Abnormal transaction behavior acquisition method and related device

Abstract

The invention discloses an abnormal transaction behavior acquisition method and a related device, and relates to the financial field or other fields, and the method comprises the steps: obtaining abnormal transactions corresponding to a plurality of abnormal accounts in a preset time period; clustering the abnormal transactions of each abnormal account to obtain a clustering set; analyzing the clustering sets corresponding to the plurality of abnormal accounts to obtain a second abnormal transaction set; obtaining maximum transaction time intervals respectively corresponding to a plurality of clustering sets contained in the second abnormal transaction set; obtaining a transaction time interval; determining an optimal time interval by combining a target error-tolerant rate corresponding to each candidate transaction time interval obtained from the transaction time interval; obtaining a target number of times; and determining a transaction time interval based on the transaction time of the abnormal transactions in the clustering set contained in the second abnormal transaction set. Therefore, the abnormal transaction behavior is determined.

Description

Technical Field

[0001] The present application relates to the field of financial technology, and in particular to a method for acquiring abnormal transaction behavior and related devices. Background Art

[0002] In order to identify abnormal transactions, it is necessary to analyze the transactions of abnormal accounts to obtain abnormal transaction behaviors. In this way, it is possible to determine whether other transaction behaviors are abnormal transaction behaviors in combination with abnormal transaction behaviors.

[0003] Based on this, it is very important to obtain abnormal trading behavior. Summary of the invention

[0004] In view of the above problems, the present application provides a method and related device for obtaining abnormal transaction behavior to achieve the purpose of obtaining abnormal transaction behavior. The specific scheme is as follows:

[0005] The first aspect of the present application provides a method for obtaining abnormal transaction behavior, comprising:

[0006] Obtain abnormal transactions corresponding to multiple abnormal accounts within a preset time period;

[0007] For each of the abnormal accounts, based on the transaction time of the multiple abnormal transactions corresponding to the abnormal account, multiple cluster sets are obtained, wherein the number of the abnormal transactions in the cluster sets is greater than or equal to a cluster number threshold;

[0008] Dividing the cluster sets whose absolute values ​​of the time intervals of the transaction times corresponding to the cluster centers are less than or equal to the first threshold into the same first abnormal transaction set;

[0009] Determine the first abnormal transaction set including the cluster set whose number is greater than or equal to a second threshold as the second abnormal transaction set;

[0010] Obtaining maximum transaction time intervals respectively corresponding to a plurality of the clustering sets included in the second abnormal transaction set;

[0011] Acquire a transaction time interval, wherein the maximum value of the transaction time interval is the maximum value of a plurality of the maximum transaction time intervals, and the minimum value of the transaction time interval is the minimum value of the plurality of the maximum transaction time intervals;

[0012] Obtain a candidate transaction time interval at each preset step length from the transaction time interval interval to obtain a plurality of candidate transaction time intervals;

[0013] For each of the candidate transaction time intervals, calculating the fault tolerance rates corresponding to the plurality of abnormal accounts respectively;

[0014] For each of the candidate transaction time intervals, the sum of the fault tolerance rates corresponding to the plurality of abnormal accounts is calculated to obtain a target fault tolerance rate corresponding to the candidate transaction time interval;

[0015] Determine the candidate transaction time interval corresponding to the highest target fault tolerance rate as the optimal time interval;

[0016] Determine the cluster number threshold as a target number;

[0017] Determining a target number of trading counterparties based on the number of trading counterparty accounts of abnormal transactions corresponding to the plurality of abnormal accounts respectively within the optimal time interval;

[0018] Determining a transaction time interval based on the transaction time of the abnormal transactions in the cluster set included in the second abnormal transaction set;

[0019] The abnormal trading behavior is determined as conducting transactions greater than or equal to the target number of transactions for counterparty accounts less than or equal to the target number of counterparties within the trading time interval and within the optimal time interval.

[0020] The second aspect of the present application provides a device for acquiring abnormal transaction behavior, including:

[0021] A first acquisition module is used to acquire abnormal transactions corresponding to multiple abnormal accounts within a preset time period;

[0022] A second acquisition module is used to obtain, for each abnormal account, a plurality of cluster sets based on the transaction time of the plurality of abnormal transactions corresponding to the abnormal account, wherein the number of the abnormal transactions in the cluster set is greater than or equal to a cluster number threshold;

[0023] A division module, used for dividing the cluster sets whose absolute values ​​of the time intervals of the transaction times corresponding to the cluster centers are less than or equal to the first threshold into the same first abnormal transaction set;

[0024] A first determination module, configured to determine the first abnormal transaction set including the cluster set whose number is greater than or equal to a second threshold as a second abnormal transaction set;

[0025] A third acquisition module is used to acquire the maximum transaction time intervals respectively corresponding to the plurality of cluster sets included in the second abnormal transaction set;

[0026] A fourth acquisition module is used to acquire a transaction time interval, wherein the maximum value of the transaction time interval is the maximum value of a plurality of the maximum transaction time intervals, and the minimum value of the transaction time interval is the minimum value of the plurality of the maximum transaction time intervals;

[0027] A fifth acquisition module, configured to obtain a candidate transaction time interval from each preset step in the transaction time interval interval, so as to obtain a plurality of the candidate transaction time intervals;

[0028] A first calculation module, configured to calculate the fault tolerance rates corresponding to the plurality of abnormal accounts respectively for each of the candidate transaction time intervals;

[0029] A second calculation module is used to calculate the sum of the fault tolerance rates corresponding to the plurality of abnormal accounts for each of the candidate transaction time intervals, so as to obtain a target fault tolerance rate corresponding to the candidate transaction time interval;

[0030] A second determination module is used to determine that the candidate transaction time interval corresponding to the highest target fault tolerance rate is the optimal time interval;

[0031] A third determination module is used to determine that the cluster number threshold is a target number of times;

[0032] A fourth determination module, configured to determine the target number of trading counterparties based on the number of trading counterparty accounts of abnormal transactions respectively corresponding to the plurality of abnormal accounts within the optimal time interval;

[0033] a fifth determining module, configured to determine a transaction time interval based on the transaction time of the abnormal transactions in the cluster set included in the second abnormal transaction set;

[0034] The sixth determination module is used to determine that the abnormal trading behavior is a transaction greater than or equal to the target number of transactions performed against counterparty accounts less than or equal to the target number of counterparties within the trading time interval and within the optimal time interval.

[0035] A third aspect of the present application provides a server, comprising at least one processor and a memory connected to the processor, wherein:

[0036] The memory is used to store computer programs;

[0037] The processor is used to execute the computer program so that the server can implement the method for obtaining abnormal transaction behavior as described in the first aspect.

[0038] The fourth aspect of the present application provides a computer storage medium, which carries one or more computer programs. When the one or more computer programs are executed by a server, the server can implement the method for obtaining abnormal transaction behavior as described in the first aspect.

[0039] By means of the above technical scheme, the present application provides a method for obtaining abnormal transaction behavior, obtaining abnormal transactions corresponding to multiple abnormal accounts within a preset time period; clustering the abnormal transactions of each abnormal account to obtain a cluster set; since the cluster set of an abnormal account does not have commonality, it is necessary to analyze the cluster sets corresponding to multiple abnormal accounts to obtain a second abnormal transaction set with commonality, that is, the second abnormal transaction set can represent the transaction behavior of abnormal transactions of most abnormal accounts; obtaining the maximum transaction time interval corresponding to the multiple cluster sets contained in the second abnormal transaction set; obtaining the transaction time interval interval; however, the optimal time interval is specifically which value of the transaction time interval interval, which needs to be determined in combination with the target fault tolerance rate corresponding to each candidate transaction time interval obtained from the transaction time interval interval; since the second abnormal transaction set can represent the transaction behavior of abnormal transactions of most abnormal accounts, the transaction time interval can be determined based on the transaction time of the abnormal transactions in the cluster set contained in the second abnormal transaction set. Thus, the abnormal transaction behavior determined is: within the transaction time interval and within the optimal time interval, transactions higher than or equal to the target number of counterparty accounts are conducted for counterparty accounts less than or equal to the target number of counterparties. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and the originals and elements are not necessarily drawn to scale.

[0041] Figure 1 A schematic diagram of a system architecture provided for this application;

[0042] Figure 2 A schematic diagram of an optional hardware structure of a terminal 100 provided in this application;

[0043] Figure 3 A schematic diagram of the structure of a server 200 provided in this application;

[0044] Figure 4 A flowchart of a method for obtaining abnormal transaction behavior provided in an embodiment of the present application;

[0045] Figure 5 A schematic diagram of cluster sets corresponding to multiple abnormal accounts provided in an embodiment of the present application;

[0046] Figure 6 Provided in the embodiments of this application Figure 5 A zoomed-in view of some clusters of abnormal account 8000;

[0047] Figure 7A schematic diagram of the structure of a device for acquiring abnormal transaction behavior provided in an embodiment of the present application. DETAILED DESCRIPTION

[0048] The following describes the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. The terms used in the implementation method section of the present application are only used to explain the specific embodiments of the present application, and are not intended to limit the present application.

[0049] The embodiments of the present application are described below in conjunction with the accompanying drawings. Those skilled in the art will appreciate that, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0050] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, which is only to describe the distinction mode adopted by the objects of the same attributes when describing in the embodiments of the present application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0051] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0052] See also Figure 1 , Figure 1 A schematic diagram of a system architecture is shown. The system may include a terminal 100 and a server 200. The server 200 may include one or more servers ( Figure 1 In the example, a server is included, and the server 200 can provide the method provided in the embodiment of the present application for one or more terminals.

[0053] Exemplarily, the terminal 100 may be a terminal held by a teller at a bank counter, or a terminal held by a customer of the bank.

[0054] Among them, an application can be installed on the terminal 100, and the above application can provide an interface. If the holder of the terminal 100 is a teller, the terminal 100 can receive relevant parameters entered by the user on the interface, such as selecting multiple abnormal accounts; if the holder of the terminal 100 is a customer, the terminal 100 can receive relevant parameters entered by the user on the interface, such as transaction amount, counterparty account, and send the above parameters to the server 200. The server 200 can obtain processing results based on the received parameters and return the processing results to the terminal 100.

[0055] Next describe Figure 1 The product form of the mid-terminal 100;

[0056] The terminal 100 in the embodiment of the present application can be a mobile phone, a tablet computer, a wearable device, a vehicle-mounted device, an augmented reality (AR) / virtual reality (VR) device, a laptop computer, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), etc., and the embodiment of the present application does not impose any limitation on this.

[0057] Figure 2 An optional hardware structure diagram of the terminal 100 is shown.

[0058] refer to Figure 2 As shown, the terminal 100 may include a radio frequency unit 110, a memory 120, an input unit 130, a display unit 140, a camera 150 (optional), an audio circuit 160 (optional), a speaker 161 (optional), a microphone 162 (optional), an earphone jack 163 (optional), a processor 170, an external interface 180, a power supply 190 and other components. Those skilled in the art will appreciate that Figure 2 This is merely an example of a terminal and does not constitute a limitation on the terminal. The terminal may include more or fewer components than shown in the figure, or a combination of certain components, or different components.

[0059] The input unit 130 can be used to receive input digital or character information, and generate key signal input related to the user settings and function control of the terminal. Specifically, the input unit 130 may include a touch screen 131 (optional) and / or other input devices 132. The touch screen 131 can collect the user's touch operations on or near it (such as the user's operation on or near the touch screen using any suitable object such as fingers, joints, stylus, etc.), and drive the corresponding connection device according to a pre-set program. The touch screen can detect the user's touch action on the touch screen, convert the touch action into a touch signal and send it to the processor 170, and can receive and execute the command sent by the processor 170; the touch signal at least includes the touch point coordinate information. The touch screen 131 can provide an input interface and an output interface between the terminal 100 and the user. In addition, the touch screen can be implemented using multiple types such as resistive, capacitive, infrared and surface acoustic wave. In addition to the touch screen 131, the input unit 130 can also include other input devices. Specifically, other input devices 132 may include, but are not limited to, one or more of a physical keyboard, function keys (such as a volume control key, a switch key, etc.), a trackball, a mouse, a joystick, and the like.

[0060] Among them, the input device 132 can receive input data and the like.

[0061] The display unit 140 can be used to display information input by the user or provided to the user, various menus of the terminal 100, interactive interfaces, file display and / or playback of any multimedia file. In the embodiment of the present application, the display unit 140 can be used to display interfaces, processing results, etc.

[0062] The memory 120 can be used to store instructions and data. The memory 120 can mainly include an instruction storage area and a data storage area. The data storage area can store various data, such as multimedia files, texts, etc.; the instruction storage area can store software units such as operating systems, applications, instructions required for at least one function, or their subsets and extensions. It can also include a non-volatile random access memory; provide the processor 170 with hardware, software and data resources including management of computing and processing equipment, and support control software and applications. It is also used for the storage of multimedia files, and the storage of running programs and applications.

[0063] The processor 170 is the control center of the terminal 100. It uses various interfaces and lines to connect various parts of the entire terminal 100. By running or executing instructions stored in the memory 120 and calling data stored in the memory 120, it executes various functions of the terminal 100 and processes data, thereby controlling the terminal device as a whole. Optionally, the processor 170 may include one or more processing units; preferably, the processor 170 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface and application program, and the modem processor mainly processes wireless communication. It is understandable that the above-mentioned modem processor may not be integrated into the processor 170. In some embodiments, the processor and the memory may be implemented on a single chip, and in some embodiments, they may also be implemented separately on separate chips. The processor 170 may also be used to generate corresponding operation control signals, send them to corresponding components of the computing and processing device, read and process data in the software, especially read and process data and programs in the memory 120, so that each functional module therein performs corresponding functions, thereby controlling the corresponding components to act according to the requirements of the instructions.

[0064] The radio frequency unit 110 (optional) can be used for receiving and sending information or receiving and sending signals during a call, for example, after receiving the downlink information of the base station, it is sent to the processor 170 for processing; in addition, the designed uplink data is sent to the base station. Generally, the RF circuit includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier (Low Noise Amplifier, LNA), a duplexer, etc. In addition, the radio frequency unit 110 can also communicate with network devices and other devices through wireless communication. The wireless communication can use any communication standard or protocol, including but not limited to Global System of Mobile communication (Global System of Mobile communication, GSM), General Packet Radio Service (General Packet Radio Service, GPRS), Code Division Multiple Access (Code Division Multiple Access, CDMA), Wideband Code Division Multiple Access (Wideband Code Division Multiple Access, WCDMA), Long Term Evolution (Long Term Evolution, LTE), email, Short Messaging Service (SMS), etc.

[0065] In this embodiment of the present application, the RF unit 110 can send data to the server 200 and receive processing results sent by the server 200.

[0066] It should be understood that the radio frequency unit 110 is optional and can be replaced by other communication interfaces, such as a network port.

[0067] The terminal 100 also includes a power supply 190 (such as a battery) for supplying power to various components. Preferably, the power supply can be logically connected to the processor 170 through a power management system, so that the power management system can manage functions such as charging, discharging, and power consumption.

[0068] The terminal 100 further includes an external interface 180 , which may be a standard Micro USB interface or a multi-pin connector, and may be used to connect the terminal 100 to communicate with other devices, or to connect a charger to charge the terminal 100 .

[0069] Although not shown, the terminal 100 may also include a flashlight, a wireless fidelity (WiFi) module, a Bluetooth module, sensors with different functions, etc., which are not described in detail here. Some or all of the methods described below may be applied in the following embodiments. Figure 2 In the terminal 100 shown.

[0070] Next describe Figure 1 The product form of the server 200;

[0071] Figure 3 A structural diagram of a server 200 is provided, such as Figure 3 As shown, the server 200 includes a bus 201, a processor 202, a communication interface 203, and a memory 204. The processor 202, the memory 204, and the communication interface 203 communicate with each other via the bus 201.

[0072] The bus 201 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0073] The processor 202 may be any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0074] The memory 204 may include a volatile memory, such as a random access memory (RAM). The memory 204 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0075] The memory 204 may be used to store software codes related to the method for obtaining abnormal transaction behavior, and the processor 202 may execute the steps of the method for obtaining abnormal transaction behavior of the chip, and may also schedule other units to implement corresponding functions.

[0076] It should be understood that the above-mentioned terminal 100 and server 200 can be centralized or distributed devices, and the processors in the above-mentioned terminal 100 and server 200 (such as processor 170 and processor 202) can be hardware circuits (such as application specific integrated circuit (ASIC), field-programmable gate array (FPGA), general-purpose processor, digital signal processor (DSP), microprocessor or microcontroller, etc.), or a combination of these hardware circuits. For example, the processor can be a hardware system with an instruction execution function, such as a CPU, DSP, etc., or a hardware system without an instruction execution function, such as an ASIC, FPGA, etc., or a combination of the above-mentioned hardware systems without an instruction execution function and hardware systems with an instruction execution function.

[0077] In order to solve the above problems, the embodiment of the present application provides a method for obtaining abnormal transaction behavior. The method for obtaining abnormal transaction behavior of the embodiment of the present application is described in detail below with reference to the accompanying drawings.

[0078] Reference Figure 4 , Figure 4 A flow chart of a method for obtaining abnormal transaction behavior provided in an embodiment of the present application is shown as follows: Figure 4 As shown, a method for obtaining abnormal transaction behavior provided in an embodiment of the present application may include steps S401 to S414, and these steps are described in detail below.

[0079] Step S401: Acquire abnormal transactions corresponding to a plurality of abnormal accounts within a preset time period.

[0080] Exemplarily, a bank includes multiple accounts, including normal accounts and abnormal accounts. The abnormal accounts mentioned in the embodiments of the present application refer to accounts that have been confirmed to have abnormal transactions.

[0081] It is understandable that abnormal accounts have normal transactions and abnormal transactions.

[0082] For example, the preset time period may be based on time, for example, the length of the preset time period may be 1 day, 1 week, 1 month, or 1 year. For example, if the preset time period is [August 30, 2024, 00:00, August 30, 2024, 23:59], the length of the preset time period is 1 day.

[0083] Exemplarily, the transaction time of the abnormal transaction corresponding to each abnormal account can be converted into a decimal time in minutes starting from 0. For example, the preset time period [00:00, August 30, 2024, 23:59, August 30, 2024] is converted to [0, 1440].

[0084] Exemplarily, abnormal transactions include: transaction time, counterparty account and transaction serial number.

[0085] Exemplarily, in order to reduce the redundancy and noise of abnormal transactions and normal transactions corresponding to multiple abnormal accounts, it is necessary to clean the transactions (including normal transactions and abnormal transactions) corresponding to the multiple abnormal accounts. Exemplarily, the cleaning process includes but is not limited to: removing duplicate transactions, such as removing duplicate transactions in different transaction systems based on the transaction serial number; removing invalid values, such as deleting passive and invalid transaction information such as batch payment, deduction, BGL (Branch General Ledger) transfer transactions; supplementing missing values, such as matching transactions from different source channels, filling in transactions with missing counterparty accounts, and using random numbers to supplement transactions with missing transaction serial numbers; removing abnormal values, such as using box plot analysis to screen out outliers and delete them.

[0086] Exemplarily, abnormal accounts may be mapped to corresponding data. For example, the data mapped to different abnormal accounts may belong to a data range of [1000, 9000].

[0087] For example, the transaction time of the abnormal transaction is converted into a decimal time in minutes starting from 0. The abnormal account is mapped to sufficiently large value data, which is convenient for subsequent clustering calculation and can reduce interference.

[0088] Step S402: for each of the abnormal accounts, based on the transaction time of the multiple abnormal transactions corresponding to the abnormal account, multiple cluster sets are obtained.

[0089] Exemplarily, the transaction time interval between the transaction times of two adjacent abnormal transactions in each cluster set is less than or equal to a time interval threshold, and the number of abnormal transactions in each cluster set is greater than or equal to a cluster number threshold.

[0090] The above-mentioned “abnormal transactions adjacent to each other” refers to abnormal transactions adjacent to each other in transaction time. The following example is used to illustrate. Assuming that the cluster set is {24, 30, 36, 38, 39, 42, 45, 49, 51}, the abnormal transactions contained in the cluster set are characterized by transaction time, “24” and “30” are abnormal transactions adjacent to each other, and “24” and “36” are not abnormal transactions adjacent to each other.

[0091] Exemplarily, the transaction time interval between the transaction times of any two of the abnormal transactions in each cluster set is less than or equal to a time interval threshold, and the number of the abnormal transactions in each cluster set is greater than or equal to a cluster number threshold.

[0092] Exemplarily, the time interval threshold and the cluster number threshold may be determined based on actual conditions and are not limited here.

[0093] Exemplarily, the time interval threshold may be determined based on actual conditions, for example, 10 minutes.

[0094] Exemplarily, the cluster number threshold may be determined based on actual conditions, for example, 5.

[0095] For example, different clustering sets may have intersections.

[0096] For example, for the same abnormal account, not all abnormal transactions can be classified into a cluster set.

[0097] Exemplarily, the clustering space in the embodiment of the present application is a two-dimensional space, the horizontal axis is the transaction time, and the vertical axis is the abnormal account.

[0098] Step S403: dividing the cluster sets whose absolute values ​​of the time intervals of the transaction times corresponding to the cluster centers are less than or equal to the first threshold into the same first abnormal transaction set.

[0099] The first threshold is smaller than the time interval threshold, and the first abnormal transaction set includes the cluster sets corresponding to a plurality of the abnormal accounts.

[0100] It is understandable that after clustering each abnormal account, the cluster set of each abnormal account obtained is not representative, but the commonalities of the cluster sets corresponding to multiple abnormal accounts are representative, so the commonalities of the cluster sets corresponding to multiple abnormal accounts are obtained through step S403.

[0101] Exemplarily, each cluster set has a cluster center, and the cluster center is the mean of the transaction time range corresponding to the cluster set. For example, the cluster set includes 5 abnormal transactions. Assume that the transaction time of the abnormal transactions is converted into decimal time in minutes starting from 0. If the transaction times of the 5 abnormal transactions are 10, 20, 30, 40, and 20 respectively, then the transaction time range corresponding to the cluster set is [10, 40], and the cluster center corresponding to the cluster set is 25.

[0102] Exemplarily, each cluster set has a cluster center, and the cluster center is the mean transaction time of abnormal transactions included in the cluster set.

[0103] Exemplarily, the first threshold or the second threshold may be manually set based on actual conditions. For example, the first threshold is 2 minutes, 20 minutes, or 30 minutes.

[0104] The following example illustrates step S403.

[0105] like Figure 5 , which is a schematic diagram of cluster sets corresponding to multiple abnormal accounts provided in an embodiment of the present application.

[0106] Figure 5 The horizontal axis in the middle represents the trading time converted to a decimal system starting with 0. Assuming the preset time period is [August 30, 2024 00:00, August 30, 2024 23:59], the minimum value of the trading time is 0 and the maximum value is 1440; Figure 5 The vertical axis in the middle is the data of abnormal accounts after being converted to [1000, 9000], and one dot represents one abnormal transaction.

[0107] Figure 5 The following table shows the partial clustering sets corresponding to the 9 abnormal accounts. Figure 5 The converted data of the 9 abnormal accounts from top to bottom are 9000, 8000, 7000, 6000, 5000, 4000, 3000, 2000, and 1000. The converted data of abnormal accounts are referred to as abnormal accounts in the following. It is understandable that Figure 5This is only an example, and does not limit the total number of multiple abnormal accounts. For example, the converted data of the abnormal account may be a decimal or an integer.

[0108] Figure 5 Abnormal transactions of the same color belong to the same cluster set, and abnormal transactions of different colors belong to different cluster sets. Figure 5 In order to enable those skilled in the art to better understand that abnormal transactions of the same color belong to the same cluster set and abnormal transactions of different colors belong to different cluster sets in the embodiment of the present application, the following is a combination of Figure 6 For explanation. Figure 6 As shown, the embodiment of the present application provides Figure 5 A zoomed-in view of part of the cluster set of abnormal account 8000.

[0109] like Figure 6 As shown, the five abnormal transactions of the same color framed by the dotted line belong to the same cluster set; the 13 abnormal transactions of the same color framed by the solid line belong to the same cluster set.

[0110] Assume that the abnormal transactions in each cluster set are represented by transaction time (unit: minute). Assume that the transaction time of the cluster center corresponding to each cluster set is the mean of the transaction time range corresponding to the cluster set. Assume that after clustering, the cluster sets corresponding to the multiple abnormal accounts are as follows:

[0111] The cluster sets corresponding to abnormal account 1000 include: Cluster 0, Cluster 1, Cluster 2, Cluster 3, Cluster 4, and Cluster 5, where:

[0112] Cluster 0 is {24,30,36,38,39,42,45,49,51}, and the transaction time of its corresponding cluster center is 37.5.

[0113] Cluster 1 is:

[0114] {102,106,111,114,115,116,119,123,126,128,129,131,134,135,136,136,141,147,155,156,157,161,163,170,171,148,176}, and the corresponding transaction time of the cluster center is 139.

[0115] Cluster2 is {362,364,369,371,373,375,383}, and the corresponding transaction time of the cluster center is 372.5.

[0116] Cluster 3 is {939,941,947,951,953,955}, and the transaction time of its corresponding cluster center is 947.

[0117] Cluster 4 is {1316, 1318, 1324, 1326, 1329}, and the corresponding transaction time of the cluster center is 1322.5.

[0118] Cluster 5 is {1367,1368,1369,1370,1372,1374,1375,1376,1381,1382,1383,1388,1389,1389,1392,1399,1401,1406,1407,1409,1412,1413,1416,1419,1421,1422,1423,1426,1429,1433,1433,1434] and its corresponding cluster center’s transaction time is 1400.5.

[0119] Assume that the cluster sets corresponding to abnormal account 3000 include: Cluster6, Cluster7 and Cluster8, where:

[0120] Cluster 6 is {22, 28, 31, 39, 41}, and the transaction time of its corresponding cluster center is 31.5.

[0121] Cluster 7 is {62, 64, 72, 77, 81, 82, 89}, and the corresponding transaction time of the cluster center is 75.5.

[0122] Cluster 8 is {114, 121, 122, 127, 131, 136, 138, 139, 145, 155}, and the corresponding transaction time of the cluster center is 134.5.

[0123] Assume that the cluster sets corresponding to abnormal account 4000 include: Cluster9, Cluster10 and Cluster11, where:

[0124] Cluster 9 is {1346, 1351, 1354, 1355, 1360, 1363, 1366, 1369, 1369, 1372, 1375, 1376, 1377, 1379, 1384, 1388, 1389, 1390, 1392, 1392, 1392, 1399}, and the corresponding transaction time of the cluster center is 1372.5.

[0125] Cluster 10 is {10, 11, 16, 22, 26}, and the transaction time of its corresponding cluster center is 18.

[0126] Cluster 11 is {52, 60, 64, 66, 69, 72, 73, 77, 81, 82, 86, 90, 92, 94, 97, 99, 101, 103, 108, 111, 119, 121, 122, 131}, and the corresponding transaction time of the cluster center is 91.5.

[0127] Assume that the cluster set corresponding to abnormal account 5000 includes: Cluster12, where:

[0128] Cluster 12 is {1261, 1266, 1271, 1276, 1279, 1283, 1288}, and the corresponding transaction time of the cluster center is 1274.5.

[0129] Assume that the cluster sets corresponding to abnormal account 6000 include: Cluster 13, Cluster 14, Cluster 15 and Cluster 16, where:

[0130] Cluster 13 is {711, 714, 718, 721, 726, 727, 733, 739, 742, 746, 751}, and the corresponding transaction time of the cluster center is 731.

[0131] Cluster14 is {821,822,823,823,824,824,831,832,834,838,841,845,849 853,855,861}, and the corresponding transaction time of the cluster center is 841.

[0132] Cluster 15 is:

[0133] {1147,1149,1152,1156,1159,1163,1164,1166,1169,1172,1174,1175,1176}, and the corresponding transaction time of the cluster center is 1161.5.

[0134] Cluster 16 is {1311, 1315, 1318, 1321, 1326}, and the corresponding transaction time of the cluster center is 1318.5.

[0135] Assume that the cluster set corresponding to abnormal account 7000 includes: Cluster17, where:

[0136] Cluster 17 is {132, 133, 134, 135, 136, 137, 138, 139}, and the corresponding transaction time of the cluster center is 135.5.

[0137] Exemplarily, the first threshold may be determined based on actual conditions. Assuming that the first threshold is 7 minutes, the following multiple first abnormal transaction sets may be obtained through the above 18 clustering sets.

[0138] {Cluster 10}, {Cluster 11}, {Cluster 7}, {Cluster 0, Cluster 6}, {Cluster 12}, {Cluster 1, Cluster 8, Cluster 17}, {Cluster 2}, {Cluster 13}, {Cluster 14}, {Cluster 3}, {Cluster 15}, {Cluster 12}, {Cluster 4, Cluster 16}, {Cluster 5}, {Cluster 9}. It can be understood that, since the number of the above-mentioned abnormal accounts is small, the number of cluster sets contained in the obtained first abnormal transaction set is small.

[0139] Step S404: determining the first abnormal transaction set including the cluster set whose number is greater than or equal to a second threshold as the second abnormal transaction set.

[0140] Exemplarily, the second threshold may be determined based on actual conditions. For example, the second threshold is related to the total number of multiple abnormal accounts. For example, the second threshold is greater than or equal to the total number of multiple abnormal accounts*a set ratio. The set ratio may be 90%.

[0141] Still taking the example in step S403 as an example, assuming that the second threshold is 3, the second abnormal transaction set is {Cluster 1, Cluster 8, Cluster 17}. The number of cluster sets included in the second abnormal transaction set represents the number of abnormal accounts. It can be understood that the more cluster sets the second abnormal transaction set includes, the more abnormal accounts the cluster sets are in the second abnormal transaction set, which means that the second abnormal transaction set can better represent the transaction characteristics of most abnormal accounts.

[0142] Exemplarily, the number of the second abnormal transaction sets is one or more.

[0143] Step S405: obtaining maximum transaction time intervals respectively corresponding to a plurality of the clustering sets included in the second abnormal transaction set.

[0144] The maximum transaction time interval corresponding to the cluster set refers to the maximum value of the transaction time intervals between the transaction times of the two abnormal transactions contained in the cluster set.

[0145] The following takes the second abnormal transaction set {Cluster 1, Cluster 8, Cluster 17} as an example for description. The maximum transaction time interval corresponding to Cluster 1 is 74, the maximum transaction time interval corresponding to Cluster 8 is 41, and the maximum transaction time interval corresponding to Cluster 17 is 7.

[0146] Step S406: Obtain the transaction time interval.

[0147] The maximum value of the transaction time interval is the maximum value of multiple maximum transaction time intervals, and the minimum value of the transaction time interval is the minimum value of multiple maximum transaction time intervals.

[0148] The following example is used to illustrate that if the second abnormal transaction set is {Cluster 1, Cluster 8, Cluster 17}, since the maximum transaction time interval corresponding to Cluster 1 is 74; the maximum transaction time interval corresponding to Cluster 8 is 41; and the maximum transaction time interval corresponding to Cluster 17 is 7; then, the transaction time interval interval is [7,74].

[0149] Step S407: obtaining a candidate transaction time interval at each preset step length from the transaction time interval interval to obtain a plurality of candidate transaction time intervals.

[0150] Exemplarily, the preset step size can be determined based on actual conditions. Assuming that the transaction time interval range is [7,74] and the preset step size is 5, the multiple candidate transaction time intervals obtained are: 7, 12, 17, 22, 17, 32, 37, 42, 47, 52, 57, 62, 67, 72.

[0151] Step S408: For each of the candidate transaction time intervals, calculate the fault tolerance rates corresponding to the plurality of abnormal accounts.

[0152] Exemplarily, the fault tolerance rate corresponding to the abnormal account is the sum of the ratios corresponding to multiple time intervals, the ratio corresponding to the time interval is the ratio of a first number to a second number, the difference between the latest time and the earliest time of the time interval is the candidate transaction time interval, the first number refers to the number of abnormal transactions of the abnormal account within the time interval, and the second number refers to the sum of the number of abnormal transactions of the abnormal account and the number of normal transactions within the time interval.

[0153] It is understandable that as the length of the candidate transaction time interval increases, the length of the event interval corresponding to the candidate transaction time interval increases, and the number of normal transactions and abnormal transactions falling into the time interval will increase, which will also lead to a decrease in the fault tolerance rate. It is understandable that the higher the fault tolerance rate corresponding to the time interval, the greater the ratio of the number of abnormal transactions falling into the time interval to the sum of the number of abnormal transactions and normal transactions falling into the time interval, so that the abnormal transaction behavior obtained is more accurate.

[0154] The time interval, the first number and the second number are described below. For each abnormal account, the transaction time of each abnormal transaction of the abnormal account can be used as the starting time, and the candidate transaction time interval can be used as the interval to obtain multiple time intervals. The following example is used for description.

[0155] For example, the preset time period is [0,1440], the candidate transaction time interval is 52, the transaction time of the first abnormal transaction is the 10th minute, then the time interval is [10,62); the transaction time of the second abnormal transaction is the 20th minute, then the time interval is [20,82); the transaction time of the third abnormal transaction is the 40th minute, then the time interval is [40,102), and the ratios corresponding to each time interval can be calculated. For example, the ratio corresponding to the time interval [10,62) = the first number / the second number = the number of abnormal transactions of the abnormal account in [10,62) / the sum of the number of abnormal transactions of the abnormal account in [10,62) and the number of normal transactions.

[0156] Step S409: For each of the candidate transaction time intervals, the sum of the fault tolerance rates corresponding to the plurality of abnormal accounts is calculated to obtain a target fault tolerance rate corresponding to the candidate transaction time interval.

[0157] Step S410: Determine the candidate transaction time interval corresponding to the highest target fault tolerance rate as the optimal time interval.

[0158] It is understandable that the longer the candidate transaction time interval is, the more abnormal transactions can fall within the candidate transaction time interval, and the more normal transactions can fall within the candidate transaction time interval. Therefore, the candidate transaction time interval needs to be determined in combination with the fault tolerance rate.

[0159] Step S411: Determine the cluster number threshold as a target number.

[0160] Step S412: Determine the target number of counterparties based on the number of counterparty accounts of abnormal transactions corresponding to the plurality of abnormal accounts within the optimal time interval.

[0161] For example, in a relatively concentrated cluster, the abnormal accounts all have 1 or 2 counterparties, and the target number of counterparties is one or two.

[0162] Step S413: determining a transaction time interval based on the transaction time of the abnormal transactions in the cluster set included in the second abnormal transaction set.

[0163] The following takes the second abnormal transaction set {Cluster 1, Cluster 8, Cluster 17} as an example. Since the time interval corresponding to Cluster 1 is [102, 176]; the time interval corresponding to Cluster 8 is [114, 155]; and the time interval corresponding to Cluster 17 is [132, 139], the transaction time interval can be [102, 176], which is converted to 24-hour time as [01:42, 02:56].

[0164] Exemplarily, the abnormal transactions with the same transaction time in the second abnormal transaction set can be divided into the same set, which is assumed to be called the target set; multiple target sets are sorted from most to least according to the number of abnormal transactions contained therein to obtain a sorting result; and the transaction time interval is determined based on the first preset number of target sets in the sorting result. For example, assuming that the preset number is 2, the transaction time interval determined based on the first two target sets in the sorting result is [102, 176].

[0165] Exemplarily, the transaction time interval may be determined based on all transaction times in the second abnormal transaction set.

[0166] Step S414: Determine that the abnormal trading behavior is a transaction greater than or equal to the target number of transactions for counterparty accounts less than or equal to the target number of counterparties within the trading time interval and within the optimal time interval.

[0167] Exemplarily, the transaction type of the transaction includes, but is not limited to: one or more of a transfer-out transaction and a transfer-in transaction.

[0168] Taking the above example again, abnormal trading behavior refers to: between [01:42, 02:56], transactions greater than or equal to the target number are generated within 52 minutes and the counterparty accounts are concentrated in one or two.

[0169] The embodiment of the present application provides a method for obtaining abnormal transaction behavior, obtaining abnormal transactions corresponding to multiple abnormal accounts within a preset time period; clustering the abnormal transactions of each abnormal account to obtain a cluster set; since the cluster set of an abnormal account does not have commonality, it is necessary to analyze the cluster sets corresponding to multiple abnormal accounts to obtain a second abnormal transaction set with commonality, that is, the second abnormal transaction set can represent the transaction behavior of abnormal transactions of most abnormal accounts; obtaining the maximum transaction time interval corresponding to the multiple cluster sets contained in the second abnormal transaction set; obtaining the transaction time interval interval; but the optimal time interval is specifically which value of the transaction time interval interval, which needs to be determined in combination with the target fault tolerance corresponding to each candidate transaction time interval obtained from the transaction time interval interval; since the second abnormal transaction set can represent the transaction behavior of abnormal transactions of most abnormal accounts, the transaction time interval can be determined based on the transaction time of the abnormal transactions in the cluster set contained in the second abnormal transaction set. Thus, the abnormal transaction behavior determined is: within the transaction time interval and within the optimal time interval, transactions higher than or equal to the target number of counterparty accounts are conducted.

[0170] It is understandable that there are multiple ways to implement step S402, and the embodiments of the present application provide but are not limited to the following two.

[0171] The first implementation of step S402 includes the following steps A1 to A9.

[0172] Step A1: for each abnormal account, determine an unmarked abnormal transaction to be processed from the multiple abnormal transactions corresponding to the abnormal account.

[0173] Initially all abnormal transactions are marked.

[0174] Step A2: For each of the abnormal accounts, a third number is obtained based on a plurality of the abnormal transactions corresponding to the abnormal account.

[0175] The third number includes the number of candidate abnormal transactions that belong to the abnormal account and whose transaction time interval with the transaction time of the abnormal transaction to be processed is less than or equal to the candidate time interval threshold, and the number of candidate abnormal transactions that belong to the abnormal account and whose transaction time interval with the transaction time of the candidate abnormal transaction is less than or equal to the candidate time interval threshold.

[0176] Step A3: If the third number is greater than or equal to the candidate cluster number threshold, obtain a candidate cluster set including the abnormal transaction to be processed and abnormal transactions whose transaction time interval with the abnormal transaction to be processed is less than or equal to the candidate time interval threshold.

[0177] Step A4: If the third number is less than the candidate cluster number threshold, and the transaction time interval between the transaction time of the abnormal transaction to be processed and the transaction time of the boundary transaction in the existing candidate cluster set is less than or equal to the candidate time interval threshold, the abnormal transaction to be processed is divided into the existing candidate cluster set.

[0178] The boundary transactions in the candidate cluster set are transactions that are closest in transaction time to the abnormal transaction to be processed.

[0179] Step A5: Determine that the abnormal transaction to be processed has been marked, and return to step A1 until all the abnormal transactions are marked.

[0180] The following example illustrates steps A1 to A5. Assuming that the abnormal transaction to be processed is P, and assuming that Eps = the candidate time interval threshold, then obtain the time interval centered on the transaction time corresponding to P and using Eps as the distance measurement time, that is, [P-Eps, P+Eps], and count the candidate abnormal transactions P1 located in the time interval [P-Eps, P+Eps]; obtain the time interval centered on the transaction time corresponding to P1 and using Eps as the distance measurement time, that is, [P1-Eps, P1+Eps], and count the candidate abnormal transactions P2 located in the time interval [P1-Eps, P1+Eps]; obtain the time interval centered on the transaction time corresponding to P2 and using Eps as the distance measurement time, that is, [P2-Eps, P2+Eps], and count the candidate abnormal transactions P3 located in the time interval [P2-Eps, P2+Eps]; obtain the time interval centered on the transaction time corresponding to P3 and using Eps as the distance measurement time, that is, [P2-Eps, P2+Eps]. y The corresponding transaction time is the center, and Eps is the time interval for measuring distance, that is, [P y -Eps,P y +Eps], the statistics are in the time interval [P y -Eps,P y +Eps] candidate abnormal transaction P y+1 , and so on, until it is in the time interval [P y -Eps,P y +Eps] is 0, and the total number of multiple candidate abnormal transactions is the third number.

[0181] If the third number is greater than or equal to the candidate cluster number threshold, a new candidate cluster set is created; the new candidate cluster set includes the third number of abnormal transactions. If the third number is less than the candidate cluster number threshold, and the transaction time interval between P and the transaction time of the boundary transaction of the existing candidate cluster set is less than or equal to the candidate time interval threshold, P is divided into the existing candidate cluster set.

[0182] Step A6: For each of the abnormal accounts, based on the multiple candidate cluster sets corresponding to the abnormal account, calculate the cluster evaluation value corresponding to the abnormal account.

[0183] It is understandable that there are multiple methods for “calculating the cluster evaluation value corresponding to the abnormal account based on the multiple candidate cluster sets corresponding to the abnormal account”, and the embodiments of the present application provide but are not limited to the following two methods.

[0184] The first one is through the formula Calculate and obtain the cluster evaluation value S corresponding to the abnormal account;

[0185] Among them, a i It refers to the average value of the transaction time interval between the transaction time of the ith abnormal transaction and other abnormal transactions in the same candidate cluster set; b i It refers to the average value of the transaction time interval between the ith abnormal transaction and the transaction time of the cluster center of other candidate cluster sets; n refers to the total number of abnormal transactions contained in the candidate cluster set corresponding to the abnormal account.

[0186] The closer the clustering evaluation value S is to 1, the better the clustering effect is.

[0187] The preset condition refers to that the target cluster evaluation value is greater than a third threshold. Exemplarily, the third threshold may be determined based on actual conditions and is not limited here. For example, the third threshold may be 0.95.

[0188] The second method is through the formula Calculate and obtain the cluster evaluation value SSE corresponding to the abnormal account;

[0189] Among them, C j refers to the jth candidate cluster set, m j C j The transaction time of the cluster center, p f C j The transaction time of the fth abnormal transaction in C j The total number of abnormal transactions included, K is the number of candidate cluster sets corresponding to the abnormal accounts.

[0190] The closer SSE is to 0, the better the clustering effect.

[0191] The preset condition refers to that the target cluster evaluation value is less than a fourth threshold. Exemplarily, the fourth threshold may be determined based on actual conditions and is not limited here. For example, the fourth threshold may be 0.05.

[0192] Step A7: Obtain the sum of the cluster evaluation values ​​corresponding to the plurality of abnormal accounts to obtain a target cluster evaluation value.

[0193] Step A8: If the target cluster evaluation value does not meet the preset conditions, update the candidate cluster number threshold and / or update the candidate time interval threshold, return to step A8, and for each abnormal account, determine the unmarked abnormal transactions to be processed from the multiple abnormal transactions corresponding to the abnormal account.

[0194] Step A9: If the target cluster evaluation value meets the preset condition, the candidate cluster sets corresponding to the plurality of abnormal accounts are determined as the cluster set.

[0195] The second implementation of step S402 is: for each of the abnormal accounts, clustering multiple abnormal transactions corresponding to the abnormal account by using the kmeans clustering algorithm to obtain a cluster combination corresponding to the abnormal account.

[0196] A method for obtaining abnormal transaction behavior provided in an embodiment of the present application is introduced above. A device for executing the method for obtaining abnormal transaction behavior is introduced below.

[0197] See also Figure 7 , Figure 7 A schematic diagram of the structure of a device for acquiring abnormal transaction behavior provided in an embodiment of the present application.

[0198] like Figure 7 As shown, the device for acquiring abnormal transaction behavior includes:

[0199] The first acquisition module 701 is used to acquire abnormal transactions corresponding to multiple abnormal accounts within a preset time period;

[0200] The second acquisition module 702 is used to obtain, for each abnormal account, a plurality of cluster sets based on the transaction time of the plurality of abnormal transactions corresponding to the abnormal account;

[0201] A division module 703 is used to divide the cluster sets whose absolute values ​​of the time intervals of the transaction times corresponding to the cluster centers are less than or equal to the first threshold into the same first abnormal transaction set;

[0202] A first determination module 704, configured to determine the first abnormal transaction set including the cluster set whose number is greater than or equal to a second threshold as a second abnormal transaction set;

[0203] The third acquisition module 705 is used to acquire the maximum transaction time intervals respectively corresponding to the plurality of cluster sets included in the second abnormal transaction set;

[0204] A fourth acquisition module 706 is used to acquire a transaction time interval, wherein the maximum value of the transaction time interval is the maximum value of a plurality of the maximum transaction time intervals, and the minimum value of the transaction time interval is the minimum value of the plurality of the maximum transaction time intervals;

[0205] A fifth acquisition module 707, configured to obtain a candidate transaction time interval from each preset step in the transaction time interval interval, so as to obtain a plurality of candidate transaction time intervals;

[0206] A first calculation module 708, configured to calculate the fault tolerance rates corresponding to the plurality of abnormal accounts respectively for each of the candidate transaction time intervals;

[0207] The second calculation module 709 is used to calculate the sum of the fault tolerance rates corresponding to the plurality of abnormal accounts for each of the candidate transaction time intervals, so as to obtain a target fault tolerance rate corresponding to the candidate transaction time interval;

[0208] A second determination module 710 is used to determine that the candidate transaction time interval corresponding to the highest target fault tolerance rate is the optimal time interval;

[0209] A third determination module 711 is used to determine that the cluster number threshold is a target number of times;

[0210] A fourth determination module 712, configured to determine the target number of trading counterparties based on the number of trading counterparty accounts of abnormal transactions corresponding to the plurality of abnormal accounts respectively within the optimal time interval;

[0211] A fifth determining module 713, configured to determine a transaction time interval based on the transaction time of the abnormal transactions in the cluster set included in the second abnormal transaction set;

[0212] The sixth determination module 714 is used to determine whether the abnormal trading behavior is a transaction greater than or equal to the target number of transactions against counterparty accounts less than or equal to the target number of counterparties within the trading time interval and within the optimal time interval.

[0213] In a possible implementation, the second acquisition module includes:

[0214] A first determining unit is used to determine, for each abnormal account, an unmarked abnormal transaction to be processed from the multiple abnormal transactions corresponding to the abnormal account;

[0215] A first acquisition unit is used to acquire, for each abnormal account, a third number based on the multiple abnormal transactions corresponding to the abnormal account, the third number including the number of candidate abnormal transactions that belong to the multiple abnormal transactions corresponding to the abnormal account and whose transaction time interval with the transaction time of the abnormal transaction to be processed is less than or equal to the candidate time interval threshold, and the number of candidate abnormal transactions that belong to the multiple abnormal transactions corresponding to the abnormal account and whose transaction time interval with the transaction time of the candidate abnormal transaction is less than or equal to the candidate time interval threshold;

[0216] A second acquisition unit is configured to acquire, if the third number is greater than or equal to a candidate cluster number threshold, a candidate cluster set including the abnormal transaction to be processed and abnormal transactions whose transaction time interval with the transaction time of the abnormal transaction to be processed is less than or equal to the candidate time interval threshold;

[0217] a partitioning unit, configured to partition the abnormal transaction to be processed into the existing candidate cluster set if the third number is less than the candidate cluster number threshold, and the transaction time interval between the transaction time of the abnormal transaction to be processed and the transaction time of the boundary transaction in the existing candidate cluster set is less than or equal to the candidate time interval threshold;

[0218] a second determining unit, configured to determine that the abnormal transaction to be processed has been marked, and trigger the first determining unit until all the abnormal transactions are marked;

[0219] A first calculation unit is configured to calculate, for each abnormal account, a cluster evaluation value corresponding to the abnormal account based on the plurality of candidate cluster sets corresponding to the abnormal account;

[0220] A third acquisition unit, configured to obtain the sum of the cluster evaluation values ​​corresponding to the plurality of abnormal accounts, to obtain a target cluster evaluation value;

[0221] a triggering unit, configured to update the candidate cluster number threshold and / or the candidate time interval threshold if the target cluster evaluation value does not meet a preset condition, and trigger the first determination unit until all the abnormal transactions are marked;

[0222] The third determining unit is configured to determine, if the target cluster evaluation value satisfies the preset condition, the candidate cluster sets corresponding to the plurality of abnormal accounts as the cluster set.

[0223] In a possible implementation, the first computing unit is specifically configured to:

[0224] By formula Calculate and obtain the cluster evaluation value S corresponding to the abnormal account;

[0225] Among them, a i It refers to the average value of the transaction time interval between the transaction time of the ith abnormal transaction and other abnormal transactions in the same candidate cluster set; b i It refers to the average value of the transaction time interval between the ith abnormal transaction and the transaction time of the cluster center of other candidate cluster sets; n refers to the total number of abnormal transactions contained in the candidate cluster set corresponding to the abnormal account.

[0226] In a possible implementation, the preset condition refers to that the target cluster evaluation value is greater than a third threshold.

[0227] In a possible implementation, the first computing unit is specifically configured to:

[0228] By formula Calculate and obtain the cluster evaluation value SSE corresponding to the abnormal account;

[0229] Among them, C j refers to the jth candidate cluster set, m j C j The transaction time of the cluster center, p f C j The transaction time of the fth abnormal transaction in C j The total number of abnormal transactions included, K is the number of candidate cluster sets corresponding to the abnormal accounts.

[0230] In a possible implementation, the preset condition refers to that the target cluster evaluation value is less than a fourth threshold.

[0231] Also provided in an embodiment of the present application is a computer program product including computer-readable instructions. When the computer-readable instructions are executed on a server, the server implements any method for obtaining abnormal transaction behavior provided in an embodiment of the present application.

[0232] A computer-readable storage medium is also provided in an embodiment of the present application. The storage medium carries one or more computer programs. When the one or more computer programs are executed by a server, the server can implement any method for obtaining abnormal transaction behavior provided in an embodiment of the present application.

[0233] It should be noted that the method for obtaining abnormal trading behavior and the related device provided by the present invention can be used in the financial field or other fields. Other fields are any fields other than the financial field. The above is only an example and does not limit the application field of the method for obtaining abnormal trading behavior and the related device provided by the present invention.

[0234] It should also be noted that the device embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed over multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. In addition, in the drawings of the device embodiments provided by the present application, the connection relationship between the modules indicates that there is a communication connection between them, which may be specifically implemented as one or more communication buses or signal lines.

[0235] Through the description of the above implementation mode, the technicians in the field can clearly understand that the present application can be implemented by means of software plus necessary general hardware, and of course, it can also be implemented by special hardware including special integrated circuits, special CPUs, special memories, special components, etc. In general, all functions completed by computer programs can be easily implemented by corresponding hardware, and the specific hardware structure used to implement the same function can also be various, such as analog circuits, digital circuits or special circuits. However, for the present application, software program implementation is a better implementation mode in more cases. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a readable storage medium, such as a computer floppy disk, a U disk, a mobile hard disk, a ROM, a RAM, a disk or an optical disk, etc., including a number of instructions to enable a computer device (which can be a personal computer, a training device, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0236] In the above embodiments, all or part of the embodiments may be implemented by software, hardware, firmware or any combination thereof. When implemented by software, all or part of the embodiments may be implemented in the form of a computer program product.

[0237] The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, a computer, a training device, or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, training device, or data center. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a training device, a data center, etc. that includes one or more available media integrations. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)), etc.

Claims

1. A method for obtaining abnormal transaction behavior, characterized in that: include: Obtain abnormal transactions corresponding to multiple abnormal accounts within a preset time period; For each of the abnormal accounts, based on the transaction time of the multiple abnormal transactions corresponding to the abnormal account, multiple cluster sets are obtained, and the number of the abnormal transactions in the cluster sets is greater than or equal to a cluster number threshold; Dividing the cluster sets whose absolute values ​​of the time intervals of the transaction times corresponding to the cluster centers are less than or equal to the first threshold into the same first abnormal transaction set; Determine the first abnormal transaction set including the cluster set whose number is greater than or equal to a second threshold as the second abnormal transaction set; Obtaining maximum transaction time intervals respectively corresponding to a plurality of the clustering sets included in the second abnormal transaction set; Acquire a transaction time interval, wherein the maximum value of the transaction time interval is the maximum value of a plurality of the maximum transaction time intervals, and the minimum value of the transaction time interval is the minimum value of the plurality of the maximum transaction time intervals; Obtain a candidate transaction time interval at each preset step length from the transaction time interval interval to obtain a plurality of candidate transaction time intervals; For each of the candidate transaction time intervals, calculating the fault tolerance rates corresponding to the plurality of abnormal accounts respectively; For each of the candidate transaction time intervals, the sum of the fault tolerance rates corresponding to the plurality of abnormal accounts is calculated to obtain a target fault tolerance rate corresponding to the candidate transaction time interval; Determine the candidate transaction time interval corresponding to the highest target fault tolerance rate as the optimal time interval; Determine the cluster number threshold as a target number; Determining a target number of trading counterparties based on the number of trading counterparty accounts of abnormal transactions corresponding to the plurality of abnormal accounts respectively within the optimal time interval; Determining a transaction time interval based on the transaction time of the abnormal transactions in the cluster set included in the second abnormal transaction set; The abnormal trading behavior is determined as conducting transactions greater than or equal to the target number of transactions for counterparty accounts less than or equal to the target number of counterparties within the trading time interval and within the optimal time interval.

2. The method for obtaining abnormal transaction behavior according to claim 1, characterized in that: The step of obtaining a plurality of clustering sets for each of the abnormal accounts based on the transaction times of the plurality of abnormal transactions corresponding to the abnormal account comprises: For each of the abnormal accounts, determining an unmarked abnormal transaction to be processed from the multiple abnormal transactions corresponding to the abnormal account; For each of the abnormal accounts, based on the multiple abnormal transactions corresponding to the abnormal account, a third number is obtained, the third number including the number of candidate abnormal transactions that belong to the multiple abnormal transactions corresponding to the abnormal account and whose transaction time interval with the transaction time of the abnormal transaction to be processed is less than or equal to the candidate time interval threshold, and the number of candidate abnormal transactions that belong to the multiple abnormal transactions corresponding to the abnormal account and whose transaction time interval with the transaction time of the candidate abnormal transaction is less than or equal to the candidate time interval threshold; If the third number is greater than or equal to the candidate cluster number threshold, obtaining a candidate cluster set including the abnormal transaction to be processed and abnormal transactions whose transaction time interval with the transaction time of the abnormal transaction to be processed is less than or equal to the candidate time interval threshold; If the third number is less than the candidate cluster number threshold, and the transaction time interval between the transaction time of the abnormal transaction to be processed and the transaction time of the boundary transaction in the existing candidate cluster set is less than or equal to the candidate time interval threshold, the abnormal transaction to be processed is divided into the existing candidate cluster set; Determining that the abnormal transaction to be processed has been marked, returning to the step of determining, for each abnormal account, an unmarked abnormal transaction to be processed from the multiple abnormal transactions corresponding to the abnormal account, until all the abnormal transactions are marked; For each of the abnormal accounts, based on the multiple candidate cluster sets corresponding to the abnormal account, a cluster evaluation value corresponding to the abnormal account is calculated; Obtaining the sum of the cluster evaluation values ​​corresponding to the plurality of abnormal accounts respectively to obtain a target cluster evaluation value; If the target cluster evaluation value does not meet the preset conditions, the candidate cluster number threshold and / or the candidate time interval threshold are updated, and the process returns to the step of determining, for each abnormal account, an unmarked abnormal transaction to be processed from the multiple abnormal transactions corresponding to the abnormal account; If the target cluster evaluation value meets the preset condition, the candidate cluster sets corresponding to the plurality of abnormal accounts are determined as the cluster sets.

3. The method for obtaining abnormal transaction behavior according to claim 2, characterized in that: The step of calculating the cluster evaluation value corresponding to the abnormal account based on the multiple candidate cluster sets corresponding to the abnormal account includes: By formula Calculate and obtain the cluster evaluation value S corresponding to the abnormal account; Among them, a i It refers to the average value of the transaction time interval between the transaction time of the ith abnormal transaction and other abnormal transactions in the same candidate cluster set; b i It refers to the average value of the transaction time interval between the ith abnormal transaction and the transaction time of the cluster center of other candidate cluster sets; n refers to the total number of abnormal transactions contained in the candidate cluster set corresponding to the abnormal account.

4. The method for obtaining abnormal transaction behavior according to claim 3 is characterized in that: The preset condition means that the target cluster evaluation value is greater than a third threshold.

5. The method for obtaining abnormal transaction behavior according to claim 2, characterized in that: The step of calculating the cluster evaluation value corresponding to the abnormal account based on the multiple candidate cluster sets corresponding to the abnormal account includes: By formula Calculate and obtain the cluster evaluation value SSE corresponding to the abnormal account; Among them, C j refers to the jth candidate cluster set, m j C j The transaction time of the cluster center, p f C j The transaction time of the fth abnormal transaction in C j The total number of abnormal transactions included, K is the number of candidate cluster sets corresponding to the abnormal accounts.

6. The method for obtaining abnormal transaction behavior according to claim 5, characterized in that: The preset condition means that the target cluster evaluation value is less than a fourth threshold.

7. A device for acquiring abnormal transaction behavior, characterized in that: include: A first acquisition module is used to acquire abnormal transactions corresponding to multiple abnormal accounts within a preset time period; A second acquisition module is used to obtain, for each abnormal account, a plurality of cluster sets based on the transaction time of the plurality of abnormal transactions corresponding to the abnormal account, wherein the number of the abnormal transactions in the cluster set is greater than or equal to a cluster number threshold; A division module, used for dividing the cluster sets whose absolute values ​​of the time intervals of the transaction times corresponding to the cluster centers are less than or equal to the first threshold into the same first abnormal transaction set; A first determination module, configured to determine the first abnormal transaction set including the cluster set whose number is greater than or equal to a second threshold as a second abnormal transaction set; A third acquisition module is used to acquire the maximum transaction time intervals respectively corresponding to the plurality of cluster sets included in the second abnormal transaction set; A fourth acquisition module is used to acquire a transaction time interval, wherein the maximum value of the transaction time interval is the maximum value of a plurality of the maximum transaction time intervals, and the minimum value of the transaction time interval is the minimum value of the plurality of the maximum transaction time intervals; A fifth acquisition module, configured to obtain a candidate transaction time interval from each preset step in the transaction time interval interval, so as to obtain a plurality of the candidate transaction time intervals; A first calculation module, configured to calculate the fault tolerance rates corresponding to the plurality of abnormal accounts respectively for each of the candidate transaction time intervals; A second calculation module is used to calculate the sum of the fault tolerance rates corresponding to the plurality of abnormal accounts for each of the candidate transaction time intervals, so as to obtain a target fault tolerance rate corresponding to the candidate transaction time interval; A second determination module is used to determine that the candidate transaction time interval corresponding to the highest target fault tolerance rate is the optimal time interval; A third determination module is used to determine that the cluster number threshold is a target number of times; A fourth determination module, configured to determine the target number of trading counterparties based on the number of trading counterparty accounts of abnormal transactions respectively corresponding to the plurality of abnormal accounts within the optimal time interval; a fifth determining module, configured to determine a transaction time interval based on the transaction time of the abnormal transactions in the cluster set included in the second abnormal transaction set; The sixth determination module is used to determine that the abnormal trading behavior is a transaction greater than or equal to the target number of transactions performed against counterparty accounts less than or equal to the target number of counterparties within the trading time interval and within the optimal time interval.

8. A computer program product, characterized in that It includes computer-readable instructions, which, when executed on a server, enable the electronic device to implement the method for obtaining abnormal transaction behavior as described in any one of claims 1 to 6.

9. A server, characterized in that: The method comprises at least one processor and a memory connected to the processor, wherein: The memory is used to store computer programs; The processor is used to execute the computer program so that the server can implement the method for obtaining abnormal transaction behavior as described in any one of claims 1 to 5.

10. A computer storage medium, characterized in that: The storage medium carries one or more computer programs, and when the one or more computer programs are executed by the server, the server can implement the method for obtaining abnormal transaction behavior as described in any one of claims 1 to 5.

Images