Abnormal transaction object identification method and related device

Abstract

The embodiment of the invention discloses an abnormal transaction object identification method and a related device, and the method comprises the steps: obtaining transaction amounts corresponding to a target transaction object at a plurality of continuous time points, and determining sub-empirical values, corresponding to a target time point, of a plurality of to-be-analyzed time points except the target time point in the plurality of time points; the average value of the sub-empirical values corresponding to the multiple to-be-analyzed time points is determined as an empirical value corresponding to the target time point, the empirical value is used for representing the transaction abnormity probability of the target time point, and the transaction abnormity probability is inversely correlated with the empirical value. On the basis that the empirical value corresponding to the target time point is smaller than the preset threshold value, it is indicated that the target transaction object has an overlarge transaction amount at the target time point compared with other time points in the multiple time points, and therefore it can be determined that the target transaction object is an abnormal transaction object at the target time point; therefore, the abnormal transaction object corresponding to each time point is accurately identified, and the transaction security is improved.

Description

Technical Field

[0001] The present application relates to the field of data analysis technology, and in particular to a method for identifying abnormal transaction objects and related devices. Background Art

[0002] As the world's financial economy has developed, banks, as the core of the financial market system, have seen a continuous increase in the number and scale of their overall transactions, but also various illegal transactions that have been repeatedly banned. These illegal transactions have seriously disrupted the country's financial order and infringed on people's property safety. It is crucial to effectively combat all kinds of illegal transactions. How to mine risky capital transactions from the massive transaction data generated every day is a common problem faced by the financial industry, including major banks. It is necessary to construct an appropriate mathematical model, apply effective and efficient detection algorithms to analyze massive transaction data, and accurately mine risky capital transaction chains.

[0003] In related technologies, a transaction topology graph can be constructed based on the transaction relationship between multiple transaction objects. The nodes in the transaction topology graph are transaction objects, and the edges between the nodes are used to represent the transaction relationship. By analyzing the transaction topology graph, the abnormal transaction objects can be determined to a certain extent.

[0004] However, the related technology only identifies anomalies based on the transaction relationship between multiple transaction nodes at a certain point in time, and does not conduct comprehensive analysis at multiple time points, resulting in poor identification accuracy of abnormal transaction objects and difficulty in improving transaction security. Summary of the invention

[0005] In order to solve the above technical problems, the present application provides a method for identifying abnormal transaction objects, which can accurately identify abnormal transaction objects based on time series information.

[0006] The embodiments of the present application disclose the following technical solutions:

[0007] In a first aspect, an embodiment of the present application discloses a method for identifying an abnormal transaction object, the method comprising:

[0008] Obtain the transaction amounts corresponding to the target transaction object at multiple consecutive time points;

[0009] Determine sub-experience values ​​of the target time point respectively corresponding to a plurality of time points to be analyzed except the target time point among the plurality of time points; determine the sub-experience value corresponding to the target time point to be analyzed to be a first sub-experience value based on the transaction amount corresponding to the target time point to be analyzed being less than the transaction amount corresponding to the target time point; determine the sub-experience value corresponding to the target time point to be analyzed to be a second sub-experience value based on the transaction amount corresponding to the target time point to be analyzed being not less than the transaction amount corresponding to the target time point; the first sub-experience value is less than the second sub-experience value; and the target time point to be analyzed is any one of the plurality of time points to be analyzed;

[0010] Determine the average value of the sub-experience values ​​corresponding to the multiple time points to be analyzed as the experience value corresponding to the target time point, the experience value is used to characterize the probability of abnormal transaction at the target time point, and the abnormal transaction probability is inversely correlated with the magnitude of the experience value;

[0011] Based on the fact that the experience value corresponding to the target time point is less than a preset threshold, it is determined that the target transaction object is an abnormal transaction object at the target time point.

[0012] In a possible implementation, the method further includes:

[0013] Determine a transaction topology graph corresponding to the target time point, the transaction topology graph comprising a plurality of transaction nodes and connection edges between the plurality of transaction nodes, the plurality of transaction nodes corresponding one-to-one to a plurality of transaction objects, the plurality of transaction objects including the target transaction object, and the connection edge between two transaction nodes is used to represent that there is a transaction behavior between the transaction objects respectively corresponding to the two transaction nodes at the target time point;

[0014] Clustering the multiple transaction nodes according to the connection edges to obtain multiple clusters, wherein the transaction intimacy between the multiple transaction nodes in the same cluster is greater than the transaction intimacy between the multiple transaction nodes in different clusters;

[0015] Based on the transaction nodes having corresponding abnormal transaction objects among the multiple transaction nodes included in the target cluster, the transaction objects respectively corresponding to the multiple transaction nodes included in the target cluster are determined as abnormal transaction objects.

[0016] In a possible implementation, based on the transaction nodes having corresponding abnormal transaction objects among the multiple transaction nodes included in the target cluster, determining the transaction objects respectively corresponding to the multiple transaction nodes included in the target cluster as abnormal transaction objects includes:

[0017] Based on the fact that the number of transaction nodes corresponding to abnormal transaction objects among the multiple transaction nodes included in the target cluster is greater than a preset number threshold, the transaction objects respectively corresponding to the multiple transaction nodes included in the target cluster are determined as abnormal transaction objects.

[0018] In a possible implementation, based on a transaction node having a corresponding abnormal transaction object among multiple transaction nodes included in the target cluster, determining the transaction objects respectively corresponding to the multiple transaction nodes included in the target cluster as abnormal transaction objects includes:

[0019] Based on the fact that a proportion of transaction nodes corresponding to abnormal transaction objects among the multiple transaction nodes included in the target cluster is greater than a preset proportion threshold, the transaction objects respectively corresponding to the multiple transaction nodes included in the target cluster are determined as abnormal transaction objects.

[0020] In a possible implementation, clustering the multiple transaction nodes according to the connection edges to obtain multiple clusters includes:

[0021] According to the connection edges, the multiple transaction nodes are clustered N times to obtain the multiple clusters. In the i-th clustering process, the target transaction node and the adjacent transaction nodes connected by the connection edges are clustered into the same cluster, and difference change information is determined. The difference change information is used to characterize the difference change in closeness brought about by clustering the target transaction node and the adjacent transaction nodes connected by the connection edges into the same cluster. The closeness difference is the difference between the transaction closeness between the multiple transaction nodes of the same cluster and the transaction closeness between the multiple transaction nodes of different clusters. The target transaction node is any transaction node that does not have a corresponding cluster in the i-th clustering process;

[0022] Based on the closeness difference change represented by the difference change information being an increase, performing the (i+1)th clustering process;

[0023] Based on the fact that the closeness difference represented by the difference change information has not increased, the target transaction node is changed and the difference change information is re-determined.

[0024] In a second aspect, an embodiment of the present application discloses a device for identifying an abnormal transaction object, the device comprising an acquisition unit, a first determination unit, a second determination unit, and a third determination unit:

[0025] The acquisition unit is used to acquire the transaction amounts corresponding to the target transaction object at multiple consecutive time points;

[0026] The first determining unit is used to determine the sub-experience values ​​of the target time point respectively corresponding to the multiple time points to be analyzed except the target time point among the multiple time points, and based on the transaction amount corresponding to the target time point to be analyzed being less than the transaction amount corresponding to the target time point, determine the sub-experience value corresponding to the target time point to be analyzed to be a first sub-experience value, based on the transaction amount corresponding to the target time point to be analyzed being not less than the transaction amount corresponding to the target time point, determine the sub-experience value corresponding to the target time point to be analyzed to be a second sub-experience value, the first sub-experience value is less than the second sub-experience value, and the target time point to be analyzed is any one of the multiple time points to be analyzed;

[0027] The second determination unit is used to determine the average value of the sub-experience values ​​corresponding to the multiple time points to be analyzed as the experience value corresponding to the target time point, the experience value is used to characterize the transaction abnormality probability at the target time point, and the transaction abnormality probability is inversely correlated with the magnitude of the experience value;

[0028] The third determining unit is configured to determine that the target transaction object is an abnormal transaction object at the target time point based on the experience value corresponding to the target time point being less than a preset threshold.

[0029] In a possible implementation manner, the apparatus further includes a fourth determining unit, a clustering unit, and a fifth determining unit:

[0030] The fourth determining unit is used to determine a transaction topology graph corresponding to the target time point, the transaction topology graph comprising a plurality of transaction nodes and connection edges between the plurality of transaction nodes, the plurality of transaction nodes corresponding one-to-one to a plurality of transaction objects, the plurality of transaction objects including the target transaction object, and the connection edge between two transaction nodes is used to indicate that there is a transaction behavior between the transaction objects respectively corresponding to the two transaction nodes at the target time point;

[0031] The clustering unit is used to cluster the multiple transaction nodes according to the connection edges to obtain multiple clusters, and the transaction closeness between the multiple transaction nodes in the same cluster is greater than the transaction closeness between the multiple transaction nodes in different clusters;

[0032] The fifth determining unit is configured to determine the transaction objects respectively corresponding to the multiple transaction nodes included in the target cluster as abnormal transaction objects based on the transaction nodes having corresponding abnormal transaction objects among the multiple transaction nodes included in the target cluster.

[0033] In a possible implementation manner, the fifth determining unit is specifically configured to:

[0034] Based on the fact that the number of transaction nodes corresponding to abnormal transaction objects among the multiple transaction nodes included in the target cluster is greater than a preset number threshold, the transaction objects respectively corresponding to the multiple transaction nodes included in the target cluster are determined as abnormal transaction objects.

[0035] In a possible implementation manner, the fifth determining unit is specifically configured to:

[0036] Based on the fact that a proportion of transaction nodes corresponding to abnormal transaction objects among the multiple transaction nodes included in the target cluster is greater than a preset proportion threshold, the transaction objects respectively corresponding to the multiple transaction nodes included in the target cluster are determined as abnormal transaction objects.

[0037] In a possible implementation manner, the clustering unit is specifically used to:

[0038] According to the connection edges, the multiple transaction nodes are clustered N times to obtain the multiple cluster clusters. In the i-th clustering process, the target transaction node and the adjacent transaction nodes connected by the connection edges are clustered into the same cluster cluster, and the difference change information is determined. The difference change information is used to characterize the difference change in closeness brought about by clustering the target transaction node and the adjacent transaction nodes connected by the connection edges into the same cluster cluster. The closeness difference is the difference between the transaction closeness between the multiple transaction nodes of the same cluster cluster and the transaction closeness between the multiple transaction nodes of different cluster clusters. The target transaction node is any transaction node that does not have a corresponding cluster cluster during the i-th clustering process;

[0039] Based on the closeness difference change represented by the difference change information being an increase, performing the (i+1)th clustering process;

[0040] Based on the fact that the closeness difference represented by the difference change information has not increased, the target transaction node is changed and the difference change information is re-determined.

[0041] In a third aspect, an embodiment of the present application discloses a computer device, wherein the computer device includes a processor and a memory:

[0042] The memory is used to store a computer program and transmit the computer program to the processor;

[0043] The processor is used to execute the abnormal transaction object identification method according to any one of the first aspects according to the instructions in the computer program;

[0044] In a fourth aspect, an embodiment of the present application discloses a computer-readable storage medium, wherein the computer-readable storage medium is used to store a computer program, and the computer program is used to execute the abnormal transaction object identification method described in any one of the first aspects;

[0045] In a fifth aspect, an embodiment of the present application discloses a computer program product including a computer program, which, when executed on a computer device, enables the computer device to execute the abnormal transaction object identification method described in any one of the first aspects.

[0046] It can be seen from the above technical scheme that when determining an abnormal transaction object, the present application can first obtain the transaction amounts corresponding to the target transaction object at multiple consecutive time points, and then determine the sub-experience values ​​corresponding to the target time point at multiple time points to be analyzed except the target time point among the multiple time points. Based on the fact that the transaction amount corresponding to the target time point to be analyzed is less than the transaction amount corresponding to the target time point, the sub-experience value corresponding to the target time point to be analyzed is determined to be a first sub-experience value. Based on the fact that the transaction amount corresponding to the target time point to be analyzed is not less than the transaction amount corresponding to the target time point, the sub-experience value corresponding to the target time point to be analyzed is determined to be a second sub-experience value. The first sub-experience value is less than the second sub-experience value. The target time point to be analyzed is any one of the multiple time points to be analyzed. Then, the average value of the sub-experience values ​​corresponding to the multiple time points to be analyzed is determined as the experience value corresponding to the target time point. The experience value is used to characterize the probability of transaction abnormality at the target time point, and the transaction abnormality probability is inversely correlated with the size of the experience value. Based on the fact that the experience value corresponding to the target time point is less than the preset threshold, it means that the target transaction object has an excessively large transaction amount at the target time point compared to other time points among the multiple time points, so that the target transaction object can be determined to be an abnormal transaction object at the target time point. It can be seen that the present application can comprehensively identify the abnormal transaction objects corresponding to each time point by combining the transaction amounts at multiple time points, thereby improving transaction security. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0048] Figure 1 A flowchart of a method for identifying an abnormal transaction object provided in an embodiment of the present application;

[0049] Figure 2 A schematic diagram of a method for identifying an abnormal transaction object provided in an embodiment of the present application;

[0050] Figure 3 A schematic diagram of a method for identifying an abnormal transaction object provided in an embodiment of the present application;

[0051] Figure 4 A schematic diagram of a method for identifying an abnormal transaction object provided in an embodiment of the present application;

[0052] Figure 5 A schematic diagram of a method for identifying an abnormal transaction object provided in an embodiment of the present application; Figure 6 A structural block diagram of an abnormal transaction object identification device provided in an embodiment of the present application;

[0053] Figure 7 A structural diagram of a terminal provided in an embodiment of the present application;

[0054] Figure 8 A structural diagram of a server provided in an embodiment of the present application. DETAILED DESCRIPTION

[0055] The embodiments of the present application are described below in conjunction with the accompanying drawings.

[0056] It is understandable that the method can be applied to a computer device, which is a computer device capable of identifying abnormal transaction objects, such as a terminal device or a server. The method can be executed independently by a terminal device or a server, and can also be applied to a network scenario in which a terminal device and a server communicate, and is executed by the cooperation of a terminal device and a server. Among them, the terminal device can be a mobile phone, a tablet computer, a laptop computer, a desktop computer and other devices. The terminal device can also include a variety of virtual reality devices, such as augmented reality (AR) devices, such as AR glasses, AR screens and other devices, and virtual reality technology (VR) devices, such as head-mounted VR glasses and other devices. The server can be understood as an application server, or a Web server. In actual deployment, the server can be an independent server, a cluster server, or a cloud server.

[0057] See also Figure 1 , Figure 1 A flowchart of a method for identifying an abnormal transaction object provided in an embodiment of the present application, the method comprising:

[0058] S101: Obtain the transaction amounts corresponding to the target transaction object at multiple consecutive time points.

[0059] The target transaction object can be any transaction object, and the transaction amount is the amount of the transaction.

[0060] S102: Determine sub-experience values ​​of the target time point corresponding to each of a plurality of time points to be analyzed except the target time point among a plurality of time points.

[0061] Among them, based on the transaction amount corresponding to the target time point to be analyzed being less than the transaction amount corresponding to the target time point, the sub-experience value corresponding to the target time point to be analyzed is determined to be the first sub-experience value, based on the transaction amount corresponding to the target time point to be analyzed being not less than the transaction amount corresponding to the target time point, the sub-experience value corresponding to the target time point to be analyzed is determined to be the second sub-experience value, the first sub-experience value is less than the second sub-experience value, and the target time point to be analyzed is any one of the multiple time points to be analyzed. The sub-experience value can reflect the numerical relationship between the transaction amount corresponding to the time point and the transaction amount corresponding to the target time point.

[0062] S103: Determine the average value of the sub-experience values ​​corresponding to the multiple time points to be analyzed as the experience value corresponding to the target time point.

[0063] Among them, the experience value is used to characterize the probability of transaction abnormality at the target time point. The probability of transaction abnormality is inversely correlated with the size of the experience value. That is, the larger the experience value, the more time points at which the transaction amount corresponding to the target transaction object at the target time point is a smaller transaction amount among multiple time points, and the corresponding transaction amount is not less than the transaction amount. Therefore, the probability of being an abnormal transaction node is lower; conversely, the smaller the experience value, the more time points at which the transaction amount corresponding to the target transaction object at the target time point is an excessively large transaction amount among multiple time points, and the corresponding transaction amount is not less than the transaction amount. Therefore, the probability of being an abnormal transaction node is higher.

[0064] S104: Based on the experience value corresponding to the target time point being less than a preset threshold, determining that the target transaction object is an abnormal transaction object at the target time point.

[0065] It can be seen from the above technical scheme that when determining an abnormal transaction object, the present application can first obtain the transaction amounts corresponding to the target transaction object at multiple consecutive time points, and then determine the sub-experience values ​​corresponding to the target time point at multiple time points to be analyzed except the target time point among the multiple time points. Based on the fact that the transaction amount corresponding to the target time point to be analyzed is less than the transaction amount corresponding to the target time point, the sub-experience value corresponding to the target time point to be analyzed is determined to be a first sub-experience value. Based on the fact that the transaction amount corresponding to the target time point to be analyzed is not less than the transaction amount corresponding to the target time point, the sub-experience value corresponding to the target time point to be analyzed is determined to be a second sub-experience value. The first sub-experience value is less than the second sub-experience value. The target time point to be analyzed is any one of the multiple time points to be analyzed. Then, the average value of the sub-experience values ​​corresponding to the multiple time points to be analyzed is determined as the experience value corresponding to the target time point. The experience value is used to characterize the probability of transaction abnormality at the target time point, and the transaction abnormality probability is inversely correlated with the size of the experience value. Based on the fact that the experience value corresponding to the target time point is less than the preset threshold, it means that the target transaction object has an excessively large transaction amount at the target time point compared to other time points among the multiple time points, so that the target transaction object can be determined to be an abnormal transaction object at the target time point. It can be seen that the present application can comprehensively identify the abnormal transaction objects corresponding to each time point by combining the transaction amounts at multiple time points, thereby improving transaction security.

[0066] In a possible implementation, the computer device may further identify abnormal transaction nodes that cannot be determined by transaction amounts in combination with the transaction associations between the transaction nodes. The method further includes:

[0067] The computer device can first determine a transaction topology graph corresponding to the target time point, wherein the transaction topology graph includes multiple transaction nodes and connection edges between the multiple transaction nodes, wherein the multiple transaction nodes correspond one-to-one to multiple transaction objects, wherein the multiple transaction objects include the target transaction object, and the connection edge between two transaction nodes is used to characterize that there is a transaction behavior between the transaction objects corresponding to the two transaction nodes respectively at the target time point.

[0068] Then, the computer device may cluster the multiple transaction nodes according to the connection edges to obtain multiple clusters, wherein the transaction closeness between multiple transaction nodes in the same cluster is greater than the transaction closeness between multiple transaction nodes in different clusters.

[0069] Since the transaction closeness between the transaction objects respectively corresponding to the multiple transaction nodes in the same cluster is relatively high, when the multiple transaction nodes included in the target cluster have a transaction node corresponding to an abnormal transaction object, the probability that the transaction objects corresponding to the other transaction nodes included in the target cluster are abnormal transaction objects is also relatively high. Therefore, based on the transaction nodes corresponding to the abnormal transaction objects among the multiple transaction nodes included in the target cluster, the computer device can determine the transaction objects respectively corresponding to the multiple transaction nodes included in the target cluster as abnormal transaction objects, thereby successfully identifying the abnormal transaction objects that cannot be identified by the transaction amount, and improving the accuracy of abnormal transaction object identification. The target cluster is any one of the multiple clusters.

[0070] Specifically, when the transaction nodes corresponding to the abnormal transaction objects among the multiple transaction nodes included in the target cluster are determined as abnormal transaction objects, in a possible implementation method, the computer device can preset a preset quantity threshold. If the number of transaction nodes corresponding to the abnormal transaction objects among the multiple transaction nodes included in the target cluster is greater than the preset quantity threshold, it means that there are too many transaction nodes corresponding to the abnormal transaction objects in the target cluster. Therefore, the probability that the transaction objects corresponding to other transaction nodes are abnormal transaction objects is too large, so that the transaction objects corresponding to the multiple transaction nodes included in the target cluster can be determined as abnormal transaction objects.

[0071] In another possible implementation, when determining that the transaction objects corresponding to the multiple transaction nodes included in the target cluster are abnormal transaction objects based on the transaction nodes having corresponding abnormal transaction objects among the multiple transaction nodes included in the target cluster, the computer device may preset a preset proportion threshold value. If the proportion of transaction nodes corresponding to the abnormal transaction objects among the multiple transaction nodes included in the target cluster is greater than the preset proportion threshold value, it means that there are too many transaction nodes corresponding to the abnormal transaction objects in the target cluster. Therefore, the probability that the transaction objects corresponding to other transaction nodes are abnormal transaction objects is too large, and thus the transaction objects corresponding to the multiple transaction nodes included in the target cluster are determined to be abnormal transaction objects.

[0072] When clustering, the computer device may cluster the transaction nodes in a variety of ways. For example, in a possible implementation, the plurality of transaction nodes are clustered according to the connection edges to obtain a plurality of clusters, including:

[0073] According to the connection edges, the multiple transaction nodes are clustered N times to obtain the multiple cluster clusters. In the i-th clustering process, the target transaction node and the adjacent transaction nodes connected by the connection edges are clustered into the same cluster cluster, and the difference change information is determined. The difference change information is used to characterize the difference change in closeness brought about by clustering the target transaction node and the adjacent transaction nodes connected by the connection edges into the same cluster cluster. The closeness difference is the difference between the transaction closeness between the multiple transaction nodes of the same cluster cluster and the transaction closeness between the multiple transaction nodes of different cluster clusters. The target transaction node is any transaction node that does not have a corresponding cluster cluster during the i-th clustering process;

[0074] If the closeness difference represented by the difference change information is increased, it means that after the target transaction node and the adjacent transaction nodes connected by the connection edge are clustered into the same cluster, the transaction closeness between multiple transaction nodes in the same cluster exceeds the transaction closeness between multiple transaction nodes in different clusters to a greater extent, that is, the clustering method is an effective clustering method, so it can be determined that the i-th clustering process is completed and the i+1-th clustering process is executed;

[0075] Based on the fact that the closeness difference represented by the difference change information has not increased, it means that after the target transaction node and the adjacent transaction nodes connected by the connecting edges are clustered into the same cluster cluster, the degree to which the transaction closeness between multiple transaction nodes in the same cluster cluster exceeds the transaction closeness between multiple transaction nodes in different cluster clusters has not increased, that is, the clustering method is an invalid clustering method. At this time, the computer device can change the target transaction node and redetermine the difference change information, that is, change the clustering method in the i-th clustering, until the closeness difference represented by the difference change information increases, and then execute the i+1-th clustering.

[0076] For example, in one possible implementation, the computer devices may be clustered using the DMAS-DE algorithm as shown below:

[0077] First, let’s introduce the following concepts:

[0078] MAS algorithm: Multiple Anomalous Subgraphs (MAS) algorithm is used to detect anomalous subgraphs on each time slice.

[0079] Deviation-based detection method: Build a data model and predict the data. If the deviation between the actual data and the predicted data is greater than the set threshold, it is considered abnormal data.

[0080] 1) Multiple Abnormal Subgraph Detection Algorithm (MAS)

[0081] The algorithm process is as follows Figure 2 shown.

[0082] Among them, TSPSD(G,α): input static graph G and significance index a, output the most abnormal connected subgraph S of the static graph

[0083] Nei(ω): The set of two time slices adjacent to the continuous set of time slices ω. For example, if ω = {t, ..., 2t}, Nei(ω) = {t-1, 2t+1}.

[0084] p t (V(S α，m ))←1.0: Set S at time t α,m The p-value of each node in is 1.0, that is, p t (v) = 1.0, v∈V(S α，m ).

[0085] Input the threshold m of the number of normal nodes contained in the abnormal subgraph, the tree and the predefined significance index α, the optimal solution φ is obtained by using the idea of ​​dynamic programming α,m .

[0086] In multiple anomaly subgraph detection (MAS), first find the time slice t0 with the largest set of anomaly subgraphs among all time slices, and continue to detect anomaly subgraphs from time slice t0 to both sides of the time axis. When the time slice boundary is reached or the time slices on both sides cannot detect anomaly subgraphs, exit the loop. In order to detect multiple anomaly subgraphs on a time slice, the p-value of the detected anomaly subgraph node in the time slice is updated after each anomaly subgraph is detected. For example, in the MAS algorithm, p t (V(S α，m ))←1.0 refers to updating the abnormal subgraph S α，m The p-value of the node in the graph is 1.0. Finally, the algorithm outputs multiple abnormal subgraphs S ω .

[0087] 2) Dynamic Network Abnormal Subgraph Detection and Evolution Algorithm (DMAS-DE)

[0088] The algorithm is as Figure 3 shown.

[0089] The DMAS-DE algorithm provides a solution to problem (12). The input is a property graph G = (V, E, T, P) and a threshold K of the number of normal nodes contained in the abnormal evolution pattern φ of the dynamic network. In step 2, the MAS algorithm can detect the abnormal subgraph {Sj, ..., Sj} in each time slice. k}. In step 3, a set of subtrees of the dynamic graph G is constructed. In step 6, the most abnormal evolution mode of a single abnormal subgraph is obtained by using the idea of ​​dynamic programming, (i.e., φ α，m yes In step 9, from {φ α，m The algorithm outputs the abnormal evolution pattern φ of the dynamic network.

[0090] (III) Building a dynamic network for capital transactions

[0091] 1) Data acquisition and preprocessing

[0092] To obtain a fund transaction data set, at least the following fields must be included: fund transaction time, accounts of both parties to the fund transaction, transaction amount, etc. Sensitive data must be desensitized.

[0093] 2) Construction of static network for capital transactions

[0094] The desensitized account ID is used as a node in the transaction network, denoted as a i , whose attribute is the total amount of transactions involved Each transaction record can be regarded as an edge of the network, and its attribute is the number of transactions between the two parties. The static network construction operator for capital transactions is shown in Figure 4.

[0095] 3) Construction of dynamic network for capital transactions

[0096] Construct a dynamic network of capital transactions in the form of snapshots, and the network structure of the snapshot is based on the static network of capital transactions.

[0097] The dynamic network of capital transactions is composed of multiple static snapshot networks on continuous time series. In addition to the attributes in the static network, the snapshot network also contains time attributes and p-value attributes. Figure 5 shown.

[0098] The computer device can first determine the p-value (i.e., empirical value) of the transaction node v in the dynamic network (i.e., the transaction topology graph) G as follows:

[0099]

[0100] Where N represents the total number of transaction nodes contained in the dynamic network, f(v n ) indicates that node v is in the snapshot network G n The characteristic observation value under the condition f(v n)>f(v), δ(·)=1, otherwise, δ(·)=0. As can be seen from the above formula, to calculate the p-value of a node, the feature observation value of the node should be compared with the feature observation value of the node in other snapshot networks.

[0101] By setting a suitable threshold K for the number of normal nodes, and inputting the capital transaction dynamic network G with p-value attributes and the threshold K into the DMAS-DE algorithm, multiple risk capital transaction chains in different time segments can be obtained. After the clusters in each transaction topology graph are determined by the DMAS-DE algorithm, if the number of transaction nodes corresponding to abnormal transaction objects in the cluster is greater than K, the transaction objects corresponding to other transaction nodes in the cluster are also determined as abnormal transaction objects.

[0102] The specific introduction of p-value is as follows:

[0103] For a given dynamic graph G = (V, E, T, P), nonparametric scanning statistics can be used to detect the evolution of subgraphs. The evolution of its dynamic abnormal subgraph φ is {S p , S p+1 , ..., S q}, this article defines is the total number of nodes contained in the dynamic abnormal subgraph, given a significance level α, it is defined as follows:

[0104]

[0105] Among them, P t (v) represents the p-value corresponding to node v at time slice t, and V(φ) represents the set of nodes in φ, that is, If the input condition is true, δ(·) = 1, otherwise if the input condition is not true, δ(·) = 0. Formula (9) defines the number of nodes in the dynamic anomaly subgraph whose p-value is lower than the significance level α.

[0106] Define the number of normal nodes contained in the dynamic abnormal subgraph as That is, the total number of nodes contained in the dynamic abnormal subgraph The number of nodes in the dynamic abnormal subgraph whose p-value is lower than the significance level α The difference is The general form of the nonparametric sweep statistic in a dynamic graph N is defined as:

[0107]

[0108]

[0109] Where K represents the upper limit of the number of normal nodes contained in the set dynamic abnormal subgraph, and the function η should satisfy: 1) the function η increases with the parameter 2) The function η increases monotonically with the increase of parameter is decreasing and monotonically decreasing.

[0110] Based on the nonparametric scanning statistic η, the detection of dynamic abnormal subgraphs can be formalized as the following optimization problem:

[0111]

[0112]

[0113] Defines the set of all nodes for all time slices Right now Define a set A of significance indicators, including all outliers, that is, less than α max All p-values ​​and α max The value itself, that is This can limit the value of α, and problem (11) can be optimized as follows:

[0114]

[0115]

[0116] Problem (12) is a typical non-parametric graph scan (NPGS) problem. NPGS problems usually involve linear objective functions, so they are generally not suitable for solving using dynamic programming. We can use nonlinear objective functions to optimize problem (12) and re-express it as a series of sub-problems in a dynamic graph.

[0117] For a snapshot G t , define the set of mined abnormal subgraphs The number of normal nodes contained in is m t ,Right now Abnormal pattern of dynamic graph φ={S t |∑ t∈ω m t ≤M}, where M is the threshold of the total number of normal nodes contained in the abnormal subgraph in a snapshot.

[0118] Given the significance index α and the threshold m of the number of normal nodes contained in the abnormal subgraph, any abnormal connected subgraph S α，m Optimize through PCST problem (3),

[0119]

[0120] in, Represented as a snapshot G of the dynamic graph G t The set of all subtrees on V(T) is represented as the set of all nodes on a subtree T. Using the idea of ​​PCST to optimize the NPGS problem, the dynamic programming algorithm is applied to solve the subproblem, which can be expressed as:

[0121] Find the most abnormal evolution pattern φ of the subgraph in the dynamic network. The abnormal pattern itself has the property that for two consecutive time slices, φ needs to share at least one node. In this way, we can get the extremely abnormal subgraph set contained in the dynamic graph of continuous time. Right now in The abnormal mode φ can be further optimized:

[0122]

[0123] Where S is the abnormal subgraph obtained in problem (14), represents the number of abnormal nodes contained in S, Represents the number of normal nodes contained in S. Given a set M = {0, 1, ..., K} of the number of normal nodes contained in a graph, k∈K in the above formula. φ α，m This is the mined dynamic anomaly subgraph. Problem (14) is expressed as:

[0124] Based on the abnormal transaction object identification method provided in the above embodiment, the present application also provides an abnormal transaction object identification device, see Figure 5 , Figure 5 This is a structural block diagram of an abnormal transaction object identification device provided in an embodiment of the present application. The device 500 includes an acquisition unit 501, a first determination unit 502, a second determination unit 503 and a third determination unit 504:

[0125] The acquisition unit 501 is used to acquire the transaction amounts corresponding to the target transaction object at multiple consecutive time points;

[0126] The first determining unit 502 is used to determine the sub-experience values ​​of the target time point respectively corresponding to the multiple time points to be analyzed except the target time point among the multiple time points, and determine that the sub-experience value corresponding to the target time point to be analyzed is a first sub-experience value based on the transaction amount corresponding to the target time point to be analyzed is less than the transaction amount corresponding to the target time point, and determine that the sub-experience value corresponding to the target time point to be analyzed is a second sub-experience value based on the transaction amount corresponding to the target time point to be analyzed is not less than the transaction amount corresponding to the target time point, the first sub-experience value is less than the second sub-experience value, and the target time point to be analyzed is any one of the multiple time points to be analyzed;

[0127] The second determining unit 503 is used to determine the average value of the sub-experience values ​​corresponding to the multiple time points to be analyzed as the experience value corresponding to the target time point, the experience value is used to characterize the transaction abnormality probability at the target time point, and the transaction abnormality probability is inversely correlated with the magnitude of the experience value;

[0128] The third determining unit 504 is configured to determine that the target transaction object is an abnormal transaction object at the target time point based on the experience value corresponding to the target time point being less than a preset threshold.

[0129] In a possible implementation manner, the apparatus further includes a fourth determining unit, a clustering unit, and a fifth determining unit:

[0130] The fourth determining unit is used to determine a transaction topology graph corresponding to the target time point, the transaction topology graph comprising a plurality of transaction nodes and connection edges between the plurality of transaction nodes, the plurality of transaction nodes corresponding one-to-one to a plurality of transaction objects, the plurality of transaction objects including the target transaction object, and the connection edge between two transaction nodes is used to indicate that there is a transaction behavior between the transaction objects respectively corresponding to the two transaction nodes at the target time point;

[0131] The clustering unit is used to cluster the multiple transaction nodes according to the connection edges to obtain multiple clusters, and the transaction closeness between the multiple transaction nodes in the same cluster is greater than the transaction closeness between the multiple transaction nodes in different clusters;

[0132] The fifth determining unit is configured to determine the transaction objects respectively corresponding to the multiple transaction nodes included in the target cluster as abnormal transaction objects based on the transaction nodes having corresponding abnormal transaction objects among the multiple transaction nodes included in the target cluster.

[0133] In a possible implementation manner, the fifth determining unit is specifically configured to:

[0134] Based on the fact that the number of transaction nodes corresponding to abnormal transaction objects among the multiple transaction nodes included in the target cluster is greater than a preset number threshold, the transaction objects respectively corresponding to the multiple transaction nodes included in the target cluster are determined as abnormal transaction objects.

[0135] In a possible implementation manner, the fifth determining unit is specifically configured to:

[0136] Based on the fact that a proportion of transaction nodes corresponding to abnormal transaction objects among the multiple transaction nodes included in the target cluster is greater than a preset proportion threshold, the transaction objects respectively corresponding to the multiple transaction nodes included in the target cluster are determined as abnormal transaction objects.

[0137] In a possible implementation manner, the clustering unit is specifically used to:

[0138] According to the connection edges, the multiple transaction nodes are clustered N times to obtain the multiple cluster clusters. In the i-th clustering process, the target transaction node and the adjacent transaction nodes connected by the connection edges are clustered into the same cluster cluster, and the difference change information is determined. The difference change information is used to characterize the difference change in closeness brought about by clustering the target transaction node and the adjacent transaction nodes connected by the connection edges into the same cluster cluster. The closeness difference is the difference between the transaction closeness between the multiple transaction nodes of the same cluster cluster and the transaction closeness between the multiple transaction nodes of different cluster clusters. The target transaction node is any transaction node that does not have a corresponding cluster cluster during the i-th clustering process;

[0139] Based on the closeness difference change represented by the difference change information being an increase, performing the (i+1)th clustering process;

[0140] Based on the fact that the closeness difference represented by the difference change information has not increased, the target transaction node is changed and the difference change information is re-determined.

[0141] The present application also provides a computer device, see Figure 6 As shown, the computer device may be a terminal device, and a mobile phone is taken as an example:

[0142] Figure 6 FIG. 1 is a block diagram showing a partial structure of a mobile phone related to a terminal device provided in an embodiment of the present application. Figure 6 The mobile phone includes: a radio frequency (RF) circuit 710, a memory 720, an input unit 730, a display unit 740, a sensor 750, an audio circuit 760, a wireless fidelity (WiFi) module 770, a processor 780, and a power supply 790. Those skilled in the art will understand that Figure 6 The mobile phone structure shown in the figure does not constitute a limitation on the mobile phone, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0143] Combine the following Figure 6 A detailed introduction to the various components of the mobile phone:

[0144] The RF circuit 710 can be used for receiving and sending signals during the process of sending and receiving information or making calls. In particular, after receiving the downlink information of the base station, it is sent to the processor 780 for processing; in addition, the designed uplink data is sent to the base station. Usually, the RF circuit 710 includes but is not limited to an antenna, at least one amplifier, a transceiver, a coupler, a low noise amplifier (Low Noise Amplifier, referred to as LNA), a duplexer, etc. In addition, the RF circuit 710 can also communicate with the network and other devices through wireless communication. The above-mentioned wireless communication can use any communication standard or protocol, including but not limited to the Global System of Mobile communication (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), email, Short Messaging Service (SMS), etc.

[0145] The memory 720 can be used to store software programs and modules. The processor 780 executes various functional applications and data processing of the mobile phone by running the software programs and modules stored in the memory 720. The memory 720 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory 720 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0146] The input unit 730 can be used to receive input digital or character information, and to generate key signal input related to the user settings and function control of the mobile phone. Specifically, the input unit 730 may include a touch panel 731 and other input devices 732. The touch panel 731, also known as a touch screen, can collect the user's touch operation on or near it (such as the user's operation on the touch panel 731 or near the touch panel 731 using any suitable object or accessory such as a finger, stylus, etc.), and drive the corresponding connection device according to a pre-set program. Optionally, the touch panel 731 may include two parts: a touch detection device and a touch controller. Among them, the touch detection device detects the user's touch orientation, detects the signal brought by the touch operation, and transmits the signal to the touch controller; the touch controller receives the touch information from the touch detection device, converts it into contact coordinates, and then sends it to the processor 780, and can receive and execute commands sent by the processor 780. In addition, the touch panel 731 can be implemented in various types such as resistive, capacitive, infrared, and surface acoustic waves. In addition to the touch panel 731, the input unit 730 may further include other input devices 732. Specifically, the other input devices 732 may include but are not limited to one or more of a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, a joystick, and the like.

[0147] The display unit 740 can be used to display information input by the user or information provided to the user and various menus of the mobile phone. The display unit 740 may include a display panel 741. Optionally, the display panel 741 may be configured in the form of a liquid crystal display (Liquid Crystal Display, LCD), an organic light-emitting diode (Organic Light-Emitting Diode, OLED), etc. Further, the touch panel 731 may cover the display panel 741. When the touch panel 731 detects a touch operation on or near it, it is transmitted to the processor 780 to determine the type of touch event. Subsequently, the processor 780 provides a corresponding visual output on the display panel 741 according to the type of touch event. Although in Figure 6 In the embodiment, the touch panel 731 and the display panel 741 are used as two independent components to realize the input and output functions of the mobile phone, but in some embodiments, the touch panel 731 and the display panel 741 can be integrated to realize the input and output functions of the mobile phone.

[0148] The mobile phone may also include at least one sensor 750, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor, wherein the ambient light sensor may adjust the brightness of the display panel 741 according to the brightness of the ambient light, and the proximity sensor may turn off the display panel 741 and / or the backlight when the mobile phone is moved to the ear. As a type of motion sensor, the accelerometer sensor can detect the magnitude of acceleration in all directions (generally three axes), and can detect the magnitude and direction of gravity when stationary. It can be used for applications that identify the posture of the mobile phone (such as horizontal and vertical screen switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc.; as for other sensors that can be configured in the mobile phone, such as gyroscopes, barometers, hygrometers, thermometers, infrared sensors, etc., they will not be repeated here.

[0149] The audio circuit 760, the speaker 761, and the microphone 762 can provide an audio interface between the user and the mobile phone. The audio circuit 760 can transmit the received audio data to the speaker 761 after converting the received audio data into an electrical signal, which is converted into a sound signal for output; on the other hand, the microphone 762 converts the collected sound signal into an electrical signal, which is received by the audio circuit 760 and converted into audio data, and then the audio data is output to the processor 780 for processing, and then sent to another mobile phone through the RF circuit 710, or the audio data is output to the memory 720 for further processing.

[0150] WiFi is a short-range wireless transmission technology. The mobile phone can help users send and receive emails, browse web pages and access streaming media through the WiFi module 770. It provides users with wireless broadband Internet access. Figure 6 A WiFi module 770 is shown, but it is understandable that it is not an essential component of the mobile phone and can be omitted as needed without changing the essence of the invention.

[0151] The processor 780 is the control center of the mobile phone. It uses various interfaces and lines to connect various parts of the entire mobile phone. By running or executing software programs and / or modules stored in the memory 720, and calling data stored in the memory 720, it executes various functions of the mobile phone and processes data, thereby performing overall detection of the mobile phone. Optionally, the processor 780 may include one or more processing units; preferably, the processor 780 may integrate an application processor and a modem processor, wherein the application processor mainly processes the operating system, user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the above-mentioned modem processor may not be integrated into the processor 780.

[0152] The mobile phone also includes a power supply 790 (such as a battery) for supplying power to various components. Preferably, the power supply can be logically connected to the processor 780 through a power management system, so that the power management system can manage charging, discharging, power consumption and other functions.

[0153] Although not shown, the mobile phone may also include a camera, a Bluetooth module, etc., which will not be described in detail here.

[0154] In this embodiment, the processor 780 included in the terminal device also has the following functions:

[0155] Obtain the transaction amounts corresponding to the target transaction object at multiple consecutive time points;

[0156] Determine sub-experience values ​​of the target time point respectively corresponding to a plurality of time points to be analyzed except the target time point among the plurality of time points; determine the sub-experience value corresponding to the target time point to be analyzed to be a first sub-experience value based on the transaction amount corresponding to the target time point to be analyzed being less than the transaction amount corresponding to the target time point; determine the sub-experience value corresponding to the target time point to be analyzed to be a second sub-experience value based on the transaction amount corresponding to the target time point to be analyzed being not less than the transaction amount corresponding to the target time point; the first sub-experience value is less than the second sub-experience value; and the target time point to be analyzed is any one of the plurality of time points to be analyzed;

[0157] Determine the average value of the sub-experience values ​​corresponding to the multiple time points to be analyzed as the experience value corresponding to the target time point, the experience value is used to characterize the probability of abnormal transaction at the target time point, and the abnormal transaction probability is inversely correlated with the magnitude of the experience value;

[0158] Based on the fact that the experience value corresponding to the target time point is less than a preset threshold, it is determined that the target transaction object is an abnormal transaction object at the target time point.

[0159] The present application also provides a server. Figure 7 As shown, Figure 7The structural diagram of the server 800 provided in the embodiment of the present application, the server 800 may have relatively large differences due to different configurations or performances, and may include one or more central processing units (CPU) 822 (for example, one or more processors) and a memory 832, and one or more storage media 830 (for example, one or more mass storage devices) storing application programs 842 or data 844. Among them, the memory 832 and the storage medium 830 can be temporary storage or permanent storage. The program stored in the storage medium 830 may include one or more modules (not shown in the figure), and each module may include a series of instruction operations on the server. Furthermore, the central processing unit 822 can be configured to communicate with the storage medium 830 and execute a series of instruction operations in the storage medium 830 on the server 800.

[0160] The server 800 may also include one or more power supplies 826, one or more wired or wireless network interfaces 850, one or more input and output interfaces 858, and / or one or more operating systems 841, such as Windows Server 2000. TM , Mac OS X TM , Unix TM ,Linux TM , FreeBSD TM etc.

[0161] The steps performed by the server in the above embodiment can be based on Figure 7 The server structure shown.

[0162] The embodiment of the present application also provides a computer-readable storage medium for storing a computer program, wherein the computer program is used to execute any one of the implementation methods of the abnormal transaction object identification methods described in the aforementioned embodiments.

[0163] An embodiment of the present application further provides a computer program product including a computer program, which, when executed on a computer device, enables the computer device to execute the abnormal transaction object identification method described in any one of the above embodiments.

[0164] It is understandable that in the specific implementation of this application, related data such as user information (such as transaction amount) is involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0165] A person of ordinary skill in the art can understand that all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the above-mentioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the above-mentioned storage medium can be at least one of the following media: read-only memory (English: read-only memory, abbreviated: ROM), RAM, magnetic disk or optical disk, etc. Various media that can store program codes.

[0166] It should be noted that each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiments. The device and system embodiments described above are merely schematic, in which the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work.

[0167] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present application should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for identifying abnormal transaction objects, characterized in that: The method comprises: Obtain the transaction amounts corresponding to the target transaction object at multiple consecutive time points; Determine sub-experience values ​​of the target time point respectively corresponding to a plurality of time points to be analyzed except the target time point among the plurality of time points; determine the sub-experience value corresponding to the target time point to be analyzed to be a first sub-experience value based on the transaction amount corresponding to the target time point to be analyzed being less than the transaction amount corresponding to the target time point; determine the sub-experience value corresponding to the target time point to be analyzed to be a second sub-experience value based on the transaction amount corresponding to the target time point to be analyzed being not less than the transaction amount corresponding to the target time point; the first sub-experience value is less than the second sub-experience value; and the target time point to be analyzed is any one of the plurality of time points to be analyzed; Determine the average value of the sub-experience values ​​corresponding to the multiple time points to be analyzed as the experience value corresponding to the target time point, the experience value is used to characterize the probability of abnormal transaction at the target time point, and the abnormal transaction probability is inversely correlated with the magnitude of the experience value; Based on the fact that the experience value corresponding to the target time point is less than a preset threshold, it is determined that the target transaction object is an abnormal transaction object at the target time point.

2. The method according to claim 1, characterized in that The method further comprises: Determine a transaction topology graph corresponding to the target time point, the transaction topology graph comprising a plurality of transaction nodes and connection edges between the plurality of transaction nodes, the plurality of transaction nodes corresponding one-to-one to a plurality of transaction objects, the plurality of transaction objects including the target transaction object, and the connection edge between two transaction nodes is used to represent that there is a transaction behavior between the transaction objects respectively corresponding to the two transaction nodes at the target time point; Clustering the multiple transaction nodes according to the connection edges to obtain multiple clusters, wherein the transaction intimacy between the multiple transaction nodes in the same cluster is greater than the transaction intimacy between the multiple transaction nodes in different clusters; Based on the transaction nodes having corresponding abnormal transaction objects among the multiple transaction nodes included in the target cluster, the transaction objects respectively corresponding to the multiple transaction nodes included in the target cluster are determined as abnormal transaction objects.

3. The method according to claim 2, characterized in that The step of determining the transaction objects respectively corresponding to the multiple transaction nodes included in the target cluster as abnormal transaction objects based on the transaction nodes corresponding to the abnormal transaction objects among the multiple transaction nodes included in the target cluster, includes: Based on the fact that the number of transaction nodes corresponding to abnormal transaction objects among the multiple transaction nodes included in the target cluster is greater than a preset number threshold, the transaction objects respectively corresponding to the multiple transaction nodes included in the target cluster are determined as abnormal transaction objects.

4. The method according to claim 2, characterized in that: Based on a transaction node having a corresponding abnormal transaction object among a plurality of transaction nodes included in the target cluster, determining the transaction objects respectively corresponding to the plurality of transaction nodes included in the target cluster as abnormal transaction objects, including: Based on the fact that a proportion of transaction nodes corresponding to abnormal transaction objects among the multiple transaction nodes included in the target cluster is greater than a preset proportion threshold, the transaction objects respectively corresponding to the multiple transaction nodes included in the target cluster are determined as abnormal transaction objects.

5. The method according to claim 2, characterized in that: The clustering of the multiple transaction nodes according to the connection edges to obtain multiple clusters includes: According to the connection edges, the multiple transaction nodes are clustered N times to obtain the multiple clusters. In the i-th clustering process, the target transaction node and the adjacent transaction nodes connected by the connection edges are clustered into the same cluster, and difference change information is determined. The difference change information is used to characterize the difference change in closeness brought about by clustering the target transaction node and the adjacent transaction nodes connected by the connection edges into the same cluster. The closeness difference is the difference between the transaction closeness between the multiple transaction nodes of the same cluster and the transaction closeness between the multiple transaction nodes of different clusters. The target transaction node is any transaction node that does not have a corresponding cluster in the i-th clustering process; Based on the closeness difference change represented by the difference change information being an increase, performing the (i+1)th clustering process; Based on the fact that the closeness difference represented by the difference change information has not increased, the target transaction node is changed and the difference change information is re-determined.

6. A device for identifying abnormal transaction objects, characterized in that: The device comprises an acquisition unit, a first determination unit, a second determination unit and a third determination unit: The acquisition unit is used to acquire the transaction amounts corresponding to the target transaction object at multiple consecutive time points; The first determining unit is used to determine the sub-experience values ​​of the target time point respectively corresponding to the multiple time points to be analyzed except the target time point among the multiple time points, and based on the transaction amount corresponding to the target time point to be analyzed being less than the transaction amount corresponding to the target time point, determine the sub-experience value corresponding to the target time point to be analyzed to be a first sub-experience value, based on the transaction amount corresponding to the target time point to be analyzed being not less than the transaction amount corresponding to the target time point, determine the sub-experience value corresponding to the target time point to be analyzed to be a second sub-experience value, the first sub-experience value is less than the second sub-experience value, and the target time point to be analyzed is any one of the multiple time points to be analyzed; The second determination unit is used to determine the average value of the sub-experience values ​​corresponding to the multiple time points to be analyzed as the experience value corresponding to the target time point, the experience value is used to characterize the transaction abnormality probability at the target time point, and the transaction abnormality probability is inversely correlated with the magnitude of the experience value; The third determining unit is configured to determine that the target transaction object is an abnormal transaction object at the target time point based on the experience value corresponding to the target time point being less than a preset threshold.

7. The device according to claim 6, characterized in that The device further includes a fourth determining unit, a clustering unit, and a fifth determining unit: The fourth determining unit is used to determine a transaction topology graph corresponding to the target time point, the transaction topology graph comprising a plurality of transaction nodes and connection edges between the plurality of transaction nodes, the plurality of transaction nodes corresponding one-to-one to a plurality of transaction objects, the plurality of transaction objects including the target transaction object, and the connection edge between two transaction nodes is used to indicate that there is a transaction behavior between the transaction objects respectively corresponding to the two transaction nodes at the target time point; The clustering unit is used to cluster the multiple transaction nodes according to the connection edges to obtain multiple clusters, and the transaction closeness between the multiple transaction nodes in the same cluster is greater than the transaction closeness between the multiple transaction nodes in different clusters; The fifth determining unit is configured to determine the transaction objects respectively corresponding to the multiple transaction nodes included in the target cluster as abnormal transaction objects based on the transaction nodes having corresponding abnormal transaction objects among the multiple transaction nodes included in the target cluster.

8. The device according to claim 7, characterized in that The fifth determining unit is specifically configured to: Based on the fact that the number of transaction nodes corresponding to abnormal transaction objects among the multiple transaction nodes included in the target cluster is greater than a preset number threshold, the transaction objects respectively corresponding to the multiple transaction nodes included in the target cluster are determined as abnormal transaction objects.

9. The device according to claim 7, characterized in that The fifth determining unit is specifically configured to: Based on the fact that a proportion of transaction nodes corresponding to abnormal transaction objects among the multiple transaction nodes included in the target cluster is greater than a preset proportion threshold, the transaction objects respectively corresponding to the multiple transaction nodes included in the target cluster are determined as abnormal transaction objects.

10. The method according to claim 7, characterized in that The clustering unit is specifically used for: According to the connection edges, the multiple transaction nodes are clustered N times to obtain the multiple clusters. In the i-th clustering process, the target transaction node and the adjacent transaction nodes connected by the connection edges are clustered into the same cluster, and difference change information is determined. The difference change information is used to characterize the difference change in closeness brought about by clustering the target transaction node and the adjacent transaction nodes connected by the connection edges into the same cluster. The closeness difference is the difference between the transaction closeness between the multiple transaction nodes of the same cluster and the transaction closeness between the multiple transaction nodes of different clusters. The target transaction node is any transaction node that does not have a corresponding cluster in the i-th clustering process; Based on the closeness difference change represented by the difference change information being an increase, performing the (i+1)th clustering process; Based on the fact that the closeness difference represented by the difference change information has not increased, the target transaction node is changed and the difference change information is re-determined.

11. A computer device, characterized in that: The computer device comprises a processor and a memory: The memory is used to store a computer program and transmit the computer program to the processor; The processor is used to execute the abnormal transaction object identification method according to any one of claims 1 to 5 according to the instructions in the computer program.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store a computer program, and the computer program is used to execute the abnormal transaction object identification method according to any one of claims 1 to 5.

13. A computer program product comprising a computer program, which, when executed on a computer device, enables the computer device to execute the abnormal transaction object identification method according to any one of claims 1 to 5.

Images