Transaction behavior risk detection method and device and nonvolatile storage medium

Abstract

The invention discloses a transaction behavior risk detection method and device and a nonvolatile storage medium. The method comprises the steps that historical transaction behavior data based on a target account are acquired, and the historical transaction behavior data are used for describing features of transaction behaviors based on the target account; performing risk detection on the current transaction behavior data of the target account according to the historical transaction behavior data based on a plurality of preset risk detection strategies in sequence to obtain a plurality of risk detection results, the plurality of risk detection strategies running resources being different; under the condition that the risk detection result with the normal transaction state appears for the first time, determining that the final risk detection result of the current transaction behavior data is the normal transaction state; or, under the condition that the plurality of risk detection results are all transaction state abnormity, determining that the final risk detection result of the current transaction behavior data is transaction state abnormity. According to the invention, the technical problem of low efficiency of risk detection of transaction behaviors is solved.

Description

Technical Field

[0001] The present invention relates to the field of computer software applications, and in particular to a transaction behavior risk detection method, device, and non-volatile storage medium. Background Art

[0002] When performing risk detection on transaction behaviors, existing technologies often use flat or single-level models to analyze all transaction data to the same extent, ignoring the fact that most transactions are normal. However, during the transaction process, the proportion of abnormal or fraudulent behavior is usually low, perhaps only around 1%. The system must screen all transactions, which is not only inefficient, but may also cause unnecessary disturbances to normal users due to frequent requests for additional verification information, reduce user experience, and lead to a waste of computing resources.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present invention provide a transaction behavior risk detection method, device, and non-volatile storage medium to at least solve the technical problem of low efficiency in risk detection of transaction behaviors.

[0005] According to one aspect of an embodiment of the present invention, a transaction behavior risk detection method is provided, comprising: obtaining historical transaction behavior data based on a target account, wherein the historical transaction behavior data is used to describe the characteristics of the transaction behavior based on the target account; sequentially based on a plurality of pre-set risk detection strategies, performing risk detection on current transaction behavior data of the target account according to the historical transaction behavior data to obtain a plurality of risk detection results, wherein the resources required for the operation of the plurality of risk detection strategies are different; in the case where a risk detection result indicating a normal transaction status appears for the first time, determining that a final risk detection result of the current transaction behavior data is a normal transaction status; or, in the case where a plurality of risk detection results indicate that the transaction status is abnormal, determining that a final risk detection result of the current transaction behavior data is an abnormal transaction status.

[0006] Optionally, based on multiple pre-set risk detection strategies, risk detection is performed on the current transaction behavior data of the target account according to the historical transaction behavior data to obtain multiple risk detection results, including: sorting the multiple risk detection strategies in order of increasing required resources to obtain a risk detection order; according to the risk detection order, sequentially adopting multiple risk detection strategies to perform risk detection on the current transaction behavior data of the target account according to the historical transaction behavior data to obtain multiple risk detection results.

[0007] Optionally, in accordance with the risk detection order, based on multiple pre-set risk detection strategies, risk detection is performed on the current transaction behavior data of the target account according to the historical transaction behavior data to obtain multiple risk detection results, including: in accordance with the risk detection order, based on the first risk detection strategy, matching the Internet device corresponding to the current transaction behavior data with the Internet device corresponding to the historical transaction behavior data; when the Internet device corresponding to the current transaction behavior data of the target account matches the Internet device corresponding to the historical transaction behavior data, directly determining that the final risk detection result of the current transaction behavior data is a normal transaction status; when the Internet device corresponding to the current transaction behavior data does not match the Internet device corresponding to the historical transaction behavior data, obtaining a first risk detection result of an abnormal transaction status, and continuing to use other strategies among the multiple risk detection strategies except the first risk detection strategy to perform risk detection on the current transaction behavior data.

[0008] Optionally, when the Internet device corresponding to the current transaction behavior data does not match the Internet device corresponding to the historical transaction behavior data, a first risk detection result of abnormal transaction status is obtained, and other strategies among the multiple risk detection strategies except the first risk detection strategy are continued to be used to perform risk detection on the current transaction behavior data, including: in accordance with the risk detection order, based on the second risk detection strategy, matching at least one of the following features in the current transaction behavior data: transaction amount, transaction time, transaction location and login frequency; when the selected feature matches a predetermined threshold, directly determining that the final risk detection result of the current transaction behavior data is a normal transaction status; when the selected feature does not match the predetermined threshold, a second risk detection result of abnormal transaction status is obtained, and other strategies among the multiple risk detection strategies except the first risk detection strategy and the second risk detection strategy are continued to be used to perform risk detection on the current transaction behavior data.

[0009] Optionally, when the selected feature does not match a predetermined threshold, a second risk detection result of an abnormal transaction status is obtained, and other strategies among the multiple risk detection strategies except the first risk detection strategy and the second risk detection strategy continue to be used to perform risk detection on the current transaction behavior data, including: building a risk assessment model based on historical transaction behavior data in accordance with the risk detection order, and inputting the current transaction behavior data into the risk assessment model; obtaining a score value of the current transaction behavior data according to the risk assessment model; when the score value of the current transaction behavior data is less than a predetermined score threshold, determining that the final risk detection result of the current transaction behavior data is a normal transaction status; when the score value of the current transaction behavior data is greater than or equal to the predetermined score threshold, determining that the final risk detection result of the current transaction behavior data is an abnormal transaction status.

[0010] Optionally, the method further includes: recording the final risk detection result of the current transaction behavior data in the historical transaction behavior data, and updating the historical transaction behavior data.

[0011] According to another aspect of an embodiment of the present invention, a transaction behavior risk detection device is provided, including: an acquisition module, used to acquire historical transaction behavior data based on a target account, wherein the historical transaction behavior data is used to describe the characteristics of the transaction behavior based on the target account; a risk detection module, used to perform risk detection on current transaction behavior data of the target account in accordance with the historical transaction behavior data based on a plurality of pre-set risk detection strategies in sequence, to obtain a plurality of risk detection results, wherein the resources required for the operation of the plurality of risk detection strategies are different; a determination module, used to determine, when a risk detection result indicating a normal transaction status appears for the first time, that a final risk detection result of the current transaction behavior data is a normal transaction status; or, when a plurality of risk detection results are all abnormal transaction statuses, determine that a final risk detection result of the current transaction behavior data is an abnormal transaction status.

[0012] According to another aspect of an embodiment of the present invention, a non-volatile storage medium is provided, wherein the non-volatile storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing any one of the transaction behavior risk detection methods.

[0013] According to another aspect of an embodiment of the present invention, there is provided an electronic device, comprising: one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement any one of the transaction behavior risk detection methods.

[0014] According to another aspect of an embodiment of the present invention, there is further provided a computer program product, including a computer program, which implements any one of the above-mentioned transaction behavior risk detection methods when executed by a processor.

[0015] In an embodiment of the present invention, historical transaction behavior data based on a target account is obtained, wherein the historical transaction behavior data is used to describe the characteristics of the transaction behavior based on the target account; based on a plurality of pre-set risk detection strategies, risk detection is performed on the current transaction behavior data of the target account according to the historical transaction behavior data to obtain a plurality of risk detection results, wherein the resources required for the operation of the plurality of risk detection strategies are different; when a risk detection result indicating a normal transaction status appears for the first time, the final risk detection result of the current transaction behavior data is determined to be a normal transaction status; or, when a plurality of risk detection results indicate an abnormal transaction status, the final risk detection result of the current transaction behavior data is determined to be an abnormal transaction status, thereby achieving the purpose of speeding up the risk detection speed as much as possible while ensuring the accuracy of risk detection, solving the technical problem of low efficiency in risk detection of transaction behaviors, and further achieving the technical effect of reducing the disturbance rate to normal transaction users and improving the efficiency and accuracy of risk detection of transaction behaviors. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0017] Figure 1 is a flow chart of a transaction behavior risk detection method provided according to an embodiment of the present invention;

[0018] Figure 2 is a schematic diagram of an optional transaction behavior hierarchical detection method provided according to an embodiment of the present invention;

[0019] Figure 3 is a schematic diagram of a transaction behavior risk detection device provided according to an embodiment of the present invention;

[0020] Figure 4 is a schematic diagram of an electronic device provided according to an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0022] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0023] According to an embodiment of the present invention, a method embodiment for detecting transaction behavior risks is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0024] Figure 1 is a flow chart of a transaction behavior risk detection method according to an embodiment of the present invention. Figure 1 As shown, the method comprises the following steps:

[0025] Step S102, obtaining historical transaction behavior data based on the target account, wherein the historical transaction behavior data is used to describe the characteristics of the transaction behavior based on the target account;

[0026] In this step, the target account can be an account created by the user on the platform, and the user can conduct transactions based on the account. Obtaining historical transaction behavior data based on the target account means retrieving all transaction record data related to the target account from the historical database of the payment system. These transaction record data include but are not limited to transaction time, transaction amount, transaction frequency, transaction location, transaction type (transfer, shopping, recharge, etc.), associated merchant information, payment method used, etc. These characteristics can reflect the transaction habits and characteristics of the target account.

[0027] Step S104, based on the pre-set multiple risk detection strategies, the current transaction behavior data of the target account is subjected to risk detection in turn according to the historical transaction behavior data, and multiple risk detection results are obtained, wherein the resources required for the operation of the multiple risk detection strategies are different;

[0028] In this step, the pre-set multiple risk detection strategies refer to a series of pre-set multiple risk detection strategies from simple to complex, from fast to deep, and the setting and execution of these strategies follow a certain order. When the system performs risk detection on the current transaction behavior, it will perform layered detection on the current transaction behavior of the target account based on these strategies and the previously collected historical transaction behavior data of the target account, and obtain multiple detection results.

[0029] In an optional embodiment, based on a plurality of pre-set risk detection strategies, risk detection is performed on the current transaction behavior data of the target account according to the historical transaction behavior data to obtain a plurality of risk detection results, including: sorting the plurality of risk detection strategies in order of increasing required resources to obtain a risk detection order; according to the risk detection order, sequentially adopting the plurality of risk detection strategies to perform risk detection on the current transaction behavior data of the target account according to the historical transaction behavior data to obtain a plurality of risk detection results.

[0030] Optionally, during the execution of risk control strategies, the system will sort them according to the amount of resources required for each strategy to run. Usually, strategies with less resource requirements (such as lightweight rule-based analysis) are ranked first, while strategies with higher resource requirements (such as deep learning model analysis, machine learning algorithms, etc.) are ranked later. This sorting ensures that the system uses the strategy with the least resources for risk detection first, and only when the current strategy cannot determine whether the transaction is safe will it start the strategy with greater resource consumption, thereby achieving optimal utilization of resources. According to the risk detection order determined above, the risk detection strategy is executed layer by layer, and each layer of the strategy will generate a risk detection result. The system will determine whether further detection is needed or whether the transaction is safe based on these results.

[0031] In an optional embodiment, in accordance with a risk detection order, based on a plurality of pre-set risk detection strategies, risk detection is performed on the current transaction behavior data of the target account according to the historical transaction behavior data to obtain a plurality of risk detection results, including: in accordance with the risk detection order, based on a first risk detection strategy, matching an Internet device corresponding to the current transaction behavior data with an Internet device corresponding to the historical transaction behavior data; when the Internet device corresponding to the current transaction behavior data of the target account matches the Internet device corresponding to the historical transaction behavior data, directly determining the final risk detection result of the current transaction behavior data as a normal transaction status; when the Internet device corresponding to the current transaction behavior data does not match the Internet device corresponding to the historical transaction behavior data, obtaining a first risk detection result of an abnormal transaction status, and continuing to use other strategies among the plurality of risk detection strategies except the first risk detection strategy to perform risk detection on the current transaction behavior data.

[0032] Optional, such as Figure 2 As shown in the figure, the system first executes the first risk detection strategy, that is, the edge computing of the T0 layer, which focuses on checking the credibility of Internet devices related to transactions. The Internet device information (such as device model, operating system, IP address, geographic location, etc.) used by the target account in the current transaction is compared with the device information recorded in the historical transaction behavior data of the account. If the system finds that the device used in the current transaction is consistent with the device information recorded in the historical data, this indicates that the device is credible. In this case, the system will immediately determine that the transaction status is normal, and no further risk detection is required, thereby quickly filtering out a large number of normal transactions, reducing disturbances to users and system resource consumption. If the device used in the current transaction does not match the device information in the historical data, this may be a risk signal, indicating that there is an abnormality in the transaction. In this case, the system will obtain a first risk detection result of an abnormal transaction status. Once the system determines that the transaction status is abnormal, it will not terminate the transaction immediately, but will continue to use a deeper risk detection strategy to further analyze the transaction behavior.

[0033] In an optional embodiment, when the Internet device corresponding to the current transaction behavior data does not match the Internet device corresponding to the historical transaction behavior data, a first risk detection result of abnormal transaction status is obtained, and other strategies among the multiple risk detection strategies except the first risk detection strategy are continued to be used to perform risk detection on the current transaction behavior data, including: in accordance with the risk detection order, based on the second risk detection strategy, matching at least one of the following features in the current transaction behavior data: transaction amount, transaction time, transaction location and login frequency; when the selected feature matches a predetermined threshold, directly determining that the final risk detection result of the current transaction behavior data is a normal transaction status; when the selected feature does not match the predetermined threshold, a second risk detection result of abnormal transaction status is obtained, and other strategies among the multiple risk detection strategies except the first risk detection strategy and the second risk detection strategy are continued to be used to perform risk detection on the current transaction behavior data.

[0034] Optional, such as Figure 2As shown in Figure 1, in the T1 layer, the system will execute the second risk detection strategy, which focuses on analyzing other key features of transaction behavior, such as transaction amount, transaction time, transaction location, and login frequency, which are important factors in assessing transaction risks. The system will check whether these features of the current transaction match the corresponding features in the historical transaction behavior data. For example, if historical transactions are usually conducted in the morning, and the current transaction occurs in the early morning, this may be an abnormal signal. If one or more features of the current transaction behavior match the features in the historical data and meet the normal behavior threshold preset by the system, then the system will consider the transaction to be normal, without further in-depth detection, and the transaction status will be marked as normal, quickly passing the risk detection process to reduce disturbance to users. If the features of the current transaction behavior do not match the features in the historical data, or are significantly different from the preset normal behavior threshold, then the system will obtain the second risk detection result of abnormal transaction status, indicating that there is a potential risk in the transaction, and the system will continue to use deeper risk detection strategies to conduct a more detailed and comprehensive risk assessment of the transaction behavior. These strategies may involve more complex models and data analysis to ensure accurate judgment of potential risks.

[0035] In an optional embodiment, when the selected feature does not match the predetermined threshold, a second risk detection result of abnormal transaction status is obtained, and other strategies among the multiple risk detection strategies except the first risk detection strategy and the second risk detection strategy continue to be used to perform risk detection on the current transaction behavior data, including: building a risk assessment model based on historical transaction behavior data in accordance with the risk detection order, and inputting the current transaction behavior data into the risk assessment model; obtaining a score value of the current transaction behavior data according to the risk assessment model; when the score value of the current transaction behavior data is less than the predetermined score threshold, determining that the final risk detection result of the current transaction behavior data is a normal transaction status; when the score value of the current transaction behavior data is greater than or equal to the predetermined score threshold, determining that the final risk detection result of the current transaction behavior data is an abnormal transaction status.

[0036] Optional, such as Figure 2As shown in the figure, once the quick identification strategy fails to confirm the safety of the transaction, the system will enter a deeper level of detection, namely the T2 deep identification layer, where more complex risk detection strategies and models will be used. At the T2 layer, the system will build a risk assessment model based on a large amount of historical transaction behavior data. This model may be a machine learning model, such as a decision tree, random forest, neural network, etc. It can learn the characteristics of normal and abnormal transactions from historical data and provide a score or risk assessment for the current transaction behavior. The detailed information of the current transaction behavior is input into the constructed risk assessment model, and the model will score according to the characteristics of the transaction behavior to quantify the transaction risk. After the model analysis, a score value will be assigned to the current transaction behavior data, which reflects the degree of abnormality of the transaction behavior. The lower the score, the more likely the transaction is to be considered normal; the higher the score, the more likely the transaction is to be judged as abnormal or risky. If the score calculated by the model is lower than the risk threshold preset by the system, it means that the risk level of the current transaction behavior is within an acceptable range. The system will eventually determine that the transaction status is normal, and the transaction can proceed smoothly, while reducing unnecessary disturbances to users. On the contrary, if the score value reaches or exceeds the preset score threshold, it indicates that the transaction behavior has a high risk. The system will ultimately determine that the transaction status is abnormal, and further measures may need to be taken, such as suspending transactions, adding verification processes, etc., to ensure the security of transactions.

[0037] Step S106, when the risk detection result of normal transaction status appears for the first time, determine that the final risk detection result of the current transaction behavior data is normal transaction status; or, when multiple risk detection results are abnormal transaction status, determine that the final risk detection result of the current transaction behavior data is abnormal transaction status.

[0038] In this step, if at any level of the risk detection process, the system finds that the current transaction behavior meets the standards or characteristics of normal transactions by comparing and analyzing the historical transaction behavior data and the current transaction behavior data, then the system will immediately stop the subsequent in-depth detection and determine the final risk detection result of the current transaction as a normal transaction status. On the contrary, if after all levels of risk detection, the detection results of each layer indicate that the current transaction behavior is abnormal or has potential risks, then the system will determine the final risk detection result of the current transaction as an abnormal transaction status. In this case, the system will take further risk control measures, such as suspending transactions, requiring users to provide additional verification, and conducting manual review, etc., to prevent potential risk events.

[0039] In an optional embodiment, the final risk detection result of the current transaction behavior data is recorded in the historical transaction behavior data, and the historical transaction behavior data is updated.

[0040] Optional, such as Figure 2As shown in the figure, when a transaction is found to have potential risks during the detection process of the T2 layer, the transaction data will be passed to the T3 layer for asynchronous analysis. The T3 layer uses its powerful computing power and analysis tools to conduct in-depth evaluations of various aspects of the transaction, including but not limited to the time, location, amount, information of the transaction device, user behavior patterns, etc., and combines these features with the final risk detection results and updates them to the user's historical transaction behavior data. This means that every transaction and its risk detection process and results will become one of the basic data for future analysis of the system, providing a richer and more accurate reference for subsequent transaction risk assessments.

[0041] Through the above, when the risk detection result of normal transaction status appears for the first time, the final risk detection result of the current transaction behavior data is determined to be normal transaction status; or when multiple risk detection results are abnormal transaction status, the final risk detection result of the current transaction behavior data is determined to be abnormal transaction status. Based on the multiple risk detection strategies set in advance, the current transaction behavior data of the target account is subjected to risk detection in accordance with the historical transaction behavior data to obtain multiple risk detection results, wherein the resources required for the operation of the multiple risk detection strategies are different; the historical transaction behavior data based on the target account is obtained, wherein the historical transaction behavior data is used to describe the characteristics of the transaction behavior based on the target account, which solves the technical problem of low efficiency in risk detection of transaction behavior, and achieves the purpose of speeding up the risk detection speed as much as possible while ensuring the accuracy of risk detection, and solves the technical problem of low efficiency in risk detection of transaction behavior, thereby achieving the technical effect of reducing the disturbance rate to normal transaction users and improving the efficiency and accuracy of risk detection of transaction behavior.

[0042] Based on the above embodiments and optional embodiments, the present invention proposes an optional implementation manner.

[0043] Step S1, obtaining historical transaction behavior data based on a target account, wherein the historical transaction behavior data is used to describe the characteristics of the transaction behavior based on the target account;

[0044] In this step, obtaining historical transaction behavior data based on the target account means retrieving all transaction record data related to the target account from the historical database of the payment system. These transaction record data include but are not limited to transaction time, transaction amount, transaction frequency, transaction location, transaction type (transfer, shopping, recharge, etc.), associated merchant information, payment method used, etc. These characteristics can reflect the transaction habits and characteristics of the target account.

[0045] Step S2, based on the pre-set multiple risk detection strategies, perform risk detection on the current transaction behavior data of the target account according to the historical transaction behavior data to obtain multiple risk detection results, including: sorting the multiple risk detection strategies in the order of increasing required resources to obtain a risk detection order; according to the risk detection order, sequentially adopting the multiple risk detection strategies to perform risk detection on the current transaction behavior data of the target account according to the historical transaction behavior data to obtain multiple risk detection results.

[0046] Optionally, during the execution of risk control strategies, the system will sort them according to the amount of resources required for each strategy to run. Usually, strategies with less resource requirements (such as lightweight rule-based analysis) are ranked first, while strategies with higher resource requirements (such as deep learning model analysis, machine learning algorithms, etc.) are ranked later. This sorting ensures that the system uses the strategy with the least resources for risk detection first, and only when the current strategy cannot determine whether the transaction is safe will it start the strategy with greater resource consumption, thereby achieving optimal utilization of resources. According to the risk detection order determined above, the risk detection strategy is executed layer by layer, and each layer of the strategy will generate a risk detection result. The system will determine whether further detection is needed or whether the transaction is safe based on these results.

[0047] Step S21, in accordance with the risk detection order, based on the pre-set multiple risk detection strategies, according to the historical transaction behavior data, the current transaction behavior data of the target account is subjected to risk detection to obtain multiple risk detection results, including: in accordance with the risk detection order, based on the first risk detection strategy, the Internet device corresponding to the current transaction behavior data is matched with the Internet device corresponding to the historical transaction behavior data; when the Internet device corresponding to the current transaction behavior data of the target account matches the Internet device corresponding to the historical transaction behavior data, directly determining that the final risk detection result of the current transaction behavior data is a normal transaction status; when the Internet device corresponding to the current transaction behavior data does not match the Internet device corresponding to the historical transaction behavior data, obtaining a first risk detection result of an abnormal transaction status, and continuing to use other strategies among the multiple risk detection strategies except the first risk detection strategy to perform risk detection on the current transaction behavior data.

[0048] Optional, such as Figure 2As shown in the figure, the system first executes the first risk detection strategy, that is, the edge computing of the T0 layer, which focuses on checking the credibility of Internet devices related to transactions. The Internet device information (such as device model, operating system, IP address, geographic location, etc.) used by the target account in the current transaction is compared with the device information recorded in the historical transaction behavior data of the account. If the system finds that the device used in the current transaction is consistent with the device information recorded in the historical data, this indicates that the device is credible. In this case, the system will immediately determine that the transaction status is normal, and no further risk detection is required, thereby quickly filtering out a large number of normal transactions, reducing disturbances to users and system resource consumption. If the device used in the current transaction does not match the device information in the historical data, this may be a risk signal, indicating that there is an abnormality in the transaction. In this case, the system will obtain a first risk detection result of an abnormal transaction status. Once the system determines that the transaction status is abnormal, it will not terminate the transaction immediately, but will continue to use a deeper risk detection strategy to further analyze the transaction behavior.

[0049] Step S22, when the Internet device corresponding to the current transaction behavior data does not match the Internet device corresponding to the historical transaction behavior data, a first risk detection result of abnormal transaction status is obtained, and other strategies among the multiple risk detection strategies except the first risk detection strategy are continued to be used to perform risk detection on the current transaction behavior data, including: in accordance with the risk detection order, based on the second risk detection strategy, at least one of the following features in the current transaction behavior data is matched: transaction amount, transaction time, transaction location and login frequency; when the selected feature matches the predetermined threshold, directly determining that the final risk detection result of the current transaction behavior data is a normal transaction status; when the selected feature does not match the predetermined threshold, a second risk detection result of abnormal transaction status is obtained, and other strategies among the multiple risk detection strategies except the first risk detection strategy and the second risk detection strategy are continued to be used to perform risk detection on the current transaction behavior data.

[0050] Optional, such as Figure 2As shown in Figure 1, in the T1 layer, the system will execute the second risk detection strategy, which focuses on analyzing other key features of transaction behavior, such as transaction amount, transaction time, transaction location, and login frequency, which are important factors in assessing transaction risks. The system will check whether these features of the current transaction match the corresponding features in the historical transaction behavior data. For example, if historical transactions are usually conducted in the morning, and the current transaction occurs in the early morning, this may be an abnormal signal. If one or more features of the current transaction behavior match the features in the historical data and meet the normal behavior threshold preset by the system, then the system will consider the transaction to be normal, without further in-depth detection, and the transaction status will be marked as normal, quickly passing the risk detection process to reduce disturbance to users. If the features of the current transaction behavior do not match the features in the historical data, or are significantly different from the preset normal behavior threshold, then the system will obtain the second risk detection result of abnormal transaction status, indicating that there is a potential risk in the transaction, and the system will continue to use deeper risk detection strategies to conduct a more detailed and comprehensive risk assessment of the transaction behavior. These strategies may involve more complex models and data analysis to ensure accurate judgment of potential risks.

[0051] Step S23, when the selected feature does not match the predetermined threshold, a second risk detection result of abnormal transaction status is obtained, and other strategies among the multiple risk detection strategies except the first risk detection strategy and the second risk detection strategy are continued to be used to perform risk detection on the current transaction behavior data, including: building a risk assessment model according to the historical transaction behavior data in accordance with the risk detection order, and inputting the current transaction behavior data into the risk assessment model; obtaining a score value of the current transaction behavior data according to the risk assessment model; when the score value of the current transaction behavior data is less than the predetermined score threshold, determining that the final risk detection result of the current transaction behavior data is a normal transaction status; when the score value of the current transaction behavior data is greater than or equal to the predetermined score threshold, determining that the final risk detection result of the current transaction behavior data is an abnormal transaction status.

[0052] Optional, such as Figure 2As shown in the figure, once the quick identification strategy fails to confirm the safety of the transaction, the system will enter a deeper level of detection, namely the T2 deep identification layer, where more complex risk detection strategies and models will be used. At the T2 layer, the system will build a risk assessment model based on a large amount of historical transaction behavior data. This model may be a machine learning model, such as a decision tree, random forest, neural network, etc. It can learn the characteristics of normal and abnormal transactions from historical data and provide a score or risk assessment for the current transaction behavior. The detailed information of the current transaction behavior is input into the constructed risk assessment model, and the model will score according to the characteristics of the transaction behavior to quantify the transaction risk. After the model analysis, a score value will be assigned to the current transaction behavior data, which reflects the degree of abnormality of the transaction behavior. The lower the score, the more likely the transaction is to be considered normal; the higher the score, the more likely the transaction is to be judged as abnormal or risky. If the score calculated by the model is lower than the risk threshold preset by the system, it means that the risk level of the current transaction behavior is within an acceptable range. The system will eventually determine that the transaction status is normal, and the transaction can proceed smoothly, while reducing unnecessary disturbances to users. On the contrary, if the score value reaches or exceeds the preset score threshold, it indicates that the transaction behavior has a high risk. The system will ultimately determine that the transaction status is abnormal, and further measures may need to be taken, such as suspending transactions, adding verification processes, etc., to ensure the security of transactions.

[0053] Step S3, when the risk detection result of normal transaction status appears for the first time, determine that the final risk detection result of the current transaction behavior data is normal transaction status; or, when multiple risk detection results are abnormal transaction status, determine that the final risk detection result of the current transaction behavior data is abnormal transaction status.

[0054] In this step, if at any level of the risk detection process, the system finds that the current transaction behavior meets the standards or characteristics of normal transactions by comparing and analyzing the historical transaction behavior data and the current transaction behavior data, then the system will immediately stop the subsequent in-depth detection and determine the final risk detection result of the current transaction as a normal transaction status. On the contrary, if after all levels of risk detection, the detection results of each layer indicate that the current transaction behavior is abnormal or has potential risks, then the system will determine the final risk detection result of the current transaction as an abnormal transaction status. In this case, the system will take further risk control measures, such as suspending transactions, requiring users to provide additional verification, and conducting manual review, etc., to prevent potential risk events.

[0055] Step S4, recording the final risk detection result of the current transaction behavior data in the historical transaction behavior data, and updating the historical transaction behavior data.

[0056] Optional, such as Figure 2As shown in the figure, when a transaction is found to have potential risks during the detection process of the T2 layer, the transaction data will be passed to the T3 layer for asynchronous analysis. The T3 layer uses its powerful computing power and analysis tools to conduct in-depth evaluations of various aspects of the transaction, including but not limited to the time, location, amount, information of the transaction device, user behavior patterns, etc., and combines these features with the final risk detection results and updates them to the user's historical transaction behavior data. This means that every transaction and its risk detection process and results will become one of the basic data for future analysis, providing richer and more accurate reference data for subsequent transaction risk assessments.

[0057] The above-mentioned optional implementation method achieves at least the following effects: the purpose of speeding up the risk detection speed as much as possible while ensuring the accuracy of risk detection is achieved, the technical problem of low efficiency in risk detection of transaction behaviors is solved, and the technical effect of reducing the disturbance rate to normal transaction users and improving the efficiency and accuracy of risk detection of transaction behaviors is achieved.

[0058] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0059] In this embodiment, a transaction behavior risk detection device is also provided, which is used to implement the above embodiments and preferred implementations, and the descriptions that have been made will not be repeated. As used below, the terms "module" and "device" can implement a combination of software and / or hardware for a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0060] According to an embodiment of the present invention, there is also provided an embodiment of a device for implementing a transaction behavior risk detection method. Figure 3 A schematic diagram of a transaction behavior risk detection device according to an embodiment of the present invention is shown in FIG. Figure 3 As shown, the above-mentioned transaction behavior risk detection device includes an acquisition module 31, a risk detection module 32, and a determination module 33. The device is described below.

[0061] An acquisition module 31 is used to acquire historical transaction behavior data based on a target account, wherein the historical transaction behavior data is used to describe the characteristics of the transaction behavior based on the target account;

[0062] The risk detection module 32 is connected to the acquisition module 31 and is used to perform risk detection on the current transaction behavior data of the target account based on the historical transaction behavior data based on the pre-set multiple risk detection strategies in turn, and obtain multiple risk detection results, wherein the resources required for the operation of the multiple risk detection strategies are different;

[0063] The determination module 33 is connected to the risk detection module 32, and is used to determine that the final risk detection result of the current transaction behavior data is a normal transaction status when the risk detection result of the normal transaction status appears for the first time; or, when multiple risk detection results are all abnormal transaction status, determine that the final risk detection result of the current transaction behavior data is an abnormal transaction status.

[0064] In a transaction behavior risk detection device provided by an embodiment of the present invention, an acquisition module is set to acquire historical transaction behavior data based on a target account, wherein the historical transaction behavior data is used to describe the characteristics of the transaction behavior based on the target account; a risk detection module is used to perform risk detection on the current transaction behavior data of the target account based on the historical transaction behavior data in turn based on a plurality of pre-set risk detection strategies, and obtain a plurality of risk detection results, wherein the resources required for the operation of the plurality of risk detection strategies are different; a determination module is used to determine that the final risk detection result of the current transaction behavior data is a normal transaction status when a risk detection result of a normal transaction status appears for the first time; or, when a plurality of risk detection results are abnormal transaction status, determine that the final risk detection result of the current transaction behavior data is an abnormal transaction status. The technical problem of low efficiency in risk detection of transaction behavior is solved, and the purpose of speeding up the risk detection speed as much as possible while ensuring the accuracy of risk detection is achieved, and the technical effect of reducing the disturbance rate to normal transaction users and improving the efficiency and accuracy of risk detection of transaction behavior is achieved.

[0065] It should be noted that the above modules can be implemented by software or hardware. For example, for the latter, it can be implemented in the following ways: the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0066] It should be noted that the acquisition module 31, risk detection module 32, and determination module 33 correspond to steps S102 to S106 in the embodiment, and the examples and application scenarios implemented by the modules and the corresponding steps are the same, but are not limited to the contents disclosed in the embodiment. It should be noted that the modules as part of the device can be run in a computer terminal.

[0067] It should be noted that the optional or preferred implementation of this embodiment can refer to the relevant description in the embodiment, which will not be repeated here.

[0068] The above-mentioned transaction behavior risk detection device may also include a processor and a memory. The acquisition module 31, the risk detection module 32, the determination module 33, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0069] The processor includes a kernel, which retrieves the corresponding program unit from the memory. There can be one or more kernels. The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one storage chip.

[0070] An embodiment of the present invention provides a non-volatile storage medium on which a program is stored. When the program is executed by a processor, a transaction behavior risk detection method is implemented.

[0071] like Figure 4 As shown, an embodiment of the present invention provides an electronic device, the electronic device 10 includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, the following steps are implemented: the memory is used to store a computer program, wherein, when the computer program is executed by the processor, the processor implements the above-mentioned transaction behavior risk detection method. The device in this article may be a server, a PC, etc.

[0072] The present invention also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program that is initialized with the following method steps: computer instructions are executed by a processor to perform the above-mentioned transaction behavior risk detection method.

[0073] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0074] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0075] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0076] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0077] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0078] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0079] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0080] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0081] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0082] The above are only embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of the claims of the present invention.

Claims

1. A transaction behavior risk detection method, characterized in that: include: Acquire historical transaction behavior data based on a target account, wherein the historical transaction behavior data is used to describe characteristics of transaction behavior based on the target account; Based on the preset multiple risk detection strategies, the current transaction behavior data of the target account is subjected to risk detection in turn according to the historical transaction behavior data, thereby obtaining multiple risk detection results, wherein the multiple risk detection strategies require different resources to run; When the risk detection result of normal transaction status appears for the first time, the final risk detection result of the current transaction behavior data is determined to be normal transaction status; or, when the multiple risk detection results are all abnormal transaction status, the final risk detection result of the current transaction behavior data is determined to be abnormal transaction status.

2. The method according to claim 1, characterized in that The method sequentially performs risk detection on the current transaction behavior data of the target account based on the pre-set multiple risk detection strategies and according to the historical transaction behavior data, and obtains multiple risk detection results, including: Sorting the multiple risk detection strategies in order of increasing required resources to obtain a risk detection order; According to the risk detection sequence, the multiple risk detection strategies are adopted in sequence, and based on the historical transaction behavior data, risk detection is performed on the current transaction behavior data of the target account to obtain multiple risk detection results.

3. The method according to claim 2, characterized in that According to the risk detection sequence, based on the pre-set multiple risk detection strategies, the current transaction behavior data of the target account is subjected to risk detection according to the historical transaction behavior data to obtain multiple risk detection results, including: According to the risk detection order and based on the first risk detection strategy, matching the Internet device corresponding to the current transaction behavior data with the Internet device corresponding to the historical transaction behavior data; In the case where the Internet device corresponding to the current transaction behavior data of the target account matches the Internet device corresponding to the historical transaction behavior data, directly determining that the final risk detection result of the current transaction behavior data is a normal transaction status; When the Internet device corresponding to the current transaction behavior data does not match the Internet device corresponding to the historical transaction behavior data, a first risk detection result of abnormal transaction status is obtained, and other strategies among the multiple risk detection strategies except the first risk detection strategy are continued to be used to perform risk detection on the current transaction behavior data.

4. The method according to claim 3, characterized in that In the case that the Internet device corresponding to the current transaction behavior data does not match the Internet device corresponding to the historical transaction behavior data, a first risk detection result of abnormal transaction status is obtained, and other strategies among the multiple risk detection strategies except the first risk detection strategy are continuously adopted to perform risk detection on the current transaction behavior data, including: According to the risk detection order, based on the second risk detection strategy, matching at least one of the following features in the current transaction behavior data: transaction amount, transaction time, transaction location and login frequency; When the selected feature matches the predetermined threshold, directly determining the final risk detection result of the current transaction behavior data as a normal transaction status; When the selected feature does not match the predetermined threshold, a second risk detection result of abnormal transaction status is obtained, and other strategies among the multiple risk detection strategies except the first risk detection strategy and the second risk detection strategy are continued to be used to perform risk detection on the current transaction behavior data.

5. The method according to claim 4, characterized in that In the case where the selected feature does not match the predetermined threshold, a second risk detection result of abnormal transaction status is obtained, and other strategies among the multiple risk detection strategies except the first risk detection strategy and the second risk detection strategy are continuously adopted to perform risk detection on the current transaction behavior data, including: According to the risk detection sequence, a risk assessment model is constructed based on the historical transaction behavior data, and the current transaction behavior data is input into the risk assessment model; According to the risk assessment model, a score value of the current transaction behavior data is obtained; When the score value of the current transaction behavior data is less than a predetermined score threshold, determining that the final risk detection result of the current transaction behavior data is that the transaction status is normal; When the score value of the current transaction behavior data is greater than or equal to a predetermined score threshold, it is determined that the final risk detection result of the current transaction behavior data is an abnormal transaction status.

6. The method according to claim 1, characterized in that Also includes: The final risk detection result of the current transaction behavior data is recorded in the historical transaction behavior data, and the historical transaction behavior data is updated.

7. A transaction behavior risk detection device, characterized in that: include: An acquisition module, used to acquire historical transaction behavior data based on a target account, wherein the historical transaction behavior data is used to describe the characteristics of the transaction behavior based on the target account; A risk detection module, configured to perform risk detection on the current transaction behavior data of the target account based on the historical transaction behavior data in turn based on a plurality of pre-set risk detection strategies, and obtain a plurality of risk detection results, wherein the resources required for the operation of the plurality of risk detection strategies are different; A determination module is used to determine that the final risk detection result of the current transaction behavior data is a normal transaction status when the risk detection result of the normal transaction status appears for the first time; or to determine that the final risk detection result of the current transaction behavior data is an abnormal transaction status when the multiple risk detection results are all abnormal transaction status.

8. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the transaction behavior risk detection method described in any one of claims 1 to 6.

9. An electronic device, characterized in that: include: One or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the transaction behavior risk detection method described in any one of claims 1 to 6.

10. A computer program product comprising computer instructions, characterized in that The computer instructions are executed by the processor to implement the transaction behavior risk detection method described in any one of claims 1 to 6.

Images