Risk transaction user identification method and device, equipment and storage medium

Abstract

The invention discloses a risk transaction user identification method and device, equipment and a storage medium, and is applied to the technical field of artificial intelligence. The method comprises the following steps: acquiring current transaction data and current user information of a to-be-identified user; inputting the current transaction data and the current user information into a risk user identification model obtained by pre-training for user transaction risk identification, and obtaining a risk transaction user identification result; wherein the risk user identification model is obtained by pre-training a preset identification network model by normal transaction sample data of normal transaction users and abnormal transaction sample data of abnormal transaction users; the abnormal transaction user is obtained by screening the historical transaction users according to the transaction time attribute information of the historical transaction users in the historical period. According to the technical scheme of the embodiment, the risk transaction user identification efficiency and identification accuracy are improved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a method, device, equipment and storage medium for identifying risky transaction users. Background Art

[0002] With the rapid development of network technology and the popularization of e-commerce, online transactions have become an indispensable part of people's daily lives. At the same time, transaction fraud is also increasing, seriously threatening the safe and stable operation of the financial system. Therefore, there is an urgent need for a method that can intelligently, efficiently and accurately identify risky transaction users to ensure the security and reliability of user fund transactions.

[0003] In recent years, the existing methods for identifying risky transaction users usually use model identification technology based on machine learning, which requires collecting a large number of transaction users and their related transaction data as model training sets. However, the existing technology is inefficient in the process of collecting transaction data, and the collected transaction data is too single, resulting in low accuracy and efficiency in identifying risky transaction users. Summary of the invention

[0004] The present invention provides a risky transaction user identification method, device, equipment and storage medium to improve the risky transaction user identification efficiency and identification accuracy.

[0005] According to one aspect of the present invention, a method for identifying risky transaction users is provided, the method comprising:

[0006] Obtain current transaction data and current user information of the user to be identified;

[0007] Inputting the current transaction data and the current user information into a pre-trained risk user identification model to perform user transaction risk identification, thereby obtaining a risk transaction user identification result;

[0008] Among them, the risk user identification model is obtained by pre-training a preset identification network model with normal transaction sample data of normal transaction users and abnormal transaction sample data of abnormal transaction users; the abnormal transaction users are obtained by screening the historical transaction users through the transaction time attribute information of historical transaction users in historical periods.

[0009] According to another aspect of the present invention, a risky transaction user identification device is provided, the device comprising:

[0010] A user information acquisition module, used to acquire the current transaction data and current user information of the user to be identified;

[0011] A transaction risk identification module, used for inputting the current transaction data and the current user information into a pre-trained risk user identification model to perform user transaction risk identification and obtain a risk transaction user identification result;

[0012] Among them, the risk user identification model is obtained by pre-training a preset identification network model with normal transaction sample data of normal transaction users and abnormal transaction sample data of abnormal transaction users; the abnormal transaction users are obtained by screening the historical transaction users through the transaction time attribute information of historical transaction users in historical periods.

[0013] According to another aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the risk transaction user identification method described in any embodiment of the present invention.

[0017] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the risk transaction user identification method described in any embodiment of the present invention when executed.

[0018] The technical solution of the present application improves the accuracy of risky transaction user identification by using a pre-trained risky user identification model to predict whether the user to be identified is a risky transaction user based on the transaction data and user information of the user to be identified. In the process of training the risky user identification model, the transaction time attribute information used for historical transactions is introduced to realize the automatic screening of abnormal transaction users, improve the screening efficiency, and improve the screening accuracy of abnormal transaction users, thereby improving the model training efficiency and model training accuracy of the risky user identification model, and further improving the accuracy of risky transaction user identification.

[0019] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 is a flow chart of a method for identifying risky transaction users provided according to the first embodiment of the present invention;

[0022] Figure 2 This is a schematic diagram of the structure of a method for identifying risky transaction users provided in accordance with Embodiment 2 of the present invention;

[0023] Figure 3 This is a schematic diagram of the structure of a risky transaction user identification device provided according to Embodiment 3 of the present invention;

[0024] Figure 4 It is a structural schematic diagram of an electronic device for implementing the risky transaction user identification method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] Embodiment 1

[0028] Figure 1This is a flow chart of a method for identifying risky transaction users provided in the first embodiment of the present invention. This embodiment can be applied to the situation of accurately and quickly identifying risky transaction users with transaction risks in the financial transaction process. The method can be executed by a risky transaction user identification device, which can be implemented in the form of hardware and / or software, and the risky transaction user identification device can be configured in an electronic device. Figure 1 As shown, the method includes:

[0029] S110: Acquire current transaction data and current user information of the user to be identified.

[0030] S120: Input the current transaction data and the current user information into a pre-trained risk user identification model to perform user transaction risk identification and obtain a risk transaction user identification result.

[0031] Among them, the risk user identification model is obtained by pre-training a preset identification network model with normal transaction sample data of normal transaction users and abnormal transaction sample data of abnormal transaction users; abnormal transaction users are obtained by screening historical transaction users through transaction time attribute information of historical transaction users in historical periods.

[0032] Among them, the user to be identified may be a user for whom transaction risk identification is to be performed; the current transaction data may include at least one of the data such as transaction records, transaction location, transaction address and transaction funds flow; the current user information may include at least one of the data such as account information, account balance, account holder and account status; among them, the account information may include the target name and target-related information of the target to which the account belongs; for example, the target may be an individual or a company, etc.

[0033] The current transaction data and current user information of the user to be identified are input into the pre-trained risk user identification model to identify the user transaction risk and obtain a risk transaction user identification result, wherein the risk transaction user identification result may include whether the user to be identified is a risk transaction user or a non-risk transaction user.

[0034] It should be noted that the information collected in this embodiment, such as the current transaction data and current user information of the user to be identified, is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0035] The risk user identification model is used to identify risky transaction users; the risk user identification model can be pre-trained by relevant technical personnel, and can be obtained by pre-training a preset identification network model based on a large number of historical transaction users in historical periods. The preset identification network model can be a random forest model, a decision tree model, or a multi-layer perceptron (MLP).

[0036] Specifically, the risk user identification model is obtained by pre-training a preset identification network model based on the normal transaction sample data of normal transaction users and the abnormal transaction sample data of abnormal transaction users. Among them, the normal transaction sample data of normal transaction users and the abnormal transaction sample data of abnormal transaction users can be screened from historical transaction users in historical time periods. In the process of screening abnormal transaction users, the transaction time attribute information of historical transaction users is combined to improve the screening accuracy of abnormal transaction users, and it can realize automatic screening of abnormal transaction users instead of manual screening, which improves the screening efficiency of abnormal transaction users.

[0037] The technical solution of the present application improves the accuracy of risky transaction user identification by using a pre-trained risky user identification model to predict whether the user to be identified is a risky transaction user based on the transaction data and user information of the user to be identified. In the process of training the risky user identification model, the transaction time attribute information used for historical transactions is introduced to realize the automatic screening of abnormal transaction users, improve the screening efficiency, and improve the screening accuracy of abnormal transaction users, thereby improving the model training efficiency and model training accuracy of the risky user identification model, and further improving the accuracy of risky transaction user identification.

[0038] The present application also provides a model training method for a risk user identification model. In an optional embodiment, the model training method for the risk user identification model is as follows:

[0039] Step a1: Obtain historical transaction data and historical user information of historical transaction users; the historical transaction data includes transaction time attribute information.

[0040] Among them, historical transaction data may include at least one of transaction records, transaction locations, transaction addresses, and transaction funds flow, etc.; historical user information may include at least one of account information, account balance, account holder, and account status, etc. Among them, transaction time attribute information may include the specific time node or time range interval when the transaction occurs.

[0041] Optionally, in order to ensure data integrity, reliability and accuracy, the historical transaction data and historical user information of the acquired historical transaction users may be subjected to pre-processing operations such as data cleaning, data deduplication and data formatting to ensure data quality and data consistency. Furthermore, the historical transaction data of historical transaction users who have engaged in entrusted deductions and financial product purchases may be removed based on the agreement account record information to remove transaction data that is irrelevant to or interferes with the risk transaction determination.

[0042] Step a2: construct a user transaction knowledge graph based on historical transaction data and historical user information; the user transaction knowledge graph includes at least two historical transaction user nodes.

[0043] Specifically, the user transaction knowledge graph can be constructed with historical transaction users as nodes and node associations between nodes as edges. The node associations between nodes can be determined based on the historical transaction data and historical user information of historical transaction users, such as the association between transaction funds. Historical transaction users can be individuals or companies.

[0044] Each historical transaction user node may also include node attribute information, such as historical user information, etc. The edge information between nodes may include capital inflow, capital outflow, payment or receipt, etc. The constructed user transaction knowledge graph is a directed graph, and the direction may represent the node association relationship between nodes, such as capital flow direction, etc.

[0045] Step a3: According to the transaction time attribute information of historical transaction users and based on the user transaction knowledge graph, determine the abnormal transaction users.

[0046] The transaction time attribute information may include the transaction time of each transaction of the historical transaction user within a preset historical time period.

[0047] For example, the transaction time fluctuation curve of the historical transaction user can be determined based on the transaction time attribute information of the historical transaction user, the horizontal axis of the curve is the transaction identifier of each transaction in the preset historical time period; the vertical axis is the transaction time corresponding to each transaction. The transaction time fluctuation curve of the historical transaction user is compared with the pre-constructed normal transaction time fluctuation curve, and the curve deviation value is determined; if the determined curve deviation value is not within the preset normal deviation value range, the historical transaction user is determined to be an abnormal transaction user.

[0048] Optionally, in order to further improve the accuracy of identifying abnormal transaction users, model prediction can also be used to perform abnormal user detection on historical transaction users.

[0049] Specifically, a preset number of transaction user samples are obtained; each transaction user sample includes data such as transaction timestamp, transaction cycle and other transaction features. Among them, other transaction features include transaction frequency and transaction type. Key features are extracted from the transaction timestamp, transaction cycle and other transaction data of the transaction user samples, such as average transaction interval, standard deviation of transaction time interval, variance of transaction time interval, maximum / minimum transaction interval, whether the transaction cycle is fixed and whether the transaction time point is specific.

[0050] Based on the existing feature extraction method, according to the key feature data of the transaction user sample, the normal transaction users with normal transaction mode and the abnormal transaction users with abnormal transaction mode are determined. The feature extraction method can be a statistical method or a clustering method, which is not limited in this embodiment. According to the determination result, the transaction user sample is labeled, wherein "0" can be used to represent the normal transaction user category, and "1" can be used to represent the abnormal transaction user category.

[0051] The transaction timestamp, transaction cycle, other transaction feature data and key feature data of the transaction user samples are used to train the preset recognition model to obtain a trained abnormal user recognition model. The recognition model can be preset by relevant technical personnel, for example, the recognition model can be a decision tree or a random forest.

[0052] The trained abnormal user identification model is used to identify the historical transaction user to obtain the identification result of the historical transaction user, wherein the identification result can be that the historical transaction user is an abnormal transaction user or that the historical transaction user is a normal transaction user.

[0053] Step a4: Determine other transaction users among the historical transaction users except the abnormal transaction users as normal transaction users.

[0054] Exemplarily, if historical transaction users include user a, user b, user c, user d and user f, wherein the abnormal transaction users determined based on the above steps include user a, user c and user d, then the normal transaction users are user b and user f.

[0055] Step a5: Generate normal transaction sample data of normal transaction users, and generate abnormal transaction sample data of abnormal transaction users.

[0056] Among them, the normal transaction sample data may include normal transaction data and normal user information of normal transaction users; the abnormal transaction sample data may include abnormal transaction data and abnormal user information of abnormal transaction users.

[0057] Normal transaction users are labeled with normal category labels, and abnormal transaction users are labeled with abnormal category labels, so that the transaction characteristics of transaction users in the corresponding category can be learned based on the labeled labels during the model training process.

[0058] Step a6: Use normal transaction sample data of normal transaction users and abnormal transaction sample data of abnormal transaction users to perform model training on the preset recognition network model until the preset model training end condition is met to obtain a risk user recognition model.

[0059] The normal transaction sample data of normal transaction users and the abnormal transaction sample data of abnormal transaction users are input into the preset recognition network model for processing to obtain the prediction result of the model output; according to the prediction result and the sample label category of the corresponding transaction sample data, the loss value is determined based on the preset loss function; according to the loss value, the recognition network model is trained until the preset model training end conditions are met to obtain a risky user identification model.

[0060] The recognition network model may be a feedforward neural network (FNN), a convolutional neural network (CNN), or a random forest, etc. The loss function may be a binary crossover loss function or an average error loss function, etc. The model training end condition may be that the number of model training times reaches a set number threshold, or the loss value tends to be stable, or the loss value reaches a set loss threshold.

[0061] The above technical solution trains the preset recognition network model by using normal transaction sample data of normal transaction users and abnormal transaction sample data of abnormal transaction users. The transaction data and user information of the transaction users are taken into consideration during the model training process, and the transaction time attribute information is introduced during the abnormal user screening process, thereby improving the screening accuracy and reliability of abnormal transaction users, thereby improving the training accuracy of the risk user identification model, and further improving the accuracy of identifying risky transaction users to be identified.

[0062] In order to further improve the accuracy of determining abnormal transaction users, in an optional embodiment, according to the transaction time attribute information of historical transaction users, based on the user transaction knowledge graph, the abnormal transaction users are determined, including:

[0063] Step b1: According to the transaction time attribute information of the historical transaction users, each historical transaction user node in the user transaction knowledge graph is traversed to determine at least one strongly connected component set.

[0064] Exemplarily, each historical transaction user node in the user transaction knowledge graph can be traversed based on a preset search algorithm to find strongly connected components in the directed graph. The search algorithm can be the Kosaraju algorithm or the Tarjan algorithm. The Kosaraju algorithm can find strongly connected components through the reverse graph of the graph and two depth-first searches (DFS); the Tarjan algorithm can use a depth-first search (DFS) combined with a backtracking method, which can complete the calculation in linear time.

[0065] It should be noted that in the transaction process in the financial field, abnormal transaction behavior may be manifested in frequent transactions or capital flows between users, and based on the generation principle of the strongly connected component set, it can be clearly seen that there are abnormal interactive correlations between the transactions in the component set. Each strongly connected component set may include at least two historical transaction user nodes traversed by the search, and there are abnormal transaction transactions between the historical transaction user nodes in the set. Therefore, the transaction users corresponding to the historical transaction user nodes in the strongly connected component set can be determined as abnormal transaction users.

[0066] Step b2: Determine the transaction users corresponding to the historical transaction user nodes in each strongly connected component set as abnormal transaction users.

[0067] It can be seen that the above technical solution traverses each historical transaction user node in the user transaction knowledge graph according to the transaction time attribute information of the historical transaction users, determines at least one strongly connected component set, and determines the transaction users corresponding to the historical transaction user nodes in the strongly connected component set as abnormal transaction users. Abnormal transaction users are selected by determining the strongly connected components, thereby improving the accuracy of determining abnormal transaction users.

[0068] It should be noted that, based on the existing method, when traversing nodes, an infinite loop may occur, such as failing to traverse the last node or failing to complete the traversal for a long time, which will affect the determination process of the strongly connected component set. Therefore, this embodiment also provides a method for determining a strongly connected component set, which avoids the above situation by introducing transaction time attribute information, and improves the efficiency and accuracy of determining strongly connected components.

[0069] In an optional embodiment, according to the transaction time attribute information of the historical transaction user, each historical transaction user node in the user transaction knowledge graph is traversed to determine at least one strongly connected component set, including:

[0070] Step c1: perform node traversal on each historical transaction user node in the user transaction knowledge graph according to the transaction time attribute information of the historical transaction user; for any traversed historical transaction user node, update the current first code value of the historical transaction user node according to the adjacent first code value of the adjacent transaction user node of the historical transaction user node; and update the current second code value of the historical transaction user node according to the traversal order of the historical transaction user node, until the preset traversal end condition is met, and at least one node traversal path is obtained; each node traversal path includes at least two historical transaction user nodes.

[0071] Before traversing each historical transaction user node in the user transaction knowledge graph, an initial first coding value (LOW) and an initial second coding value (DFN) are set for each historical transaction user node.

[0072] Specifically, in the process of traversing each historical transaction user node in the user transaction knowledge graph, the initial second code value (DFN) of the historical transaction user node is updated according to the traversal order of the historical transaction user node to obtain the current second code value. For example, the initial second code value DFN of the historical transaction user node A is 0. During the traversal process, the historical transaction user node A is the third node visited, and the current second code value DFN of the historical transaction user node A is 3.

[0073] In the process of traversing each historical transaction user node in the user transaction knowledge graph, for any traversed historical transaction user node, the current first code value of the historical transaction user node is updated according to the adjacent first code value of the adjacent transaction user node of the historical transaction user node. For example, when traversing to the historical transaction user node B, its current first code value is 2, and the adjacent first code value of the adjacent transaction user node of the historical transaction user node is 3, then the smaller value of the current first code value and the adjacent first code value of the historical transaction user node is selected to update the current first code value of the historical transaction user node B.

[0074] The traversal end condition can be pre-set by relevant technical personnel. For example, the traversal end condition can be when the number of nodes traversed reaches a set node number threshold; or when the traversal time reaches a set time range. Optionally, in order to ensure the traversal accuracy of the node traversal path, the traversal end condition can also be set based on the transaction time attribute information.

[0075] Specifically, the traversal end condition may be: setting a first end time point and a second end time point; for any node traversal path, when the node traversal time of the node traversal path reaches the first end time point and the traversal has not ended, the node traversal continues until the second end time point. Obtain the transaction time attribute information of the reference transaction nodes traversed between the first end time point and the second end time point, and determine whether there are reference transaction nodes whose transaction time is within the preset abnormal transaction time range; if there are and the number is unique, then the reference transaction node is used as the end node of the node traversal path; if there are and the number is not unique, then select the reference transaction node with the most transaction time falling within the abnormal transaction time range from each reference transaction node that meets the conditions, and use the reference transaction node as the end node of the node traversal path; if not, then use the last transaction node traversed by the second end time point as the end node of the node traversal path.

[0076] Step c2: Determine at least one strongly connected component set according to the current first code value and the current second code value of each historical transaction user node in each node traversal path.

[0077] Exemplarily, a historical transaction user node having the same current first coding value and current second coding value may be regarded as an abnormal transaction node, and a strongly connected component set including at least one abnormal transaction node may be generated.

[0078] Optionally, at least one strongly connected component set is determined based on the current first coding value and the current second coding value of each historical transaction user node in each node traversal path, including: for any node traversal path, reverse traversal is performed from the end node of the node traversal path, and the current first coding value and the current second coding value of the traversed historical transaction user node are compared for consistency; if they are consistent, generating a strongly connected component set including the historical transaction user node and the historical transaction user nodes that have been traversed.

[0079] For any node traversal path, reverse traversal is started from the end node in the node traversal path. For any traversed historical transaction user node, it is determined whether the current first code value and the current second code value of the historical transaction user node are consistent; if so, a strongly connected component set including the historical transaction user node and the traversed historical transaction user nodes is generated.

[0080] Exemplarily, the node traversal path is represented in the form of a data stack as {a, b, c, d, e}, where e is the end node, a is the head node, and b, c, and d are the historical transaction user nodes traversed in sequence. Starting from the end node e, traversing in reverse, when traversing to node c, the current first code value and the current second code value of node c are consistent, then the set of strongly connected components is {c, d, e}.

[0081] It can be seen that in this embodiment, by traversing backward from the end node of the node traversal path, and comparing the consistency of the first coding value and the second coding value of the traversed node, until a set of strongly connected components is generated when the conditions are met, in addition to making an abnormality judgment based on the transaction characteristics of the node itself, the association relationship with its adjacent nodes is also considered in the process of generating strongly connected components, thereby determining a set of strongly connected components that have direct and indirect associations with the abnormal node, thereby improving the accuracy of determining the set of strongly connected components.

[0082] The above technical solution generates a set of strongly connected components by setting coding value characteristics for each historical transaction user node and introducing transaction time attribute information in the process of generating node traversal paths, which effectively avoids the path generation process from falling into an infinite loop and comprehensively considers the abnormal characteristics represented by the transaction time, so that the path generation accuracy of each node traversal path is higher, thereby improving the accuracy of the subsequent generation of strongly connected component sets.

[0083] In order to further improve the comprehensiveness, reliability and accuracy of the generation of abnormal transaction sample data for abnormal transaction users, this embodiment also provides a method for generating abnormal transaction sample data. In an optional embodiment, generating the abnormal transaction sample data of the abnormal transaction user includes:

[0084] Step d1: Obtain transaction data and user information of abnormal transaction users.

[0085] Among them, transaction data may include at least one of transaction records, transaction location, transaction time, transaction address and transaction funds flow; user information may include at least one of account information, account balance, account holder and account status.

[0086] Step d2: Generate risk characteristic data based on the transaction data of abnormal transaction users.

[0087] Among them, risk characteristic data is used to characterize parameter data with risky transaction characteristics. For example, risk characteristic data may include transaction frequency, transaction volatility, number of individuals to whom funds flow, regions to which funds flow, and addresses of both parties to the transaction, etc., which can be directly obtained or generated based on transaction data.

[0088] In an optional embodiment, risk characteristic data is generated based on the transaction data of the abnormal transaction user, including:

[0089] Step d21: Determine the transaction frequency standard deviation based on the number of transactions in the transaction data of the abnormal transaction user.

[0090] Among them, the transaction frequency standard deviation X is determined as follows:

[0091]

[0092] Where N is the number of transactions; x i is the i-th transaction; is the average number of transactions.

[0093] Step d22: Determine the transaction volume standard deviation based on the transaction volume in the transaction data of the abnormal transaction user.

[0094] Among them, the determination method of the trading volume standard deviation Y is as follows:

[0095]

[0096] Where N is the number of transactions; y i is the transaction volume of the i-th transaction; is the average transaction volume.

[0097] Step d23, determining transaction time characteristic data according to the transaction time in the transaction data of the abnormal transaction user;

[0098] Specifically, according to the transaction time of at least one transaction of the transaction user in the historical time period, the transaction time interval between each transaction can be determined, and according to the transaction time interval of each transaction, the time interval mean can be determined. According to the transaction time, the transaction fluctuation data is generated, and the maximum transaction time fluctuation and the minimum transaction time fluctuation are determined. The time interval mean and the time fluctuation data are determined as the transaction time characteristic data. Optionally, the transaction time characteristic data may also include the transaction time density, the transaction time length, the transaction time interval distribution and the transaction time peak value.

[0099] Step d24: Generate risk characteristic data including transaction frequency standard deviation, transaction volume standard deviation and transaction time characteristic data.

[0100] It can be seen that the above technical solution comprehensively considers the dimensions of different transaction data in the process of generating risk characteristic data, improves the comprehensiveness of determining risk characteristic data, thereby further improving the reliability and comprehensiveness of abnormal transaction sample data, and further improving the accuracy of learning abnormal characteristics in subsequent model training.

[0101] Step d3: Generate abnormal transaction sample data including transaction data, user information and risk characteristic data of abnormal transaction users.

[0102] The technical solution of the above embodiment generates risk characteristic data based on the transaction data of abnormal transaction users, and generates abnormal transaction sample data including the transaction data, user information and risk characteristic data of abnormal transaction users. The risk characteristic data of the transaction is introduced in the process of generating abnormal transaction sample data, which improves the comprehensiveness of the generation of abnormal transaction sample data, thereby improving the comprehensiveness, reliability and feature diversity of the input sample data set in the model training process.

[0103] Embodiment 2

[0104] Figure 2 This is a schematic diagram of a method for identifying risky transaction users provided in Embodiment 2 of the present invention. This embodiment provides a preferred example based on the above embodiments.

[0105] like Figure 2 As shown, the method comprises the following specific steps:

[0106] S21. Obtain historical transaction data and historical user information of historical transaction users; wherein the historical transaction data includes transaction time attribute information.

[0107] S22. Construct a user transaction knowledge graph based on historical transaction data and historical user information; wherein the user transaction knowledge graph includes at least two historical transaction user nodes.

[0108] S23. According to the transaction time attribute information of the historical transaction users, perform node traversal on each of the historical transaction user nodes in the user transaction knowledge graph to determine at least one strongly connected component set.

[0109] Specifically, according to the transaction time attribute information of the historical transaction user, each historical transaction user node in the user transaction knowledge graph is traversed, and for any traversed historical transaction user node, the current first code value of the historical transaction user node is updated according to the adjacent first code value of the adjacent transaction user node of the historical transaction user node, and the current second code value of the historical transaction user node is updated according to the traversal order of the historical transaction user node, until a preset traversal end condition is met, and at least one node traversal path is obtained; each node traversal path includes at least two historical transaction user nodes; for any node traversal path, reverse traversal is performed from the end node of the node traversal path, and the current first code value and the current second code value of the traversed historical transaction user node are compared for consistency; if they are consistent, a strongly connected component set including the historical transaction user node and the traversed historical transaction user nodes is generated.

[0110] S24. Determine the transaction users corresponding to the historical transaction user nodes in each strongly connected component set as abnormal transaction users.

[0111] S25. Determine other transaction users among the historical transaction users except the abnormal transaction users as normal transaction users.

[0112] S26A. Generate normal transaction sample data of normal transaction users.

[0113] S26B. Generate abnormal transaction sample data of abnormal transaction users.

[0114] Specifically, the transaction data and user information of the abnormal transaction user are obtained; the transaction frequency standard deviation is determined according to the number of transactions in the transaction data of the abnormal transaction user; and the transaction volume standard deviation is determined according to the transaction volume in the transaction data of the abnormal transaction user; and the transaction time characteristic data is determined according to the transaction time in the transaction data of the abnormal transaction user; and risk characteristic data including the transaction frequency standard deviation, the transaction volume standard deviation and the transaction time characteristic data are generated. Risk characteristic data is generated according to the transaction data of the abnormal transaction user; and abnormal transaction sample data including the transaction data, user information and risk characteristic data of the abnormal transaction user are generated.

[0115] S27. Use normal transaction sample data of normal transaction users and abnormal transaction sample data of abnormal transaction users to perform model training on a preset recognition network model until a preset model training end condition is met, thereby obtaining a risk user recognition model.

[0116] S28. Obtain current transaction data and current user information of the user to be identified.

[0117] S29, inputting the current transaction data and the current user information into a pre-trained risk user identification model to perform user transaction risk identification and obtain a risk transaction user identification result.

[0118] It should be noted that the information collected in this embodiment, such as historical transaction data and historical user information of historical transaction users, normal transaction sample data of normal transaction users, and abnormal transaction sample data of abnormal transaction users, is information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of relevant data comply with the relevant laws, regulations and standards of relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0119] Embodiment 3

[0120] Figure 3The structure diagram of a risky transaction user identification device provided in the third embodiment of the present invention. The risky transaction user identification device provided in the embodiment of the present invention can be used to accurately identify risky transaction users who have transaction risks in the financial transaction process. The risky transaction user identification device can be implemented in the form of hardware and / or software, such as Figure 3 As shown, the device specifically includes: a user information acquisition module 301 and a transaction risk identification module 302. Among them,

[0121] The user information acquisition module 301 is used to acquire the current transaction data and current user information of the user to be identified;

[0122] The transaction risk identification module 302 is used to input the current transaction data and the current user information into a pre-trained risk user identification model to perform user transaction risk identification and obtain a risk transaction user identification result;

[0123] Among them, the risk user identification model is obtained by pre-training a preset identification network model with normal transaction sample data of normal transaction users and abnormal transaction sample data of abnormal transaction users; the abnormal transaction users are obtained by screening the historical transaction users through the transaction time attribute information of historical transaction users in historical periods.

[0124] The technical solution of the present application improves the accuracy of risky transaction user identification by using a pre-trained risky user identification model to predict whether the user to be identified is a risky transaction user based on the transaction data and user information of the user to be identified. In the process of training the risky user identification model, the transaction time attribute information used for historical transactions is introduced to realize the automatic screening of abnormal transaction users, improve the screening efficiency, and improve the screening accuracy of abnormal transaction users, thereby improving the model training efficiency and model training accuracy of the risky user identification model, and further improving the accuracy of risky transaction user identification.

[0125] Optionally, the device further comprises: a model training module; the model training module trains the risk user identification model; the model training module comprises:

[0126] The information acquisition submodule is used to acquire historical transaction data and historical user information of historical transaction users; the historical transaction data includes transaction time attribute information;

[0127] A graph construction submodule, configured to construct a user transaction knowledge graph based on the historical transaction data and the historical user information; the user transaction knowledge graph includes at least two historical transaction user nodes;

[0128] An abnormal user determination submodule, used to determine abnormal transaction users based on the transaction time attribute information of the historical transaction users and the user transaction knowledge graph;

[0129] A normal user determination submodule, used to determine other transaction users among the historical transaction users except the abnormal transaction users as normal transaction users;

[0130] A sample data generating submodule, used to generate normal transaction sample data of the normal transaction user, and to generate abnormal transaction sample data of the abnormal transaction user;

[0131] The model training submodule is used to use the normal transaction sample data of the normal transaction users and the abnormal transaction sample data of the abnormal transaction users to perform model training on the preset recognition network model until the preset model training end conditions are met to obtain a risky user recognition model.

[0132] Optionally, the abnormal user determination submodule includes:

[0133] A strongly connected component determination unit, configured to perform node traversal on each of the historical transaction user nodes in the user transaction knowledge graph according to the transaction time attribute information of the historical transaction user, and determine at least one strongly connected component set;

[0134] The abnormal user determination unit is used to determine the transaction users corresponding to the historical transaction user nodes in each of the strongly connected component sets as abnormal transaction users.

[0135] Optionally, a strongly connected component determination unit includes:

[0136] A path traversal subunit, configured to perform node traversal on each of the historical transaction user nodes in the user transaction knowledge graph according to the transaction time attribute information of the historical transaction user, and for any traversed historical transaction user node, update the current first code value of the historical transaction user node according to the adjacent first code value of the adjacent transaction user node of the historical transaction user node, and update the current second code value of the historical transaction user node according to the traversal order of the historical transaction user node, until a preset traversal end condition is met, thereby obtaining at least one node traversal path; each of the node traversal paths includes at least two historical transaction user nodes;

[0137] The strongly connected component determination subunit is used to determine at least one strongly connected component set according to the current first coding value and the current second coding value of each historical transaction user node in each of the node traversal paths.

[0138] Optionally, the strongly connected component determines the subunit, specifically for:

[0139] For any node traversal path, reverse traverse is performed from the end node of the node traversal path, and the current first code value and the current second code value of the traversed historical transaction user node are compared for consistency;

[0140] If they are consistent, a strongly connected component set including the historical transaction user node and the traversed historical transaction user nodes is generated.

[0141] Optional, sample data generation submodule, including:

[0142] A relevant data acquisition unit, used to acquire the transaction data and user information of the abnormal transaction user;

[0143] A risk characteristic generating unit, configured to generate risk characteristic data according to the transaction data of the abnormal transaction user;

[0144] The sample data generating unit is used to generate abnormal transaction sample data including the transaction data, user information and risk characteristic data of the abnormal transaction user.

[0145] Optionally, a risk feature generation unit is used to:

[0146] Determining a transaction frequency standard deviation according to the number of transactions in the transaction data of the abnormal transaction user; and,

[0147] Determining a transaction volume standard deviation according to the transaction volume in the transaction data of the abnormal transaction user; and

[0148] Determining transaction time characteristic data according to the transaction time in the transaction data of the abnormal transaction user;

[0149] Generate risk characteristic data including the transaction frequency standard deviation, the transaction volume standard deviation and the transaction time characteristic data.

[0150] The risk transaction user identification device provided in the embodiment of the present invention can execute the risk transaction user identification method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0151] Embodiment 4

[0152] Figure 4A schematic diagram of the structure of an electronic device 40 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0153] like Figure 4 As shown, the electronic device 40 includes at least one processor 41, and a memory connected to the at least one processor 41, such as a read-only memory (ROM) 42, a random access memory (RAM) 43, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 41 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 42 or the computer program loaded from the storage unit 48 to the random access memory (RAM) 43. In the RAM 43, various programs and data required for the operation of the electronic device 40 can also be stored. The processor 41, the ROM 42, and the RAM 43 are connected to each other through a bus 44. An input / output (I / O) interface 45 is also connected to the bus 44.

[0154] A number of components in the electronic device 40 are connected to the I / O interface 45, including: an input unit 46, such as a keyboard, a mouse, etc.; an output unit 47, such as various types of displays, speakers, etc.; a storage unit 48, such as a disk, an optical disk, etc.; and a communication unit 49, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 49 allows the electronic device 40 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0155] The processor 41 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 41 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 41 executes the various methods and processes described above, such as the risk transaction user identification method.

[0156] In some embodiments, the risk transaction user identification method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 48. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 40 via the ROM 42 and / or the communication unit 49. When the computer program is loaded into the RAM 43 and executed by the processor 41, one or more steps of the risk transaction user identification method described above may be performed. Alternatively, in other embodiments, the processor 41 may be configured to perform the risk transaction user identification method in any other appropriate manner (e.g., by means of firmware).

[0157] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0158] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0159] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0160] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0161] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0162] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0163] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0164] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for identifying risky transaction users, characterized in that: include: Obtain current transaction data and current user information of the user to be identified; Inputting the current transaction data and the current user information into a pre-trained risk user identification model to perform user transaction risk identification, thereby obtaining a risk transaction user identification result; Among them, the risk user identification model is obtained by pre-training a preset identification network model with normal transaction sample data of normal transaction users and abnormal transaction sample data of abnormal transaction users; the abnormal transaction users are obtained by screening the historical transaction users through the transaction time attribute information of historical transaction users in historical periods.

2. The method according to claim 1, characterized in that The model training method of the risk user identification model is as follows: Acquire historical transaction data and historical user information of historical transaction users; the historical transaction data includes transaction time attribute information; Constructing a user transaction knowledge graph based on the historical transaction data and the historical user information; the user transaction knowledge graph includes at least two historical transaction user nodes; According to the transaction time attribute information of the historical transaction user and based on the user transaction knowledge graph, determining the abnormal transaction user; Determine other transaction users among the historical transaction users except the abnormal transaction user as normal transaction users; generating normal transaction sample data of the normal transaction user, and generating abnormal transaction sample data of the abnormal transaction user; The normal transaction sample data of the normal transaction users and the abnormal transaction sample data of the abnormal transaction users are used to perform model training on the preset recognition network model until the preset model training end condition is met, thereby obtaining a risky user recognition model.

3. The method according to claim 2, characterized in that The determining of abnormal transaction users based on the transaction time attribute information of the historical transaction users and the user transaction knowledge graph includes: According to the transaction time attribute information of the historical transaction user, performing node traversal on each of the historical transaction user nodes in the user transaction knowledge graph to determine at least one strongly connected component set; The transaction users corresponding to the historical transaction user nodes in each of the strongly connected component sets are determined as abnormal transaction users.

4. The method according to claim 3, characterized in that The step of performing node traversal on each of the historical transaction user nodes in the user transaction knowledge graph according to the transaction time attribute information of the historical transaction user to determine at least one strongly connected component set includes: According to the transaction time attribute information of the historical transaction user, each of the historical transaction user nodes in the user transaction knowledge graph is traversed, and for any traversed historical transaction user node, the current first code value of the historical transaction user node is updated according to the adjacent first code value of the adjacent transaction user node of the historical transaction user node, and the current second code value of the historical transaction user node is updated according to the traversal order of the historical transaction user node, until a preset traversal end condition is met, and at least one node traversal path is obtained; each of the node traversal paths includes at least two historical transaction user nodes; At least one strongly connected component set is determined according to the current first coding value and the current second coding value of each historical transaction user node in each of the node traversal paths.

5. The method according to claim 4, characterized in that The step of determining at least one strongly connected component set according to the current first code value and the current second code value of each historical transaction user node in each node traversal path includes: For any node traversal path, reverse traverse is performed from the end node of the node traversal path, and the current first code value and the current second code value of the traversed historical transaction user node are compared for consistency; If they are consistent, a strongly connected component set including the historical transaction user node and the traversed historical transaction user nodes is generated.

6. The method according to claim 2, characterized in that The generating of abnormal transaction sample data of the abnormal transaction user comprises: Obtaining transaction data and user information of the abnormal transaction user; Generate risk characteristic data based on the transaction data of the abnormal transaction user; Abnormal transaction sample data including the transaction data, user information and risk characteristic data of the abnormal transaction user is generated.

7. The method according to claim 6, characterized in that The generating risk characteristic data according to the transaction data of the abnormal transaction user includes: Determining a transaction frequency standard deviation according to the number of transactions in the transaction data of the abnormal transaction user; and, Determining a transaction volume standard deviation according to the transaction volume in the transaction data of the abnormal transaction user; and Determining transaction time characteristic data according to the transaction time in the transaction data of the abnormal transaction user; Generate risk characteristic data including the transaction frequency standard deviation, the transaction volume standard deviation and the transaction time characteristic data.

8. A risky transaction user identification device, characterized in that: include: A user information acquisition module, used to acquire the current transaction data and current user information of the user to be identified; A transaction risk identification module, used for inputting the current transaction data and the current user information into a pre-trained risk user identification model to perform user transaction risk identification and obtain a risk transaction user identification result; Among them, the risk user identification model is obtained by pre-training a preset identification network model with normal transaction sample data of normal transaction users and abnormal transaction sample data of abnormal transaction users; the abnormal transaction users are obtained by screening the historical transaction users through the transaction time attribute information of historical transaction users in historical periods.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the risk transaction user identification method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the risk transaction user identification method according to any one of claims 1 to 7 when executed.

Images