Risk transaction identification method and device, electronic equipment, medium and program product

Abstract

The invention provides a risk transaction identification method and device, electronic equipment, a medium and a program product, which can be used in the field of data processing. The method comprises the following steps: acquiring target transaction information between a user side and a merchant side, and acquiring first basic information of the merchant side and second basic information of the user side; risk factor characteristics are obtained according to the target transaction information, team characteristics corresponding to a target group are determined according to the risk factor characteristics, and the target group comprises at least one of a user side and a merchant side; determining a first reasoning feature of the merchant according to the first basic information, and determining a second reasoning feature of the user according to the second basic information; and according to the risk element features, the team features, the first reasoning features and the second reasoning features, determining transaction risk parameters between the user side and the merchant side, and according to the transaction risk parameters, determining whether there is a transaction risk between the user side and the merchant side. According to the invention, the transaction risk judgment accuracy is improved.

Description

Technical Field

[0001] The present application relates to the field of data processing, and in particular to a risky transaction identification method, device, electronic device, medium and program product. Background Art

[0002] With the development of network technology, more and more users are conducting transactions online. There are transaction risks in online transactions, such as malicious order brushing and arbitrage transactions.

[0003] In the exemplary technology, risk factors such as transaction time and transaction amount are obtained from the transaction information of the two parties to the transaction, and the corresponding historical portraits are matched by the risk factors to determine whether the transaction is risky based on the historical portraits.

[0004] However, the above-mentioned features for determining whether a transaction has risks are too simple and the accuracy of judging transaction risks is low. Summary of the invention

[0005] The present application provides a risky transaction identification method, device, electronic device, medium and program product, which solves the problem of low accuracy in judging transaction risks.

[0006] In a first aspect, the present application provides a method for identifying risky transactions, the method comprising:

[0007] Acquire target transaction information between the user party and the merchant party, and acquire first basic information of the merchant party and second basic information of the user party;

[0008] Acquire risk factor characteristics according to the target transaction information, and determine team characteristics of a target group according to the risk factor characteristics, wherein the target group includes at least one of the user party and the merchant party;

[0009] Determine a first inference feature of the merchant side according to the first basic information, and a second inference feature of the user side according to the second basic information;

[0010] The transaction risk parameters between the user and the merchant are determined based on the risk factor characteristics, the team characteristics, the first reasoning characteristics, and the second reasoning characteristics, and whether there is a transaction risk between the user and the merchant is determined based on the transaction risk parameters.

[0011] In some embodiments, determining the team characteristics of the target group according to the risk factor characteristics includes:

[0012] Among the risk factor characteristics, determining the first characteristic of the user side and the second characteristic of the merchant side;

[0013] Determine a user feature vector of the user according to the first feature, and determine a merchant feature vector of the merchant according to the second feature;

[0014] Determine a first feature vector corresponding to a target similarity between the merchant feature vector and the user feature vector;

[0015] A second feature vector is constructed according to the user feature vector, the merchant feature vector and the first feature vector, and a clustering feature is determined according to the second feature vector to serve as a team feature corresponding to the target group.

[0016] In some embodiments, determining a first feature vector corresponding to a target similarity between the merchant feature vector and the user feature vector includes:

[0017] Determining a target similarity between the merchant feature vector and the user feature vector;

[0018] In response to the target similarity being less than a preset similarity, a first feature vector corresponding to the target similarity is constructed.

[0019] In some embodiments, determining the clustering feature according to the second feature vector includes:

[0020] The second feature vector is input into a clustering model to obtain a clustering feature output by the clustering model.

[0021] In some embodiments, determining the first inference feature of the merchant according to the first basic information, and determining the second inference feature of the user according to the second basic information, includes:

[0022] Acquire a first identifier of the merchant according to the first basic information, and acquire a second identifier of the user according to the second basic information;

[0023] Acquire a first knowledge fragment associated with the first identifier and a second knowledge fragment associated with the second identifier;

[0024] A first reasoning feature of the merchant side is determined based on the first knowledge fragment, and a second reasoning feature of the user side is determined based on the second knowledge fragment.

[0025] In some embodiments, determining the first reasoning feature of the merchant side according to the first knowledge fragment, and determining the second reasoning feature of the user side according to the second knowledge fragment, includes:

[0026] Among the risk factor characteristics, determining the first characteristic of the user side and the second characteristic of the merchant side;

[0027] Obtaining a risk scenario corresponding to the target transaction information;

[0028] The first reasoning feature and the second reasoning feature are determined according to the first feature, the second feature, the risk scenario, the team feature, the first knowledge fragment, and the second knowledge fragment.

[0029] In some embodiments, determining the transaction risk parameter between the user and the merchant based on the risk factor feature, the team feature, the first reasoning feature, and the second reasoning feature includes:

[0030] Constructing a first combined feature according to the risk factor feature, the team feature, the first reasoning feature, and the second reasoning feature;

[0031] The first combined feature is input into a recognition model to obtain a transaction risk parameter output by the recognition model.

[0032] In some embodiments, constructing a first combined feature according to the risk factor feature, the team feature, the first reasoning feature, and the second reasoning feature includes:

[0033] Determining an importance parameter of each third feature, each of the third features including the risk factor feature, the team feature, the first reasoning feature, and the second reasoning feature;

[0034] Determining a fourth feature from each of the third features according to the importance parameter, wherein the fourth feature is a third feature whose importance parameter is greater than a preset threshold;

[0035] The fourth features are combined to obtain the first combined feature.

[0036] In some embodiments, before inputting the first combined feature into the recognition model to obtain the transaction risk parameter output by the recognition model, the method further includes:

[0037] Acquire multiple training samples, the training samples include a second combination feature and a risk label, the second combination feature is constructed based on the risk factor feature, the team feature, and the reasoning feature obtained from the historical transaction information, and the risk label is used to indicate whether the historical transaction information has a transaction risk;

[0038] The preset model is trained according to each of the training samples to obtain the recognition model.

[0039] In a second aspect, the present application provides a risky transaction identification device, comprising:

[0040] A first acquisition module is used to acquire target transaction information between a user party and a merchant party, and acquire first basic information of the merchant party and second basic information of the user party;

[0041] A second acquisition module, configured to acquire risk factor characteristics according to the target transaction information, and determine team characteristics of a target group according to the risk factor characteristics, wherein the target group includes at least one of the user party and the merchant party;

[0042] A first determining module, configured to determine a first inference feature of the merchant side according to the first basic information, and a second inference feature of the user side according to the second basic information;

[0043] The second determination module is used to determine the transaction risk parameters between the user and the merchant according to the risk factor characteristics, the team characteristics, the first reasoning characteristics and the second reasoning characteristics, and determine whether there is a transaction risk between the user and the merchant according to the transaction risk parameters.

[0044] In a third aspect, the present application provides an electronic device, comprising: a processor, and a memory and a communication interface communicatively connected to the processor;

[0045] The communication interface is used to communicate with other communication devices;

[0046] The memory is used to store computer-executable instructions;

[0047] The processor is used to execute the computer-executable instructions stored in the memory to implement the risk transaction identification method provided in the first aspect.

[0048] In a fourth aspect, the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, the risk transaction identification method provided in the first aspect is implemented.

[0049] In a fifth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the risk transaction identification method provided in the first aspect.

[0050] The risk transaction identification method, device, electronic device, medium and program product provided in the present application obtain transaction information and basic information between the user and the merchant, obtain risk factor characteristics based on the transaction information, and determine the team characteristics of the target group based on the risk factor characteristics, determine the first reasoning characteristics of the user and the second reasoning characteristics of the merchant through the basic information, and determine the transaction risk parameters through the risk factor characteristics, team characteristics, first reasoning characteristics and second reasoning characteristics, so as to determine whether there is a transaction risk between the two parties to the transaction based on the transaction risk parameters. In the present application, it is determined whether there is a transaction risk between the two parties to the transaction through multiple characteristics such as risk factor characteristics, team characteristics and reasoning characteristics, that is, it is analyzed from multiple dimensions whether there is a transaction risk between the two parties to the transaction, which improves the accuracy of the judgment of transaction risk. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0052] Figure 1 A schematic diagram of the scenarios involved in the risky transaction identification method of this application;

[0053] Figure 2 The following is a schematic diagram of the steps of the risk transaction identification method provided in the embodiment of the present application. Figure 1 ;

[0054] Figure 3 The following is a schematic diagram of the steps of the risk transaction identification method provided in the embodiment of the present application. Figure 2 ;

[0055] Figure 4 The following is a schematic diagram of the steps of the risk transaction identification method provided in the embodiment of the present application. Figure 3 ;

[0056] Figure 5 The following is a schematic diagram of the steps of the risk transaction identification method provided in the embodiment of the present application. Figure 4 ;

[0057] Figure 6 The following is a schematic diagram of the steps of the risk transaction identification method provided in the embodiment of the present application. Figure 5 ;

[0058] Figure 7 A schematic diagram of a program module of a risky transaction identification device provided in an embodiment of the present application;

[0059] Figure 8 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application.

[0060] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application. In addition, although the disclosure in the present application is introduced according to one or several exemplary examples, it should be understood that each aspect of these disclosures can also constitute a complete implementation method separately.

[0062] It should be noted that the brief description of terms in this application is only for the convenience of understanding the embodiments described below, and is not intended to limit the embodiments of this application. Unless otherwise specified, these terms should be understood according to their common and usual meanings.

[0063] In addition, the terms "include" and "have" and any variations thereof are intended to cover but not exclude inclusion, for example, a product or device comprising a list of components is not necessarily limited to those components expressly listed but may include other components not expressly listed or inherent to such products or devices.

[0064] The term "module" used in the embodiments of the present application refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic, or a combination of hardware and / or software code that can perform the functions associated with the element.

[0065] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0066] With the development of network technology, more and more users are conducting transactions online. There are transaction risks in online transactions, such as malicious order brushing and arbitrage transactions.

[0067] In the exemplary technology, risk factors such as transaction time and transaction amount are obtained from the transaction information of the two parties to the transaction, and the corresponding historical portraits are matched by the risk factors to determine whether the transaction is risky based on the historical portraits.

[0068] However, the above-mentioned features for determining whether a transaction has risks are too simple and the accuracy of judging transaction risks is low.

[0069] Based on the above technical problems, the source of the technical concept of this application is obtained, and the specific source of the technical concept is as follows:

[0070] Based on real-time user marketing data, use decision engines or model algorithms to identify risks and deal with or send them to the organizers of marketing activities, so as to confirm marketing risks from a business perspective and take risk control measures as soon as possible. The business scenario of marketing risk identification is complex, and it is necessary to comprehensively evaluate the harm and impact of marketing behaviors based on many characteristic data such as activity type, risk control strategy, whether it is a team crime, and historical violations.

[0071] The transaction business itself has a "two-way" feature, such as user-merchant, transfer initiator-recipient. Mining deep-level feature information from them respectively and evaluating their "consistency" through the degree of similarity between the two will help judge transaction risks.

[0072] The local portrait knowledge base contains knowledge from multiple sources, such as basic user information, historical transactions, violation history, merchant portraits, and intelligence knowledge. The traditional approach is to convert the portrait features into risk features, associate them with the current traffic, and input them into the classifier together. This approach relies on the experience of risk control technicians, and has problems such as large workload of feature engineering, difficulty in identifying the importance of knowledge, and low upper limit of feature dimensions. Large language model (LLM) technology is good at information extraction, summarization, and reasoning, and has received more and more attention and application. However, general large models cannot meet actual business needs, mainly due to knowledge illusion, lack of professional knowledge, and data security issues. Retrieval-Augmented Generation (RAG) technology can dynamically retrieve information from external knowledge sources and use the retrieved data as a reference for answers, which greatly improves the accuracy and relevance of answers and effectively solves problems in large language models.

[0073] Based on this, this application designs a solution that combines the characteristics of risk factors, team characteristics, and reasoning characteristics of portraits to judge transaction risks, so as to achieve more accurate and explainable risk identification and prediction.

[0074] Reference Figure 1 , Figure 1Schematic diagram of the application scenario of the risk transaction identification method of the present application. The risk transaction identification device 100 obtains the target transaction information and basic information between the user party and the merchant party, obtains the risk factor characteristics based on the target transaction information, determines the team characteristics of the target group through the risk factor characteristics, and the target group includes at least one of the user party and the merchant party. Based on the basic information, the first reasoning characteristics of the user party and the second reasoning characteristics of the merchant party are determined, thereby determining the transaction risk parameters between the two transaction parties based on the risk factor characteristics, the team characteristics, the first reasoning characteristics, and the second reasoning characteristics, thereby determining whether there is a transaction risk between the two transaction parties based on the transaction risk parameters. When the risk transaction identification device 100 determines that there is a transaction risk between the two transaction parties, it outputs a prompt message, and the prompt message is used to indicate that there is a risk in the transaction.

[0075] The following Figure 1 The technical solutions shown in the present application are described in detail in conjunction with specific embodiments. It should be noted that the following embodiments can exist independently or in combination with each other, and the same or similar contents will not be described repeatedly in different embodiments.

[0076] Reference Figure 2 , Figure 2 The process diagram of the risk transaction identification method provided in the embodiment of the present application is as follows: Figure 1 , risky transaction identification methods include:

[0077] Step S201, obtaining target transaction information between the user party and the merchant party, and obtaining first basic information of the merchant party and second basic information of the user party.

[0078] In this embodiment, the execution subject is a risky transaction identification device. For the convenience of description, the term "device" is used below to refer to the risky transaction identification device. The device can be a server or a terminal device with risky transaction identification.

[0079] The device obtains transaction information between the user and the merchant, which is defined as target transaction information. The transaction parties in the transaction information include the user who sells the goods and the user who buys the goods. The user who sells the goods is defined as the merchant, and the user who buys the goods is defined as the user.

[0080] After obtaining the target transaction information, the device obtains the first basic information of the merchant and the second basic information of the user. The first basic information includes the merchant's ID, account number, identification of the device used, etc.; the second basic information includes the user's ID, account number, identification of the device used, etc.

[0081] Step S202, acquiring risk factor characteristics according to target transaction information, and determining team characteristics of a target group according to the risk factor characteristics, wherein the target group includes at least one of a user side and a merchant side.

[0082] After obtaining the target transaction information, the risk factor characteristics are obtained from the target transaction information. For example, the risk factor characteristics include but are not limited to user ID, merchant ID, transaction time, transaction amount, discount amount, merchant name, merchant number, merchant type, device type, and device risk. The risk factor characteristics are shown in the following table:

[0083]

[0084] After obtaining the risk factor characteristics, the team characteristics of the target group are determined based on the risk factor characteristics. The target group includes at least one of the user side and the merchant side, that is, the target group is the group where the user side is located, the group where the merchant side is located, or the joint group of the merchant side and the user side. It can be understood that the device determines the team characteristics of the group where the user side is located, the team characteristics of the group where the merchant side is located, and / or the characteristics of the user-merchant side joint group based on the risk factor characteristics. Exemplarily, after obtaining the risk factor characteristics, the device separates the risk factor characteristics into user characteristics and merchant characteristics. User characteristics include user account type, payment method, bank card type, payment amount, discount amount, device information, etc.; merchant characteristics include merchant name, location, type, scale, etc. After obtaining the merchant characteristics, the device determines the characteristics matched by the merchant characteristics as team characteristics, determines the characteristics matched by the user characteristics as team characteristics, or uses the characteristics matched by the user characteristics and the commodity characteristics as team characteristics. For example, team characteristics are characteristics of the group to which the merchant belongs. Based on the characteristics of each merchant, the device can determine that the merchant belongs to an individual user. An individual user has multiple characteristics, and the multiple characteristics of the individual user are used as group characteristics. For another example, team characteristics are characteristics of the group to which the user belongs. Based on the characteristics of each user, the device can determine that the user belongs to group A. The device pre-stores various characteristics of group A, and the various characteristics of group A are used as group characteristics. In addition, team characteristics are characteristics of a group including users and merchants. Based on user characteristics and merchant characteristics, the device determines that the user and the merchant belong to a joint group of upstream supplier A and downstream application provider B, and uses the pre-stored characteristics of the joint group as group characteristics.

[0085] Step S203, determining a first inference feature of the merchant side according to the first basic information, and a second inference feature of the user side according to the second basic information.

[0086] In order to accurately determine whether there is a transaction risk between the user and the merchant, the device will further determine the reasoning characteristics of the two transaction parties. The reasoning characteristics of the merchant are defined as the first reasoning characteristics, and the reasoning characteristics of the user are defined as the second reasoning characteristics.

[0087] Exemplarily, the device obtains the first identifier of the merchant from the first basic information, and obtains the second identifier of the user from the second basic information. The device obtains the historical transaction information associated with the first identifier from the database, and obtains the risk characteristics as the first inference characteristics by reasoning and analyzing the historical transaction information. For example, after analyzing the historical information, it is found that the merchant has malicious order brushing behavior, and the malicious order brushing behavior is the first inference characteristic; the device obtains the historical transaction information associated with the second identifier from the database, and obtains the risk characteristics of the user as the first inference characteristic by analyzing and reasoning the historical transaction information associated with the second identifier. For example, the user frequently collects consumption coupons and there is arbitrage behavior, and the arbitrage behavior is the second inference characteristic.

[0088] Step S204, determining the transaction risk parameters between the user and the merchant based on the risk factor characteristics, the team characteristics, the first reasoning characteristics, and the second reasoning characteristics, and determining whether there is a transaction risk between the user and the merchant based on the transaction risk parameters.

[0089] After the first inference feature and the second inference feature, the device determines the transaction risk parameters between the user party and the merchant party based on the risk factor feature, the team feature, the first inference feature and the second inference feature.

[0090] Exemplarily, the risk factor feature, the team feature, the first reasoning feature, and the second reasoning feature are input into the recognition model, and the recognition model outputs the risk transaction parameter. The risk transaction parameter may be a label or a score.

[0091] After obtaining the transaction risk parameter, the device can determine whether there is a transaction risk between the user and the merchant. In one example, the transaction risk parameter is a label. When the label indicates a risky transaction, it is determined that there is a transaction risk between the user and the merchant. In another example, the risky transaction parameter is a score. If the score is greater than or equal to a preset score, it can be determined that there is a transaction risk between the user and the merchant. If the score is less than the preset score, it is determined that there is no transaction risk between the user and the merchant.

[0092] When the device determines that there is no transaction risk between the user and the merchant, it outputs a prompt message. The prompt message includes but is not limited to the risk level, risk score, risk source, and risk type. The risk score is a transaction risk parameter as a score. The larger the risk score, the higher the risk level. The risk source is, for example, an abnormal transaction pattern or abnormal merchant behavior. The risk type is a transaction risk parameter as a label, and the risk types include fraud risk, credit risk, etc.

[0093] In this embodiment, the transaction information and basic information between the user and the merchant are obtained, the risk factor characteristics are obtained based on the transaction information, and the team characteristics of the target group are determined based on the risk factor characteristics. The first reasoning characteristics of the user and the second reasoning characteristics of the merchant are determined through the basic information, and the transaction risk parameters are determined through the risk factor characteristics, team characteristics, first reasoning characteristics, and second reasoning characteristics, so as to determine whether the transaction parties have transaction risks based on the transaction risk parameters. In this application, it is determined whether the transaction parties have transaction risks through multiple characteristics such as risk factor characteristics, team characteristics, and reasoning characteristics, that is, whether the transaction parties have transaction risks is analyzed from multiple dimensions, which improves the accuracy of transaction risk judgment.

[0094] Reference Figure 3 , Figure 3 This is a schematic diagram of the process of risk transaction identification method for this application Figure 2 ,based on Figure 2 In the illustrated embodiment, step S202 includes:

[0095] Step S301, among various risk factor characteristics, determine the first characteristic of the user side and the second characteristic of the merchant side.

[0096] In this embodiment, the device uses the user's feature as the first feature among the risk factor features, and determines the merchant's feature as the second feature. The first feature includes the user's account type, payment method, bank card type, payment amount, discount amount, device information, etc.; the second feature includes the merchant's name, location, type, scale, etc.

[0097] Step S302: determining a user feature vector of the user side according to the first feature, and determining a merchant feature vector of the merchant side according to the second feature.

[0098] After determining the first feature and the second feature, the device determines a feature vector corresponding to the user as a user feature vector based on the first feature, and determines a feature vector corresponding to the merchant as a merchant feature vector based on the second feature.

[0099] Exemplarily, the device first processes the first feature and the second feature, and the processing includes standardization of numerical features, normalization, category feature encoding, missing value processing, outlier detection and processing, etc. The processed first feature and the second feature are input to the dual-tower model. The dual-tower model includes a user tower and a merchant tower. The dual-tower model processes the first feature input to the user tower and the second feature input to the merchant tower through a neural network with a multi-layer perceptron structure. The network structure of each layer includes a linear layer and an activation function, and batch standardization and Dropout can be added to the network structure to enhance the generalization ability of the model. The dual-tower model is optimized by supervised learning, and the loss function is usually a cross entropy loss. The goal is to maximize the receiver operating characteristic curve of the model on the validation set. When training the dual-tower model, a small batch gradient descent optimization algorithm can be used to speed up the convergence speed and avoid local optimality. The hyperparameters of the dual-tower model (such as learning rate, hidden layer size, Dropout ratio, etc.) can be tuned by grid search or random search. After the multi-layer neural network model is trained to convergence and the receiver operating characteristic curve meets the standard, the training can be completed to obtain the dual-tower model. The output of the feature layer of the last layer of the user tower in the dual-tower model is used as the user feature vector, and the output of the feature layer of the last layer of the merchant tower is used as the merchant feature vector.

[0100] Step S303: determine a first feature vector corresponding to the target similarity between the merchant feature vector and the user feature vector.

[0101] After obtaining the user feature vector and the merchant feature vector, the similarity between the merchant feature vector and the user feature vector is determined as the target similarity. The target similarity can be obtained by calculating the user feature vector and the merchant feature vector using a cosine similarity algorithm. After obtaining the target similarity, the target similarity is encoded to obtain a feature vector corresponding to the target similarity as the first feature vector.

[0102] Furthermore, when the similarity between the user side and the merchant side is lower, the feature difference on both sides of the surface twin towers is larger, which means that the transaction is abnormal or there is fraud. For example, if a user suddenly conducts a large-amount preferential transaction with a merchant who has never traded with him at an abnormal time, this behavior will have a lower similarity in the feature space. In this regard, the device first determines the target similarity between the merchant feature vector and the user feature vector. When the target similarity is less than the preset similarity, it can be determined that the transaction may be risky, and thus constructs a first feature vector corresponding to the target similarity, thereby determining the team features based on the first feature vector, and then determining whether the transaction is risky based on the team features, risk factor features, first inference features, and second inference features. When the target similarity is greater than or equal to the preset similarity, it can be determined that there is no risk in the transaction, and there is no need to construct the first feature vector corresponding to the target similarity, and the target transaction information is marked as a risk-free transaction.

[0103] Step S304: construct a second feature vector according to the user feature vector, the merchant feature vector and the first feature vector, and determine clustering features according to the second feature vector to serve as team features corresponding to the target group.

[0104] After obtaining the first feature vector, the device constructs a second feature vector based on the user feature vector, the merchant feature vector and the first feature vector. Exemplarily, the second feature vector can be obtained by concatenating the user feature vector, the merchant feature vector and the first feature vector.

[0105] In one example, after obtaining the second eigenvector, the device uses the second eigenvector as a data point and clusters it with the existing eigenpoints to obtain multiple clusters of data points. The device then determines the label, scale, and internal variance of each cluster of data points. The label refers to the category to which the cluster belongs, the scale refers to the number of data points in the cluster, and the internal variance refers to the degree of discreteness of the data in the cluster. The label can be defined as the class label, so the scale can also be defined as the class scale, and the internal variance is defined as the intra-class variance. The class label, class scale, and intra-class variance of the cluster where the second eigenvector is located are team features. The second eigenvector and each existing data point can be obtained through a clustering algorithm, that is, based on the clustering algorithm, each cluster is first obtained, the number of data points in the cluster is the class scale, and the intra-class variance can be calculated based on each data point in the cluster, and then the optimal value of K is determined based on the silhouette coefficient, and finally the class label corresponding to each data point is determined based on K. K refers to the number of clusters. The calculation method of the silhouette coefficient is as follows:

[0106] For a data point i, first calculate the average distance a between it and other data points in the cluster i (Intra-cluster similarity). Then calculate the average distance b between the point and the data points in other clusters that do not contain the cluster where the point is located. i (Inter-cluster similarity), select the one with the smallest distance as the average inter-cluster distance of i. Calculate the silhouette coefficient of data point i Finally, based on the mapping relationship between the silhouette coefficient and K, K can be obtained.

[0107] In another example, the second feature vector is input into the clustering model to obtain the clustering features output by the clustering model as team features, that is, the cluster to which the second feature vector belongs, the class size of the cluster, the class label and the intra-class variance are determined by the model.

[0108] It should be noted that the clustering model can be obtained through unsupervised clustering learning training. Considering the possible error disturbance in unsupervised clustering learning, it is necessary to name the class labels in combination with examples (transaction time, amount, equipment, and consistency of merchants), and verify the reliability of the clusters. For clusters with weak reliability, it is necessary to reduce the importance of features and give priority to enhanced verification methods such as face and text messages.

[0109] In this embodiment, the device classifies the risk factor characteristics to obtain the first characteristic of the user and the second characteristic of the merchant, thereby accurately determining the team characteristics of the group to which the merchant belongs based on the first characteristic and the second characteristic.

[0110] Reference Figure 4 , Figure 4 This is a schematic diagram of the process of risk transaction identification method for this application Figure 3 ,based on Figure 2 Or the embodiment shown in 3, step S203 includes:

[0111] Step S401, obtaining a first identifier of a merchant according to first basic information, and obtaining a second identifier of a user according to second basic information.

[0112] In this embodiment, the device obtains the merchant's identifier from the first basic information as the first identifier, and obtains the user's identifier from the second basic information as the second identifier.

[0113] Step S402: Acquire a first knowledge fragment associated with the first identifier and a second knowledge fragment associated with the second identifier.

[0114] The device is connected to a local knowledge base for communication. The local knowledge base includes knowledge from multiple sources, such as the user's basic information, historical transactions, violation history, merchant portraits, intelligence knowledge, and activity rules. The knowledge information can be divided according to the identification dimension to obtain sub-knowledge information. Identification dimensions include, for example, account (mobile phone number, user ID, identity), merchant, device, team, and activity dimensions. The sub-indication fragments are vectorized to obtain knowledge fragments for easy storage, and the knowledge fragments are associated with the corresponding identification dimensions for storage. Knowledge fragments can be used as portrait features. Examples of knowledge fragments are shown in the following table:

[0115]

[0116] After obtaining the first identifier and the second identifier, the device performs data retrieval in the local knowledge base based on the first identifier and the second identifier, obtains the knowledge fragment associated with the first identifier as the first knowledge fragment, and obtains the knowledge fragment associated with the second identifier as the second knowledge fragment.

[0117] Step S403, determining a first reasoning feature of the merchant side according to the first knowledge fragment, and determining a second reasoning feature of the user side according to the second knowledge fragment.

[0118] After determining the first knowledge segment and the second knowledge segment, a first reasoning feature of the merchant side is determined based on the first knowledge segment, and a second reasoning feature of the user side is determined based on the second knowledge segment.

[0119] Exemplarily, the first reasoning feature and the second reasoning feature are as follows:

[0120]

[0121] Among them, the inference features corresponding to the account, device and activity are the second inference features of the user side, and the team and merchant are the first inference features of the merchant side.

[0122] In this embodiment, based on the first basic information and the second basic information, knowledge fragments are retrieved, and then reasoning features are obtained based on the knowledge fragments, and then based on the reasoning features, it is accurately determined whether there is a transaction risk between the two parties to the transaction.

[0123] Reference Figure 5 , Figure 5 This is a schematic diagram of the process of risk transaction identification method for this application Figure 4 ,based on Figure 4 In the illustrated embodiment, step S403 includes:

[0124] Step S501, among various risk factor characteristics, determine the first characteristic of the user side and the second characteristic of the merchant side.

[0125] In this embodiment, the device determines the first feature of the user side and the second feature of the merchant side among the risk factor features.

[0126] The first features include user account type, payment method, bank card type, payment amount, discount amount, device information, etc.; the second features include the merchant's name, location, type, scale, etc.

[0127] Step S502, obtaining the risk scenario corresponding to the target transaction information.

[0128] Step S503, determining a first reasoning feature and a second reasoning feature according to the first feature, the second feature, the risk scenario, the team feature, the first knowledge fragment, and the second knowledge fragment.

[0129] After determining the first feature and the second feature, the device determines the risk scenario corresponding to the target transaction information, where the risk scenario is a scenario where the current transaction may have risks, such as an anti-fraud scenario, a telecommunications fraud scenario, and the like.

[0130] The device obtains a transaction identifier from the target transaction information, and uses a scenario associated with the transaction identifier as a risk scenario.

[0131] The device determines the first reasoning feature and the second reasoning feature based on the first feature, the second feature, the risk scenario, the team feature, the first knowledge fragment and the second reasoning feature.

[0132] Exemplarily, the first feature, the second feature, the risk scenario, the team feature, the first knowledge fragment and the second reasoning feature are input into the large language model to obtain the first reasoning feature and the second reasoning feature output by the large language model. The large language model is obtained by training samples in the training set, and the samples include features corresponding to the text obtained by reasoning, and the inference position is, for example, the text corresponding to the following reasoning feature. In addition, the sample also includes the risk factor features of the user side in the historical transaction information, the risk factor features of the merchant side, the risk scenarios corresponding to the historical transaction information, the knowledge fragments associated with the user side's identification, and the knowledge fragments associated with the merchant side.

[0133] The first reasoning feature and the second reasoning feature obtained by the above method are specifically as follows:

[0134]

[0135] The reasoning features corresponding to multi-dimension 1, multi-dimension 2, multi-dimension 3, multi-dimension 4, multi-dimension 5, and multi-dimension 7 may be the first reasoning features corresponding to the user side, and multi-dimension 6 is the second reasoning feature corresponding to the merchant side.

[0136] It should be noted that, since the inference feature is obtained through multiple features, it is not necessary to distinguish whether the first inference feature and the second inference feature are from the user side or the merchant side.

[0137] In this embodiment, the device combines multiple features to summarize risk factors, thereby obtaining more accurate reasoning features, thereby improving the accuracy of identifying transaction risks.

[0138] Reference Figure 6 , Figure 6 This is a schematic diagram of the process of risk transaction identification method for this application Figure 5 ,based on Figures 2 to 5 In any of the illustrated embodiments, step S204 includes:

[0139] Step S601, constructing a first combination feature according to the risk factor feature, the team feature, the first reasoning feature and the second reasoning feature.

[0140] In this embodiment, the device constructs a first combined feature based on the risk factor feature, the team feature, the first reasoning feature, and the second reasoning feature.

[0141] In one example, the risk factor feature, the team feature, the first reasoning feature, and the second reasoning feature are concatenated to obtain a first combined feature.

[0142] In another example, there are too many features to be combined, and unimportant features need to be deleted. In this regard, the device determines the importance parameter of each third feature, and each third feature is the above-mentioned risk factor feature, team feature, first reasoning feature, and second reasoning feature. The device can determine the importance parameter of the third feature by random forest or regularization, and can also obtain the corresponding importance parameter by the type to which the third feature belongs. The importance parameter corresponding to the type is manually set, and the larger the importance parameter, the more important the feature. The device determines the fourth feature from each third feature based on the importance parameter, and the fourth feature is a third feature whose importance parameter is greater than a preset threshold. The device then splices each fourth feature to obtain the first combined feature.

[0143] Step S602: input the first combined feature into the recognition model to obtain the transaction risk parameter output by the recognition model.

[0144] After obtaining the first combined feature, the device inputs the first combined feature into the recognition model, and the parameter output by the recognition model is the transaction risk parameter.

[0145] The recognition model can be obtained through training. Exemplarily, the device obtains multiple training samples, the training samples include a second combination feature and a risk label, the second combination feature is constructed based on the risk factor feature, team feature and reasoning feature obtained from the historical transaction information, and the risk label is used to indicate whether the historical transaction information has transaction risks. The device can obtain the recognition model by training the preset model based on each training sample, and the preset model can be a regression model.

[0146] In this embodiment, the risk factor feature, the team feature, the first reasoning feature and the second reasoning feature are spliced ​​to obtain a combined feature, and the combined feature is input into the recognition model to obtain accurate risk transaction parameters.

[0147] Based on the contents described in the above embodiments, a risk transaction identification device is also provided in the embodiments of the present application. Figure 7 , Figure 7 This is a schematic diagram of a program module of a risky transaction identification device provided in an embodiment of the present application. In some implementations, the risky transaction identification device 700 includes:

[0148] The first acquisition module 710 is used to acquire target transaction information between the user and the merchant, and acquire first basic information of the merchant and second basic information of the user;

[0149] A second acquisition module 720 is used to acquire risk factor characteristics according to the target transaction information, and determine team characteristics of a target group according to the risk factor characteristics, where the target group includes at least one of a user side and a merchant side;

[0150] A first determination module 730 is used to determine a first inference feature of the merchant side according to the first basic information, and a second inference feature of the user side according to the second basic information;

[0151] The second determination module 740 is used to determine the transaction risk parameters between the user and the merchant according to the risk factor characteristics, the team characteristics, the first reasoning characteristics and the second reasoning characteristics, and determine whether there is a transaction risk between the user and the merchant according to the transaction risk parameters.

[0152] In some embodiments, the risky transaction identification device 700 is specifically used to:

[0153] Among the risk factor characteristics, determining a first characteristic on the user side and a second characteristic on the merchant side;

[0154] Determine a user feature vector of the user side according to the first feature, and determine a merchant feature vector of the merchant side according to the second feature;

[0155] Determine a first feature vector corresponding to a target similarity between a merchant feature vector and a user feature vector;

[0156] A second feature vector is constructed according to the user feature vector, the merchant feature vector and the first feature vector, and a clustering feature is determined according to the second feature vector to serve as a team feature corresponding to the target group.

[0157] In some embodiments, the risky transaction identification device 700 is specifically used to:

[0158] Determine the target similarity between the merchant feature vector and the user feature vector;

[0159] In response to the target similarity being less than a preset similarity, a first feature vector corresponding to the target similarity is constructed.

[0160] In some embodiments, the risky transaction identification device 700 is specifically used to:

[0161] The second feature vector is input into the clustering model to obtain the clustering features output by the clustering model.

[0162] In some embodiments, the risky transaction identification device 700 is specifically used to:

[0163] Acquire a first identifier of the merchant according to the first basic information, and acquire a second identifier of the user according to the second basic information;

[0164] Acquire a first knowledge fragment associated with the first identifier and a second knowledge fragment associated with the second identifier;

[0165] A first reasoning feature of the merchant side is determined based on the first knowledge fragment, and a second reasoning feature of the user side is determined based on the second knowledge fragment.

[0166] In some embodiments, the risky transaction identification device 700 is specifically used to:

[0167] Among the risk factor characteristics, determining a first characteristic on the user side and a second characteristic on the merchant side;

[0168] Obtain risk scenarios corresponding to target transaction information;

[0169] A first reasoning feature and a second reasoning feature are determined according to the first feature, the second feature, the risk scenario, the team feature, the first knowledge fragment, and the second knowledge fragment.

[0170] In some embodiments, the risky transaction identification device 700 is specifically used to:

[0171] Constructing a first combination feature according to the risk factor feature, the team feature, the first reasoning feature and the second reasoning feature;

[0172] The first combined feature is input into the recognition model to obtain the transaction risk parameter output by the recognition model.

[0173] In some embodiments, the risky transaction identification device 700 is specifically used to:

[0174] Determining an importance parameter of each third feature, each third feature including a risk factor feature, a team feature, a first reasoning feature, and a second reasoning feature;

[0175] Determine a fourth feature from each of the third features according to the importance parameter, the fourth feature being a third feature whose importance parameter is greater than a preset threshold;

[0176] The fourth features are combined to obtain the first combined feature.

[0177] In some embodiments, the risky transaction identification device 700 is specifically used to:

[0178] Acquire multiple training samples, the training samples include a second combination feature and a risk label, the second combination feature is constructed based on the risk factor feature, the team feature, and the reasoning feature obtained from the historical transaction information, and the risk label is used to indicate whether the historical transaction information has a transaction risk;

[0179] The preset model is trained according to each training sample to obtain a recognition model.

[0180] It should be noted that the various steps in the risky transaction identification method executed by the risky transaction identification device are specifically referred to the above embodiment and will not be described in detail here.

[0181] Furthermore, based on the contents described in the above embodiments, an electronic device is also provided in an embodiment of the present application, which includes at least one processor, and a communication interface and a memory to which the processor is communicatively connected; wherein the communication interface is used to communicate with other communication devices, and the memory stores computer-executable instructions; the above at least one processor executes the computer-executable instructions stored in the memory to implement each step in the risk transaction identification method as described in the above embodiments.

[0182] In order to better understand the embodiments of the present application, refer to Figure 8 , Figure 8 A schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application.

[0183] like Figure 8 As shown, the electronic device 800 of this embodiment includes: a processor 801, a memory 802, and a communication interface 804; wherein:

[0184] Memory 802, used to store computer-executable instructions;

[0185] The communication interface 804 is used to communicate with other communication devices;

[0186] The processor 801 is used to execute the computer-executable instructions stored in the memory to implement the various steps in the query optimization method described in the above embodiment.

[0187] Optionally, the memory 802 may be independent or integrated with the processor 801 .

[0188] When the memory 802 is independently provided, the device further includes a bus 803 for connecting the memory 802 , the communication interface 804 and the processor 801 .

[0189] An embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When a processor executes the computer-executable instructions, each step of the risk transaction identification method described in the above embodiment is implemented.

[0190] An embodiment of the present application provides a computer program product, including a computer program. When the computer program is executed by a processor, the computer program implements the various steps in the risk transaction identification method described in the above embodiment.

[0191] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of modules is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, which can be electrical, mechanical or other forms.

[0192] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0193] In addition, each functional module in each embodiment of the present application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The above-mentioned module-composed unit can be implemented in the form of hardware or in the form of hardware plus software functional units.

[0194] The above-mentioned integrated module implemented in the form of a software function module can be stored in a computer-readable storage medium. The above-mentioned software function module is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to perform some steps of the methods of various embodiments of the present application.

[0195] It should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the method disclosed in the application may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0196] The memory may include high-speed memory, and may also include non-volatile storage, such as at least one disk memory, and may also be a USB flash drive, a mobile hard disk, a read-only memory, a magnetic disk or an optical disk, etc.

[0197] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0198] The storage medium may be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory, electrically erasable programmable read-only memory, erasable programmable read-only memory, programmable read-only memory, read-only memory, magnetic memory, flash memory, magnetic disk or optical disk. The storage medium may be any available medium that can be accessed by a general or special purpose computer.

[0199] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for identifying risky transactions, characterized in that: include: Acquire target transaction information between the user party and the merchant party, and acquire first basic information of the merchant party and second basic information of the user party; Acquire risk factor characteristics according to the target transaction information, and determine team characteristics of a target group according to the risk factor characteristics, wherein the target group includes at least one of the user party and the merchant party; Determine a first inference feature of the merchant side according to the first basic information, and a second inference feature of the user side according to the second basic information; The transaction risk parameters between the user and the merchant are determined based on the risk factor characteristics, the team characteristics, the first reasoning characteristics, and the second reasoning characteristics, and whether there is a transaction risk between the user and the merchant is determined based on the transaction risk parameters.

2. The risky transaction identification method according to claim 1, characterized in that: Determining the team characteristics of the target group according to the risk factor characteristics includes: Among the risk factor characteristics, determining the first characteristic of the user side and the second characteristic of the merchant side; Determine a user feature vector of the user according to the first feature, and determine a merchant feature vector of the merchant according to the second feature; Determine a first feature vector corresponding to a target similarity between the merchant feature vector and the user feature vector; A second feature vector is constructed according to the user feature vector, the merchant feature vector and the first feature vector, and a clustering feature is determined according to the second feature vector to serve as a team feature corresponding to the target group.

3. The risky transaction identification method according to claim 2, characterized in that: The determining of a first feature vector corresponding to a target similarity between the merchant feature vector and the user feature vector comprises: Determining a target similarity between the merchant feature vector and the user feature vector; In response to the target similarity being less than a preset similarity, a first feature vector corresponding to the target similarity is constructed.

4. The risky transaction identification method according to claim 2, characterized in that: The determining the clustering feature according to the second feature vector comprises: The second feature vector is input into a clustering model to obtain a clustering feature output by the clustering model.

5. The risky transaction identification method according to claim 1, characterized in that: The determining the first inference feature of the merchant side according to the first basic information, and the determining the second inference feature of the user side according to the second basic information, includes: Acquire a first identifier of the merchant according to the first basic information, and acquire a second identifier of the user according to the second basic information; Acquire a first knowledge fragment associated with the first identifier and a second knowledge fragment associated with the second identifier; A first reasoning feature of the merchant side is determined based on the first knowledge fragment, and a second reasoning feature of the user side is determined based on the second knowledge fragment.

6. The risky transaction identification method according to claim 5, characterized in that: The determining the first inference feature of the merchant side according to the first knowledge fragment, and determining the second inference feature of the user side according to the second knowledge fragment, includes: Among the risk factor characteristics, determining the first characteristic of the user side and the second characteristic of the merchant side; Obtaining a risk scenario corresponding to the target transaction information; The first reasoning feature and the second reasoning feature are determined according to the first feature, the second feature, the risk scenario, the team feature, the first knowledge fragment, and the second knowledge fragment.

7. The risky transaction identification method according to claim 1, characterized in that: The determining, according to the risk factor feature, the team feature, the first reasoning feature, and the second reasoning feature, a transaction risk parameter between the user and the merchant includes: Constructing a first combined feature according to the risk factor feature, the team feature, the first reasoning feature, and the second reasoning feature; The first combined feature is input into a recognition model to obtain a transaction risk parameter output by the recognition model.

8. The risky transaction identification method according to claim 7, characterized in that: The constructing a first combination feature according to the risk factor feature, the team feature, the first reasoning feature, and the second reasoning feature includes: Determining an importance parameter of each third feature, each of the third features including the risk factor feature, the team feature, the first reasoning feature, and the second reasoning feature; Determining a fourth feature from each of the third features according to the importance parameter, wherein the fourth feature is a third feature whose importance parameter is greater than a preset threshold; The fourth features are combined to obtain the first combined feature.

9. The risky transaction identification method according to claim 7, characterized in that: Before inputting the first combined feature into the recognition model to obtain the transaction risk parameter output by the recognition model, the method further includes: Acquire multiple training samples, the training samples include a second combination feature and a risk label, the second combination feature is constructed based on the risk factor feature, the team feature, and the reasoning feature obtained from the historical transaction information, and the risk label is used to indicate whether the historical transaction information has a transaction risk; The preset model is trained according to each of the training samples to obtain the recognition model.

10. A risky transaction identification device, characterized in that: include: A first acquisition module is used to acquire target transaction information between a user party and a merchant party, and acquire first basic information of the merchant party and second basic information of the user party; A second acquisition module, configured to acquire risk factor characteristics according to the target transaction information, and determine team characteristics of a target group according to the risk factor characteristics, wherein the target group includes at least one of the user party and the merchant party; A first determining module, configured to determine a first inference feature of the merchant side according to the first basic information, and a second inference feature of the user side according to the second basic information; The second determination module is used to determine the transaction risk parameters between the user and the merchant according to the risk factor characteristics, the team characteristics, the first reasoning characteristics and the second reasoning characteristics, and determine whether there is a transaction risk between the user and the merchant according to the transaction risk parameters.

11. An electronic device, characterized in that: include: A processor, and a memory and a communication interface communicatively connected to the processor; The communication interface is used to communicate with other communication devices; The memory is used to store computer-executable instructions; The processor is used to execute the computer-executable instructions stored in the memory to implement the risk transaction identification method as described in any one of claims 1-9.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, and when the computer-executable instructions are executed by a processor, the risk transaction identification method according to any one of claims 1 to 9 is implemented.

13. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the risk transaction identification method as described in any one of claims 1 to 9 is implemented.

Images