflect the reduction in the value of the objective function from the baseline submodel to the update submodel. The value reduction = the first objective function value - the second objective function value. The first objective function value refers to the value of the objective function corresponding to the baseline submodel and the current anomaly detection model as a whole, and the second objective function value refers to the value of the objective function corresponding to the update submodel and the current anomaly detection model as a whole. The larger the update gain value, the greater the value reduction. By selecting the update submodel with the largest update gain value as the new baseline submodel, the value of the objective function can be changed in a decreasing direction, thereby continuously improving the detection accuracy of the current anomaly detection model, thereby improving the detection accuracy of the generated order anomaly detection model.

[0081] Specifically, the benchmark sub-model is a decision tree. The server can generate an initial benchmark sub-model based on multiple sample transaction orders. The initial benchmark sub-model includes a root node, and each sample transaction order is divided into the root node. The server can update the benchmark sub-model to obtain at least one updated sub-model corresponding to the benchmark sub-model. For example, the server can determine a candidate splitting node from the benchmark sub-model, generate at least one splitting condition for the candidate splitting node, and for each splitting condition of the candidate splitting node, generate a sub-node for the candidate splitting node in the benchmark sub-model according to the splitting condition, such as generating a left leaf node and a right leaf node, to obtain an updated sub-model that meets the splitting condition. The server divides the multiple sample transaction orders in the root node into a left leaf node and a right leaf node according to the splitting condition. The updated gain value can be expressed as:

[0082]

[0083] Where Gain is the updated gain value. L is the sum of the gradients of each sample transaction order in the left leaf node generated according to the splitting condition, G Ris the sum of the gradients of each sample transaction order in the right leaf node generated according to the splitting condition, H L is the sum of the second-order derivatives of each sample transaction order in the left leaf node generated according to the splitting condition, H R It is the sum of the second-order derivatives of each sample trading order in the right leaf node generated according to the splitting condition. The sample transaction order is detected by the current anomaly detection model to obtain the second detection value of the sample transaction order. i It refers to the gradient of the i-th sample transaction order. i It refers to the second-order derivative of the i-th sample transaction order.

[0084] In this embodiment, when the second iteration stop condition is not met, the update sub-model with the largest update gain value is selected from each update sub-model as the new benchmark sub-model. When the second iteration stop condition is met, the benchmark sub-model is determined as the detection sub-model, thereby improving the rationality and detection accuracy of the detection sub-model.

[0085] In some embodiments, the benchmark sub-model belongs to a decision tree; generating a benchmark sub-model based on multiple sample transaction orders includes: generating a benchmark sub-model based on multiple sample transaction orders; the benchmark sub-model includes a root node, and each sample transaction order is divided into the root node; updating the benchmark sub-model to obtain at least one updated sub-model corresponding to the benchmark sub-model includes: obtaining order features of multiple sample transaction orders; the order features of the sample transaction orders include feature values ​​of the sample transaction orders under multiple preset order feature dimensions; determining a candidate splitting node from the benchmark sub-model, and generating at least one splitting condition for the candidate splitting node; the splitting condition includes a splitting order feature dimension and a splitting value corresponding to the splitting order feature dimension; the splitting order feature dimension belongs to multiple preset order feature dimensions; for each splitting condition of the candidate splitting node, generating a child node for the candidate splitting node in the benchmark sub-model according to the splitting condition, and generating an updated sub-model that meets the splitting condition.

[0086] The benchmark sub-model may be variable. The initial benchmark sub-model may be a decision tree with only one root node, in which each sample transaction order is divided into the root node. When the initial benchmark sub-model is updated, two leaf nodes are generated for the root node, and each sample transaction order in the root node is divided into the two leaf nodes. At least one updated sub-model is obtained for each update.

[0087] Specifically, the server determines a candidate splitting node from the baseline sub-model, generates at least one splitting condition for the candidate splitting node, the splitting condition includes a splitting order feature dimension and a splitting value corresponding to the splitting order feature dimension, and the splitting order feature dimension belongs to multiple preset order feature dimensions. For each splitting condition of the candidate splitting node, a child node is generated for the candidate splitting node in the baseline sub-model according to the splitting condition, and an updated sub-model that meets the splitting condition is generated. Among them, the candidate splitting node can be one or more, and multiple means at least two. Each candidate splitting node is processed in the same way.

[0088] In some embodiments, for each preset order feature dimension, the server determines whether a node corresponding to the preset order feature dimension already exists in the benchmark sub-model, or if not, the preset order feature dimension is used as the split order feature dimension, and the split value is determined according to the feature value of each sample transaction order under the preset order feature dimension. For example, the server can use the mode or average of the feature values ​​of each sample transaction order under the preset order feature dimension as the split value, or can use any feature value of the feature values ​​of each sample transaction order under the preset order feature dimension as the split value. The method of generating the split value is not limited here.

[0089] In this embodiment, a candidate splitting node is determined from the benchmark sub-model, and at least one splitting condition of the candidate splitting node is generated. The splitting condition includes a splitting order feature dimension and a splitting value corresponding to the splitting order feature dimension. The splitting order feature dimension belongs to multiple preset order feature dimensions. For each splitting condition of the candidate splitting node, a sub-node is generated for the candidate splitting node in the benchmark sub-model according to the splitting condition, and an updated sub-model that meets the splitting condition is generated, so that the updated sub-model fully considers each of the multiple preset order feature dimensions, thereby improving the rationality of the generated detection sub-model.

[0090] In some embodiments, determining the sample prediction deviation value of the sample transaction order based on the predicted abnormality degree characterization value of the sample transaction order and the sample weight of the sample transaction order includes: determining the difference between the predicted abnormality degree characterization value of the sample transaction order and the actual abnormality degree characterization value of the sample transaction order to obtain the characterization deviation value of the sample transaction order; determining the sample prediction deviation value of the sample transaction order based on the characterization deviation value of the sample transaction order and the sample weight of the sample transaction order.

[0091] Specifically, the server may obtain the characterization deviation value of the sample transaction order according to the difference between the predicted abnormality characterization value of the sample transaction order and the actual abnormality characterization value of the sample transaction order. The absolute value of the difference between the predicted abnormality characterization value and the actual abnormality characterization value is positively correlated with the characterization deviation value of the sample transaction order. The server may use the absolute value or square value of the difference as the characterization deviation value of the sample transaction order.

[0092] In some embodiments, the server performs a product operation on the characterization deviation value of the sample transaction order and the sample weight of the sample transaction order, and uses the result of the product operation as the sample prediction deviation value of the sample transaction order.

[0093] In this embodiment, the difference between the predicted abnormality degree characterization value of the sample transaction order and the actual abnormality degree characterization value of the sample transaction order is determined to obtain the characterization deviation value of the sample transaction order, and based on the characterization deviation value of the sample transaction order and the sample weight of the sample transaction order, the sample prediction deviation value of the sample transaction order is determined, thereby improving the rationality of the sample prediction deviation value.

[0094] In some embodiments, the sample transaction order is a transaction order triggered by a social application; multiple preset order feature dimensions include resource transfer account reliability, and obtaining order features of multiple sample transaction orders includes: for each sample transaction order, based on the social information of the resource transferor of the sample transaction order in the social application, determining the feature value of the sample transaction order under the resource transfer account reliability; according to the feature value of the sample transaction order under the resource transfer account reliability, obtaining the order features of the sample transaction order.

[0095] Among them, the terminal may be installed with a social application, and the social application includes but is not limited to an instant messaging application for individuals or an instant messaging application for groups. The social application installed on the terminal may provide a payment function, so that the user can use the payment function to realize the transaction. The server may be the server where the background service of the social application is located. The resource transfer account refers to the account to which the sample transaction order transfers the resources, that is, the account of the resource transferee. The characteristic value under the reliability of the resource transfer account is used to characterize the reliability of the resource transfer account. The larger the characteristic value, the greater the reliability. Social information includes but is not limited to the number of friends, the frequency of interaction with friends, etc. For example, the more friends there are, the greater the reliability, and the higher the interaction frequency, the greater the reliability.

[0096] In this embodiment, the order characteristics of the sample transaction order are obtained according to the characteristic values ​​of the sample transaction order under the resource transfer account reliability, which improves the rationality of the order characteristics and helps to detect abnormal transaction orders.

[0097] In some embodiments, the step of determining multiple sample transaction orders includes: obtaining a first set of historical transaction orders; the order type of each historical transaction order in the first set of historical transaction orders is a normal order; obtaining a second set of historical transaction orders; the order type of each historical transaction order in the second set of historical transaction orders is an abnormal order; obtaining a first number of historical transaction orders from the first set of historical transaction orders, and obtaining a second number of historical transaction orders from the second set of historical transaction orders; obtaining multiple sample transaction orders based on the first number of historical transaction orders and the second number of historical transaction orders; the first number is different from the second number.

[0098] Among them, the historical transaction order can be triggered in a social application. Social applications include but are not limited to instant messaging applications for individuals or instant messaging applications for groups. Historical transaction orders are orders for resource transfer triggered in social applications. For example, historical transaction orders can be orders for resource transfer such as transferring money to friends, scanning code transfers, or sending red envelopes. Resources refer to resources that exist in electronic accounts and can be circulated, such as resources that can be circulated on the Internet through accounts. An account may include at least one of a bank card number or an Internet payment account. Resources may include funds in an account, virtual red envelopes, game coins, or virtual items, etc. Resource transfer refers to the transfer of resources from one account to another.

[0099] The order type of each historical transaction order in the first historical transaction order set is a normal order. The order type of each historical transaction order in the second historical transaction order set is an abnormal order. Historical transaction orders refer to transaction orders generated in a historical time period, such as transaction orders generated in the last year or 6 months. The first quantity is greater than the second quantity. Alternatively, the first quantity is less than the second quantity.

[0100] Specifically, the server may obtain a first number of historical transaction orders from a first historical transaction order set and a second number of historical transaction orders from a second historical transaction order set according to a preset ratio. The ratio of the first number to the second number is the preset ratio. The preset ratio is a value greater than 1, or a value less than 1. The preset ratio may be determined according to an actual scenario. For example, each transaction order within a period of time, such as 1 month or 15 days, in an actual scenario may be obtained, and the ratio of the number of normal transaction orders to the number of abnormal transaction orders in each transaction order may be used as the preset threshold.

[0101] In this embodiment, since the first quantity is different from the second quantity, normal sample transaction orders and abnormal sample transaction orders are unbalanced. Since the weight is updated in the process of generating each order anomaly detection model, when the normal sample transaction orders and abnormal sample transaction orders are unbalanced, for example, when the first quantity is greater than the second quantity, it can be avoided that the preset number of order anomaly detection models have a higher accuracy in detecting normal transaction orders and a lower accuracy in detecting abnormal transaction orders, thereby avoiding the preset number of order anomaly detection models from paying excessive attention to normal transaction orders and having insufficient recognition ability for abnormal transaction orders.

[0102] In the field of social payment, the detection of fraudulent behavior can be regarded as an anomaly detection problem with unbalanced samples. Currently, anomaly detection in this field mainly relies on compound rules and traditional machine learning models such as logistic regression models. However, these models may face challenges in some cases when the samples are unbalanced. For example, since most samples belong to the normal class, the model may perform well in predicting the normal class but poorly in predicting the fraud class. In this case, the model may focus too much on the normal class, resulting in insufficient recognition of the fraud class.

[0103] The order type determination method proposed in the present application can be used to detect the suspiciousness of C2C transaction behavior to detect suspicious fraudulent behavior. C2C is a professional term in e-commerce, which means e-commerce between individuals, where C refers to consumers, because the English word for consumer is Customer (Consumer). The order type determination method proposed in the present application can adjust the sample weights through an adaptive enhancement strategy. By adjusting the sample weights according to the error of each sample in the previous round of classification, fraudulent samples that are difficult to classify are easier to identify in subsequent classifiers. This method shows higher robustness when processing unbalanced data, and can better focus on fraud categories, thereby improving the accuracy and stability of fraud detection.

[0104] In some embodiments, updating the sample weight of the sample transaction order based on the order anomaly degree characterization value of the sample transaction order detected by the order anomaly detection model includes: determining the predicted order type of the sample transaction order based on the order anomaly degree characterization value of the sample transaction order detected by the order anomaly detection model; and increasing the sample weight of the sample transaction order when the predicted order type of the sample transaction order is inconsistent with the actual order type of the sample transaction order.

[0105] The predicted order type refers to the order type to which the predicted sample transaction order belongs, which may be the same as or different from the actual order type of the sample transaction order.

[0106] Specifically, the server may set an increase coefficient. When the predicted order type of the sample transaction order is inconsistent with the actual order type of the sample transaction order, the server may multiply the sample weight of the sample transaction order by the increase coefficient, and use the multiplication result as the sample weight of the sample transaction order, thereby increasing the sample weight. The increase coefficient is a value greater than 1, such as 1.1 or 1.2.

[0107] In some embodiments, the server may set a reduction coefficient. When the predicted order type of the sample transaction order is consistent with the actual order type of the sample transaction order, the server may multiply the sample weight of the sample transaction order by the reduction coefficient and use the multiplication result as the sample weight of the sample transaction order, thereby reducing the sample weight. The reduction coefficient is a value less than 1, such as 0.9 or 0.95.

[0108] In this embodiment, since the larger the sample weight, the more attention the order anomaly detection model pays to the sample transaction order, therefore, when the predicted order type of the sample transaction order is inconsistent with the actual order type of the sample transaction order, increasing the sample weight of the sample transaction order can increase the influence of the sample transaction order on the next generated order anomaly detection model, thereby making the next generated order anomaly detection model pay more attention to the sample transaction order, thereby improving the accuracy of the order anomaly degree representation value of the sample transaction order detected by the next generated order anomaly detection model, thereby improving the prediction accuracy of the order type of the sample transaction order.

[0109] In some embodiments, the method also includes: determining the transaction order to be detected; for each order anomaly detection model, detecting the transaction order respectively through each detection sub-model in the order anomaly detection model to obtain the order anomaly degree characterization value of the transaction order detected by the order anomaly detection model; based on the order anomaly degree characterization value of the transaction order detected by each order anomaly detection model, determining the order type to which the transaction order belongs.

[0110] Among them, the transaction order to be detected may be triggered in a social application. Social applications include but are not limited to instant messaging applications for individuals or instant messaging applications for groups. The transaction order to be detected is an order for resource transfer triggered in a social application. For example, the transaction order may be an order for resource transfer such as friend transfer, code transfer, or red envelope transfer. Resources refer to resources that exist in an electronic account and can be circulated, such as resources that can be circulated on the Internet through an account. An account may include at least one of a bank card number or an Internet payment account. Resources may include funds in an account, virtual red envelopes, game coins, or virtual items, etc. Resource transfer refers to the transfer of resources from one account to another.

[0111] Specifically, the server determines the order features of the transaction order to be detected. For each order anomaly detection model, the server inputs the order features of the transaction order to be detected into each detection sub-model of the order anomaly detection model, and detects and obtains the order anomaly degree characterization value of the transaction order. The server can count the order anomaly degree characterization values ​​of the transaction orders detected by each order anomaly detection model to obtain the order type to which the transaction order belongs. Among them, the transaction order to be detected is a transaction order triggered by a social application. The method for determining the order features of the transaction order to be detected refers to the method for obtaining the order features of the sample transaction order.

[0112] In some embodiments, after the server obtains a preset number of order anomaly detection models, it can perform accuracy evaluation on the preset number of order anomaly detection models. After the accuracy evaluation is passed, the preset number of order anomaly detection models are applied to the detection of transaction orders. Specifically, the server obtains multiple evaluation transaction orders, and the evaluation transaction orders are used to evaluate the preset number of order anomaly detection models. For each evaluation transaction order, the server obtains the order anomaly degree characterization values ​​detected by each order anomaly detection model for the evaluation transaction order, and performs statistics on each order anomaly degree characterization value of the evaluation transaction order to obtain the order anomaly degree statistical value of the evaluation transaction order. When the order anomaly degree statistical value is greater than or equal to the characterization threshold, the predicted order type of the evaluation transaction order is determined to be an abnormal order, otherwise, the predicted order type of the evaluation transaction order is determined to be a normal order. The characterization threshold can be an empirical value or can be obtained based on experiments. For example, the server can obtain the real abnormality degree characterization values ​​of multiple abnormal sample transaction orders, and determine the characterization threshold according to the real abnormality degree characterization values ​​of the multiple abnormal sample transaction orders. For example, the smallest real abnormality degree characterization value among the real abnormality degree characterization values ​​of the multiple abnormal sample transaction orders can be used as the characterization threshold. Of course, it can also be determined by other methods, which are not limited here.

[0113] In some embodiments, the server determines the number of evaluated transaction orders whose actual order type is abnormal orders in each evaluated transaction order to obtain the first order quantity, determines the number of evaluated transaction orders whose predicted order type and actual order type are both abnormal orders in each evaluated transaction order to obtain the second order quantity; calculates the ratio of the second order quantity to the first order quantity to obtain the first evaluation value. That is, the first evaluation value = the second order quantity / the first order quantity, the server determines the number of evaluated transaction orders whose predicted order type is abnormal orders in each evaluated transaction order to obtain the third order quantity, and calculates the ratio of the third order quantity to the second order quantity to obtain the second evaluation value. That is, the second evaluation value = the third order quantity / the second order quantity. When the first evaluation value is greater than the first threshold value and the second evaluation value is greater than the second threshold value, it is determined that the accuracy evaluation passes.

[0114] Among them, the first threshold can be set as needed, for example, it can be 90% or 95%. The first evaluation value is less than or equal to 1. The closer the first evaluation value is to 1, the higher the accuracy of the preset number of order anomaly detection model as a whole. Since the ratio of the third order quantity to the second order quantity is greater than or equal to 1, the second evaluation value is also greater than or equal to 1. The closer the second evaluation value is to 1, the higher the accuracy of the preset number of order anomaly detection model as a whole. The second threshold can be set as needed, for example, 1.1 or 1.2.

[0115] In some embodiments, the server may also evaluate the distribution of statistical values ​​of the degree of order abnormality of the transaction order, information value (IV), AUC (area under curve) and KS (Kolmogorov-Smirnov). Among them, AUC refers to the area enclosed by the ROC curve and the x-axis. KS refers to the intercept of the tangent line with a slope of 1 of the ROC curve. The ROC (receiver operating characteristic curve) curve refers to the receiver operating characteristic curve.

[0116] In this embodiment, based on the order anomaly degree characterization values ​​of the transaction orders detected by each order anomaly detection model, the order type to which the transaction order belongs is determined, thereby improving the detection accuracy of the order type.

[0117] In some embodiments, transaction orders are detected respectively by each detection sub-model in the order anomaly detection model to obtain the order anomaly degree characterization value of the transaction order detected by the order anomaly detection model, including: detecting transaction orders respectively by each detection sub-model in the order anomaly detection model to obtain the detection value of each detection sub-model for the transaction order; and counting the detection value of each detection sub-model for the transaction order to obtain the order anomaly degree characterization value of the transaction order detected by the order anomaly detection model.

[0118] Specifically, for each order anomaly detection model, the server determines the order features of the transaction order to be detected, inputs the order features of the transaction order into each detection sub-model in the order anomaly detection model respectively, predicts the transaction order through each detection sub-model respectively, obtains the detection value of each detection sub-model, sums the detection values ​​of each detection sub-model, and uses the calculated result as the characterization value of the order anomaly degree of the transaction order.

[0119] In this embodiment, the detection values ​​of each detection sub-model for the transaction order are statistically analyzed to obtain the order abnormality degree characterization value of the transaction order detected by the order abnormality detection model, thereby determining the order abnormality degree characterization value of the transaction order through detection by the order abnormality detection model, thereby improving the accuracy of the order abnormality degree characterization value of the transaction order.

[0120] In some embodiments, the method further includes: for each sample transaction order, based on the model weights of each order anomaly detection model, performing statistics on the abnormality degree characterization values ​​of the sample transaction order for each order anomaly detection model, to obtain the order abnormality degree statistical value of the sample transaction order; determining the difference between the order abnormality degree statistical value of the sample transaction order and the true abnormality degree characterization value of the sample transaction order, to obtain the statistical deviation value of the sample transaction order; determining the model weight loss value based on the statistical deviation value of each sample transaction order, and updating the model weights of each order anomaly detection model in a direction that reduces the model weight loss value, to obtain the detection model weight of each order anomaly detection model; determining the order type to which the transaction order belongs based on the order anomaly degree characterization values ​​of the transaction orders detected by each order anomaly detection model, including: performing statistics on the abnormality degree characterization values ​​of the transaction order for each order anomaly detection model based on the detection model weights of each order anomaly detection model, to obtain the order anomaly degree statistical value of the transaction order; determining the order type to which the transaction order belongs according to the order anomaly degree statistical value of the transaction order.

[0121] Specifically, the server sets an initial model weight for each order anomaly detection model, obtains the order anomaly degree characterization value of each sample transaction order detected by each order anomaly detection model, and for each sample transaction order, based on the model weight of each order anomaly detection model, performs statistics on the anomaly degree characterization value of each sample transaction order for each order anomaly detection model, obtains the order anomaly degree statistical value of the sample transaction order, determines the difference between the order anomaly degree statistical value of the sample transaction order and the true anomaly degree characterization value of the sample transaction order, obtains the statistical deviation value of the sample transaction order, and determines the model weight loss value based on the statistical deviation value of each sample transaction order, and the model weight loss value is positively correlated with the statistical deviation value of each sample transaction order. The server can update the model weight of each order anomaly detection model in the direction of reducing the model weight loss value, until the change in the model weight loss value is less than the change threshold, or the model weight loss value is less than the loss threshold, then stop updating the model weight, and determine the model weight of the order anomaly detection model when the update is stopped as the detection model weight of the order anomaly detection model. Among them, the server performs weighted calculation on the abnormality degree characterization value of the sample transaction order for each order anomaly detection model, and normalizes the result of the weighted calculation, for example, by normalizing it through the sigmoid function, and uses the normalized result as the statistical value of the order abnormality degree of the sample transaction order.

[0122] In some embodiments, the server may perform weighted calculation on the abnormality degree characterization value of the transaction order for each order anomaly detection model based on the detection model weight of each order anomaly detection model, and use the result of the weighted calculation as the statistical value of the order abnormality degree of the transaction order.

[0123] In some embodiments, the server may compare the order abnormality degree statistics of the transaction order with the characterization threshold. When the order abnormality degree statistics is greater than or equal to the characterization threshold, the order type of the transaction order is determined to be an abnormal order; otherwise, the order type of the transaction order is determined to be a normal order.

[0124] In some embodiments, when the order type to which the transaction order belongs is an abnormal order, the service may send an order abnormality prompt message to the terminal, and may also send an order abnormality prompt message for the transaction order to a device used for security management.

[0125] In this embodiment, the model weight loss value is determined based on the statistical deviation value of each sample transaction order, and the model weight of each order anomaly detection model is updated in the direction of reducing the model weight loss value to obtain the detection model weight of each order anomaly detection model, thereby improving the accuracy of the detection model weight. Based on the detection model weight of each order anomaly detection model, the abnormality degree characterization value of each order anomaly detection model is statistically analyzed for the transaction order to obtain the order abnormality degree statistical value of the transaction order, and the order type to which the transaction order belongs is determined according to the order abnormality degree statistical value of the transaction order, thereby improving the detection accuracy of the order type.

[0126] In some embodiments, Figure 7 As shown, a method for determining an order type is provided. The method can be executed by a terminal or a server, or can be executed by both the terminal and the server. The method is applied to a server as an example for explanation, and includes the following steps:

[0127] Step 702: Generate a detection sub-model based on multiple sample transaction orders and the sample weight of each sample transaction order.

[0128] Step 704, initialize the current anomaly detection model, add the detection sub-model to the current anomaly detection model to update the current anomaly detection model.

[0129] Step 706, determine whether the first iteration stop condition is met, if not, return to step 702, if yes, execute step 708.

[0130] Step 708: determine the current anomaly detection model as the order anomaly detection model.

[0131] Among them, the order anomaly detection model can be generated based on the XGB algorithm. The XGB algorithm is a decision tree ensemble algorithm based on the gradient boosting method. Its core idea is to iteratively construct multiple weak learners (usually decision trees) and linearly combine these weak learners to obtain a stronger prediction model. The basic principle of XGB comes from the gradient boosting method. Gradient boosting is an ensemble learning algorithm for regression and classification tasks. It iteratively trains a series of weak learners and combines these weak learners into a strong learner. In each round of iteration, the model focuses on samples that have large errors in previous predictions, assigns higher weights to these samples, and optimizes the objective function to reduce the prediction error. XGB uses CART (Classification and Regression Tree) as the base learner. CART is a binary tree structure, each internal node corresponds to a feature and its split point, and each leaf node corresponds to a weight value.

[0132] Step 710, determine whether a preset number of order anomaly detection models are generated, if not, execute step 712, if yes, execute step 714.

[0133] Step 712 , for each sample transaction order, based on the order anomaly degree characterization value of the sample transaction order detected by the order anomaly detection model, update the sample weight of the sample transaction order, and return to step 702 .

[0134] Step 714, determining the transaction order to be detected.

[0135] Step 716: for each order anomaly detection model, the transaction orders are respectively detected by each detection sub-model in the order anomaly detection model to obtain the order anomaly degree representation value of the transaction order detected by the order anomaly detection model.

[0136] Step 718: Determine the order type to which the transaction order belongs based on the order anomaly degree characterization values ​​of the transaction order detected by each order anomaly detection model.

[0137] The order type determination method provided in the present application may have different characteristics of different sample transaction orders. For example, some sample transaction orders are easier to identify the order type they belong to, while some sample transaction orders are not easy to identify the order type they belong to. Therefore, in each iteration, the sample weight of the sample transaction order is updated based on the order anomaly degree characterization value of the sample transaction order detected by the order anomaly detection model, so that the degree of attention of the order anomaly detection model to the sample order can be updated, so that the degree of influence of the sample order in the process of generating different order anomaly detection models is reasonably changed, so that the preset number of order anomaly detection models generated can be used to predict the order type to which transaction orders with different characteristics belong, thereby improving the detection accuracy of the order type. The order type determination method provided in the present application can be applied to scenarios with unbalanced samples such as gambling and money laundering, and strengthen the detection ability of abnormal samples to improve the accuracy of anomaly detection and fraud detection. It is used to detect transactions used for gambling and transactions used for money laundering. The order type determination method provided in the present application can be applied in the fields of finance, e-commerce and social payment. The identification and detection of fraudulent behavior is one of the key tasks, and the data samples in these scenarios usually have the problem of imbalance. The order type determination method provided by this application can improve the accuracy of anomaly detection and fraud detection, thereby reducing risk losses and protecting the interests of the platform and users. The order type determination method provided by this application can adopt an anomaly detection method based on adaptive enhanced XGB. However, other types of unsupervised machine learning models, such as tree models, can also be included as sub-models in the adaptive enhancement or integrated model framework, thereby further improving the performance and effect of the overall model. The order type determination method provided by this application has applications, including but not limited to fraud identification scenarios, and the patented technical solution can also be used in other risk identification businesses, such as gambling, money laundering and other businesses.

[0138] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0139] Based on the same inventive concept, the embodiment of the present application also provides an order type determination device for implementing the order type determination method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more order type determination device embodiments provided below can refer to the limitations of the order type determination method above, and will not be repeated here.

[0140] In some embodiments, Figure 8 As shown, an order type determination device is provided, including: a model generation module 802, a weight update module 804 and an iteration module 806, wherein:

[0141] The model generation module 802 is used to generate an order anomaly detection model based on multiple sample transaction orders and sample weights of each sample transaction order; the order anomaly detection model includes multiple detection sub-models, and each detection sub-model in the order anomaly detection model is generated sequentially, and the generation process of the detection sub-model generated later depends on the detection sub-model generated earlier; the order anomaly degree representation value detected by the order anomaly detection model is the combination of the detection values ​​of each detection sub-model in the order anomaly detection model.

[0142] The weight updating module 804 is used to update the sample weight of each sample transaction order based on the order anomaly degree representation value of the sample transaction order detected by the order anomaly detection model.

[0143] Iteration module 806 is used to return to iteratively execute the steps and subsequent steps of generating an order anomaly detection model based on multiple sample transaction orders and the sample weights of each sample transaction order based on the updated sample weights, so as to regenerate a new order anomaly detection model until a preset number of order anomaly detection models are generated and the iteration is stopped; the preset number of order anomaly detection models are used to determine the order type.

[0144] In some embodiments, the model generation module 802 is further used to generate a detection sub-model based on multiple sample transaction orders and sample weights of each sample transaction order; add the detection sub-model to the current anomaly detection model to update the current anomaly detection model; when the current anomaly detection model does not meet the first iteration stop condition, return to the step of generating the detection sub-model based on multiple sample transaction orders and sample weights of each sample transaction order; when the current anomaly detection model meets the first iteration stop condition, determine the current anomaly detection model as an order anomaly detection model.

[0145] In some embodiments, the model generation module 802 is further used to generate a benchmark sub-model based on multiple sample transaction orders, update the benchmark sub-model to obtain at least one updated sub-model corresponding to the benchmark sub-model; for each updated sub-model, detect the sample transaction order through the updated sub-model and the current anomaly detection model to obtain a predicted abnormality degree characterization value of the sample transaction order; determine the sample prediction deviation value of the sample transaction order according to the predicted abnormality degree characterization value of the sample transaction order and the sample weight of the sample transaction order; generate a detection sub-model according to the sample prediction deviation value of each sample transaction order detected by each updated sub-model and each updated sub-model.

[0146] In some embodiments, the model generation module 802 is also used to determine, for each update sub-model, an update gain value of the update sub-model based on the sample prediction deviation value of each sample transaction order; when the second iteration stop condition is not met, select the update sub-model with the largest update gain value from each update sub-model as the new baseline sub-model, and return to the step of updating the baseline sub-model to obtain at least one update sub-model corresponding to the baseline sub-model; when the second iteration stop condition is met, determine the baseline sub-model as the detection sub-model.

[0147] In some embodiments, the benchmark sub-model belongs to a decision tree; the model generation module 802 is also used to generate a benchmark sub-model based on multiple sample transaction orders; the benchmark sub-model includes a root node, and each sample transaction order is divided into the root node; the order features of the multiple sample transaction orders are obtained; the order features of the sample transaction orders include the feature values ​​of the sample transaction orders under multiple preset order feature dimensions; the candidate splitting node is determined from the benchmark sub-model, and at least one splitting condition of the candidate splitting node is generated; the splitting condition includes a splitting order feature dimension and a splitting value corresponding to the splitting order feature dimension; the splitting order feature dimension belongs to multiple preset order feature dimensions; for each splitting condition of the candidate splitting node, a child node is generated for the candidate splitting node in the benchmark sub-model according to the splitting condition, and an updated sub-model that meets the splitting condition is generated.

[0148] In some embodiments, the model generation module 802 is also used to determine the difference between the predicted abnormality degree characterization value of the sample transaction order and the actual abnormality degree characterization value of the sample transaction order to obtain the characterization deviation value of the sample transaction order; based on the characterization deviation value of the sample transaction order and the sample weight of the sample transaction order, determine the sample prediction deviation value of the sample transaction order.

[0149] In some embodiments, the sample transaction order is a transaction order triggered by a social application; multiple preset order feature dimensions include resource transfer account reliability, and the model generation module 802 is also used to determine, for each sample transaction order, a feature value of the sample transaction order under the resource transfer account reliability based on the social information of the resource transferee of the sample transaction order in the social application; and obtain the order features of the sample transaction order based on the feature value of the sample transaction order under the resource transfer account reliability.

[0150] In some embodiments, the device also includes a sample determination module for determining multiple sample transaction orders, and the sample determination module is also used to obtain a first historical transaction order set; the order type of each historical transaction order in the first historical transaction order set is a normal order; obtain a second historical transaction order set; the order type of each historical transaction order in the second historical transaction order set is an abnormal order; obtain a first number of historical transaction orders from the first historical transaction order set, and obtain a second number of historical transaction orders from the second historical transaction order set; based on the first number of historical transaction orders and the second number of historical transaction orders, obtain multiple sample transaction orders; the first number is different from the second number.

[0151] In some embodiments, the weight updating module 804 is also used to determine the predicted order type of the sample transaction order based on the order anomaly degree characterization value of the sample transaction order detected by the order anomaly detection model; when the predicted order type of the sample transaction order is inconsistent with the actual order type of the sample transaction order, increase the sample weight of the sample transaction order.

[0152] In some embodiments, the device also includes an order type determination module, which is further used to determine the transaction order to be detected; for each order anomaly detection model, the transaction order is detected respectively by each detection sub-model in the order anomaly detection model to obtain the order anomaly degree characterization value of the transaction order detected by the order anomaly detection model; based on the order anomaly degree characterization value of the transaction order detected by each order anomaly detection model, the order type to which the transaction order belongs is determined.

[0153] In some embodiments, the order type determination module is also used to detect transaction orders respectively through each detection sub-model in the order anomaly detection model to obtain the detection value of each detection sub-model for the transaction order; the detection value of each detection sub-model for the transaction order is counted to obtain the order anomaly degree representation value of the transaction order detected by the order anomaly detection model.

[0154] In some embodiments, the device also includes a model weight determination module, which is used to, for each sample transaction order, based on the model weights of each order anomaly detection model, perform statistics on the abnormality degree characterization value of each order anomaly detection model for the sample transaction order, to obtain the order abnormality degree statistical value of the sample transaction order; determine the difference between the order abnormality degree statistical value of the sample transaction order and the actual abnormality degree characterization value of the sample transaction order, to obtain the statistical deviation value of the sample transaction order; determine the model weight loss value based on the statistical deviation value of each sample transaction order, and update the model weight of each order anomaly detection model in the direction of reducing the model weight loss value to obtain the detection model weight of each order anomaly detection model; the order type determination module is also used to perform statistics on the abnormality degree characterization value of each order anomaly detection model for the transaction order based on the detection model weights of each order anomaly detection model, to obtain the order abnormality degree statistical value of the transaction order; determine the order type to which the transaction order belongs according to the order abnormality degree statistical value of the transaction order.

[0155] Each module in the above-mentioned order type determination device can be implemented in whole or in part by software, hardware or a combination thereof. Each of the above-mentioned modules can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each of the above modules.

[0156] In some embodiments, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Fig. 9 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data involved in the order type determination method. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an order type determination method is implemented.

[0157] In some embodiments, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Fig.10As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, an order type determination method is implemented. The display unit of the computer device is used to form a visually visible image, and can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen. The input device of the computer device can be a touch layer covered on the display screen, or a button, trackball or touchpad set on the computer device casing, or an external keyboard, touchpad or mouse, etc.

[0158] Those skilled in the art will understand that Fig. 9 and Fig.10 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0159] In some embodiments, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned order type determination method when executing the computer program.

[0160] In some embodiments, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the steps in the above-mentioned order type determination method are implemented.

[0161] In some embodiments, a computer program product is provided, including a computer program, which implements the steps in the above-mentioned order type determination method when executed by a processor.

[0162] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions. The collection, use and processing of data related to transaction orders involved in this application must comply with the relevant laws, regulations and standards of relevant countries and regions.

[0163] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0164] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0165] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for determining an order type, characterized in that: The method comprises: Based on multiple sample transaction orders and sample weights of each of the sample transaction orders, an order anomaly detection model is generated; the order anomaly detection model includes multiple detection sub-models, each detection sub-model in the order anomaly detection model is generated in sequence, and the generation process of the detection sub-model generated later depends on the detection sub-model generated earlier; the order anomaly degree representation value detected by the order anomaly detection model is the combination of the detection values ​​of each detection sub-model in the order anomaly detection model; For each of the sample transaction orders, based on the order anomaly degree characterization value of the sample transaction order detected by the order anomaly detection model, updating the sample weight of the sample transaction order; Based on the updated sample weights, return to iteratively execute the step of generating an order anomaly detection model based on multiple sample transaction orders and the sample weights of each of the sample transaction orders and subsequent steps to regenerate a new order anomaly detection model until a preset number of order anomaly detection models are generated and the iteration is stopped; the preset number of order anomaly detection models are used to determine the order type.

2. The method according to claim 1, characterized in that: The generating of the order anomaly detection model based on the plurality of sample transaction orders and the sample weight of each of the sample transaction orders comprises: Generate a detection sub-model based on a plurality of sample transaction orders and a sample weight of each of the sample transaction orders; Adding the detection sub-model to the current anomaly detection model to update the current anomaly detection model; If the current anomaly detection model does not meet the first iteration stop condition, return to the step of generating a detection sub-model based on the multiple sample transaction orders and the sample weights of the sample transaction orders; When the current anomaly detection model satisfies the first iteration stop condition, the current anomaly detection model is determined as an order anomaly detection model.

3. The method according to claim 2, characterized in that The generating of the detection sub-model based on the plurality of sample transaction orders and the sample weight of each of the sample transaction orders comprises: Generate a benchmark sub-model based on multiple sample transaction orders, and update the benchmark sub-model to obtain at least one updated sub-model corresponding to the benchmark sub-model; For each updated sub-model, the sample transaction order is detected by using the updated sub-model and the current anomaly detection model to obtain a predicted abnormality degree representation value of the sample transaction order; Determining a sample prediction deviation value of the sample transaction order according to the prediction abnormality degree characterization value of the sample transaction order and the sample weight of the sample transaction order; A detection sub-model is generated based on the sample prediction deviation value of each sample transaction order detected by each update sub-model and each update sub-model.

4. The method according to claim 3, characterized in that: Generating the detection sub-model according to the sample prediction deviation value of each sample transaction order detected by each update sub-model and each update sub-model comprises: For each of the update sub-models, determining an update gain value of the update sub-model based on the sample prediction deviation value of each of the sample transaction orders; When the second iteration stop condition is not met, selecting an updated submodel with the largest update gain value from each updated submodel as a new reference submodel, and returning to the step of updating the reference submodel to obtain at least one updated submodel corresponding to the reference submodel; When the second iteration stopping condition is met, the reference sub-model is determined as the detection sub-model.

5. The method according to claim 3, characterized in that: The benchmark sub-model belongs to a decision tree; Generating a benchmark sub-model based on a plurality of sample transaction orders comprises: generating a benchmark sub-model based on a plurality of sample transaction orders; the benchmark sub-model comprises a root node, and each of the sample transaction orders is divided into the root node; The updating of the reference sub-model to obtain at least one updated sub-model corresponding to the reference sub-model comprises: Acquire order features of the plurality of sample transaction orders; the order features of the sample transaction orders include feature values ​​of the sample transaction orders under a plurality of preset order feature dimensions; Determine a candidate splitting node from the benchmark sub-model, and generate at least one splitting condition of the candidate splitting node; the splitting condition includes a splitting order feature dimension and a splitting value corresponding to the splitting order feature dimension; the splitting order feature dimension belongs to the plurality of preset order feature dimensions; For each splitting condition of the candidate splitting node, a child node is generated for the candidate splitting node in the benchmark sub-model according to the splitting condition, and an updated sub-model that meets the splitting condition is generated.

6. The method according to claim 3, characterized in that The step of determining the sample prediction deviation value of the sample transaction order according to the prediction abnormality degree characterization value of the sample transaction order and the sample weight of the sample transaction order includes: Determine the difference between the predicted abnormality level characterization value of the sample transaction order and the actual abnormality level characterization value of the sample transaction order to obtain a characterization deviation value of the sample transaction order; Based on the characterization deviation value of the sample transaction order and the sample weight of the sample transaction order, a sample prediction deviation value of the sample transaction order is determined.

7. The method according to claim 3, characterized in that The sample transaction order is a transaction order triggered by a social application; the plurality of preset order feature dimensions include resource transfer account reliability, and the order features of the plurality of sample transaction orders are obtained including: For each of the sample transaction orders, based on the social information of the resource transferee of the sample transaction order in the social application, determining a characteristic value of the sample transaction order under the resource transfer-in account reliability; According to the characteristic value of the sample transaction order under the resource transfer-in account reliability, the order characteristic of the sample transaction order is obtained.

8. The method according to claim 1, characterized in that: The step of determining the plurality of sample transaction orders comprises: Acquire a first historical transaction order set; the order type of each historical transaction order in the first historical transaction order set is a normal order; Acquire a second historical transaction order set; the order type of each historical transaction order in the second historical transaction order set is an abnormal order; Acquire a first number of historical trading orders from the first historical trading order set, and acquire a second number of historical trading orders from the second historical trading order set; The plurality of sample transaction orders are obtained based on the first number of historical transaction orders and the second number of historical transaction orders; the first number is different from the second number.

9. The method according to claim 1, characterized in that: The updating of the sample weight of the sample transaction order based on the order anomaly degree characterization value of the sample transaction order detected by the order anomaly detection model comprises: Determining a predicted order type of the sample transaction order based on the order anomaly degree characterization value of the sample transaction order detected by the order anomaly detection model; When the predicted order type of the sample transaction order is inconsistent with the actual order type of the sample transaction order, the sample weight of the sample transaction order is increased.

10. The method according to any one of claims 1 to 9, characterized in that: The method further comprises: Determine the transaction order to be tested; For each of the order anomaly detection models, the transaction orders are respectively detected by each detection sub-model in the order anomaly detection model to obtain an order anomaly degree representation value of the transaction order detected by the order anomaly detection model; Based on the order anomaly degree characterization values ​​of the transaction orders respectively detected by the order anomaly detection models, the order type to which the transaction order belongs is determined.

11. The method according to claim 10, characterized in that The transaction order is detected by each detection sub-model in the order anomaly detection model respectively, and the order anomaly degree characterization value of the transaction order detected by the order anomaly detection model is obtained, which includes: The transaction order is detected by each detection sub-model in the order anomaly detection model, and a detection value of each detection sub-model for the transaction order is obtained; The detection values ​​of each detection sub-model for the transaction order are counted to obtain a value representing the degree of order anomaly of the transaction order detected by the order anomaly detection model.

12. The method according to claim 10, characterized in that The method further comprises: For each of the sample transaction orders, based on the model weights of the order anomaly detection models, statistics are performed on the abnormality degree characterization values ​​of the sample transaction orders of the order anomaly detection models to obtain the order anomaly degree statistical value of the sample transaction order; Determine the difference between the statistical value of the order abnormality degree of the sample transaction order and the actual abnormality degree representation value of the sample transaction order to obtain the statistical deviation value of the sample transaction order; Determine a model weight loss value based on the statistical deviation value of each of the sample transaction orders, and update the model weight of each order anomaly detection model in a direction that reduces the model weight loss value to obtain a detection model weight of each of the order anomaly detection models; The determining the order type to which the transaction order belongs based on the order anomaly degree characterization values ​​of the transaction order respectively detected by the order anomaly detection models comprises: Based on the detection model weights of the order anomaly detection models, statistics are performed on the abnormality degree representation values ​​of the transaction orders of the order anomaly detection models to obtain the order anomaly degree statistics of the transaction orders; The order type to which the transaction order belongs is determined according to the statistical value of the order abnormality degree of the transaction order.

13. An order type determination device, characterized in that: The device comprises: A model generation module, used to generate an order anomaly detection model based on multiple sample transaction orders and sample weights of each of the sample transaction orders; the order anomaly detection model includes multiple detection sub-models, each detection sub-model in the order anomaly detection model is generated in sequence, and the generation process of the detection sub-model generated later depends on the detection sub-model generated earlier; the order anomaly degree representation value detected by the order anomaly detection model is a combination of the detection values ​​of each detection sub-model in the order anomaly detection model; A weight updating module, configured to update, for each of the sample transaction orders, a sample weight of the sample transaction order based on an order anomaly degree characterization value of the sample transaction order detected by the order anomaly detection model; An iteration module is used to return to iteratively execute the step of generating an order anomaly detection model based on multiple sample transaction orders and the sample weights of each of the sample transaction orders and subsequent steps based on the updated sample weights, so as to regenerate a new order anomaly detection model until a preset number of order anomaly detection models are generated and the iteration is stopped; the preset number of order anomaly detection models are used to determine the order type.

14. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 12 are implemented.

15. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 12 are implemented.

16. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 12 are implemented.

Images