Illegal transaction group identification method and device, equipment, storage medium and product

Abstract

The invention discloses an illegal transaction group identification method and device, equipment, a storage medium and a product, relates to the technical field of data processing, and discloses an illegal transaction group identification method comprising the following steps: constructing a social network graph according to recharging information provided by a telephone charge recharging platform; performing loop iteration on the social network graph by using a community discovery algorithm, and dividing the main payment number in the social network graph into a plurality of communities; and screening out a suspicious illegal transaction group from the plurality of communities according to the distance between the associated main payment number in the user complaint order received by the telephone charge recharging platform and the main payment number in each community. Accurate identification, prevention and control of illegal transactions and illegal accounts are realized.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to methods, devices, equipment, storage media and products for identifying illegal trading groups. Background Art

[0002] At present, criminals conduct illegal transactions through phone bill payment. For example, ordinary users purchase phone bills through a third-party slow charging platform. The third-party slow charging platform collects a large number of main payment numbers, that is, illegal numbers, matches the ordinary user's phone bill payment order with the illegal transaction order, and finally returns the payment page of the ordinary user's phone bill payment order to the criminals to recharge the illegal transaction amount. In order to avoid such illegal transactions, it is necessary to identify and prevent these illegal transactions. In the related technology, by making a rule judgment for each transaction and deciding whether to intercept the transaction based on the judgment result, the illegal transaction can be identified and prevented from the source through simple configuration. For example, the rule here can be that the number of paid numbers associated with the same main payment number within 24 hours is greater than or equal to 10, and the transaction is rejected when the main payment number is traded for the 11th time. However, this rule is easy to be circumvented, which is not conducive to the accurate identification and prevention of illegal transactions and illegal accounts. Summary of the invention

[0003] The main purpose of this application is to provide a method, device, equipment, storage medium and product for identifying illegal trading groups, aiming to achieve accurate identification and prevention of illegal transactions and illegal accounts.

[0004] To achieve the above purpose, the present application proposes a method for identifying illegal trading groups, the method comprising:

[0005] A social network graph is constructed according to the recharge information provided by the phone charge recharge platform, wherein each node of the social network graph corresponds to a main payment number, and a connection edge between two nodes represents a connection relationship between the two main payment numbers, and a weight of the connection edge is determined according to the paid numbers, payment accounts and device information associated with the two main payment numbers;

[0006] Dividing the main payment numbers in the social network graph into multiple communities using a community discovery algorithm;

[0007] Suspicious illegal transaction groups are screened out from the plurality of communities according to the distance between the main payment number associated with the user complaint order received by the phone charge recharge platform and the main payment number in each of the communities.

[0008] In one embodiment, the step of dividing the main payment number in the social network graph into multiple communities by using a community discovery algorithm includes:

[0009] Merge the nodes in the initial social network graph with their adjacent nodes in sequence;

[0010] Calculating the maximum modularity gain of the node and each of its adjacent nodes, and based on the maximum modularity gain, acquiring an adjacent node with the maximum modularity gain from each of the adjacent nodes of the node;

[0011] Move the node to the community where its corresponding adjacent node with the largest modularity gain is located;

[0012] Compress all nodes in each current community into a new node;

[0013] Constructing a new social network graph according to the compressed new nodes, and iterating the new social network graph in a loop using a community discovery algorithm;

[0014] When it is detected that the community discovery algorithm reaches a set iteration termination condition, the cyclic iteration of the social network graph is stopped, and the multiple communities finally divided are output.

[0015] In one embodiment, the step of sequentially merging the nodes in the initial social network graph with each of its adjacent nodes includes:

[0016] Counting the connection edges corresponding to each node in the initial social network;

[0017] Determine the node degree corresponding to each node according to the connection edges corresponding to each node;

[0018] Nodes with node degrees less than a preset value are deleted, and the remaining nodes in the initial social network graph are merged with their adjacent nodes in turn.

[0019] In one embodiment, the step of sequentially merging the nodes in the initial social network graph with each of its adjacent nodes includes:

[0020] Counting the connection edges corresponding to each node in the initial social network;

[0021] Determine the node degree corresponding to each node according to the connection edges corresponding to each node;

[0022] If the node degree of a node and the node degree of a neighboring node of the node are both greater than or equal to a preset value, the node is moved to the community where the neighboring node is located.

[0023] In one embodiment, after the step of screening out suspicious illegal transaction groups from a plurality of communities according to the distance between the main payment number associated with the user complaint order received by the phone charge recharge platform and the main payment number in each of the communities, the step further includes:

[0024] Determine the relationship between each of the suspected illegal trading groups and the illegal trading groups of the illegal trading orders;

[0025] Determine the risk value of each of the suspected illegal transaction groups according to the association relationship;

[0026] Determine a target risk value according to the risk value of the current transaction and the risk value of the suspected illegal transaction group to which the current transaction belongs;

[0027] A target risk strategy is determined according to the target risk value.

[0028] In one embodiment, the step of determining the risk value of each of the suspected illegal transaction groups according to the association relationship includes:

[0029] If the number of the suspected illegal trading group and the illegal trading group of the illegal trading order that is once associated is greater than a first preset number, determining the risk value of the suspected illegal trading group to be a first risk value;

[0030] If the number of first-degree connections between the suspected illegal trading group and the illegal trading group of the illegal trading order is greater than the second preset number and less than or equal to the first preset number, and the number of second-degree connections or more is greater than the second preset number, the risk value of the suspected illegal trading group is determined to be the second risk value;

[0031] If the number of first-degree connections between the suspected illegal trading group and the illegal trading group of the illegal trading order is greater than the third preset number and less than or equal to the second preset number, and the number of second-degree connections or more is greater than the third preset number and less than or equal to the second preset number, determine that the risk value of the suspected illegal trading group is the third risk value;

[0032] Among them, the first preset number, the second preset number and the third preset number decrease in sequence.

[0033] In addition, to achieve the above purpose, the present application also proposes a device for identifying a group of illegal transactions, the device for identifying a group of illegal transactions comprising:

[0034] A network construction module is used to construct a social network graph according to the recharge information provided by the phone charge recharge platform, wherein each node of the social network graph corresponds to a main payment number, and a connection edge between two nodes represents a connection relationship between the two main payment numbers, and a weight of the connection edge is determined according to the paid numbers, payment accounts and device information associated with the two main payment numbers;

[0035] A community division module, used to divide the main payment numbers in the social network graph into multiple communities using a community discovery algorithm;

[0036] The screening module is used to screen out suspicious illegal transaction groups from multiple communities according to the distance between the main payment number associated with the user complaint order received by the phone charge recharge platform and the main payment number in each community.

[0037] In addition, to achieve the above-mentioned purpose, the present application also proposes a device for identifying illegal trading groups, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, and the computer program is configured to implement the steps of the method for identifying illegal trading groups as described above.

[0038] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and stores a computer program on the storage medium. When the computer program is executed by a processor, the steps of the method for identifying illegal trading groups as described above are implemented.

[0039] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the method for identifying illegal trading groups as described above are implemented.

[0040] This application constructs a social network graph based on the recharge information provided by the phone charge recharge platform, and uses a community discovery algorithm to divide the main payment numbers in the social network graph into multiple communities; based on the distance between the main payment number associated with the user complaint order received by the phone charge recharge platform and the main payment number in each of the communities, suspicious illegal transaction groups are screened out from the multiple communities. Among them, the community discovery algorithm implements community division, can accurately identify the community structure in the network, and determine the community to which each main payment number belongs, and thus can effectively discover suspicious illegal transaction groups in the social network graph. And the weight of the connection edge between the two nodes is determined based on the paid number, payment account and device information associated with the two main payment numbers, that is, the weight of the connection edge between the two nodes is determined based on the device information of multiple dimensions, so that the weight of the connection edge between the two nodes is more accurate, and the suspicious illegal transaction groups finally screened out are more accurate. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0042] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0043] Figure 1 A flow chart of the first embodiment of the method for identifying illegal trading groups in this application;

[0044] Figure 2 A flow chart of the second embodiment of the method for identifying illegal trading groups of this application;

[0045] Figure 3 A brief flow chart of the second embodiment of the present invention is provided;

[0046] Figure 4 Another simplified flow chart of the second embodiment of the present invention;

[0047] Figure 5 A flow chart of the third embodiment of the method for identifying illegal trading groups of this application;

[0048] Figure 6 This is a functional module diagram of a device for identifying illegal trading groups according to an embodiment of the present application;

[0049] Figure 7 It is a schematic diagram of the structure of the device for identifying illegal trading groups in the embodiment of the present application.

[0050] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0051] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0052] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0053] In the related art, by making rule judgments for each transaction and deciding whether to intercept the transaction based on the judgment results, it is possible to identify and prevent illegal transactions from the source through simple configuration. For example, the rule here can be that the number of paid numbers associated with the same main payment number within 24 hours is greater than or equal to 10, and the transaction is rejected when the transaction is made with the main payment number for the 11th time. However, this rule is easy to circumvent, which is not conducive to the accurate identification and prevention of illegal transactions and illegal accounts. For example, the number of paid numbers associated with the same main payment number is controlled to less than 10 times in 24 hours, and then the main payment number is changed. It only needs to prepare enough main payment numbers. By circumventing in this way, the accuracy of identification and prevention of illegal transactions and illegal accounts is reduced.

[0054] In response to the above-mentioned defects, the present application proposes a method for identifying illegal transaction groups, and the main technical solutions include: constructing a social network graph based on the recharge information provided by the phone charge recharge platform, wherein each node of the social network graph corresponds to a main payment number, and the connecting edge between two nodes represents the connection relationship between the two main payment numbers, and the weight of the connecting edge is determined according to the paid numbers, payment account and device information associated with the two main payment numbers; using a community discovery algorithm to divide the main payment numbers in the social network graph into multiple communities; based on the distance between the main payment number associated with the user complaint order received by the phone charge recharge platform and the main payment number in each of the communities, screening out suspicious illegal transaction groups from the multiple communities.

[0055] The community discovery algorithm can accurately identify the community structure in the network and determine the community to which each main payment number belongs, thereby effectively discovering suspicious illegal transaction groups in the social network graph. The weight of the connection edge between the two nodes is determined based on the paid number, payment account and device information associated with the two main payment numbers, that is, the weight of the connection edge between the two nodes is determined based on the device information of multiple dimensions, making the weight of the connection edge between the two nodes more accurate, and making the suspicious illegal transaction groups finally screened out more accurate.

[0056] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, an identification device for illegal trading groups, etc. The following takes the identification device for illegal trading groups as an example to illustrate this embodiment and the following embodiments.

[0057] The application scenario of the present application may be: currently, payment of phone bills is used by gambling groups as an important tool for money laundering. It mainly requires some intermediate numbers (main payment numbers) to place orders through the payment interface, and then match them with the gambling orders. Finally, the payment page of the payment order is returned to the gambler for recharging the gambling funds (phone bills). The platform that matches the payment order and the gambling order is a third-party slow charging platform. The third-party slow charging platform requires a large number of intermediate numbers (main payment numbers) to place orders for payment of phone bills. The present application mainly identifies the intermediate numbers provided by the third-party slow charging platform through a community discovery algorithm, and cracks down on a certain intermediate link of the illegal group to prevent the entire behavior of using payment of phone bills to violate regulations. Specifically, this application conducts community discovery based on information such as the place of origin of the main payment number, the main payment device, the main payment address, the main payment order submission time, the place of origin of the main payment address, the paid number, the place of origin of the paid number, the payment account, the payment associated number, the payment address, the payment device fingerprint, the calling behavior of the main payment number, the paid number and the number associated with the payment account, etc., to obtain the intermediate number belonging to the same community, and then associate the intermediate number of the same community with the complaint data to determine that the group discovered in the community is a group that violates the payment regulations, thereby solving the point-to-surface problem in risk prevention and control and increasing the intensity of crackdown on violating groups.

[0058] It should be noted that some of the terms involved in this application are introduced one by one as follows:

[0059] Main payment numbers: A large number of black and gray numbers of mobile phones on third-party slow charging platforms.

[0060] Numbers subject to recharge: ordinary users who purchase slow recharge services on platforms that provide recharge services.

[0061] Payment account: The account used by gamblers to pay gambling money.

[0062] Payment Number: The number associated with the account that the gambler uses to pay for gambling.

[0063] Node degree: the number of edges associated with the node.

[0064] Modularity: It is calculated by calculating the ratio between the number of edges within the community and the number of edges in the entire network, assessing the tightness of the connections within the community relative to the connections between communities.

[0065] Modularity gain: measures the amount of change in modularity when moving a node from one community to another.

[0066] First-degree association: First-degree association refers to how many other nodes a node is adjacent to.

[0067] Second-degree association: The second-degree association refers to the number of nodes adjacent to a first-degree node as the center point.

[0068] It should be noted that the community discovery algorithm of the present application is a type of algorithm used to identify community structures in a network or graph, that is, a set of nodes with dense internal node connections and sparse external connections. The community discovery algorithm used in the present application can be any of the following:

[0069] 1. Splitting-based algorithms: Girvan-Newman (GN) algorithm: This algorithm splits communities by iteratively removing the edges with the highest betweenness in the network. Edge betweenness refers to the number of paths that pass through the edge among all the shortest paths in the network. As high-betweenness edges are removed, communities in the network gradually emerge.

[0070] 2. Louvain algorithm: This is a heuristic algorithm based on modularity optimization. The algorithm first considers each node as an independent community, and then iteratively merges nodes to maximize modularity, which is the ratio of internal connections to external connections of the network. Louvain algorithm is popular for its efficiency and scalability. Or, Leiden algorithm: As an improved version of Louvain algorithm, Leiden algorithm solves the problem that Louvain algorithm may produce different results when running multiple times while optimizing modularity.

[0071] 3. Label Propagation Algorithm (LPA): This algorithm discovers community structure through label propagation. Each node is assigned a label representing the community it belongs to. Then, the node updates its own label based on the labels of its neighbor nodes, usually choosing the label that appears most frequently among the neighbors. This process is repeated until the label of each node no longer changes. The LPA algorithm is simple and computationally efficient, but it may be unstable and does not support the division of overlapping communities.

[0072] 4. Random walk algorithm: This algorithm is based on the idea of ​​random walk, which believes that it is easier to get stuck in a community when doing random walks within it. The algorithm merges similar communities by calculating the similarity between nodes (based on the probability of random walks).

[0073] 5. Spectral clustering algorithm: Spectral clustering algorithm maps the nodes in the network into a metric space and divides the community by the similarity of the nodes. This method usually uses the eigenvectors of the adjacency matrix for clustering.

[0074] 6. Hierarchical clustering algorithm: including agglomerative algorithm and divisive algorithm. The agglomerative algorithm starts from a single node and gradually merges similar nodes or communities; while the divisive algorithm starts from the entire network and gradually removes weakly connected edges to split the community.

[0075] The subsequent embodiments of this application take the Louvain algorithm as an example. The advantage of the Louvain algorithm is that it can divide the network into communities with optimal modularity in a short time. From the analysis, it can be seen that when dealing with social networks in the real world, the connections between network nodes are mostly social connections between two nodes in a short period of time. However, during the first round of iterations, the Louvain algorithm will move each node to all neighboring nodes in turn. Such paired nodes will calculate the modularity of the corresponding community during one round of iterations of the algorithm, reducing the efficiency of the algorithm. Therefore, this application proposes an improved Louvain algorithm based on preprocessing based on the actual situation of community division, which not only ensures the quality of community division, but also improves efficiency.

[0076] Based on the above content, the present application embodiment provides a method for identifying illegal trading groups. Figure 1 , Figure 1 This is a flow chart of the first embodiment of the method for identifying illegal trading groups of the present application.

[0077] In this embodiment, the method for identifying illegal trading groups includes steps S10 to S30:

[0078] Step S10, constructing a social network graph according to the recharge information provided by the phone charge recharge platform, wherein each node of the social network graph corresponds to a main payment number, and a connection edge between two nodes represents a connection relationship between the two main payment numbers, and a weight of the connection edge is determined according to the paid numbers, payment accounts and device information associated with the two main payment numbers;

[0079] It should be noted that the above number can be a mobile phone number.

[0080] It should be noted that the phone bill recharge platform is a third-party slow charging platform.

[0081] It should be noted that the recharge information may be data of different dimensions such as the main payment number, the paid number, the payment account number, and the device information used in the recharge process.

[0082] The process of constructing a social network graph based on the recharge information provided by the phone recharge platform usually involves defining the elements of the graph (vertices / nodes and edges) and the relationships between them. The following is the specific process of constructing a social network graph based on the recharge information provided by the phone recharge platform:

[0083] (1) Determine the type of social network graph: It is necessary to clarify whether the graph to be constructed is a directed graph or an undirected graph, and whether it is weighted. These characteristics will affect the representation of the graph and the choice of subsequent algorithms.

[0084] Directed graph: The edges in the graph have directionality, that is, they point from one vertex to another.

[0085] Undirected graph: The edges in the graph have no direction and can be passed in both directions.

[0086] Weighted graph: The edges or vertices in the graph are associated with weights.

[0087] (2) Define the vertex set: Determine the set of all vertices in the graph. Vertices can be principal numbers.

[0088] (3) Define edge sets: Define edge sets based on the relationships between vertices. Edges can be directed or undirected, depending on your needs. If the graph is weighted, you also need to assign a weight value to each edge.

[0089] (4) Select the graph representation method: Select the appropriate representation method based on the characteristics of the graph and the application scenario. Common graph representation methods include adjacency matrix and adjacency list.

[0090] Adjacency matrix: A two-dimensional array is used to represent a graph, where the rows and columns of the array correspond to the vertices in the graph. If there is an edge between vertex i and vertex j, the array element [i][j] is 1 (for an unweighted graph) or the weight of the edge (for a weighted graph); otherwise, it is 0 (for an unweighted graph) or a value representing infinity (such as ∞, for a weighted graph with no edges connecting the vertices).

[0091] Adjacency list: A graph is represented using a data structure such as an array or a linked list. Each vertex corresponds to a list that stores the vertices adjacent to the vertex and their weights (if the graph is weighted). An adjacency list is more space-efficient than an adjacency matrix, especially for sparse graphs.

[0092] (5) Build a graph representation: Based on the previously defined vertex set, edge set, and selected representation, build a graph representation. If an adjacency matrix is ​​used, fill the matrix based on the relationships between vertices. If an adjacency list is used, create a list for each vertex and add adjacent vertices and weights based on the edge set.

[0093] (6) Verify the correctness of the graph: After construction is complete, verify the correctness of the graph. This usually includes checking whether the number of vertices and edges is as expected, and whether the edges correctly connect the vertices.

[0094] In this embodiment, the social network graph can be stored in the form of an adjacency matrix. Specifically, there is an adjacency matrix A, where A ij =1 means that there is an edge connecting node i and node j, and A ij = 0 means there is no edge connection between node i and node j. Among them, the self-connection between the node itself is 0, that is, A ii =1, the edge between itself and itself is not considered.

[0095] If the community discovery algorithm can divide a network into k communities after calculation, define a k*k matrix e, where e ij represents the ratio of the number of edges connecting community i and community j to the total number of edges in the community, e ii It represents the ratio of the number of edges between community i and community i to the total number of edges in the community, that is, the ratio of the number of edges between nodes in community i to the total number of edges in the community. After establishing a social network using data of different dimensions such as the main payment number, the paid number, the payment account, and the device information, a social network graph G(V, E) is constructed. The main payment number is used as a node of the graph, and each node is associated through the associated paid number, payment account, device information and other data dimensions.

[0096] It should be noted that the number of transactions associated with the main payment number to describe the change in the number of transactions of the paid number associated with the main payment number within a certain period of time is an index reflecting the comprehensive change in the number of paid numbers associated with the main payment number. In this application, the monthly association of the main payment number with the paid number is used as the measurement condition, and the formula for the daily change of the main payment number associated with the paid number is:

[0097]

[0098] Among them, t i (r) represents the number of paid numbers associated with the main payment number i on the rth day, S avg It indicates the monthly average value of the main payment number associated with the paid number. At the same time, other information of the main payment number, paid number and payment account (this information is the above-mentioned device information) needs to be considered: the device associated with the main payment number, IP address and attributes, IP location, number geographical distribution, transaction time, number associated with the payment account, payment account device fingerprint, payment account IP address and attributes, IP location, payment and order time difference, main payment number, paid number and payment number The number of calls, therefore, the following parameters are used to describe the characteristics of the merchant:

[0099] (1) Device information associated with the main payment number: Since the main payment number is provided by a third-party slow charging platform, it needs to perform large-scale operations, and there may be duplicate device fingerprints on the device or the device corresponding to the main payment number may be modified by tampering with the device fingerprint through the machine software, using a virtual machine or root permissions, changing the browser, etc. The device fingerprint corresponding to the main payment number and the key elements associated with the device fingerprint constitute the device characteristics of the main payment number. This feature is optional and is related to whether each business system can obtain the device fingerprint.

[0100] (2) IP address and attributes of the main payment number: Since the main payment number is provided by the third-party slow charging platform, in order to circumvent the risk control rules of the main payment number IP aggregation, the third-party slow charging platform generally uses proxy IP or second-dial IP and other technologies. The risk profile of the main payment number IP can be portrayed by the consistency between the number location and the IP location and the second-dial IP identification technology.

[0101] (3) Geographical distribution of main payment numbers: Since the main payment numbers are provided by third-party slow charging platforms, third-party slow charging platforms generally obtain numbers through purchase. These numbers often belong to the same province or are scattered in several provinces, which is inconsistent with the national distribution characteristics of the payment service.

[0102] (4) Order time for main payment number: The order for main payment number is placed through a third-party slow charging platform. The order time and trend distribution of the order are basically consistent with the time distribution of gamblers participating in gambling. That is, there is a peak from 8 pm to early morning and on holidays, which is inconsistent with the overall payment trend of the phone bill payment business.

[0103] (5) Numbers associated with the payment account: Since the main payment number is the number provided by the third-party slow charging platform, the payment number is the number associated with the gambler when making payments. Illegal transactions are carried out by paying phone bills. There are obvious inconsistencies between the main payment number and the payment number, and the number ownership is also inconsistent. In addition, the payment number performs recharge transactions for multiple numbers within a period of time, and the recharge users basically do not overlap, which is quite different from normal recharge users.

[0104] (6) Payment number device fingerprint: Since the main payment number is the number provided by the third-party slow charging platform, and the payment number is the number associated with the gambler when making payment, the device fingerprint corresponding to the payment number is inconsistent with the device fingerprint corresponding to the main payment number, and the device fingerprint corresponding to the payment number does not show the risk factors of aggregation and tampering, and the device fingerprint associated with the payment number in the past 30 days is the same device fingerprint, which is significantly different from the device fingerprint of the main payment number.

[0105] (7) Payment account IP address and attributes: Since the main payment number is the number provided by the third-party slow charging platform, the payment number is the number associated with the gambler when making a payment. The IP associated with the payment account is the normal IP at the time of payment, which is usually consistent with the number’s location at the time of payment. The number associated with this IP is relatively fixed over a period of time. The IP address is generally a normal IP, and the IP at the time of payment is inconsistent with the IP of the main payment number, and the location is also inconsistent.

[0106] (8) Time difference between payment and order placement: Since the main payment number is the number provided by the third-party slow charging platform, and the payment number is the number associated with the gambler's payment, the gambling funds are laundered by paying the phone bill, which requires a third party to match the order. When the order process is completed, the normal transaction directly pulls up the payment page for payment. However, this process requires the third-party platform to match the order, so the time interval between the order and payment of the money laundering order will be much longer than the time interval of the normal order.

[0107] (9) Communication characteristics of the main payment number, the number being paid, and the payment number: The numbers of each normal payment number will have intersections in the call records, but the numbers of the parties who use the payment to launder gambling funds do not have any transactions in the communication records, which does not conform to the logic of normal recharge.

[0108] (10) Payment number payment behavior and consumption behavior: The payment number corresponds to a gambler, who will make high-frequency recharge payments over a certain period of time. However, the balance and phone bill consumption behavior of the operator corresponding to the number do not show obvious abnormalities, that is, the recharge and consumption behaviors are inconsistent.

[0109] (11) Online behavior of the payment number: The payment number corresponds to a gambler. Through the operator's DPI data analysis, it was found that the payment number had browsed, downloaded or used gambling apps in the recent period, which is consistent with the recharge behavior characteristics of the number.

[0110] (12) Communication behavior of the main payment number: Since the main payment number is provided by a third-party slow charging platform, analysis shows that the communication behavior of this number is significantly different from that of normal numbers in terms of operator phone charge recharge, calls, and Internet access.

[0111] (13) Communication behavior of the paid number: This is a user number that normally needs to be recharged. Through analysis, it is found that this number has the characteristics of a normal number in use in terms of phone recharge, calls, and Internet access on the operator side, and there is no intersection in the call behavior with the main paid number and the payment number. In addition, the analysis of the user's Internet behavior does not show any behavioral characteristics of recently visiting or downloading gambling websites and apps.

[0112] Based on the above description, the input vector is:

[0113]

[0114] in, Indicates the main payment number of the transaction. Indicates the paid number of the transaction, Indicates the payment number of this transaction. Indicates the order time associated with this transaction. Indicates the payment time of the transaction. The device fingerprint representing the primary payment number, Indicates the IP information of the main payment number. The device fingerprint representing the payment number, Indicates the IP information of the payment number, Indicates the communication and consumption behavior of the transaction payment number. Indicates the communication behavior of the main payment number. Indicates the communication behavior of the seized number. Indicates the online behavior of the payment number. Device fingerprint related variables are optional variables, which are used as standards based on whether different business systems can obtain them. This is a required field and is the main risk feature of this identification method.

[0115] This embodiment builds a system to identify the main paying number group based on the characteristics of the paid number, the main paying number, and the payment account, so as to combat illegal activities of violating regulations by paying phone bills.

[0116] Step S20, using a community discovery algorithm to divide the main payment numbers in the social network graph into multiple communities;

[0117] The community discovery algorithm can be used to iterate the social network graph in a loop to divide the main payment numbers in the social network graph into multiple communities. The specific process is as follows:

[0118] (1) Each main payment number in the social network graph is regarded as an independent community, that is, each node belongs to a separate community.

[0119] (2) For each main payment number, try to divide it into the community where its neighboring nodes are located. Calculate the change in modularity before and after each division. If the modularity is greater than 0, it means that the modularity is improved after the division, and the division is accepted; otherwise, keep it as it is. Repeat this process until the community affiliation of all nodes no longer changes.

[0120] (3) Treat the communities divided in the first step as new nodes and construct a new network graph. In the new graph, the weight of the edge between super nodes is equal to the sum of the weights of all edges between the corresponding communities in the original graph. Repeat the process of the modularity optimization stage, but this time operate on the new network graph.

[0121] (4) Repeat the modularity optimization stage and the network cohesion stage until the structure of the entire network no longer changes, that is, the modularity can no longer be improved by community merging.

[0122] (5) Each main payment number is divided into a specific community, forming a multi-community structure.

[0123] It should be noted that the performance and effect of the Louvain algorithm may be affected by many factors such as the scale of the social network graph, sparsity, and the weights of nodes and edges. The results of the algorithm may be affected by the initial conditions, that is, different initial community divisions may lead to different final division results. Therefore, in practical applications, it may be necessary to run the algorithm multiple times to obtain stable division results.

[0124] Through the above steps, the Louvain algorithm can be used to iteratively divide the main payment numbers in the social network graph to form multiple community structures, thereby revealing hidden communities and relationship patterns in the social network.

[0125] Step S30, screening out suspicious illegal transaction groups from a plurality of the communities according to the distance between the main payment number associated with the user complaint order received by the phone charge recharge platform and the main payment number in each of the communities.

[0126] It should be noted that each community represents a group. Based on the output of different groups, combined with the information of the main payment number associated with the user complaint order received by the phone charge recharge platform, the distance between different groups and the main payment number in the user complaint order is calculated. When the calculated distance between the group and the main payment number in the user complaint order is less than or equal to a specific value, the group is defined as a suspicious illegal transaction group and the next step of manual verification is carried out.

[0127] This embodiment provides a method for identifying illegal transaction groups. The community discovery algorithm can accurately identify the community structure in the network and determine the community to which each main payment number belongs, thereby effectively discovering suspicious illegal transaction groups in the social network graph. The weight of the connection edge between two nodes is determined based on the paid number, payment account and device information associated with the two main payment numbers, that is, the weight of the connection edge between two nodes is determined based on device information of multiple dimensions, so that the weight of the connection edge between the two nodes is more accurate, and the suspicious illegal transaction groups finally screened out are more accurate.

[0128] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar content as the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated later. On this basis, the main payment number, the paid number and the payment number of the normal user who pays the phone bill are basically the same number or the main payment number and the paid number are inconsistent (normal recharge by others), which will show internal connectivity and external isolation in the risk factor association map. In the traditional Louvain algorithm, it is necessary to consider the modularity gain of these nodes moving to adjacent nodes, which will waste computing resources.

[0129] The improved algorithm of this application mainly consists of three parts. The first part is the preprocessing stage, and the second part is the first round of iteration of the algorithm. After the second part is completed, the number of nodes in the entire network community will be quickly classified into different communities, and the community containing many nodes will be redefined as the node of the community division in the next stage. After the processing of the second part, the number of nodes is sharply reduced. The community node division process carried out in the third part re-moves the new nodes to maximize the modularity gain. The computational complexity of this process is much smaller than that of the second part. In the actual operation process, the time efficiency of the improved algorithm is mainly measured by the processing of the second part.

[0130] Please refer to Figure 2 , step S20 includes steps S21 to S26, wherein steps S21 to S23 belong to the above-mentioned second part, and steps S24 to S26 belong to the above-mentioned third part.

[0131] Step S21, merging the nodes in the initial social network graph with their adjacent nodes in sequence; Each node in the initial social network graph is regarded as a separate community, and the social network graph is represented in the form of an adjacency matrix or adjacency table to facilitate rapid query of the connection relationship between nodes. Step S22, calculating the maximum modularity gain of the node and each of its adjacent nodes, and based on the maximum modularity gain, obtaining an adjacent node with the maximum modularity gain from each of the adjacent nodes of the node; When considering moving node i to the community where its neighbor node j is located, calculate the modularity gain ΔQ brought by this operation. This is usually calculated by comparing the modularity values ​​before and after the move. For each node i, traverse all its neighboring nodes j. For each neighboring node j, calculate the modularity gain after moving node i to the community where j is located. Find the maximum modularity gain and the corresponding neighboring node. Step S23, moving the node to the community where its corresponding adjacent node with the largest modularity gain is located; Remove node i from its current community and add it to the community of its neighboring nodes. Step S24, compressing all nodes of each current community into a new node; In the second stage, the divided communities are treated as new nodes in the network, and the weights of the connecting edges between the new nodes are obtained by the sum of the connecting weights of the connecting edges between the corresponding communities. The sum of the edge weights in the community is used as the weight of the new node, and the modularity gain calculation process is used again to calculate the positive gain generated when the node moves, and the cycle is repeated. The sum of the weights of the main payment number in the new node through the paid number, payment number, device fingerprint of the main payment number, whether the main payment IP and payment IP are consistent, etc. is used as the weight of the node and other nodes for further iterative calculation. Step S25, constructing a new social network graph according to the compressed new nodes, and performing cyclic iteration on the new social network graph using a community discovery algorithm; The new social network graph is iteratively updated by using the community discovery algorithm using the above steps S21 to S24. Step S26, detecting that the community discovery algorithm reaches a set iteration termination condition, stopping the loop iteration of the social network graph, and outputting a plurality of communities finally divided. The iteration termination condition may be set as follows: no larger value of the modularity gain appears, or the number of iterations reaches a set number. In this embodiment, the main payment numbers are divided into multiple communities through the Louvain algorithm, and then the main payment numbers belonging to the same community are determined according to the divided communities, so as to realize the identification and classification of the community to which the main payment numbers belong. In practical applications, the Louvain algorithm will generate useless node duplication calculations during the first round of iterations, increase the computational workload, and cause time efficiency lags for the division of large-scale networks. In particular, when discovering criminal groups, it is necessary to conduct community discovery research from a large amount of data. For such practical problem solving, it is necessary to propose corresponding improvements to the Louvain algorithm. The advantage of the Louvain algorithm is that it can divide the network into communities with optimal modularity in a short time. It can be seen from analysis that when dealing with social networks in the real world, the connections between network nodes are mostly social connections between two nodes in a short period of time. However, during the first round of iterations, the Louvain algorithm will move each node to all neighboring nodes in turn. Such two-to-two paired nodes will calculate the modularity of the corresponding community during one round of iterations of the algorithm, reducing the efficiency of the algorithm. Therefore, this application proposes an improved Louvain algorithm based on preprocessing for the actual situation of community division, which not only ensures the quality of community division, but also improves efficiency. That is, the following steps belong to the first part above. The main idea of ​​the preprocessing stage is to first calculate the node degree of each node, directly delete the node pairs that are only connected to each other, and merge the two nodes if there is a node degree greater than 1 in the node pairs that are connected to each other. Through preprocessing, the number of nodes in the network is reduced, thereby reducing the modularity gain calculation process of the second part of the Louvain algorithm and improving the efficiency of the algorithm. Specifically, the preprocessing process specifically includes the following steps S211~S214: Further, in one embodiment, referring to Figure 3 , step S21 includes steps S211 to S213: Step S211, counting the connection edges corresponding to each node in the initial social network; Step S212, determining the node degree corresponding to each node according to the connection edges corresponding to each node; Step S213, deleting nodes whose node degrees are less than a preset value, and sequentially merging the remaining nodes in the initial social network graph with their adjacent nodes. The nodes in the social network graph are stored in the form of an adjacency list, and the main payment number is stored as a node in the form of an adjacency list. Traverse all points, calculate the node degree d(i) of each node i, and store the result in a separate array. Take the main payment number as the node, and the dimensions such as the paid number, payment number, device fingerprint of the main payment number, and main payment IP associated with the main payment number as the edge of the node, and calculate the number of edges corresponding to each node as the degree of the node. According to the calculated node degree, if the node degree is 0, the node is directly eliminated as a separate community and no longer participates in the subsequent algorithm iteration process. Because if the node degree of the main payment number is 0, it means that the paid number and payment number associated with the main payment number are inconsistent with the behavior of the money laundering group. The node needs to be deleted to improve the calculation efficiency of subsequent steps. Further, see Figure 4 , step S21 includes step S211, step S212 and step S214: Step S211, counting the connection edges corresponding to each node in the initial social network; Step S212, determining the node degree corresponding to each node according to the connection edges corresponding to each node; Step S214: If the node degree of the node and the node degree of the neighboring node of the node are both greater than or equal to a preset value, the node is moved to the community where the neighboring node is located. It should be noted that the above preset value can be set to 1. According to the calculated node degree, if the node degree is 1, determine whether the degree of its neighbor node is 1. If it is 1, there is no need to calculate the modularity gain after the move, and directly merge the nodes into the same community, eliminating the modularity calculation process of the mobile node; if the degree of the neighbor node is not 1, it participates in the subsequent iterative calculation process. Because if the node degree corresponding to the main payment number is 1, it indicates that the main payment number is a normal recharge for others, and this type of number is classified into the same type of community, which improves the efficiency of algorithm calculation and the accuracy of group identification. After the processed nodes are classified into different communities, the modularity gain of the remaining nodes is calculated to make the nodes move in the direction with the maximum gain. The modularity gain of the main payment number with a node degree greater than 1 is calculated to ensure that the main payment number moves between communities in the local optimal situation each time. In this embodiment, by adding a new data preprocessing process, the merging efficiency of subsequent nodes is improved, which greatly solves the practical problem of low latency and high response of the risk control system. Based on the above embodiments of the present application, in the third embodiment of the present application, the same or similar contents as those in the above embodiments can be referred to the above introduction, and will not be described in detail later. Figure 5 , after step S30, further comprising steps S110 to S140: Step S110, determining the association relationship between each of the suspected illegal trading groups and the illegal trading groups of the illegal trading orders; The information such as the location of the principal payment number, the principal payment device, the principal payment IP, the time of submission of the principal payment order, the location of the principal payment IP, the paid number, the location of the paid number, the payment account, the payment associated number, the payment IP, the payment device fingerprint, the calling behavior between the principal payment number and the paid mobile phone number and the mobile phone number associated with the payment account corresponding to the suspicious illegal transaction group and the illegal transaction group of the illegal transaction order can be obtained, and based on this information, a risk factor association map between each suspicious illegal transaction group and the illegal transaction group of the illegal transaction order is constructed, and based on the risk factor association map, the association relationship between each of the suspicious illegal transaction groups and the illegal transaction group of the illegal transaction order is obtained. Step S120, determining the risk value of each of the suspected illegal transaction groups according to the association relationship; The association relationship may be a first degree association or a second degree association or more. Different association relationships correspond to different risk values ​​of suspicious illegal transaction groups. Step S130, determining a target risk value according to the risk value of the current transaction and the risk value of the suspicious illegal transaction group to which the current transaction belongs; The suspicious illegal transaction group that matches the current transaction is determined from the various suspicious illegal transaction groups determined above, that is, the suspicious illegal transaction group to which the current transaction belongs. The main payment number or payment number of the current transaction can be obtained, and the suspicious illegal transaction group that matches the current transaction is determined from the various suspicious illegal transaction groups determined above based on the main payment number or payment number. The risk value of the current transaction and the risk value of the suspicious illegal transaction group to which the current transaction belongs are added to obtain a target risk value. Step S140: determining a target risk strategy according to the target risk value. Different target risk strategies are configured according to different scores. For example, the target risk strategy can be face recognition, customer service password recognition, direct blocking, etc. In this embodiment, based on the verified illegal trading orders, the intrinsic correlation between risk factors is mined through the technology of association graphs, which effectively improves the risk control system's detection level for illegal trading orders, and improves the original single-point prevention and control to surface prevention and control. Furthermore, in one embodiment, an important means of determining whether phone bill recharge is money laundering is to verify with the paid users and paying users through customer service personnel whether the transactions of highly suspicious merchants every day are illegal transaction orders. Based on the high-risk suspicious main payment accounts and payment accounts verified daily by the phone bill recharge business, the main payment number and device determined as a gambling order, the number and device associated with the payment account and other information are used as points, and the suspicious illegal transaction groups identified by the community discovery algorithm are divided into different types through the association relationship, and the risk value corresponding to each type is different. The types of suspicious illegal trading groups and the risk value corresponding to each type include one of steps S121 to S123: Step S121, if the number of the suspected illegal trading groups and the illegal trading groups of the illegal trading order that are once associated is greater than a first preset number, determining the risk value of the suspected illegal trading group to be a first risk value; For example, the association between the suspected illegal trading group and the confirmed illegal trading order is calculated in terms of number, device, IP, etc. If the number of suspected illegal trading groups and illegal trading orders that are once associated is greater than 20, the risk value of the suspected illegal trading group is set to S1. The first preset number is 20, and the first risk value is set to S1. Step S122: if the number of first-degree associations between the suspected illegal trading group and the illegal trading group of the illegal trading order is greater than the second preset number and less than or equal to the first preset number, and the number of second-degree associations or more is greater than the second preset number, determine the risk value of the suspected illegal trading group to be the second risk value; For example, if the number of suspected illegal trading groups that are first-degree associated with illegal trading groups of confirmed illegal trading orders is less than 20 and greater than 10, and the number of second-degree or higher associated with illegal trading groups is greater than 10, the risk value of the suspected illegal trading group is set to S2. The second preset number is 10, and the second risk value is set to S2. Step S123, if the number of first-degree associations between the suspected illegal trading group and the illegal trading group of the illegal trading order is greater than the third preset number and less than or equal to the second preset number, and the number of second-degree associations or more is greater than the third preset number and less than or equal to the second preset number, determine that the risk value of the suspected illegal trading group is the third risk value; For example, if the number of first-degree associations between the suspected illegal trading group and the illegal trading group of the confirmed illegal trading order is less than 10 and greater than 5, and the number of second-degree associations or higher is less than 10 and greater than 5, the risk value of the suspected illegal trading group is set to S3. The third preset number is 5, and the second risk value is set to S3. The first preset number, the second preset number and the third preset number are successively reduced. The specific classification criteria mentioned in this section need to be specifically analyzed according to different business systems and specific risk situations. The output score of the association map is S value, where S1>S2>S3. In this embodiment, based on the high-risk suspicious main payment account and payment account verified daily by the phone bill recharge business, the main payment number and device determined as the gambling order, the number and device associated with the payment account and other information are used as points, and the suspicious illegal transaction groups identified by the community discovery algorithm are divided into different types through the association relationship. The risk value corresponding to each type is different, so that the risk value of different types of suspicious illegal transaction groups can be accurately judged, and the risk identification of suspicious illegal transaction groups is improved. It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the method for identifying illegal trading groups in the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application. This application also provides a device for identifying illegal trading groups, please refer to Figure 6 , the identification device of the illegal trading group includes: The network construction module 10 is used to construct a social network graph according to the recharge information provided by the phone charge recharge platform, wherein each node of the social network graph corresponds to a main payment number, and the connection edge between two nodes represents the connection relationship between the two main payment numbers, and the weight of the connection edge is determined according to the paid number, payment account and device information associated with the two main payment numbers; A community division module 20, configured to divide the main payment numbers in the social network graph into a plurality of communities using a community discovery algorithm; The screening module 30 is used to screen out suspicious illegal transaction groups from multiple communities according to the distance between the main payment number associated with the user complaint order received by the phone charge recharge platform and the main payment number in each community. Optionally, the community partitioning module 20 is also used to merge the nodes in the initial social network graph with their adjacent nodes in turn; calculate the maximum modularity gain of the node and its adjacent nodes, and based on the maximum modularity gain, obtain the adjacent node with the largest modularity gain from the adjacent nodes of the node; move the node to the community where its corresponding adjacent node with the largest modularity gain is located; compress all nodes in each current community into a new node; construct a new social network graph based on the compressed new nodes, and use the community discovery algorithm to iterate the new social network graph in a loop; detect that the community discovery algorithm reaches the set iteration termination condition, stop the loop iteration of the social network graph, and output the multiple communities finally divided. Optionally, the community partitioning module 20 is also used to count the connection edges corresponding to each node in the initial social network; determine the node degree corresponding to each node based on the connection edges corresponding to each node; delete nodes whose node degree is less than a preset value, and merge the remaining nodes in the initial social network graph with their adjacent nodes in turn. Optionally, the community partitioning module 20 is also used to count the connection edges corresponding to each node in the initial social network; determine the node degree corresponding to each node based on the connection edges corresponding to each node; if the node degree of a node and the node degree of a neighbor node of the node are both greater than or equal to a preset value, move the node to the community where the neighbor node is located. Optionally, the device for identifying the illegal transaction group also includes a risk strategy determination module, which is used to determine the association relationship between each of the suspected illegal transaction groups and the illegal transaction groups of the illegal transaction order; determine the risk value of each of the suspected illegal transaction groups based on the association relationship; determine the target risk value based on the risk value of the current transaction and the risk value of the suspected illegal transaction group to which the current transaction belongs; and determine the target risk strategy based on the target risk value. Optionally, the risk strategy determination module is used to determine that the risk value of the suspicious illegal trading group is a first risk value if the number of first-degree associations between the suspicious illegal trading group and the illegal trading group of the illegal trading order is greater than a first preset number; if the number of first-degree associations between the suspicious illegal trading group and the illegal trading group of the illegal trading order is greater than a second preset number and less than or equal to the first preset number, and the number of second-degree associations or more is greater than the second preset number, determine that the risk value of the suspicious illegal trading group is a second risk value; if the number of first-degree associations between the suspicious illegal trading group and the illegal trading group of the illegal trading order is greater than a third preset number and less than or equal to the second preset number, and the number of second-degree associations or more is greater than the third preset number and less than or equal to the second preset number, determine that the risk value of the suspicious illegal trading group is a third risk value; wherein, the first preset number, the second preset number and the third preset number decrease in sequence. The device for identifying illegal trading groups provided by the present application adopts the method for identifying illegal trading groups in the above-mentioned embodiment, and can realize accurate identification and prevention of illegal transactions and illegal accounts. Compared with the prior art, the beneficial effects of the device for identifying illegal trading groups provided by the present application are the same as the beneficial effects of the method for identifying illegal trading groups provided by the above-mentioned embodiment, and the other technical features of the device for identifying illegal trading groups are the same as the features disclosed in the above-mentioned embodiment method, which will not be described in detail here. The present application provides a device for identifying a group of illegal trading groups, and the device for identifying a group of illegal trading groups includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method for identifying a group of illegal trading groups in the above-mentioned embodiment one. Reference below Figure 7 , which shows a schematic diagram of the structure of the device for identifying illegal trading groups suitable for implementing the embodiments of the present application. The device for identifying illegal trading groups in the embodiments of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 7 The illustrated identification device for illegal trading groups is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application. like Figure 7 As shown, the identification device for illegal trading groups may include a processing device 1001 (such as a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the identification device for illegal trading groups are also stored. The processing device 1001, ROM1002 and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 1003 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 1009. The communication device 1009 can allow the identification device of the illegal trading group to communicate wirelessly or wired with other devices to exchange data. Although the figure shows the identification device of the illegal trading group with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively. In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed. The device for identifying illegal trading groups provided by the present application adopts the method for identifying illegal trading groups in the above embodiment, and can realize accurate identification and prevention of illegal transactions and illegal accounts. Compared with the prior art, the beneficial effects of the device for identifying illegal trading groups provided by the present application are the same as the beneficial effects of the method for identifying illegal trading groups provided by the above embodiment, and the other technical features of the device for identifying illegal trading groups are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here. It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner. The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims. The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the method for identifying illegal trading groups in the above-mentioned embodiment. The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0132] The computer-readable storage medium may be included in the identification device of the illegal trading group; or may exist independently without being assembled into the identification device of the illegal trading group.

[0133] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the identification device of the illegal transaction group, the identification device of the illegal transaction group: constructs a social network graph according to the recharge information provided by the phone charge recharge platform, each node of the social network graph corresponds to a main payment number, and the connection edge between two nodes represents the connection relationship between the two main payment numbers, and the weight of the connection edge is determined according to the paid numbers, payment account and device information associated with the two main payment numbers; divides the main payment numbers in the social network graph into multiple communities using a community discovery algorithm; and screens out suspicious illegal transaction groups from multiple communities according to the distance between the main payment number associated with the user complaint order received by the phone charge recharge platform and the main payment number in each of the communities.

[0134] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0135] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0136] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0137] The readable storage medium provided in this application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned method for identifying illegal trading groups, and can achieve accurate identification and prevention of illegal transactions and illegal accounts. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the method for identifying illegal trading groups provided in the above-mentioned embodiments, and will not be elaborated here.

[0138] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned method for identifying illegal trading groups when executed by a processor.

[0139] The computer program product provided by this application can realize accurate identification and prevention of illegal transactions and illegal accounts. Compared with the prior art, the beneficial effects of the computer program product provided by this application are the same as the beneficial effects of the method for identifying illegal transaction groups provided by the above embodiment, which will not be repeated here.

[0140] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A method for identifying illegal trading groups, characterized in that: The method comprises: A social network graph is constructed according to the recharge information provided by the phone charge recharge platform, wherein each node of the social network graph corresponds to a main payment number, and a connection edge between two nodes represents a connection relationship between the two main payment numbers, and a weight of the connection edge is determined according to the paid numbers, payment accounts and device information associated with the two main payment numbers; Dividing the main payment numbers in the social network graph into multiple communities using a community discovery algorithm; Suspicious illegal transaction groups are screened out from the plurality of communities according to the distance between the main payment number associated with the user complaint order received by the phone charge recharge platform and the main payment number in each of the communities.

2. The method according to claim 1, characterized in that The step of dividing the main payment numbers in the social network graph into multiple communities using a community discovery algorithm comprises: Merge the nodes in the initial social network graph with their adjacent nodes in sequence; Calculating the maximum modularity gain of the node and each of its adjacent nodes, and based on the maximum modularity gain, acquiring an adjacent node with the maximum modularity gain from each of the adjacent nodes of the node; Move the node to the community where its corresponding adjacent node with the largest modularity gain is located; Compress all nodes in each current community into a new node; Constructing a new social network graph according to the compressed new nodes, and iterating the new social network graph in a loop using a community discovery algorithm; When it is detected that the community discovery algorithm reaches a set iteration termination condition, the cyclic iteration of the social network graph is stopped, and the multiple communities finally divided are output.

3. The method according to claim 2, characterized in that The step of sequentially merging the nodes in the initial social network graph with each of its adjacent nodes comprises: Counting the connection edges corresponding to each node in the initial social network; Determine the node degree corresponding to each node according to the connection edges corresponding to each node; Nodes with node degrees less than a preset value are deleted, and the remaining nodes in the initial social network graph are merged with their adjacent nodes in turn.

4. The method according to claim 2, characterized in that The step of sequentially merging the nodes in the initial social network graph with each of its adjacent nodes comprises: Counting the connection edges corresponding to each node in the initial social network; Determine the node degree corresponding to each node according to the connection edges corresponding to each node; If the node degree of a node and the node degree of a neighboring node of the node are both greater than or equal to a preset value, the node is moved to the community where the neighboring node is located.

5. The method according to any one of claims 1 to 4, characterized in that After the step of screening out suspicious illegal transaction groups from a plurality of communities according to the distance between the main payment number associated with the user complaint order received by the phone charge recharge platform and the main payment number in each community, the method further includes: Determine the relationship between each of the suspected illegal trading groups and the illegal trading groups of the illegal trading orders; Determine the risk value of each of the suspected illegal transaction groups according to the association relationship; Determine a target risk value according to the risk value of the current transaction and the risk value of the suspected illegal transaction group to which the current transaction belongs; A target risk strategy is determined according to the target risk value.

6. The method according to claim 5, characterized in that The step of determining the risk value of each of the suspected illegal transaction groups according to the association relationship includes: If the number of the suspected illegal trading group and the illegal trading group of the illegal trading order that is once associated is greater than a first preset number, determining the risk value of the suspected illegal trading group to be a first risk value; If the number of first-degree connections between the suspected illegal trading group and the illegal trading group of the illegal trading order is greater than the second preset number and less than or equal to the first preset number, and the number of second-degree connections or more is greater than the second preset number, the risk value of the suspected illegal trading group is determined to be the second risk value; If the number of first-degree connections between the suspected illegal trading group and the illegal trading group of the illegal trading order is greater than the third preset number and less than or equal to the second preset number, and the number of second-degree connections or more is greater than the third preset number and less than or equal to the second preset number, determine that the risk value of the suspected illegal trading group is the third risk value; Among them, the first preset number, the second preset number and the third preset number decrease in sequence.

7. A device for identifying illegal trading groups, characterized in that: The device comprises: A network construction module is used to construct a social network graph according to the recharge information provided by the phone charge recharge platform, wherein each node of the social network graph corresponds to a main payment number, and a connection edge between two nodes represents a connection relationship between the two main payment numbers, and a weight of the connection edge is determined according to the paid numbers, payment accounts and device information associated with the two main payment numbers; A community division module, used to divide the main payment numbers in the social network graph into multiple communities using a community discovery algorithm; The screening module is used to screen out suspicious illegal transaction groups from multiple communities according to the distance between the main payment number associated with the user complaint order received by the phone charge recharge platform and the main payment number in each community.

8. A device for identifying illegal trading groups, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the method for identifying an illegal trading group according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the method for identifying an illegal trading group according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the method for identifying an illegal trading group according to any one of claims 1 to 6 are implemented.

Images