Transaction behavior risk detection method, device, and non-volatile storage medium

Abstract

The present invention discloses a transaction behavior risk detection method, device, and non-volatile storage medium. The method comprises: obtaining historical transaction behavior data based on a target account, wherein the historical transaction behavior data is used to describe the characteristics of the transaction behavior based on the target account; sequentially performing risk detection on the target account's current transaction behavior data based on the historical transaction behavior data based on a plurality of pre-set risk detection strategies, and obtaining a plurality of risk detection results, wherein the resources required for the operation of the plurality of risk detection strategies differ; when a risk detection result indicating a normal transaction status appears for the first time, determining the final risk detection result of the current transaction behavior data as a normal transaction status; or, when multiple risk detection results indicate an abnormal transaction status, determining the final risk detection result of the current transaction behavior data as an abnormal transaction status. The present invention solves the technical problem of low efficiency in risk detection of transaction behaviors.

Description

Technical Field

[0001] The present invention relates to the field of computer software applications, and in particular to a transaction behavior risk detection method, device, and non-volatile storage medium. Background Art

[0002] When performing risk detection on transaction behaviors, existing technologies often use flat or single-level models to analyze all transaction data to the same extent, ignoring the fact that most transactions are normal. However, during the transaction process, the proportion of abnormal or fraudulent behavior is usually low, perhaps only around 1%. The system must screen all transactions, which is not only inefficient but may also cause unnecessary interruptions to normal users due to frequent requests for additional verification information, reducing the user experience and leading to a waste of computing resources.

[0003] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0004] Embodiments of the present invention provide a transaction behavior risk detection method, device, and non-volatile storage medium to at least solve the technical problem of low efficiency in risk detection of transaction behaviors.

[0005] According to one aspect of an embodiment of the present invention, a transaction behavior risk detection method is provided, comprising: obtaining historical transaction behavior data based on a target account, wherein the historical transaction behavior data is used to describe characteristics of the transaction behavior based on the target account; sequentially performing risk detection on current transaction behavior data of the target account based on a plurality of pre-set risk detection strategies and according to the historical transaction behavior data, to obtain a plurality of risk detection results, wherein the resources required for the operation of the plurality of risk detection strategies are different; in a case where a risk detection result indicating a normal transaction status appears for the first time, determining that a final risk detection result of the current transaction behavior data is a normal transaction status; or, in a case where a plurality of risk detection results indicate that the transaction status is abnormal, determining that the final risk detection result of the current transaction behavior data is an abnormal transaction status.

[0006] Optionally, based on multiple pre-set risk detection strategies, risk detection is performed on the current transaction behavior data of the target account according to historical transaction behavior data to obtain multiple risk detection results, including: sorting multiple risk detection strategies in order of increasing required resources to obtain a risk detection order; according to the risk detection order, multiple risk detection strategies are sequentially adopted to perform risk detection on the current transaction behavior data of the target account according to historical transaction behavior data to obtain multiple risk detection results.

[0007] Optionally, in accordance with the risk detection order, based on a plurality of pre-set risk detection strategies, risk detection is performed on the current transaction behavior data of the target account according to the historical transaction behavior data to obtain multiple risk detection results, including: in accordance with the risk detection order, based on the first risk detection strategy, matching the Internet device corresponding to the current transaction behavior data with the Internet device corresponding to the historical transaction behavior data; when the Internet device corresponding to the current transaction behavior data of the target account matches the Internet device corresponding to the historical transaction behavior data, directly determining the final risk detection result of the current transaction behavior data as a normal transaction status; when the Internet device corresponding to the current transaction behavior data does not match the Internet device corresponding to the historical transaction behavior data, obtaining a first risk detection result of an abnormal transaction status, and continuing to use other strategies among the plurality of risk detection strategies except the first risk detection strategy to perform risk detection on the current transaction behavior data.

[0008] Optionally, when the Internet device corresponding to the current transaction behavior data does not match the Internet device corresponding to the historical transaction behavior data, a first risk detection result of abnormal transaction status is obtained, and other strategies among the multiple risk detection strategies except the first risk detection strategy are continued to be used to perform risk detection on the current transaction behavior data, including: in accordance with the risk detection order, based on the second risk detection strategy, matching at least one of the following features in the current transaction behavior data: transaction amount, transaction time, transaction location and login frequency; when the selected feature matches the predetermined threshold, directly determining the final risk detection result of the current transaction behavior data as normal transaction status; when the selected feature does not match the predetermined threshold, a second risk detection result of abnormal transaction status is obtained, and other strategies among the multiple risk detection strategies except the first risk detection strategy and the second risk detection strategy are continued to be used to perform risk detection on the current transaction behavior data.

[0009] Optionally, when the selected features do not match the predetermined threshold, a second risk detection result of abnormal transaction status is obtained, and other strategies among the multiple risk detection strategies except the first risk detection strategy and the second risk detection strategy are continued to be used to perform risk detection on the current transaction behavior data, including: constructing a risk assessment model based on historical transaction behavior data in accordance with the risk detection order, and inputting the current transaction behavior data into the risk assessment model; obtaining a score value of the current transaction behavior data according to the risk assessment model; when the score value of the current transaction behavior data is less than the predetermined score threshold, determining that the final risk detection result of the current transaction behavior data is normal transaction status; when the score value of the current transaction behavior data is greater than or equal to the predetermined score threshold, determining that the final risk detection result of the current transaction behavior data is abnormal transaction status.

[0010] Optionally, the method further includes: recording the final risk detection result of the current transaction behavior data in the historical transaction behavior data, and updating the historical transaction behavior data.

[0011] According to another aspect of an embodiment of the present invention, a transaction behavior risk detection device is provided, including: an acquisition module for acquiring historical transaction behavior data based on a target account, wherein the historical transaction behavior data is used to describe the characteristics of the transaction behavior based on the target account; a risk detection module for sequentially performing risk detection on the current transaction behavior data of the target account based on a plurality of pre-set risk detection strategies and according to the historical transaction behavior data, to obtain a plurality of risk detection results, wherein the resources required for the operation of the plurality of risk detection strategies are different; a determination module for determining, when a risk detection result indicating a normal transaction status appears for the first time, that a final risk detection result of the current transaction behavior data is that the transaction status is normal; or, when a plurality of risk detection results indicate that the transaction status is abnormal, determining that the final risk detection result of the current transaction behavior data is that the transaction status is abnormal.

[0012] According to another aspect of an embodiment of the present invention, a non-volatile storage medium is provided. The non-volatile storage medium stores a plurality of instructions, and the instructions are suitable for being loaded and executed by a processor for any one of the transaction behavior risk detection methods.

[0013] According to another aspect of an embodiment of the present invention, an electronic device is provided, comprising: one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement any one of the transaction behavior risk detection methods.

[0014] According to yet another aspect of an embodiment of the present invention, a computer program product is provided, including a computer program, which implements any one of the above-mentioned transaction behavior risk detection methods when executed by a processor.

[0015] In an embodiment of the present invention, historical transaction behavior data based on a target account is obtained, wherein the historical transaction behavior data is used to describe the characteristics of the transaction behavior based on the target account; based on a plurality of pre-set risk detection strategies, risk detection is performed on the current transaction behavior data of the target account according to the historical transaction behavior data to obtain a plurality of risk detection results, wherein the resources required for the operation of the plurality of risk detection strategies are different; when a risk detection result indicating a normal transaction status appears for the first time, the final risk detection result of the current transaction behavior data is determined to be a normal transaction status; or, when a plurality of risk detection results indicate an abnormal transaction status, the final risk detection result of the current transaction behavior data is determined to be an abnormal transaction status, thereby achieving the purpose of speeding up the risk detection speed as much as possible while ensuring the accuracy of risk detection, solving the technical problem of low efficiency in risk detection of transaction behavior, and further achieving the technical effect of reducing the disturbance rate to normal transaction users and improving the efficiency and accuracy of risk detection of transaction behavior. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0017] Figure 1 This is a flow chart of a transaction behavior risk detection method provided according to an embodiment of the present invention;

[0018] Figure 2 is a schematic diagram of an optional transaction behavior hierarchical detection method provided according to an embodiment of the present invention;

[0019] Figure 3 2 is a schematic diagram of a transaction behavior risk detection device provided according to an embodiment of the present invention;

[0020] Figure 4 is a schematic diagram of an electronic device provided according to an embodiment of the present invention. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0022] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0023] According to an embodiment of the present invention, a method embodiment for detecting transaction behavior risks is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0024] Figure 1 is a flow chart of a transaction behavior risk detection method according to an embodiment of the present invention. Figure 1 As shown, the method includes the following steps:

[0025] Step S102: Acquire historical transaction behavior data based on the target account, wherein the historical transaction behavior data is used to describe characteristics of transaction behavior based on the target account;

[0026] In this step, the target account can be an account created by the user on the platform, and the user can conduct transactions based on the account. Obtaining historical transaction behavior data based on the target account involves retrieving all transaction records related to the target account from the payment system's historical database. This transaction record data includes, but is not limited to, transaction time, transaction amount, transaction frequency, transaction location, transaction type (transfer, purchase, top-up, etc.), associated merchant information, and payment method used. These characteristics can reflect the target account's transaction habits and characteristics.

[0027] Step S104, sequentially performing risk detection on the target account's current transaction behavior data based on multiple pre-set risk detection strategies and historical transaction behavior data, obtaining multiple risk detection results, wherein the various risk detection strategies require different resources to run;

[0028] In this step, the pre-set multiple risk detection strategies refer to a series of pre-set risk detection strategies ranging from simple to complex, and from rapid to in-depth. These strategies are set and executed in a specific order. When the system performs risk detection on current trading behavior, it will use these strategies and previously collected historical trading data of the target account to conduct a layered detection of the target account's current trading behavior, resulting in multiple detection results.

[0029] In an optional embodiment, risk detection is performed on the current transaction behavior data of the target account based on the historical transaction behavior data based on a plurality of pre-set risk detection strategies in sequence to obtain a plurality of risk detection results, including: sorting the plurality of risk detection strategies in order of increasing required resources to obtain a risk detection order; and sequentially adopting the plurality of risk detection strategies in accordance with the risk detection order to perform risk detection on the current transaction behavior data of the target account based on the historical transaction behavior data to obtain a plurality of risk detection results.

[0030] Optionally, during the execution of risk control strategies, the system will sort them according to the amount of resources required for each strategy to run. Generally, strategies with fewer resource requirements (such as lightweight rule-based analysis) are ranked first, while strategies with higher resource requirements (such as deep learning model analysis, machine learning algorithms, etc.) are ranked later. This sorting ensures that the system uses strategies with the least resources for risk detection first. Only when the current strategy cannot determine whether the transaction is safe will it start strategies with higher resource consumption, thereby achieving optimal resource utilization. According to the risk detection order determined above, the risk detection strategies are executed layer by layer. Each layer of strategy will generate a risk detection result. The system will use these results to determine whether further detection is needed or whether the transaction is safe.

[0031] In an optional embodiment, according to the risk detection order, based on multiple pre-set risk detection strategies, the current transaction behavior data of the target account is subjected to risk detection according to the historical transaction behavior data to obtain multiple risk detection results, including: according to the risk detection order, based on the first risk detection strategy, the Internet device corresponding to the current transaction behavior data is matched with the Internet device corresponding to the historical transaction behavior data; when the Internet device corresponding to the current transaction behavior data of the target account matches the Internet device corresponding to the historical transaction behavior data, the final risk detection result of the current transaction behavior data is directly determined to be a normal transaction status; when the Internet device corresponding to the current transaction behavior data does not match the Internet device corresponding to the historical transaction behavior data, a first risk detection result of an abnormal transaction status is obtained, and other strategies except the first risk detection strategy among the multiple risk detection strategies are continued to be used to perform risk detection on the current transaction behavior data.

[0032] Optional, such as Figure 2 As shown, the system first executes the first risk detection strategy, namely, edge computing at the T0 layer, which focuses on verifying the trustworthiness of internet devices associated with transactions. The system compares the internet device information (such as device model, operating system, IP address, and geographic location) used by the target account in the current transaction with the device information recorded in the account's historical transaction data. If the system finds that the device used in the current transaction matches the device information recorded in the historical data, this indicates that the device is trustworthy. In this case, the system immediately determines that the transaction status is normal, eliminating the need for further risk detection. This quickly filters out a large number of normal transactions, reducing user disruption and system resource consumption. If the device used in the current transaction does not match the device information in the historical data, this may be a risk signal, indicating that the transaction is abnormal. In this case, the system will receive a first risk detection result indicating an abnormal transaction status. Once the system determines that the transaction status is abnormal, it will not immediately terminate the transaction, but will continue to use more in-depth risk detection strategies to further analyze the transaction behavior.

[0033] In an optional embodiment, when the Internet device corresponding to the current transaction behavior data does not match the Internet device corresponding to the historical transaction behavior data, a first risk detection result of abnormal transaction status is obtained, and other strategies among the multiple risk detection strategies except the first risk detection strategy are continued to be used to perform risk detection on the current transaction behavior data, including: according to the risk detection order, based on the second risk detection strategy, matching at least one of the following features in the current transaction behavior data: transaction amount, transaction time, transaction location and login frequency; when the selected feature matches the predetermined threshold, directly determining the final risk detection result of the current transaction behavior data as normal transaction status; when the selected feature does not match the predetermined threshold, a second risk detection result of abnormal transaction status is obtained, and other strategies among the multiple risk detection strategies except the first risk detection strategy and the second risk detection strategy are continued to be used to perform risk detection on the current transaction behavior data.

[0034] Optional, such as Figure 2As shown, at the T1 level, the system executes a secondary risk detection strategy, which focuses on analyzing other key characteristics of transaction behavior, such as transaction amount, transaction time, transaction location, and login frequency—all important factors in assessing transaction risk. The system checks whether these characteristics of the current transaction match those in historical transaction data. For example, if historical transactions typically occurred in the morning, but the current transaction occurred in the early morning, this could be an anomaly. If one or more characteristics of the current transaction match those in the historical data and meet the system's preset threshold for normal behavior, the system deems the transaction normal and eliminates the need for further in-depth analysis. The transaction status is marked as normal, allowing it to quickly pass the risk detection process and minimize user disruption. If the characteristics of the current transaction do not match those in the historical data, or differ significantly from the preset threshold for normal behavior, the system will receive a secondary risk detection result indicating an abnormal transaction status, indicating potential risk. The system will then apply further tiers of risk detection strategies for a more detailed and comprehensive risk assessment of the transaction. These strategies may involve more complex models and data analysis to ensure accurate judgments on potential risks.

[0035] In an optional embodiment, when the selected features do not match the predetermined threshold, a second risk detection result of abnormal transaction status is obtained, and other strategies among the multiple risk detection strategies except the first risk detection strategy and the second risk detection strategy are continued to be used to perform risk detection on the current transaction behavior data, including: building a risk assessment model based on historical transaction behavior data in accordance with the risk detection order, and inputting the current transaction behavior data into the risk assessment model; obtaining a score value of the current transaction behavior data according to the risk assessment model; when the score value of the current transaction behavior data is less than the predetermined score threshold, determining that the final risk detection result of the current transaction behavior data is normal transaction status; when the score value of the current transaction behavior data is greater than or equal to the predetermined score threshold, determining that the final risk detection result of the current transaction behavior data is abnormal transaction status.

[0036] Optional, such as Figure 2As shown, if the quick identification strategy fails to confirm the safety of a transaction, the system will enter a deeper level of detection, the T2 deep identification layer, which utilizes more complex risk detection strategies and models. At the T2 layer, the system constructs a risk assessment model based on extensive historical transaction data. This model may be a machine learning model, such as a decision tree, random forest, or neural network. It learns the characteristics of normal and abnormal transactions from historical data and provides a score or risk assessment for the current transaction. The detailed information of the current transaction is input into the constructed risk assessment model, which then assigns a score based on the characteristics of the transaction to quantify the transaction risk. After analysis, the model assigns a score to the current transaction data, which reflects the degree of abnormality. A lower score indicates that the transaction is more likely to be considered normal; a higher score indicates that the transaction is more likely to be considered abnormal or risky. If the score calculated by the model is below the system's preset risk threshold, it means that the risk level of the current transaction is within an acceptable range. The system will ultimately determine the transaction status as normal, allowing the transaction to proceed smoothly while minimizing unnecessary disruption to the user. On the contrary, if the score reaches or exceeds the preset score threshold, it indicates that the transaction behavior has a high risk. The system will ultimately determine that the transaction status is abnormal and may need to take further measures, such as suspending the transaction, adding verification procedures, etc., to ensure the security of the transaction.

[0037] Step S106: When the risk detection result of the normal transaction status appears for the first time, the final risk detection result of the current transaction behavior data is determined to be the normal transaction status; or, when multiple risk detection results are all abnormal transaction status, the final risk detection result of the current transaction behavior data is determined to be the abnormal transaction status.

[0038] In this step, if, at any level of the risk detection process, the system compares and analyzes historical and current transaction data and finds that the current transaction meets the standards or characteristics of normal trading, the system will immediately stop further in-depth detection and determine the final risk detection result for the current transaction as normal. Conversely, if the detection results at all levels of risk detection indicate that the current transaction behavior is abnormal or has potential risks, the system will determine the final risk detection result for the current transaction as abnormal. In this case, the system will implement further risk control measures, such as suspending trading, requiring users to provide additional verification, and conducting manual review, to prevent potential risk events.

[0039] In an optional embodiment, the final risk detection result of the current transaction behavior data is recorded in the historical transaction behavior data, and the historical transaction behavior data is updated.

[0040] Optional, such as Figure 2As shown in the figure, when a transaction is identified as potentially risky during the T2 layer's detection process, the transaction data is passed to the T3 layer for asynchronous analysis. Leveraging its powerful computing capabilities and analytical tools, the T3 layer conducts an in-depth assessment of all aspects of the transaction, including but not limited to the time, location, amount, transaction device information, and user behavior patterns. These characteristics are then combined with the final risk detection results and updated into the user's historical transaction behavior data. This means that every transaction, along with its risk detection process and results, becomes part of the system's foundational data for future analysis, providing a richer and more accurate reference for subsequent transaction risk assessments.

[0041] Through the above, when the risk detection result of the normal transaction status appears for the first time, the final risk detection result of the current transaction behavior data is determined to be the normal transaction status; or when multiple risk detection results are all abnormal transaction status, the final risk detection result of the current transaction behavior data is determined to be the abnormal transaction status. Based on the multiple pre-set risk detection strategies, the current transaction behavior data of the target account is subjected to risk detection in accordance with the historical transaction behavior data to obtain multiple risk detection results, wherein the resources required for the operation of the multiple risk detection strategies are different; the historical transaction behavior data based on the target account is obtained, wherein the historical transaction behavior data is used to describe the characteristics of the transaction behavior based on the target account, thereby solving the technical problem of low efficiency in risk detection of transaction behavior, achieving the purpose of speeding up the risk detection speed as much as possible while ensuring the accuracy of risk detection, solving the technical problem of low efficiency in risk detection of transaction behavior, and thus achieving the technical effect of reducing the disturbance rate to normal transaction users and improving the efficiency and accuracy of risk detection of transaction behavior.

[0042] Based on the above embodiments and optional embodiments, the present invention proposes an optional implementation manner.

[0043] Step S1, obtaining historical transaction behavior data based on a target account, wherein the historical transaction behavior data is used to describe characteristics of transaction behavior based on the target account;

[0044] In this step, obtaining historical transaction data based on the target account involves retrieving all transaction records related to the target account from the payment system's historical database. This transaction record data includes, but is not limited to, transaction time, transaction amount, transaction frequency, transaction location, transaction type (transfer, purchase, top-up, etc.), associated merchant information, and payment methods used. These characteristics can reflect the target account's transaction habits and characteristics.

[0045] Step S2, based on multiple pre-set risk detection strategies and according to historical transaction behavior data, performs risk detection on the current transaction behavior data of the target account to obtain multiple risk detection results, including: sorting the multiple risk detection strategies in the order of increasing required resources to obtain a risk detection order; according to the risk detection order, sequentially adopting multiple risk detection strategies to perform risk detection on the current transaction behavior data of the target account according to the historical transaction behavior data to obtain multiple risk detection results.

[0046] Optionally, during the execution of risk control strategies, the system will sort them according to the amount of resources required for each strategy to run. Generally, strategies with fewer resource requirements (such as lightweight rule-based analysis) are ranked first, while strategies with higher resource requirements (such as deep learning model analysis, machine learning algorithms, etc.) are ranked later. This sorting ensures that the system uses strategies with the least resources for risk detection first. Only when the current strategy cannot determine whether the transaction is safe will it start strategies with higher resource consumption, thereby achieving optimal resource utilization. According to the risk detection order determined above, the risk detection strategies are executed layer by layer. Each layer of strategy will generate a risk detection result. The system will use these results to determine whether further detection is needed or whether the transaction is safe.

[0047] Step S21, in accordance with the risk detection order, based on the multiple pre-set risk detection strategies, and according to the historical transaction behavior data, risk detection is performed on the current transaction behavior data of the target account to obtain multiple risk detection results, including: in accordance with the risk detection order, based on the first risk detection strategy, matching the Internet device corresponding to the current transaction behavior data with the Internet device corresponding to the historical transaction behavior data; when the Internet device corresponding to the current transaction behavior data of the target account matches the Internet device corresponding to the historical transaction behavior data, directly determining that the final risk detection result of the current transaction behavior data is a normal transaction status; when the Internet device corresponding to the current transaction behavior data does not match the Internet device corresponding to the historical transaction behavior data, obtaining a first risk detection result of an abnormal transaction status, and continuing to use other strategies among the multiple risk detection strategies except the first risk detection strategy to perform risk detection on the current transaction behavior data.

[0048] Optional, such as Figure 2As shown, the system first executes the first risk detection strategy, namely, edge computing at the T0 layer, which focuses on verifying the trustworthiness of internet devices associated with transactions. The system compares the internet device information (such as device model, operating system, IP address, and geographic location) used by the target account in the current transaction with the device information recorded in the account's historical transaction data. If the system finds that the device used in the current transaction matches the device information recorded in the historical data, this indicates that the device is trustworthy. In this case, the system immediately determines that the transaction status is normal, eliminating the need for further risk detection. This quickly filters out a large number of normal transactions, reducing user disruption and system resource consumption. If the device used in the current transaction does not match the device information in the historical data, this may be a risk signal, indicating that the transaction is abnormal. In this case, the system will receive a first risk detection result indicating an abnormal transaction status. Once the system determines that the transaction status is abnormal, it will not immediately terminate the transaction, but will continue to use more in-depth risk detection strategies to further analyze the transaction behavior.

[0049] Step S22, when the Internet device corresponding to the current transaction behavior data does not match the Internet device corresponding to the historical transaction behavior data, a first risk detection result of an abnormal transaction status is obtained, and other strategies among the multiple risk detection strategies except the first risk detection strategy are continued to be used to perform risk detection on the current transaction behavior data, including: according to the risk detection order, based on the second risk detection strategy, matching at least one of the following features in the current transaction behavior data: transaction amount, transaction time, transaction location and login frequency; when the selected feature matches the predetermined threshold, directly determining the final risk detection result of the current transaction behavior data as a normal transaction status; when the selected feature does not match the predetermined threshold, a second risk detection result of an abnormal transaction status is obtained, and other strategies among the multiple risk detection strategies except the first risk detection strategy and the second risk detection strategy are continued to be used to perform risk detection on the current transaction behavior data.

[0050] Optional, such as Figure 2As shown, at the T1 level, the system executes a secondary risk detection strategy, which focuses on analyzing other key characteristics of transaction behavior, such as transaction amount, transaction time, transaction location, and login frequency—all important factors in assessing transaction risk. The system checks whether these characteristics of the current transaction match those in historical transaction data. For example, if historical transactions typically occurred in the morning, but the current transaction occurred in the early morning, this could be an anomaly. If one or more characteristics of the current transaction match those in the historical data and meet the system's preset threshold for normal behavior, the system deems the transaction normal and eliminates the need for further in-depth analysis. The transaction status is marked as normal, allowing it to quickly pass the risk detection process and minimize user disruption. If the characteristics of the current transaction do not match those in the historical data, or differ significantly from the preset threshold for normal behavior, the system will receive a secondary risk detection result indicating an abnormal transaction status, indicating potential risk. The system will then apply further tiers of risk detection strategies for a more detailed and comprehensive risk assessment of the transaction. These strategies may involve more complex models and data analysis to ensure accurate judgments on potential risks.

[0051] Step S23, when the selected feature does not match the predetermined threshold, obtains a second risk detection result of abnormal transaction status, and continues to use other strategies among the multiple risk detection strategies except the first risk detection strategy and the second risk detection strategy to perform risk detection on the current transaction behavior data, including: constructing a risk assessment model based on historical transaction behavior data in accordance with the risk detection order, and inputting the current transaction behavior data into the risk assessment model; obtaining a score value of the current transaction behavior data according to the risk assessment model; when the score value of the current transaction behavior data is less than the predetermined score threshold, determining that the final risk detection result of the current transaction behavior data is normal transaction status; when the score value of the current transaction behavior data is greater than or equal to the predetermined score threshold, determining that the final risk detection result of the current transaction behavior data is abnormal transaction status.

[0052] Optional, such as Figure 2As shown, if the quick identification strategy fails to confirm the safety of a transaction, the system will enter a deeper level of detection, the T2 deep identification layer, which utilizes more complex risk detection strategies and models. At the T2 layer, the system constructs a risk assessment model based on extensive historical transaction data. This model may be a machine learning model, such as a decision tree, random forest, or neural network. It learns the characteristics of normal and abnormal transactions from historical data and provides a score or risk assessment for the current transaction. The detailed information of the current transaction is input into the constructed risk assessment model, which then assigns a score based on the characteristics of the transaction to quantify the transaction risk. After analysis, the model assigns a score to the current transaction data, which reflects the degree of abnormality. A lower score indicates that the transaction is more likely to be considered normal; a higher score indicates that the transaction is more likely to be considered abnormal or risky. If the score calculated by the model is below the system's preset risk threshold, it means that the risk level of the current transaction is within an acceptable range. The system will ultimately determine the transaction status as normal, allowing the transaction to proceed smoothly while minimizing unnecessary disruption to the user. On the contrary, if the score reaches or exceeds the preset score threshold, it indicates that the transaction behavior has a high risk. The system will ultimately determine that the transaction status is abnormal and may need to take further measures, such as suspending the transaction, adding verification procedures, etc., to ensure the security of the transaction.

[0053] Step S3: When the risk detection result of the normal transaction status appears for the first time, determine that the final risk detection result of the current transaction behavior data is the normal transaction status; or, when multiple risk detection results are abnormal transaction status, determine that the final risk detection result of the current transaction behavior data is the abnormal transaction status.

[0054] In this step, if, at any level of the risk detection process, the system compares and analyzes historical and current transaction data and finds that the current transaction meets the standards or characteristics of normal trading, the system will immediately stop further in-depth detection and determine the final risk detection result for the current transaction as normal. Conversely, if the detection results at all levels of risk detection indicate that the current transaction behavior is abnormal or has potential risks, the system will determine the final risk detection result for the current transaction as abnormal. In this case, the system will implement further risk control measures, such as suspending trading, requiring users to provide additional verification, and conducting manual review, to prevent potential risk events.

[0055] Step S4: Record the final risk detection result of the current transaction behavior data in the historical transaction behavior data, and update the historical transaction behavior data.

[0056] Optional, such as Figure 2As shown in the figure, when a transaction is identified as potentially risky during the T2 layer's detection process, the transaction data is passed to the T3 layer for asynchronous analysis. Leveraging its powerful computing capabilities and analytical tools, the T3 layer conducts an in-depth assessment of all aspects of the transaction, including but not limited to the time, location, amount, transaction device information, and user behavior patterns. These characteristics are then combined with the final risk detection results and updated into the user's historical transaction behavior data. This means that every transaction, along with its risk detection process and results, becomes fundamental data for future analysis, providing richer and more accurate reference data for subsequent transaction risk assessments.

[0057] The above optional implementation method achieves at least the following effects: the purpose of speeding up risk detection as much as possible while ensuring the accuracy of risk detection is achieved, the technical problem of low efficiency in risk detection of transaction behaviors is solved, and the technical effect of reducing the disturbance rate to normal transaction users and improving the efficiency and accuracy of risk detection of transaction behaviors is achieved.

[0058] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0059] This embodiment also provides a transaction behavior risk detection device for implementing the above-mentioned embodiments and preferred embodiments. Details already described will not be repeated. As used below, the terms "module" and "device" may refer to a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementation using hardware, or a combination of software and hardware, is also possible and contemplated.

[0060] According to an embodiment of the present invention, there is also provided an embodiment of a device for implementing a transaction behavior risk detection method. Figure 3 A schematic diagram of a transaction behavior risk detection device according to an embodiment of the present invention is shown in FIG. Figure 3 As shown, the transaction behavior risk detection device includes an acquisition module 31, a risk detection module 32, and a determination module 33. The device is described below.

[0061] An acquisition module 31 is configured to acquire historical transaction behavior data based on a target account, wherein the historical transaction behavior data is used to describe characteristics of transaction behavior based on the target account;

[0062] The risk detection module 32 is connected to the acquisition module 31 and is used to sequentially perform risk detection on the current transaction behavior data of the target account based on multiple pre-set risk detection strategies and historical transaction behavior data to obtain multiple risk detection results. The various risk detection strategies require different resources to run.

[0063] The determination module 33 is connected to the risk detection module 32 and is used to determine that the final risk detection result of the current transaction behavior data is a normal transaction status when the risk detection result of the normal transaction status appears for the first time; or, when multiple risk detection results are all abnormal transaction status, determine that the final risk detection result of the current transaction behavior data is an abnormal transaction status.

[0064] In a transaction risk detection device provided by an embodiment of the present invention, an acquisition module is provided for acquiring historical transaction behavior data based on a target account, wherein the historical transaction behavior data is used to describe the characteristics of the transaction behavior based on the target account; a risk detection module is used to sequentially perform risk detection on the current transaction behavior data of the target account based on multiple pre-set risk detection strategies and the historical transaction behavior data, thereby obtaining multiple risk detection results, wherein the multiple risk detection strategies require different resources to run; and a determination module is used to determine, upon the first occurrence of a risk detection result indicating a normal transaction status, that the final risk detection result of the current transaction behavior data is a normal transaction status; or, upon the occurrence of multiple risk detection results indicating an abnormal transaction status, determine, upon the occurrence of multiple risk detection results indicating an abnormal transaction status, that the final risk detection result of the current transaction behavior data is an abnormal transaction status. This device solves the technical problem of low efficiency in transaction risk detection, achieves the goal of accelerating risk detection as much as possible while ensuring the accuracy of risk detection, solves the technical problem of low efficiency in transaction risk detection, and thereby achieves the technical effect of reducing the disturbance rate to normal transaction users and improving the efficiency and accuracy of transaction risk detection.

[0065] It should be noted that the above modules can be implemented by software or hardware. For example, for the latter, it can be implemented in the following ways: the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0066] It should be noted that the acquisition module 31, risk detection module 32, and determination module 33 described above correspond to steps S102 to S106 in the embodiment. The examples and application scenarios implemented by these modules and corresponding steps are the same, but are not limited to the contents disclosed in the above embodiment. It should be noted that these modules, as part of the device, can be run on a computer terminal.

[0067] It should be noted that the optional or preferred implementation of this embodiment can be found in the relevant description in the embodiment, which will not be repeated here.

[0068] The above-mentioned transaction behavior risk detection device may also include a processor and a memory. The acquisition module 31, risk detection module 32, determination module 33, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize corresponding functions.

[0069] The processor includes a kernel, which retrieves the corresponding program unit from memory. There can be one or more kernels. Memory may include non-permanent memory in a computer-readable medium, random access memory (RAM), and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory includes at least one memory chip.

[0070] An embodiment of the present invention provides a non-volatile storage medium having a program stored thereon, which implements a transaction behavior risk detection method when executed by a processor.

[0071] like Figure 4 As shown, an embodiment of the present invention provides an electronic device, the electronic device 10 includes a processor, a memory, and a program stored in the memory and runnable on the processor. When the processor executes the program, the following steps are implemented: the memory is used to store a computer program, wherein, when the computer program is executed by the processor, the processor implements the above-mentioned transaction behavior risk detection method. The device in this article can be a server, PC, etc.

[0072] The present invention also provides a computer program product which, when executed on a data processing device, is suitable for executing a program which is initialized with the following method steps: computer instructions are executed by a processor to perform the above-mentioned transaction behavior risk detection method.

[0073] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0074] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0075] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0076] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0077] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0078] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0079] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0080] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0081] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0082] The above are merely embodiments of the present invention and are not intended to limit the present invention. It will be apparent to those skilled in the art that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention are intended to be included within the scope of the claims of the present invention.

Claims

1. A transaction behavior risk detection method, characterized in that: include: Acquiring historical transaction behavior data based on a target account, wherein the historical transaction behavior data is used to describe characteristics of transaction behavior based on the target account; performing risk detection on the current transaction behavior data of the target account based on the historical transaction behavior data based on a plurality of pre-set risk detection strategies, thereby obtaining a plurality of risk detection results, wherein the plurality of risk detection strategies require different resources to run; When a risk detection result indicating a normal transaction status appears for the first time, determining that the final risk detection result of the current transaction behavior data is a normal transaction status; or, when the multiple risk detection results all indicate an abnormal transaction status, determining that the final risk detection result of the current transaction behavior data is an abnormal transaction status; Among them, the risk detection is performed on the current transaction behavior data of the target account based on the historical transaction behavior data in sequence based on the pre-set multiple risk detection strategies to obtain multiple risk detection results, including: sorting the multiple risk detection strategies in the order of increasing required resources to obtain a risk detection sequence; according to the risk detection sequence, the multiple risk detection strategies are sequentially adopted to perform risk detection on the current transaction behavior data of the target account based on the historical transaction behavior data to obtain multiple risk detection results.

2. The method according to claim 1, characterized in that In accordance with the risk detection order, the multiple risk detection strategies are sequentially adopted, and based on the historical transaction behavior data, risk detection is performed on the current transaction behavior data of the target account to obtain multiple risk detection results, including: According to the risk detection order and based on the first risk detection strategy, matching the Internet device corresponding to the current transaction behavior data with the Internet device corresponding to the historical transaction behavior data; If the Internet device corresponding to the current transaction behavior data of the target account matches the Internet device corresponding to the historical transaction behavior data, directly determining that the final risk detection result of the current transaction behavior data is a normal transaction status; When the Internet device corresponding to the current transaction behavior data does not match the Internet device corresponding to the historical transaction behavior data, a first risk detection result of abnormal transaction status is obtained, and other strategies among the multiple risk detection strategies except the first risk detection strategy are continued to be used to perform risk detection on the current transaction behavior data.

3. The method according to claim 2, characterized in that When the Internet device corresponding to the current transaction behavior data does not match the Internet device corresponding to the historical transaction behavior data, obtaining a first risk detection result indicating abnormal transaction status, and continuing to use other strategies among the multiple risk detection strategies except the first risk detection strategy to perform risk detection on the current transaction behavior data, including: According to the risk detection order, based on the second risk detection strategy, matching at least one of the following features in the current transaction behavior data: transaction amount, transaction time, transaction location, and login frequency; When the selected feature matches a predetermined threshold, directly determining the final risk detection result of the current transaction behavior data as a normal transaction status; When the selected feature does not match the predetermined threshold, a second risk detection result indicating an abnormal transaction status is obtained, and other strategies among the multiple risk detection strategies except the first risk detection strategy and the second risk detection strategy are continued to be used to perform risk detection on the current transaction behavior data.

4. The method according to claim 3, characterized in that In the case where the selected feature does not match the predetermined threshold, a second risk detection result indicating an abnormal transaction status is obtained, and other strategies among the multiple risk detection strategies except the first risk detection strategy and the second risk detection strategy are continuously used to perform risk detection on the current transaction behavior data, including: Building a risk assessment model based on the historical transaction behavior data in accordance with the risk detection sequence, and inputting the current transaction behavior data into the risk assessment model; Obtaining a score value for the current transaction behavior data according to the risk assessment model; If the score value of the current transaction behavior data is less than a predetermined score threshold, determining that the final risk detection result of the current transaction behavior data is a normal transaction status; When the score value of the current transaction behavior data is greater than or equal to a predetermined score threshold, it is determined that the final risk detection result of the current transaction behavior data is an abnormal transaction status.

5. The method according to claim 1, wherein Also includes: The final risk detection result of the current transaction behavior data is recorded in the historical transaction behavior data, and the historical transaction behavior data is updated.

6. A transaction behavior risk detection device, characterized in that: include: an acquisition module, configured to acquire historical transaction behavior data based on a target account, wherein the historical transaction behavior data is used to describe characteristics of transaction behavior based on the target account; a risk detection module, configured to sequentially perform risk detection on the current transaction behavior data of the target account based on the historical transaction behavior data based on a plurality of pre-set risk detection strategies, and obtain a plurality of risk detection results, wherein the plurality of risk detection strategies require different resources to run; a determination module configured to determine, when a risk detection result indicating a normal transaction status appears for the first time, that the final risk detection result of the current transaction behavior data is a normal transaction status; or, when all of the multiple risk detection results indicate an abnormal transaction status, determine that the final risk detection result of the current transaction behavior data is an abnormal transaction status; Among them, the risk detection module is also used to sort the multiple risk detection strategies in the order of increasing required resources to obtain a risk detection order; according to the risk detection order, the multiple risk detection strategies are adopted in turn, and based on the historical transaction behavior data, the current transaction behavior data of the target account is subjected to risk detection to obtain multiple risk detection results.

7. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executed by the transaction behavior risk detection method according to any one of claims 1 to 5.

8. An electronic device, characterized in that: include: One or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the transaction behavior risk detection method described in any one of claims 1 to 5.

9. A computer program product comprising computer instructions, characterized in that The computer instructions are executed by the processor to implement the transaction behavior risk detection method described in any one of claims 1 to 5.

Images