Merchant exception type identification method and device, equipment, medium and program

Abstract

The embodiment of the invention provides a merchant exception type identification method and device, equipment, a medium and a program, and relates to the field of artificial intelligence, and the method comprises the steps: obtaining a portrait feature of a to-be-identified merchant, inputting the portrait feature into a risk identification model, and obtaining a risk type of a first merchant; obtaining a merchant relation graph of the to-be-identified merchant, and diffusing the risk type of the first merchant according to different relation types of the merchant relation graph to obtain the risk type of the to-be-identified merchant; and obtaining a credible identifier of the to-be-identified merchant, and determining an abnormal type of the to-be-identified merchant according to the risk type and the credible identifier of the to-be-identified merchant. According to the method, risk type identification is carried out through multi-modal portrait features, the risk identification accuracy can be improved, the risk types are diffused through the merchant relation graph to expand the coverage range of risk merchants, the risk types of the merchants and the credible identifiers are fused to determine the abnormal types of the to-be-identified merchants, and the risk identification accuracy is improved. And the accuracy of abnormity identification is improved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computer technology, and in particular, to a method, device, equipment, medium and program for identifying abnormal types of merchants. Background Art

[0002] As the scale of merchants increases year by year, various types of risks continue to emerge, and various illegal operations of merchants have brought great security risks to the online payment ecosystem.

[0003] In the prior art, the risk of merchants is determined through big data analysis, knowledge graphs or network models, but the accuracy of existing methods for identifying abnormal merchants is low. Summary of the invention

[0004] The embodiments of the present application provide a method, apparatus, device, medium and program for identifying abnormal merchant types, which can improve the accuracy of identifying abnormal merchants.

[0005] In a first aspect, an embodiment of the present application provides a method for identifying abnormal types of merchants, the method comprising: obtaining portrait features of a merchant to be identified, the portrait features comprising the following types of features: merchant transaction type features, merchant relationship type features and merchant basic portrait type features; inputting the portrait features of the merchant to be identified into a pre-trained risk identification model to obtain a risk type of a first merchant, the risk identification model is trained based on the portrait features of a training sample, and the risk identification model is used to identify multiple risk types; obtaining a merchant relationship map of the merchant to be identified, the merchant relationship map comprising a strong relationship map and a weak relationship map, and diffusing the risk type of the first merchant according to the merchant relationship map to obtain the risk type of the merchant to be identified; obtaining a trusted identifier of the merchant to be identified; and determining the abnormal type of the merchant to be identified based on the risk type and the trusted identifier of the merchant to be identified.

[0006] In a second aspect, an embodiment of the present application provides a device for identifying abnormal types of merchants, the device comprising: a feature acquisition module, used to acquire portrait features of the merchant to be identified, the portrait features comprising the following types of features: merchant transaction type features, merchant relationship type features and merchant basic portrait type features; a risk identification module, used to input the portrait features of the merchant to be identified into a pre-trained risk identification model to obtain the risk type of a first merchant, the risk identification model is trained based on the portrait features of training samples, and the risk identification model is used to identify multiple risk types; a diffusion module, used to acquire a merchant relationship map of the merchant to be identified, the merchant relationship map comprising a strong relationship map and a weak relationship map, and the risk type of the first merchant is diffused according to the merchant relationship map to obtain the risk type of the merchant to be identified; a trusted determination module, used to acquire a trusted identification of the merchant to be identified; and an abnormal determination module, used to determine the abnormal type of the merchant to be identified based on the risk type and the trusted identification of the merchant to be identified.

[0007] In some embodiments, the risk identification model includes multiple sub-identification models, each of which is used to identify the risk type of the merchant. The risk identification module is specifically used to: input the merchant's portrait features into the multiple sub-identification models respectively to obtain the candidate risk type output by each sub-identification model; and fuse the multiple candidate risk types output by the multiple sub-identification models to obtain the risk type of the first merchant.

[0008] In some embodiments, the multiple sub-recognition models include a traditional classification model and a deep model; the traditional classification model includes a linear model and / or a nonlinear model.

[0009] In some embodiments, the device also includes a training module, which is used to: obtain sample data of training samples, the sample data including merchant portrait features and risk type labels, the portrait features including the following types of features: merchant transaction type features, merchant relationship type features and merchant basic portrait type features; use the sample data of the training samples to train multiple candidate traditional classification models; obtain performance indicators of the multiple candidate traditional classification models, and determine the traditional classification model used by the risk identification model from the multiple candidate classification models based on the performance indicators of the multiple candidate traditional classification models; perform feature fusion and difficult sample mining on the sample data of the training samples, and use the fused features obtained by fusion and the difficult samples obtained by mining to train the deep model.

[0010] In some embodiments, the training module is specifically used to: obtain original sample data of an original training sample, wherein the original sample data includes original portrait features and risk type labels; perform feature selection on the original portrait features in the original sample data to obtain sample data of the original training sample; and perform sample iteration on the original training sample to obtain the training sample.

[0011] In some embodiments, the multiple candidate traditional classification models and the deep model are trained in a distributed parallel manner.

[0012] In some embodiments, the device further includes a monitoring module for: monitoring the values ​​and distribution of the preset features and label features of the merchant to be identified; and monitoring the performance of the risk identification model.

[0013] In some embodiments, the diffusion module is specifically used to: perform strong relationship diffusion on the risk type of the first merchant according to the strong relationship map and the first diffusion condition to obtain a first diffusion result; perform weak relationship diffusion on the risk type of the first merchant according to the weak relationship map and the second diffusion condition to obtain a second diffusion result; and combine the first diffusion result and the second diffusion result to obtain the risk type of the merchant to be identified.

[0014] In some embodiments, the strong relationships in the strong relationship graph include: one or more of the merchant's entity, legal person, super administrator and merged merchant number; the weak relationships in the weak relationship graph include: one or more of the merchant's employees, contact information, domain name, address and merchant name.

[0015] In some embodiments, the first diffusion condition includes the following multiple conditions: the current multi-level diffusion level is less than a preset first level threshold, the number of diffusion nodes of the current multi-level diffusion is less than a preset first number threshold, and the risk concentration of the current multi-level diffusion is greater than a preset first risk concentration threshold, wherein the risk concentration of the current multi-level diffusion is the maximum value of the ratio of the number of diffusion nodes of each risk type after the current multi-level diffusion to the number of diffusion nodes of the current multi-level diffusion; the second diffusion condition includes the following multiple conditions: the current diffusion level is less than a preset second level threshold, the number of diffusion nodes of the current level diffusion is less than a preset second number threshold, and the risk concentration of the current level diffusion is greater than a preset second risk concentration threshold.

[0016] In some embodiments, the trusted determination module is specifically used to: determine a second merchant with a KA label as a trusted merchant from the merchants to be identified based on the portrait features of the merchant to be identified; diffuse the trusted identifier of the second merchant based on the strong relationship graph to obtain the trusted identifier of the merchant to be identified.

[0017] In some embodiments, the trusted determination module is specifically used to: diffuse the trusted identifier of the second merchant according to the strong relationship graph and the third diffusion condition to obtain a trusted diffusion result; determine the trusted merchants among the remaining merchants according to at least one of the historical transaction information, risk type, and category information of the remaining merchants, and the remaining merchants are the merchants without trusted identifiers among the merchants to be identified.

[0018] In some embodiments, the trusted determination module is specifically used to: determine the activity and stability of the remaining merchants based on the historical transaction information of the remaining merchants; determine highly active and stable merchants from the remaining merchants based on the activity and stability of the remaining merchants; determine low-risk merchants from the highly active and stable merchants based on the risk types of the highly active and stable merchants to obtain a first set of trusted merchants; determine merchants of trusted categories based on the category information of the remaining merchants to obtain a second set of trusted merchants.

[0019] In some embodiments, the third diffusion condition includes the following conditions: the current multi-stage diffusion level is less than a preset third level threshold, and the number of diffusion nodes of the current multi-stage diffusion is less than a preset third number threshold.

[0020] In some embodiments, the device also includes a management and control module, which is used to obtain a merchant management and control strategy that matches the abnormal type of the merchant to be identified, wherein different merchant management and control strategies correspond to different abnormal types; and use the merchant management and control strategy to manage the merchant.

[0021] In some embodiments, the device also includes a query module, which is used to: receive a query request, the query request includes a query keyword, and the query keyword is an index of an entity in the merchant relationship map; perform a multi-level diffusion query based on the query keyword and the query level corresponding to the query keyword to obtain a query result, the query result includes abnormal information of the target merchant corresponding to the query keyword, abnormal information of the target merchant's strong relationship merchants, and abnormal information of the target merchant's weak relationship merchants; and distinguish between displaying the merchant's strong relationship merchants and weak relationship merchants based on pre-configured display configuration information of strong relationships and weak relationships.

[0022] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor and a memory, the memory being used to store a computer program, the processor being used to call and run the computer program stored in the memory to execute the method described in the first aspect or each implementation method above.

[0023] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store a computer program, and the computer program enables a computer to execute the method described in the first aspect or each implementation method above.

[0024] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the method of the first aspect or each implementation method described above.

[0025] The technical solution provided by the embodiment of the present application is to obtain the portrait features of the merchant to be identified, input the portrait features of the merchant to be identified into the pre-trained risk identification model, and obtain the risk type of the first merchant, which is used to identify multiple risk types; obtain the merchant relationship map of the merchant to be identified, the merchant relationship map includes a strong relationship map and a weak relationship map, and diffuse the risk type of the first merchant according to the merchant relationship map to obtain the risk type of the merchant to be identified; obtain the trusted identification of the merchant to be identified, and determine the abnormal type of the merchant to be identified according to the risk type and trusted identification of the merchant to be identified. In this method, the risk type is identified through multi-modal portrait features, which can improve the accuracy of risk identification, and the risk type and trusted identification are diffused through the merchant relationship map to expand the coverage of risky merchants and trusted merchants. The risk type and trusted identification of the merchant to be identified are integrated to determine the abnormal type of the merchant to be identified, thereby improving the accuracy of abnormal identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0027] Figure 1 is a flow chart of a method for identifying abnormal merchant types provided in Example 1 of the present application;

[0028] Figure 2 A schematic diagram of a strong relationship map and a weak relationship map;

[0029] Figure 3 The risk types and distribution of trusted identifiers of merchants to be identified;

[0030] Figure 4 The overall flow chart of the method for identifying abnormal merchant types provided in this application;

[0031] Figure 5 A flowchart of a method for training a risk identification model provided in Example 2 of the present application;

[0032] Figure 6 A flowchart of a method for training a risk identification model provided in Example 3 of the present application;

[0033] Figure 7 The diffusion diagram for risk diffusion and credible diffusion;

[0034] Figure 8 A flowchart of a method for training a risk identification model provided in Example 4 of the present application;

[0035] Fig. 9 A flowchart for mining trusted merchants;

[0036] Fig.10 A flowchart of a method for identifying abnormal merchant types provided in Embodiment 5 of the present application;

[0037] Fig.11 A processing flow chart of a merchant relationship map provided in an embodiment of the present application;

[0038] Fig.12 A schematic diagram of query results of abnormal types of merchants;

[0039] Fig.13 A schematic diagram of the structure of a device for identifying abnormal merchant types provided in Embodiment 6 of the present application;

[0040] Fig.14 A structural schematic diagram of an electronic device provided in Example 7 of the present application. DETAILED DESCRIPTION

[0041] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0042] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0043] In order to facilitate the understanding of the embodiments of the present application, before describing the various embodiments of the present application, some concepts involved in all the embodiments of the present application are first appropriately explained.

[0044] The scale of merchants is gradually increasing. Merchants include online merchants and offline merchants. Offline merchants usually conduct face-to-face transactions in fixed places, and the transaction risks are relatively low. Online merchants conduct transactions through online payment, and users can complete transactions without leaving home. Although online transactions have their convenience, there are also more payment security issues. Therefore, it is necessary to effectively identify abnormal merchants and normal merchants, protect the transactions of normal merchants from being affected, and control abnormal merchants, for example, refuse risky merchants to settle in, control the permissions of risky merchants, and restrict transactions for risky merchants.

[0045] Abnormal merchants are also called risky merchants, and risky merchants can be identified by risk type. Normal merchants are also called trusted merchants, and trusted merchants do not have risks. If the risk value is used to represent the size of the risk, then the risk value of a trusted merchant can be considered to be 0.

[0046] The embodiment of the present application provides a method for identifying abnormal types of merchants, which uses multi-dimensional data to identify risk types, can identify multiple risk types, and individually perform trustworthy identification on merchants, and integrate the risk types and trustworthy identification results of merchants to obtain abnormal types of merchants, thereby improving the accuracy of abnormal merchant identification, and can also distinguish merchant relationships based on merchant relationship maps, and spread risk types and trustworthy identification results based on relationship types, thereby expanding the coverage of risk type users and trustworthy users.

[0047] The identification method of the merchant exception type provided in the embodiment of the present application can be executed by an exception handling device, which can be a terminal device or a server.

[0048] Terminal devices include mobile phones, tablet computers, desktop computers, portable laptops, intelligent voice interaction devices, smart home appliances and other forms of devices.

[0049] The server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud security, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), as well as big data and artificial intelligence platforms.

[0050] After introducing some concepts involved in the embodiments of the present application, a method for identifying merchant abnormality types provided in the embodiments of the present application is specifically described below with reference to the accompanying drawings.

[0051] Figure 1 is a flow chart of a method for identifying abnormal merchant types provided in the first embodiment of the present application. Figure 1 As shown, the method of this embodiment includes the following steps.

[0052] S101. Obtaining portrait features of the merchant to be identified, the portrait features include the following types of features: merchant transaction type features, merchant relationship type features and merchant basic portrait type features.

[0053] The merchant portrait features obtained in this embodiment can be features of multiple dimensions. According to the needs of the actual application scenario, thousands of dimensions or hundreds of dimensions can be selected. Using multi-dimensional features to identify the risks of merchants can improve the accuracy of risk identification.

[0054] According to the source of feature data, the following types of features can be included: merchant transaction type features, merchant relationship type features and merchant basic portrait type features. Among them, merchant transaction type features are features determined based on the merchant's transaction data, including but not limited to: merchant deposit features, withdrawal features and transaction distribution. Merchant transaction data includes deposit amount, withdrawal amount, transaction type, transaction time, etc.

[0055] The merchant relationship type feature is a feature extracted from the merchant's relationship data, which is used to characterize the relationship between the merchant and other people. The merchant's relationship data includes the relationship between merchants, the relationship between merchants and users (legal persons, employees), the transaction relationship between merchants and customers, etc.

[0056] The merchant's basic portrait type characteristics are determined based on the merchant's entry information provided when the merchant enters (or registers or registers) the platform. The merchant's entry information includes images and text content provided at the time of entry, including but not limited to merchant name, legal person information, registration time, registered capital, etc.

[0057] The portrait features of the merchant to be identified include real-time features and offline features, wherein the real-time features are features obtained by real-time statistics based on the merchant's current transaction scenario, and the offline features are features obtained by statistics of the merchant's historical transaction data, historical relationship data, etc. over a period of time in an offline manner. It can be understood that the real-time features of the merchant that can be extracted by the device are usually less than the offline features, and the offline features include more and more comprehensive features. Of course, in some scenarios, the merchant's portrait may also only use offline features, and this embodiment does not limit this.

[0058] S102. Input the portrait features of the merchant to be identified into a pre-trained risk identification model to obtain the risk type of the first merchant. The risk identification model is trained based on the portrait features of the training samples, and the risk identification model is used to identify multiple risk types.

[0059] The risk identification model is used to identify the risk type of the merchant. The risk identification model is used to identify multiple existing risk types. The risk identification model used in the prior art can usually only identify a single risk type.

[0060] The image features of the training sample also include the following types of features: merchant transaction type features, merchant relationship type features and merchant basic image type features. When training the risk identification model, offline features are usually used for training. When training the risk identification model, the data of the training sample also includes risk type labels, which are also referred to as risk labels. Risk labels are used to identify risk types. Risk labels are obtained based on user feedback, third-party feedback or other model identification. Optionally, the image features of the training sample also include complaint labels and important merchant (KeyAccount, referred to as KA) labels.

[0061] The risk identification model may include one or more sub-identification models. When the risk identification model includes multiple sub-identification models, each sub-identification model is used to separately identify the risk type of the merchant. Accordingly, the merchant's portrait features are respectively input into the multiple sub-identification models to obtain the candidate risk type output by each sub-identification model, and the multiple candidate risk types output by the multiple sub-identification models are fused to obtain the merchant's risk type.

[0062] Multiple sub-identification models perform risk identification independently, and the identified multiple candidate risk types are fused. The accuracy of risk identification model identification can be improved through multi-model fusion.

[0063] Exemplarily, multiple candidate risk types output by multiple sub-recognition models may be fused in the following manner:

[0064] Method 1: Voting is performed on multiple candidate risk types output by multiple sub-recognition models to obtain the risk type of the merchant.

[0065] For example, the risk identification model includes three sub-identification models. When the identification results of two or more sub-identification models are the same, the identification results of the two or more sub-identification models are determined as the identification results of the risk identification model. When the identification results of the three sub-identification models are different, the identification results are considered to be wrong or unrecognizable.

[0066] Method 2: Determine the risk type of the merchant based on the probabilities corresponding to multiple candidate risk types output by multiple sub-recognition models.

[0067] The sub-identification model can also obtain the probability corresponding to the output candidate risk type. For example, the candidate risk type output by sub-identification model 1 is type 1, and the probability that the merchant is type 1 can be output. The risk type with the highest probability can be selected as the merchant's risk type.

[0068] Optionally, the multiple sub-recognition models include a traditional classification model and a deep model, and the traditional classification model includes a linear model and / or a nonlinear model.

[0069] S103: Obtain a merchant relationship map of the merchant to be identified, where the merchant relationship map includes a strong relationship map and a weak relationship map, and diffuse the risk type of the first merchant according to the merchant relationship map to obtain the risk type of the merchant to be identified.

[0070] The risk identification model can only identify the risk types of some merchants (i.e., the first merchant) among the merchants to be identified, and the risk types of the remaining merchants cannot be identified. The remaining merchants may be unable to be identified due to too few portrait features obtained or other reasons. For example, the transaction data of some merchants is missing or too little, resulting in the inability to identify the risk characteristics of the merchants.

[0071] Therefore, for risky merchants, in addition to using the risk identification model for single-point identification, it is also necessary to blacken the associated merchants, that is, to mark the merchants associated with the risky merchants as risky. There are many types of relationships in merchant relationships, and the stability and reliability of different types of relationships are different. In this embodiment, merchant relationships are divided into two categories according to the stability and reliability of merchant relationships: strong relationship type and weak relationship type.

[0072] Exemplarily, the strong relationships in the strong relationship graph include: one or more of the merchant's principal, legal person, super administrator (referred to as super administrator) and merged merchant number. The weak relationships in the weak relationship graph include: one or more of the merchant's employees, contact information, domain name, address and merchant name.

[0073] Figure 2 A schematic diagram of a strong relationship map and a weak relationship map, refer to Figure 2 As shown in the figure, the merchant strong relationship includes: the merchant's principal, legal person, super administrator and merged merchant number. The merchant weak relationship includes: the merchant's employees, contact number, domain name, address and merchant name.

[0074] The main body of a merchant may be the merchant's business license. Each merchant has a unique business license. Each merchant may have multiple stores, and the multiple stores share the same business license.

[0075] Optionally, in order to ensure the reliability of merchant relationships, some merchant relationships have constraints, and when establishing a merchant relationship, the merchant relationship needs to satisfy the constraints.

[0076] For example, super administrators are constrained by time and magnitude. Time constraints refer to determining super administrators at specified times. For example, a merchant may have had multiple super administrators in the past 10 years, but the early super administrators may have left. Therefore, when determining the merchant's super administrator, it is necessary to select super administrators within the last three months or one year. The magnitude constraint of super administrators refers to the number of stores managed by super administrators. Usually, the number of stores managed by a super administrator is limited. If the information is registered incorrectly, the number of stores managed by the super administrator may be much larger than the normal value. For example, the threshold of the number of stores managed by super administrators is set to 10,000. If the number of stores managed by super administrators is greater than 10,000, the super administrator is considered untrustworthy.

[0077] For another example, risk constraints are imposed on merchant numbers. For some group companies, the group company has multiple enterprises, each of which has a different merchant number. Some enterprises under the group may be risky. When determining the merchant number of the enterprise, risky enterprises are filtered. If most of the enterprises in the group are risky, then the enterprise can be considered risky and all enterprises in the group are excluded.

[0078] After obtaining the strong relationship map and weak relationship map of the merchant, the risk type of the first merchant is diffused according to the strong relationship map and the weak relationship map, respectively, to obtain the risk type of the merchant to be identified. During the diffusion, according to the merchant relationship map, the merchants strongly associated with the first merchant are determined according to the strong relationship of the first merchant, and the merchants weakly associated with the first merchant are determined according to the weak relationship of the first merchant. Taking the strong relationship as an example, the merchants strongly associated with the first merchant refer to the merchants with the same subject, legal person, super-management or merged merchant as the first merchant.

[0079] Some of the merchants strongly associated with the first merchant and the merchants weakly associated with the first merchant obtained by diffusion may not have risk labels. The purpose of diffusion is to set risk labels for the merchants without risk labels among these associated merchants.

[0080] When performing risk diffusion, one-level or multi-level diffusion can be performed. There may be problems with data explosion and diffusion accuracy during diffusion. Therefore, when performing multi-level diffusion of strong relationships and diffusion of weak relationships, constraints need to be imposed based on risk concentration and the number of diffusion nodes. The risk concentration is used to indicate the maximum risk probability after each level of diffusion, and the number of diffusion nodes is used to indicate the number of diffusion nodes obtained after each level of diffusion. For example, when the number of diffusion nodes obtained after a certain level of diffusion is greater than the preset number threshold or the risk concentration is less than the preset risk concentration value, the diffusion is stopped.

[0081] S104: Obtain a trusted identifier of the merchant to be identified.

[0082] In one implementation, based on the portrait features of the merchant to be identified, a second merchant with a KA label is determined from the merchants to be identified as a trusted merchant. Some merchants in the portrait features of the merchants to be identified have a KA label, and the KA label indicates that the merchant is a trusted merchant. The KA label is usually manually marked, for example, a label marked for the merchant when the merchant is registered.

[0083] Optionally, the trusted identifier of the trusted merchant is a KA tag. Of course, the trusted identifier can also be identified by other tags different from the KA tag. Accordingly, after the trusted merchant is determined, a trusted identifier is set for the trusted merchant.

[0084] In another implementation, based on the portrait features of the merchant to be identified, a second merchant with a KA label is determined as a trusted merchant from the merchants to be identified, and the trusted identifier of the second merchant is diffused according to the strong relationship graph to obtain the trusted identifier of the merchant to be identified.

[0085] In another implementation, based on the portrait features of the merchant to be identified, a second merchant with a KA label is determined as a trusted merchant from the merchants to be identified, the trusted identifier of the second merchant is diffused according to the strong relationship graph, and the trusted merchant is determined from the remaining merchants based on at least one of the merchant's historical transaction information, risk type, and category information of the merchant.

[0086] Optionally, the trust types are graded, for example, trusted merchants are divided into first-level trusted merchants and second-level trusted merchants. Accordingly, the trusted merchant identifier has multiple values, for example, the trusted identifier includes a first-level trusted identifier and a second-level trusted identifier.

[0087] After obtaining the trusted identifier of the second merchant, the trusted identifier of the second merchant is diffused using a strong relationship graph. The strong relationship diffusion of the trusted identifier is similar to the strong relationship diffusion of the risk label. Through the strong relationship diffusion of the trusted identifier, a trusted identifier is set for the merchants to be identified that are strongly associated with the second merchant. Among the merchants strongly associated with the second merchant obtained through diffusion, some have trusted identifiers, while some do not. A trusted identifier is set for the merchants that do not have a trusted identifier.

[0088] In this embodiment, the risk types and trustworthy identifiers of merchants are spread through different types of relationship graphs of merchants, thereby increasing the coverage of risky merchants and trustworthy merchants. Figure 3 For the risk types of merchants to be identified and the distribution of trusted identifiers, refer to Figure 3 As shown, the horizontal axis is the risk level, and the vertical axis is the quality level (or called the credibility level). Merchants in the gray-filled elliptical area are safe and credible merchants. Purely malicious merchants refer to the first merchants identified according to the risk identification model. There are also some normal, unknown merchants and exploited credible merchants among the merchants to be identified. For these merchants, relationship graph diffusion is performed. The relationship graph diffusion includes the diffusion of risk types according to the merchant relationship graph and the diffusion of credible identification according to the merchant relationship graph. For credible merchants, some other credible merchant mining algorithms can also be used to mine credible merchants.

[0089] S105: Determine the abnormal type of the merchant to be identified according to the risk type and the trustworthy identifier of the merchant to be identified.

[0090] Some of the merchants to be identified have risk tags, some have trusted tags, some have both trusted tags and risk tags, and some have neither trusted tags nor risk tags. In this embodiment, the risk type and trusted identifier of the merchant to be identified are merged to determine the abnormal type of the merchant to be identified. The abnormal type of the merchant to be identified includes but is not limited to: non-abnormal, unknown abnormal, abnormal type 1-abnormal type N, etc.

[0091] Exemplarily, a merchant with only a trusted label is determined to be a normal merchant, and a merchant with both a trusted label and a risk label is determined to be a normal merchant. The normal merchant is protected, and the abnormal type of the normal merchant is non-abnormal.

[0092] For merchants with only risk labels, the merchant is determined to be an abnormal merchant. For abnormal merchants, different abnormal types can be further divided according to the risk type corresponding to the risk label, or the risk type of the merchant is used as the abnormal type. For merchants without risk labels and trustworthy labels, the merchant is determined to be an unknown merchant, and the abnormal type of the unknown merchant is unknown abnormality.

[0093] Optionally, after determining the merchant's exception type, a merchant control strategy matching the exception type is obtained according to the merchant's exception type, wherein different merchant control strategies correspond to different exception types, and the merchant control strategy is used to control the merchant.

[0094] The abnormal identification results of merchants can be used to process the transaction behaviors of merchants. For example, for transactions of non-abnormal merchants (i.e. normal merchants), no intervention is made. For abnormal merchants, transactions can be prohibited or restricted according to the abnormal types of abnormal merchants. Restricting transactions includes limiting the single transaction amount of merchants, limiting the number of transactions of merchants, or limiting the total transaction amount of merchants, etc. For example, for the first type of abnormality, the merchant's transaction is prohibited, and for the second type of abnormality, the merchant is closed.

[0095] The merchant's abnormal identification results can also be used to evaluate the merchant's credit in the credit business of banks or other financial institutions. For example, normal credit business is conducted for trusted merchants, credit business is rejected for risky merchants, and credit business is restricted for unknown merchants.

[0096] The abnormal identification result of the merchant can also be used to assist customer service personnel in performing abnormal review. In some application scenarios, customer service personnel need to perform abnormal review on the customers submitted for review. In this scenario, the customer service personnel first determine whether the customers to be reviewed include abnormal merchants and normal merchants identified by the identification method of this application. If the customers to be reviewed include abnormal merchants and normal merchants identified by the identification method of this application, there is no need to repeat the abnormal review for this part of customers. The results identified by the identification method of this application can be directly used to perform normal review on the remaining customers, thereby improving the review efficiency of customer service personnel.

[0097] In this embodiment, the portrait features of the merchant to be identified are obtained, and the portrait features of the merchant to be identified are input into the pre-trained risk identification model to obtain the risk type of the first merchant, and the risk identification model is used to identify multiple risk types; the merchant relationship map of the merchant to be identified is obtained, and the merchant relationship map includes a strong relationship map and a weak relationship map, and the risk type of the first merchant is diffused according to the merchant relationship map to obtain the risk type of the merchant to be identified; the trusted identifier of the merchant to be identified is obtained, and the abnormal type of the merchant to be identified is determined according to the risk type and the trusted identifier of the merchant to be identified. In this method, the risk type is identified through multimodal portrait features, which can improve the accuracy of risk identification, and the risk type and the trusted identifier are diffused through the merchant relationship map to expand the coverage of risky merchants and trusted merchants. The risk type and the trusted identifier of the merchant to be identified are integrated to determine the abnormal type of the merchant to be identified, thereby improving the accuracy of abnormal identification.

[0098] Based on Example 1, Figure 4 The overall flow chart of the merchant abnormality type identification method provided in this application is used to illustrate the overall process and principle of the merchant abnormality type identification method, refer to Figure 4 As shown, the merchant abnormal type identification method is implemented by four functional modules: portrait feature module, risk model module, graph diffusion module and management and control processing module.

[0099] The portrait feature module is used for feature extraction. Through feature extraction, the portrait features of merchants required for model training and model application are obtained. The portrait features include real-time features and offline features. Among them, real-time features are obtained by processing offline features imported offline and statistical features obtained by real-time statistics. Real-time statistics include transaction statistics, relationship statistics, and risk statistics. The real-time transaction type features, real-time relationship type features, and real-time risk statistical features obtained through real-time statistics. Offline features imported offline include merchants' basic portrait type features, merchant relationship type features, labels, etc.

[0100] Among them, labels include but are not limited to risk labels, complaint labels and KA labels. Complaint labels are used to indicate whether there are complaints, and KA labels are used to indicate that the merchant is a safe and trustworthy merchant. Optionally, risk labels can be identified by user feedback, third-party feedback, and other model strategies.

[0101] Optionally, the merchant portrait features used in anomaly identification are real-time features, and the merchant portrait features used in risk identification model training are offline features.

[0102] Optionally, the device acquires offline features in a multi-period and / or scenario-specific manner. Exemplarily, scenario-specific statistics may be performed according to one or more of transaction type, non-transaction type, and merchant relationship type.

[0103] Statistics by transaction type include: statistics by transaction type such as face-to-face code scanning, mini-program payment, payment link payment, payment code payment, etc. Statistics by non-transaction type include statistics by merchant entry type, including application through web page, application through APP, application through third-party agency, etc. Statistics by relationship type include statistics by merchant-user (legal person, employee) relationship, and statistics by merchant-merchant relationship.

[0104] The risk model module is used to train the risk identification model, deploy the risk identification model, monitor the risk identification model, and mine trusted merchants based on the portrait features provided by the portrait feature module.

[0105] The graph diffusion module is used to establish a multi-dimensional heterogeneous relationship graph for merchants, classify the relationship types of merchants into strong relationships and weak relationships, and diffuse the risk types and trusted identifiers of merchants according to the relationship types.

[0106] The management, control and disposal module focuses on the application of the identification method of abnormal merchant types, and applies the risk merchant and trusted merchant mining method provided in the embodiment of the present application to specific business scenarios. The management, control and disposal module provides a set of query and analysis tools through data and tool construction, provides an external data interface, performs risk merchant management and processing, and provides risk evidence chain support to the business side and customer service personnel.

[0107] Embodiment 2 of the present application provides a risk identification model training method for training the risk identification model used above. The training method is executed by a training device. It can be understood that the training and application of the model can be implemented on the same device or on different devices. When the training and application of the model are implemented on the same device, the training device is an exception handling device. When the training and application of the model are implemented on different devices, the training device is an independent device independent of the exception handling device. Figure 5 Flow chart of the training method of the risk identification model provided in Example 2 of the present application, combined with Figure 4 and Figure 5 The method of the second embodiment of the present application is described.

[0108] S201. Obtain sample data of training samples, where the sample data includes merchant portrait features and risk type labels.

[0109] The portrait features include the following types of features: merchant transaction type features, merchant relationship type features and merchant basic portrait type features.

[0110] Figure 4The portrait features provided by the portrait feature module shown are original portrait features, and the original portrait features are used to form original training samples. The original sample data of the original training samples include original portrait features and risk type labels.

[0111] In one implementation, the training device may use the acquired original training samples as training samples for model training.

[0112] In another implementation, the training device preprocesses original sample data of original training samples and uses the preprocessed data as training samples.

[0113] refer to Figure 4 Optionally, the preprocessing operation includes feature selection and / or sample iteration. Feature selection is used to remove irrelevant, redundant or noisy features, and select a small number of relevant features from the original features as the final features used for model training. Through feature selection, a hundred-dimensional feature can be selected from a thousand-dimensional feature as the final feature used for model training.

[0114] Feature selection can bring better learning performance, higher learning accuracy, lower computational cost and better model interpretability. Exemplarily, feature selection includes but is not limited to: binning operation, weight of evidence (WOE) calculation, information value (IV) and population stability index (PSI) calculation, and feature selection is performed based on IV and PSI.

[0115] Model training usually uses multiple iterations for training. The number of samples used in each iteration training can be gradually reduced to speed up the convergence of the model. The training samples used in each iteration can use sample iteration to select some samples. Sample iteration can be performed based on the original training samples or based on the training samples used in the previous training.

[0116] The training device obtains sample data of the original training sample by performing feature selection on the original image features in the original sample data, and further performs sample iteration on the original training sample to obtain the training sample.

[0117] S202: Use sample data of training samples to train multiple candidate traditional classification models.

[0118] refer to Figure 4The risk identification model of this embodiment includes a traditional classification model and a deep model. The deep model adopts a deep learning algorithm, which usually adopts a neural network model, while the traditional classification model adopts a traditional machine learning algorithm, which uses simpler models such as decision trees, random forests, naive Bayes, etc.

[0119] The algorithm of the traditional classification model is simpler than that of the deep model, and usually has lower computational complexity, but the deep model can mine deeper and more features, thereby improving the accuracy of classification.

[0120] Optionally, the plurality of candidate traditional classification models include linear models and nonlinear models. Figure 4 The following three traditional classification models are used: Logistic Regression (LR), Extreme Gradient Boosting (XGB), and Random Forest (RF). Among them, the LR model is a linear model, and the XGB and RF models are nonlinear models.

[0121] The multiple candidate traditional classification models use the same training samples for multiple iterative training, and the training process of each candidate traditional classification model is independent. Optionally, the multiple candidate traditional classification models are trained in a distributed parallel manner, such as using a Sparksql distributed method for training. Distributed parallel training can improve the training speed of the risk identification model and shorten the training time of the model.

[0122] Optionally, multiple candidate traditional classification models may also be trained in a serial manner, and the training may be selected in a parallel or serial manner according to the size of the training samples.

[0123] S203: Obtain performance indicators of multiple candidate traditional classification models, and determine a traditional classification model used by the risk identification model from the multiple candidate classification models according to the performance indicators of the multiple candidate traditional classification models.

[0124] This step corresponds to Figure 4 In the model selection, one or more classification models are selected from multiple candidate classification models as the traditional classification models finally used by the risk identification model. The performance indicators of traditional classification models may include: the area under the curve (AUC) of the receiver operating characteristic (ROC) curve, the Kolmogorov-Smirnov (KS) curve, the confusion matrix, the PR curve, the model stability PSI, etc.

[0125] In this embodiment, multiple indicators can be used to evaluate the model and select the optimal traditional classification model. Optionally, the Shapley Additive ExPlanation (SHAP) analysis method can also be used to evaluate the model. SHAP is a method for solving the interpretability of the model, and the model selection is performed based on the SHAP analysis results.

[0126] S204: Perform feature fusion and difficult sample mining on the sample data of the training samples, and use the fused features obtained by feature fusion and the difficult samples obtained by mining to train the deep model.

[0127] When training a deep model, the features of the training samples can be fused to obtain new features (also called fused features). Optionally, feature crossover can be used for feature fusion. Feature crossover is also called feature combination. By multiplying two or more features, nonlinear transformation of the sample space can be achieved, thereby increasing the nonlinear capability of the model.

[0128] Merchant portrait features include categorical features and numerical features, where categorical features are also called sparse features and numerical features are also called dense features. For example, KA labels and complaint labels are categorical features, and transaction amounts are numerical features. Numerical features can be directly used as model inputs, while categorical features need to be converted through embedding before they can be used as model inputs.

[0129] Although the number of difficult samples is small, they have a greater impact on the model. Difficult samples can be mined based on existing training samples and feature sets to improve the performance of the model.

[0130] The training of deep models is also called model exploration. Optionally, the deep model can use Deepfm. Merchants have many categorical features and numerical features. You can try to fuse the categorical features and numerical features into a new feature combination to mine more effective features.

[0131] Optionally, the deep model uses Graph Neural Networks (GNN). GNN is used for graph mining and is a framework for mining graph structure data using deep learning. CNN can convert graph structure data into a standard representation and input it into a neural network for training. For example, CNN can perform concatenating learning on relationship (such as merchant relationship) embedding and original data features to achieve feature fusion.

[0132] Optionally, the training device can evaluate the performance of the deep model and multiple candidate traditional classification models as a whole, and select one or more models as risk identification models based on the performance indicators. For example, the AUC of the LR, RF, XGB and Deepfm models is calculated, and the model to be used in the risk identification model is selected based on the AUC size. The larger the AUC, the better the performance of the model.

[0133] Through a large number of verifications, it is shown that the deep model has good results in the application scenarios of this application. For example, the model effect is verified in a 20 million data set. The AUCs of the LR, RF, XGB and Deepfm models are 84.5, 89.4, 92.1 and 92.6 respectively. The Deepfm model performs better than the XGB model. Using the Deepfm model can obtain more accurate prediction results.

[0134] In this embodiment, by training multiple candidate traditional classification models and determining the traditional classification model used by the risk identification model from multiple candidate traditional classification models based on their performance indicators, the optimal traditional classification model can be selected for the risk identification model, thereby improving the accuracy of the risk identification model. In addition, feature fusion and difficult sample mining are performed on the sample data of the training samples, and the deep model is trained using the fused features obtained by fusion and the difficult samples obtained by mining to form a multi-model fusion risk identification model composed of the traditional classification model and the deep model. The traditional classification model and the deep model perform risk identification respectively, and the identified risk types are fused. The accuracy of the risk identification model can be improved through multi-model fusion.

[0135] Based on the first embodiment, the third embodiment of the present application provides a method for identifying abnormal types of merchants, which is used to explain step S103 of the first embodiment in detail. Figure 6 This is a flow chart of a method for training a risk identification model provided in Example 3 of the present application, such as Figure 6 As shown, the method provided in this embodiment includes the following steps.

[0136] S1031. Obtain a merchant relationship map of the merchant to be identified, where the merchant relationship map includes a strong relationship map and a weak relationship map.

[0137] S1032. Perform strong relationship diffusion on the risk type of the first merchant according to the strong relationship graph and the first diffusion condition to obtain a first diffusion result.

[0138] A merchant's strong relationships include one or more of the merchant's principal, legal person, super administrator, and merged merchant number. When risk type diffusion is performed based on strong relationships, one-level or multi-level diffusion can be performed. A strong relationship is a highly trusted merchant relationship. For a strong relationship, the first-level diffusion can be performed directly, that is, the strongly associated merchants of the first merchant are determined based on the merchant relationship map. If the strongly associated merchants of the first merchant have no risk type, the risk type of the first merchant is set to the risk type of the strongly associated merchants of the first merchant, that is, the risk type of the strongly associated merchants of the first merchant is the same as the risk type of the first merchant.

[0139] The number of nodes obtained by the first-level diffusion of strong relationships is usually small and controllable, so there is no need to constrain the first-level diffusion of strong relationships. Optionally, after the first-level diffusion of strong relationships, if the number of first-level diffusion nodes is too large, you can choose to stop the diffusion, where the number of first-level diffusion nodes refers to the number of associated merchants after the first-level diffusion.

[0140] The first diffusion condition is used to constrain the strong-relationship multi-level diffusion. When the device performs each level of diffusion, it determines whether the parameters of the current multi-level diffusion meet the first diffusion condition. If the first diffusion condition is met, the device performs diffusion. If the first diffusion condition is not met, the device stops diffusion.

[0141] Exemplarily, the first diffusion condition includes the following conditions: the current multi-level diffusion level is less than a preset first level threshold, the number of diffusion nodes of the current multi-level diffusion is less than a preset first number threshold, and the risk concentration of the current multi-level diffusion is greater than a preset first risk concentration threshold. The parameters of the current multi-level diffusion include the current multi-level diffusion level, the number of diffusion nodes of the current multi-level diffusion, and the risk concentration of the current multi-level diffusion.

[0142] The parameters of the current multi-level diffusion do not satisfy the first diffusion conditions, including not satisfying any one of the first diffusion conditions, that is, the current multi-level diffusion level is greater than or equal to the first level threshold, or the number of diffusion nodes of the current multi-level diffusion is greater than or equal to the preset first number threshold, or the risk concentration of the current multi-level diffusion is less than or equal to the preset first risk concentration threshold, and it is determined to stop the diffusion.

[0143] The number of diffusion nodes of the current multi-level diffusion is the number of associated merchants after the current multi-level diffusion. For example, the number of diffusion nodes of the strong relationship first-level diffusion is 10, and the number of diffusion nodes of the strong relationship second-level diffusion is 1000.

[0144] The risk concentration of the current multi-level diffusion is the maximum value of the ratio of the number of diffusion nodes of each risk type after the current multi-level diffusion to the number of diffusion nodes of the current multi-level diffusion. Assume that the number of diffusion nodes of the secondary diffusion is 1000, and there are three risk types: risk type 1, risk type 2 and risk type 3. The number of diffusion nodes of risk type 1 is 50, the number of diffusion nodes of risk type 2 is 350, and the number of diffusion nodes of risk type 3 is 600. Then the risk concentration of risk type 1 is 50 / 1000=5%, the risk concentration of risk type 2 is 350 / 1000=35%, and the risk concentration of risk type 3 is 600 / 1000=60%. Then the risk concentration of the secondary diffusion is 60%.

[0145] Assuming that the first level threshold is three levels, the first quantity threshold is 5000, and the first risk concentration threshold is 20%, when performing strong relationship secondary diffusion, the secondary diffusion level is less than the first level threshold, the number of diffusion nodes of the secondary diffusion is 1000 less than the first quantity threshold 5000, and the risk concentration of the secondary diffusion is 60% greater than the first risk concentration threshold 20%, then it is determined that the parameters of the secondary diffusion meet the first diffusion condition, and strong relationship secondary diffusion is performed. Specifically, the risk type is set for the nodes without risk type in the nodes after the secondary diffusion, and if the nodes after the secondary diffusion have risk types, the nodes are not processed, wherein each node after diffusion is a merchant.

[0146] In this embodiment, when the number of diffusion nodes of the current multi-level diffusion is less than the first quantity threshold, the risk merchants are diffused. On the one hand, the confidence of the risk merchants obtained by diffusion is high, which meets the diffusion accuracy requirements, and on the other hand, the data explosion problem can be avoided. If the diffusion is still performed when the number of diffusion nodes of the current multi-level diffusion is greater than the quantity threshold, the number of risk merchants obtained by diffusion is huge. On the one hand, there may be a data explosion problem, and on the other hand, the diffusion accuracy may be reduced. Combined with the actual scenario, the number and proportion of risk merchants in the merchants are less than a certain range. If the number of risk merchants after diffusion is obviously too large, it means that the confidence of the risk merchants obtained by this diffusion is low, and an error may have occurred. It is necessary to stop the diffusion to prevent the error from being continuously expanded.

[0147] Similarly, when the risk concentration of the current multi-level diffusion is less than the first risk concentration threshold, if the diffusion continues, the diffusion accuracy may be reduced, and the confidence level of the risk of the risk merchant after the diffusion cannot be guaranteed.

[0148] In actual situations, after multiple levels of diffusion, the risk concentration and the number of diffusion nodes of the current multi-level diffusion may still meet the conditions. For example, after four levels of diffusion of a strong relationship, the risk concentration and the number of diffusion nodes still meet the conditions. At this time, in order to avoid unlimited diffusion, the first level threshold is set to avoid unlimited diffusion.

[0149] In summary, in this embodiment, by setting the first diffusion condition for strong relationship multi-level diffusion, the data explosion problem during multi-level diffusion can be avoided and the diffusion accuracy of risk diffusion can be ensured.

[0150] S1033. Perform weak relationship diffusion on the risk type of the first merchant according to the weak relationship graph and the second diffusion condition to obtain a second diffusion result.

[0151] Different from strong relationships, the number of diffusion nodes after weak relationship diffusion is usually larger. Therefore, when diffusing based on weak relationships, both primary diffusion and multi-level diffusion need to constrain the diffusion according to the second diffusion condition.

[0152] Exemplarily, the second diffusion condition includes the following conditions: the current diffusion level is less than a preset second level threshold, the number of diffusion nodes of the current level diffusion is less than a preset second number threshold, and the risk concentration of the current level diffusion is greater than a preset second risk concentration threshold. The current level diffusion can be a single-level diffusion or a multi-level diffusion.

[0153] Correspondingly, when the diffusion level of the current level is greater than or equal to the preset second level threshold, or the number of diffusion nodes of the current level diffusion is greater than or equal to the preset second number threshold, or the risk concentration of the current level diffusion is less than or equal to the preset second risk concentration threshold, it is determined that the parameters of the current level diffusion do not meet the second diffusion condition.

[0154] Optionally, the second level threshold is the same as the first level threshold, the second quantity threshold is the same as the first quantity threshold, and the second risk concentration threshold is the same as the first risk concentration threshold.

[0155] Since the number of diffusion nodes of weak relationship diffusion is large and the credibility is low, in order to prevent too many diffusion nodes, the second level threshold is set smaller than the first level threshold. For example, the first level threshold is 4 levels and the second level threshold is 2 levels.

[0156] The principles of weak relationship diffusion and strong relationship diffusion are similar. The difference lies in the constraints and relationships, which will not be repeated here.

[0157] S1034. Combining the first diffusion result and the second diffusion result, obtain the risk type of the merchant to be identified.

[0158] Through strong relationship diffusion and weak relationship diffusion, the coverage of risky merchants among the merchants to be identified is expanded, so that some risky merchants that cannot be identified through the risk identification model or some newly settled merchants that have not yet been identified for abnormalities can obtain risk types.

[0159] Figure 7 Diagram of risk diffusion and credible diffusion, combined with Figure 4 and 7 Explain the risk diffusion and trust diffusion process. It can be understood that the merchant's risk type and trust identification are diffused separately. Since the diffusion process of the two is similar, Figure 7 The diffusion of merchant risk types and trusted identifiers are explained together. The difference between the two is that the diffusion of trusted identifiers is only based on the strong relationship graph, not the weak relationship graph, while the diffusion of risk types is based on both the strong relationship graph and the weak relationship graph.

[0160] Reference Figure 7 First, the strong relationship type and trusted identification of the merchant are directly diffused according to the strong relationship graph. Direct diffusion refers to diffusion without constraints. Then, the risk type and trusted identification of the merchant are conditionally diffused according to the strong relationship graph. When the risk type is diffused according to the second-level condition, the parameters of the second-level condition diffusion need to meet the first diffusion condition; when the trusted identification is diffused according to the second-level condition, the parameters of the second-level condition diffusion need to meet the third diffusion condition, which is different from the first diffusion condition.

[0161] When diffusing the risk types of merchants according to the weak relationship map, the weak relationship primary condition diffusion is performed first, and then the weak relationship secondary condition diffusion is performed. Among them, both the weak relationship primary condition diffusion and the weak relationship secondary condition diffusion need to meet the second diffusion condition.

[0162] Although Figure 7 Not shown in the figure, both weak and strong relationships may be diffused to more levels until the corresponding diffusion conditions are no longer met, and then the diffusion stops.

[0163] In this embodiment, the risk type of the first merchant is subjected to strong relationship multi-level diffusion according to the strong relationship graph and the first diffusion condition to obtain the first diffusion result, the risk type of the first merchant is subjected to weak relationship diffusion according to the weak relationship graph and the second diffusion condition to obtain the second diffusion result, and the risk type of the merchant to be identified is obtained by combining the first diffusion result and the second diffusion result. The first diffusion condition and the second diffusion condition both include constraints on the diffusion level, the number of diffusion nodes, and the risk concentration, thereby avoiding the data explosion problem during multi-level diffusion and ensuring the diffusion accuracy of risk diffusion.

[0164] On the basis of the first embodiment, the fourth embodiment of the present application provides a method for identifying abnormal types of merchants, which is used to explain step S104 of the first embodiment in detail. Figure 8 This is a flow chart of a training method for a risk identification model provided in Example 4 of the present application, such as Figure 8 As shown, the method provided in this embodiment includes the following steps.

[0165] S1041. According to the portrait features of the merchant to be identified, determine that a second merchant with a KA label is a trusted merchant from the merchants to be identified.

[0166] Reference Fig. 9 As shown, Fig. 9 This is a flow chart for mining trusted merchants. This step corresponds to the KA merchant data integration in the figure. KA merchants refer to merchants with KA labels among the merchants to be identified. The KA labels in the merchant portrait features can be obtained through industry entry, manual labeling and famous company labeling.

[0167] S1042. Diffusion of the trusted identifier of the second merchant is performed according to the strong relationship graph and the third diffusion condition to obtain a trusted diffusion result.

[0168] Different from the diffusion of risk types, the diffusion of trusted logos has higher requirements on the confidence of the diffusion results. Therefore, when the trusted logos are diffused, they are only diffused according to the strong relationship graph to ensure the confidence of the trusted merchants obtained by diffusion.

[0169] Optionally, when the trusted identifier is diffused according to the strong relationship graph, only the first-level direct diffusion of the strong relationship may be performed, or the multi-level conditional diffusion of the strong relationship may be performed. When the multi-level conditional diffusion of the strong relationship is performed, the third diffusion condition is used for constraint.

[0170] Exemplarily, the third diffusion condition includes the following conditions: the current multi-stage diffusion level is less than a preset third level threshold, and the number of diffusion nodes of the current multi-stage diffusion is less than a preset third number threshold.

[0171] Reference Figure 7 and Fig. 9 As shown, the trusted identification of the second merchant is diffused in multiple levels according to the strong relationship graph, wherein the first-level diffusion of the strong relationship adopts direct diffusion, the second-level diffusion of the strong relationship and the diffusion above the second level adopt conditional diffusion, and the condition of the second-level diffusion is the third diffusion condition.

[0172] S1043. Determine the trusted merchants among the remaining merchants based on at least one of the historical transaction information, risk types, and category information of the remaining merchants, where the remaining merchants are the merchants without trusted identification among the merchants to be identified.

[0173] Through strong relationship diffusion, trusted labels are set for some high-quality merchants. However, there are still some high-quality merchants among the merchants to be identified that have not been discovered. For these high-quality merchants, we can further use the merchant's historical transaction information, risk type and merchant category information to conduct trusted mining to increase the coverage of trusted merchants.

[0174] In an exemplary method, the activity and stability of the remaining merchants are determined based on their historical transaction information, and based on the activity and stability of the remaining merchants, highly active and stable merchants are determined from the remaining merchants. Based on the risk types of the highly active and stable merchants, low-risk merchants are determined from the highly active and stable merchants to obtain a first set of trusted merchants.

[0175] Reference Fig. 9 The high-activity high-quality merchants in the mining are the trusted merchants obtained by the mining of high-activity high-quality merchants as the first trusted merchant set. The activity of the merchant can be determined based on the merchant's deposit and withdrawal data over a period of time (for example, the last three months or six months). The deposit and withdrawal data includes the number of deposit and withdrawal transactions, the transaction amount, etc. The larger the number of deposit and withdrawal transactions and the transaction amount, the higher the merchant's activity. The stability of the merchant can be determined based on the fluctuation of the merchant's deposit and withdrawal data over a period of time. For example, the variance of the merchant's deposit and withdrawal data over a period of time is calculated to determine the merchant's stability.

[0176] Optionally, the deposit and withdrawal data of the sub-merchants can be counted first, and the deposit and withdrawal data of the sub-merchants can be sorted to obtain the activity ranking of the sub-merchants, and the stability of the sub-merchants can be calculated based on the deposit and withdrawal data of the sub-merchants, and the stability of the sub-merchants can be sorted. Then, the deposit and withdrawal data of the subject associated with the sub-merchants can be determined based on the deposit and withdrawal data of the sub-merchants, and the deposit and withdrawal data of the subject can be sorted to obtain the activity ranking of the subject, and the stability of the subject can be calculated based on the deposit and withdrawal data of the subject, and the stability of the subject can be sorted.

[0177] For example, the top 10% of merchants ranked by activity can be taken as highly active merchants, and the top 10% of merchants ranked by stability can be taken as highly stable merchants. Highly active merchants and highly stable merchants can be taken as trusted merchants respectively, or the intersection of highly active merchants and highly stable merchants (i.e., highly active and stable merchants) can be taken as trusted merchants.

[0178] Optionally, the highly active and stable merchants may be further filtered into high-risk merchants according to risk types to obtain a first set of trusted merchants.

[0179] Furthermore, merchants of the trusted category can be determined based on the category information of the remaining merchants to obtain a second set of trusted merchants. For some key industries, the category information of merchants can be used to mine trusted merchants and filter out unreasonable merchants. The category information of merchants includes merchant category, subject category or subject name, etc.

[0180] Reference Fig. 9As shown in the figure, enterprises, institutions, public welfare merchants and other merchants are determined by merchant categories, and small and micro merchants are determined according to the main categories and names. Small and micro merchants refer to face-to-face merchants (such as merchants setting up stalls on the roadside). Small and micro merchants are individual merchants, and usually there is no merchant entry category data. Small and micro merchants can be filtered out, and enterprises, institutions and public welfare merchants are set as the second trusted merchant collection.

[0181] In this embodiment, the trusted identifier of the second merchant is diffused according to the strong relationship graph to obtain a diffused trusted merchant set, the merchant's activity and stability are determined according to the merchant's historical transaction information, and high-activity and stable merchants are mined according to the merchant's activity and stability to obtain a first trusted merchant set, and key industry customers are mined according to the merchant's category information to obtain a second trusted merchant set. Ultimately, the trusted merchants consist of the second merchant, the diffused trusted merchant set, the first trusted merchant set, and the second trusted merchant set, thereby increasing the coverage of trusted merchants.

[0182] After completing the construction of the risk identification model and the trusted mining model, it is also necessary to deal with risky merchants, protect trusted merchants, and automatically update the risk identification model and trusted mining model based on feedback to form a complete closed-loop system.

[0183] Based on the first embodiment, the fifth embodiment of the present application provides a method for identifying abnormal types of merchants. Fig.10 This is a flow chart of a method for identifying abnormal merchant types provided in Embodiment 5 of the present application, such as Fig.10 As shown, the method provided in this embodiment includes the following steps.

[0184] S101. Obtaining portrait features of the merchant to be identified, the portrait features include the following types of features: merchant transaction type features, merchant relationship type features and merchant basic portrait type features.

[0185] S102. Input the portrait features of the merchant to be identified into a pre-trained risk identification model to obtain the risk type of the first merchant. The risk identification model is used to identify multiple risk types.

[0186] S103: Obtain a merchant relationship map of the merchant to be identified, where the merchant relationship map includes a strong relationship map and a weak relationship map, and diffuse the risk type of the first merchant according to the merchant relationship map to obtain the risk type of the merchant to be identified.

[0187] S104: Obtain a trusted identifier of the merchant to be identified.

[0188] S105: Determine the abnormal type of the merchant to be identified according to the risk type and the trustworthy identifier of the merchant to be identified.

[0189] The specific implementation of steps S101-S105 refers to the relevant description of the above-mentioned embodiment, which will not be repeated here.

[0190] S106. According to the abnormal type of the merchant to be identified, a merchant management and control strategy matching the abnormal type is obtained, and the merchant is managed and controlled using the merchant management and control strategy, wherein different merchant management and control strategies correspond to different abnormal types.

[0191] Reference Figure 4 The control processing module shown has the function of risk merchant control and disposal. The control processing module can provide a variety of merchant control strategies and handle different abnormal types differently. For example, authority control is performed on abnormal merchants, and authority control includes transaction authority control. The control processing module is also used for risk investigation and disposal, which includes risk sorting of merchants and routinely pushing risky merchants. Risky merchants can be pushed according to the configured push cycle.

[0192] In some scenarios, risky merchants and trusted merchants can be pushed to special investigators, who will verify the risky merchants and trusted merchants. If the risky merchants and trusted merchants are found to be incorrectly marked, the risk type of the risky merchant will be modified or the trusted identifier of the trusted merchant will be modified.

[0193] In some scenarios, risky merchants and trusted merchants can be pushed to customer service personnel to assist customer service personnel in conducting abnormal audits on customers to be audited, so as to improve the audit efficiency of customer service personnel.

[0194] S107. Monitor the values ​​and distribution of the preset features and label features of the merchants to be identified, and monitor the performance of the risk identification model.

[0195] Reference Figure 4 The model deployment monitoring submodule in the risk model module is used to monitor the values ​​and distribution of the preset features and label features of the merchants to be identified, monitor the performance of the risk identification model, such as monitoring the fluctuation of the performance, and monitor the distribution of the risk types predicted by the risk identification module.

[0196] During the model application process, the model deployment monitoring submodule can monitor all or part of the input features of the risk identification model (i.e., the merchant's portrait features). For example, only the preset features and label features are monitored. When monitoring the features, it is possible to monitor whether the feature values ​​are correct, and monitor the distribution of the features to determine whether the distribution of the features is correct. When an error in a feature or label is detected, the value of the feature or label can be corrected, or if the frequency of feature errors is high, the feature can be screened out. Optionally, key feature mining can be performed based on the monitoring results of the features. By mining key features, the accuracy of the model can be improved.

[0197] Monitoring the distribution of the prediction results of the risk identification model includes monitoring whether the prediction results are accurate, monitoring the fluctuation of the prediction results, etc.

[0198] S108. Receive a query request, and perform a multi-level diffusion query according to the query keyword and the query level corresponding to the query keyword to obtain a query result, wherein the query result includes abnormal information of the target merchant corresponding to the query keyword, abnormal information of merchants with strong relationships with the target merchant, and abnormal information of merchants with weak relationships with the target merchant, and the merchants with strong relationships and merchants with weak relationships are displayed separately.

[0199] In order to visually display the merchant relationship map, the relationship between merchants, the merchant management and control strategies, the merchant's abnormal information, the model's monitoring results, etc., this application requires data and tool construction to provide a complete set of data analysis and display tools to manage and display the data involved in this application.

[0200] Reference Figure 4 As shown, the data and tool construction part provides off-file database tables, real-time interfaces and management information system (MIS) tools. The off-file database tables are used to manage and record the merchant relationship graph stored offline. The merchant relationship graph is usually stored offline in a distributed file system (Hadoop Distributed File System, HDFS). By providing a real-time interface, real-time query of merchant graph relationships is achieved. MIS tools are used to efficiently manage data.

[0201] Fig.11 A processing flow chart of a merchant relationship map provided in an embodiment of the present application, referring to Fig.11As shown, graph analysis includes three modules: a graph library creation module, a graph data import module and a real-time graph analysis module. The graph library creation module is used to construct a merchant relationship graph, which can adopt a homogeneous relationship graph or a heterogeneous relationship graph. There is only one node type and relationship type in the homogeneous relationship graph, and there are more than one node type or relationship type in the heterogeneous relationship graph.

[0202] Isomorphic relationship graphs and heterogeneous relationship graphs can be converted to each other. For example, a heterogeneous relationship graph can be established first, and then a prefix can be added to the heterogeneous relationship graph to convert it into a homogeneous relationship graph. The relationship between merchants and users is represented as merchant ID-user ID in the heterogeneous relationship graph, and can be represented as M_merchant ID (node ​​1)-U_user ID (node ​​2) in the homogeneous relationship graph.

[0203] The merchant relationship graph is usually created offline and stored in HDSF. When performing merchant relationship queries, the merchant relationship graph needs to be imported from HDSF to a real-time key value (kv) storage platform. The merchant relationship graph is also called graph data, which includes point data and edge data.

[0204] Optionally, incremental import is used when importing edge data and point data of the graph. Compared with full import, incremental import takes much less time, and the time taken for incremental import can be reduced to minutes.

[0205] The real-time graph analysis module is used to provide real-time relationship query and real-time organization analysis functions. The real-time relationship query function includes data adding and visualization configuration functions. The data adding function is used to input query keywords, which are the indexes (i.e., key values) of entities in the merchant relationship graph, such as user ID, merchant ID, etc. Visualization configuration is used to configure different types and attribute nodes and edges to display different colors and values ​​to improve the readability of query results.

[0206] The real-time organization analysis function is used to mine community organizations based on the merchant relationship map, calculate organizational connectivity, etc. The organizations involved here refer to those engaged in illegal activities.

[0207] The query request includes a query keyword which is an index of an entity in the merchant relationship graph, for example, the query keyword is a merchant ID, a subject ID and a domain name key. In this embodiment, a multi-level diffusion query can be performed based on the query keyword. The query results returned by the multi-level diffusion query include not only the abnormal information of the target merchant corresponding to the query keyword, but also the abnormal information of the associated merchants of the target merchant. The associated merchants of the target merchant include the strongly related merchants and / or weakly related merchants of the target merchant.

[0208] The abnormal information of the target merchant and the target merchant's associated merchants may be abnormal types, and may also be risk types and trustworthy identifiers of the merchants.

[0209] Fig.12 This is a schematic diagram of the query results of abnormal types of merchants. When the query keyword is the merchant ID, a three-level diffusion query can be performed based on the merchant's main body, legal person, super management, telephone, domain name, etc. When the query keyword is the main body ID, a strong relationship three-level diffusion query can be performed, where the query result of the strong relationship three-level diffusion based on the main body ID is the same as the strong relationship three-level diffusion query result based on the merchant ID. If only strong relationship diffusion is selected for the main body ID, the number of nodes in the first 3 levels of diffusion can be controlled, and optionally, 4-6 levels of diffusion queries can be performed. When the query keyword is the domain name, since the domain name is a weak relationship, the number of associated nodes may explode. Therefore, 2-3 levels of diffusion queries are generally performed when querying based on the domain name.

[0210] In order to facilitate better implementation of the merchant abnormality type identification method of the embodiment of the present application, the embodiment of the present application also provides a merchant abnormality type identification device. Fig.13 A schematic diagram of the structure of a device for identifying abnormal merchant types provided in Example 6 of the present application, such as Fig.13 As shown, the merchant abnormal type identification device 100 may include:

[0211] The feature acquisition module 11 is used to acquire the portrait features of the merchant to be identified, and the portrait features include the following types of features: merchant transaction type features, merchant relationship type features and merchant basic portrait type features;

[0212] A risk identification module 12 is used to input the image features of the merchant to be identified into a pre-trained risk identification model to obtain the risk type of the first merchant, wherein the risk identification model is trained based on the image features of the training sample, and the risk identification model is used to identify multiple risk types;

[0213] A diffusion module 13 is used to obtain a merchant relationship map of the merchant to be identified, wherein the merchant relationship map includes a strong relationship map and a weak relationship map, and diffuse the risk type of the first merchant according to the merchant relationship map to obtain the risk type of the merchant to be identified;

[0214] A trustworthy determination module 14, used to obtain a trustworthy identification of the merchant to be identified;

[0215] The abnormality determination module 15 is used to determine the abnormality type of the merchant to be identified according to the risk type and the trustworthy identifier of the merchant to be identified.

[0216] In some optional implementations, the risk identification model includes a plurality of sub-identification models, each of which is used to identify the risk type of the merchant;

[0217] The risk identification module 12 is specifically used for:

[0218] Inputting the merchant's portrait features into the multiple sub-recognition models respectively to obtain the candidate risk type output by each sub-recognition model;

[0219] The multiple candidate risk types output by the multiple sub-recognition models are integrated to obtain the risk type of the first merchant.

[0220] In some optional implementations, the multiple sub-recognition models include a traditional classification model and a deep model; the traditional classification model includes a linear model and / or a nonlinear model.

[0221] In some optional implementations, the apparatus 100 further includes a training module, which is used to:

[0222] Acquire sample data of training samples, the sample data including merchant portrait features and risk type labels, the portrait features including the following types of features: merchant transaction type features, merchant relationship type features, and merchant basic portrait type features;

[0223] Using the sample data of the training samples to train multiple candidate traditional classification models;

[0224] Acquire performance indicators of the plurality of candidate traditional classification models, and determine a traditional classification model used by the risk identification model from the plurality of candidate classification models according to the performance indicators of the plurality of candidate traditional classification models;

[0225] Feature fusion and difficult sample mining are performed on the sample data of the training samples, and the deep model is trained using the fused features obtained by fusion and the difficult samples obtained by mining.

[0226] In some optional implementations, the training module is specifically used to:

[0227] Obtaining original sample data of original training samples, wherein the original sample data includes original image features and risk type labels;

[0228] Performing feature selection on the original image features in the original sample data to obtain sample data of the original training sample;

[0229] Perform sample iteration on the original training samples to obtain the training samples.

[0230] In some optional implementations, the multiple candidate traditional classification models and the deep model are trained in a distributed parallel manner.

[0231] In some optional implementations, the apparatus 100 further includes a monitoring module, configured to:

[0232] Monitoring the values ​​and distribution of the preset features and label features of the merchant to be identified;

[0233] The performance of the risk identification model is monitored.

[0234] In some optional implementations, the diffusion module 13 is specifically used to:

[0235] Perform strong relationship diffusion on the risk type of the first merchant according to the strong relationship graph and the first diffusion condition to obtain a first diffusion result;

[0236] Perform weak relationship diffusion on the risk type of the first merchant according to the weak relationship graph and the second diffusion condition to obtain a second diffusion result;

[0237] The risk type of the merchant to be identified is obtained by combining the first diffusion result and the second diffusion result.

[0238] In some optional implementations, the strong relationships in the strong relationship graph include: one or more of the merchant's principal, legal person, super administrator, and merged merchant number;

[0239] The weak relationships in the weak relationship graph include: one or more of the merchant's employees, contact information, domain name, address and merchant name.

[0240] In some optional implementations, the first diffusion condition includes the following multiple conditions: the current multi-level diffusion level is less than a preset first level threshold, the number of diffusion nodes of the current multi-level diffusion is less than a preset first number threshold, and the risk concentration of the current multi-level diffusion is greater than a preset first risk concentration threshold, wherein the risk concentration of the current multi-level diffusion is the maximum value of the ratio of the number of diffusion nodes of each risk type after the current multi-level diffusion to the number of diffusion nodes of the current multi-level diffusion;

[0241] The second diffusion condition includes the following multiple conditions: the current diffusion level is less than a preset second level threshold, the number of diffusion nodes of the current level diffusion is less than a preset second number threshold, and the risk concentration of the current level diffusion is greater than a preset second risk concentration threshold.

[0242] In some optional implementations, the trust determination module 14 is specifically used to:

[0243] According to the portrait features of the merchant to be identified, a second merchant with an important customer KA tag is determined as a credible merchant from the merchants to be identified;

[0244] The trusted identifier of the second merchant is diffused according to the strong relationship graph to obtain the trusted identifier of the merchant to be identified.

[0245] In some optional implementations, the trust determination module 14 is specifically used to:

[0246] Diffusion of the trusted identifier of the second merchant is performed according to the strong relationship graph and the third diffusion condition to obtain a trusted diffusion result;

[0247] Determine the trusted merchants among the remaining merchants according to at least one of the historical transaction information, risk type, and category information of the remaining merchants, wherein the remaining merchants are the merchants without trusted identification among the merchants to be identified.

[0248] In some optional implementations, the trust determination module 14 is specifically used to:

[0249] Determine the activity and stability of the remaining merchants based on the historical transaction information of the remaining merchants;

[0250] According to the activity and stability of the remaining merchants, determine highly active and stable merchants from the remaining merchants;

[0251] According to the risk type of the highly active and stable merchants, determine merchants of low risk type from the highly active and stable merchants to obtain a first set of trusted merchants;

[0252] Merchants of the trusted category are determined according to the category information of the remaining merchants to obtain a second trusted merchant set.

[0253] In some optional implementations, the third diffusion condition includes the following conditions: the current multi-stage diffusion level is less than a preset third level threshold, and the number of diffusion nodes of the current multi-stage diffusion is less than a preset third number threshold.

[0254] In some optional implementations, the device 100 further includes a management and control module, which is used to:

[0255] According to the abnormal type of the merchant to be identified, a merchant control strategy matching the abnormal type is obtained, wherein different merchant control strategies corresponding to different abnormal types are different;

[0256] The merchant management and control strategy is used to manage the merchants.

[0257] In some optional implementations, the apparatus 100 further includes a query module, configured to:

[0258] receiving a query request, wherein the query request includes a query keyword, and the query keyword is an index of an entity in the merchant relationship graph;

[0259] According to the query keyword and the query level corresponding to the query keyword, a multi-level diffusion query is performed to obtain a query result, wherein the query result includes abnormal information of the target merchant corresponding to the query keyword, abnormal information of merchants with strong relationships with the target merchant, and abnormal information of merchants with weak relationships with the target merchant;

[0260] According to the pre-configured display configuration information of strong relationships and weak relationships, the merchants with strong relationships and merchants with weak relationships of the merchant are displayed separately.

[0261] It should be understood that the device embodiment and the method embodiment may correspond to each other, and similar descriptions may refer to the method embodiment. To avoid repetition, they will not be described here.

[0262] The above describes the device 100 of the embodiment of the present application from the perspective of the functional module in conjunction with the accompanying drawings. It should be understood that the functional module can be implemented in hardware form, can be implemented by instructions in software form, and can also be implemented by a combination of hardware and software modules. Specifically, the steps of the method embodiment in the embodiment of the present application can be completed by the hardware integrated logic circuit and / or software form instructions in the processor, and the steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or a combination of hardware and software modules in the decoding processor to perform. Optionally, the software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, a register, etc. The storage medium is located in a memory, and the processor reads the information in the memory, and completes the steps in the above method embodiment in conjunction with its hardware.

[0263] An embodiment of the present application also provides an electronic device. Fig.14 A structural diagram of an electronic device provided in Embodiment 7 of the present application, such as Fig.14 As shown, the electronic device 200 may include:

[0264] The memory 21 and the processor 22, the memory 21 is used to store the computer program and transmit the program code to the processor 22. In other words, the processor 22 can call and run the computer program from the memory 21 to implement the method in the embodiment of the present application.

[0265] In some embodiments of the present application, the processor 22 may include but is not limited to: a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0266] In some embodiments of the present application, the memory 21 includes, but is not limited to, volatile memory and / or non-volatile memory. The non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM) and direct RAM bus random access memory (DRRAM).

[0267] In some embodiments of the present application, the computer program may be divided into one or more modules, which are stored in the memory 21 and executed by the processor 22 to complete the method provided by the present application. The one or more modules may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program in the electronic device.

[0268] like Fig.14As shown, the electronic device 200 may further include: a transceiver 23 , which may be connected to the processor 22 or the memory 21 .

[0269] The processor 22 may control the transceiver 23 to communicate with other devices, specifically, to send information or data to other devices, or to receive information or data sent by other devices. The transceiver 23 may include a transmitter and a receiver. The transceiver 23 may further include an antenna, and the number of antennas may be one or more.

[0270] Understandable, although Fig.14 Not shown, the electronic device 200 may also include a positioning module, a Bluetooth module, a display, a controller, an input device, etc., which will not be described in detail here.

[0271] It should be understood that the various components in the electronic device are connected via a bus system, wherein the bus system includes not only a data bus but also a power bus, a control bus and a status signal bus.

[0272] The present application also provides a computer storage medium on which a computer program is stored, and when the computer program is executed by a computer, the computer can perform the method of the above method embodiment. In other words, the present application embodiment also provides a computer program product containing instructions, and when the instructions are executed by a computer, the computer can perform the method of the above method embodiment.

[0273] The present application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. The processor of the electronic device reads the computer program from the computer-readable storage medium, and the processor executes the computer program, so that the electronic device executes the corresponding process in the above method embodiment, which will not be described here for brevity.

[0274] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the module is only a logical function division. There may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.

[0275] The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. For example, each functional module in each embodiment of the present application may be integrated into a processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0276] It is understandable that in the specific implementation methods of this application, related data such as user information and merchant portraits are involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0277] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for identifying abnormal types of merchants, characterized in that: include: Acquire the portrait features of the merchant to be identified, wherein the portrait features include the following types of features: merchant transaction type features, merchant relationship type features, and merchant basic portrait type features; Inputting the image features of the merchant to be identified into a pre-trained risk identification model to obtain the risk type of the first merchant, wherein the risk identification model is trained based on the image features of the training sample, and the risk identification model is used to identify multiple risk types; Acquire a merchant relationship map of the merchant to be identified, wherein the merchant relationship map includes a strong relationship map and a weak relationship map, and diffuse the risk type of the first merchant according to the merchant relationship map to obtain the risk type of the merchant to be identified; Obtaining a trusted identifier of the merchant to be identified; The abnormal type of the merchant to be identified is determined according to the risk type and the trustworthy identifier of the merchant to be identified.

2. The method according to claim 1, characterized in that The risk identification model includes a plurality of sub-identification models, each of which is used to identify the risk type of the merchant; The step of inputting the merchant's portrait features into a pre-trained risk identification model to obtain the risk type of the first merchant includes: Inputting the merchant's portrait features into the multiple sub-recognition models respectively to obtain the candidate risk type output by each sub-recognition model; The multiple candidate risk types output by the multiple sub-recognition models are integrated to obtain the risk type of the first merchant.

3. The method according to claim 2, characterized in that The multiple sub-recognition models include a traditional classification model and a deep model; The traditional classification model includes a linear model and / or a nonlinear model.

4. The method according to claim 3, characterized in that Also includes: Acquire sample data of training samples, the sample data including merchant portrait features and risk type labels, the portrait features including the following types of features: merchant transaction type features, merchant relationship type features, and merchant basic portrait type features; Using the sample data of the training samples to train multiple candidate traditional classification models; Acquire performance indicators of the plurality of candidate traditional classification models, and determine a traditional classification model used by the risk identification model from the plurality of candidate classification models according to the performance indicators of the plurality of candidate traditional classification models; Feature fusion and difficult sample mining are performed on the sample data of the training samples, and the deep model is trained using the fused features obtained by fusion and the difficult samples obtained by mining.

5. The method according to claim 4, characterized in that The step of obtaining sample data of training samples includes: Obtaining original sample data of original training samples, wherein the original sample data includes original image features and risk type labels; Performing feature selection on the original image features in the original sample data to obtain sample data of the original training sample; Perform sample iteration on the original training samples to obtain the training samples.

6. The method according to claim 4, characterized in that The multiple candidate traditional classification models and the deep model are trained in a distributed parallel manner.

7. The method according to any one of claims 1 to 6, characterized in that: Also includes: Monitoring the values ​​and distribution of the preset features and label features of the merchant to be identified; The performance of the risk identification model is monitored.

8. The method according to any one of claims 1 to 6, characterized in that: The step of diffusing the risk type of the first merchant according to the merchant relationship graph to obtain the risk type of the merchant to be identified includes: Perform strong relationship diffusion on the risk type of the first merchant according to the strong relationship graph and the first diffusion condition to obtain a first diffusion result; Perform weak relationship diffusion on the risk type of the first merchant according to the weak relationship graph and the second diffusion condition to obtain a second diffusion result; The risk type of the merchant to be identified is obtained by combining the first diffusion result and the second diffusion result.

9. The method according to claim 8, characterized in that The strong relationships in the strong relationship graph include: one or more of the merchant's principal, legal person, super administrator, and merged merchant number; The weak relationships in the weak relationship graph include: one or more of the merchant's employees, contact information, domain name, address and merchant name.

10. The method according to claim 8, characterized in that: The first diffusion condition includes the following conditions: the current multi-level diffusion level is less than a preset first level threshold, the number of diffusion nodes of the current multi-level diffusion is less than a preset first number threshold, and the risk concentration of the current multi-level diffusion is greater than a preset first risk concentration threshold, wherein the risk concentration of the current multi-level diffusion is the maximum value of the ratio of the number of diffusion nodes of each risk type after the current multi-level diffusion to the number of diffusion nodes of the current multi-level diffusion; The second diffusion condition includes the following multiple conditions: the current diffusion level is less than a preset second level threshold, the number of diffusion nodes of the current level diffusion is less than a preset second number threshold, and the risk concentration of the current level diffusion is greater than a preset second risk concentration threshold.

11. The method according to any one of claims 1 to 6, characterized in that: The step of obtaining the trusted identifier of the merchant to be identified includes: According to the portrait features of the merchant to be identified, a second merchant with an important customer KA tag is determined as a credible merchant from the merchants to be identified; The trusted identifier of the second merchant is diffused according to the strong relationship graph to obtain the trusted identifier of the merchant to be identified.

12. The method according to claim 11, characterized in that The step of diffusing the trusted identifier of the second merchant according to the strong relationship graph to obtain the trusted identifier of the merchant to be identified includes: Diffusion of the trusted identifier of the second merchant is performed according to the strong relationship graph and the third diffusion condition to obtain a trusted diffusion result; According to at least one of historical transaction information, risk types, and category information of the remaining merchants, the trusted merchants among the remaining merchants are determined, and the remaining merchants are merchants without trusted identification among the merchants to be identified.

13. The method according to claim 12, characterized in that The determining of the trusted merchants among the remaining merchants according to at least one of the historical transaction information, the risk type and the category information of the remaining merchants comprises: Determine the activity and stability of the remaining merchants based on the historical transaction information of the remaining merchants; According to the activity and stability of the remaining merchants, determine highly active and stable merchants from the remaining merchants; According to the risk type of the highly active and stable merchants, determine merchants of low risk type from the highly active and stable merchants to obtain a first set of trusted merchants; Merchants of the trusted category are determined according to the category information of the remaining merchants to obtain a second trusted merchant set.

14. The method according to claim 12, characterized in that: The third diffusion condition includes the following conditions: the current multi-stage diffusion level is less than a preset third level threshold, and the number of diffusion nodes of the current multi-stage diffusion is less than a preset third number threshold.

15. The method according to claim 1, characterized in that Also includes: According to the abnormal type of the merchant to be identified, a merchant control strategy matching the abnormal type is obtained, wherein different merchant control strategies corresponding to different abnormal types are different; The merchant management and control strategy is used to manage the merchants.

16. The method according to claim 1, characterized in that Also includes: receiving a query request, wherein the query request includes a query keyword, and the query keyword is an index of an entity in the merchant relationship graph; According to the query keyword and the query level corresponding to the query keyword, a multi-level diffusion query is performed to obtain a query result, wherein the query result includes abnormal information of the target merchant corresponding to the query keyword, abnormal information of merchants with strong relationships with the target merchant, and abnormal information of merchants with weak relationships with the target merchant; According to the pre-configured display configuration information of strong relationships and weak relationships, the merchants with strong relationships and merchants with weak relationships of the merchant are displayed separately.

17. A device for identifying abnormal types of merchants, characterized in that: include: A feature acquisition module is used to acquire the portrait features of the merchant to be identified, wherein the portrait features include the following types of features: merchant transaction type features, merchant relationship type features, and merchant basic portrait type features; A risk identification module, used for inputting the image features of the merchant to be identified into a pre-trained risk identification model to obtain the risk type of the first merchant, wherein the risk identification model is trained based on the image features of the training sample, and the risk identification model is used to identify multiple risk types; A diffusion module is used to obtain a merchant relationship map of the merchant to be identified, wherein the merchant relationship map includes a strong relationship map and a weak relationship map, and diffuse the risk type of the first merchant according to the merchant relationship map to obtain the risk type of the merchant to be identified; A trustworthy identification module, used to obtain the trustworthy identification of the merchant to be identified; The abnormality determination module is used to determine the abnormality type of the merchant to be identified according to the risk type and the trusted identifier of the merchant to be identified.

18. An electronic device, characterized in that: include: A processor and a memory, the memory being used to store a computer program, and the processor being used to call and run the computer program stored in the memory to execute the method according to any one of claims 1 to 16.

19. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein the computer program causes a computer to execute the method according to any one of claims 1 to 16.

20. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the method according to any one of claims 1 to 16 is implemented.

Images