Anti-fraud model detection data processing method and device, equipment, medium and product

Abstract

The invention provides an anti-fraud model detection data processing method and device, equipment, a medium and a product, and relates to the technical field of data processing, and the method comprises the steps: carrying out the recognition of a first direction of a table image, and obtaining a first direction line; performing text recognition on the table image to obtain at least one initial textbox and texts corresponding to the initial textboxes; fusing the initial textboxes according to a second direction to obtain a target textbox; determining a second direction line according to each target textbox; determining cells according to the first direction lines and the second direction lines; determining a text corresponding to each cell according to the text corresponding to each initial textbox; and determining a table corresponding to the table image according to each cell and the text corresponding to each cell. According to the embodiment of the invention, the accuracy of the output result of the anti-fraud model can be quickly detected.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to an anti-fraud model detection data processing method, device, equipment, medium and product. Background Art

[0002] With the development of the Internet and mobile payments, bank accounts have become an indispensable tool in people's daily lives. Anti-fraud models can be built to detect account risks, so as to quickly identify risky accounts and improve account security.

[0003] At present, due to the rapid update of financial fraud methods, the scripted nature of gang fraud and the industrial chain, anti-fraud rules, strategies and model features also need to change rapidly and be frequently iterated and launched online. However, there are no scientific, comprehensive and operational evaluation standards for model launch standards and post-launch model tracking, and it often takes a long period of operation before it can be officially put into use. Summary of the invention

[0004] The present application provides an anti-fraud model detection data processing method, device, equipment, medium and product, which can quickly detect the accuracy of the anti-fraud model output results.

[0005] In a first aspect, the present application provides an anti-fraud model detection data processing method, comprising:

[0006] Obtain data of at least one risky transaction account detected online by an anti-fraud model;

[0007] Performing feature analysis on the data of each of the risky transaction accounts to obtain feature data of each of the risky transaction accounts;

[0008] Screening a target transaction account from each of the risky transaction accounts according to the characteristic data of each of the risky transaction accounts;

[0009] According to each of the target transaction accounts, the anti-fraud model is optimized and fed back.

[0010] In a second aspect, the present application provides an anti-fraud model detection data processing device, comprising:

[0011] A model output acquisition module, used to acquire data of at least one risky transaction account detected online by the anti-fraud model;

[0012] An account feature acquisition module, used to perform feature analysis on the data of each risky transaction account to obtain feature data of each risky transaction account;

[0013] An account screening module, used for screening target transaction accounts from among the risky transaction accounts according to the characteristic data of the risky transaction accounts;

[0014] The output feedback module is used to optimize the anti-fraud model according to each of the target transaction accounts.

[0015] In a third aspect, the present application provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0016] The memory stores computer-executable instructions;

[0017] The processor executes the computer-executable instructions stored in the memory to implement the method described in the present application.

[0018] In a fourth aspect, the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the method described in the present application.

[0019] In a fifth aspect, the present application provides a computer program product, including a computer program, which implements the method described in the present application when executed by a processor.

[0020] The present application provides an anti-fraud model detection data processing method, device, equipment, medium and product, which obtains the data of risky transaction accounts obtained by online detection of anti-fraud models, performs feature analysis on the data of risky transaction accounts, and then screens out target transaction accounts. According to the target transaction accounts, the anti-fraud model is optimized and fed back. This can help the anti-fraud model to be launched immediately when the research and development is successful, solve the problem of long launch cycle of the anti-fraud model, improve the real-time monitoring of the anti-fraud model, and continuously analyze the output results of the anti-fraud model, as well as continuously optimize the parameters of the online anti-fraud model. This can improve the suspicious account monitoring mechanism, build a complete anti-fraud model optimization feedback system, and realize the rapid deployment and application of the anti-fraud model. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0022] Figure 1 A flowchart of the anti-fraud model detection data processing method provided in an embodiment of the present application;

[0023] Figure 2 A flowchart of the anti-fraud model detection data processing method provided in an embodiment of the present application;

[0024] Figure 3 A flowchart of the anti-fraud model detection data processing method provided in an embodiment of the present application;

[0025] Figure 4A schematic diagram of an anti-fraud model detection data processing scenario provided in an embodiment of the present application;

[0026] Figure 5 A schematic diagram of the structure of an anti-fraud model detection data processing device provided in an embodiment of the present application;

[0027] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0028] The above drawings have shown clear embodiments of the present application, which will be described in more detail later. These drawings and text descriptions are not intended to limit the scope of the present application in any way, but to illustrate the concept of the present application to those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0029] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0030] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings. It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be considered as exemplary, and their purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or must use the relevant content of the solution. The acquisition, storage, use, and processing of data in the technical solution of the present application are in compliance with the relevant provisions of national laws and regulations.

[0031] In this embodiment, there is no scientific, comprehensive and operational evaluation standard for the model launch standard and the tracking of the model after launch in the prior art, and it often takes a long time to run before it can be officially put into use. This application proposes an anti-fraud model detection data processing method, device, equipment, medium and product, which obtains the data of risky transaction accounts obtained by online detection of anti-fraud models, and performs feature analysis on the data of risky transaction accounts, and then screens out target transaction accounts. According to the target transaction accounts, the anti-fraud model is optimized and fed back, which can help the anti-fraud model to be launched immediately when the research and development is successful, solve the problem of long launch cycle of anti-fraud models, improve the real-time monitoring of anti-fraud models, and continuously analyze the output results of anti-fraud models, and continuously optimize the parameters of online anti-fraud models, which can improve the suspicious account monitoring mechanism, build a complete anti-fraud model optimization feedback system, and realize the rapid deployment and application of anti-fraud models.

[0032] Figure 1 The process of the anti-fraud model detection data processing method provided in the embodiment of the present application is applicable to obtaining risk transaction accounts monitored online by the anti-fraud model for analysis and feedback when the anti-fraud model is put into use, and optimizing the anti-fraud model based on this. The method can be executed by an anti-fraud model detection data processing device, which can be implemented in the form of hardware and / or software. Figure 1 As shown, the method comprises the following steps:

[0033] S101. Obtain data of at least one risky transaction account detected online by an anti-fraud model.

[0034] The anti-fraud model is used to input account-related data and output the classification result of the account, for example, the classification result includes a risky transaction account or a normal transaction account. The input data of the anti-fraud model may be the same as or different from the data of the risky transaction account in the embodiment of the present application. In fact, the anti-fraud model processes the input data specified by some specific rules. The anti-fraud model is different from the device for implementing the anti-fraud model detection data processing method provided in the embodiment of the present application. At least one risky transaction account detected online by the anti-fraud model may refer to the online real-time data of the account being processed after the anti-fraud model is deployed and runs online, and the classification result obtained is a risky account. Among them, the risky account defined by the anti-fraud model may be a suspicious account or a dangerous account, etc., which is essentially the same as the risky transaction account in the embodiment of the present application. In addition, the anti-fraud model is a deep learning model, and the specific structure is not limited.

[0035] The data of the risky trading account is used as a basis for judging the suspicious probability of the risky trading account. The data of the risky trading account may include at least one of the following: the input data used by the anti-fraud model or part of it, and the data of the risky trading account collected independently. It should be noted that the data of the risky trading account is obtained with the authorization of the user to whom the risky trading account belongs and is legal and compliant. In some embodiments, the data of the risky trading account may include the interaction data and attribute data of the risky trading account.

[0036] S102: Perform feature analysis on the data of each risky transaction account to obtain feature data of each risky transaction account.

[0037] Feature analysis can refer to processing the data of risky trading accounts to extract key features that can reflect whether the risky trading accounts are risky. Feature data is used to represent whether the risky trading accounts are risky.

[0038] S103: Screening a target transaction account from among the risky transaction accounts according to the characteristic data of the risky transaction accounts.

[0039] Based on the characteristic data of the risky transaction accounts, the suspicious probability of each risky transaction account is determined, and the target transaction accounts are screened out according to the suspicious probability of each risky transaction account. In one example, the risky transaction accounts with suspicious probabilities higher than a preset probability threshold are screened out and determined as target transaction accounts. For another example, the top n risky transaction accounts with suspicious probabilities can be screened out and determined as target transaction accounts.

[0040] In some embodiments, determining the suspicious probability of each risky transaction account based on the characteristic data of the risky transaction account may be performed by clustering the risky transaction accounts, and calculating the suspicious probability of the risky transaction accounts based on the risky transaction accounts in the risk categories obtained by clustering. In one example, the suspicious probability of the risky transaction accounts belonging to each category is higher than that of the risky transaction accounts outside of each category.

[0041] In some embodiments, the suspicious probability of each risky transaction account is determined based on the characteristic data of the risky transaction account, and the characteristic data of the risky transaction account can be input into a pre-trained deep learning model to obtain the suspicious probability of each risky transaction account.

[0042] In some embodiments, determining the suspicious probability of each risky transaction account based on the characteristic data of the risky transaction account can be performed according to some preset rules, the characteristic data of the risky transaction account is subjected to rule judgment to obtain a score of at least one rule, and the scores of each rule are weighted summed to obtain the suspicious probability of the risky transaction account.

[0043] Optionally, in some embodiments, the anti-fraud model detection data processing method also includes: obtaining at least one standard account involved in the case; obtaining data of each of the standard accounts involved in the case; determining each of the standard accounts involved in the case as each of the risky transaction accounts, and determining the data of each of the standard accounts involved in the case as the data of each of the risky transaction accounts.

[0044] The standard account involved in the case can be an account determined to be risky provided by an authoritative channel. The system that implements the method provided by the embodiment of the present application can be connected to the authoritative system to obtain the standard account involved in the case provided by the authoritative system. With authorization, the data of the standard account involved in the case is obtained. The standard account involved in the case is used as a risky transaction account, and together with the risky transaction account detected by the anti-fraud model, it is determined whether it is risky, which is equivalent to using the standard account involved in the case as a positive sample to assist and verify whether the risky transaction account is risky. Usually, the standard account involved in the case can be a telecommunications fraud account.

[0045] It can be seen that by treating standard accounts involved in the case as risky transaction accounts and making suspicious judgments, and jointly identifying them with risky transaction accounts obtained through anti-fraud model detection, we can better understand the characteristics of risk categories and thus improve the accuracy of risk detection.

[0046] S104: Optimizing and feeding back the anti-fraud model according to each of the target transaction accounts.

[0047] Feedback the determined target transaction account to the anti-fraud model so that the anti-fraud model will classify the target transaction account as the true value of the risky transaction account, form a training sample, and continue to adjust the parameters of the anti-fraud model to optimize the anti-fraud model and improve the risk detection accuracy of the anti-fraud model. In addition, the characteristic data of the target transaction account can also be provided to the anti-fraud model to supplement the input data of the anti-fraud model for the target transaction account, thereby enriching the input data of the anti-fraud model and improving the risk detection accuracy of the anti-fraud model.

[0048] Optionally, in some embodiments, the anti-fraud model is optimized and fed back according to each of the target transaction accounts, including: verifying each of the target transaction accounts to obtain verification results and verification data; when the target transaction account is verified as a dangerous account, using the verification data and feature data of the dangerous account as supplementary features of the dangerous account; and providing feedback to the anti-fraud model based on the dangerous account and the supplementary features of the dangerous account, so that the anti-fraud model is optimized and adjusted according to the dangerous account and the supplementary features of the dangerous account.

[0049] Verifying the target trading account may be further distinguishing the target trading account. The target trading account is actually the result obtained by distinguishing the characteristic data. To further distinguish the target trading account, new data needs to be used, and the new data is the verification data. The verification data may refer to relevant data other than the characteristic data of the target trading account. The verification data is different from the characteristic data. In fact, the verification of the target trading account is based on the verification of supplementary data other than the characteristic data of the target trading account. The verification result may refer to the result of judging whether the target trading account is a risky account. The verification result may include that the target trading account is a risky account and that the target trading account is not a risky account.

[0050] The supplementary features are used to feed back to the anti-fraud model so that the anti-fraud model adds the supplementary features as input related to the risky account, thereby adjusting the parameters of the anti-fraud model. In some embodiments, the original input data and supplementary features related to the risky account are used as training samples, the training samples are input into the anti-fraud model for processing, and the prediction result of the anti-fraud model for the risky account is output. According to the difference between the prediction result and the classification result of the account as risky, the loss function is calculated, and the anti-fraud model is adjusted according to the loss function.

[0051] It can be seen that by verifying the target transaction account and obtaining the verification data, when the target transaction account is a dangerous account, the dangerous account and its feature data and verification data are fed back to the anti-fraud model, which can provide the anti-fraud model with a direction to be optimized, so that the anti-fraud model can accurately learn features that have not been perceived in the past, thereby accurately improving the risk detection accuracy of the anti-fraud model.

[0052] Optionally, in some embodiments, verifying each of the target trading accounts to obtain a verification result and verification data includes at least one of the following: manually interacting with each of the target trading accounts to obtain a verification result of the target trading account, and determining the interaction data as the verification data of the target trading account; and obtaining account information of each of the target trading accounts, determining the verification result of the target trading account, and determining the account information as the verification data of the target trading account.

[0053] Manual interaction may refer to the interaction process between the operation and maintenance user and the user to which the target trading account belongs. In some embodiments, the operation and maintenance user may contact the user to which the target trading account belongs by phone to confirm the behavior, status, attributes and other data associated with the target trading account, and determine the obtained behavior, status, attributes and other data associated with the target trading account as interaction data. The manually uploaded verification results and the interaction data in the manual interaction process may be obtained to obtain the verification results and verification data of the target trading account.

[0054] The account information of the target trading account can be obtained through the platform to which the target trading account belongs to obtain the authorized account-related information. The account information may include information such as the behavior, status and attributes associated with the target trading account. The interface of the platform to which it belongs can be called to obtain the account information, and the verification result and verification data of the target trading account can be obtained based on the account information.

[0055] When there is duplicate information in the interactive data and the account information, the interactive data and the account information can be deduplicated and merged to obtain verification data. When there is conflicting information in the interactive data and the account information, the account information can be used as the standard, and the conflicting content can be deleted from the interactive data to obtain verification data.

[0056] It can be seen that by manually verifying the target trading account, obtaining the verification result and verification data, and obtaining the account information of the target trading account, obtaining the verification result and verification data, and selecting at least one of them to verify the target risk account, the verification method can be enriched, and the verification data can be increased, which can further correct the target trading account and increase the reliability of the risky account.

[0057] The embodiment of the present application obtains data of risky transaction accounts obtained by online detection of the anti-fraud model, performs feature analysis on the data of the risky transaction accounts, and then screens out target transaction accounts. According to the target transaction accounts, the anti-fraud model is optimized and fed back. This can help the anti-fraud model to be launched immediately when the research and development is successful, solve the problem of long launch cycle of the anti-fraud model, improve the real-time monitoring of the anti-fraud model, and continuously analyze the output results of the anti-fraud model, as well as continuously optimize the parameters of the online anti-fraud model. This can improve the suspicious account monitoring mechanism, build a complete anti-fraud model optimization feedback system, and realize the rapid deployment and application of the anti-fraud model.

[0058] Figure 2 A flowchart of an anti-fraud model detection data processing method provided in an embodiment of the present application, such as Figure 2 As shown, the method comprises the following steps:

[0059] S201. Obtain data of at least one risky transaction account detected online by an anti-fraud model.

[0060] S202: For each of the risk interaction accounts, determine the common features of the risk transaction account according to the data transmitted in the data of the risk transaction account.

[0061] The transmission data may refer to information related to data transmitted by the risk trading account when the risk trading account interacts. In some embodiments, the data associated with the transmission data includes time information of the transmission and space information of the transmission. Among them, the risk trading account usually interacts in the network, and the space information usually refers to network information.

[0062] Optionally, in some embodiments, determining the common characteristics of the risk trading account based on the transmission data in the data of the risk trading account includes: determining the timing characteristics of the risk trading account based on the time and frequency of the transmission data of the risk trading account; determining the network characteristics of the risk trading account based on the address, device and network behavior associated with the transmission data of the risk trading account; and determining the timing characteristics and network characteristics of the risk trading account as the common characteristics of the risk trading account.

[0063] Time series features are used to describe the time distribution and frequency changes of risky trading accounts. Interaction behavior can be the behavior of trading operations. In one example, abnormal trading patterns are identified by monitoring the time intervals and trading peaks of risky trading accounts. For example, if an account frequently conducts large transactions during atypical trading hours (such as early morning), there may be a risk of fraud. Accordingly, statistics can be used to determine whether the time distribution of transactions of risky trading accounts includes atypical trading hours, and whether the trading peak includes atypical trading hours.

[0064] In one example, the time series features include: whether the type of time distribution includes atypical trading periods, whether the period of peak trading hours includes atypical trading periods, frequency, and frequency change rate. The time series features can be: 1 (1 means including), 1 (1 means including), 20, 1.5.

[0065] Network characteristics are used to describe the address, device, and network behavior of risky trading accounts. Among them, the address may include a network address or an actual geographic location, and the network address may include an Internet Protocol Address (IP). The address, device, and network behavior associated with the transmitted data may refer to the source address, destination address, source device, destination device, interaction between the source device and the destination device, etc. of a single transmission of data. The addresses, devices, and network behaviors associated with multiple transmission data are counted to obtain network characteristics. In one example, potential account takeover risks can be identified by analyzing the diversity of login devices and the frequency of changes in network addresses. For example, the same account may log in from multiple geographic locations in a short period of time, which may be abnormal.

[0066] In one example, the network characteristics include: device login address and login frequency. The network characteristics may be: 23345, 50 times per hour.

[0067] The time series features and network features can be concatenated to obtain common features.

[0068] It can be seen that the timing characteristics of the risky trading account are determined by obtaining the time and frequency of the transmission data, and the network characteristics of the risky trading account are determined by obtaining the address, device and network behavior associated with the transmission data. The timing characteristics and network characteristics are spliced ​​to obtain common characteristics, and the characteristics of the risky trading account are obtained from the dimensions of time and space, enriching the characteristic dimensions and content of the risky trading account.

[0069] S203: Determine business characteristics of the risky transaction account according to business data in the data of the risky transaction account.

[0070] Business data may refer to transaction-related data of a risk trading account.

[0071] Optionally, in some embodiments, determining the business characteristics of the risk trading account based on the business data in the data of the risk trading account includes: aggregating the transaction quantity and frequency from the business data of the risk trading account, and determining the batch characteristics of the risk trading account based on the transaction quantity and the frequency; determining the transaction characteristics of the risk trading account based on the transaction type, transaction amount and frequency in the business data of the risk trading account; and determining the batch characteristics and transaction characteristics of the risk trading account as the business characteristics of the risk trading account.

[0072] The number of transactions can refer to the number of times a risky trading account has transactions. The frequency can refer to the frequency of transactions in a risky trading account. Batch features are used to describe statistical key features extracted from large amounts of data. Features such as the number of transactions and the frequency of transactions in a risky trading account within a certain period of time can be aggregated. For example, by analyzing the total transaction amount and the number of transactions in a risky trading account per month, abnormal large-amount transactions can be discovered.

[0073] In one example, batch features include: transaction quantity and frequency. Batch features can be: 10,000, 10.

[0074] Transaction characteristics are used to describe the content related to each transaction behavior. Transaction characteristics can include transaction type, transaction amount, and frequency of risky transaction accounts. Single transaction amounts and transaction objects (such as common payees and payers) can be analyzed. For example, if a risky transaction account suddenly conducts large transactions with multiple new payees, it may be a sign of fraud.

[0075] In an example, transaction characteristics include transaction type, transaction amount and frequency. The transaction characteristics may be: remittance, 1 million, 10 times a day.

[0076] Batch features and transaction features can be combined to obtain business features. Business features include batch features obtained by statistics of risky trading accounts in a large number of trading operations, as well as transaction features of each individual trading business.

[0077] It can be seen that the batch characteristics of risky trading accounts are determined by obtaining the transaction quantity and frequency of business data, and the transaction characteristics of risky trading accounts are determined by obtaining the transaction type, transaction amount and frequency. The batch characteristics and transaction characteristics are spliced ​​to obtain business characteristics. The characteristics of risky trading accounts are obtained from the dimensions of batch statistics and single transaction business, enriching the characteristic dimensions and content of risky trading accounts.

[0078] S204: Determine the risk characteristics of the risky trading account according to the behavior data in the data of the risky trading account.

[0079] The behavior data may refer to data related to the interactive behavior of the risky trading account. In some embodiments, the behavior data may include data associated with the transaction behavior of the risky trading account.

[0080] Optionally, in some embodiments, determining the risk characteristics of the risk trading account based on the behavioral data in the data of the risk trading account includes: determining the risk characteristics of the risk trading account based on historical behavior and external evaluation data of the risk trading account.

[0081] Risk characteristics are used to describe the risk level of risk trading accounts. Historical behavior is used to determine whether there are abnormal behaviors in risk trading accounts. External evaluation data can obtain the evaluation data of multiple authorized risk trading accounts by calling the interface of the external system. The evaluation data of the required risk trading account can be queried from the evaluation data of a large number of risk trading accounts; or the evaluation data of the required risk trading account can be directly obtained from the external system.

[0082] The overall risk of a risky trading account can be assessed by combining external data (such as blacklist information and / or credit scores, etc.) with the historical trading behavior of the risky trading account. For example, a risky trading account has a record of being blacklisted and has abnormal recent trading behavior, which means it has a high risk level.

[0083] In one example, the risk characteristics include: whether to include historical behavior and external evaluation data of the risk. The risk characteristics may be: yes, high risk level.

[0084] Among them, historical behavior and external evaluation data can be spliced ​​to obtain risk characteristics. In fact, historical behavior can be understood as the internal evaluation data of risk trading accounts, and risk characteristics include the evaluation data of risk trading accounts in the internal system and the evaluation data of risk trading accounts in the external system.

[0085] It can be seen that by obtaining the historical behavior of business data and external evaluation data to determine the risk characteristics of risk trading accounts, it is possible to obtain risk evaluation results of risk trading accounts in internal and external networks, and enrich the characteristic dimensions and content of risk trading accounts.

[0086] S205: Determine the general characteristics, business characteristics and risk characteristics of the risky transaction account as characteristic data of the risky transaction account.

[0087] The general features, business features and risk features of the risky trading account are integrated to obtain feature data. Specifically, the general features, business features and risk features can be spliced ​​to obtain the feature data of the risky trading account. Before splicing, each feature can be standardized to ensure that each feature is on a unified scale.

[0088] S206: Screening a target transaction account from each of the risky transaction accounts according to the characteristic data of each of the risky transaction accounts.

[0089] S207: Optimizing and feeding back the anti-fraud model according to each of the target transaction accounts.

[0090] The embodiments of the present application can enrich the content and dimension of the data by acquiring the transmission data, business data and behavior data of the risky trading accounts, extract features from the diverse data, enrich the content and dimension of the features, and increase the representativeness of the features, thereby making judgments on the risky trading accounts based on the features, and improving the accuracy of risk detection of the risky trading accounts.

[0091] Figure 3 A flowchart of an anti-fraud model detection data processing method provided in an embodiment of the present application, such as Figure 3 As shown, the method comprises the following steps:

[0092] S301. Obtain data of at least one risky transaction account detected online by an anti-fraud model.

[0093] S302: Perform feature analysis on the data of each risky transaction account to obtain feature data of each risky transaction account.

[0094] S303: Calculate the distance between the risky transaction accounts according to the characteristic data of the risky transaction accounts.

[0095] The characteristic vector of the risky trading account can be determined according to the characteristic data of the risky trading account. The distance between the characteristic vectors of each two risky trading accounts is calculated as the distance between the two risky trading accounts. Exemplarily, the distance between the characteristic vectors can be calculated using the Euclidean distance or Manhattan distance method.

[0096] S304: Determine the density of each of the risky transaction accounts according to the distance between each of the risky transaction accounts.

[0097] According to the distance between every two risky trading accounts, the distance between each risky trading account and other risky trading accounts is determined, thereby determining the risky trading accounts near the risky trading account, and then according to the number of risky trading accounts near the risky trading account, determining the density of the risky trading account. The vicinity of the risky trading account may refer to a range extending outward by a certain distance with the risky trading account as the center, and the distance may be set to at least one value.

[0098] S305: Calculate the suspicious probability of each of the risky transaction accounts according to the density of each of the risky transaction accounts.

[0099] The density of risky trading accounts is used to describe the degree of aggregation of risky trading accounts. Based on the characteristic data of the risky trading accounts, the distance between the risky trading account and other risky trading accounts is determined, which indicates that the distance between the risky trading accounts is used to describe the similarity between the risky trading accounts. Accordingly, risky trading accounts with similar risk characteristics are clustered together. Suspicious risky trading accounts usually have similarities and are thus clustered together, so that the suspicious probability of the risky trading accounts can be determined based on the density of the risky trading accounts. In some embodiments, the suspicious probability of the risky trading accounts is proportional to the density of the risky trading accounts.

[0100] S306 . According to the suspicious probability of each of the risky transaction accounts, at least one target transaction account with a high suspicious probability is selected from among the risky transaction accounts.

[0101] You can select risky trading accounts with suspicious probabilities greater than a preset probability threshold as target trading accounts. Or you can select the top n risky trading accounts with the highest suspicious probabilities as target trading accounts. The number of target trading accounts is at least one. If there is no target trading account, you can continue to collect more feature data and recalculate the suspicious probability of the risk account.

[0102] In some embodiments, the risky transaction accounts are sorted according to their suspicious probability to obtain an account sorting result; in the account sorting result, a target number of risky transaction accounts with high suspicious probability are selected and determined as target transaction accounts.

[0103] The higher the suspicious probability, the greater the possibility that the risky trading account is risky. The target number can be determined based on experiments. When the risky trading accounts include standard accounts involved in the case, and the target trading accounts do not include the standard accounts involved in the case, the standard accounts involved in the case that are not included can be used as target trading accounts.

[0104] S307: Optimizing and feeding back the anti-fraud model according to each of the target transaction accounts.

[0105] Optionally, in some embodiments, the calculation of the suspicious probability of each of the risky trading accounts based on the density of each of the risky trading accounts includes: determining at least one core account in each of the risky trading accounts based on the density of each of the risky trading accounts; clustering each of the risk accounts based on each of the core accounts to obtain at least one account class, and the suspicious probability of each of the risk accounts.

[0106] For each risky trading account, the distance from the risky trading account to the kth nearest neighbor is calculated as the core distance of the risky trading account. For every two risky trading accounts, the mutual reachability distance between the two risky trading accounts is calculated, specifically the maximum value between the core distances of the two risky trading accounts. The density of the risky trading accounts is calculated based on the core distance and reachability distance of the risky trading accounts. Alternatively, the density of the risky trading accounts can also be determined based on the number of accounts within a preset radius centered on the risky trading account.

[0107] Risky trading accounts with a density higher than the density threshold are identified as core accounts. According to the accessibility distance of each risky trading account, a minimum spanning tree (MST) is constructed, which represents the connection relationship of data points. According to the minimum spanning tree, that is, based on density accessibility, the core accounts with a density direct relationship are connected to form an account class. Each account class includes at least one core account. And risky trading accounts with a density lower than the preset density threshold are identified as noise accounts. Risky trading accounts at the boundary value are divided into corresponding account classes. Specifically, the risky trading account clustering can be realized by using the density-based spatial hierarchical clustering method with noise (Hierarchical Density-Based Spatial Clustering of Applications with Noise, HDBSCAN).

[0108] According to the at least one account class obtained by the classification, the risky transaction accounts and target transaction accounts included in each account class can be determined. The confidence that the risky transaction account belongs to the account class is determined as the suspicious probability of the risky transaction account.

[0109] It can be seen that by determining the suspicious probability of risky trading accounts according to the density distribution of risky trading accounts, similar features between risky trading accounts can be converted into the density distribution of risky trading accounts, and the suspicious probability of risky trading accounts can be determined, which can improve the reliability of the suspicious probability.

[0110] Optionally, in some embodiments, the risk accounts are clustered according to the core accounts to obtain at least one account class, including: according to the core accounts, the risk accounts are clustered according to at least one target density to obtain at least one alternative class under each target density; according to each target density and the alternative class under each target density, at least one account class and the suspicious probability of each risk account are determined.

[0111] Each target density is different. Starting from the highest target density, the target density is gradually reduced. For each target density, the points that meet the density conditions are connected to form an alternative class of the target density. As the target density decreases, the alternative classes are gradually merged to form a hierarchical clustering result, i.e., the minimum spanning tree. The persistence of each alternative class under different target densities is calculated, and the non-overlapping cluster with the largest total persistence is selected and determined as the account class, and the confidence that each risky trading account belongs to the corresponding account class is determined, and the confidence of the risky trading account is determined as the suspicious probability.

[0112] It can be seen that by automatically determining the number of clusters according to the density distribution of the data without prior specification, the clustering analysis process is greatly simplified, and a hierarchical clustering result is formed. The granularity of the clustering can be controlled by setting different parameters to meet different needs, providing a more flexible clustering analysis method. Finally, the confidence level of the risky trading account is used as the suspicious probability of the risky trading account to improve the reliability of the clustering results.

[0113] The embodiment of the present application calculates the distance between risky transaction accounts, determines the density of risky transaction accounts, and thus determines the density of risky transaction accounts, and screens target transaction accounts. It can accurately screen out multiple target transaction accounts with similar risk characteristics, which can speed up risk detection and improve risk detection accuracy.

[0114] In an example, Figure 4 As shown, an anti-fraud model detection data processing method may include:

[0115] S401. Model development.

[0116] Obtain manually developed models. Specifically, model development includes: model conceptualization, model design, and model construction.

[0117] S402: Acquire data of risky trading accounts.

[0118] Obtain the risky transaction accounts output by the anti-fraud model and sample the data of the risky transaction accounts. The data of the risky transaction accounts can be obtained from the communicating business system (equivalent to the internal data source) and the external data source. Specifically, the objects of the business system docking may include the user's debit and credit cards, the merchant's accounts, and different types of digital currencies. The external data source mainly provides risk assessment data.

[0119] S403: Feature analysis.

[0120] Perform feature analysis on the acquired data of the risky transaction accounts to obtain at least one of a general feature, a business feature, a risk feature, and the like.

[0121] S404: Processing risk transaction account data.

[0122] The acquired features are integrated to obtain feature data. The target trading accounts are screened from the risky trading accounts based on the feature data.

[0123] S405. Model monitoring, specifically including the effectiveness of the anti-fraud model and supplementary features.

[0124] Determine the detection accuracy of the anti-fraud model based on the target trading account. Feedback the target trading account to the anti-fraud model, and provide the verification data associated with the target trading account to the anti-fraud model.

[0125] S406: Model optimization.

[0126] The anti-fraud model adjusts parameters based on the target transaction account and verification data to optimize the accuracy of risk account identification of the anti-fraud model.

[0127] The embodiment of the present application conducts expert investigation and confirmation on the target transaction account, continuously analyzes, and counts the effectiveness indicators of the anti-fraud model. It can continuously optimize the anti-fraud model and improve the monitoring mechanism by adding tags and adjusting parameters.

[0128] Establish a complete model optimization feedback system, optimize the monitoring mechanism through continuous analysis of the anti-fraud model output results, introduce expert feedback and actual investigation results, adjust model parameters, and improve feature extraction methods.

[0129] S407, model offline and archived.

[0130] When the anti-fraud model needs to be adjusted and optimized, the anti-fraud model will be taken offline and archived, and then redeployed and put online after optimization.

[0131] After the anti-fraud model is successfully developed, it still takes a long time for online verification before it can be officially put into use. The embodiments of the present application can help the anti-fraud model to be put online immediately after successful development, solve the problem of long anti-fraud model online cycle, and have very high timeliness; focus on the large amount of suspicious data generated by the online anti-fraud model, and process the time series characteristics, network characteristics, transaction characteristics and risk status of the relevant suspicious account card numbers in real time, and comprehensively use knowledge graphs, machine learning and flow service platforms and other technologies to select the TopN suspicious data with high scores for investigation; continuously analyze the output results of the anti-fraud model, count the characteristic indicators of suspicious accounts, and improve the suspicious account monitoring mechanism by continuously adjusting and optimizing the parameters of the online anti-fraud model, and build a complete model optimization feedback system.

[0132] The embodiment of the present application provides a method for tracking suspicious data features after the anti-fraud model is launched. By real-time processing of the time series features, network features, transaction features, and risk status of the relevant suspicious account card numbers, a suspicious account screening model is established, and the trend of account risk feature changes is monitored to achieve rapid model launch and optimization. Specifically, the model launch speed is accelerated: the model is launched quickly after successful development, greatly shortening the model launch cycle; the workload of operation and maintenance users is reduced: through accurate screening and feature analysis of suspicious accounts, the workload of operation and maintenance users is reduced, and complaints from account users are reduced; an efficient monitoring mechanism is provided: using real-time data analysis and machine learning technology, an efficient fraud monitoring and screening method is provided.

[0133] Figure 5 This is a schematic diagram of the structure of the anti-fraud model detection data processing device provided in the embodiment of the present application. Figure 5 As shown, the anti-fraud model detection data processing device includes:

[0134] A model output acquisition module 501 is used to acquire data of at least one risky transaction account detected online by an anti-fraud model;

[0135] An account feature acquisition module 502 is used to perform feature analysis on the data of each risky transaction account to obtain feature data of each risky transaction account;

[0136] An account screening module 503 is used to screen a target transaction account from each of the risky transaction accounts according to the characteristic data of each of the risky transaction accounts;

[0137] The output feedback module 504 is used to optimize the anti-fraud model according to each of the target transaction accounts.

[0138] Optionally, the account feature acquisition module 502 includes:

[0139] A general feature extraction unit, configured to determine, for each of the risk interaction accounts, the general features of the risk transaction accounts according to the data transmitted in the data of the risk transaction accounts;

[0140] A business feature extraction unit, used to determine the business features of the risky transaction account according to the business data in the data of the risky transaction account;

[0141] A risk feature extraction unit, configured to determine the risk feature of the risky transaction account according to the behavior data in the data of the risky transaction account;

[0142] The feature fusion unit is used to determine the general features, business features and risk features of the risky transaction account as feature data of the risky transaction account.

[0143] Optional, general feature extraction unit, specifically used for:

[0144] Determining the time series characteristics of the risky transaction account according to the time and frequency of the transmission data of the risky transaction account;

[0145] Determining the network characteristics of the risky transaction account according to the address, device and network behavior associated with the transmission data of the risky transaction account;

[0146] The time series characteristics and network characteristics of the risky transaction account are determined as the common characteristics of the risky transaction account.

[0147] Optionally, the service feature extraction unit is specifically used to:

[0148] Aggregating the transaction quantity and frequency from the business data of the risky transaction account, and determining the batch characteristics of the risky transaction account according to the transaction quantity and the frequency;

[0149] Determining transaction characteristics of the risky transaction account based on the transaction type, transaction amount and frequency in the business data of the risky transaction account;

[0150] The batch characteristics and transaction characteristics of the risky transaction account are determined as the business characteristics of the risky transaction account.

[0151] Optionally, a risk feature extraction unit is used to:

[0152] The risk characteristics of the risky trading account are determined according to the historical behavior of the risky trading account and external evaluation data.

[0153] Optionally, the account screening module 503 includes:

[0154] An account distance calculation unit, used for calculating the distance between each of the risky transaction accounts according to the characteristic data of each of the risky transaction accounts;

[0155] A density calculation unit, used to determine the density of each of the risky transaction accounts according to the distance between each of the risky transaction accounts;

[0156] A probability calculation unit, used to calculate the suspicious probability of each of the risky transaction accounts according to the density of each of the risky transaction accounts;

[0157] The probability screening unit is used to screen at least one target transaction account with a high suspicious probability from among the risky transaction accounts according to the suspicious probability of each risky transaction account.

[0158] Optionally, a probability calculation unit is used to:

[0159] Determining at least one core account among the risky transaction accounts according to the density of the risky transaction accounts;

[0160] The risk accounts are clustered according to the core accounts to obtain at least one account class and a suspicious probability of each risk account.

[0161] Optional, probability screening unit, specifically used for:

[0162] sorting the risky transaction accounts according to the suspicious probability of the risky transaction accounts to obtain an account sorting result;

[0163] From the account sorting results, a target number of risky transaction accounts with a high suspicion probability are selected and determined as target transaction accounts.

[0164] Optionally, the output feedback module 504 includes:

[0165] An account verification unit, used to verify each of the target transaction accounts and obtain a verification result and verification data;

[0166] a supplementary feature determination unit, configured to use the verification data and feature data of the dangerous account as the supplementary feature of the dangerous account when the target transaction account is verified as a dangerous account;

[0167] The optimization and parameter adjustment unit is used to provide feedback to the anti-fraud model based on the risky account and the supplementary features of the risky account, so that the anti-fraud model is optimized and adjusted based on the risky account and the supplementary features of the risky account.

[0168] Optionally, the account verification unit is specifically used for at least one of the following:

[0169] Manually interact with each of the target transaction accounts to obtain verification results of the target transaction accounts, and determine the interaction data as verification data of the target transaction accounts; and

[0170] The account information of each of the target transaction accounts is obtained, and a verification result of the target transaction account is determined, and the account information is determined as verification data of the target transaction account.

[0171] Optionally, the anti-fraud model detection data processing device further includes:

[0172] A standard case-related account acquisition module, used to acquire at least one standard case-related account;

[0173] A case-related data acquisition module, used to acquire the data of each of the standard cases-related accounts;

[0174] The risk account newly added module is used to determine each of the standard accounts involved in the case as each of the risky transaction accounts, and to determine the data of each of the standard accounts involved in the case as the data of each of the risky transaction accounts.

[0175] The anti-fraud model detection data processing device provided in the embodiment of the present invention can execute the anti-fraud model detection data processing method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0176] Figure 6 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0177] like Figure 6As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0178] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0179] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs the various methods and processes described above, such as the anti-fraud model detection data processing method.

[0180] In some embodiments, the anti-fraud model detection data processing method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the anti-fraud model detection data processing method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the anti-fraud model detection data processing method in any other appropriate manner (e.g., by means of firmware).

[0181] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0182] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0183] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0184] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0185] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0186] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0187] An embodiment of the present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements the anti-fraud model detection data processing method provided in any embodiment of the present application.

[0188] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0189] Note that the above are only preferred embodiments of the present invention and the technical principles used. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in more detail through the above embodiments, the present invention is not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the present invention, and the scope of the present invention is determined by the scope of the appended claims.

Claims

1. A method for processing data for anti-fraud model detection, characterized in that: include: Obtain data of at least one risky transaction account detected online by an anti-fraud model; Performing feature analysis on the data of each of the risky transaction accounts to obtain feature data of each of the risky transaction accounts; Screening a target transaction account from each of the risky transaction accounts according to the characteristic data of each of the risky transaction accounts; According to each of the target transaction accounts, the anti-fraud model is optimized and fed back.

2. The method according to claim 1, characterized in that The characteristic analysis of the data of each risky transaction account to obtain characteristic data of each risky transaction account includes: For each of the risk interaction accounts, determining the common features of the risk transaction account according to the data transmitted in the data of the risk transaction account; Determining business characteristics of the risky transaction account based on business data in the data of the risky transaction account; Determining risk characteristics of the risky trading account based on the behavioral data in the data of the risky trading account; The general characteristics, business characteristics and risk characteristics of the risky transaction account are determined as characteristic data of the risky transaction account.

3. The method according to claim 2, characterized in that The determining the common features of the risky trading account according to the data transmitted in the risky trading account includes: Determining the time series characteristics of the risky transaction account according to the time and frequency of the transmission data of the risky transaction account; Determining the network characteristics of the risky transaction account according to the address, device and network behavior associated with the transmission data of the risky transaction account; The time series characteristics and network characteristics of the risky transaction account are determined as the common characteristics of the risky transaction account.

4. The method according to claim 2, characterized in that: The determining the business characteristics of the risky transaction account according to the business data in the data of the risky transaction account includes: Aggregating the transaction quantity and frequency from the business data of the risky transaction account, and determining the batch characteristics of the risky transaction account according to the transaction quantity and the frequency; Determining transaction characteristics of the risky transaction account based on the transaction type, transaction amount and frequency in the business data of the risky transaction account; The batch characteristics and transaction characteristics of the risky transaction account are determined as the business characteristics of the risky transaction account.

5. The method according to claim 2, characterized in that: The step of determining the risk characteristics of the risky trading account according to the behavior data in the data of the risky trading account includes: The risk characteristics of the risky trading account are determined according to the historical behavior of the risky trading account and external evaluation data.

6. The method according to claim 1, characterized in that The step of screening target transaction accounts from among the risky transaction accounts according to the characteristic data of the risky transaction accounts comprises: Calculating the distance between each of the risky transaction accounts according to the characteristic data of each of the risky transaction accounts; Determining the density of each of the risky transaction accounts according to the distance between each of the risky transaction accounts; Calculating the suspicious probability of each of the risky transaction accounts according to the density of each of the risky transaction accounts; According to the suspicious probability of each of the risky transaction accounts, at least one target transaction account with a high suspicious probability is screened from among the risky transaction accounts.

7. The method according to claim 6, characterized in that The calculating the suspicious probability of each of the risky transaction accounts according to the density of each of the risky transaction accounts includes: Determining at least one core account among the risky transaction accounts according to the density of the risky transaction accounts; The risk accounts are clustered according to the core accounts to obtain at least one account class and a suspicious probability of each risk account.

8. The method according to claim 6, characterized in that The step of clustering the risk accounts according to the core accounts to obtain at least one account class and the suspicious probability of each risk account includes: According to each of the core accounts, clustering each of the risk accounts according to at least one target density to obtain at least one candidate class under each of the target densities; At least one account class and the suspicious probability of each risk account are determined based on each of the target densities and the alternative classes under each of the target densities.

9. The method according to claim 1, characterized in that: The optimizing feedback of the anti-fraud model according to each of the target transaction accounts includes: Verifying each of the target transaction accounts to obtain verification results and verification data; When the target transaction account is verified as a risky account, the verification data and feature data of the risky account are used as supplementary features of the risky account; According to the risky account and the supplementary features of the risky account, feedback is given to the anti-fraud model so that the anti-fraud model is optimized and adjusted according to the risky account and the supplementary features of the risky account.

10. The method according to claim 9, characterized in that Verify each of the target transaction accounts to obtain verification results and verification data, including at least one of the following: Manually interact with each of the target transaction accounts to obtain verification results of the target transaction accounts, and determine the interaction data as verification data of the target transaction accounts; as well as The account information of each of the target transaction accounts is obtained, and a verification result of the target transaction account is determined, and the account information is determined as verification data of the target transaction account.

11. The method according to claim 1, characterized in that: Also includes: Obtain at least one standard account involved in the case; Obtain data of accounts involved in each of the above standards; Each of the standard accounts involved in the case is determined as each of the risky transaction accounts, and the data of each of the standard accounts involved in the case is determined as the data of each of the risky transaction accounts. 12.An anti-fraud model detection data processing device, characterized in that: include: A model output acquisition module, used to acquire data of at least one risky transaction account detected online by the anti-fraud model; An account feature acquisition module, used to perform feature analysis on the data of each risky transaction account to obtain feature data of each risky transaction account; An account screening module, used for screening target transaction accounts from among the risky transaction accounts according to the characteristic data of the risky transaction accounts; The output feedback module is used to optimize the anti-fraud model according to each of the target transaction accounts.

13. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the anti-fraud model detection data processing method according to any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the anti-fraud model detection data processing method according to any one of claims 1 to 11.

15. A computer program product, characterized in that It includes a computer program, which, when executed by a processor, implements the anti-fraud model detection data processing method described in any one of claims 1 to 11.

Images