Fraud early warning method and device, electronic equipment and storage medium

Abstract

The invention provides a fraud early warning method and device, electronic equipment and a storage medium. The fraud early warning method comprises the following steps: acquiring a real first role feature, a real second role feature and a real third role feature of a to-be-processed user; acquiring a pre-generated user role cluster and a risk level of the user role cluster, matching the real first role feature of the to-be-processed user with the user role cluster, and taking the risk level of the successfully matched user role cluster as the risk level of the to-be-processed user; based on the real second role feature of the to-be-processed user, predicting to obtain a predicted third role feature of the to-be-processed user, and based on the predicted third role feature and the real third role feature, calculating a risk score of the to-be-processed user; and when the risk score of the to-be-processed user is greater than a preset score and the risk level of the to-be-processed user is greater than a preset level, executing fraud early warning operation for the to-be-processed user. According to the invention, the accuracy and applicability of fraud early warning can be improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a fraud warning method, device, electronic device and storage medium. Background Art

[0002] With the rapid development of communication technology and network information technology, telecommunication networks have become an indispensable part of people's daily life and work. People communicate, exchange information, and handle business through telecommunication networks, and telecommunication networks have penetrated into every corner of social and economic activities. However, with the widespread and convenient application of telecommunication networks, cybercrimes such as telecommunication fraud are becoming increasingly rampant. Fraudulent means vary, including but not limited to impersonating government agencies, emergency requests from relatives and friends, lottery fraud, investment and financial fraud, etc. These fraudulent behaviors not only cause economic losses to the victims, but also seriously disrupt the normal market order and social order. Therefore, the research and development of telecommunication fraud early warning technology is particularly urgent.

[0003] The current fraud warning methods mainly rely on user education and warnings, telephone number blacklist management, etc. These methods can reduce the occurrence of telecommunications fraud to a certain extent, but they also have shortcomings. Among them, user education and warnings rely on the self-consciousness of users and are not universal; blacklist management often lags behind fraudulent behavior and cannot deal with first-time fraud or frequent number changes. Therefore, the current fraud warning methods have low accuracy and poor applicability. Summary of the invention

[0004] In view of the above problems, the embodiments of the present application propose a fraud warning method, device, electronic device and storage medium to solve the problems of low accuracy and poor applicability of the fraud warning method.

[0005] According to one aspect of an embodiment of the present application, a fraud early warning method is provided, the method comprising:

[0006] Obtaining the real first role characteristics, the real second role characteristics and the real third role characteristics of the user to be processed;

[0007] Acquire a pre-generated user role cluster and a risk level of the user role cluster, match the real first role feature of the user to be processed with the user role cluster, and use the risk level of the successfully matched user role cluster as the risk level of the user to be processed;

[0008] Based on the real second role feature of the user to be processed, predicting a predicted third role feature of the user to be processed, and calculating a risk score of the user to be processed based on the predicted third role feature of the user to be processed and the real third role feature of the user to be processed;

[0009] When the risk score of the user to be processed is greater than a preset score, and the risk level of the user to be processed is greater than a preset level, a fraud warning operation is performed on the user to be processed.

[0010] According to another aspect of an embodiment of the present application, a fraud early warning device is provided, the device comprising:

[0011] An acquisition module, used to acquire the real first role characteristics, the real second role characteristics and the real third role characteristics of the user to be processed;

[0012] A matching module, used to obtain a pre-generated user role cluster and a risk level of the user role cluster, match the real first role feature of the user to be processed with the user role cluster, and use the risk level of the successfully matched user role cluster as the risk level of the user to be processed;

[0013] A calculation module, configured to predict a predicted third role feature of the user to be processed based on the real second role feature of the user to be processed, and calculate a risk score of the user to be processed based on the predicted third role feature of the user to be processed and the real third role feature of the user to be processed;

[0014] The early warning module is used to perform a fraud early warning operation on the user to be processed when the risk score of the user to be processed is greater than a preset score and the risk level of the user to be processed is greater than a preset level.

[0015] According to another aspect of an embodiment of the present application, an electronic device is provided, comprising a processor and a computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium; when the computer program is executed by the processor, the processor executes the fraud warning method as described in any one of the above items.

[0016] According to another aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the processor executes the fraud warning method as described in any one of the above items.

[0017] In the embodiment of the present application, an analysis is performed based on the role characteristics of the user to be processed. On the one hand, the risk level of the user to be processed is obtained by matching the real first role characteristics of the user to be processed with the pre-generated user role cluster and the risk level of the user role cluster. On the other hand, the predicted third role characteristics of the user to be processed are predicted by the real second role characteristics of the user to be processed. Then, the predicted third role characteristics of the user to be processed and the real third role characteristics of the user to be processed are compared to obtain the risk score of the user to be processed. Then, based on the risk level of the user to be processed and the risk score of the user to be processed, a comprehensive judgment is made as to whether to perform a fraud warning operation on the user to be processed. The role characteristics of the user to be processed can more accurately reflect the fraud risk of the user to be processed. At the same time, the comprehensive judgment based on the risk score and the risk level is more accurate, so the accuracy of the fraud warning can be improved. Moreover, the analysis of the role characteristics can be applied to various users, so the applicability of the fraud warning can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is a flowchart of the steps of a fraud warning method according to an embodiment of the present application;

[0019] Figure 2 is a schematic diagram of a sliding time window method in an embodiment of the present application;

[0020] Figure 3 is a schematic diagram of a clustering result of an embodiment of the present application;

[0021] Figure 4 It is a structural schematic diagram of a feature prediction model in an embodiment of the present application;

[0022] Figure 5 is a schematic diagram of a model prediction result of an embodiment of the present application;

[0023] Figure 6 It is a schematic diagram of a fraud warning processing process of an embodiment of the present application;

[0024] Figure 7 is a flow chart of a fraud early warning method according to an embodiment of the present application;

[0025] Figure 8 is a flow chart of another fraud early warning method according to an embodiment of the present application;

[0026] Fig. 9 This is a flow chart of creating a user role cluster according to an embodiment of the present application;

[0027] Fig.10 is a flow chart of updating a user role cluster according to an embodiment of the present application;

[0028] Fig.11is a flow chart of a model training process in an embodiment of the present application;

[0029] Fig.12 It is a structural block diagram of a fraud warning device according to an embodiment of the present application;

[0030] Fig.13 It is a structural block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments.

[0032] Reference Figure 1 , showing a step flow chart of a fraud warning method according to an embodiment of the present application.

[0033] like Figure 1 As shown, the fraud warning method may include the following steps:

[0034] Step 101, obtaining the real first role characteristics, the real second role characteristics and the real third role characteristics of the user to be processed.

[0035] Role characteristics refer to the characteristics used to describe and distinguish the social roles and behavior patterns of different users. These characteristics reflect information about the user's social attributes, social network relationships, communication behaviors, usage habits, transaction characteristics, etc., and can be used to identify and predict potential fraudulent activities.

[0036] Exemplarily, role characteristics include but are not limited to: social characteristics, first behavior characteristics, second behavior characteristics, third behavior characteristics, first time-space characteristics, second time-space characteristics, third time-space characteristics, etc. The first role characteristics include but are not limited to: social characteristics, first behavior characteristics, first time-space characteristics, second time-space characteristics, etc. The second role characteristics include but are not limited to: social characteristics, first behavior characteristics, second behavior characteristics, third behavior characteristics, first time-space characteristics, third time-space characteristics, etc. The third role characteristics include but are not limited to: first behavior characteristics, second behavior characteristics, first time-space characteristics, etc.

[0037] Exemplarily, the social characteristics may include the characteristics shown in Table 1 below:

[0038] Table 1 Social characteristics

[0039]

[0040] Exemplarily, the first behavior feature may include the features shown in Table 2 below:

[0041] Table 2 First behavior characteristics table

[0042]

[0043]

[0044] Exemplarily, the second behavior feature may include the features shown in Table 3 below:

[0045] Table 3 Second behavior characteristics table

[0046]

[0047] Exemplarily, the third behavior feature may include the features shown in Table 4 below:

[0048] Table 4 The third behavior characteristics table

[0049]

[0050] Exemplarily, the first spatiotemporal features may include the features shown in Table 5 below:

[0051] Table 5 The first spatiotemporal feature table

[0052]

[0053] Exemplarily, the second spatiotemporal features may include the features shown in Table 6 below:

[0054] Table 6 Second spatiotemporal characteristics table

[0055]

[0056] Exemplarily, the third spatiotemporal feature may include the features shown in Table 7 below:

[0057] Table 7 The third spatiotemporal characteristics table

[0058]

[0059] In the above tables, the use mark 1 means that the feature is used as the first role feature, the use mark 2 means that the feature is used as the second role feature, and the use mark 3 means that the feature is used as the third role feature. The features such as the number of calls, average call time, and the number of call counterpart numbers in the first behavior feature can be specifically subdivided into different time periods, such as the number of calls, average call time, and the number of call counterpart numbers in the past week, the working days of the past week, and the holidays of the past week. The historical behavior features in the third behavior feature can include the statistical behavior features of the day, week, and month, and the average value is generally taken. The first spatiotemporal feature, the second spatiotemporal feature, and the third spatiotemporal feature can be obtained in different time periods, such as all day on weekdays, daytime on weekdays, night on weekdays, all day on holidays, daytime on holidays, and night on holidays.

[0060] It should be noted that the role characteristics in the above tables are only used for illustration and are not intended to limit the embodiments of the present application. In a specific implementation, more or fewer role characteristics may be used according to actual needs.

[0061] In the embodiment of the present application, anomaly detection and data cleaning can also be performed on role features.

[0062] Since fraudulent users (users can be phone numbers) account for a small proportion of all users, their corresponding role characteristics will be quite different from those of non-fraudulent users. Therefore, in the process of anomaly detection, data missing processing and data logic verification can be performed, and there is no need to screen and fill out outliers based on statistical characteristics. In data missing processing, missing role characteristics can be processed by interpolating null values. In data logic verification, a set of verification rules can be defined and maintained to verify role characteristics one by one, such as whether the number of call counterparts is less than the number of calls, whether the total proportion of calls of each duration is 100%, etc. Role characteristics that fail the test can be deleted or modified.

[0063] Since the role features such as the functional area access sequence, functional area access frequency, functional area freeness, and functional area jump degree in the above-mentioned first spatiotemporal feature need to be calculated by other role features, these role features that need to be calculated can be obtained during the data cleaning process.

[0064] Functional area access sequence: Based on the latitude and longitude of the user accessing the base station such as the caller's place of origin and the caller's origin, the map application API (Application Programming Interface) is called to query the location information, obtain the location information and the surrounding POI (Point of Interest) information, and then extract the corresponding functional area (one or more) in the geographic tag of the location information, such as office buildings, schools, residential areas, hospitals, etc., to obtain the functional area access sequence.

[0065] Functional area visit frequency: According to the functional area visit sequence, calculate the user's visit frequency in different functional areas. Assume that the total residence time of user U in all functional areas is M (which can be obtained), and the total number of visits is N (which can be obtained). If user U is in functional area R i The residence time in is M i (can be obtained), the number of visits is N i (can be obtained), then user U has a certain preference for function area R i The access frequency F(U,R i ) is calculated as follows (1):

[0066]

[0067] Functional area freeness: define a freeness probability threshold γ. If user U is in a functional area R i The access frequency F(U,R i ) is greater than the probability threshold γ, then it is accumulated. Users with different roles have different regularities and periodicities in their spatiotemporal trajectories in the time series. The size of the regional freeness can reflect the role characteristics of different users. For example, office workers go out early and return late on weekdays to and from the work area and the living area, but rarely visit the work area on holidays. The specific value of the freeness probability threshold γ can be set according to actual needs.

[0068] The calculation formula of functional area freeness is as follows (2):

[0069]

[0070] Among them, S u represents the functional region freeness, and n represents the total number of functional regions in the functional region access sequence.

[0071] Functional area jump degree: the total number of functional areas visited by the user (that is, the total number of functional areas in the functional area access sequence). The size of the functional area jump degree can reflect the role characteristics of different users. For example, the area jump degree of a courier is very high, while the area jump degree of a teacher is very low.

[0072] Since some role characteristics are specific role characteristics that should not be made public, these specific role characteristics can be protected during the data cleaning process. Algorithm-based protection processing methods include differential privacy and homomorphic encryption, and data-based protection processing methods include data desensitization, data generalization, and feature selection. The former has a high computational cost and is suitable for scenarios such as public data sets and secure multi-party computing. The latter is relatively simple to process and is suitable for localized, private deployment, and scenarios where the feature sensitivity is not high. Since role characteristics are mainly used to distinguish role groups and judge the degree of behavioral risk, specific role characteristics such as name, ID number, and mobile phone number are rare, so data-based protection processing methods can be used to process specific role characteristics. Specific measures can be: select specific role characteristics based on the principle of minimum availability; symbolize specific role characteristics that can be symbolized, such as gender and education level can be replaced by digital classification; generalize specific role characteristics that can be generalized to a higher level, such as generalizing age to age groups, generalizing occupations to major categories, and generalizing specific address information to district-level information, etc.

[0073] In the embodiment of the present application, in order to more clearly distinguish the acquired role features from the predicted role features, the acquired role features are referred to as real role features, and the predicted role features are referred to as predicted role features. Specifically, the acquired first role features are referred to as real first role features, the acquired second role features are referred to as real second role features, the acquired third role features are referred to as real third role features, and the predicted third role features are referred to as predicted third role features.

[0074] In an embodiment of the present application, the sliding window method can be used to obtain the real first role characteristics, real second role characteristics and real third role characteristics of the user to be processed. The time window is used to capture the local characteristics of the data by moving a fixed-size window on the time series using the sliding window method. It is an effective time series analysis method. For each time window, the required role characteristics can be obtained. Therefore, the real first role characteristics may include the real first role characteristics of one or more time windows, the real second role characteristics may include the real second role characteristics of one or more time windows, and the real third role characteristics may include the real third role characteristics of one or more time windows. Among them, the time window of the real third role characteristics is located after the time window of the real second role characteristics.

[0075] Figure 2 Schematic diagram of a sliding time window method in an embodiment of the present application. Figure 2 As shown, the time window is T = {t1, t2, ..., t S}, the length of the time window is w, the sliding step of the time window is w / 2, and the role features included in each time window are F = {f1, f2, ..., f N}.

[0076] Step 102, obtaining a pre-generated user role cluster and the risk level of the user role cluster, matching the real first role feature of the user to be processed with the user role cluster, and using the risk level of the successfully matched user role cluster as the risk level of the user to be processed.

[0077] In the embodiment of the present application, user role clusters and risk levels of the user role clusters are generated in advance, wherein there are multiple user role clusters, each of which has its own risk level.

[0078] Exemplarily, the process of generating the user role cluster and the risk level of the user role cluster may include the following steps A1 to A2:

[0079] Step A1: obtaining real first role features of first sample users, and clustering the first sample users based on the real first role features of the first sample users to obtain multiple user role clusters.

[0080] The first sample user can be a full sample user, including fraud sample users and non-fraud sample users. Fraud sample users can be blacklist sample users. Blacklist sample users refer to phone numbers that are identified as being associated with fraudulent activities. These phone numbers are sourced through authoritative channels and are marked as "blacklisted". Blacklist sample users will be updated and managed in real time based on the latest fraud intelligence. Non-fraud sample users can be whitelist sample users. Whitelist sample users refer to phone numbers that are considered safe and trustworthy. These phone numbers come from known trustworthy users, trustworthy enterprises and institutions, and trustworthy numbers that have passed security verification and user feedback. Whitelist sample users will be updated and managed in real time based on the latest fraud intelligence and user feature analysis results.

[0081] For each first sample user, the real first role feature of the first sample user is obtained respectively. The process of obtaining the real first role feature of the first sample user is the same as the process of obtaining the real first role feature of the user to be processed, including anomaly detection and data cleaning processes, and the specific details can be referred to the relevant description above.

[0082] Exemplarily, the process of clustering the first sample users based on the real first role features of the first sample users to obtain a plurality of user role clusters may include the following steps A11 to A12:

[0083] Step A11: clustering the first sample users based on the real first role features of the first sample users to obtain a plurality of initial clusters.

[0084] In an embodiment of the present application, any applicable clustering method can be used to cluster the first sample users to obtain multiple initial clusters. For example, partition-based clustering, density-based clustering, grid-based clustering, model-based clustering, deep clustering, and the like. Different clustering algorithms have their own advantages and disadvantages, and are applicable to different application scenarios. The partition-based clustering algorithm requires the number of clusters to be specified in advance, and does not work well for non-spherical data. The granularity of the spatial division in grid-based clustering has a great influence on the clustering results, and does not work well for data of different densities. Model-based clustering requires the assumption that the data conforms to a certain distribution, which may not be consistent with the actual data, and the computational complexity is high. Deep clustering requires a large amount of data and consumes a lot of computing resources.

[0085] Based on this, the embodiments of the present application further consider that the data set may have clusters of different sizes and shapes, and it is difficult to determine the number of clusters in advance. At the same time, the data set is likely to have noise and outliers, so a density-based clustering algorithm is selected. The density-based clustering algorithm can find clusters of any shape, does not require the number of clusters to be preset, and can effectively handle noise and outliers. Furthermore, clustering is performed based on an improved multi-density data-based density peak clustering algorithm, and the cluster center is quickly selected by using local density and parent point distance as descriptive features.

[0086] Exemplarily, the process of clustering the first sample users based on the real first role features of the first sample users to obtain a plurality of initial clusters may include the following steps A111 to A114:

[0087] Step A111: for each first sample user, calculate the second distance between the real first role feature of the first sample user and the real first role features of other first sample users, and obtain the kth nearest neighbor second distance of the first sample user, where k is a positive integer.

[0088] For each first sample user, a second distance between the real first role feature of the first sample user and the real first role feature of each other first sample user is calculated. The specific process of calculating the second distance between the real first role feature of the first sample user and the real first role features of other first sample users can be processed based on actual experience, and this embodiment will not be discussed in detail here.

[0089] For each first sample user, the kth nearest neighbor second distance of the first sample user is obtained from the second distance corresponding to the first sample user, where k is a positive integer. The kth nearest neighbor second distance refers to the kth second distance after the second distances corresponding to the first sample user are sorted in ascending order. The specific value of k can be set according to actual needs.

[0090] Step A112, sorting the k-th nearest neighbor second distances of all the first sample users, calculating the first difference between the k-th nearest neighbor second distances of two adjacent first sample users after sorting, and when the first difference is less than a preset difference, dividing the two adjacent first sample users into the same initial sample set.

[0091] The kth nearest neighbor second distances of all the first sample users are sorted in ascending order or descending order. The specific value of the preset difference can be set according to actual needs, and this embodiment does not limit this.

[0092] For example, all the first sample users are arranged in ascending order according to the second distance of the kth nearest neighbor, and a distance line graph is drawn. The bifurcation points in the distance line graph are found, which are the first sample users with different densities. Then, all the first sample users are divided into multiple initial sample sets according to the first sample users with different densities.

[0093] Step A113: for each initial sample set, obtain the cutoff distance of the initial sample set, and obtain multiple cluster centers of the initial sample set.

[0094] Exemplarily, the process of obtaining the cutoff distance of the initial sample set may include: taking a preset initial value as a candidate distance; for each first sample user in the initial sample set, obtaining the total number of first sample users in the initial sample set whose fourth distance (the distance between the real first role features) with the first sample user is less than the candidate distance, as the cutoff number corresponding to the first sample user; when the average value of the cutoff numbers corresponding to all first sample users in the initial sample set is less than a preset percentage of the total number of first sample users in the initial sample set, increasing the candidate distance, and returning to the step of obtaining the total number of first sample users whose fourth distance with the first sample user is less than the candidate distance for each first sample user in the initial sample set; when the average value of the cutoff numbers corresponding to all first sample users in the initial sample set is greater than or equal to a preset percentage of the total number of first sample users in the initial sample set, using the candidate distance as the cutoff distance of the initial sample set. By gradually increasing the candidate distance, a more accurate cutoff distance can be obtained.

[0095] The preset initial value, the preset percentage, and the increase range of the candidate distance can be set according to actual needs, and this embodiment does not impose any limitation on this.

[0096] Exemplarily, the process of obtaining multiple cluster centers of the initial sample set may include: for each first sample user in the initial sample set, calculating the local density and the parent point distance of the first sample user, and taking the product of the local density and the parent point distance as the comprehensive parameter of the first sample user; sorting the comprehensive parameters of all first sample users in the initial sample set, calculating the second difference between the comprehensive parameters of two adjacent first sample users after sorting, and taking multiple groups of two adjacent first sample users whose second difference is less than the average value of all the second differences and whose second difference is the largest as the cluster centers of the initial sample set.

[0097] The local density can be calculated by the following formula (3):

[0098] in

[0099] Among them, ρ i represents the local density of the i-th first sample user in the initial sample set, d ij represents the distance between the i-th first sample user and the j-th first sample user in the initial sample set, d c is the cutoff distance of the initial sample set, and m represents the total number of other first sample users in the initial sample set except the i-th first sample user.

[0100] The parent point distance can be calculated by the following formula (4):

[0101]

[0102] Among them, δ i represents the parent point distance of the i-th first sample user in the initial sample set, d ij represents the distance between the i-th first sample user and the j-th first sample user in the initial sample set, ρ i represents the local density of the i-th first sample user in the initial sample set, ρ j represents the local density of the j-th first sample user in the initial sample set.

[0103] The comprehensive parameters of all first sample users in the initial sample set are sorted and summarized in a scatter plot, and then the second differences between adjacent points in the scatter plot and the average value of all second differences are calculated.

[0104] Step A114, for each cluster center of each initial sample set, take the cluster center as the cluster center of an initial cluster, calculate the third distance between the true first role feature of the first sample user in the initial sample set and the true first role feature of the cluster center, and divide the first sample user whose third distance is less than the cutoff distance into the initial cluster.

[0105] Step A12, calculate the clustering evaluation index, and when the clustering evaluation index meets the preset conditions, use the initial cluster as the user role cluster; when the clustering evaluation index does not meet the preset conditions, adjust the clustering parameters to re-cluster. The clustering parameters may include but are not limited to the above-mentioned preset difference, preset initial value, preset percentage, increase range of candidate distance, number of cluster centers, etc.

[0106] In the embodiment of the present application, by effectively evaluating the clustering effect, an initial cluster with better clustering effect is selected as the user role cluster, thereby improving the quality of the user role cluster.

[0107] Exemplarily, the clustering evaluation index may include, but is not limited to, at least one of the following: cluster silhouette coefficient, Davies-Bouldin index, Calinski-Harabasz index.

[0108] The clustering silhouette coefficient may be an average of the silhouette coefficients of all first sample users. The clustering silhouette coefficient is used to measure the clustering effect. The larger the clustering silhouette coefficient, the better the clustering effect.

[0109] Davies-Bouldin index: It is an indicator for evaluating clustering effect, mainly used to measure the compactness and separation of clusters. Compactness refers to how closely the samples in the cluster are clustered around the cluster center. Separation refers to the distance between different cluster centers. The lower the value of Davies-Bouldin index, the better the clustering effect, that is, the smaller the distance within the cluster and the larger the distance between clusters.

[0110] The calculation method of Davies-Bouldin index is as follows: Assume that the clustering results in a total of h initial clusters, and the initial cluster C i The cluster center is μ i , the initial cluster C j The cluster center is μ j , cluster center μ i and cluster centers μ j The distance between them is d(μ i ,μ j ), initial cluster C i All first sample users in the cluster center μ i The average distance is Si , the initial cluster C j All first sample users in the cluster center μ j The average distance is S j , then the initial cluster C i and the initial cluster C j The similarity R between ij Calculated by formula (5):

[0111]

[0112] For each initial cluster C in the h initial clusters i , find another initial cluster C with the greatest similarity j (i≠j), define the Davies-Bouldin index DB as the R of all initial clusters ij The average value of the maximum value is calculated by formula (6):

[0113]

[0114] Calinski-Harabasz index: It is an indicator used to evaluate clustering effect, also known as variance ratio criterion, which evaluates the effectiveness of clustering by comparing the ratio of the sum of squares between clusters to the sum of squares within clusters. The higher the value of Calinski-Harabasz index, the better the clustering effect, that is, the difference within the cluster is small and the difference between clusters is large.

[0115] The Calinski-Harabasz index is calculated as follows: Calculate the intra-cluster sum of squares WSS of the initial cluster, that is, the sum of the squares of the distances from all first sample users in the initial cluster to the cluster center. Calculate the inter-cluster sum of squares BSS of the initial cluster, that is, first calculate the center point of all first sample users as the global center, then for each initial cluster, calculate the square of the distance from the cluster center of the initial cluster to the global center, then calculate the product of the square of the distance and the total number of first sample users in the initial cluster, and finally add these products. Assuming that the clustering results in a total of h initial clusters and the total number of all first sample users is l, the Calinski-Harabasz index CH is calculated by formula (7):

[0116]

[0117] If there are multiple evaluation indicators for the initial cluster, when each evaluation indicator of the initial cluster satisfies its corresponding preset condition, the initial cluster is used as the user role cluster. For example, the preset condition corresponding to the clustering silhouette coefficient may be that the clustering silhouette coefficient is greater than a preset silhouette coefficient threshold; the preset condition corresponding to the Davies-Bouldin index may be that the Davies-Bouldin index is less than a preset first index threshold; the preset condition corresponding to the Calinski-Harabasz index may be that the Calinski-Harabasz index is greater than a preset second index threshold. The specific values ​​of the silhouette coefficient threshold, the first index threshold, and the second index threshold can be set according to actual needs.

[0118] Step A2: for each user role cluster, calculate the first distance between the real first role feature of the cluster center of the user role cluster and the real first role feature of the fraud sample user, and determine the risk level of the user role cluster based on the first distance.

[0119] The various distances (first distance, second distance, third distance, fourth distance, fifth distance, sixth distance) in the embodiments of the present application may be Euclidean distance, Mahalanobis distance, and the like.

[0120] For example, the calculation formula of Mahalanobis distance is shown in formula (8):

[0121]

[0122] Among them, DM ij (RC i ,X j ) represents the cluster center RC of a user role cluster i and a fraud sample user X j The Mahalanobis distance between -1 Represents the cluster center RC i 、Fraud sample user X j The inverse matrix of the covariance matrix, (RC i -X j ) T Represents (RC i -X j ) is the transpose of .

[0123] For each user role cluster, the risk level of the user role cluster can be determined based on the first distance between the cluster center of the user role cluster and each fraud sample user. The cluster center of the user role cluster is one of the first sample users.

[0124] Exemplarily, the process of determining the risk level of the user role cluster based on the first distance may include: obtaining the minimum first distance and the maximum first distance in the first distances (the first distances between the cluster center of the user role cluster and each fraud sample user respectively), and calculating the average first distance of all the first distances, and calculating the comprehensive score of the user role cluster based on the minimum first distance, the maximum first distance and the average first distance; and using the risk level corresponding to the comprehensive score as the risk level of the user role cluster.

[0125] The comprehensive score can be calculated using the following formula (9):

[0126] CS i =0.3*min(DM i )+0.5*avg(DM i )+0.2*max(DM i ) (9)

[0127] Among them, CS i represents the comprehensive score of the i-th user role cluster, min(DM i ) represents the minimum first distance corresponding to the i-th user role cluster, avg(DM i ) represents the average first distance corresponding to the i-th user role cluster, max(DM i ) represents the maximum first distance corresponding to the i-th user role cluster.

[0128] The correspondence between the comprehensive score and the risk level is set in advance in any applicable manner, and the risk level corresponding to the comprehensive score can be queried based on the correspondence.

[0129] For example, the values ​​in the interval [0, 1] can be pre-divided into multiple sub-intervals (e.g., multiple equal divisions with equal distances), and each sub-interval corresponds to a risk level. The larger the value of the sub-interval, the higher the risk level. After the comprehensive score is calculated, the comprehensive score is normalized to the interval [0, 1]. The risk level corresponding to the normalized comprehensive score is the risk level corresponding to the sub-interval in which the normalized comprehensive score is located.

[0130] In an embodiment of the present application, after generating user role clusters and risk levels of user role clusters, the user role clusters and risk levels of user role clusters can be saved. Of course, the cluster centers of the user role clusters and the characteristic statistical matrix of the user role clusters (including mean, median, 25% quantile, 75% quantile, standard deviation, etc.) can also be saved. Figure 3 A schematic diagram of a clustering result of an embodiment of the present application is shown in FIG. Figure 3As shown, after clustering, multiple user role clusters are obtained, and the risk level (Risk) of each user role cluster is obtained.

[0131] In the embodiment of the present application, in order to adapt to the emerging new fraud methods, the user role cluster can also be iteratively updated to continuously optimize the role characteristics. Iterative updates can be divided into two types, namely incremental updates and full updates.

[0132] Therefore, in the embodiment of the present application, the real first role features of the newly added sample users can also be obtained in real time or periodically, and the fifth distance between the real first role features of the newly added sample users and the real first role features of the cluster center of each of the user role clusters is calculated respectively. When the minimum fifth distance among the fifth distances corresponding to the newly added sample users is greater than the preset distance, the newly added sample users are used as sample users to be clustered. The newly added sample users can be fraud sample users or non-fraud sample users. The specific value of the preset distance can be set according to actual needs.

[0133] When the incremental update cycle is reached, or the total number of sample users to be clustered is greater than the first threshold and less than the second threshold, a newly added user role cluster and the risk level of the newly added user role cluster are generated based on the sample users to be clustered. The newly added user role cluster is merged with the previously generated user role cluster. The specific process of generating a newly added user role cluster and the risk level of the newly added user role cluster based on the sample users to be clustered is the same as the above-mentioned process of generating a user role cluster and the risk level of the user role cluster based on the first sample user, and specific reference may be made to the relevant description above.

[0134] When the full update cycle is reached, or the total number of the sample users to be clustered is greater than or equal to the second threshold, the user role clusters and the risk levels of the user role clusters are regenerated based on the sample users to be clustered and the first sample users. The previously generated user role clusters are replaced with the regenerated user role clusters. The process of regenerating the user role clusters and the risk levels of the user role clusters based on the sample users to be clustered and the first sample users is the same as the process of generating the user role clusters and the risk levels of the user role clusters based on the first sample users, and specific reference may be made to the relevant description above.

[0135] The incremental update period is less than the full update period. Specific values ​​of the incremental update period, the full update period, the first threshold, and the second threshold can be set according to actual needs.

[0136] After obtaining the real first role feature of the user to be processed, the real first role feature of the user to be processed is matched with the user role cluster, and the risk level of the successfully matched user role cluster is used as the risk level of the user to be processed.

[0137] Exemplarily, the process of matching the real first role characteristics of the user to be processed with the user role cluster may include: respectively calculating the sixth distance between the real first role characteristics of the user to be processed and the real first role characteristics of the cluster center of each of the user role clusters, and taking the user role cluster with the smallest sixth distance to the user to be processed as the successfully matched user role cluster.

[0138] Step 103: based on the real second role feature of the user to be processed, predict the predicted third role feature of the user to be processed, and calculate the risk score of the user to be processed based on the predicted third role feature of the user to be processed and the real third role feature of the user to be processed.

[0139] In an embodiment of the present application, a feature prediction model can be pre-trained, and the feature prediction model can be used to predict the predicted third role features of the user to be processed based on the real second role features of the user to be processed. This approach can improve the accuracy and efficiency of role feature prediction.

[0140] Exemplarily, the feature prediction model is trained in the following manner: obtaining the real second role feature and the real third role feature of the non-fraud sample user; using the real second role feature of the non-fraud sample user as the input of the feature prediction model to be trained, and obtaining the predicted third role feature of the non-fraud sample user output by the feature prediction model to be trained; calculating the loss function based on the predicted third role feature of the non-fraud sample user and the real third role feature of the non-fraud sample user; when the loss function is greater than or equal to a preset loss threshold, determining that the training is not completed, adjusting the model parameters to continue training; when the loss function is less than the preset loss threshold, determining that the training is completed, obtaining the feature prediction model, and saving the model parameters of the feature prediction model. The specific value of the loss threshold can be set according to actual needs.

[0141] Since non-fraud sample users come from all walks of life, the sample data for model training and testing are sufficiently representative and diverse, and have good credibility. Therefore, the feature prediction model trained using non-fraud sample users can learn users' daily normal behavior information.

[0142] In the embodiment of the present application, the feature prediction model can select a MIMO (Multiple Input Multiple Output) model of any applicable structure. The MIMO model is a model for processing a system with multiple inputs and multiple outputs. In many practical problems, there may be a complex nonlinear relationship between the input and output of the system. The MIMO model allows the system to process multiple inputs and multiple outputs at the same time. By considering multiple inputs and outputs, these complex relationships can be modeled more flexibly to adapt to different scenarios.

[0143] Figure 4 Schematic diagram of a feature prediction model in an embodiment of the present application. Figure 4 The feature prediction model includes an input layer, an LSTM (Long Short-Term Memory) network layer, a first fully connected layer, a hidden layer, a second fully connected layer, and an output layer connected in sequence. Of course, other structures can also be used, and this embodiment does not limit this.

[0144] LSTM network is a variant of RNN (Recurrent Neural Network). The main feature of LSTM network is the addition of a structure called "Memory Cell" to control the information flow of the network. This structure can memorize information and add it to the current processing when needed, so as to better process long sequence data. In order to predict time series, two fully connected layers are connected after LSTM network, because the two fully connected layers are wide enough and there is at least one activation function with any "squeezing" property, which can fit any continuous function well. There is a hidden layer (also called activation function layer) between the two fully connected layers. The activation function of the hidden layer can be set to any applicable activation function such as Tanh (hyperbolic tangent) activation function. Tanh activation function is nonlinear, allowing the network to learn complex nonlinear mappings, so as to better capture complex relationships in data. Tanh activation function maps input to the range [-1, 1]. Compared with some other activation functions, it can alleviate the gradient vanishing problem during gradient propagation.

[0145] In an embodiment of the present application, the feature prediction model can predict the predicted role features of the user in the next time window based on the real role features of the user's historical time window, and then determine whether the user's behavior is abnormal by comparing the predicted role features of the user in the next time window with the real role features of the user in the next time window. Therefore, the real second role features include the real second role features of the first S-1 time windows among the S time windows, the real third role features include the real third role features of the Sth time window among the S time windows, and the predicted third role features include the predicted third role features of the Sth time window among the S time windows, where S is a positive integer. For example, Figure 4 As shown, the input of the feature prediction model can be from t1 to t S The real second character feature of the time window is output as t S+1 The real third character feature of the time window. Among them, for the character features that are extra in the input compared to the output, they can be additionally counted and concatenated as input, thereby reducing the difficulty of training.

[0146] In the embodiment of the present application, the loss function includes but is not limited to: MSE (Mean Squared Error) loss function, cross entropy loss function, absolute value loss function, square loss function, etc.

[0147] Taking the mean square error loss function as an example, its calculation formula is shown in formula (10):

[0148]

[0149] Among them, MSE represents the mean square error loss function, q represents the total number of non-fraud sample users, p represents the total number of features in predicting the third role feature, and f ij represents the jth feature of the true third role feature of the i-th non-fraud sample user, Represents the jth feature of the predicted third role feature of the i-th non-fraud sample user.

[0150] The feedback of the model can be implemented by the gradient descent algorithm, where the update of the parameters is achieved by calculating the gradient of the loss function relative to the parameters. For LSTM, BPTT (Backpropagation Through Time) is a training algorithm whose mathematical expression can be expanded by the chain rule to perform gradient propagation for each time step in the network. Specifically, the gradient calculation for a certain time step can be expressed as formula (11):

[0151]

[0152] Among them, MSE represents the mean square error loss function, θ represents the model parameters, Represents the gradient (also known as partial derivative) of the mean square error loss function with respect to the model parameters, MSE ij represents the mean square error loss function on each output dimension, represents the gradient of the mean squared error loss function on each output dimension with respect to the model parameters, Represents partial derivative.

[0153] Then, the parameters are updated using the gradient descent algorithm using formula (12):

[0154]

[0155] Among them, θ new represents the updated model parameters, θ old represents the model parameters before update, η is the learning rate, which controls the step size of parameter update. During full training, η can be 0.1; during incremental training, η can be 0.005.

[0156] Based on the real second role feature of the user to be processed, predicting the predicted third role feature of the user to be processed includes: taking the real second role feature of the user to be processed as the input of a pre-trained feature prediction model, and obtaining the predicted third role feature of the user to be processed output by the feature prediction model.

[0157] Based on the comparison between the predicted third role feature of the user to be processed and the actual third role feature of the user to be processed, the risk score of the user to be processed may be calculated.

[0158] Exemplarily, the risk score of the user to be processed is calculated by the following formulas (13)-(15):

[0159]

[0160]

[0161] Among them, f i represents the i-th feature of the real third role feature of the user to be processed, represents the historical average value of the i-th feature in the real third role feature of the user to be processed, σ represents the historical standard deviation of the i-th feature in the real third role feature of the user to be processed, z represents the standard score of the i-th feature in the real third role feature of the user to be processed, represents the i-th feature of the predicted third role feature of the user to be processed, μ represents the penalty coefficient, and score iThe abnormal score of the i-th feature in the real third role feature of the user to be processed, p represents the total number of features in the real third role feature of the user to be processed, and score represents the risk score of the user to be processed.

[0162] Figure 5 Schematic diagram of a model prediction result of an embodiment of the present application. Figure 5 As shown in the figure, after model prediction, the score results of each feature can be obtained.

[0163] Step 104, when the risk score of the user to be processed is greater than a preset score, and the risk level of the user to be processed is greater than a preset level, a fraud warning operation is performed on the user to be processed.

[0164] The specific values ​​of the preset scores and preset levels can be set according to actual needs, and this embodiment does not impose any limitation on this.

[0165] In an embodiment of the present application, a corresponding notification service can be integrated, and the fraud warning operation can be to send a notification to the user that the user to be processed has a fraud risk when the user's behavior to be processed has a fraud risk, thereby ensuring that the notification can be delivered to the user in a timely and reliable manner, reminding the user of possible risks, and giving suggestions, such as not to disclose personal information, not to trust unfamiliar calls, etc.

[0166] For example, you can use services such as SMS gateways and voice notification APIs to implement multi-channel notifications. Specifically, SMS notifications: provide urgent text messages. Voice calls: call users by phone when necessary to provide detailed information. Mobile application notifications: use mobile applications to send real-time notifications to users.

[0167] The notification content may include: a specific description of the user to be processed; a risk assessment to guide the user to take appropriate measures; and contact information to obtain more information or confirm the user's identity.

[0168] Provide user feedback channels, such as: Confirmation mechanism: Allow users to confirm whether it is their own behavior. Denial mechanism: Users can deny abnormal behavior, triggering further verification process. Additional information provision: Allow users to provide additional information to assist model improvement.

[0169] In the embodiment of the present application, considering that the feature prediction model may need to be updated or retrained over time to adapt to new data distribution or business needs, the feature prediction model may be incrementally trained or fully trained.

[0170] Therefore, in the embodiment of the present application, the real second role characteristics and the real third role characteristics of the sample users predicted to be abnormal can be obtained. Among them, the sample users predicted to be abnormal include at least one of the following: users predicted to be abnormal according to the feedback of the fraud warning operation by the user, and users predicted to be abnormal according to the risk score. The user can give feedback on the fraud warning operation. If the user targeted by the fraud warning operation is a non-fraud user, the user can give feedback on the predicted abnormality of the user. After receiving the user's feedback, the feedback model will anonymize it and collect it, and record the warning content, user feedback, model output, etc. of each fraud warning operation as an important input for subsequent model retraining and adjustment. After using the feature prediction model to make a prediction and calculate the user's risk score, if the risk score is greater than the preset score, it can be verified whether the user is a non-fraud sample user. If so, the user is determined to be a user predicted to be abnormal.

[0171] When the incremental training cycle is reached, or the total number of sample users predicted to be abnormal is greater than the third threshold and less than the fourth threshold, the feature prediction model is retrained based on the real second role features and the real third role features of the sample users predicted to be abnormal. The process of retraining the feature prediction model based on sample users predicted to be abnormal is the same as the process of training the feature prediction model based on non-fraudulent sample users, and the specific details can be referred to the relevant description above.

[0172] When the full training cycle is reached, or the total number of sample users predicted to be abnormal is greater than or equal to the fourth threshold, the feature prediction model is retrained based on the real second role features and real third role features of the sample users predicted to be abnormal, and the real second role features and real third role features of the non-fraud sample users. The process of retraining the feature prediction model based on sample users predicted to be abnormal and non-fraud sample users is the same as the process of training the feature prediction model based on non-fraud sample users, and specific reference may be made to the relevant description above.

[0173] The incremental training cycle is smaller than the full training cycle. Specific values ​​of the incremental training cycle, the full training cycle, the third threshold, and the fourth threshold can be set according to actual needs.

[0174] Figure 6 FIG. 1 is a schematic diagram of a fraud warning processing process according to an embodiment of the present application. Figure 6 As shown, the fraud warning processing process includes role maintenance, model processing, and warning processing. Among them, the role maintenance process can include role creation and role update, the model processing process can include model training and model prediction, and the warning processing includes fraud warning and model retraining. The following is a detailed introduction.

[0175] Figure 7 Flowchart of a fraud warning method according to an embodiment of the present application. Figure 7 As shown, the fraud warning method may include: obtaining the real first role feature, the real second role feature and the real third role feature of the user to be processed; matching the real first role feature of the user to be processed with the user role cluster, and taking the risk level of the successfully matched user role cluster as the risk level of the user to be processed; judging whether the risk level is greater than a preset level; if not (the level is less than or equal to the preset level), terminating this detection; if (the risk level is greater than the preset level), using the feature prediction model to predict the predicted third role feature of the user to be processed based on the real second role feature of the user to be processed, and calculating the risk score of the user to be processed based on the predicted third role feature and the real third role feature; judging whether the risk score is greater than the preset score; if not (the risk score is less than or equal to the preset score), terminating this detection; if (the risk score is greater than the preset score), performing a fraud warning operation on the user to be processed; receiving user feedback, and saving the user with abnormal prediction in the feedback.

[0176] Figure 8 FIG. 1 is a flow chart of another fraud warning method according to an embodiment of the present application. Figure 8 As shown, the fraud warning method may include: obtaining the real first role feature, the real second role feature and the real third role feature of the user to be processed; using the feature prediction model to predict the predicted third role feature of the user to be processed based on the real second role feature of the user to be processed, and calculating the risk score of the user to be processed based on the predicted third role feature and the real third role feature; judging whether the risk score is greater than a preset score; if not (the risk score is less than or equal to the preset score), terminating this detection; if (the risk score is greater than the preset score), matching the real first role feature of the user to be processed with the user role cluster, and taking the risk level of the successfully matched user role cluster as the risk level of the user to be processed; judging whether the risk level is greater than the preset level; if not (the risk level is less than or equal to the preset level), terminating this detection; if (the risk level is greater than the preset level), performing a fraud warning operation on the user to be processed; receiving user feedback, and saving the user with abnormal prediction in the feedback.

[0177] Fig. 9 This is a flow chart of creating a user role cluster according to an embodiment of the present application. Fig. 9 As shown, the process of creating a user role cluster may include: obtaining the real first role characteristics of the first sample user (including data anomaly detection and data cleaning process); clustering the first sample users to obtain multiple user role clusters; determining the risk level of the user role cluster based on the first distance between the cluster center of the user role cluster and the fraud sample user; and outputting the user role cluster and the risk level of the user role cluster.

[0178] Fig.10 1 is a flow chart of updating a user role cluster according to an embodiment of the present application. Fig.10 As shown, the process of updating the user role cluster may include: obtaining the real first role characteristics of the newly added sample user (including data anomaly detection and data cleaning process); calculating the fifth distance between the newly added sample user and the cluster center of the user role cluster; judging whether the minimum fifth distance among the fifth distances corresponding to the newly added sample user is greater than the preset distance; if not (the minimum fifth distance is less than or equal to the preset distance), returning to the step of obtaining the real first role characteristics of the newly added sample user; if (the minimum fifth distance is greater than the preset distance), storing the newly added sample user as a sample user to be clustered in the sample pool; judging whether the incremental update condition or the full update condition is met; if the incremental update condition is met, generating a newly added user role cluster and a risk level of the newly added user role cluster based on the sample user to be clustered; outputting the newly added user role cluster and the risk level of the newly added user role cluster, and this update ends; if the full update condition is met, regenerating the user role cluster and the risk level of the user role cluster based on the sample user to be clustered and the first sample user; outputting the regenerated user role cluster and the risk level of the regenerated user role cluster; clearing the sample pool; and this update ends. The incremental update condition is: the incremental update period has been reached or the total number of sample users to be clustered is greater than the first threshold and less than the second threshold. The full update condition is: the full update period has been reached or the total number of sample users to be clustered is greater than or equal to the second threshold.

[0179] Fig.11 : is a flow chart of a model training process in an embodiment of the present application. Fig.11 As shown, the model training process includes: obtaining the real second role characteristics and real third role characteristics of non-fraud sample users (including data anomaly detection and data cleaning processes) as training samples; using the training samples to train the feature prediction model; using the feature prediction model to predict the user to be processed; obtaining the real second role characteristics and real third role characteristics of the sample user predicted to be abnormal; judging whether the full training conditions are met; if (the full training conditions are met), the sample users predicted to be abnormal and the non-fraud sample users are used as training samples, and the step of training the feature prediction model using the training samples is returned; if not (the full training conditions are not met), judging whether the incremental training conditions are met; if (the incremental training conditions are met), the sample users predicted to be abnormal are used as training samples, and the step of training the feature prediction model using the training samples is returned; if not (the incremental training conditions are not met), the step of predicting the user to be processed using the feature prediction model is returned.

[0180] In the embodiment of the present application, through the clustering and grading based on role characteristics, combined with the hybrid machine learning modeling of the feature prediction model, the suspected fraudulent numbers can be effectively learned and analyzed. This model design and the way of role characteristics make full use of the potential value of a large number of unlabeled samples, and at the same time can grade the fraudulent risks. The feature prediction model can use the user's historical role characteristics to infer whether the behavioral characteristics in the future time window are abnormal. Using this modeling method, the accuracy, recall rate and precision of fraudulent number identification have reached excellent levels. Through the combination and dynamic processing of user social characteristics, behavioral characteristics, and spatiotemporal characteristics, a three-dimensional evaluation of user role characteristics can be formed. At the same time, combined with the iterative update of user roles and real-time monitoring, self-optimization and dynamic update of modeling and early warning can be achieved, which can adapt to the ever-changing fraud methods and improve the accuracy and real-time performance of fraud identification. Using a composite learning strategy and a user feedback mechanism, false positives and missed reports can be reduced, more accurate early warning services can be provided, and false positives and missed reports can be reduced.

[0181] Reference Fig.12 , shows a structural block diagram of a fraud warning device according to an embodiment of the present application.

[0182] like Fig.12 As shown, the fraud warning device may include the following modules:

[0183] An acquisition module 1201 is used to acquire the real first role characteristic, the real second role characteristic and the real third role characteristic of the user to be processed;

[0184] A matching module 1202 is used to obtain a pre-generated user role cluster and a risk level of the user role cluster, match the real first role feature of the user to be processed with the user role cluster, and use the risk level of the successfully matched user role cluster as the risk level of the user to be processed;

[0185] A calculation module 1203 is used to predict a predicted third role feature of the user to be processed based on the real second role feature of the user to be processed, and calculate a risk score of the user to be processed based on the predicted third role feature of the user to be processed and the real third role feature of the user to be processed;

[0186] The early warning module 1204 is used to perform a fraud early warning operation on the user to be processed when the risk score of the user to be processed is greater than a preset score and the risk level of the user to be processed is greater than a preset level.

[0187] Optionally, the user role clusters and the risk levels of the user role clusters are generated by the following modules: a clustering module, used to obtain the real first role characteristics of the first sample users, cluster the first sample users based on the real first role characteristics of the first sample users, and obtain multiple user role clusters; the first sample users include fraud sample users and non-fraud sample users; a determination module, used to calculate, for each user role cluster, the first distance between the real first role characteristics of the cluster center of the user role cluster and the real first role characteristics of the fraud sample users, and determine the risk level of the user role cluster based on the first distance.

[0188] Optionally, the clustering module includes: a clustering submodule, used to cluster the first sample users based on the real first role characteristics of the first sample users to obtain multiple initial clusters; an evaluation submodule, used to calculate a clustering evaluation index, and when the clustering evaluation index meets a preset condition, using the initial cluster as the user role cluster.

[0189] Optionally, the clustering submodule includes: a distance calculation unit, which is used to calculate, for each first sample user, a second distance between the real first role feature of the first sample user and the real first role features of other first sample users, and obtain the kth nearest neighbor second distance of the first sample user, where k is a positive integer; a first division unit, which is used to sort the kth nearest neighbor second distances of all the first sample users, calculate the first difference between the kth nearest neighbor second distances of two adjacent first sample users after sorting, and when the first difference is less than a preset difference, divide the two adjacent first sample users into the same initial sample set; a parameter acquisition unit, which is used to obtain, for each initial sample set, a cutoff distance of the initial sample set and obtain multiple cluster centers of the initial sample set; a second division unit, which is used to take each cluster center of each initial sample set as the cluster center of an initial cluster, calculate the third distance between the real first role feature of the first sample user in the initial sample set and the real first role feature of the cluster center, and divide the first sample users whose third distance is less than the cutoff distance into the initial cluster.

[0190] Optionally, the parameter acquisition unit includes: a first parameter acquisition subunit, used to use a preset initial value as a candidate distance; for each first sample user in the initial sample set, obtaining the total number of first sample users in the initial sample set whose fourth distance with the first sample user is less than the candidate distance, as the cutoff number corresponding to the first sample users; when the average value of the cutoff numbers corresponding to all first sample users in the initial sample set is less than a preset percentage of the total number of first sample users in the initial sample set, increasing the candidate distance, and returning to the step of obtaining the total number of first sample users whose fourth distance with the first sample user is less than the candidate distance for each first sample user in the initial sample set; when the average value of the cutoff numbers corresponding to all first sample users in the initial sample set is greater than or equal to a preset percentage of the total number of first sample users in the initial sample set, using the candidate distance as the cutoff distance of the initial sample set.

[0191] Optionally, the parameter acquisition unit includes: a second parameter acquisition subunit, used to calculate the local density and the parent point distance of each first sample user in the initial sample set, and take the product of the local density and the parent point distance as the comprehensive parameter of the first sample user; sort the comprehensive parameters of all the first sample users in the initial sample set, calculate the second difference between the comprehensive parameters of two adjacent first sample users after sorting, and take multiple groups of two adjacent first sample users whose second difference is less than the average value of all the second differences and whose second difference is the largest as the clustering centers of the initial sample set.

[0192] Optionally, the clustering evaluation index includes at least one of the following: clustering silhouette coefficient, Davies-Bouldin index, Calinski-Harabasz index.

[0193] Optionally, a determination module is specifically used to obtain the minimum first distance and the maximum first distance among the first distances, and calculate the average first distance of all the first distances, and calculate the comprehensive score of the user role cluster based on the minimum first distance, the maximum first distance and the average first distance; and use the risk level corresponding to the comprehensive score as the risk level of the user role cluster.

[0194] Optionally, the device also includes: a new acquisition module, used to obtain the real first role characteristics of the newly added sample user, calculate the fifth distance between the real first role characteristics of the newly added sample user and the real first role characteristics of the cluster center of the user role cluster, and when the minimum fifth distance among the fifth distances corresponding to the newly added sample user is greater than a preset distance, the newly added sample user is used as a sample user to be clustered; an incremental update module, used to generate a newly added user role cluster and the risk level of the newly added user role cluster based on the sample users to be clustered when the incremental update cycle is reached or the total number of the sample users to be clustered is greater than the first threshold and less than the second threshold; a full update module, used to regenerate the user role cluster and the risk level of the user role cluster based on the sample users to be clustered and the first sample user when the full update cycle is reached or the total number of the sample users to be clustered is greater than or equal to the second threshold; the incremental update cycle is less than the full update cycle.

[0195] Optionally, the matching module 1202 is specifically configured to calculate a sixth distance between the real first role feature of the user to be processed and the real first role feature of the cluster center of the user role cluster, and take the user role cluster with the smallest sixth distance as the successfully matched user role cluster.

[0196] Optionally, the calculation module 1203 includes: a prediction submodule, configured to use the real second role feature of the user to be processed as an input of a pre-trained feature prediction model to obtain the predicted third role feature of the user to be processed output by the feature prediction model.

[0197] Optionally, the feature prediction model includes an input layer, a long short-term memory network layer, a first fully connected layer, a hidden layer, a second fully connected layer and an output layer connected in sequence.

[0198] Optionally, the feature prediction model is trained in the following manner: obtaining the real second role features and the real third role features of non-fraud sample users; using the real second role features of the non-fraud sample users as the input of the feature prediction model to be trained, and obtaining the predicted third role features of the non-fraud sample users output by the feature prediction model to be trained; calculating the loss function based on the predicted third role features of the non-fraud sample users and the real third role features of the non-fraud sample users, and when the loss function is less than a preset loss threshold, determining that the training is completed, and obtaining the feature prediction model.

[0199] Optionally, the device also includes: an anomaly acquisition module, used to obtain the real second role characteristics and real third role characteristics of sample users predicted to be abnormal; the sample users predicted to be abnormal include at least one of the following: users predicted to be abnormal and determined by verifying the risk score for users predicted to be abnormal based on the feedback of the fraud warning operation; an incremental training module, used to retrain the feature prediction model based on the real second role characteristics and real third role characteristics of the sample users predicted to be abnormal when the incremental training cycle is reached, or the total number of sample users predicted to be abnormal is greater than the third threshold and less than the fourth threshold; a full training module, used to retrain the feature prediction model based on the real second role characteristics and real third role characteristics of the sample users predicted to be abnormal and the real second role characteristics and real third role characteristics of the non-fraud sample users when the full training cycle is reached, or the total number of sample users predicted to be abnormal is greater than or equal to the fourth threshold; the incremental training cycle is less than the full training cycle.

[0200] Optionally, the real second role feature includes the real second role feature of the first S-1 time windows among the S time windows, the real third role feature includes the real third role feature of the Sth time window among the S time windows, and the predicted third role feature includes the predicted third role feature of the Sth time window among the S time windows, and S is a positive integer.

[0201] Optionally, the calculation module 1203 is specifically configured to calculate the risk score of the user to be processed based on the predicted third role feature of the user to be processed and the actual third role feature of the user to be processed by the following formula:

[0202]

[0203] Among them, f i represents the i-th feature of the real third role feature of the user to be processed, represents the historical average value of the i-th feature in the real third role feature of the user to be processed, σ represents the historical standard deviation of the i-th feature in the real third role feature of the user to be processed, z represents the standard score of the i-th feature in the real third role feature of the user to be processed, represents the i-th feature of the predicted third role feature of the user to be processed, μ represents the penalty coefficient, and score i The abnormal score of the i-th feature in the real third role feature of the user to be processed, p represents the total number of features in the real third role feature of the user to be processed, and score represents the risk score of the user to be processed.

[0204] As for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0205] In an embodiment of the present application, an electronic device is also provided. Fig.13 , shows a structural block diagram of an electronic device according to an embodiment of the present application. Fig.13 As shown, the electronic device 130 includes a processor 1301 and a computer-readable storage medium 1302 , on which a computer program 13021 is stored.

[0206] Processor 1301 is used to execute a computer program 13021 stored on a computer-readable storage medium 1302. When executing computer program 13021, processor 1301 implements the fraud warning method of any of the above-mentioned embodiments and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0207] The processor 1301 mentioned above may include but is not limited to: a central processing unit (CPU), a network processor (NP), a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0208] The computer-readable storage medium 1302 mentioned above may include but is not limited to: read-only memory (ROM), random access memory (RAM), compact disc read-only memory (CD-ROM), electronic erasable programmable read-only memory (EEPROM), hard disk, floppy disk, flash memory, etc.

[0209] In an embodiment of the present application, a computer-readable storage medium is further provided, on which a computer program is stored. The computer program can be executed by a processor of an electronic device. When the computer program is executed by the processor, the processor executes the fraud warning method described in any of the above embodiments.

[0210] It should be noted that all actions to obtain signals, information or data in this application are carried out in compliance with the relevant data protection laws and policies of the location and with the authorization given by the owner of the corresponding device.

[0211] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or terminal device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or terminal device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the existence of other identical elements in the process, method, article or terminal device including the elements.

[0212] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application.

[0213] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in the present application can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0214] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0215] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. In summary, the content of this specification should not be understood as limiting the present application.

Claims

1. A fraud early warning method, characterized in that: The method comprises: Obtaining the real first role characteristics, the real second role characteristics and the real third role characteristics of the user to be processed; Acquire a pre-generated user role cluster and a risk level of the user role cluster, match the real first role feature of the user to be processed with the user role cluster, and use the risk level of the successfully matched user role cluster as the risk level of the user to be processed; Based on the real second role feature of the user to be processed, predicting a predicted third role feature of the user to be processed, and calculating a risk score of the user to be processed based on the predicted third role feature of the user to be processed and the real third role feature of the user to be processed; When the risk score of the user to be processed is greater than a preset score, and the risk level of the user to be processed is greater than a preset level, a fraud warning operation is performed on the user to be processed.

2. The method according to claim 1, characterized in that The user role clusters and risk levels of the user role clusters are generated in the following manner: Acquire a real first role feature of a first sample user, and cluster the first sample users based on the real first role feature of the first sample users to obtain a plurality of user role clusters; The first sample users include fraud sample users and non-fraud sample users; For each user role cluster, a first distance between the real first role feature of the cluster center of the user role cluster and the real first role feature of the fraud sample user is calculated, and the risk level of the user role cluster is determined based on the first distance.

3. The method according to claim 2, characterized in that The clustering of the first sample users based on the real first role features of the first sample users to obtain a plurality of user role clusters includes: Clustering the first sample users based on the real first role features of the first sample users to obtain a plurality of initial clusters; A clustering evaluation index is calculated, and when the clustering evaluation index meets a preset condition, the initial cluster is used as the user role cluster.

4. The method according to claim 3, characterized in that The clustering of the first sample users based on the real first role features of the first sample users to obtain a plurality of initial clusters includes: For each first sample user, calculate the second distance between the real first role feature of the first sample user and the real first role features of other first sample users, and obtain the kth nearest neighbor second distance of the first sample user, where k is a positive integer; sorting the k-th nearest neighbor second distances of all the first sample users, calculating a first difference between the k-th nearest neighbor second distances of two adjacent first sample users after sorting, and when the first difference is less than a preset difference, grouping the two adjacent first sample users into the same initial sample set; For each initial sample set, obtaining a cutoff distance of the initial sample set and obtaining multiple clustering centers of the initial sample set; For each cluster center of each initial sample set, the cluster center is taken as the cluster center of an initial cluster, and the third distance between the true first role feature of the first sample user in the initial sample set and the true first role feature of the cluster center is calculated, and the first sample user whose third distance is less than the truncation distance is divided into the initial cluster.

5. The method according to claim 4, characterized in that The obtaining of the cutoff distance of the initial sample set includes: The preset initial value is used as the candidate distance; For each first sample user in the initial sample set, obtaining the total number of first sample users in the initial sample set whose fourth distance to the first sample user is less than the candidate distance as the cutoff number corresponding to the first sample user; When the average of the truncated numbers corresponding to all the first sample users in the initial sample set is less than a preset percentage of the total number of the first sample users in the initial sample set, increasing the candidate distance, returning to the step of obtaining, for each first sample user in the initial sample set, the total number of first sample users whose fourth distance to the first sample user is less than the candidate distance; When the average of the truncation numbers corresponding to all the first sample users in the initial sample set is greater than or equal to a preset percentage of the total number of the first sample users in the initial sample set, the candidate distance is used as the truncation distance of the initial sample set.

6. The method according to claim 4, characterized in that The obtaining of a plurality of cluster centers of the initial sample set comprises: For each first sample user in the initial sample set, calculate the local density and the parent point distance of the first sample user, and use the product of the local density and the parent point distance as the comprehensive parameter of the first sample user; Sort the comprehensive parameters of all the first sample users in the initial sample set, calculate the second difference between the comprehensive parameters of two adjacent first sample users after sorting, and take multiple groups of two adjacent first sample users whose second difference is less than the average of all the second differences and whose second difference is the largest as the clustering centers of the initial sample set.

7. The method according to claim 3, characterized in that The clustering evaluation index includes at least one of the following: clustering silhouette coefficient, Davies-Bouldin index, and Calinski-Harabasz index.

8. The method according to claim 2, characterized in that: The determining the risk level of the user role cluster based on the first distance includes: Obtaining a minimum first distance and a maximum first distance among the first distances, and calculating an average first distance of all the first distances, and calculating a comprehensive score of the user role cluster based on the minimum first distance, the maximum first distance, and the average first distance; The risk level corresponding to the comprehensive score is used as the risk level of the user role cluster.

9. The method according to claim 2, characterized in that: The method further comprises: Acquire the real first role feature of the newly added sample user, calculate the fifth distance between the real first role feature of the newly added sample user and the real first role feature of the cluster center of the user role cluster, and when the minimum fifth distance among the fifth distances corresponding to the newly added sample user is greater than a preset distance, use the newly added sample user as a sample user to be clustered; When the incremental update period is reached, or the total number of the sample users to be clustered is greater than the first threshold and less than the second threshold, generating a new user role cluster and a risk level of the new user role cluster based on the sample users to be clustered; When the full update cycle is reached, or the total number of the sample users to be clustered is greater than or equal to the second threshold, the user role clusters and the risk levels of the user role clusters are regenerated based on the sample users to be clustered and the first sample users; the incremental update cycle is less than the full update cycle.

10. The method according to claim 1, characterized in that The matching of the real first role feature of the to-be-processed user with the user role cluster includes: The sixth distance between the real first role feature of the user to be processed and the real first role feature of the cluster center of the user role cluster is calculated, and the user role cluster with the smallest sixth distance is taken as the user role cluster that is successfully matched.

11. The method according to claim 1, characterized in that: The predicting of the predicted third role feature of the user to be processed based on the real second role feature of the user to be processed includes: The real second role feature of the user to be processed is used as the input of the pre-trained feature prediction model to obtain the predicted third role feature of the user to be processed output by the feature prediction model.

12. The method according to claim 11, characterized in that The feature prediction model includes an input layer, a long short-term memory network layer, a first fully connected layer, a hidden layer, a second fully connected layer and an output layer which are connected in sequence.

13. The method according to claim 11, characterized in that The feature prediction model is trained in the following way: Obtain the real second role characteristics and real third role characteristics of non-fraud sample users; Using the real second role feature of the non-fraudulent sample user as the input of the feature prediction model to be trained, and obtaining the predicted third role feature of the non-fraudulent sample user output by the feature prediction model to be trained; A loss function is calculated based on the predicted third role features of the non-fraud sample users and the actual third role features of the non-fraud sample users. When the loss function is less than a preset loss threshold, the training is determined to be completed, and the feature prediction model is obtained.

14. The method according to claim 13, characterized in that The method further comprises: Acquire the real second role characteristics and the real third role characteristics of the sample users predicted to be abnormal; the sample users predicted to be abnormal include at least one of the following: users predicted to be abnormal according to the feedback of the fraud warning operation, and users predicted to be abnormal determined by verifying the risk score; When the incremental training cycle is reached, or the total number of the sample users predicted to be abnormal is greater than the third threshold and less than the fourth threshold, the feature prediction model is retrained based on the real second role features and the real third role features of the sample users predicted to be abnormal; When the full training cycle is reached, or the total number of sample users predicted to be abnormal is greater than or equal to the fourth threshold, the feature prediction model is retrained based on the real second role characteristics and the real third role characteristics of the sample users predicted to be abnormal, and the real second role characteristics and the real third role characteristics of the non-fraudulent sample users; the incremental training cycle is less than the full training cycle.

15. The method according to claim 1, characterized in that The real second character feature includes the real second character features of the first S-1 time windows among the S time windows, the real third character feature includes the real third character feature of the Sth time window among the S time windows, and the predicted third character feature includes the predicted third character feature of the Sth time window among the S time windows, where S is a positive integer.

16. The method according to claim 1, characterized in that The risk score of the user to be processed is calculated based on the predicted third role feature of the user to be processed and the actual third role feature of the user to be processed by the following formula: Among them, the f i represents the i-th feature of the real third role feature of the user to be processed, represents the historical average value of the i-th feature in the real third role feature of the user to be processed, σ represents the historical standard deviation of the i-th feature in the real third role feature of the user to be processed, z represents the standard score of the i-th feature in the real third role feature of the user to be processed, represents the i-th feature of the predicted third role feature of the user to be processed, μ represents the penalty coefficient, and score i The abnormal score of the i-th feature in the real third role feature of the user to be processed, p represents the total number of features in the real third role feature of the user to be processed, and score represents the risk score of the user to be processed.

17. A fraud early warning device, characterized in that: The device comprises: An acquisition module, used to acquire the real first role characteristics, the real second role characteristics and the real third role characteristics of the user to be processed; A matching module, used to obtain a pre-generated user role cluster and a risk level of the user role cluster, match the real first role feature of the user to be processed with the user role cluster, and use the risk level of the successfully matched user role cluster as the risk level of the user to be processed; A calculation module, configured to predict a predicted third role feature of the user to be processed based on the real second role feature of the user to be processed, and calculate a risk score of the user to be processed based on the predicted third role feature of the user to be processed and the real third role feature of the user to be processed; The early warning module is used to perform a fraud early warning operation on the user to be processed when the risk score of the user to be processed is greater than a preset score and the risk level of the user to be processed is greater than a preset level.

18. An electronic device, characterized in that: The electronic device comprises a processor and a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program; When the computer program is executed by the processor, the processor executes the fraud warning method according to any one of claims 1 to 16.

19. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the processor executes the fraud warning method according to any one of claims 1 to 16.

Images