Rule matching method and device based on DBSCAN algorithm
By clustering and matching rules indicators as standard points, the DBSCAN algorithm is used to improve the efficiency of rule matching, and the problem of low matching efficiency between transaction data and early warning rules in the existing technology is solved, and more efficient anti-fraud interception is achieved.
Patent Information
- Application Number
- CN202411739982.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-29
- Publication Date
- 2025-03-18
AI Technical Summary
In the prior art, the matching efficiency of transaction data and early warning rules is low, resulting in limited anti-fraud interception efficiency.
The rule matching method based on the DBSCAN algorithm is adopted, and the rule indicators are added to the batch data as standard points. The data are clustered through the DBSCAN algorithm to obtain a cluster with the standard points as the cluster center and rule matching is performed.
Through clustering and matching, the matching efficiency of rules can be greatly improved, the matching time can be reduced, and the efficiency of anti-fraud interception can be improved.
Smart Images
Figure CN119648249A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of data processing technology, and in particular to a rule matching method and device based on a DBSCAN algorithm. Background Art
[0002] The implementation of anti-fraud interception requires the cooperation of upstream and downstream systems. The upstream system makes judgments based on transaction data based on pre-set rules. When the transaction data triggers the rules, an early warning is generated and sent to the downstream system, thereby achieving interception.
[0003] Due to the wide variety of transaction types, many warning rules are set accordingly. When a transaction data is received, it will be matched with many warning rules in sequence, which will lead to low matching efficiency.
[0004] In summary, how to improve the matching efficiency of rules is an urgent problem that those skilled in the art need to solve. Summary of the invention
[0005] In view of this, the present application provides a rule matching method and device based on the DBSCAN algorithm, aiming to improve the matching efficiency of rules.
[0006] In a first aspect, the present application provides a rule matching method based on the DBSCAN algorithm, comprising:
[0007] Get batch data;
[0008] Adding the rule index as a standard point to the batch data to obtain processed batch data;
[0009] Clustering the processed batch data using the DBSCAN algorithm to obtain a cluster with the standard point as the cluster center;
[0010] Matching the standard point with the rule corresponding to the standard point;
[0011] If the match is successful, feedback information is generated.
[0012] Optionally, before clustering the processed batch data using the DBSCAN algorithm to obtain a cluster with the standard point as the cluster center, the method further includes:
[0013] Get historical batch data;
[0014] The DBSCAN algorithm is trained using the historical batch data to obtain the domain radius and density threshold of the DBSCAN algorithm.
[0015] Optionally, after matching the standard point with the rule corresponding to the standard point, the method further includes:
[0016] If the match is not successful, the standard point is matched with the rules other than the rule corresponding to the standard point;
[0017] If the match is successful, feedback information is generated.
[0018] Optionally, after adding the rule indicator as a standard point to the batch data to obtain the processed batch data, the method further includes:
[0019] Clustering the processed batch data using a DBSCAN algorithm to obtain noise batch data; the noise batch data is batch data that is not divided into clusters;
[0020] Matching the noise batch data with all the rules respectively;
[0021] If the match is successful, feedback information is generated.
[0022] In a second aspect, the present application provides a rule matching device based on the DBSCAN algorithm, comprising:
[0023] A first acquisition module, used for acquiring batch data;
[0024] An adding module, used for adding the rule index as a standard point to the batch data to obtain the processed batch data;
[0025] A first clustering module is used to cluster the processed batch data using a DBSCAN algorithm to obtain a cluster with the standard point as the cluster center;
[0026] A first matching module, used for matching the standard point with a rule corresponding to the standard point;
[0027] The first feedback module is used to generate feedback information if the match is successful.
[0028] Optionally, the device further comprises:
[0029] The second acquisition module is used to acquire historical batch data;
[0030] The training module is used to train the DBSCAN algorithm using the historical batch data to obtain the domain radius and density threshold of the DBSCAN algorithm.
[0031] Optionally, the device further comprises:
[0032] A second matching module, configured to match the standard point with rules other than the rule corresponding to the standard point respectively if the matching fails;
[0033] The second feedback module is used to generate feedback information if the match is successful.
[0034] Optionally, the device further comprises:
[0035] A second clustering module is used to cluster the processed batch data using a DBSCAN algorithm to obtain noise batch data; the noise batch data is batch data that is not divided into clusters;
[0036] A third matching module, used for matching the noise batch data with all the rules respectively;
[0037] The third feedback module is used to generate feedback information if the match is successful.
[0038] In a third aspect, an embodiment of the present application provides a computer device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements a rule matching method based on the DBSCAN algorithm as described in any one of the implementation methods in the first aspect of the embodiment of the present application.
[0039] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a terminal device, the terminal device executes a rule matching method based on the DBSCAN algorithm as described in any implementation method in the first aspect of the embodiment of the present application.
[0040] The present application provides a rule matching method based on the DBSCAN algorithm. When executing the method, first obtain batch data, then add the rule indicator as a standard point to the batch data to obtain the processed batch data, then cluster the processed batch data using the DBSCAN algorithm to obtain a cluster with the standard point as the cluster center, and match the standard point with the rule corresponding to the standard point. If the match is successful, feedback information is generated. In this way, by using the rule indicator as the standard point as the cluster center and using the standard point for rule matching, the batch data of the entire cluster can be matched with the rule only through one standard point, which can greatly improve the matching efficiency of the rule. BRIEF DESCRIPTION OF THE DRAWINGS
[0041] In order to more clearly illustrate the technical solutions in this embodiment or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0042] Figure 1A flowchart of a rule matching method based on the DBSCAN algorithm provided in an embodiment of the present application;
[0043] Figure 2 A schematic diagram of the structure of a rule matching device based on the DBSCAN algorithm provided in an embodiment of the present application;
[0044] Figure 3 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0045] The following will be combined with the accompanying drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. The present application provides a rule matching method and device based on the DBSCAN algorithm, which is used in the field of data processing technology. The above is only an example and does not limit the application field of the method and device name provided by the present application.
[0046] The implementation of anti-fraud interception requires the cooperation of upstream and downstream systems. The upstream system makes judgments based on transaction data based on pre-set rules. When the transaction data triggers the rules, an early warning is generated and sent to the downstream system, thereby achieving interception.
[0047] Due to the wide variety of transaction types, many warning rules are set accordingly. When a transaction data is received, it will be matched with many warning rules in sequence, which will lead to low matching efficiency.
[0048] After research, the inventor proposed the technical solution of this application, firstly obtaining batch data, then adding the rule indicator as a standard point to the batch data, obtaining the processed batch data, then clustering the processed batch data using the DBSCAN algorithm, obtaining a cluster with the standard point as the cluster center, and matching the standard point with the rule corresponding to the standard point, and generating feedback information if the match is successful. In this way, by using the rule indicator as the standard point as the cluster center and using the standard point for rule matching, the batch data of the entire cluster can be matched with the rule only through one standard point, which can greatly improve the matching efficiency of the rule.
[0049] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. It should be noted that, for ease of description, only the parts related to the relevant invention are shown in the accompanying drawings. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other.
[0050] See also Figure 1 , Figure 1 A flowchart of a rule matching method based on the DBSCAN algorithm provided in an embodiment of the present application includes:
[0051] S101: Acquire batch data.
[0052] Get batch data, such as batch transaction data.
[0053] S102: adding the rule index as a standard point to the batch data to obtain processed batch data.
[0054] Determine the rule indicator corresponding to the rule, add the rule indicator as a standard point to the batch data, and obtain the processed batch data.
[0055] S103: clustering the processed batch data using the DBSCAN algorithm to obtain a cluster with the standard point as the cluster center.
[0056] The DBSCAN algorithm is a density-based clustering algorithm that proposes the concept of neighborhood to reflect the clustering of data points. The algorithm has two core parameters: neighborhood radius and density threshold. Among them, the neighborhood radius describes the distance threshold, and the density threshold gives the minimum number of samples within the neighborhood radius of a certain sample point. The core idea of the DBSCAN algorithm is to divide the sample points into clusters one by one according to the neighborhood radius and density threshold, and the sample points that are not divided into clusters are regarded as noise sample points.
[0057] Before executing step S103, it is necessary to first obtain similar batch data from past transaction data, and use the historical batch data to train the DBSCAN algorithm to obtain the domain radius and density threshold of the DBSCAN algorithm.
[0058] The DBSCAN algorithm is used to cluster the processed batch data to obtain a cluster with the standard point as the cluster center. The specific implementation method is as follows: the processed batch data is used as a sample data set S, where S = {x1, x2, ..., x n}, where n is a positive integer. For any sample point x j , whose neighborhood refers to the sample point x j With centered at , and given a neighborhood radius Eps, the set of sample points that satisfies the following formula:
[0059] N Eps (x j )={x j ∈S|dist(x i ,x j )≤Eps};
[0060] Among them, dist(x i ,x j ) represents the Euclidean distance.
[0061] For x j A sample x in the neighborhood i If the number of sample points in its neighborhood is greater than the density threshold, then x is considered i and x j Belong to the same cluster, set as C s . Recursively traverse x j The remaining sample points in the neighborhood are judged to be j Whether they belong to the same cluster. s The above process needs to be repeated until C s If the number of sample points in no longer increases, clustering is considered complete.
[0062] S104: Match the standard point with the rule corresponding to the standard point.
[0063] The standard point is matched with the rule corresponding to the standard point. If the match is successful, it means that the cluster where the standard point is located matches the rule, and step S105 is executed; if the match is not successful, the standard point is matched with the rules other than the rule corresponding to the standard point. If the match is successful, step S105 is executed.
[0064] S105: If the match is successful, feedback information is generated.
[0065] In some embodiments, after adding the rule indicator as a standard point to the batch data to obtain the processed batch data, the processed batch data is clustered using the DBSCAN algorithm to obtain noise batch data, wherein the noise batch data is batch data that has not been divided into a cluster, and the noise batch data needs to be matched with all the rules respectively. If the match is successful, feedback information is generated.
[0066] In the embodiment provided by the present application, batch data is first obtained, and then the rule indicator is added to the batch data as a standard point to obtain the processed batch data. Then, the processed batch data is clustered using the DBSCAN algorithm to obtain a cluster with the standard point as the cluster center, and the standard point is matched with the rule corresponding to the standard point. If the match is successful, feedback information is generated. In this way, by using the rule indicator as the standard point as the cluster center and using the standard point for rule matching, the batch data of the entire cluster can be matched with the rule only through one standard point, which can greatly improve the matching efficiency of the rule.
[0067] The above are some specific implementations of the rule matching method based on the DBSCAN algorithm provided in the embodiments of the present application. Based on this, the present application also provides a corresponding device. The device provided in the embodiments of the present application will be introduced from the perspective of functional modularization.
[0068] See also Figure 2 , Figure 2 A schematic diagram of a rule matching device based on a DBSCAN algorithm provided in an embodiment of the present application is provided. The rule matching device 200 based on the DBSCAN algorithm includes:
[0069] A first acquisition module 210, used to acquire batch data;
[0070] An adding module 220, used for adding the rule index as a standard point to the batch data to obtain processed batch data;
[0071] A first clustering module 230 is used to cluster the processed batch data using a DBSCAN algorithm to obtain a cluster with the standard point as the cluster center;
[0072] A first matching module 240, configured to match the standard point with a rule corresponding to the standard point;
[0073] The first feedback module 250 is configured to generate feedback information if the match is successful.
[0074] Optionally, the device 200 further includes:
[0075] The second acquisition module is used to acquire historical batch data;
[0076] The training module is used to train the DBSCAN algorithm using the historical batch data to obtain the domain radius and density threshold of the DBSCAN algorithm.
[0077] Optionally, the device 200 further includes:
[0078] A second matching module, configured to match the standard point with rules other than the rule corresponding to the standard point respectively if the matching fails;
[0079] The second feedback module is used to generate feedback information if the match is successful.
[0080] Optionally, the device 200 further includes:
[0081] A second clustering module is used to cluster the processed batch data using a DBSCAN algorithm to obtain noise batch data; the noise batch data is batch data that is not divided into clusters;
[0082] A third matching module, used for matching the noise batch data with all the rules respectively;
[0083] The third feedback module is used to generate feedback information if the match is successful.
[0084] The embodiments of the present application also provide corresponding devices and computer storage media for implementing the solutions provided by the embodiments of the present application.
[0085] like Figure 3 As shown, the computer device 01 is in the form of a general computing device. The components of the computer device 01 may include but are not limited to: one or more processors or processing units 03, a system memory 08, and a bus 04 connecting different system components (including the system memory 08 and the processing unit 03).
[0086] Bus 04 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor or a local bus using any of a variety of bus structures. For example, these architectures include but are not limited to Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus and Peripheral Component Interconnect (PCI) bus.
[0087] The computer device 01 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the computer device 01, including volatile and non-volatile media, removable and non-removable media.
[0088] The system memory 08 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 09 and / or cache memory 10. The computer device 01 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 11 may be used to read and write non-removable, non-volatile magnetic media ( Figure 3 not shown, usually called a "hard drive"). Although Figure 3 Not shown in the figure, a disk drive for reading and writing a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 04 via one or more data medium interfaces. The memory 08 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.
[0089] A program / utility 12 having a set (at least one) of program modules 13 may be stored, for example, in the memory 08, such program modules 13 including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which or some combination thereof may include an implementation of a network environment. The program modules 13 generally perform the functions and / or methods of the embodiments described herein.
[0090] The computer device 01 may also communicate with one or more external devices 02 (e.g., keyboard, pointing device, display 07, etc.), one or more devices that enable a user to interact with the computer device 01, and / or any device that enables the computer device 01 to communicate with one or more other computing devices (e.g., network card, modem, etc.). Such communication may be performed via input / output (I / O) interface 06. Furthermore, the computer device 01 may also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN) and / or public network, such as the Internet) via network adapter 05. Figure 3 As shown, the network adapter 05 communicates with other modules of the computer device 01 via the bus 04. It should be understood that although Figure 3 Not shown, other hardware and / or software modules may be used in conjunction with computer device 01, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.
[0091] The processor unit 03 executes various functional applications and data processing by running the programs stored in the system memory 08, for example, implementing a rule matching method based on the DBSCAN algorithm provided in an embodiment of the present application.
[0092] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.
[0093] Through the description of the above implementation methods, it can be known that those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment method can be implemented by means of software plus a general hardware platform. Based on such an understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a storage medium, such as a read-only memory (ROM) / RAM, a magnetic disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network communication device such as a router) to execute the methods described in each embodiment of the present application or some parts of the embodiments.
[0094] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work.
[0095] The above description is merely an exemplary embodiment of the present application and is not intended to limit the protection scope of the present application.
Claims
1. A rule matching method based on DBSCAN algorithm, characterized in that: include: Get batch data; Adding the rule index as a standard point to the batch data to obtain processed batch data; Clustering the processed batch data using the DBSCAN algorithm to obtain a cluster with the standard point as the cluster center; Matching the standard point with the rule corresponding to the standard point; If the match is successful, feedback information is generated.
2. The method according to claim 1, characterized in that Before clustering the processed batch data using the DBSCAN algorithm to obtain a cluster with the standard point as the cluster center, the method further includes: Get historical batch data; The DBSCAN algorithm is trained using the historical batch data to obtain the domain radius and density threshold of the DBSCAN algorithm.
3. The method according to claim 1, characterized in that After matching the standard point with the rule corresponding to the standard point, the method further includes: If the match is not successful, the standard point is matched with the rules other than the rule corresponding to the standard point; If the match is successful, feedback information is generated.
4. The method according to claim 1, characterized in that After adding the rule indicators as standard points to the batch data to obtain the processed batch data, the method further includes: Clustering the processed batch data using a DBSCAN algorithm to obtain noise batch data; the noise batch data is batch data that is not divided into clusters; Matching the noise batch data with all the rules respectively; If the match is successful, feedback information is generated.
5. A rule matching device based on DBSCAN algorithm, characterized in that: include: A first acquisition module, used for acquiring batch data; An adding module, used for adding the rule index as a standard point to the batch data to obtain the processed batch data; A first clustering module is used to cluster the processed batch data using a DBSCAN algorithm to obtain a cluster with the standard point as the cluster center; A first matching module, used for matching the standard point with a rule corresponding to the standard point; The first feedback module is used to generate feedback information if the match is successful.
6. The device according to claim 5, characterized in that The device also includes: The second acquisition module is used to acquire historical batch data; The training module is used to train the DBSCAN algorithm using the historical batch data to obtain the domain radius and density threshold of the DBSCAN algorithm.
7. The device according to claim 5, characterized in that The device also includes: A second matching module, configured to match the standard point with rules other than the rule corresponding to the standard point respectively if the matching fails; The second feedback module is used to generate feedback information if the match is successful.
8. The device according to claim 5, characterized in that The device also includes: A second clustering module is used to cluster the processed batch data using a DBSCAN algorithm to obtain noise batch data; the noise batch data is batch data that is not divided into clusters; A third matching module, used for matching the noise batch data with all the rules respectively; The third feedback module is used to generate feedback information if the match is successful.
9. A computer device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the rule matching method based on the DBSCAN algorithm as described in any one of claims 1 to 4 is implemented.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed on a terminal device, the terminal device executes the rule matching method based on the DBSCAN algorithm as described in any one of claims 1 to 4.