Anti-fraud early warning method and anti-fraud early warning system based on causal analysis

Abstract

The invention provides an anti-fraud early warning method and an anti-fraud early warning system based on causal analysis. The method comprises the following steps: acquiring account related data; constructing a directed causal graph according to the account related data; constructing a first model; inputting the directed causal graph into the first model to obtain an analysis result corresponding to the directed causal graph; and generating early warning information under the condition that the analysis result represents that the account may have the risk of fraud. According to the scheme, the problem that bank users are easily cheated by telecommunications in the prior art is solved.

Description

Technical Field

[0001] The present application relates to the field of account security technology, and more specifically, to an anti-fraud early warning method, device, computer program product, and anti-fraud early warning system based on causal analysis. Background Art

[0002] With the prevalence of external telecommunications network fraud and illegal crimes, higher requirements have been placed on the banking industry. It is not only necessary to develop business well, but also to combat telecommunications network fraud and illegal crimes. How to timely warn customers of fraud risks has become a difficult problem for the banking industry. Therefore, if bank users conduct non-banking business under the inducement of criminals, bank users will face property losses. Summary of the invention

[0003] The main purpose of the present application is to provide an anti-fraud early warning method, device, computer program product and anti-fraud early warning system based on causal analysis, so as to at least solve the problem in the prior art that bank users are susceptible to telecommunications fraud.

[0004] In order to achieve the above-mentioned purpose, according to one aspect of the present application, there is provided an anti-fraud early warning method based on causal analysis, comprising: obtaining account-related data, wherein the account-related data includes one or more of personal data, transaction data and associated data, wherein the personal data includes at least one or more of age, occupation, education level and residential area, the transaction data includes at least one or more of transaction frequency, transaction amount, transaction time and transaction method, and the associated data includes at least one or more of associated accounts, associated occupations and associated education levels; constructing a directed causal graph based on the account-related data, wherein the directed causal graph includes multiple of the A causal pointing relationship between account-related data and multiple account-related data; constructing a first model, wherein the first model is trained by a Bayesian estimation algorithm using multiple sets of training data, each set of training data in the multiple sets of training data includes a historical directed causal graph obtained within a historical time period, and a historical analysis result corresponding to the historical directed causal graph, wherein the historical analysis result is used to characterize whether a historical account corresponding to the historical directed causal graph will incur a risk of fraud; inputting the directed causal graph into the first model to obtain an analysis result corresponding to the directed causal graph; and generating early warning information when the analysis result characterizes that an account will incur a risk of fraud.

[0005] Optionally, obtaining account-related data includes: obtaining initial account-related data, wherein the initial account-related data is account-related data obtained at an initial moment; preprocessing the initial account-related data to obtain the account-related data, wherein the preprocessing method includes one or more of discretization processing, quantification processing and normalization processing.

[0006] Optionally, constructing a directed causal graph based on the account-related data includes: constructing a second model, wherein the second model is trained by streaming learning using multiple sets of training data, each set of training data in the multiple sets of training data includes historical account-related data acquired within a historical time period, and a historical undirected causal graph corresponding to the historical account-related data, wherein the historical undirected causal graph is historical risk causes corresponding to the historical account-related data and historical risk results corresponding to the historical account-related data; inputting the account-related data into the second model to obtain an undirected causal graph corresponding to the account-related data; and orienting the undirected causal graph using at least a hill climbing search algorithm to obtain the directed causal graph.

[0007] Optionally, before constructing the second model, the method further includes: obtaining at least part of the account-related data; performing association analysis on at least part of the account-related data to obtain an association analysis result, wherein the association analysis result is used to characterize the association relationship between at least part of the account-related data.

[0008] Optionally, performing association analysis on at least part of the account-related data to obtain an association analysis result includes: using a Log-Likehood function to calculate a statistical value between first account-related data and second account-related data, wherein the first account-related data is one of the account-related data, and the second account-related data is one of the account-related data other than the first account-related data; when the statistical value is greater than a preset statistical threshold, determining that there is a correlation between the first account-related data and the second account-related data, and obtaining a first association analysis result.

[0009] Optionally, performing association analysis on at least part of the account-related data to obtain an association analysis result includes: using a Log-Likehood function to calculate a first statistical value, a second statistical value, and a third statistical value, wherein the first statistical value is a statistical value between the first account-related data and the second account-related data, the second statistical value is a statistical value between the third account-related data and the second account-related data, and the third statistical value is a statistical value between the first account-related data and the third account-related data, the first account-related data is one of the account-related data, the second account-related data is one of the account-related data other than the first account-related data, and the third account-related data is one of the account-related data other than the first account-related data and the second account-related data; when the first statistical value is greater than the second statistical value and the third statistical value is greater than the second statistical value, determining that the third account-related data is redundant data of the first account-related data and the third account-related data is redundant data of the second account-related data, and obtaining a second association analysis result.

[0010] Optionally, at least a hill climbing search algorithm is used to orient the undirected causal graph to obtain the directed causal graph, including: constructing a third model, wherein the third model is trained by the first algorithm and the second algorithm using multiple sets of training data, each set of training data in the multiple sets of training data includes a historical undirected causal graph obtained within a historical time period, and a historical directed causal graph corresponding to the historical undirected causal graph, wherein the first algorithm is a hill climbing search directional algorithm based on MDL scoring, and the second algorithm is a Bayesian estimation algorithm; the undirected causal graph is input into the third model to obtain the directed causal graph corresponding to the undirected causal graph.

[0011] According to another aspect of the present application, an anti-fraud early warning device based on causal analysis is provided, comprising: a first acquisition unit, used to acquire account-related data, wherein the account-related data includes one or more of personal data, transaction data and associated data, wherein the personal data includes at least one or more of age, occupation, education level and residential area, the transaction data includes at least one or more of transaction frequency, transaction amount, transaction time and transaction method, and the associated data includes at least one or more of associated accounts, associated occupations and associated education levels; a first construction unit, used to construct a directed causal graph based on the account-related data, wherein the directed causal graph includes multiple account-related data and multiple a causal pointing relationship between the account-related data; a second construction unit, used to construct a first model, wherein the first model is trained by a Bayesian estimation algorithm using multiple sets of training data, and each set of training data in the multiple sets of training data includes a historical directed causal graph obtained within a historical time period, and a historical analysis result corresponding to the historical directed causal graph, wherein the historical analysis result is used to characterize whether the historical account corresponding to the historical directed causal graph will have a risk of fraud; a first processing unit, used to input the directed causal graph into the first model, and obtain the analysis result corresponding to the directed causal graph; an early warning unit, used to generate early warning information when the analysis result characterizes that the account will have a risk of fraud.

[0012] According to another aspect of the present application, a computer program product is provided, including a computer program, which, when executed by a processor, implements the steps of any one of the anti-fraud warning methods based on causal analysis.

[0013] According to another aspect of the present application, an anti-fraud early warning system is provided, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include means for executing any one of the anti-fraud early warning methods based on causal analysis.

[0014] By applying the technical solution of the present application, a directed causal graph can be constructed based on account-related data. The directed causal graph can characterize the causal relationship between different account-related data. For example, older people may be defrauded, which may increase the transaction frequency, or the transaction amount of accounts in certain financial industries may be large. The model is constructed through this causal relationship. The Bayesian algorithm has strong explanatory power, can give probability values ​​to different results, and has a more accurate judgment of the data. Therefore, by learning the causal relationship between account-related data, when the model output may contain fraudulent behavior, timely early warning of fraud risks can be given, thereby reducing the risk of fraud. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The drawings constituting part of the present application are used to provide a further understanding of the present application. The exemplary embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0016] Figure 1 A hardware structure block diagram of a mobile terminal for executing an anti-fraud early warning method based on causal analysis provided in an embodiment of the present application is shown;

[0017] Figure 2 A flow chart of an anti-fraud early warning method based on causal analysis provided according to an embodiment of the present application is shown;

[0018] Figure 3 A schematic diagram of the technical process of the present solution based on streaming causal analysis is shown;

[0019] Figure 4 A structural block diagram of an anti-fraud early warning device based on causal analysis provided according to an embodiment of the present application is shown.

[0020] The above drawings include the following reference numerals:

[0021] 102, processor; 104, memory; 106, transmission device; 108, input and output devices. DETAILED DESCRIPTION

[0022] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0023] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this application.

[0024] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0025] For the convenience of description, some nouns or terms involved in the embodiments of the present application are explained below:

[0026] Causal graph model: It is a theory for studying uncertainty problems, which mainly uses Bayesian Network (BN) for probabilistic inference.

[0027] Greedy hill climbing search algorithm based on MDL scoring function: Through the MDL scoring function and the restricted greedy hill climbing search algorithm, causal orientation of undirected Bayesian networks can be achieved.

[0028] Bayesian parameter estimation method: Generate a prior distribution of model parameters based on a priori data set, and then iteratively calculate the probability of each node in the causal graph under the condition of the value of the parent node set.

[0029] As introduced in the background technology, bank users are vulnerable to telecommunication fraud in the prior art. To solve the above problems, the embodiments of the present application provide an anti-fraud warning method, device, computer program product and anti-fraud warning system based on causal analysis.

[0030] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0031] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 1 is a hardware structure block diagram of a mobile terminal of an anti-fraud early warning method based on causal analysis according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0032] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the display method of device information in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the above method is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. The transmission device 106 is used to receive or send data via a network. The above-mentioned specific examples of the network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0033] In this embodiment, an anti-fraud early warning method based on causal analysis is provided, which runs on a mobile terminal, a computer terminal or a similar computing device. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0034] Figure 2 It is a flow chart of an anti-fraud early warning method based on causal analysis according to an embodiment of the present application.

[0035] like Figure 2 As shown, the method comprises the following steps:

[0036] Step S201, obtaining account-related data, wherein the account-related data includes one or more of personal data, transaction data and associated data, wherein the personal data includes at least one or more of age, occupation, education level and place of residence, the transaction data includes at least one or more of transaction frequency, transaction amount, transaction time and transaction method, and the associated data includes at least one or more of associated accounts, associated occupations and associated education level;

[0037] Specifically, Figure 3 As shown, the real data of fraud-related accounts (such as customer information [age, occupation, education level, place of residence...], transaction information [transaction frequency, transaction amount, transaction time, transaction method...], and associated account information [associated account customer information, associated accounts, associated transactions, associated occupations and associated education levels, such as age, place of residence, occupation, education level]) can be obtained through the bank system database to provide original training data for fraud-related risk warning.

[0038] Step S202, constructing a directed causal graph according to the account-related data, wherein the directed causal graph includes a plurality of the account-related data and a causal pointing relationship between the plurality of the account-related data;

[0039] Specifically, the directed causal graph includes multiple account-related data, as well as the causal pointing relationship between the multiple account-related data. For example, older accounts have lower transaction frequencies, that is, one cause corresponds to one result, a one-to-one relationship, or a one-to-many relationship, or a many-to-many relationship. The causal pointing relationship is the direction of the arrow.

[0040] Step S203, constructing a first model, wherein the first model is obtained by training with a Bayesian estimation algorithm using multiple sets of training data, each set of training data in the multiple sets of training data includes a historical directed causal graph obtained in a historical time period, and a historical analysis result corresponding to the historical directed causal graph, wherein the historical analysis result is used to characterize whether a historical account corresponding to the historical directed causal graph will have a risk of fraud;

[0041] Specifically, machine learning training can be performed using a Bayesian estimation algorithm, and the training data includes a historical directed causal graph and historical analysis results corresponding to the historical directed causal graph, thereby obtaining a first model.

[0042] Step S204, inputting the directed causal graph into the first model to obtain an analysis result corresponding to the directed causal graph;

[0043] Specifically, since the first model can accurately determine whether a fraud risk will occur, the current directed causal graph is input into the first model to obtain the analysis result corresponding to the directed causal graph, that is, whether the account corresponding to the directed causal graph will have a fraud risk.

[0044] Step S205: if the above analysis result indicates that the account may be at risk of fraud, generate warning information.

[0045] Specifically, if the account is at risk of fraud, a warning message will be generated to explain the warning reminder.

[0046] Through this embodiment, a directed causal graph can be constructed based on account-related data. The directed causal graph can characterize the causal relationship between different account-related data. For example, older people may be defrauded, which may increase the transaction frequency, or the transaction amount of accounts in certain financial industries is larger. The model is constructed through this causal relationship. The Bayesian algorithm has strong explanatory power, can give probability values ​​to different results, and has a more accurate judgment of the data. Therefore, by learning the causal relationship between account-related data, when the model output may contain fraudulent behavior, timely early warning reminders of fraud risks can be issued, thereby reducing the risk of fraud.

[0047] Specifically, in some existing solutions, anti-fraud models based on machine learning and deep learning cannot analyze the causal relationship between different data features and determine the real factors that lead to anti-fraud behavior. Traditional causal network analysis models cannot dynamically be compatible with newly added feature data and need to repeatedly train the previous data each time. The maintenance cost of the model is relatively high. In this solution, by modeling the data of fraud-related account factors, and dynamically being compatible with newly added factor data, the causal relationship between fraud-related account factors is learned, and after possible fraud occurs, fraud risks are promptly warned. The accuracy and timeliness of fraud warning intervention can be significantly improved, reducing the risk of financial fraud.

[0048] In the specific implementation process, obtaining account-related data can be achieved through the following steps: obtaining initial account-related data, wherein the initial account-related data is the account-related data obtained at the initial moment; preprocessing the initial account-related data to obtain the account-related data, wherein the preprocessing method includes one or more of discretization processing, quantification processing and normalization processing.

[0049] In this solution, by preprocessing the data, the influence of the data on subsequent content can be eliminated, and the validity and accuracy of the data can be guaranteed.

[0050] Specifically, Figure 3As shown in the figure, this solution designs its own training data of fraudulent account factors, and collects and preprocesses the data effectively. The input data can be preprocessed, such as discretizing continuous data (such as age) and quantifying qualitative data (such as education), and then normalizing the processed data to eliminate the impact of data dimension on the subsequent data processing.

[0051] During the specific implementation process, a directed causal graph is constructed based on the above-mentioned account-related data, which can be achieved through the following steps: constructing a second model, wherein the above-mentioned second model is trained by streaming learning using multiple sets of training data, and each set of training data in the above-mentioned multiple sets of training data includes historical account-related data obtained within a historical time period, and a historical undirected causal graph corresponding to the above-mentioned historical account-related data, wherein the above-mentioned historical undirected causal graph is the historical risk causes corresponding to the above-mentioned historical account-related data and the historical risk results corresponding to the above-mentioned historical account-related data; inputting the above-mentioned account-related data into the above-mentioned second model to obtain an undirected causal graph corresponding to the above-mentioned account-related data; and orienting the above-mentioned undirected causal graph using at least a hill climbing search algorithm to obtain the above-mentioned directed causal graph.

[0052] In this solution, machine learning training can be performed through streaming learning to obtain a second model. The second model can output an undirected causal graph corresponding to the account-related data. The undirected causal graph includes multiple causes and results, but the causes and results are not connected. Therefore, a hill climbing search algorithm is used to connect the causes and results to obtain a more accurate directed causal graph.

[0053] Streaming learning is a machine learning method that achieves a continuous learning process by continuously obtaining samples from data streams and updating models. In traditional machine learning, models are usually trained through offline batch processing, while in streaming learning, models can be continuously updated as data continues to arrive to adapt to the ever-changing environment. The advantage of streaming learning is that it can process and analyze data in real time and can adapt to new data patterns and changes more quickly.

[0054] Specifically, Figure 3 As shown, the input data is sequentially input into the streaming causal network model (i.e., the second model) in a streaming manner, and the threshold of the independence analysis scoring tool is set (it can be set according to the actual situation, and the threshold used in this solution is 0.8), and learning and modeling are performed to generate an undirected causal graph between the factors of the fraud-related accounts. By using streaming learning, new fraud-related account factors are dynamically added to the existing fraud-related account causal graph model without the need to repeatedly train the model.

[0055] The generated undirected causal graph is oriented according to the hill climbing search method to generate a directed graph (the causal pointing relationship between the factors of the fraudulent account). The Bayesian estimation parameter learning method is then used to learn the parameters of each factor of the causal graph, and the conditional probability table of each factor node is generated, thereby obtaining a complete causal graph model of the factors of the fraudulent account (i.e., the third model).

[0056] Specifically, when a possible fraud occurs, the fraud-related account factor data appearing in the suspected fraud is input into the generated fraud-related account factor causal graph model to infer and calculate the probability value of the fraud risk.

[0057] Based on the obtained fraud risk probability value and the preset threshold, it is determined whether fraud is occurring. If it occurs, the early warning fact of the customer fraud event is pushed to the SMS system through the Kafka message queue, and a SMS is sent to notify the branch manager of the fraud bank account and the fraud customer, reminding the branch manager and the fraud customer that they may be experiencing fraud, and taking relevant anti-fraud measures.

[0058] In the specific implementation process, before constructing the second model, the above method also includes the following steps: obtaining at least part of the above account-related data; performing association analysis on at least part of the above account-related data to obtain association analysis results, wherein the above association analysis results are used to characterize the association relationship between at least part of the above account-related data.

[0059] In this solution, correlation analysis can be performed on account-related data to determine whether there is correlation or redundancy between account-related data, and then the data can be screened subsequently to ensure that the amount of data when the causal graph is generated subsequently is small, further ensuring that the accuracy of the subsequent causal graph is better.

[0060] Specifically, the learning of causal networks can help filter out irrelevant factors in fraudulent account factors, find factors that have direct or indirect causal relationships, and provide a complete causal chain for relevant personnel to analyze and investigate. Applying causal model learning to fraudulent account warnings, the model learned through the causal network has actual causality, not just correlation, so the predicted results have higher accuracy.

[0061] Specifically, through the anti-fraud model based on causal graph model learning, the causal relationship between different fraud-related account factors is analyzed, the real factors leading to anti-fraud behavior are determined, irrelevant factors are eliminated, and the accuracy of fraud warning is improved.

[0062] Specifically, the independence scoring tool used is the Log-Likehood function, which can test whether there is an independent relationship between two factors. The process of streaming causal network learning is mainly divided into two stages, namely correlation analysis and redundancy analysis, which are introduced below.

[0063] In some embodiments, correlation analysis is performed on at least part of the above account-related data to obtain a correlation analysis result, which can be specifically achieved through the following steps: using a Log-Likehood function to calculate a statistical value between the first account-related data and the second account-related data, wherein the first account-related data is one of the above account-related data, and the second account-related data is one of the above account-related data other than the first account-related data; when the statistical value is greater than a preset statistical threshold, it is determined that there is a correlation between the first account-related data and the second account-related data, and a first correlation analysis result is obtained.

[0064] In this solution, the Log-Likehood function can be used to analyze the correlation between data. Specifically, statistical values ​​can be used to express the strength of the correlation between account-related data, so that whether there is a correlation between data can be determined more accurately.

[0065] Specifically, for the correlation analysis of fraud-related account factors, the fraud-related account factors are input into the streaming causal model in sequence. i After reaching the system, calculate f respectively i With all the factors f1, f2, ..., f that flowed into the fraudulent account before i-1 The statistical value LLR(f k ,f i ), if LLR(f k ,f i )>threshold (threshold is the preset statistical threshold, the value used in this article is 0.8), then these related fraud account factors are saved to the current factor f i The candidate neighbor set tempMB.

[0066] Specifically, in the above-mentioned embodiment, f k Indicates the data related to the first account, f i Represents the second account related data, LLR(f k ,f i ) represents the statistical value between the first account-related data and the second account-related data.

[0067] The Log-Likehood independence test scoring function is defined as:

[0068]

[0069] Description of this statistic: The two random variables are f x =(x1,...,x n ) and f y =(y1,...,y n ), V x,y represents the joint sample (x1,y1),...,(x n ,y n ). The random variable f x , f y The respective distribution of x (A), f x (B), and their joint distribution is represented by V x,y (A×B), where A and B are Borel subsets in the original variable space, for their finite partitions f x With f y The log-likelihood function of .

[0070] In some embodiments, association analysis is performed on at least part of the account-related data to obtain an association analysis result, which can be specifically achieved by the following steps: using a Log-Likehood function to calculate a first statistical value, a second statistical value, and a third statistical value, wherein the first statistical value is a statistical value between the first account-related data and the second account-related data, the second statistical value is a statistical value between the third account-related data and the second account-related data, the third statistical value is a statistical value between the first account-related data and the third account-related data, the first account-related data is one of the account-related data, the second account-related data is one of the account-related data other than the first account-related data, and the third account-related data is one of the account-related data other than the first account-related data and the second account-related data; when the first statistical value is greater than the second statistical value and the third statistical value is greater than the second statistical value, it is determined that the third account-related data is redundant data of the first account-related data and the third account-related data is redundant data of the second account-related data, and a second association analysis result is obtained.

[0071] In this solution, the Log-Likehood function can be used to analyze the redundancy between data. Specifically, statistical values ​​can be used to express the strength of the redundancy between account-related data, so that it can be more accurately determined whether there is redundancy between data.

[0072] Specifically, for the redundancy analysis of the factors of fraudulent accounts, the factor f is updated through redundancy analysis. j (f j The candidate neighbors (i.e., MB{f j}) and construct the current factor f i MB (i.e. MB{f i}). The specific process is as follows: First, try to convert the current factor f j Add to tempMB each factor f j MB (ie MB{f j}). For convenience, we use f v MB{f j}, calculate and judge LLR(f v ,f j )>LLR(f i ,f j ) and LLR(f v ,f i )>LLR(f i ,f j ) are both true, if true, then f i As a redundant factor, there is no need to i Join MB{f j}; If not, then the factor f i Join MB j}, and also i Join MB{f j}. At this time, MB{f j Some factors in} m It may be due to i The addition of LLR(f i ,f j )>LLR(f m ,f j ) and LLR(f i ,f m )>LLR(f m ,f j ) are both true, if true, then it means f m As a redundancy factor, we will j} remove f m , and also from MB{f m} remove f j Through the above steps, MB{f j}, at this time MB{f i}Some factors may also occur to prevent MB{f i There are two redundant factors in}, and we need to continue to calculate and judge MB{f i Each factor f in n Whether it is a redundant factor, the calculation and judgment process is similar to the above, and will not be repeated here. Through the above process, the MB of each factor flowing into the system is obtained, and by combining the MB of each factor, the undirected causal graph between the factors of the fraudulent account is obtained.

[0073] Specifically, in the above-mentioned embodiment, f v Indicates the data related to the first account, f j Indicates the data related to the second account, f i Represents the third account related data, LLR(f v ,f j ) represents the first statistical value, LLR(f i ,f j ) represents the second statistical value, LLR(f v ,f i ) represents the third statistical value.

[0074] If there are still fraudulent account factors flowing into the system, repeat the above steps until no new factors flow into the system.

[0075] In some embodiments, at least a hill climbing search algorithm is used to orient the undirected causal graph to obtain the directed causal graph, which can be specifically achieved through the following steps: constructing a third model, wherein the third model is trained by the first algorithm and the second algorithm using multiple sets of training data, and each set of training data in the multiple sets of training data includes a historical undirected causal graph obtained within a historical time period and a historical directed causal graph corresponding to the historical undirected causal graph, wherein the first algorithm is a hill climbing search directional algorithm based on MDL scoring, and the second algorithm is a Bayesian estimation algorithm; inputting the undirected causal graph into the third model to obtain the directed causal graph corresponding to the undirected causal graph.

[0076] In this solution, the first algorithm and the second algorithm can be combined to perform machine learning training and construct a third model. The third model can be used to determine the directed causal graph corresponding to the undirected causal graph. The hill climbing search algorithm can be gradually optimized to find the optimal solution. The MDL score is used as a guide to reduce the search space and improve the search efficiency. The Bayesian estimation algorithm can combine prior knowledge and update the relationship through new data to make the constructed directed causal graph more in line with the actual situation. The combination of the first algorithm and the second algorithm can fully utilize the uncertainty capability of the Bayesian algorithm in the search process. At the same time, with the help of the search efficiency of the first algorithm, the optimal directed causal graph that conforms to both the data and the prior knowledge can be quickly found.

[0077] Specifically, first, the hill climbing search directional algorithm is used to find the local optimal solution in the search space. The algorithm starts from an initial solution and searches for the optimal solution by continuously moving to a better solution in the adjacent solution. In the process of hill climbing search, the MDL score can be used as the objective function, that is, each time the adjacent solution is moved, the MDL score of the current solution is calculated, and the solution with a better score is selected as the next search point. Once the hill climbing search algorithm finds a local optimal solution, the Bayesian estimation algorithm can be used to optimize the solution. The Bayesian estimation algorithm can further improve the quality of the solution by adjusting the parameters of the solution. In the Bayesian estimation algorithm, the MDL score can be used as prior information, and the posterior probability can be calculated in combination with the parameters of the current solution to obtain a more accurate solution. Finally, the above steps are repeated until the global optimal solution is found or a certain number of iterations is reached. By combining the hill climbing search directional algorithm and the Bayesian estimation algorithm with the MDL score, the search process can be effectively optimized and the accuracy and quality of the solution can be improved.

[0078] Specifically, the hill climbing search directional method based on MDL scoring and the Bayesian estimation parameter learning method can be used to perform directional and factor node parameter learning on the causal graph generated in the third step. Other causal directional and parameter learning methods can also be used. The hill climbing search method and maximum likelihood estimation method are used in this experiment.

[0079] Specifically, the MDL scoring function for the hill climbing search directional algorithm is defined as:

[0080]

[0081] in The term describes the goodness of fit of the data, n is the number of features, Pa(X j ) represents feature X j The parent node of , NLL represents each scoring family, represents the optimal parameter, which is get. It describes the complexity of the model structure, and m is the number of observation samples in the data.

[0082] A causal graph model for early warning of fraudulent accounts based on streaming learning methods can be used. Fraudulent account factors can be dynamically attached to the existing causal graph. If the fraudulent account factor library is expanded in the future, the expanded factors can be added to the existing model through learning, without having to relearn the entire model, which increases the cost of training and greatly reduces the cost of continuous operation of the system.

[0083] Specifically, the Bayesian parameter estimation method used in causal network parameter learning generates hyperparameters of the prior Dirichlet distribution of model parameters based on the prior data set, and then calculates the conditional probability of each node in the causal network taking different possible values ​​under the condition that the parent node set takes the value of the previous iteration result.

[0084] Through experimental comparison, after using the same fraud-related account factors, the anti-fraud risk warning device based on the streaming causal model proposed in this scheme has improved the accuracy of fraud warning by 7%-10% compared with traditional machine learning models (such as decision tree model, logistic regression, BP neural network, etc.); at the same time, the fraud-related account causal graph model with streaming learning has improved the time efficiency of model training by 18%-25% compared with the non-streaming model.

[0085] The embodiment of the present application also provides an anti-fraud early warning device based on causal analysis. It should be noted that the anti-fraud early warning device based on causal analysis of the embodiment of the present application can be used to execute the anti-fraud early warning method based on causal analysis provided by the embodiment of the present application. The device is used to implement the above-mentioned embodiments and preferred implementation modes, and those that have been described will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware for a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0086] The following is an introduction to the anti-fraud early warning device based on causal analysis provided in an embodiment of the present application.

[0087] Figure 4 is a structural block diagram of an anti-fraud early warning device based on causal analysis according to an embodiment of the present application. Figure 4 As shown, the device comprises:

[0088] A first acquisition unit 10 is used to acquire account-related data, wherein the account-related data includes one or more of personal data, transaction data and associated data, wherein the personal data includes at least one or more of age, occupation, education level and place of residence, the transaction data includes at least one or more of transaction frequency, transaction amount, transaction time and transaction method, and the associated data includes at least one or more of associated account, associated occupation and associated education level;

[0089] A first construction unit 20 is used to construct a directed causal graph according to the account-related data, wherein the directed causal graph includes a plurality of the account-related data and a causal pointing relationship between the plurality of the account-related data;

[0090] A second construction unit 30 is used to construct a first model, wherein the first model is obtained by training with a Bayesian estimation algorithm using multiple sets of training data, each set of training data in the multiple sets of training data includes a historical directed causal graph obtained in a historical time period, and a historical analysis result corresponding to the historical directed causal graph, wherein the historical analysis result is used to characterize whether a historical account corresponding to the historical directed causal graph will have a risk of fraud;

[0091] A first processing unit 40 is used to input the directed causal graph into the first model to obtain an analysis result corresponding to the directed causal graph;

[0092] The early warning unit 50 is used to generate early warning information when the above analysis results indicate that the account may be at risk of fraud.

[0093] Through this embodiment, a directed causal graph can be constructed based on account-related data. The directed causal graph can characterize the causal relationship between different account-related data. For example, older people may be defrauded, which may increase the transaction frequency, or the transaction amount of accounts in certain financial industries is larger. The model is constructed through this causal relationship. The Bayesian algorithm has strong explanatory power, can give probability values ​​to different results, and has a more accurate judgment of the data. Therefore, by learning the causal relationship between account-related data, when the model output may contain fraudulent behavior, timely early warning reminders of fraud risks can be issued, thereby reducing the risk of fraud.

[0094] During the specific implementation process, the first acquisition unit includes an acquisition module and a first processing module. The acquisition module is used to acquire initial account-related data, wherein the above-mentioned initial account-related data is the account-related data obtained at the initial moment; the first processing module is used to preprocess the above-mentioned initial account-related data to obtain the above-mentioned account-related data, wherein the preprocessing method includes one or more of discretization processing, quantification processing and normalization processing.

[0095] In this solution, by preprocessing the data, the influence of the data on subsequent content can be eliminated, and the validity and accuracy of the data can be guaranteed.

[0096] During the specific implementation process, the first construction unit includes a construction module, a second processing module and a third processing module. The construction module is used to construct a second model, wherein the second model is trained by streaming learning using multiple sets of training data, and each set of training data in the multiple sets of training data includes historical account-related data obtained within a historical time period and a historical undirected causal graph corresponding to the historical account-related data, wherein the historical undirected causal graph is the historical risk causes corresponding to the historical account-related data and the historical risk results corresponding to the historical account-related data; the second processing module is used to input the account-related data into the second model to obtain the undirected causal graph corresponding to the account-related data; the third processing module is used to orient the undirected causal graph using at least a hill climbing search algorithm to obtain the directed causal graph.

[0097] In this solution, machine learning training can be performed through streaming learning to obtain a second model. The second model can output an undirected causal graph corresponding to the account-related data. The undirected causal graph includes multiple causes and results, but the causes and results are not connected. Therefore, a hill climbing search algorithm is used to connect the causes and results to obtain a more accurate directed causal graph.

[0098] During the specific implementation process, the above-mentioned device also includes a second acquisition unit and a second processing unit. The second acquisition unit is used to obtain at least part of the above-mentioned account-related data before building the second model; the second processing unit is used to perform association analysis on at least part of the above-mentioned account-related data to obtain association analysis results, wherein the above-mentioned association analysis results are used to characterize the association relationship between at least part of the above-mentioned account-related data.

[0099] In this solution, correlation analysis can be performed on account-related data to determine whether there is correlation or redundancy between account-related data, and then the data can be screened subsequently to ensure that the amount of data when the causal graph is generated subsequently is small, further ensuring that the accuracy of the subsequent causal graph is better.

[0100] In some embodiments, the second processing unit includes a first calculation module and a first determination module, the first calculation module is used to use the Log-Likehood function to calculate the statistical value between the first account-related data and the second account-related data, wherein the first account-related data is one of the account-related data, and the second account-related data is one of the account-related data other than the first account-related data; the first determination module is used to determine that there is a correlation between the first account-related data and the second account-related data when the statistical value is greater than a preset statistical threshold, and obtain a first correlation analysis result.

[0101] In this solution, the Log-Likehood function can be used to analyze the correlation between data. Specifically, statistical values ​​can be used to express the strength of the correlation between account-related data, so that whether there is a correlation between data can be determined more accurately.

[0102] In some embodiments, the second processing unit includes a second calculation module and a second determination module, the second calculation module is used to calculate a first statistical value, a second statistical value and a third statistical value by using a Log-Likehood function, wherein the first statistical value is a statistical value between the first account-related data and the second account-related data, the second statistical value is a statistical value between the third account-related data and the second account-related data, the third statistical value is a statistical value between the first account-related data and the third account-related data, the first account-related data is one of the account-related data, the second account-related data is one of the account-related data other than the first account-related data, and the third account-related data is one of the account-related data other than the first account-related data and the second account-related data; the second determination module is used to determine that the third account-related data is redundant data of the first account-related data and the third account-related data is redundant data of the second account-related data when the first statistical value is greater than the second statistical value and the third statistical value is greater than the second statistical value, and obtain a second association analysis result.

[0103] In this solution, the Log-Likehood function can be used to analyze the redundancy between data. Specifically, statistical values ​​can be used to express the strength of the redundancy between account-related data, so that it can be more accurately determined whether there is redundancy between data.

[0104] In some embodiments, the third processing module includes a construction submodule and a processing submodule, the construction submodule is used to construct a third model, wherein the third model is obtained by training the first algorithm and the second algorithm using multiple sets of training data, each set of training data in the multiple sets of training data includes a historical undirected causal graph obtained within a historical time period, and a historical directed causal graph corresponding to the historical undirected causal graph, wherein the first algorithm is a hill climbing search directional algorithm based on MDL scoring, and the second algorithm is a Bayesian estimation algorithm; the processing submodule is used to input the undirected causal graph into the third model to obtain the directed causal graph corresponding to the undirected causal graph.

[0105] In this solution, the first algorithm and the second algorithm can be combined to perform machine learning training and construct a third model. The third model can be used to determine the directed causal graph corresponding to the undirected causal graph. The hill climbing search algorithm can be gradually optimized to find the optimal solution. The MDL score is used as a guide to reduce the search space and improve the search efficiency. The Bayesian estimation algorithm can combine prior knowledge and update the relationship through new data to make the constructed directed causal graph more in line with the actual situation. The combination of the first algorithm and the second algorithm can fully utilize the uncertainty capability of the Bayesian algorithm in the search process. At the same time, with the help of the search efficiency of the first algorithm, the optimal directed causal graph that conforms to both the data and the prior knowledge can be quickly found.

[0106] The above-mentioned anti-fraud early warning device based on causal analysis includes a processor and a memory. The above-mentioned first acquisition unit, the first construction unit, the second construction unit, the first processing unit and the early warning unit are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize the corresponding functions. The above-mentioned modules are all located in the same processor; or, the above-mentioned modules are located in different processors in the form of any combination.

[0107] The processor includes a kernel, which retrieves the corresponding program unit from the memory. One or more kernels can be set, and the problem that bank users are easily vulnerable to telecommunication fraud in the prior art can be solved by adjusting kernel parameters.

[0108] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0109] An embodiment of the present invention provides a computer-readable storage medium, which includes a stored program, wherein when the program is running, the device where the computer-readable storage medium is located is controlled to execute the anti-fraud warning method based on causal analysis.

[0110] An embodiment of the present invention provides a processor, which is used to run a program, wherein the anti-fraud warning method based on causal analysis is executed when the program is running.

[0111] An embodiment of the present invention provides a device, comprising a processor, a memory, and a program stored in the memory and executable on the processor, wherein when the processor executes the program, at least steps of an anti-fraud early warning method based on causal analysis are implemented. The device in this article may be a server, a PC, a PAD, a mobile phone, etc.

[0112] A computer program product includes a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the anti-fraud warning method based on causal analysis in each embodiment of the present application are implemented.

[0113] The present application provides an anti-fraud early warning system, comprising one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include a method for executing any one of the above-mentioned anti-fraud early warning methods based on causal analysis.

[0114] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0115] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0116] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0117] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0118] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0119] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0120] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0121] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0122] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0123] From the above description, it can be seen that the above embodiments of the present application achieve the following technical effects:

[0124] 1) The anti-fraud early warning method based on causal analysis of the present application can construct a directed causal graph based on account-related data. The directed causal graph can characterize the causal relationship between different account-related data. For example, older people may be defrauded, and the transaction frequency may increase, or the transaction amount of accounts in certain financial industries may be large. The model is constructed through this causal relationship. The Bayesian algorithm has strong explanatory power, can give probability values ​​to different results, and has a more accurate judgment of the data. Therefore, by learning the causal relationship between account-related data, when the model output may contain fraudulent behavior, timely early warning reminders of fraud risks can be issued, thereby reducing the risk of fraud.

[0125] 2) The anti-fraud early warning device based on causal analysis of the present application can construct a directed causal graph based on account-related data. The directed causal graph can characterize the causal relationship between different account-related data. For example, older people may be defrauded, and the transaction frequency may increase, or the transaction amount of accounts in certain financial industries may be large. The model is constructed through this causal relationship. The Bayesian algorithm has strong explanatory power, can give probability values ​​to different results, and has a more accurate judgment of the data. Therefore, by learning the causal relationship between account-related data, when the model output may contain fraudulent behavior, timely early warning reminders of fraud risks can be issued, thereby reducing the risk of fraud.

[0126] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. An anti-fraud early warning method based on causal analysis, characterized in that: include: Acquiring account-related data, wherein the account-related data includes one or more of personal data, transaction data, and associated data, wherein the personal data includes at least one or more of age, occupation, education level, and place of residence, the transaction data includes at least one or more of transaction frequency, transaction amount, transaction time, and transaction method, and the associated data includes at least one or more of associated accounts, associated occupations, and associated education level; Constructing a directed causal graph according to the account-related data, wherein the directed causal graph includes a plurality of the account-related data and a causal pointing relationship between the plurality of the account-related data; Constructing a first model, wherein the first model is obtained by training with a Bayesian estimation algorithm using multiple sets of training data, wherein each set of training data in the multiple sets of training data includes a historical directed causal graph obtained within a historical time period and a historical analysis result corresponding to the historical directed causal graph, wherein the historical analysis result is used to characterize whether a historical account corresponding to the historical directed causal graph will have a risk of fraud; Inputting the directed causal graph into the first model to obtain an analysis result corresponding to the directed causal graph; When the analysis result indicates that the account may be at risk of fraud, a warning message is generated.

2. The method according to claim 1, characterized in that Get account-related data, including: Acquire initial account-related data, wherein the initial account-related data is account-related data obtained at an initial moment; The initial account-related data is preprocessed to obtain the account-related data, wherein the preprocessing method includes one or more of discretization processing, quantification processing and normalization processing.

3. The method according to claim 1, characterized in that A directed causal graph is constructed based on the account-related data, including: Constructing a second model, wherein the second model is trained by streaming learning using multiple sets of training data, each set of training data in the multiple sets of training data includes historical account-related data acquired within a historical time period and a historical undirected causal graph corresponding to the historical account-related data, wherein the historical undirected causal graph is a historical risk cause corresponding to the historical account-related data and a historical risk result corresponding to the historical account-related data; Inputting the account-related data into the second model to obtain an undirected causal graph corresponding to the account-related data; At least a hill climbing search algorithm is used to orient the undirected causal graph to obtain the directed causal graph.

4. The method according to claim 3, characterized in that Before constructing the second model, the method further includes: obtaining at least part of the account-related data; Perform association analysis on at least part of the account-related data to obtain an association analysis result, wherein the association analysis result is used to characterize the association relationship between at least part of the account-related data.

5. The method according to claim 4, characterized in that Performing association analysis on at least part of the account-related data to obtain association analysis results, including: Using a Log-Likehood function, a statistical value between first account-related data and second account-related data is calculated, wherein the first account-related data is one of the account-related data, and the second account-related data is one of the account-related data except the first account-related data; When the statistical value is greater than a preset statistical threshold, it is determined that the first account-related data and the second account-related data are correlated, and a first correlation analysis result is obtained.

6. The method according to claim 4, characterized in that Performing association analysis on at least part of the account-related data to obtain association analysis results, including: A Log-Likehood function is used to calculate a first statistical value, a second statistical value, and a third statistical value, wherein the first statistical value is a statistical value between the first account-related data and the second account-related data, the second statistical value is a statistical value between the third account-related data and the second account-related data, and the third statistical value is a statistical value between the first account-related data and the third account-related data, the first account-related data is one of the account-related data, the second account-related data is one of the account-related data other than the first account-related data, and the third account-related data is one of the account-related data other than the first account-related data and the second account-related data; When the first statistical value is greater than the second statistical value, and the third statistical value is greater than the second statistical value, it is determined that the third account-related data is redundant data of the first account-related data, and the third account-related data is redundant data of the second account-related data, and a second association analysis result is obtained.

7. The method according to claim 3, characterized in that At least using a hill climbing search algorithm to orient the undirected causal graph to obtain the directed causal graph, including: Constructing a third model, wherein the third model is obtained by training the first algorithm and the second algorithm using multiple sets of training data, each set of training data in the multiple sets of training data includes a historical undirected causal graph obtained in a historical time period and a historical directed causal graph corresponding to the historical undirected causal graph, wherein the first algorithm is a hill climbing search directional algorithm based on MDL scoring, and the second algorithm is a Bayesian estimation algorithm; The undirected causal graph is input into the third model to obtain the directed causal graph corresponding to the undirected causal graph.

8. An anti-fraud early warning device based on causal analysis, characterized in that: include: A first acquisition unit is used to acquire account-related data, wherein the account-related data includes one or more of personal data, transaction data and associated data, wherein the personal data includes at least one or more of age, occupation, education level and place of residence, the transaction data includes at least one or more of transaction frequency, transaction amount, transaction time and transaction method, and the associated data includes at least one or more of associated account, associated occupation and associated education level; A first construction unit is configured to construct a directed causal graph according to the account-related data, wherein the directed causal graph includes a plurality of the account-related data and a causal pointing relationship between the plurality of the account-related data; A second construction unit is used to construct a first model, wherein the first model is obtained by training with a Bayesian estimation algorithm using multiple sets of training data, each set of training data in the multiple sets of training data includes a historical directed causal graph obtained within a historical time period and a historical analysis result corresponding to the historical directed causal graph, wherein the historical analysis result is used to characterize whether a historical account corresponding to the historical directed causal graph will have a risk of fraud; A first processing unit, configured to input the directed causal graph into the first model to obtain an analysis result corresponding to the directed causal graph; The early warning unit is used to generate early warning information when the analysis result indicates that the account may be at risk of fraud.

9. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the anti-fraud early warning method based on causal analysis described in any one of claims 1 to 7 are implemented.

10. An anti-fraud early warning system, characterized in that: include: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include a method for executing the anti-fraud early warning method based on causal analysis as described in any one of claims 1 to 7.

Images