Abnormal transaction detection method and device, equipment and storage medium

Abstract

The embodiment of the invention discloses an abnormal transaction detection method and device, equipment and a storage medium. Comprising the steps of obtaining a transaction record set in a preset historical time period; extracting the transaction attribute of each transaction record in the transaction record set; wherein the transaction attributes comprise at least one of the following: a transaction type, an asset code, an investment portfolio, a transaction direction and a transaction amount; performing abnormal transaction record detection on the transaction record set according to at least one item in the transaction attributes; wherein the detection of the abnormal transaction records comprises detection of reverse transactions and detection of short-term large-amount frequent transactions; and generating early warning information according to the detected abnormal transaction record. According to the abnormal transaction detection method provided by the embodiment of the invention, abnormal transaction record detection is performed on the transaction record set according to at least one item in the transaction attributes, so that the efficiency and convenience of abnormal transaction detection can be improved.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of data processing technology, and in particular to a method, device, equipment and storage medium for detecting abnormal transactions. Background Art

[0002] With the rapid development of financial technology, electronic transactions have accounted for more than 90% of the total inter-bank transaction volume. The electronic transaction system provides financial institutions with convenient and fast transaction methods, but it also brings a series of problems and risks. How to monitor and analyze the transaction data of financial institutions in real time to discover abnormal transaction behaviors and take corresponding measures to prevent risks in a timely manner is one of the key tasks of state-owned banks. At present, there are two common methods for abnormal transaction detection. One is data mining technology, which discovers hidden patterns and laws through calculations on large amounts of data and identifies abnormal transaction behaviors; the other is machine learning technology, which uses machine learning algorithms to classify, aggregate and predict data to identify abnormal transaction behaviors. The above two detection methods are complex and inefficient. Summary of the invention

[0003] The embodiments of the present invention provide a method, device, equipment and storage medium for detecting abnormal transactions, which can improve the efficiency and convenience of abnormal transaction detection.

[0004] In a first aspect, an embodiment of the present invention provides a method for detecting abnormal transactions, comprising:

[0005] Get the transaction record set within the preset historical period;

[0006] Extracting transaction attributes of each transaction record in the transaction record set; wherein the transaction attributes include at least one of the following: transaction type, asset code, investment portfolio, transaction direction, and transaction amount;

[0007] Detecting abnormal transaction records in the transaction record set according to at least one of the transaction attributes; wherein the detection of abnormal transaction records includes the detection of reverse transactions and the detection of short-term large-amount frequent transactions;

[0008] Generate early warning information based on detected abnormal transaction records.

[0009] In a second aspect, an embodiment of the present invention further provides a device for detecting abnormal transactions, including:

[0010] A transaction record set acquisition module is used to acquire a transaction record set within a preset historical period;

[0011] A transaction attribute extraction module, used to extract the transaction attributes of each transaction record in the transaction record set; wherein the transaction attributes include at least one of the following: transaction type, asset code, investment portfolio, transaction direction and transaction amount;

[0012] An abnormal transaction record detection module, used to detect abnormal transaction records in the transaction record set according to at least one of the transaction attributes; wherein the detection of abnormal transaction records includes the detection of reverse transactions and the detection of short-term large-amount frequent transactions;

[0013] The warning information generation module is used to generate warning information based on the detected abnormal transaction records.

[0014] In a third aspect, an embodiment of the present invention further provides an electronic device, the electronic device comprising:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the abnormal transaction detection method described in the embodiment of the present invention.

[0018] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the abnormal transaction detection method described in the embodiment of the present invention when executed.

[0019] The embodiment of the present invention discloses a method, device, equipment and storage medium for detecting abnormal transactions. Obtain a transaction record set within a preset historical period; extract the transaction attributes of each transaction record in the transaction record set; wherein the transaction attributes include at least one of the following: transaction type, asset code, investment portfolio, transaction direction and transaction amount; detect abnormal transaction records in the transaction record set according to at least one of the transaction attributes; wherein the detection of abnormal transaction records includes the detection of reverse transactions and the detection of short-term large-amount frequent transactions; generate warning information based on the detection of abnormal transaction records. The abnormal transaction detection method provided in this embodiment detects abnormal transaction records in the transaction record set according to at least one of the transaction attributes, which can improve the efficiency and convenience of abnormal transaction detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 is a flow chart of a method for detecting abnormal transactions in Embodiment 1 of the present invention;

[0021] Figure 2 This is an example diagram of detecting reverse transactions by using a decision tree in Embodiment 1 of the present invention;

[0022] Figure 3It is a structural schematic diagram of an abnormal transaction detection device in Embodiment 2 of the present invention;

[0023] Figure 4 It is a structural schematic diagram of an electronic device in Embodiment 3 of the present invention. DETAILED DESCRIPTION

[0024] The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the present invention, rather than to limit the present invention. It should also be noted that, for ease of description, only parts related to the present invention, rather than all structures, are shown in the accompanying drawings.

[0025] Embodiment 1

[0026] Figure 1 This is a flow chart of a method for detecting abnormal transactions provided in the first embodiment of the present invention. This embodiment is applicable to the case of detecting abnormal transactions. The method can be executed by an abnormal transaction detection device, which can be implemented in the form of software and / or hardware. Optionally, it can be implemented by an electronic device, which can be a mobile terminal, a PC or a server. Specifically, it includes the following steps:

[0027] S110, obtaining a transaction record set within a preset historical period.

[0028] The preset historical period may be a set period before the time corresponding to the operation of obtaining the transaction record set. For example, assuming that the transaction record set is obtained at midnight every day, the preset historical period is the previous day, that is, the transaction records generated in the previous day are obtained. In this embodiment, the transaction records generated in the preset historical period are obtained from the transaction system to obtain the transaction record set.

[0029] S120, extracting transaction attributes of each transaction record in the transaction record set.

[0030] Among them, the transaction attributes include at least the following: transaction type, asset code, investment portfolio, transaction direction and transaction amount. Transaction types may include bonds, funds, asset management plans, stocks, on-site funds, repurchase transactions and other types. The asset code may be a unique identification code designed by a financial institution (such as a bank, a bond company) to identify an asset. The investment portfolio may be a financial product designed and issued by a financial institution, that is, a financial product used to complete the transaction corresponding to the current transaction record. The transaction direction may include both buy and sell directions. In this embodiment, after obtaining multiple transaction records within a preset historical period, at least one transaction attribute of the transaction type, asset code, investment portfolio, transaction direction and transaction amount of each transaction record is extracted.

[0031] S130, detecting abnormal transaction records in the transaction record set according to at least one of the transaction attributes.

[0032] Among them, the detection of abnormal transaction records includes the detection of reverse transactions and the detection of short-term large-amount frequent transactions. In this embodiment, if two transaction records in a preset historical period meet the following conditions: the asset code is the same, the investment portfolio is the same, and the transaction direction is opposite, then the two transaction records are reverse transactions. If the number of transaction records with the same investment portfolio and the same asset code exceeds a certain threshold and / or the transaction amount exceeds a certain threshold in the preset period, the transaction records with the same investment portfolio and the same asset code are short-term large-amount frequent transactions.

[0033] Optionally, the method of detecting abnormal transaction records in the transaction record set according to at least one of the transaction attributes may be: determining a detection condition according to the transaction type; and detecting abnormal transaction records in the transaction record set based on the detection condition.

[0034] Wherein, if the detection of the abnormal transaction record is the detection of reverse transaction, the transaction type includes repurchase transaction and investment transaction. Investment transaction can be any one of: bonds, funds, asset management plans, stocks, and on-site funds.

[0035] Specifically, the method of determining the detection conditions according to the transaction type may be: if the transaction type is an investment transaction, the detection conditions include: the same asset code, the same investment portfolio and the opposite transaction direction; accordingly, the method of detecting abnormal transaction records in the transaction record set based on the detection conditions may be: comparing the asset codes, investment portfolios and transaction directions in each transaction record in the transaction record set; if the comparison result meets the detection conditions, the two transaction records are opposite transactions.

[0036] In this embodiment, if the transaction type is any investment transaction among bonds, funds, asset management plans, stocks, and on-site funds, each transaction record in the transaction record set is traversed, and the traversed transaction record is compared with the asset code, investment portfolio and transaction direction of other transaction records. If the asset code, investment portfolio and transaction directions of two transaction records are the same, the two transaction records are the same, and the transaction directions are opposite, then the two transaction records are reverse transactions.

[0037] Specifically, the method of determining the detection conditions according to the transaction type may be: if the transaction type is a repurchase transaction, the detection conditions include: the same investment portfolio and opposite transaction directions; accordingly, the method of detecting abnormal transaction records in the transaction record set based on the detection conditions may be: comparing the investment portfolios and transaction directions in each pair of transaction records in the transaction record set; if the comparison results meet the detection conditions, the pair of transaction records are opposite transactions.

[0038] In this embodiment, if the transaction type is a repurchase transaction, each transaction record in the transaction record set is traversed, and the traversed transaction record is compared with the asset code, investment portfolio and transaction direction of other transaction records. If the investment portfolios of two transaction records are the same and the transaction directions are opposite, the two transaction records are reverse transactions.

[0039] In this embodiment, the reverse transaction can be detected by using a decision tree. For example, Figure 2 This is an example diagram of detecting reverse transactions using a decision tree in this embodiment. Figure 2 As shown, for investment and repurchase transactions, the reverse transactions in the transaction record set are detected based on the decision tree.

[0040] Optionally, if the detection of abnormal transaction records is the detection of short-term large-value frequent transactions; the method of determining the detection conditions according to the transaction type can be: the detection conditions determined according to the transaction type include: the number of transactions is greater than the first set threshold and / or the transaction amount is greater than the second set threshold.

[0041] Among them, the transaction amount is greater than the second set threshold value, including the single transaction amount is greater than the second set threshold value or the cumulative transaction amount is greater than the second set threshold value. The values ​​of the first set threshold value and the second set threshold value are determined by the transaction type. The transaction type may include: first-level bond, second-level bond, bond transfer, fund subscription, fund redemption, asset management plan subscription, asset management plan redemption, pledged repurchase, non-standard asset transaction, non-standard asset transfer, on-site fund, stock transaction, etc. Exemplarily, if the transaction type is a deposit transaction, the detection condition is that the number of transactions is greater than the first set threshold value and the transaction amount is greater than the second set threshold value; if the transaction type is a fund subscription, the detection condition is that the number of transactions is greater than the first set threshold value or the transaction amount is greater than the second set threshold value. If the transaction type is a management plan subscription or an asset management plan redemption, the detection condition is that the number of transactions is greater than the first set threshold value and the transaction amount is greater than the second set threshold value. If the transaction type is a non-standard asset transaction or a non-standard asset transfer, the detection condition is that the number of transactions is greater than the first set threshold value and the transaction amount is greater than the second set threshold value. If the transaction type is secondary stock transaction, the detection condition is that the number of transactions is greater than the first set threshold and the transaction amount is greater than the second set threshold. If the transaction type is fund subscription or fund redemption, the detection condition is that the number of transactions is greater than the first set threshold or the transaction amount is greater than the second set threshold. If the transaction type is on-site fund, the detection condition is that the number of transactions is greater than the first set threshold or the transaction amount is greater than the second set threshold. If the transaction type is primary bond, the detection condition is that the number of transactions is greater than the first set threshold and the transaction amount is greater than the second set threshold. If the transaction type is secondary bond or bond transfer, the detection condition is that the number of transactions is greater than the first set threshold and the transaction amount is greater than the second set threshold. If the transaction type is pledged repo, the detection condition is that the number of transactions is greater than the first set threshold and the transaction amount is greater than the second set threshold.

[0042] Accordingly, the method for detecting abnormal transaction records in the transaction record set based on the detection conditions may be: determining the number of transactions and / or transaction amount of the transaction records in the transaction record set with the same investment portfolio and the same asset code; if the number of transactions and / or transaction amount meet the detection conditions, then determining the transaction records in the transaction record set with the same investment portfolio and the same asset code as short-term large-amount frequent transactions.

[0043] In this embodiment, if the transaction number and / or transaction amount of the transaction records with the same investment portfolio and the same asset code in the transaction record set meets the detection condition corresponding to the transaction type, the transaction records with the same investment portfolio and the same asset code in the transaction record set are determined as short-term large-amount frequent transactions.

[0044] S140, generating warning information according to the detected abnormal transaction records.

[0045] In this embodiment, after obtaining the abnormal transaction record, the abnormal transaction record is registered, and a warning message is generated based on the detected abnormal transaction record, and the warning message is sent to the target user via email or text message for the target user to review.

[0046] In this embodiment, abnormal transaction detection can be achieved by inserting an automated detection program into a Robotic Process Automation (RPA) platform, and automated abnormal transaction detection and early warning can be added non-invasively, i.e., there is no need to modify the transaction system.

[0047] The technical solution of this embodiment obtains a transaction record set within a preset historical period; extracts the transaction attributes of each transaction record in the transaction record set; wherein the transaction attributes include at least one of the following: transaction type, asset code, investment portfolio, transaction direction and transaction amount; detects abnormal transaction records in the transaction record set according to at least one of the transaction attributes; wherein the detection of abnormal transaction records includes the detection of reverse transactions and the detection of short-term large-amount frequent transactions; generates warning information according to the detection of abnormal transaction records. The abnormal transaction detection method provided in this embodiment detects abnormal transaction records in the transaction record set according to at least one of the transaction attributes, which can improve the efficiency and convenience of abnormal transaction detection.

[0048] Embodiment 2

[0049] Figure 3 is a schematic diagram of the structure of an abnormal transaction detection device provided by Embodiment 2 of the present invention. Figure 3 As shown, the device comprises:

[0050] The transaction record set acquisition module 310 is used to acquire the transaction record set within a preset historical period;

[0051] The transaction attribute extraction module 320 is used to extract the transaction attributes of each transaction record in the transaction record set; wherein the transaction attributes include at least the following: transaction type, asset code, investment portfolio, transaction direction and transaction amount;

[0052] The abnormal transaction record detection module 330 is used to detect abnormal transaction records in the transaction record set according to at least one of the transaction attributes; wherein the detection of abnormal transaction records includes the detection of reverse transactions and the detection of short-term large-amount frequent transactions;

[0053] The warning information generation module 340 is used to generate warning information according to the detected abnormal transaction records.

[0054] Optionally, the abnormal transaction record detection module 330 is further used to:

[0055] Determine detection conditions based on transaction type;

[0056] The transaction record set is detected for abnormal transaction records based on the detection conditions.

[0057] Optionally, if the detection of abnormal transaction records is the detection of reverse transactions, the transaction types include repurchase transactions and investment transactions.

[0058] Optionally, the abnormal transaction record detection module 330 is further used to:

[0059] If the transaction type is an investment transaction, the detection conditions include: same asset code, same investment portfolio and opposite transaction direction;

[0060] Compare the asset codes, investment portfolios and transaction directions in the transaction records in the transaction record set;

[0061] If the comparison result meets the detection conditions, the two transaction records are reverse transactions.

[0062] Optionally, the abnormal transaction record detection module 330 is further used to:

[0063] If the transaction type is a repurchase transaction, the detection conditions include: the investment portfolio is the same and the transaction direction is opposite;

[0064] Compare the investment portfolios and transaction directions of each pair of transaction records in the transaction record set;

[0065] If the comparison result meets the detection conditions, the two transaction records are reverse transactions.

[0066] Optionally, if the abnormal transaction record detection is the detection of short-term large-amount frequent transactions, the abnormal transaction record detection module 330 is further used to:

[0067] The detection conditions determined according to the transaction type include: the number of transactions is greater than the first set threshold and / or the transaction amount is greater than the second set threshold; wherein the transaction amount is greater than the second set threshold includes a single transaction amount greater than the second set threshold or a cumulative transaction amount greater than the second set threshold.

[0068] Optionally, the abnormal transaction record detection module 330 is further used to:

[0069] Determine the number of transactions and / or transaction amounts of transaction records with the same portfolio and the same asset code in the transaction record set;

[0070] If the number of transactions and / or transaction amount meet the detection conditions, the transaction records with the same investment portfolio and asset code in the transaction record set will be determined as short-term large-amount frequent transactions.

[0071] The above device can execute the methods provided by all the above embodiments of the present invention, and has the corresponding functional modules and beneficial effects of executing the above methods. For technical details not described in detail in this embodiment, please refer to the methods provided by all the above embodiments of the present invention.

[0072] Embodiment 3

[0073] Figure 4 A schematic diagram of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, the connections and relationships between the components, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0074] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0075] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0076] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a method for detecting abnormal transactions.

[0077] In some embodiments, the abnormal transaction detection method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the abnormal transaction detection method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the abnormal transaction detection method in any other appropriate manner (e.g., by means of firmware).

[0078] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0079] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0080] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0081] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0082] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0083] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0084] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0085] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for detecting abnormal transactions, characterized in that: include: Get the transaction record set within the preset historical period; Extracting transaction attributes of each transaction record in the transaction record set; wherein the transaction attributes include at least one of the following: transaction type, asset code, investment portfolio, transaction direction, and transaction amount; Detecting abnormal transaction records in the transaction record set according to at least one of the transaction attributes; wherein the detection of abnormal transaction records includes the detection of reverse transactions and the detection of short-term large-amount frequent transactions; Generate early warning information based on detected abnormal transaction records.

2. The method according to claim 1, characterized in that Detecting abnormal transaction records in the transaction record set according to at least one of the transaction attributes includes: Determine detection conditions based on transaction type; The transaction record set is detected for abnormal transaction records based on the detection condition.

3. The method according to claim 2, characterized in that If the detection of the abnormal transaction record is the detection of a reverse transaction, the transaction type includes a repurchase transaction and an investment transaction.

4. The method according to claim 3, characterized in that The detection conditions are determined based on the transaction type, including: If the transaction type is an investment transaction, the detection conditions include: the same asset code, the same investment portfolio, and the opposite transaction direction; Accordingly, detecting abnormal transaction records on the transaction record set based on the detection condition includes: Comparing the asset codes, investment portfolios and transaction directions in each pair of transaction records in the transaction record set; If the comparison result meets the detection condition, the pairwise transaction records are reverse transactions.

5. The method according to claim 3, characterized in that: The detection conditions are determined based on the transaction type, including: If the transaction type is a repurchase transaction, the detection conditions include: the investment portfolio is the same and the transaction direction is opposite; Accordingly, detecting abnormal transaction records on the transaction record set based on the detection condition includes: Comparing the investment portfolios and transaction directions of two transaction records in the transaction record set; If the comparison result meets the detection condition, the pairwise transaction records are reverse transactions.

6. The method according to claim 2, characterized in that If the detection of abnormal transaction records is the detection of short-term large-amount frequent transactions; The detection conditions are determined based on the transaction type, including: The detection conditions determined according to the transaction type include: the number of transactions is greater than the first set threshold and / or the transaction amount is greater than the second set threshold; wherein the transaction amount is greater than the second set threshold includes a single transaction amount greater than the second set threshold or a cumulative transaction amount greater than the second set threshold.

7. The method according to claim 6, characterized in that Detecting abnormal transaction records on the transaction record set based on the detection condition includes: Determine the number of transactions and / or transaction amount of the transaction records with the same investment portfolio and the same asset code in the transaction record set; If the number of transactions and / or the transaction amount meet the detection condition, the transaction records with the same investment portfolio and the same asset code in the transaction record set are determined as short-term large-amount frequent transactions.

8. A device for detecting abnormal transactions, characterized in that: include: A transaction record set acquisition module is used to acquire a transaction record set within a preset historical period; A transaction attribute extraction module, used to extract the transaction attributes of each transaction record in the transaction record set; wherein the transaction attributes include at least one of the following: transaction type, asset code, investment portfolio, transaction direction and transaction amount; An abnormal transaction record detection module, used to detect abnormal transaction records in the transaction record set according to at least one of the transaction attributes; wherein the detection of abnormal transaction records includes the detection of reverse transactions and the detection of short-term large-amount frequent transactions; The warning information generation module is used to generate warning information based on the detected abnormal transaction records.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the abnormal transaction detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the abnormal transaction detection method according to any one of claims 1 to 7 when executed.

Images