Fraudulent transaction detection method and device

Abstract

The invention provides a fraudulent transaction detection method and device, and relates to the technical field of computers. The method specifically comprises the steps of inputting acquired first operation information and a first historical operation information set of a target account into a dynamic behavior model for first detection to obtain a first detection result; determining a first verification mode according to the first detection result; performing first verification on the target account through a first verification mode, and inputting obtained second operation information and a second historical operation information set of the target account into the fraud detection model to perform second detection under the condition that the first verification result indicates that the verification of the target account is passed, so as to obtain a second detection result; and determining a target response mechanism corresponding to the target transaction according to the second detection result. According to the invention, the problem of low accuracy of a fraudulent transaction detection method in the prior art is solved, and the accuracy of the fraudulent transaction detection method is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a fraudulent transaction detection method and device. Background Art

[0002] With the continuous development of the Internet and the increasing popularity of computer and network applications, many payment transactions have shifted from offline transactions to online transactions, such as paying rent, paying tuition, and students paying tuition, etc. In order to ensure that everyone can accurately pay to the corresponding account when making payment transactions, the detection of fraudulent transactions becomes particularly important.

[0003] In the related art, historical transaction data is usually used directly as training data to train its learning model so that it can subsequently detect fraudulent transactions. However, historical transaction data has a serious imbalance (that is, the ratio of abnormal transactions is too low). If fraudulent transaction data is deliberately created, the fraudulent transaction data created is limited, and it is impossible to create fraudulent transaction data that includes multiple forms of fraudulent transactions. Therefore, when a new form of fraudulent transaction appears, there is no way to accurately detect the fraudulent transaction.

[0004] With regard to the problem of low accuracy of fraudulent transaction detection methods in the prior art, no effective technical solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide a fraudulent transaction detection method and device to at least solve the problem of low flexibility of the fraudulent transaction detection method in the prior art.

[0006] According to one aspect of an embodiment of the present application, a fraudulent transaction detection method is provided, including: obtaining first operation information and a first set of historical operation information of a target account, wherein the first operation information is used to indicate information of the target account logging into a transaction platform at a current timestamp; inputting the first operation information and the first set of historical operation information into a dynamic behavior model for a first detection, and obtaining a first detection result corresponding to the first operation information, wherein the first detection result is used to indicate a risk level of a first operation corresponding to the first operation information; determining a first verification method according to the first detection result, and obtaining second operation information and a second set of historical operation information of the target account, wherein the second operation information is used to indicate transaction information corresponding to a target transaction; performing a first verification on the target account through the first verification method, and obtaining a first verification result, and when the first verification result indicates that the target account has passed the verification, inputting the second operation information and the second set of historical operation information into a fraud detection model for a second detection, and obtaining a second detection result corresponding to the second operation information; and determining a target response mechanism corresponding to the target transaction according to the second detection result.

[0007] According to another aspect of an embodiment of the present application, a fraudulent transaction detection device is also provided, including: an acquisition unit, used to acquire first operation information and a first historical operation information set of a target account, wherein the first operation information is used to indicate information that the target account has logged into a transaction platform at a current timestamp; a first detection unit, used to input the first operation information and the first historical operation information set into a dynamic behavior model for a first detection, and obtain a first detection result corresponding to the first operation information, wherein the first detection result is used to indicate a risk level of the first operation corresponding to the first operation information; a first determination unit, used to determine a first verification method according to the first detection result, and to acquire second operation information and a second historical operation information set of the target account, wherein the second operation information is used to indicate transaction information corresponding to a target transaction; a second detection unit, used to perform a first verification on the target account through the first verification method, obtain a first verification result, and when the first verification result indicates that the target account has passed the verification, input the second operation information and the second historical operation information set into a fraud detection model for a second detection, and obtain a second detection result corresponding to the second operation information; a second determination unit, used to determine a target response mechanism corresponding to the target transaction according to the second detection result.

[0008] Optionally, the above-mentioned first detection unit includes a first determination subunit, which is used to determine the data feature scores corresponding to each of the multiple first data in the first operation information according to the first historical operation information set, and the multiple first data include: a reference operation timestamp, a device fingerprint, and a device location. The device fingerprint uniquely corresponds to the device, and the device is used to run the trading platform; a first acquisition subunit, which is used to obtain the preset weight values ​​corresponding to each of the multiple first data; a second determination subunit, which is used to determine the operation score corresponding to the first operation information according to multiple data feature scores and multiple preset weight values; a third determination subunit, which is used to determine the first detection result according to the operation score and a preset interval set, wherein the preset interval set includes multiple preset score intervals.

[0009] Optionally, the above-mentioned first determination subunit includes a first determination module, which is used to determine an operation time period set, a device fingerprint set, and a device location set based on the first historical operation information set; a second determination module, which is used to determine that the data feature score corresponding to the reference timestamp is less than zero when the reference operation timestamp matches the reference time period in the operation time period set, and to determine that the data feature score is not less than zero when the reference timestamp does not match the reference time period, and to determine the data feature score corresponding to the reference timestamp based on the matching result between the reference timestamp and the time period in the operation time period set except the reference time period; and a third determination module, which is used to determine the data feature score corresponding to the device fingerprint based on the matching result between the device fingerprint and the device fingerprint set, and to determine the data feature score corresponding to the device location based on the device location and the device location set.

[0010] Optionally, the above-mentioned first determination unit includes: a fourth determination subunit, used to determine that the first verification method is target account verification, and / or at least one device verification method when the first detection result indicates that the risk level is no risk; when the first detection result indicates that the risk level is light risk and there is at least one device verification method for the device, determine the first verification method to be at least one device verification method; when the first detection result indicates that the risk level is light risk and there is no device verification method for the device, determine the first verification method to be OTP verification; when the first detection result indicates that the risk level is medium risk, determine the first verification method to be OTP verification and fingerprint verification, and / or at least one device verification method; when the first detection result indicates that the risk level is heavy risk, determine the first verification method to be fingerprint verification and face recognition verification.

[0011] Optionally, the above-mentioned second detection unit includes: a construction subunit, used to construct an operation graph structure corresponding to the second operation information based on the second historical operation information set, wherein the multiple graph nodes of the operation graph structure include nodes corresponding to multiple second data in the second operation information; a second acquisition subunit, used to acquire nodes corresponding to multiple second data, obtain multiple data nodes, and determine the node path length between any node in the multiple data nodes and the remaining nodes in the multiple data nodes, to obtain a node path length set; a fifth determination subunit, used to determine the first risk value corresponding to each of the multiple data nodes based on the second historical operation information set, to obtain a first risk value set, and determine the second risk value corresponding to each of the multiple data nodes based on the node path length set and the first risk value set, to obtain a second risk value set; a sixth determination subunit, used to determine the comprehensive risk value of the second operation information based on the second risk value set, and determine the second detection result based on the comprehensive risk value.

[0012] Optionally, the above-mentioned fraud transaction detection device also includes: a third determination unit, used to determine a second verification method based on the second detection result, wherein the second detection result is used to indicate the risk level of the second operation corresponding to the second operation information, and the second verification method is a verification method corresponding to the payment account in the second operation information; a verification subunit, used to perform a second verification on the second operation information according to the second verification method to obtain a second verification result.

[0013] Optionally, the above-mentioned third determination unit includes: a seventh determination subunit, used to determine that the second verification method is a transaction verification method and a face recognition verification method corresponding to the second operation when the second detection result indicates that the risk level is no risk; an eighth determination subunit, used to determine that the second verification method is a transaction verification method, a face recognition verification method and an iris verification method when the second detection result indicates that the risk level is light risk or medium risk.

[0014] Optionally, the above-mentioned second determination unit includes: a ninth determination subunit, used to determine that the target response mechanism is a first transaction confirmation mechanism when the second detection result indicates that the risk level is no risk and the second verification result indicates that the second operation information is verified successfully; wherein the first transaction confirmation mechanism is used to send the first transaction confirmation information to the target account; a tenth determination subunit, used to determine that the target response mechanism is a warning mechanism when the second detection result indicates that the risk level is light risk or medium risk and the second verification result indicates that the second operation information is verified successfully, wherein the warning mechanism is used to send a warning message and the second transaction confirmation information corresponding to the warning mechanism to the target account; an eleventh determination subunit, used to determine that the target response mechanism is a freezing mechanism when the second detection result indicates that the risk level is a heavy risk, wherein the freezing mechanism is used to freeze the account information corresponding to the payment account.

[0015] According to another aspect of the embodiments of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the above fraudulent transaction detection method.

[0016] According to another aspect of an embodiment of the present application, an electronic device is also provided, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor executes the above fraud transaction detection method.

[0017] Through the above-mentioned fraudulent transaction detection method, it is possible to timely discover and stop transactions that may be fraudulent, thereby improving the accuracy of the fraudulent transaction detection method. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the specific implementation methods of the present application or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some implementation methods of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 is a schematic diagram of a hardware environment of an optional fraudulent transaction detection method according to an embodiment of the present invention; Figure 2 is a flow chart of an optional fraudulent transaction detection method according to an embodiment of the present invention; Figure 3 is a schematic diagram of an optional fraudulent transaction detection method according to an embodiment of the present invention; Figure 4 is a schematic structural diagram of an optional fraudulent transaction detection device according to an embodiment of the present invention; Figure 5 It is a schematic diagram of the structure of an optional electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0020] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0021] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices. It should be noted that, in the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other. The present application will be described in detail below with reference to the drawings and in conjunction with the embodiments.

[0022] In the overseas study payment business, a large amount of sensitive information is involved, including the user's personal identity information, school admission information, payment amount, payment method, bank account, etc. Once this information is leaked or tampered with, it will not only cause serious economic losses to the user, but also have a great impact on the company's reputation and trust. Therefore, data security and information security are called core needs in the field of overseas study payment. At present, common data security solutions mainly rely on traditional encryption technology, blacklist detection and other means, but these methods have certain limitations. They cannot detect whether it is a fraudulent transaction in time when the user is making a transaction, nor can they stop the user's current fraudulent transaction in time if it is a fraudulent transaction.

[0023] In order to solve the problem of low accuracy of fraudulent transaction detection methods in the prior art, the present application embodiment provides a fraudulent transaction detection method. As an optional implementation, the above-mentioned fraudulent transaction detection method can be but is not limited to being applied to Figure 1 In the fraudulent transaction detection system composed of the terminal device 102 and the server 104 shown in FIG. Figure 1As shown, the terminal device 102 is connected to the server 104 through a network 110. The network 110 may include but is not limited to: a wired network, a wireless network. The terminal device 102 is also provided with a display 106, a processor 108 and a memory 112. The display 106 may be used to display the operation results and operation information corresponding to the first operation and the second operation (i.e., the first operation information and the second operation information), etc. The processor 108 may be used to perform data processing on the first operation request and / or the second operation request, etc. The memory 112 may be used to store the relevant information involved in this application; the server 104 may be a single server, or a server cluster composed of multiple servers, or a cloud server. The server 104 includes a database 114 and a processing engine 116. Among them, the database 114 may be used to store the first operation information, the first historical operation information set, the second operation information and the second historical operation information set, etc., and the processing engine 116 may be used to perform data processing on the first operation information, the first historical operation information set, the second operation information and the second historical operation information set, etc.

[0024] According to one aspect of the embodiment of the present invention, the fraudulent transaction detection system may further perform the following steps: First, the terminal device 102 executes S102 to send a first operation request and / or a second operation request to the server 104 via the network 110; then, the server 104 executes Figure 1 S104 to S112 are shown, thereby completing the fraudulent transaction detection of the target transaction and determining the target response mechanism corresponding to the target transaction according to the second detection result.

[0025] Through the above-mentioned fraudulent transaction detection method, more accurate fraudulent transaction detection of target transactions can be achieved, thereby improving the accuracy of the fraudulent transaction detection method.

[0026] The above is only an example and is not limited in this embodiment.

[0027] As an optional implementation, please refer to Figure 2 The flowchart of the fraudulent transaction detection method shown in FIG. The method may include the following steps: S202, obtaining first operation information and a first historical operation information set of a target account, wherein the first operation information is used to indicate information of the target account logging into the trading platform at a current timestamp; S204, inputting the first operation information and the first historical operation information set into the dynamic behavior model to perform a first detection, and obtaining a first detection result corresponding to the first operation information, wherein the first detection result is used to indicate a risk level of a first operation corresponding to the first operation information; S206, determining a first verification method according to the first detection result, and obtaining second operation information and a second historical operation information set of the target account, wherein the second operation information is used to indicate transaction information corresponding to the target transaction; S208, performing a first verification on the target account by using a first verification method to obtain a first verification result, and if the first verification result indicates that the target account has passed the verification, inputting the second operation information and the second historical operation information set into a fraud detection model to perform a second detection, and obtaining a second detection result corresponding to the second operation information; S210: Determine a target response mechanism corresponding to the target transaction according to the second detection result.

[0028] The target account in the above 202 can be understood, but not limited to, as the account used by the user to log in to the trading platform, and the first operation information includes the information of the user logging in to the trading platform at the current timestamp, the first operation information includes the current login timestamp, the device fingerprint (used to uniquely correspond to a device running a trading platform), the geographical location (i.e., the following device location, when the user uses the device to run the trading platform and uses the target account to log in to the trading platform, the geographical location of the device), etc., and the first historical operation information set includes multiple operation information corresponding to the target trading platform before the current timestamp. It can be understood that the above first historical operation information can be understood, but not limited to, as stored in the target storage location (such as a database), and the target storage location can be understood, but not limited to, as a "behavior feature library" constructed based on the user's operation behavior. The features stored in the behavior feature library can not only be used as an auxiliary tool for user identity authentication, but also can be used for subsequent anomaly detection; and each time different users log in to the trading platform (regardless of whether the login is successful or failed), the corresponding login information will be synchronously saved in the behavior feature library for more accurate detection later. The above trading platform can be understood, but not limited to, as a platform that requires payment for transactions, such as a payment platform.

[0029] The above dynamic behavior model can compare and detect the first operation information with multiple subsets in the first historical operation information set (i.e., the above first detection), thereby obtaining a first detection result. The above first operation can be understood as, but not limited to, an operation of logging into the trading platform, i.e., an operation of a user sending a transaction request for logging into the trading platform from a client. The first verification method in the above S206 can be understood as, but not limited to, a verification method corresponding to the first detection result corresponding to the first operation information, i.e., the operation in the above S206 can be understood as, but not limited to, different verification methods corresponding to different risk levels of the first operation indicated by the first detection result. The above second historical operation information set includes operation information of all second operations (e.g., payment operations) performed by all users on the trading platform. Each second historical operation information in the second historical operation information set includes information filled in by the user involved in each second operation. For example, when a user pays tuition fees, he needs to fill in payment-related information, such as student number, name, ID number, school, class, etc., before paying (i.e., the above target transaction); for another example, when a user pays rent or electricity bills, he needs to fill in information such as name, telephone number, ID number, household number, address, etc. before paying.

[0030] The first verification result in S208 indicates that the target account has passed the verification, which can be understood, but not limited to, as allowing the target account to log in to the trading platform. The second detection can be understood, but not limited to, as a detection of the target transaction (the second operation described below), and then the target response mechanism can be determined according to the second detection result corresponding to the second detection. In addition to the second operation information and the second historical operation information set, the input fraud detection model also includes the target account corresponding to the first verification result, and the risk value corresponding to the target account corresponding to the first verification result.

[0031] The above-mentioned fraudulent transaction detection method solves the problem of low flexibility of the fraudulent transaction detection method in the prior art and improves the flexibility of the fraudulent transaction detection method.

[0032] As an optional implementation manner, the first operation information and the first historical operation information set are input into the dynamic behavior model for a first detection, and a first detection result corresponding to the first operation information is obtained, including: S1, determining data feature scores corresponding to multiple first data in the first operation information according to the first historical operation information set, where the multiple first data include: a reference operation timestamp, a device fingerprint, and a device location, where the device fingerprint uniquely corresponds to the device, and the device is used to run the trading platform; S2, obtaining preset weight values ​​corresponding to each of the multiple first data; S3, determining an operation score corresponding to the first operation information according to a plurality of data feature scores and a plurality of preset weight values; S4, determining a first detection result according to the operation score and a preset interval set, wherein the preset interval set includes a plurality of preset score intervals.

[0033] It should be noted that the above data feature score can be understood, but is not limited to, as being used to indicate the risk level of the first data. The multiple first data may be, but are not limited to, information related to the first operation obtained when the user sends the first operation request corresponding to the first operation through the client. The reference operation timestamp is the timestamp when the target user sends the first operation request using the target account. The device fingerprint is used to indicate the device used by the target user when sending the first operation request using the target account. The device location is the location of the device used when sending the first operation request. The operations in the above S1 specifically include: S1-1, determining an operation time period set, a device fingerprint set, and a device location set according to the first historical operation information set; S1-2, when the reference operation timestamp matches the reference time period in the operation time period set, determining that the data feature score corresponding to the reference timestamp is less than zero; S1-3, when the reference timestamp does not match the reference time period, determining that the data feature score is not less than zero, and determining the matching result with the time period in the operation time period set except the reference time period according to the reference timestamp, and determining the data feature score corresponding to the reference timestamp; S1-4, determining the data feature score corresponding to the device fingerprint according to the matching result between the device fingerprint and the device fingerprint set, and determining the data feature score corresponding to the device location according to the device location and the device location set.

[0034] The operation time period set in S1-1 above can be understood, but not limited to, as multiple time periods corresponding to the above device location, and the multiple time periods can constitute a whole day (24 hours) corresponding to the device location. For example, assuming that the device location is Province A (or City A, or Country A), then the multiple time periods include 6:00 a.m. to 12:00 p.m., 12:00 p.m. to 5:00 p.m., 5:00 p.m. to 10:00 p.m., and 10:00 p.m. to 6:00 a.m. the next day. The above reference time period can be understood, but not limited to, as the time period with the lowest frequency of target transactions (for example, the above 10:00 p.m. to 6:00 a.m. the next day), and the time period with the lowest frequency of target transactions corresponds to the above device location (for example, the time periods in China and abroad are different, and there will be corresponding time differences). That is, the above operation time period set can be understood, but not limited to, as being determined based on the above device location, the above device fingerprint set can be understood, but not limited to, as all historical device fingerprints corresponding to the target account, and the above device location set is all historical device locations corresponding to the target account. The above preset weight value can be understood, but not limited to, as the weight value corresponding to each of the different first data set in advance.

[0035] The match in S1-2 above can be understood, but not limited to, as the reference timestamp being located in the reference time period. The mismatch between the reference timestamp and the reference time period in S1-3 can be understood, but not limited to, as the reference timestamp matching any operation time period other than the reference time period in the above operation time period set. Matching different operation time periods corresponds to different data feature scores, and the above data feature scores correspond to the matching of different preset operation time periods, device fingerprints, and device locations. For example, in the operations in S1-2 to S1-3 above, assuming that the reference timestamp matches from 6:00 a.m. to 12:00 p.m., the data feature score is 3, the reference timestamp matches from 12:00 p.m. to 5:00 p.m., the data feature score is 4, the reference timestamp matches from 5:00 p.m. to 10:00 p.m., the data feature score is 5, and the reference timestamp matches from 10:00 p.m. to 6:00 a.m. the next day, the data feature score is -3.

[0036] The above S1-4 determines the data feature score corresponding to the device fingerprint according to the matching result between the device fingerprint and the device fingerprint set, including: when the device fingerprint matches the device fingerprint set (which can be but not limited to being understood as the device fingerprint is included in multiple reference device fingerprints included in the device fingerprint set), the data feature score corresponding to the device fingerprint is a first score; when the device fingerprint does not match the device fingerprint set, the data feature score corresponding to the device fingerprint is a second score, and the second score is less than the first score; the above S1-4 determines the data feature score corresponding to the device location according to the device location and the device location set, including: when the device location matches the device location set, the data feature score corresponding to the device location is a third score; when the device location does not match the device location set, the data feature score corresponding to the device location is a fourth score, and the fourth score is less than the third score.

[0037] In the above S3, determining the operation score corresponding to the first operation information according to multiple data feature scores and multiple preset weight values ​​can be understood, but not limited to, as determining the sum of the products of multiple data feature scores and corresponding preset weight values ​​as the operation score, that is, multiplying each data feature score by the corresponding preset weight value to obtain the weight feature value corresponding to each first data; and determining the sum of multiple weight feature values ​​as the above operation score. The preset weight value corresponding to each of the above data feature scores is the preset weight value corresponding to the first data corresponding to each data feature score. The above preset interval set can be understood, but not limited to, as including multiple preset score intervals set in advance, and the multiple preset score intervals include a first preset score interval, a second preset score interval, a third preset score interval, and a fourth preset score interval. The preset score in the first preset score interval is higher than the preset score in the second preset score interval, the preset score in the second preset score interval is higher than the preset score in the third preset score interval, and the preset score in the third preset score interval is higher than the preset score in the fourth preset score interval.

[0038] Determining the first detection result according to the operation score and the preset interval set in the above S4 includes: when the operation score matches the first preset score interval, determining that the first detection result indicates a risk level of no risk; when the operation score matches the second preset score interval, determining that the first detection result indicates a risk level of light risk; when the operation score matches the third preset score interval, determining that the first detection result indicates a risk level of medium risk; when the operation score matches the fourth preset score interval, determining that the first detection result indicates a risk level of heavy risk.

[0039] By determining the first detection result indicating different risk levels corresponding to the first operation information as described above in the present application, different verification methods can be determined according to the different first detection results determined, thereby achieving effective and more accurate verification of the first operation and the second operation.

[0040] As an optional implementation manner, determining the first verification method according to the first detection result includes: S1, when the first detection result indicates that the risk level is no risk, determining that the first verification method is a target account verification and / or at least one device verification method; S2, when the first detection result indicates that the risk level is a light risk and the device has at least one device authentication method, determining that the first authentication method is at least one device authentication method; S3, when the first detection result indicates that the risk level is a light risk and the device does not have a device verification method, determining that the first verification method is OTP verification; S4, when the first detection result indicates that the risk level is medium risk, determining that the first verification method is OTP verification and fingerprint verification, and / or at least one device verification method; S5. When the first detection result indicates that the risk level is a heavy risk, determine that the first verification method is fingerprint verification and face recognition verification.

[0041] It should be noted that the target account verification can be understood as, but not limited to, verification of the account password corresponding to the target account, and the at least one device verification method can be understood as, but not limited to, verification of the trading platform when the device is used to log in to the trading platform; the operation in S1 can be understood as, but not limited to, determining the first verification method as the target account verification and at least one device verification method when the first detection result indicates that the risk level is no risk and the device has at least one device verification method; determining the first verification method as the target account verification when the first detection result indicates that the risk level is no risk and the device does not have at least one device verification method; at least one device verification method, for example, when using a mobile phone to open the trading platform, if the target user has set at least one of the following for the mobile phone: device password (mobile phone digital password unlocking), user fingerprint (fingerprint unlocking), pattern (pattern unlocking). The OTP verification is a dynamic password verification, and the dynamic password can be sent by SMS, or by email, etc. The fingerprint verification in S4 and S5 can be, but not limited to, verifying the fingerprint of the target user corresponding to the target account. The fingerprint verification here is different from the user fingerprint mentioned above. The user fingerprint can be, but not limited to, the corresponding fingerprint set in the verification device.

[0042] Through the above-mentioned implementation mode of the present application, a more rigorous verification method can be gradually and flexibly replaced according to the different risk levels indicated by the first detection result, so as to perform an accurate first detection.

[0043] As an optional implementation manner, the second operation information and the second historical operation information set are input into the fraud detection model for a second detection, and a second detection result corresponding to the second operation information is obtained, including: S1, constructing an operation graph structure corresponding to the second operation information according to the second historical operation information set, wherein the multiple graph nodes of the operation graph structure include nodes corresponding to the multiple pieces of second data in the second operation information; S2, obtaining nodes corresponding to each of the plurality of second data to obtain a plurality of data nodes, and determining a node path length between any node in the plurality of data nodes and the remaining nodes in the plurality of data nodes to obtain a node path length set; S3, determining first risk values ​​corresponding to each of the plurality of data nodes according to the second historical operation information set to obtain a first risk value set, and determining second risk values ​​corresponding to each of the plurality of data nodes according to the node path length set and the first risk value set to obtain a second risk value set; S4, determining a comprehensive risk value of the second operation information according to the second risk value set, and determining a second detection result according to the comprehensive risk value.

[0044] It should be noted that, in addition to the nodes corresponding to the multiple second data in the second operation information, the multiple graph nodes in S1 also include nodes corresponding to multiple third data associated with the multiple second data, for example Figure 3 The nodes shown include node A corresponding to the first ID number, node G corresponding to the first student number, node F corresponding to the first account number, node E corresponding to the device location, node B corresponding to the second student number, node C corresponding to the second account number, and node D corresponding to the second ID number, wherein the first ID number, the first student number, the first account number, and the device location are multiple pieces of second data in the first operation information, the second student number, the second account number, and the second ID number are information included in the second historical operation information set, wherein the first account number and the second account number are both target accounts that have conducted target transactions (payments) on the first ID number, and the second ID number is the target account that has conducted target transactions on the second student number, etc. Figure 3 If there are lines between the multiple nodes shown, it means that there is relevant information in the information filled in by the user when performing historical target transactions and current target transactions.

[0045] The node path length determined in S2 above can be understood, but not limited to, as follows: Figure 3 As shown, the path lengths between node A and nodes B, C, D, E, F, G, etc. are determined (for example, the node path length between node A and node B is 1, the path length between node A and node C is 2, the path length between node A and node D is 2, and so on), the path lengths between node B and nodes A, C, D, E, F, G, etc. are determined (for example, the node path length between node B and node A is 1, the path length between node B and node C is 1, the path length between node B and node D is 1, the path length between node B and node E is 2, the path length between node B and node G is 2, the path length between node B and node F is 3), and so on, and the node path lengths between each node and other nodes are determined respectively.

[0046] In the above S3, the first risk values ​​corresponding to multiple data nodes are determined according to the second historical operation information set, and obtaining the first risk value set includes: determining multiple reference data sets corresponding to each second data in the second operation information from the second historical operation information set; determining the first risk value corresponding to each data node according to the number of data corresponding to each of the multiple data subsets in each reference data set, and the multiple reference data sets corresponding to the above second data are, for example: when the second data is an ID card number, determining the student number subset (or account number subset), payment account number subset (the payment account is the account for logging into the transaction platform), device fingerprint subset, name subset, contact information subset, etc. corresponding to the ID card number; the above data quantity can be understood as but not limited to the number of student numbers in the student number subset, the number of payment accounts The number of payment accounts in the ID number subset, the number of device fingerprints in the device fingerprint subset, and so on; the above-mentioned determination of the first risk value corresponding to each data node according to the number of data corresponding to each of the multiple data subsets in each reference data set includes: determining the reference risk value corresponding to each data subset (including determining any data subset in the multiple data subsets as the current data subset, determining the current number of data corresponding to the current data subset, and determining the reference risk value determined by the current data subset according to the current number of data and the preset risk assessment rules, the preset risk assessment rules are the pre-set risk assessment rules corresponding to the current data subset; determining any data subset other than the current data subset in the multiple data subsets as the current data subset); determining the sum of the multiple reference risk values ​​as the first risk value. The above-mentioned preset risk assessment rules are, for example: assuming that the current data subset is an ID number subset, then the risk assessment rules are, for example, when the number of ID numbers in the ID number subset exceeds 3, the reference risk value is 2, and when the number of ID numbers in the ID number subset exceeds 4, the reference risk value is 3, and so on.

[0047] The above-mentioned determination of the second risk value corresponding to each of the multiple data nodes according to the node path length set and the first risk value set includes: obtaining the longest node path length corresponding to each of the multiple data nodes, and determining the reference risk value between each data node and the other multiple data nodes according to the longest node path length, the node path length set and the first risk value set; determining the sum of the multiple reference risk values ​​and the first risk value corresponding to the data node as the second risk value corresponding to the data node. The above-mentioned determination of the reference risk value can be understood, but not limited to, as follows: each data node corresponds to a first risk value, and each data node has a node path length with other nodes. Assuming that Figure 3 The first risk value corresponding to the A node is 3, the first risk value corresponding to the B node is 0, the first risk value corresponding to the C node is 1, the first risk value corresponding to the D node is 4, the first risk value corresponding to the E node is 6, the first risk value corresponding to the F node is 3, the first risk value corresponding to the G node is 2, and the Figure 3 As shown, the longest node path corresponding to node A is 3, so the specific reference risk value is determined, for example: the node path length between node A and node B is 1, but the risk value corresponding to node B is 0, then the reference risk value of node A relative to node B is 0; the node path length between node A and node C is 2, then the reference risk value of node A relative to node C is 1 / 3 (that is, the ratio of the first risk value of node C to the longest node path length); the path length between node A and node D is 2, then the reference risk value of node A relative to node D is 4 / 3 (that is, the ratio of the first risk value of node D to the longest node path length), and so on, so that the reference risk value of node A relative to nodes B, C, D, E, F, and G can be obtained, and then the multiple reference risk values ​​corresponding to node A are added, and the first risk value corresponding to node A is added to obtain the second risk value corresponding to node A. The method for determining the second risk values ​​corresponding to other nodes is the same as the method for determining the second risk value corresponding to node A mentioned above.

[0048] The above-mentioned determination of the comprehensive risk value of the second operation information according to the second risk value set includes: obtaining the first detection risk value of the target account corresponding to the first detection result (the first detection risk value may be a risk value pre-set according to the risk level indicated by the first detection result, that is, how much the first detection risk value is when the first detection result indicates no risk, how much the first detection risk value is when the first detection result indicates light risk, etc.), and the second detection risk value corresponding to the second risk value set, wherein the second detection risk value is the sum of multiple second risk values ​​in the second risk value set; determining the comprehensive risk value according to the preset detection weight set, the first detection risk value, and the second detection risk value (including determining the product of the first detection risk value and the weight corresponding to the first detection risk value in the preset detection weight set as the first product; determining the product of the second detection risk value and the weight corresponding to the second detection risk value in the preset detection weight set as the second product; and determining the sum of the first product and the second product as the comprehensive risk value), and subsequently determining the second detection result according to the level of the comprehensive risk value. Different risk values ​​correspond to different risk levels indicated by the second detection result, and the higher the comprehensive risk value, the higher the risk level indicated by the corresponding second detection result.

[0049] Through the above implementation of the present application, the first detection result is associated with the second detection result, and through a special determination method of the second detection result, the second detection result corresponding to the second operation can be accurately determined, thereby improving the reliability of fraudulent transaction detection.

[0050] As an optional implementation manner, before determining the target response mechanism corresponding to the target transaction according to the second detection result, the method further includes: S1, determining a second verification method according to a second detection result, wherein the second detection result is used to indicate a risk level of a second operation corresponding to the second operation information, and the second verification method is a verification method corresponding to the payment account in the second operation information; S2, performing a second verification on the second operation information according to a second verification method to obtain a second verification result.

[0051] The second operation can be understood as, but is not limited to, the target transaction operation (e.g., payment operation). The operations in S2 specifically include: S2-1, when the second detection result indicates that the risk level is no risk, determining the second verification method to be the transaction verification method and face recognition verification method corresponding to the second operation; S2-2, when the second detection result indicates that the risk level is light risk or medium risk, determining the second verification method to be the transaction verification method, face recognition verification method, and iris verification method.

[0052] It should be noted that the above-mentioned transaction verification methods include payment password verification and payment fingerprint verification, the above-mentioned face recognition verification method can be understood but not limited to face swiping verification, and the above-mentioned iris verification method can be understood but not limited to more accurate uniqueness verification of the user by verifying the iris.

[0053] After determining the second verification method, a second verification can be performed according to the second verification method to obtain a second verification result. After obtaining the second verification result, the target response mechanism corresponding to the target transaction can be determined. Determining the target response mechanism corresponding to the target transaction according to the second detection result includes: when the second detection result indicates that the risk level is no risk, and the second verification result indicates that the second operation information verification is passed, determining the target response mechanism to be the first transaction confirmation mechanism (at this time, it is only necessary to prompt the user, such as a pop-up window prompt, to confirm again whether to conduct the target transaction. If the target transaction is conducted, the second operation information is verified and the payment password or payment fingerprint is verified. If the target transaction is not conducted, no verification is required), wherein the first transaction confirmation mechanism is used to send the first transaction confirmation information to the target account; when the second detection result is If the risk level is indicated as light risk or medium risk, and the second verification result indicates that the second operation information verification is successful, the target response mechanism is determined to be a warning mechanism (at this time, the target user needs to be prompted by a warning to confirm again whether to conduct the target transaction. If the target transaction is conducted, the user is warned by a warning color or a warning light, etc. to carefully verify the second operation information and verify the payment password or payment fingerprint. If the target transaction is not conducted, no verification is required), wherein the warning mechanism is used to send a warning message and the second transaction confirmation information corresponding to the warning mechanism to the target account; if the second detection result indicates that the risk level is a heavy risk, the target response mechanism is determined to be a freezing mechanism (which can be understood, but is not limited to, as forcibly preventing the user from conducting the target transaction), wherein the freezing mechanism is used to freeze the account information corresponding to the payment account.

[0054] Through the above-mentioned implementation manner of the present application, fraudulent transactions can be identified more reliably, and when there is a high possibility of fraudulent transactions, users can be directly organized to conduct target transactions, thereby improving the reliability of fraudulent transaction detection.

[0055] It should be noted that, for the above-mentioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described action sequence, because according to the present invention, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present invention.

[0056] According to another aspect of the embodiment of the present invention, a fraudulent transaction detection device for implementing the above-mentioned fraudulent transaction detection method is also provided. Figure 4 As shown, the device comprises: An acquisition unit 402 is used to acquire first operation information and a first historical operation information set of a target account, wherein the first operation information is used to indicate information that the target account has logged into the trading platform at a current timestamp; A first detection unit 404 is used to input the first operation information and the first historical operation information set into the dynamic behavior model to perform a first detection, and obtain a first detection result corresponding to the first operation information, wherein the first detection result is used to indicate the risk level of the first operation corresponding to the first operation information; A first determination unit 406 is used to determine a first verification method according to the first detection result, and obtain second operation information and a second historical operation information set of the target account, wherein the second operation information is used to indicate transaction information corresponding to the target transaction; The second detection unit 408 is configured to perform a first verification on the target account by using the first verification method to obtain a first verification result, and if the first verification result indicates that the target account has passed the verification, input the second operation information and the second historical operation information set into the fraud detection model to perform a second detection to obtain a second detection result corresponding to the second operation information; The second determining unit 410 is configured to determine a target response mechanism corresponding to the target transaction according to the second detection result.

[0057] The specific manner in which each unit in the above device embodiment performs operations has been described in detail in the embodiment of the method, and will not be elaborated on again here.

[0058] According to another aspect of the embodiments of the present invention, there is also provided an electronic device for implementing the above-mentioned fraudulent transaction detection method. The electronic device may be as follows: Figure 5 The terminal device or server shown in the figure. This embodiment is described by taking the electronic device as a terminal device as an example. Figure 5 As shown, the electronic device includes: at least one processor 504; and a memory 502 in communication with the at least one processor 504; wherein the memory 502 stores a computer program executable by the at least one processor 504, and the computer program is executed by the at least one processor 504, so that the at least one processor 504 performs the steps in any one of the above method embodiments. The electronic device may be located in at least one network device among a plurality of network devices of a computer network. The processor may be configured to execute the above fraudulent transaction detection method through the computer program.

[0059] Alternatively, a person skilled in the art may understand that: Figure 5The structure shown is for illustration only, and the electronic device may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (Mobile Internet Devices, MID), a PAD, or other terminal devices. Figure 5 The structure of the electronic device is not limited. For example, the electronic device may also include Figure 5 More or fewer components (such as network interfaces, etc.) as shown in, or with Figure 5 Different configurations are shown.

[0060] The memory 502 can be used to store software programs and modules, such as program instructions / modules corresponding to the fraudulent transaction detection method and device in the embodiment of the present invention. The processor 504 executes various functional applications and data processing by running the software programs and modules stored in the memory 502, that is, the above-mentioned fraudulent transaction detection method is implemented. The memory 502 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 502 may further include a memory remotely arranged relative to the processor 504, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. The memory 502 may be specifically used, but not limited to, for storing various data involved in the above-mentioned fraudulent transaction detection method. As an example, the above-mentioned electronic device is used to implement the above-mentioned fraudulent transaction detection method, and the above-mentioned memory 502 may include, but not limited to, the acquisition unit 402, the first detection unit 404, the first determination unit 406, the second detection unit 408, and the second determination unit 410 in the above-mentioned fraudulent transaction detection device. In addition, other module units in the above-mentioned fraudulent transaction detection device may also be included but not limited to, which will not be described in detail in this example.

[0061] Optionally, the transmission device 506 is used to receive or send data via a network. Specific examples of the network may include wired networks and wireless networks. In one example, the transmission device 506 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices and routers via a network cable so as to communicate with the Internet or a local area network. In one example, the transmission device 506 is a radio frequency (Radio Frequency, RF) module, which is used to communicate with the Internet wirelessly. In addition, the electronic device also includes: a display 508, and a connection bus 510, which is used to connect the various module components in the electronic device.

[0062] According to one aspect of the present application, a computer-readable storage medium is provided, and a processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the above-mentioned fraudulent transaction detection method.

[0063] Those skilled in the art will appreciate that the implementation of all or part of the processes in the above method embodiments can be accomplished by instructing related hardware through a computer program. The program can be stored in a computer-readable storage medium. When the program is executed, it can include processes such as those in the above method embodiments.

[0064] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A fraudulent transaction detection method, characterized in that: include: Acquire first operation information and a first historical operation information set of a target account, wherein the first operation information is used to indicate information that the target account logs into a trading platform at a current timestamp; Inputting the first operation information and the first historical operation information set into a dynamic behavior model for a first detection, and obtaining a first detection result corresponding to the first operation information, wherein the first detection result is used to indicate a risk level of a first operation corresponding to the first operation information; Determine a first verification method according to the first detection result, and obtain second operation information and a second set of historical operation information of the target account, wherein the second operation information is used to indicate transaction information corresponding to the target transaction; Performing a first verification on the target account by using the first verification method to obtain a first verification result, and when the first verification result indicates that the target account has passed the verification, inputting the second operation information and the second set of historical operation information into a fraud detection model to perform a second detection to obtain a second detection result corresponding to the second operation information; A target response mechanism corresponding to the target transaction is determined according to the second detection result.

2. The method according to claim 1, characterized in that Inputting the first operation information and the first historical operation information set into a dynamic behavior model for a first detection, and obtaining a first detection result corresponding to the first operation information, including: Determine, according to the first historical operation information set, data feature scores corresponding to each of the multiple first data in the first operation information, the multiple first data comprising: a reference operation timestamp, a device fingerprint, and a device location, the device fingerprint uniquely corresponding to a device, and the device is used to run the trading platform; Obtaining preset weight values ​​corresponding to each of the plurality of first data; Determining an operation score corresponding to the first operation information according to the plurality of data feature scores and the plurality of preset weight values; The first detection result is determined according to the operation score and a preset interval set, wherein the preset interval set includes a plurality of preset score intervals.

3. The method according to claim 2, characterized in that Determining data feature scores corresponding to each of the plurality of first data in the first operation information according to the first historical operation information set includes: Determine an operation time period set, a device fingerprint set, and a device location set according to the first historical operation information set; In a case where the reference operation timestamp matches a reference time period in the operation time period set, determining that a data feature score corresponding to the reference timestamp is less than zero; In the case where the reference timestamp does not match the reference time period, determining that the data feature score is not less than zero, and determining the data feature score corresponding to the reference timestamp according to the matching result between the reference timestamp and the time period in the operation time period set except the reference time period; A data feature score corresponding to the device fingerprint is determined according to a matching result between the device fingerprint and the device fingerprint set, and a data feature score corresponding to the device location is determined according to the device location and the device location set.

4. The method according to claim 2, characterized in that: Determining a first verification method according to the first detection result includes: When the first detection result indicates that the risk level is no risk, determining that the first verification method is a target account verification and / or at least one device verification method; When the first detection result indicates that the risk level is a light risk and the device has at least one device authentication method, determining that the first authentication method is the at least one device authentication method; When the first detection result indicates that the risk level is a light risk and the device does not have a device verification method, determining that the first verification method is OTP verification; When the first detection result indicates that the risk level is medium risk, determining that the first verification method is OTP verification and fingerprint verification, and / or the at least one device verification method; When the first detection result indicates that the risk level is a heavy risk, the first verification method is determined to be fingerprint verification and face recognition verification.

5. The method according to claim 2, characterized in that: Inputting the second operation information and the second historical operation information set into the fraud detection model to perform a second detection, and obtaining a second detection result corresponding to the second operation information, including: constructing an operation graph structure corresponding to the second operation information according to the second historical operation information set, wherein the multiple graph nodes of the operation graph structure include nodes corresponding to the multiple pieces of second data in the second operation information; Obtaining nodes corresponding to each of the plurality of second data to obtain a plurality of data nodes, and determining a node path length between any node in the plurality of data nodes and the remaining nodes in the plurality of data nodes to obtain a node path length set; Determine the first risk value corresponding to each of the plurality of data nodes according to the second historical operation information set to obtain a first risk value set, and determine the second risk value corresponding to each of the plurality of data nodes according to the node path length set and the first risk value set to obtain a second risk value set; A comprehensive risk value of the second operation information is determined according to the second risk value set, and the second detection result is determined according to the comprehensive risk value.

6. The method according to claim 1, characterized in that Before determining the target response mechanism corresponding to the target transaction according to the second detection result, the method further includes: determining a second verification method according to the second detection result, wherein the second detection result is used to indicate a risk level of a second operation corresponding to the second operation information, and the second verification method is a verification method corresponding to the payment account in the second operation information; Perform a second verification on the second operation information according to the second verification method to obtain a second verification result.

7. The method according to claim 6, characterized in that Determining a second verification method according to the second detection result includes: If the second detection result indicates that the risk level is no risk, determining that the second verification method is a transaction verification method and a face recognition verification method corresponding to the second operation; When the second detection result indicates that the risk level is light risk or medium risk, the second verification method is determined to be a transaction verification method, a face recognition verification method, and an iris verification method.

8. The method according to claim 7, characterized in that Determining a target response mechanism corresponding to the target transaction according to the second detection result includes: When the second detection result indicates that the risk level is no risk and the second verification result indicates that the second operation information is verified, determining that the target response mechanism is a first transaction confirmation mechanism, wherein the first transaction confirmation mechanism is used to send first transaction confirmation information to the target account; When the second detection result indicates that the risk level is light risk or medium risk, and the second verification result indicates that the second operation information is verified, determining that the target response mechanism is a warning mechanism, wherein the warning mechanism is used to send a warning message and second transaction confirmation information corresponding to the warning mechanism to the target account; In a case where the second detection result indicates that the risk level is a severe risk, the target response mechanism is determined to be a freezing mechanism, wherein the freezing mechanism is used to freeze the account information corresponding to the payment account.

9. A fraudulent transaction detection device, characterized in that: include: An acquisition unit, configured to acquire first operation information and a first historical operation information set of a target account, wherein the first operation information is used to indicate information indicating that the target account has logged into a trading platform at a current timestamp; a first detection unit, configured to input the first operation information and the first historical operation information set into a dynamic behavior model for a first detection, and obtain a first detection result corresponding to the first operation information, wherein the first detection result is used to indicate a risk level of a first operation corresponding to the first operation information; A first determining unit, configured to determine a first verification method according to the first detection result, and obtain second operation information and a second historical operation information set of the target account, wherein the second operation information is used to indicate transaction information corresponding to the target transaction; a second detection unit, configured to perform a first verification on the target account by using the first verification method to obtain a first verification result, and, if the first verification result indicates that the target account has passed verification, input the second operation information and the second set of historical operation information into a fraud detection model for a second detection to obtain a second detection result corresponding to the second operation information; A second determining unit is configured to determine a target response mechanism corresponding to the target transaction according to the second detection result.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the fraudulent transaction detection method according to any one of claims 1 to 8.

Images