Abnormal business main body identification method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides an abnormal business main body identification method and device, electronic equipment and a computer readable storage medium, and relates to the field of artificial intelligence. The method comprises the following steps: determining transaction data of a plurality of business subjects, obtaining a plurality of clusters, determining a first abnormal rate of each cluster, and taking the cluster with the first abnormal rate greater than a first preset threshold as a target cluster; determining data characteristics of transaction data of each first business main body and each second business main body; determining a second abnormal rate of the first business main body according to the similarity between the data characteristics of the first business main body and each second business main body; for each first business main body, obtaining a third abnormal rate of the first business main body; and taking the first business main body of which the third abnormal rate is greater than a second preset threshold as an abnormal business main body. The embodiment of the invention does not depend on a large amount of annotation data, can directly output the abnormal business main body, and can improve the coverage rate of identifying the abnormal business main body.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology. Specifically, the present application relates to a method, device, electronic device, computer-readable storage medium and computer program product for identifying abnormal business entities. Background Art

[0002] As we all know, cross-border businesses are not allowed to provide payment and settlement services to merchants engaged in specific risk industries (i.e. abnormal business entities). It is particularly important to effectively identify such merchants.

[0003] However, due to the limited information available to overseas merchants, there are also few cases discovered in history, and the number of cases in a large number of risky industries is concentrated in the single digit. There are two main methods for related technologies to identify abnormal business entities:

[0004] 1) Modeling is performed based on structured features such as transaction flow, and the trained model is applied to all merchants;

[0005] 2) Construct keyword documents for various types of risks, perform keyword matching on unstructured information, and identify merchants with corresponding risks if the keywords are matched.

[0006] The above-mentioned Type 1 method requires more labeled data. However, there are more than 100 categories of existing specific business risks, and the sample size of each category is very limited, which is not enough to support the data required for model training. The Type 2 method is limited by the richness of the keyword dictionary, and there are more than 30 languages ​​of overseas merchants. Except for Chinese and English, keywords in other languages ​​are rarely covered. At the same time, the keyword misjudgment rate is high, which increases the cost of manual review. Summary of the invention

[0007] The embodiments of the present application provide a method, device, electronic device, computer-readable storage medium and computer program product for identifying abnormal business entities, which can solve the above-mentioned problems of the prior art. The technical solution is as follows:

[0008] According to one aspect of an embodiment of the present application, a method for identifying an abnormal business subject is provided, the method comprising:

[0009] Determine transaction data of multiple business entities, including abnormal business entities and business entities to be identified;

[0010] According to the degree of association between the transaction data of multiple business entities, the multiple business entities are clustered to obtain multiple clusters, and the first abnormality rate of each cluster is determined. The first abnormality rate is the proportion of abnormal business entities in the cluster, and the cluster whose first abnormality rate is greater than the first preset threshold is used as the target cluster;

[0011] Determine data features of transaction data of each first business subject and each second business subject, the first business subject is a business subject to be identified in a target cluster, and the second business subject includes at least an abnormal business subject in the corresponding target cluster;

[0012] For each first business subject, determine the similarity between the data features of the first business subject and each second business subject, and determine the second abnormality rate of the first business subject according to the similarity between the data features of the first business subject and each second business subject;

[0013] For each first business subject, the third abnormality rate of the first business subject is obtained according to the first abnormality rate of the target node cluster where the first business subject is located and the second abnormality rate of the first business subject, and the first business subject whose third abnormality rate is greater than the second preset threshold is regarded as an abnormal business subject.

[0014] According to another aspect of an embodiment of the present application, a device for identifying an abnormal business subject is provided, the device comprising:

[0015] A transaction data determination module, used to determine the transaction data of multiple business entities, wherein the multiple business entities include abnormal business entities and business entities to be identified;

[0016] A first abnormality rate determination module is used to cluster multiple business entities according to the degree of association between the transaction data of the multiple business entities, obtain multiple clusters, determine the first abnormality rate of each cluster, the first abnormality rate is the proportion of abnormal business entities in the cluster, and take the cluster whose first abnormality rate is greater than the first preset threshold as the target cluster;

[0017] A feature determination module, used to determine data features of transaction data of each first business subject and each second business subject, the first business subject is a business subject to be identified in a target cluster, and the second business subject includes at least an abnormal business subject in the corresponding target cluster;

[0018] A second abnormality rate determination module is used to determine, for each first business subject, the similarity between the data features of the first business subject and each second business subject, and determine the second abnormality rate of the first business subject according to the similarity between the data features of the first business subject and each second business subject;

[0019] The anomaly identification module obtains, for each first business subject, the third anomaly rate of the first business subject according to the first anomaly rate of the target node cluster where the first business subject is located and the second anomaly rate of the first business subject, and regards the first business subject whose third anomaly rate is greater than the second preset threshold as an abnormal business subject.

[0020] As an optional implementation manner, the first abnormality rate determination module is specifically used for:

[0021] Determining a plurality of business subject pairs according to the transaction data of the plurality of business subjects, each business subject pair including two business subjects whose correlation degree is greater than a third preset threshold;

[0022] A connection graph is obtained according to the plurality of business subject pairs, wherein each node in the connection graph represents a business subject in a business subject pair, and a line is connected between two nodes corresponding to each business subject pair;

[0023] The clusters in the connected graph are determined through the community discovery algorithm.

[0024] As an optional implementation, the transaction data of each business subject includes the object identifier of each transaction object that conducts transactions with the business subject, and the transaction frequency and transaction amount of each transaction object with the business subject;

[0025] The first abnormal rate determination module determines a plurality of business subject pairs according to the transaction data of the plurality of business subjects, including:

[0026] According to the transaction data of each business subject, a plurality of candidate business subject pairs are obtained, wherein the number of identical transaction objects between two business subjects in each candidate business subject pair is greater than a fourth preset threshold;

[0027] For each candidate business entity pair, determine the degree of association between the two business entities in the candidate business entity pair based on the transaction frequencies and transaction amounts corresponding to the two business entities in the candidate business entity pair;

[0028] According to the correlation degree corresponding to each candidate business subject pair, a plurality of business subject pairs are determined.

[0029] As an optional implementation, the transaction data of each business subject includes at least one description information of the transaction;

[0030] The data features of the transaction data of any one of the first business subjects and the second business subjects include sub-features of all types of descriptive information of the corresponding business subjects.

[0031] As an optional implementation manner, the feature determination module is specifically used to:

[0032] For any one of the first business subject and the second business subject, the sub-features of each description information of the corresponding business subject are obtained in the following manner:

[0033] The frequencies of the description information of the corresponding types of the corresponding business subjects are counted, and a preset number of reference description information is obtained from all the description information of the corresponding types of the corresponding business subjects in descending order of the frequencies, and text features of the preset number of reference description information are extracted, and the text features are used as sub-features of the description information of the corresponding types of the corresponding business subjects.

[0034] As an optional implementation manner, the feature determination module extracts a preset number of text features of the reference description information, including:

[0035] Segment all sentences in a preset number of reference description information, and obtain a word vector for each segmented word based on a pre-trained word vector model;

[0036] According to the word vectors of all the segmented words, a vector representation of a preset number of reference description information is obtained;

[0037] According to the word vectors of all the segmented words, the vector representations of a preset number of reference description information are regularized to obtain sub-features of the corresponding types of description information of the business subject.

[0038] As an optional implementation manner, the similarity between the data features of the first business subject and a second business subject includes: the similarity between sub-features of all types of description information of the first business subject and a second business subject;

[0039] The second abnormality rate determination module is specifically used for:

[0040] For each type of description information, the maximum similarity between the sub-features of the description information of the first business subject and the corresponding type of the second business subjects is used as the sub-abnormality rate of the description information of the corresponding type of the first business subject;

[0041] The second abnormality rate of the first business subject includes sub-abnormality rates of all types of descriptive information of the first business subject.

[0042] As an optional implementation, the abnormality identification module is specifically used for:

[0043] Determine a weight corresponding to the first abnormality rate and a weight corresponding to each type of descriptive information;

[0044] The first abnormality rate and the sub-abnormality rates of all types of descriptive information of the first business subject are weightedly summed with corresponding weights to obtain a third abnormality rate of the first business subject.

[0045] According to another aspect of an embodiment of the present application, an electronic device is provided, which includes a memory, a processor, and a computer program stored in the memory, and the processor executes the computer program to implement the steps of the above-mentioned method for identifying abnormal business entities.

[0046] According to another aspect of the embodiments of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned method for identifying abnormal business entities are implemented.

[0047] According to one aspect of an embodiment of the present application, a computer program product is provided, including a computer program, which implements the steps of the above-mentioned method for identifying abnormal business entities when the computer program is executed by a processor.

[0048] The beneficial effects of the technical solution provided by the embodiment of the present application are:

[0049] By obtaining the transaction data of abnormal business subjects and business subjects to be identified, the correlation between the transaction data of the business subjects is first used to cluster multiple business subjects to obtain multiple clusters, each of which includes multiple business subjects with strong correlations. Then, based on the proportion of abnormal business subjects in the clusters, the first abnormality rate of the clusters is obtained, and the first probability that each business subject to be identified belongs to an abnormal business subject is obtained from the perspective of the degree of transaction correlation. Further, based on the first preset threshold, the target cluster is screened out, and the data features of the first business subject and the second business subject are obtained by deriving features from the transaction data of the business subjects, so that the dimensions are richer and the relationship between the first business subject and each second business subject is determined. The similarity between the data features of the business subjects is determined according to the similarity between the data features of the first business subject and each second business subject. The second abnormality can characterize the similarity between the first business subject and the abnormal business subject. The first abnormality rate of the target node cluster where the first business subject is located and the second abnormality rate of the first business subject are combined to obtain the third abnormality rate of the first business subject. A new abnormal business subject is determined based on the third abnormality rate. Since this solution comprehensively considers the degree of correlation and data features, does not rely on a large amount of labeled data, and can directly output abnormal business subjects, it has been verified that in practical applications it can also be found that the coverage rate of identifying abnormal business subjects can be greatly improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in describing the embodiments of the present application.

[0051] Figure 1a A schematic diagram of the system architecture for implementing abnormal business entities provided in an embodiment of the present application;

[0052] Figure 1b The overall process framework diagram of the method for identifying abnormal business entities provided in the embodiment of the present application;

[0053] Figure 2A flowchart of a method for identifying an abnormal business subject provided in an embodiment of the present application;

[0054] Figure 3 A schematic diagram of a process for obtaining a business subject pair provided in an embodiment of the present application;

[0055] Figure 4 A schematic diagram of a connectivity graph provided in an embodiment of the present application;

[0056] Figure 5 A schematic diagram of a process for determining the similarity between sub-features of description information of a first business subject and a second business subject provided in an embodiment of the present application;

[0057] Figure 6 A flowchart of a method for identifying an abnormal business subject provided in an embodiment of the present application;

[0058] Figure 7 A schematic diagram of a scenario provided for an embodiment of the present application;

[0059] Figure 8 A schematic diagram of the structure of an abnormal business subject identification device provided in an embodiment of the present application;

[0060] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0061] The embodiments of the present application are described below in conjunction with the drawings in the present application. It should be understood that the implementation methods described below in conjunction with the drawings are exemplary descriptions for explaining the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions of the embodiments of the present application.

[0062] It will be understood by those skilled in the art that, unless specifically stated, the singular forms "one", "an" and "the" used herein may also include plural forms. It should be further understood that the terms "including" and "comprising" used in the embodiments of the present application refer to that the corresponding features can be implemented as the presented features, information, data, steps, operations, elements and / or components, but do not exclude the implementation as other features, information, data, steps, operations, elements, components and / or combinations thereof supported by the technical field. It should be understood that when we call an element "connected" or "coupled" to another element, the one element can be directly connected or coupled to the other element, or it can refer to that the one element and the other element establish a connection relationship through an intermediate element. In addition, the "connection" or "coupling" used here may include wireless connection or wireless coupling. The term "and / or" used here indicates at least one of the items defined by the term, for example, "A and / or B" can be implemented as "A", or as "B", or as "A and B".

[0063] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0064] First, several terms involved in this application are introduced and explained:

[0065] The identification method of abnormal business entities provided in the embodiment of the present application is based on artificial intelligence. Artificial Intelligence (AI) is a theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology in computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines so that the machines have the functions of perception, reasoning and decision-making.

[0066] Artificial intelligence technology is a comprehensive discipline that covers a wide range of fields, including both hardware-level and software-level technologies. The basic technologies of artificial intelligence generally include sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics and other technologies. Artificial intelligence software technology mainly includes computer vision technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0067] In the embodiments of the present application, the artificial intelligence software technologies mainly involved include the above-mentioned natural language processing, machine learning / deep learning and other directions. For example, it may involve text preprocessing (Text preprocessing) and semantic understanding (Semantic understanding) in natural language processing (NLP), and it may also involve deep learning (Deep Learning) in machine learning (Machine learning, ML), including various types of artificial neural networks (Artificial Neural Network, ANN).

[0068] The method for identifying abnormal business entities provided in this application can be applied to abnormal business entity identification devices with data processing capabilities, such as terminal devices and servers. Among them, the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server providing cloud computing services. The terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited to this. The terminal device and the server can be directly or indirectly connected via wired or wireless communication, and this application does not limit this.

[0069] The abnormal business subject identification device may have the ability to implement natural language processing, which is an important direction in the fields of computer science and artificial intelligence. It studies various theories and methods that can achieve effective communication between people and computers using natural language. Natural language processing is a science that integrates linguistics, computer science, and mathematics. Therefore, research in this field will involve natural language, that is, the language used by people in daily life, so it is closely related to the study of linguistics. Natural language processing technology generally includes text processing, semantic understanding, machine translation, robot question and answer, knowledge graph and other technologies. In an embodiment of the present application, the abnormal business subject identification device can process the transaction note information through text preprocessing, semantic understanding and other technologies in natural language processing.

[0070] The abnormal business subject identification device may have machine learning capabilities. Machine learning is a multi-disciplinary interdisciplinary subject involving probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory and other disciplines. It specializes in studying how computers simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to make computers intelligent. Its applications are spread across all areas of artificial intelligence. Machine learning and deep learning usually include technologies such as artificial neural networks.

[0071] The artificial intelligence model used in the abnormal business subject identification method provided in the embodiment of the present application mainly involves the application of neural networks, and the abnormal business subjects are identified through neural networks.

[0072] In addition, the abnormal business subject identification device provided in the embodiment of the present application also has cloud computing capabilities. Cloud computing refers to the delivery and use mode of IT infrastructure, which means obtaining the required resources through the network in an on-demand and easily scalable manner; cloud computing in a broad sense refers to the delivery and use mode of services, which means obtaining the required services through the network in an on-demand and easily scalable manner. This service can be IT and software, Internet-related, or other services. Cloud computing is the product of the development and integration of traditional computer and network technologies such as grid computing, distributed computing, parallel computing, utility computing, network storage technologies, virtualization, and load balancing.

[0073] With the development of the Internet, real-time data streams, and the diversification of connected devices, as well as the demand for search services, social networks, mobile commerce, and open collaboration, cloud computing has developed rapidly. Different from the previous parallel distributed computing, the emergence of cloud computing will promote revolutionary changes in the entire Internet model and enterprise management model from a conceptual perspective.

[0074] In an embodiment of the present application, the abnormal business subject identification device can use cloud computing technology to process the account description information of the account to be identified and the content published by the account to be identified, so as to determine whether the account to be identified is an abnormal account based on the processed information.

[0075] In cross-border business, the supervision clearly stipulates that payment and settlement services shall not be provided to merchants engaged in specific risky industries (such as surrogacy and other risky businesses). How to effectively identify such merchants is particularly important. However, due to the limited information available on overseas merchants themselves and the small number of cases discovered in history, a large number of cases in risky industries are concentrated in the single digit.

[0076] Existing technical solutions can be divided into two categories:

[0077] 1) Modeling is performed based on structured features such as transaction flow, and the trained model is applied to all merchants;

[0078] 2) Construct keyword documents for various types of risks, perform keyword matching on unstructured information, and identify merchants with corresponding risks if the keywords are matched.

[0079] Existing technical solutions 1) The supervised modeling method requires more labeled data. However, there are more than 100 categories of specific business risks, and the sample size of each category is very limited, which is not enough to support the data required for model training. In addition, only structured data such as transaction flow is considered, and unstructured data is not used. In fact, there is no obvious distinction between the transaction flow of risky merchants. Solution 2) The method based on keyword matching is limited by the richness of the keyword dictionary, and there are more than 30 languages ​​for overseas merchants. In addition to Chinese and English, keywords in other languages ​​are rarely covered. At the same time, the keyword misjudgment rate is high, which increases the cost of manual review.

[0080] In order to facilitate understanding of the technical solution of the present application, the abnormal business subject identification method provided in the embodiment of the present application is introduced below in combination with actual application scenarios, taking the server as the abnormal business subject identification device.

[0081] It should be noted that the collection and processing of transaction data in each embodiment of the present application, when applied in examples, are strictly in accordance with the requirements of relevant national laws and regulations, obtain the informed consent or separate consent of the business entity, and carry out subsequent data use and processing within the scope of authorization of laws and regulations and business entities.

[0082] The abnormal business subject identification method, device, electronic device, computer-readable storage medium and computer program product provided in this application are intended to solve the above technical problems in the prior art.

[0083] The following describes several exemplary embodiments to illustrate the technical solutions of the embodiments of the present application and the technical effects produced by the technical solutions of the present application. It should be noted that the following embodiments can refer to, draw on or combine with each other, and the same terms, similar features and similar implementation steps in different embodiments will not be described repeatedly.

[0084] Figure 1aA schematic diagram of the system architecture for realizing abnormal business subjects provided in the embodiment of the present application, the system may include a terminal 100 and a server 200, the terminal 100 and the server 200 are connected via a network, an application client (referred to as application) is installed in the terminal, an abnormal business subject identification device is integrated in the server 200, and the terminal 100 can access the server 200. In the embodiment of the present invention, the server 200 is mainly used to obtain the transaction data generated by the business subject and / or transaction object fed back by the terminal through the application client, obtain multiple clusters, determine the first abnormality rate of each cluster, and take the cluster whose first abnormality rate is greater than the first preset threshold as the target cluster; determine the data features of the transaction data of each first business subject and each second business subject; determine the second abnormality rate of the first business subject according to the similarity between the data features of the first business subject and each second business subject; for each first business subject, obtain the third abnormality rate of the first business subject; take the first business subject whose third abnormality rate is greater than the second preset threshold as the abnormal business subject.

[0085] In the embodiment of the present invention, the server 200 may be an independent server, or a server network or server cluster composed of servers. For example, the server 200 described in the embodiment of the present invention includes but is not limited to a computer, a network host, a single network server, a plurality of network server sets or a cloud server composed of a plurality of servers. Among them, the cloud server is composed of a large number of computers or network servers based on cloud computing (Cloud Computing). In the embodiment of the present invention, communication between the server and the terminal can be achieved through any communication method, including but not limited to mobile communication based on the 3rd Generation Partnership Project (3GPP), Long Term Evolution (LTE), Worldwide Interoperability for Microwave Access (WiMAX), or computer network communication based on TCP / IP Protocol Suite (TCP / IP), User Datagram Protocol (UDP) protocol, etc.

[0086] It can be understood that the terminal 100 used in the embodiment of the present invention can be understood as a client device, and the terminal 100 includes both receiving and transmitting hardware, that is, a device with receiving and transmitting hardware capable of performing two-way communication on a two-way communication link. Such a terminal may include: a cellular or other communication device having a single-line display or a multi-line display or a cellular or other communication device without a multi-line display. The specific terminal 100 can be a desktop terminal or a mobile terminal. The terminal 100 can be one of a mobile phone, a tablet computer, a laptop computer, etc., and at least one application that can access the network is pre-installed in the terminal 100, such as a communication application (such as WeChat or QQ).

[0087] Those skilled in the art will understand that Figure 1a The application environment shown in the figure is only one application scenario of the present application solution and does not constitute a limitation on the application scenario of the present application solution. Other application environments may also include Figure 1a More or fewer servers, or server network connections, as shown in Figure 1a Only one server and two terminals are shown. It can be understood that the data anomaly identification system may also include one or more other servers, and / or one or more terminals connected to the server network, which is not specifically limited here.

[0088] Figure 1b The overall process framework diagram of the method for identifying abnormal business entities provided in the embodiment of the present application is shown in the figure. The method includes obtaining transaction data of multiple business entities. On the one hand, based on the degree of correlation between the transaction data of the business entities, multiple clusters are obtained, and based on the proportion of identified abnormal business entities in each cluster, the first abnormality rate of each cluster is used, and the target cluster whose first abnormality rate is greater than the first preset threshold is screened out. On the other hand, based on various types of unstructured information in the transaction data, the features of various types of unstructured information of the target cluster are extracted as data features of the transaction data, and based on the similarity of the data features of the first business entity in the target cluster and the identified abnormal business subject, the second abnormality rate of the first business entity is obtained, and the third abnormality rate is obtained according to the first abnormality rate and the second abnormality rate of the first business entity (of the cluster in which it is located), and the business abnormality subject of the information is determined from the first business entity based on the third abnormality rate.

[0089] The present application provides a method for identifying abnormal business entities. Figure 2 As shown, the method includes:

[0090] S101. Determine transaction data of multiple business entities.

[0091] The business subject of the embodiment of the present application can be a merchant, in particular a merchant in which cross-border transactions occur. Multiple business subjects include both abnormal business subjects identified historically and business subjects to be identified. In actual application, the embodiment of the present application can be executed periodically (e.g., daily, weekly, monthly, quarterly, etc.), taking a cycle as a natural day as an example, at a preset time of each day, such as 8 o'clock in the morning, it is possible to obtain a business subject from 8 o'clock in the morning of the previous day to 8 o'clock in the morning today that has been traded and has not been identified as an abnormal business subject as a business subject to be identified, and obtain the transaction data of the business subject to be identified.

[0092] In some embodiments, the transaction data includes the transaction object with which the business subject conducts transactions, the transaction amount of each transaction, and transaction notes, etc. It is understandable that the transaction data obtained in the embodiment of the present application is the data of transactions generated within a preset period.

[0093] In some embodiments, the application of the embodiments of the present application can display prompt information on the application before providing transaction services to the business entity. The prompt information is used to prompt the business entity whether it agrees to the background collection of the business entity's desensitized transaction data. If the business entity agrees to the background collection of the business entity's desensitized transaction data, then after the business entity subsequently uses the application to conduct transactions, the desensitized transaction data will be used to identify abnormal business entities.

[0094] S102. Clustering the multiple business entities according to the correlation degree between the transaction data of the multiple business entities to obtain multiple clusters, determining a first abnormality rate of each cluster, and taking the cluster whose first abnormality rate is greater than a first preset threshold as a target cluster.

[0095] After obtaining the transaction data of multiple business entities, the embodiment of the present application further clusters the business entities based on the degree of association between the business entities to obtain multiple clusters. The association in the embodiment of the present application refers to the existence of some common attributes between the transaction data of the business entities, such as having a common transaction object.

[0096] In some embodiments, transaction data may include an object identifier of a transaction object, so that business entities with the same transaction object can be associated, and the associated business entities are further clustered based on the transaction data. It is understandable that each cluster includes multiple business entities with similar transaction data, and the proportion of abnormal business entities in each cluster is counted as the first abnormality rate of each cluster. It should be understood that the higher the proportion of abnormal business entities in a cluster, the higher the probability that the business entity to be identified in the cluster is also an abnormal business entity. The embodiment of the present application uses a cluster with a first abnormality rate greater than a first preset threshold as a target cluster, and the target cluster will be further processed later.

[0097] S103: Determine data characteristics of transaction data of each first business entity and each second business entity.

[0098] The first business subject in the embodiment of the present application refers to a business subject to be identified in the target cluster.

[0099] The second business subject in the embodiment of the present application at least includes the abnormal business subject in the corresponding target cluster. Since the number of target clusters is often more than one, the first business subjects in different target clusters have different corresponding second business subjects.

[0100] In some embodiments, the second business subject may also be all abnormal business subjects. Subsequently, by comparing the data features of each first business subject with the data features of all abnormal business subjects, the accuracy of identifying the first business subject may be effectively improved.

[0101] S104. For each first business subject, determine the similarity between the data features of the first business subject and each second business subject, and determine the second abnormality rate of the first business subject according to the similarity between the data features of the first business subject and each second business subject.

[0102] In the embodiment of the present application, for each first business entity, it is necessary to determine the data features of the transaction data between it and each second business entity. In the embodiment of the present application, a feature extraction model can be pre-trained, and the data features output by the feature extraction model can be obtained by inputting the transaction data of the business entity into the feature extraction model.

[0103] In some embodiments, transaction data may include transaction notes provided by a business object when conducting transactions with a business object, so that the data feature of the transaction data may be a word vector of the transaction notes. That is, the embodiment of the present application may pre-train a word vector model, and by inputting the text information of the transaction notes into the word vector model, obtain the word vector of each word segment in the text information, and then use it as the data feature of the transaction data. Since the number of transaction notes of a business entity may be large, the transaction notes may be sorted according to the frequency of occurrence, and a certain number of transaction notes may be selected in descending order of frequency to determine the data feature. In addition, the transaction notes may be segmented first, sorted according to the frequency of occurrence of the word segments, and a certain number of word segments may be selected in descending order of frequency to determine the data feature.

[0104] The present application does not impose any specific limitation on the method for calculating the similarity between data features, for example, it may be cosine similarity, Euclidean distance, Jaccd similarity coefficient, etc.

[0105] After determining the similarity between the data features of a first business subject and each second business subject, the embodiment of the present application can further determine the second abnormality rate of the first business subject, the second abnormality rate is determined based on the similarity between the data features of the first business subject and each second business subject, and the second abnormality rate reflects the degree of similarity between the first business subject and the identified abnormal business subject. In some embodiments, the second abnormality rate of a first business subject can be the highest similarity among the similarities between the data features of the first business subject and each second business subject. For example, there are 4 second business subjects, and the similarities between the data features of a first business subject and the 4 second business subjects are 60%, 65%, 70% and 80% respectively, then 80% can be used as the second abnormality rate of the first business subject.

[0106] S105 . For each first business subject, obtain a third abnormality rate of the first business subject according to a first abnormality rate of a target node cluster where the first business subject is located and a second abnormality rate of the first business subject.

[0107] It should be noted that the first anomaly rate of the node cluster reflects the similarity between each business subject in the node cluster and the identified abnormal business subjects in terms of association, while the second anomaly rate of a business subject reflects the similarity with the identified abnormal business subjects in terms of data characteristics. Therefore, the third anomaly rate obtained by combining the two anomaly rates can comprehensively reflect the probability that a first business subject is an abnormal business subject.

[0108] S106. The first business entity whose third abnormality rate is greater than the second preset threshold is regarded as an abnormal business entity.

[0109] The embodiment of the present application obtains transaction data of abnormal business subjects and business subjects to be identified, first clusters multiple business subjects using the correlation between the transaction data of the business subjects to obtain multiple clustering clusters, each clustering cluster includes multiple business subjects with strong correlation, and then obtains a first abnormality rate of the clustering cluster based on the proportion of abnormal business subjects in the clustering cluster, and obtains a first probability that each business subject to be identified belongs to an abnormal business subject from the perspective of the degree of transaction correlation, and further selects a target clustering cluster based on a first preset threshold, and obtains data features of the first business subject and the second business subject by deriving features from the transaction data of the business subjects, so that the dimensions are richer and the first business subject and the second business subject are determined. The similarity between the data features of each second business subject is determined according to the similarity between the data features of the first business subject and each second business subject. The second abnormality can characterize the similarity between the first business subject and the abnormal business subject. The first abnormality rate of the target node cluster where the first business subject is located and the second abnormality rate of the first business subject are combined to obtain the third abnormality rate of the first business subject. A new abnormal business subject is determined based on the third abnormality rate. Since this solution comprehensively considers the degree of correlation and data features, does not rely on a large amount of labeled data, and can directly output abnormal business subjects, it has been verified that in practical applications it can also be found that the coverage rate of identifying abnormal business subjects can be greatly improved.

[0110] Based on the above embodiments, as an optional embodiment, multiple business entities are clustered according to the degree of association between transaction data of multiple business entities to obtain multiple clusters, including:

[0111] S201, determining multiple business subject pairs according to transaction data of multiple business subjects;

[0112] S202, obtaining a connectivity graph according to multiple business entities;

[0113] S203: Determine the clusters in the connected graph through a community discovery algorithm.

[0114] Each business subject pair in the embodiment of the present application includes two business subjects whose association degree is greater than the third preset threshold. As can be seen from the above embodiment, the association in the present application refers to the existence of some common attributes in the transaction data of the business subject, for example, having the same transaction object, that is, the same transaction object, has transactions on both business subjects.

[0115] The initial transaction information pre-collected in the embodiment of the present application, that is, the information of each transaction, includes the object identifier and transaction amount of the transaction object that conducts transactions with the business entity. Transaction data can be obtained by aggregating based on the dimension of the transaction object.

[0116] See also Figure 3, which exemplarily shows a flow chart of obtaining a business subject pair in an embodiment of the present application. As shown in the figure, first, information on each transaction of each transaction object within a certain period of time is collected, and the information includes the object identifier and transaction amount of the transaction object. Then, the transaction of each business subject is aggregated according to the dimension of the transaction object, and the transaction frequency (each transaction corresponds to a transaction frequency) and transaction amount of each transaction object and each business subject are counted. Then, each object identifier is traversed to see how many transaction objects it has traded with. If two business subjects have common transaction objects, and the number of common transaction objects is greater than the fourth preset threshold (1 in the figure), it is considered that the two business subjects are associated and can constitute a candidate business subject pair.

[0117] After analysis, it is found that there are a large number of candidate business entity pairs that have only weak correlations. Therefore, the embodiment of the present application further screens the candidate business entity pairs and retains the candidate business entity pairs with strong correlations, that is, business entity pairs. Specifically, the embodiment of the present application determines the correlation between the two business entities in the candidate business entity pair based on the transaction frequency and transaction amount corresponding to each of the two business entities in the candidate business entity pair.

[0118] The calculation formula of the association degree in the embodiment of the present application can be expressed as:

[0119]

[0120] Among them, Q represents the degree of association, W1 and W2 represent the weighted scores of transaction frequency and transaction amount, and C cnt Indicates the number of common transaction objects of business subject A and business subject B in a candidate business subject pair. cnt Indicates the total number of transaction objects of business subject A, B cnt Indicates the total number of transaction objects of business subject B, C amt Indicates the transaction amount of the common transaction object of business subject A and business subject B. amt represents the total transaction amount of business subject A (that is, the transaction amount of all transaction objects of business subject A), B amt Indicates the total transaction amount of business subject B (ie, the transaction amount of all transaction objects of business subject B). After determining the corresponding association degrees of all candidate business subjects, a business subject pair is determined from the candidate business subject pairs based on a third preset threshold.

[0121] After obtaining the business subject pair, you can use the business subjects in the business subject pair as nodes of the connectivity graph, and connect two nodes belonging to the same business subject pair to obtain the connectivity graph. Figure 4, which exemplarily shows a schematic diagram of the connectivity graph obtained in the present application. According to the definition of the connectivity graph, nodes C1 and C2 are a business subject pair, C2 and C3 are a business subject pair, C3 and C4 are a business subject pair, C5 and C6 are a business subject pair, and C5 and C7 are also a business subject pair, C7 and C8 are a business subject pair, C8 and C9 are a business subject pair, and C10 and C10 are a business subject pair.

[0122] This application uses a community discovery algorithm to determine the clusters in the connectivity graph. Specifically, the Fast Unfolding algorithm can be used. The core of the Fast Unfolding algorithm includes two parts: 1) Modularity Optimization, 2) Graph Folding. By alternately performing these two operations, the modularity of the entire network is finally optimized.

[0123] The detailed process of the algorithm is as follows, including steps 1 to 5, where steps 2-3 are Modularity Optimization and step 4 is Graph Folding:

[0124] 1) Initialization: Each node in the connected graph is considered as a separate community, that is, the number of communities is the same as the number of nodes;

[0125] 2) Node transfer: For each node, try to divide the node into the community where its neighboring nodes are located in turn, and calculate the modularity change ΔQ before and after the division. If ΔQ is less than 0, the original community remains unchanged (because the modularity information here is only related to the neighboring nodes, it is local information, which is conducive to distributed computing);

[0126] 3) Visit all nodes: Repeat step 2, continue to transfer and evaluate nodes between communities, and visit all nodes. If no update occurs during the whole process, it can be considered that the optimal community division under greedy is achieved. If it has not yet reached the optimal state, continue to step 4;

[0127] 4) Reconstruct the graph: reconstruct all nodes belonging to the same community into a new node, rebuild the graph, and execute according to step 1;

[0128] 5) Complete multiple rounds of node transfer: Repeat steps 1-4 until the modularity of the entire graph no longer changes or reaches the preset number of iterations.

[0129] It should be understood that unstructured features refer to feature information such as unstructured text and images of a business entity. The unstructured text in the transaction data of the embodiment of the present application may come from the description information of the transaction, for example:

[0130] Remarks information refers to the remarks information on the transaction order;

[0131] Complaint information refers to the complaint information of the transaction party regarding the transaction;

[0132] Business information refers to the information on the business scope of a business entity during the entry and transaction stages.

[0133] For these unstructured texts, on the one hand, each merchant can have more data associated with it. For example, a merchant can have multiple transactions, so there can be multiple descriptive information, so it is necessary to screen the multiple descriptive information. On the other hand, some texts cannot be used directly and need to be processed into quantifiable data.

[0134] Based on the above embodiments, as an optional embodiment, the transaction data of each business subject in the embodiment of the present application includes at least one description information of the transaction.

[0135] Accordingly, the data features of the transaction data of any one of the first business entities and the second business entities include sub-features of all types of descriptive information of the corresponding business entity.

[0136] Taking the description information including remarks information, complaint information and business scope information as an example, the data characteristics of a business subject in an embodiment of the present application include sub-characteristics of the remarks information, sub-characteristics of the complaint information and sub-characteristics of the business scope information of the business subject.

[0137] It should be understood that the sub-features of any type of descriptive information are determined based on at least one descriptive information of that type of the corresponding business entity. For example, the sub-features of the remark information of a business entity can be obtained after feature extraction based on the remark information of all transactions of the business entity within six months.

[0138] It should be understood that when there is only one type of description information of a business entity, the sub-features of the description information of this type can be used as data features of the transaction data of the business entity.

[0139] Based on the above embodiments, as an optional embodiment, respectively determining data features of transaction data of each first business subject and each second business subject includes:

[0140] For any one of the first business subject and the second business subject, the sub-features of each description information of the business subject are obtained in the following manner:

[0141] The frequencies of the description information of the corresponding categories of the business subjects are counted, and a preset number of reference description information is obtained from all the description information of the corresponding categories of the business subjects in descending order of frequency, and text features of the preset number of reference description information are extracted, and the text features are used as sub-features of the description information of the corresponding categories of the business subjects.

[0142] That is to say, the method for determining data features for the first business entity and the second business entity in the embodiment of the present application is the same, and the method for determining each sub-feature is also the same, which is to count the frequency of the descriptive information of the business entity, and then select a preset number of descriptive information in descending order of frequency as reference descriptive information, and extract the text features of the reference descriptive information to obtain the sub-features of the corresponding type of descriptive information of the business entity.

[0143] The purpose of this application is to better understand the distribution of the description information by filtering out reference description information based on frequency, and to determine the frequently occurring description information, thereby obtaining the most frequently occurring description information, so as to more accurately determine the business that the business entity is engaged in.

[0144] It should be understood that the remark information and complaint information are usually dynamically changing, that is, different transactions and different transaction objects often result in different remark information and complaint information, while the business scope information is usually fixed. Therefore, when counting the frequency, there is usually only one piece of business scope information, and the corresponding reference description information is often also only one.

[0145] Based on the above embodiments, as an optional embodiment, extracting a preset number of text features of reference description information includes:

[0146] Segment all sentences in a preset number of reference description information, and obtain a word vector for each segmented word based on a pre-trained word vector model;

[0147] According to the word vectors of all the segmented words, a vector representation of a preset number of reference description information is obtained;

[0148] According to the word vectors of all the segmented words, the vector representations of a preset number of reference description information are regularized to obtain sub-features of the corresponding types of description information of the business subject.

[0149] The embodiment of the present application considers that the semantic representation (vector representation) of the description information of the corresponding type is the mean of the semantic representations of all the word segments contained therein. Therefore, each sentence in the reference description information can be segmented, and then an embedding query can be performed on each word segment to determine the word vector of each word segment. The word vectors of all word segments of a sentence are summed, that is, the semantic representation of the description information of the corresponding type. In some embodiments, the semantic representation of the description information of a type can be calculated according to the following formula:

[0150]

[0151] Among them, V i represents the semantic representation of the i-th description information of the business subject, m represents the total number of segmentations in all reference description information of the i-th description information of the business subject, V_w ij Represents the word vector of the j-th word in all reference description information of the i-th description information of the business entity.

[0152] After obtaining the vector representation of the preset number of reference description information, the vector representation of the preset number of reference description information is further regularized according to the word vectors of all word segments. Specifically, the sub-features of the corresponding types of description information of the business subject can be obtained according to the following formula:

[0153]

[0154] Among them, V′ i A sub-feature representing the i-th type of descriptive information of a business entity.

[0155] See also Figure 5 , which exemplarily shows a flow chart of determining the similarity between sub-features of a description information of a first business subject and a second business subject in an embodiment of the present application. As shown in the figure, the embodiment of the present application first obtains a description information list of a description information of each of the two business subjects (the first business subject and the second business subject), each list includes description information of transactions generated within a certain period of time (for example, half a year), denoises information such as transaction order number, noun of the business subject, etc. in the description information, and then deduplicates the text, and finally selects the first 10 description information in order of frequency of occurrence from large to small, and then splices the 10 description information of each business subject to obtain a spliced ​​text.

[0156] The text features of the concatenated text are further extracted and the concatenated text is vectorized. The semantic representation of the text is the mean of the word vectors of the word segments it contains. The specific method is to segment the sentence and perform an embedding query on each word. The embedding of the concatenated text is the sum of the embeddings of all the word segments in the text.

[0157] After obtaining the sub-features of the same set of description information of the first business subject and the second business subject, similarity calculation can be performed. In the embodiment of the present application, the calculation formula of cosine similarity can be adopted, which is specifically:

[0158]

[0159] Among them, W ij V represents the similarity of the sub-features of the same set of description information of the first business subject i and the second business subject j, i The sub-feature representing the corresponding description information of the first business subject i, V j A sub-feature representing the corresponding description information of the second business subject j.

[0160] Based on the above embodiments, as an optional embodiment, the similarity between the data features of a first business subject and a second business subject includes: the similarity between sub-features of all types of description information of the first business subject and the second business subject.

[0161] That is, the similarity between the data features of a first business subject and a second business subject is a multi-dimensional value, which includes the similarity between the sub-features of all types of descriptive information of the first business subject and a second business subject.

[0162] Determining the second abnormality rate of the first business subject according to the similarity between the data features of the first business subject and each of the second business subjects includes:

[0163] For each type of description information, the maximum similarity between the sub-features of the description information of the first business subject and the corresponding type of the second business subjects is used as the sub-abnormality rate of the description information of the corresponding type of the first business subject;

[0164] The second abnormality rate of the first business subject includes sub-abnormality rates of all types of descriptive information of the first business subject.

[0165] Through the above embodiment, the maximum similarity between the sub-features of all types of description information of the first business subject and each second business subject is obtained. For each type of description information, the maximum similarity between the sub-features of the corresponding type of description information of the first business subject and each second business subject is used as the sub-abnormality rate of the corresponding type of description information of the first business subject. The corresponding calculation formula can be expressed as:

[0166] T Bi =max(W ij ) j∈A

[0167] Among them, T Birepresents the sub-anomaly rate of the B-th type of description information of the first business subject i, A represents the set of second business subjects, W ij Indicates the similarity between the sub-features of the B-th category description information of the first business entity i and the second business entity j.

[0168] Based on the above embodiments, as an optional embodiment, obtaining a third abnormality rate of the first business subject according to the first abnormality rate of the target node cluster where the first business subject is located and the second abnormality rate of the first business subject includes:

[0169] Determine a weight corresponding to the first abnormality rate and a weight corresponding to each type of descriptive information;

[0170] The first abnormality rate and the sub-abnormality rates of all types of descriptive information of the first business subject are weightedly summed with corresponding weights to obtain a third abnormality rate of the first business subject.

[0171] The corresponding calculation formula can be expressed as:

[0172]

[0173] Among them, S score represents the third abnormality rate of the first business entity, W1 represents the weight corresponding to the first abnormality rate R, and W B represents the weight corresponding to the Bth type of description information, and M represents the total number of description information.

[0174] See also Figure 6 , which exemplarily shows a flow chart of a method for identifying an abnormal business subject in an embodiment of the present application, as shown in the figure, including:

[0175] S301, determining transaction data of multiple business entities, where the multiple business entities include abnormal business entities and business entities to be identified;

[0176] S302: obtaining a plurality of candidate business subject pairs according to the transaction data of each business subject, wherein the number of identical transaction objects between two business subjects in each candidate business subject pair is greater than a fourth preset threshold;

[0177] S303. For each candidate business entity pair, determine the degree of association between the two business entities in the candidate business entity pair according to the transaction frequencies and transaction amounts corresponding to the two business entities in the candidate business entity pair;

[0178] S304, determining a plurality of business subject pairs according to the correlation degrees corresponding to the candidate business subject pairs;

[0179] S305, obtaining a connectivity graph according to the plurality of business subject pairs, wherein each node in the connectivity graph represents a business subject in a business subject pair, and a line is connected between two nodes corresponding to each business subject pair;

[0180] S306, determining clusters in the connectivity graph by using a community discovery algorithm;

[0181] S307, determining a first abnormality rate of each cluster, and taking a cluster whose first abnormality rate is greater than a first preset threshold as a target cluster;

[0182] S308, counting the frequency of the corresponding type of description information of the corresponding business subject, obtaining a preset number of reference description information from all the corresponding type of description information of the corresponding business subject in descending order of frequency, extracting text features of the preset number of reference description information, and using the text features as sub-features of the corresponding type of description information of the corresponding business subject;

[0183] S309: for each type of description information, the maximum similarity between the sub-features of the description information of the first business subject and the corresponding type of the second business subject is used as the sub-abnormality rate of the description information of the corresponding type of the first business subject;

[0184] S310, performing weighted summation on the first abnormality rate and sub-abnormality rates of all types of descriptive information of the first business subject with corresponding weights to obtain a third abnormality rate of the first business subject;

[0185] S311. The first business entity whose third abnormality rate is greater than the second preset threshold is regarded as an abnormal business entity.

[0186] See also Figure 7, which exemplarily shows a scenario diagram of an embodiment of the present application. As shown in the figure, it includes a first terminal 701, a second terminal 702, a transaction server 703 and a security server 704, wherein the first terminal 701 is a terminal used by a patient, and the second terminal 702 is a terminal for payment deployed by a new business entity (a hospital). When the patient needs to pay after seeing a doctor, the payment is made to the second terminal 702 through the payment program running on the first terminal 701. The transaction data generated after the payment is stored in the transaction server 703. The transaction server 703 is a background server corresponding to the payment program. The transaction server 703 sends the transaction data of the business entity to the security server 704. It is understandable that the transaction server 703 will also count the transaction data of the patient paying through the first terminal to the terminals deployed by other business entities, as well as the transaction data of other users paying through the payment programs running on their own terminals. The security server 704 determines whether the new business entity is an abnormal business entity based on the transaction data of each business entity received and the method provided in the embodiment of the present application. If it is determined to be an abnormal business entity, an alarm message will be sent to the transaction server 703, instructing the transaction server 703 to suspend the payment function of the second terminal 702, so that the second terminal 702 can no longer receive payments from the payment program, effectively avoiding the operation of risky businesses.

[0187] It should be noted that Figure 7 The scenario diagram of the abnormal business subject identification system shown is merely an example. The abnormal business subject identification system and scenario described in the embodiment of the present invention are intended to more clearly illustrate the technical solution of the embodiment of the present invention, and do not constitute a limitation on the technical solution provided by the embodiment of the present invention. Ordinary technicians in this field can know that with the evolution of the abnormal business subject identification system and the emergence of new business scenarios, the technical solution provided by the embodiment of the present invention is also applicable to similar technical problems.

[0188] The present application embodiment provides a device for identifying abnormal business entities, such as Figure 8 As shown, the abnormal business subject identification device may include: a transaction data determination module 101, a first abnormal rate determination module 102, a feature determination module 103, a second abnormal rate determination module 104 and an abnormality identification module 105, wherein:

[0189] The transaction data determination module 101 is used to determine the transaction data of multiple business entities, where the multiple business entities include abnormal business entities and business entities to be identified;

[0190] A first abnormality rate determination module 102 is used to cluster multiple business entities according to the degree of association between the transaction data of the multiple business entities, obtain multiple clusters, determine a first abnormality rate of each cluster, the first abnormality rate is the proportion of abnormal business entities in the cluster, and take the cluster whose first abnormality rate is greater than a first preset threshold as the target cluster;

[0191] The feature determination module 103 is used to determine the data features of the transaction data of each first business subject and each second business subject, the first business subject is the business subject to be identified in the target cluster, and the second business subject includes at least the abnormal business subject in the corresponding target cluster;

[0192] The second abnormality rate determination module 104 is used to determine, for each first business subject, the similarity between the data features of the first business subject and each second business subject, and determine the second abnormality rate of the first business subject according to the similarity between the data features of the first business subject and each second business subject;

[0193] The anomaly identification module 105 obtains, for each first business subject, a third anomaly rate of the first business subject according to the first anomaly rate of the target node cluster where the first business subject is located and the second anomaly rate of the first business subject, and regards the first business subject whose third anomaly rate is greater than the second preset threshold as an abnormal business subject.

[0194] The device of the embodiments of the present application can execute the method provided by the embodiments of the present application, and the implementation principles are similar. The actions performed by each module in the device of each embodiment of the present application correspond to the steps in the method of each embodiment of the present application. For the detailed functional description of each module of the device, please refer to the description in the corresponding method shown in the previous text, which will not be repeated here.

[0195] As an optional implementation manner, the first abnormality rate determination module is specifically used for:

[0196] Determining a plurality of business subject pairs according to the transaction data of the plurality of business subjects, each business subject pair including two business subjects whose correlation degree is greater than a third preset threshold;

[0197] A connection graph is obtained according to the plurality of business subject pairs, wherein each node in the connection graph represents a business subject in a business subject pair, and a line is connected between two nodes corresponding to each business subject pair;

[0198] The clusters in the connected graph are determined through the community discovery algorithm.

[0199] As an optional implementation, the transaction data of each business subject includes the object identifier of each transaction object that conducts transactions with the business subject, and the transaction frequency and transaction amount of each transaction object with the business subject;

[0200] The first abnormal rate determination module determines a plurality of business subject pairs according to the transaction data of the plurality of business subjects, including:

[0201] According to the transaction data of each business subject, a plurality of candidate business subject pairs are obtained, wherein the number of identical transaction objects between two business subjects in each candidate business subject pair is greater than a fourth preset threshold;

[0202] For each candidate business entity pair, determine the degree of association between the two business entities in the candidate business entity pair based on the transaction frequencies and transaction amounts corresponding to the two business entities in the candidate business entity pair;

[0203] A plurality of business entities are determined according to the corresponding correlation degrees of each pair of candidate business entities.

[0204] As an optional implementation, the transaction data of each business subject includes at least one description information of the transaction;

[0205] The data features of the transaction data of any one of the first business subjects and the second business subjects include sub-features of all types of descriptive information of the corresponding business subjects.

[0206] As an optional implementation manner, the feature determination module is specifically used to:

[0207] For any one of the first business subject and the second business subject, the sub-features of each description information of the corresponding business subject are obtained in the following manner:

[0208] The frequencies of the description information of the corresponding types of the corresponding business subjects are counted, and a preset number of reference description information is obtained from all the description information of the corresponding types of the corresponding business subjects in descending order of the frequencies, and text features of the preset number of reference description information are extracted, and the text features are used as sub-features of the description information of the corresponding types of the corresponding business subjects.

[0209] As an optional implementation manner, the feature determination module extracts a preset number of text features of the reference description information, including:

[0210] Segment all sentences in a preset number of reference description information, and obtain a word vector for each segmented word based on a pre-trained word vector model;

[0211] According to the word vectors of all the segmented words, a vector representation of a preset number of reference description information is obtained;

[0212] According to the word vectors of all the segmented words, the vector representations of a preset number of reference description information are regularized to obtain sub-features of the corresponding types of description information of the business subject.

[0213] As an optional implementation manner, the similarity between the data features of the first business subject and a second business subject includes: the similarity between sub-features of all types of description information of the first business subject and a second business subject;

[0214] The second abnormality rate determination module is specifically used for:

[0215] For each type of description information, the maximum similarity between the sub-features of the description information of the first business subject and the corresponding type of the second business subjects is used as the sub-abnormality rate of the description information of the corresponding type of the first business subject;

[0216] The second abnormality rate of the first business subject includes sub-abnormality rates of all types of descriptive information of the first business subject.

[0217] As an optional implementation, the abnormality identification module is specifically used for:

[0218] Determine a weight corresponding to the first abnormality rate and a weight corresponding to each type of descriptive information;

[0219] The first abnormality rate and the sub-abnormality rates of all types of descriptive information of the first business subject are weightedly summed with corresponding weights to obtain a third abnormality rate of the first business subject.

[0220] In an embodiment of the present application, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory, and the processor executes the above-mentioned computer program to implement the steps of the abnormal business subject identification method. Compared with the related art, it can achieve: by obtaining transaction data of an abnormal business subject and a business subject to be identified, first clustering multiple business subjects using the correlation between the transaction data of the business subjects to obtain multiple cluster clusters, each cluster cluster including multiple business subjects with strong correlation, and then based on the proportion of abnormal business subjects in the cluster cluster, obtaining a first abnormality rate of the cluster cluster, and obtaining a first probability that each business subject to be identified belongs to an abnormal business subject from the perspective of the degree of transaction correlation, and further based on a first preset threshold, screening out a target cluster cluster, and deriving features from the transaction data of the business subject. , obtain the data features of the first business subject and the second business subject, the dimensions are richer, determine the similarity between the data features of the first business subject and each second business subject, determine the second abnormality rate of the first business subject according to the similarity between the data features of the first business subject and each second business subject, the second abnormality can characterize the similarity between the first business subject and the abnormal business subject, and obtain the third abnormality rate of the first business subject by combining the first abnormality rate of the target node cluster where the first business subject is located and the second abnormality rate of the first business subject. Based on the third abnormality rate, a new abnormal business subject is determined. Since this solution comprehensively considers the degree of correlation and data features, does not rely on a large amount of labeled data, and can directly output abnormal business subjects, it has been verified that in practical applications, it has also been found that the coverage rate of identifying abnormal business subjects can be well improved.

[0221] In an alternative embodiment, an electronic device is provided, such as Fig. 9 As shown, Fig. 9 The electronic device 4000 shown includes: a processor 4001 and a memory 4003. The processor 4001 and the memory 4003 are connected, such as through a bus 4002. Optionally, the electronic device 4000 may also include a transceiver 4004, which may be used for data interaction between the electronic device and other electronic devices, such as data transmission and / or data reception. It should be noted that in actual applications, the transceiver 4004 is not limited to one, and the structure of the electronic device 4000 does not constitute a limitation on the embodiments of the present application.

[0222] Processor 4001 may be a CPU (Central Processing Unit), a general-purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. Processor 4001 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0223] The bus 4002 may include a path to transmit information between the above components. The bus 4002 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 4002 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Fig. 9 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0224] The memory 4003 may be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), magnetic disk storage media, other magnetic storage devices, or any other medium that can be used to carry or store computer programs and can be read by a computer, without limitation herein.

[0225] The memory 4003 is used to store the computer program for executing the embodiment of the present application, and the execution is controlled by the processor 4001. The processor 4001 is used to execute the computer program stored in the memory 4003 to implement the steps shown in the above method embodiment.

[0226] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps and corresponding contents of the aforementioned method embodiment can be implemented.

[0227] The embodiment of the present application also provides a computer program product, including a computer program, which can implement the steps and corresponding contents of the aforementioned method embodiment when executed by a processor.

[0228] The terms "first", "second", "third", "fourth", "1", "2", etc. (if any) in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than that shown or described in the drawings.

[0229] It should be understood that, although each operation step is indicated by arrows in the flowchart of the embodiment of the present application, the implementation order of these steps is not limited to the order indicated by the arrows. Unless clearly stated herein, in some implementation scenarios of the embodiment of the present application, the implementation steps in each flowchart can be performed in other orders according to demand. In addition, some or all of the steps in each flowchart may include multiple sub-steps or multiple stages based on actual implementation scenarios. Some or all of these sub-steps or stages may be executed at the same time, and each sub-step or stage in these sub-steps or stages may also be executed at different times respectively. In different scenarios of execution time, the execution order of these sub-steps or stages may be flexibly configured according to demand, and the embodiment of the present application does not limit this.

[0230] The above are only optional implementation methods for some implementation scenarios of the present application. It should be pointed out that for ordinary technicians in this technical field, without departing from the technical concept of the scheme of the present application, other similar implementation methods based on the technical ideas of the present application are also within the protection scope of the embodiments of the present application.

Claims

1. A method for identifying abnormal business entities, characterized in that: include: Determining transaction data of multiple business entities, wherein the multiple business entities include abnormal business entities and business entities to be identified; Clustering the multiple business entities according to the degree of association between the transaction data of the multiple business entities to obtain multiple clusters, determining a first abnormality rate of each cluster, where the first abnormality rate is the proportion of abnormal business entities in the cluster, and taking a cluster whose first abnormality rate is greater than a first preset threshold as a target cluster; Determine data features of transaction data of each first business subject and each second business subject, wherein the first business subject is a business subject to be identified in a target cluster, and the second business subject includes at least an abnormal business subject in the corresponding target cluster; For each first business subject, determine the similarity between the data features of the first business subject and each second business subject, and determine the second abnormality rate of the first business subject according to the similarity between the data features of the first business subject and each second business subject; For each first business subject, the third abnormality rate of the first business subject is obtained according to the first abnormality rate of the target node cluster where the first business subject is located and the second abnormality rate of the first business subject, and the first business subject whose third abnormality rate is greater than the second preset threshold is regarded as an abnormal business subject.

2. The method according to claim 1, characterized in that The step of clustering the multiple business entities according to the degree of association between the transaction data of the multiple business entities to obtain multiple clusters includes: Determining a plurality of business subject pairs according to the transaction data of the plurality of business subjects, each business subject pair including two business subjects whose correlation degree is greater than a third preset threshold; Obtaining a connectivity graph according to the plurality of business subject pairs, wherein each node in the connectivity graph represents a business subject in a business subject pair, and a line is connected between two nodes corresponding to each business subject pair; The clusters in the connectivity graph are determined by a community discovery algorithm.

3. The method according to claim 2, characterized in that The transaction data of each business subject includes the object identifier of each transaction object with which the business subject conducts transactions, and the transaction frequency and transaction amount of each transaction object with the business subject; The determining of a plurality of business subject pairs according to the transaction data of the plurality of business subjects comprises: According to the transaction data of each business subject, a plurality of candidate business subject pairs are obtained, wherein the number of identical transaction objects between two business subjects in each candidate business subject pair is greater than a fourth preset threshold; For each candidate business entity pair, determining the degree of association between the two business entities in the candidate business entity pair according to the transaction frequencies and transaction amounts corresponding to the two business entities in the candidate business entity pair; The plurality of business subject pairs are determined according to the correlation degrees corresponding to the candidate business subject pairs.

4. The method according to any one of claims 1 to 3, characterized in that: The transaction data of each business subject includes at least one kind of description information of the transaction; The data features of the transaction data of any one of the first business entities and the second business entities include sub-features of all types of descriptive information of the corresponding business entity.

5. The method according to claim 4, characterized in that The determining of data features of transaction data of each first business entity and each second business entity includes: For any one of the first business subject and the second business subject, the sub-features of each description information of the corresponding business subject are obtained in the following manner: The frequencies of the description information of the corresponding types of the corresponding business subjects are counted, and a preset number of reference description information is obtained from all the description information of the corresponding types of the corresponding business subjects in descending order of frequency, and text features of the preset number of reference description information are extracted, and the text features are used as sub-features of the description information of the corresponding types of the corresponding business subjects.

6. The method according to claim 5, characterized in that The extracting the text features of the preset number of reference description information includes: Segmenting all sentences in the preset number of reference description information, and obtaining a word vector for each segmented word based on a pre-trained word vector model; Obtaining vector representations of the preset number of reference description information according to the word vectors of all word segments; According to the word vectors of all the segmented words, the vector representations of the preset number of reference description information are regularized to obtain sub-features of the corresponding types of description information of the business entity.

7. The method according to claim 4, characterized in that The similarity between the data features of the first business subject and a second business subject includes: the similarity between sub-features of all types of descriptive information of the first business subject and a second business subject; The determining the second abnormality rate of the first business subject according to the similarity between the data features of the first business subject and each second business subject includes: For each type of description information, the maximum similarity between the sub-features of the description information of the first business subject and the corresponding type of the second business subject is used as the sub-abnormality rate of the description information of the corresponding type of the first business subject; The second abnormality rate of the first business subject includes sub-abnormality rates of all types of descriptive information of the first business subject.

8. The method according to claim 7, characterized in that The obtaining, according to the first abnormality rate of the target node cluster where the first business subject is located and the second abnormality rate of the first business subject, a third abnormality rate of the first business subject comprises: Determine a weight corresponding to the first abnormality rate and a weight corresponding to each type of description information; The first abnormality rate and the sub-abnormality rates of all types of descriptive information of the first business subject are weightedly summed with corresponding weights to obtain a third abnormality rate of the first business subject.

9. A device for identifying abnormal business entities, characterized in that: include: A transaction data determination module, used to determine transaction data of multiple business entities, wherein the multiple business entities include abnormal business entities and business entities to be identified; A first abnormality rate determination module is used to cluster the multiple business entities according to the degree of association between the transaction data of the multiple business entities, obtain multiple clusters, determine a first abnormality rate of each cluster, the first abnormality rate is the proportion of abnormal business entities in the cluster, and take the cluster whose first abnormality rate is greater than a first preset threshold as the target cluster; A feature determination module, used to determine data features of transaction data of each first business subject and each second business subject, wherein the first business subject is a business subject to be identified in a target cluster, and the second business subject includes at least an abnormal business subject in the corresponding target cluster; A second abnormality rate determination module is used to determine, for each first business subject, the similarity between the data features of the first business subject and each second business subject, and determine the second abnormality rate of the first business subject according to the similarity between the data features of the first business subject and each second business subject; The anomaly identification module obtains, for each first business entity, the third anomaly rate of the first business entity based on the first anomaly rate of the target node cluster where the first business entity is located and the second anomaly rate of the first business entity, and regards the first business entity whose third anomaly rate is greater than the second preset threshold as an abnormal business entity.

10. An electronic device comprising a memory, a processor and a computer program stored in the memory, characterized in that: The processor executes the computer program to implement the steps of the method for identifying abnormal business entities according to any one of claims 1-8.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for identifying an abnormal business subject as described in any one of claims 1 to 8 is implemented.

Images