Account anomaly detection method and system

Abstract

The present invention relates to the field of information detection technology, and discloses an account anomaly detection method and system, including a data acquisition module, a data preprocessing module, a data analysis module, a dynamic rating module, a response processing module and a feedback module. Through the collaborative work of multiple modules, the method can more accurately identify abnormal behaviors, reduce false alarm rates, and effectively prevent adversarial attacks. The dynamic threshold adjustment and hierarchical response mechanism of the method improve real-time performance and user experience, adapt to complex and changeable network environments, improve account security, enhance the ability to respond to sudden attacks, and through a continuous optimization mechanism, the method has more efficient and intelligent security protection capabilities.

Description

Technical Field

[0001] The present invention relates to the technical field of information detection, and in particular to an account anomaly detection method and system. Background Art

[0002] Account anomaly detection is a key technology that aims to identify potential abnormal activities (such as account theft, fraudulent transactions, and automated attacks) by analyzing user behavior data (such as logins, transactions, and operation records). With the acceleration of digitalization, account anomaly detection has become a core security component of various online services to protect user assets and data privacy.

[0003] Although existing technologies have achieved certain results in account anomaly detection, there are still significant shortcomings. First, the false alarm rate is high, and static rules or single models are difficult to adapt to complex and changeable user behaviors, resulting in normal operations being misjudged as abnormal, affecting user experience. Secondly, the ability to defend against adversarial attacks is insufficient. Existing methods have limited ability to identify adversarial samples (such as forged behaviors and automated tools) and are easily bypassed by attackers. In addition, dynamic adaptability is poor, and fixed thresholds and offline training modes cannot respond to scenario changes in real time (such as a surge in traffic during holidays). Finally, the lack of interpretability makes it difficult for black box models to provide intuitive risk attribution, which increases the difficulty of manual review. These problems seriously restrict the accuracy and practicality of account anomaly detection, and a smarter and more robust solution is urgently needed.

[0004] Therefore, we propose an account anomaly detection method and system to solve the above problems. Summary of the invention

[0005] The purpose of the present invention is to provide an account anomaly detection method to solve the problem that the false alarm rate is high, static rules or single models are difficult to adapt to complex and changeable user behaviors, resulting in normal operations being misjudged as abnormal, affecting user experience. Secondly, the ability to defend against attacks is insufficient, and the existing methods have limited ability to identify adversarial samples (such as forged behaviors and automated tools), which can be easily bypassed by attackers.

[0006] To achieve the above object, the present invention provides the following technical solution: an account anomaly detection method, comprising a data acquisition module, a data preprocessing module, a data analysis module, a dynamic rating module, a response processing module and a feedback module, and the specific steps are as follows: S1. Collect the user's real-time behavior data through the data collection module, retrieve the user's historical behavior data, and input the user's real-time behavior data and the user's historical behavior data into the data preprocessing module; S2. Cleaning and dimensionlessizing the user real-time behavior data and user historical behavior data collected by the data collection module through the data preprocessing module, and reorganizing them into real-time data sets and historical data sets; S3, analyzing the real-time data set and the historical data set generated by the data preprocessing module through the data analysis module, and obtaining the real-time user behavior feature risk coefficient SF1, the real-time device environment risk coefficient SF2, the real-time context feature risk coefficient SF3, the historical user behavior feature risk coefficient LF1, the historical device environment risk coefficient LF2 and the historical context feature risk coefficient LF3, the first dynamic threshold value Y1 and the penalty coefficient CF and the second dynamic threshold value Y2 through calculation; S4. Comparing and analyzing the risk coefficient generated by the data analysis module with the dynamic threshold through the dynamic rating module to generate a first comparison result and a second comparison result, judging whether the current account has abnormal behavior according to the first comparison result and the second comparison result, and classifying the abnormal behavior magnitude based on the first comparison result and the second comparison result; S5. Through the response processing module, on the basis of the magnitude division based on the dynamic rating module, matching warning measures are carried out, and the alarm information is sent through the feedback module.

[0007] Preferably, in step S1, the data of the data collection module set includes a user behavior feature data group, a device environment data group, and a context feature data group; The user behavior feature data group includes real-time login frequency, real-time transaction amount fluctuation, real-time behavior sequence abnormality and real-time transaction frequency, historical login frequency, historical transaction amount fluctuation, historical behavior sequence abnormality and historical transaction frequency; Device environment data includes real-time device ID change frequency, real-time IP address change frequency, real-time device type distribution frequency, real-time login device geographic location offset, historical device ID change frequency, historical IP address change frequency, historical device type distribution frequency, and historical login device geographic location offset; The context feature data includes real-time login time abnormalities, real-time social behavior changes, real-time capital flow patterns, real-time activity range changes, historical login time abnormalities, historical social behavior changes, historical capital flow patterns, and historical activity range changes.

[0008] Preferably, in step S2, the real-time data set and the historical data set generated by the data preprocessing module are specifically as follows: The real-time data set includes real-time login frequency A, real-time transaction amount fluctuation B, real-time behavior sequence abnormality C, real-time transaction frequency D, real-time device ID change frequency E, real-time IP address change frequency F, real-time device type distribution frequency G, real-time login device geographic location offset H, real-time login time abnormality I, real-time social behavior change J, real-time capital flow pattern K, and real-time activity range change L; The historical data set includes: historical login frequency, historical transaction amount fluctuations, historical behavior sequence abnormality and historical transaction frequency, historical device ID change frequency, historical IP address change frequency, historical device type distribution frequency and historical login device geographic location offset, historical login time abnormality, historical social behavior changes, historical capital flow patterns and historical activity range changes; The historical login frequencies FA are recorded as FA1, FA2, FA3, ..., FAn-1, FAn according to the timestamps; The historical transaction amount fluctuations FB are recorded as FB1, FB2, FB3, ..., FBn-1, FAn according to the timestamps; The abnormality degree FC of the historical behavior sequence is recorded as FC1, FC2, FC3, ..., FCn-1, FCn according to the timestamp; The historical transaction frequencies FD are recorded as FD1, FD2, FD3, ..., FDn-1, FDn according to the timestamps; The historical equipment ID change frequencies FE are recorded as FE1, FE2, FE3, ..., FEn-1, FEn according to the timestamp; The historical IP address change frequency FF is recorded as FF1, FF2, FF3, ..., FFn-1, FFn according to the timestamp; The historical equipment type distribution frequency FG is recorded as FG1, FG2, FG3, ..., FGn-1, FGn according to the timestamp; The geographical location offsets FH of historical login devices are recorded as FH1, FH2, FH3, ..., FHn-1, FHn according to the timestamps; The historical login time abnormality FIs are recorded as FI1, FI2, FI3, ..., FIn-1, FIn according to the timestamp; The historical social behavior changes FJ are recorded as FJ1, FJ2, FJ3, ..., FJn-1, FJn according to the timestamps; The historical fund flow pattern FK is recorded as FK1, FK2, FK3, ..., FKn-1, FKn according to the timestamp; The historical activity range changes FL are recorded as FL1, FL2, FL3, ..., FLn-1, FLn according to the timestamps.

[0009] Preferably, in step S3, the data analysis module obtains the user behavior feature risk coefficient, the device environment risk coefficient, the context feature risk coefficient, the first dynamic threshold and the penalty coefficient, and the second dynamic threshold through the following steps: S3.1. The data analysis module calculates the real-time data set and the historical data set to obtain the real-time user behavior feature risk coefficient SF1, the real-time device environment risk coefficient SF2, the real-time context feature risk coefficient SF3, the historical user behavior feature risk coefficient LF1, the historical device environment risk coefficient LF2, and the historical context feature risk coefficient LF3; S3.2, the data analysis module generates a first dynamic threshold and a penalty coefficient by integrating and calculating the historical data set; S3.3. The data analysis module integrates and calculates the first dynamic threshold and the penalty coefficient to generate a second dynamic coefficient.

[0010] Preferably, the real-time user behavior feature risk coefficient SF1, the real-time device environment risk coefficient SF2, the real-time context feature risk coefficient SF3, the historical user behavior feature risk coefficient LF1, the historical device environment risk coefficient LF2 and the historical context feature risk coefficient LF3 are calculated and obtained by the following formula: ; ; ; ; ; ; Where: A is the real-time login frequency, B is the real-time transaction amount fluctuation, C is the real-time behavior sequence abnormality, D is the real-time transaction frequency, E is the real-time device ID change frequency, F is the real-time IP address change frequency, G is the real-time device type distribution frequency, H is the real-time login device geographic location offset, I is the real-time login time abnormality, J is the real-time social behavior change, K is the real-time capital flow pattern, and L is the real-time activity range change; FAn is the historical login frequency at timestamp n, FBn is the historical transaction amount fluctuation at timestamp n, FCn is the historical behavior sequence abnormality at timestamp n, FDn is the historical transaction frequency at timestamp n, FEn is the historical device ID change frequency at timestamp n, FFn is the historical IP address change frequency at timestamp n, FGn is the historical device type distribution frequency at timestamp n, FHn is the historical login device geographic location offset at timestamp n, FIn is the historical login time abnormality at timestamp n, FJn is the historical social behavior change at timestamp n, FKn is the historical capital flow pattern at timestamp n, and FLn is the historical activity range change at timestamp n; FAn-1 is the historical login frequency at timestamp n-1, FBn-1 is the historical transaction amount fluctuation at timestamp n-1, FCn-1 is the historical behavior sequence abnormality at timestamp n-1, FDn-1 is the historical transaction frequency at timestamp n-1, FEn-1 is the historical device ID change frequency at timestamp n-1, FFn-1 is the historical IP address change frequency at timestamp n-1, FGn-1 is the historical device type distribution frequency at timestamp n-1, FHn-1 is the historical login device geographic location offset at timestamp n-1, FIn-1 is the historical login time abnormality at timestamp n-1, FJn-1 is the historical social behavior change at timestamp n-1, FKn-1 is the historical capital flow pattern at timestamp n-1, and FLn-1 is the historical activity range change at timestamp n-1.

[0011] Preferably, the first dynamic threshold Y1 and the penalty coefficient CF are calculated and obtained by the following formulas respectively: ; ; Where: Z1 is the first proxy function, which is filled with the real-time user behavior feature risk coefficient SF1, the real-time device environment risk coefficient SF2, and the real-time context feature risk coefficient SF3; Z2 is the second proxy function, which is filled with the historical user behavior feature risk coefficient LF1, the historical device environment risk coefficient LF2, and the historical context feature risk coefficient LF3; b1 and b2 are weight values, and the values ​​of b1 and b2 are adjusted and set by the user.

[0012] Preferably, the second dynamic threshold Y2 is calculated by the following formula: ; Where: Y1 is the first dynamic threshold, CF is the penalty coefficient.

[0013] Preferably, in step S4, the dynamic rating module generates the first comparison result and the second comparison result through the following steps: S4.1. Compare the user behavior feature risk coefficient, the device environment risk coefficient, and the context feature risk coefficient with the first dynamic threshold respectively, thereby generating a first comparison result; The first comparison results are as follows: when When , it means that the risk coefficient of user behavior characteristics, the risk coefficient of device environment, and the risk coefficient of context characteristics are all normal; when When , it means that there is no abnormality in the risk coefficient of user behavior characteristics, device environment risk coefficient, and contextual characteristic risk coefficient; Z1 is the first proxy function, which is filled with the user behavior feature risk coefficient, device environment risk coefficient, and context feature risk coefficient respectively, and Y1 is the first dynamic threshold; S4.2, the user behavior feature risk coefficient, the device environment risk coefficient, and the context feature risk coefficient are respectively compared with the second dynamic threshold to generate a second comparison result; The second comparison results are as follows: when When , it means that the risk coefficient of user behavior characteristics, the risk coefficient of device environment, and the risk coefficient of context characteristics are all normal; when When , it means that there is no abnormality in the risk coefficient of user behavior characteristics, device environment risk coefficient, and contextual characteristic risk coefficient; Z1 is the first proxy function, which is filled with the user behavior feature risk coefficient, device environment risk coefficient, and context feature risk coefficient respectively, and Y2 is the second dynamic threshold; S4.3, based on the first comparison result and the second comparison result, generate a magnitude classification, as follows: when , which means no risk; when When only one of the user behavior risk factor, device environment risk factor, and context feature risk factor is abnormal, it means that a level 1 risk is currently present; when When any two of the user behavior risk factor, device environment risk factor, and contextual risk factor are abnormal, it means that a secondary risk has occurred. when When the user behavior feature risk factor, device environment risk factor, and context feature risk factor are all abnormal, it means that a third-level risk exists.

[0014] Preferably, in step S5, the specific alarm method is as follows: When a level 1 risk occurs, the internal intelligent voice system will call the user and record the call, while also sending a transaction reminder message; When secondary risks occur, the internal intelligent voice system will call the user and record the call, send transaction reminder information, and mark the transaction account; When a third-level risk occurs, the account will be frozen urgently, and a call will be made to the user through the internal intelligent voice system and recorded. If the call is not answered within 10 seconds, an emergency call will be made to the relevant department. At the same time, a transaction reminder message will be sent to the user and the transaction account will be marked.

[0015] The present application also includes an account anomaly detection system, including a data acquisition module, a data preprocessing module, a data analysis module, a dynamic rating module, a response processing module, and a feedback module; The data acquisition module obtains the user's behavior data and historical behavior data in real time and passes it to the data preprocessing module; The data preprocessing module cleans and dimensionlessly processes the data to generate standardized real-time and historical data sets; The data analysis module analyzes the collated data set and calculates various risk factors, dynamic thresholds and penalty coefficients CF; The dynamic rating module compares the risk coefficient and the dynamic threshold, generates a first comparison result and a second comparison result, and divides the risk level according to the results; The response processing module takes corresponding warning measures according to the risk level; The feedback module will promptly feed back the processing results to the user and generate alarm information for relevant personnel to handle according to the situation.

[0016] Compared with the prior art, the present invention has the following beneficial effects: 1. Through the collaborative work of multiple modules, this method can more accurately identify abnormal behaviors, reduce false alarm rates, and effectively prevent adversarial attacks. The dynamic threshold adjustment and hierarchical response mechanism of this method improves real-time performance and user experience, and adapts to complex and changing network environments. Overall, this method improves account security, enhances the ability to respond to sudden attacks, and through continuous optimization mechanisms, makes this method more efficient and intelligent in security protection.

[0017] 2. This method can comprehensively evaluate user risks from multiple dimensions. This multi-dimensional risk analysis method can more accurately identify complex abnormal behaviors. If a user frequently changes devices or login locations and still shows normal transaction patterns, this method can comprehensively evaluate these changes to determine whether there are potential security risks. This method can effectively identify and defend against various disguised attacks. Attackers usually disguise themselves as normal users to attack by changing devices, IP addresses, etc., and this method can detect these abnormal behaviors in a timely manner through a multi-dimensional risk assessment and dynamic adjustment mechanism, thereby enhancing the protection capabilities of this method. Therefore, this method has a strong ability to resist attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a diagram of the method steps of the present invention.

[0019] Figure 2 It is a system flow chart of the present invention.

[0020] In the figure: 1. Data acquisition module; 2. Data preprocessing module; 3. Data analysis module; 4. Dynamic rating module; 5. Response processing module; 6. Feedback module. DETAILED DESCRIPTION

[0021] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0022] Example 1: Please refer to Figure 1 , an account anomaly detection method, including a data collection module 1, a data preprocessing module 2, a data analysis module 3, a dynamic rating module 4, a response processing module 5 and a feedback module 6, the specific steps are as follows: S1, collect the user's real-time behavior data through the data collection module 1, retrieve the user's historical behavior data, and input the user's real-time behavior data and the user's historical behavior data into the data preprocessing module 2; S2, cleaning and dimensionless the user real-time behavior data and user historical behavior data collected by the data collection module 1 through the data preprocessing module 2, and reorganizing them into real-time data sets and historical data sets; S3, analyzing the real-time data set and the historical data set generated by the data preprocessing module 2 through the data analysis module 3, and obtaining the real-time user behavior feature risk coefficient SF1, the real-time device environment risk coefficient SF2, the real-time context feature risk coefficient SF3, the historical user behavior feature risk coefficient LF1, the historical device environment risk coefficient LF2 and the historical context feature risk coefficient LF3, the first dynamic threshold value Y1 and the penalty coefficient CF and the second dynamic threshold value Y2 through calculation; S4, comparing and analyzing the risk coefficient generated by the data analysis module 3 with the dynamic threshold through the dynamic rating module 4, generating a first comparison result and a second comparison result, judging whether the current account has abnormal behavior according to the first comparison result and the second comparison result, and dividing the abnormal behavior magnitude based on the first comparison result and the second comparison result; S5. Through the response processing module 5, based on the magnitude classification of the dynamic rating module 4, matching warning measures are taken, and the alarm information is sent through the feedback module 6.

[0023] In this embodiment: In step S1, the data collection module 1 is responsible for collecting the user's real-time behavior data and retrieving the user's historical behavior data. The real-time behavior data includes the current login frequency, operation sequence, device fingerprint, IP address, geographic location, etc., while the historical behavior data includes the login records, operation modes, commonly used devices, etc. in the past 30 or 90 days. By combining real-time and historical data, the data collection module 1 constructs a complete user behavior portrait, solving the problem of data islands in traditional methods.

[0024] In step S2, the data preprocessing module 2 cleans and dimensionlessly processes the real-time behavior data and historical behavior data collected by the data collection module 1. Data cleaning includes removing noise data, while dimensionlessly processing maps features of different scales into a unified range through a standardized method.

[0025] In step S3, the data analysis module 3 performs an in-depth analysis on the preprocessed real-time data set and historical data set, and generates multiple key parameters through calculation. First, it calculates the real-time risk coefficient, including the user behavior feature risk coefficient SF1, the device environment risk coefficient SF2, and the context feature risk coefficient SF. Secondly, the data analysis module 3 also calculates the historical risk coefficient, including the user behavior feature risk coefficient LF1, the device environment risk coefficient LF2, and the context feature risk coefficient LF. Finally, the data analysis module 3 combines real-time and historical data to dynamically generate the first dynamic threshold value Y1, the second dynamic threshold value Y2, and the penalty coefficient CF.

[0026] In step S4, the dynamic rating module 4 compares and analyzes the risk factor generated by the data analysis module 3 with the dynamic threshold, and generates a first comparison result and a second comparison result. The first comparison result is to compare the real-time risk factor with the first dynamic threshold Y1 to determine whether a primary anomaly is triggered. In this way, the method can adapt to the operational requirements of different risk levels, while ensuring account security, reducing interference and accidental injuries to users.

[0027] In step S5, the response processing module 5 takes corresponding warning measures according to the magnitude classification of the dynamic rating module 4. For low-risk behaviors, this method may send a text message verification code; for medium-risk behaviors, this method requires the user to perform secondary authentication; for high-risk behaviors, this method directly freezes the account and triggers an alarm. At the same time, the feedback module 6 collects false positives and missed negatives, updates model parameters and adversarial sample libraries, and optimizes detection performance. If a device is misjudged as high risk, this method will record the case and adjust the evaluation weight of the device fingerprint. The beneficial effect of this step is that it blocks attack behaviors while minimizing user friction, and adapts to new attack modes through online learning mechanisms, thereby achieving rapid disposal and continuous optimization. Through this intelligent feedback and update mechanism, this method can not only efficiently respond to various attacks in the short term, but also improve its long-term protection capabilities through historical data and feedback.

[0028] Through the above steps, this method achieves multi-dimensional optimization of account anomaly detection. Through the collaborative work of multiple modules, this method can more accurately identify abnormal behavior, reduce false alarm rate, and effectively prevent adversarial attacks. The dynamic threshold adjustment and hierarchical response mechanism of this method improve real-time performance and user experience, and adapt to complex and changing network environments. Overall, this method improves account security, enhances the ability to respond to sudden attacks, and through continuous optimization mechanisms, makes this method have more efficient and intelligent security protection capabilities.

[0029] Example 2: Please refer to Figure 1 ,In step S1, the data collected by the data collection module 1 includes a user behavior feature data group, a device environment data group, and a context feature data group; The user behavior feature data group includes real-time login frequency, real-time transaction amount fluctuation, real-time behavior sequence abnormality, real-time transaction frequency, historical login frequency, historical transaction amount fluctuation, historical behavior sequence abnormality and historical transaction frequency; Device environment data includes real-time device ID change frequency, real-time IP address change frequency, real-time device type distribution frequency, real-time login device geographic location offset, historical device ID change frequency, historical IP address change frequency, historical device type distribution frequency, and historical login device geographic location offset; The context feature data includes real-time login time abnormalities, real-time social behavior changes, real-time capital flow patterns, real-time activity range changes, historical login time abnormalities, historical social behavior changes, historical capital flow patterns, and historical activity range changes.

[0030] In this embodiment: In this method, the data collection module 1 can comprehensively obtain various types of information about user behavior, device environment and contextual features by combining the collection of real-time and historical data, and build a refined user behavior portrait. Compared with the traditional single data source, this multi-dimensional data collection method greatly enhances the ability to capture user behavior patterns. By combining real-time data and historical data, a comprehensive analysis of user behavior can be ensured. Real-time data such as the user's real-time login frequency, operation sequence, device fingerprint, IP address, geographic location, etc. can directly reflect the user's current activity status, while historical data provides a stable behavior baseline for this method, which helps to identify potential abnormal behavior.

[0031] This method can more accurately determine whether there is abnormal behavior and significantly reduce the false alarm rate by comprehensively analyzing user behavior, device environment and context features. Traditional methods often rely on only a single feature for anomaly detection, which can easily misjudge some occasional but non-abnormal behaviors as abnormalities. This method can accurately judge user behavior by integrating features from multiple dimensions. This method can dynamically adjust the detection strategy based on the comparison of the user's historical login frequency, transaction amount fluctuations and other behavioral patterns with the current behavior. If a user logs in frequently, but the behavior occurs on their commonly used devices and locations, then even if the behavior deviates from historical records, this method can judge it as normal behavior and avoid misjudging it as abnormal.

[0032] This method combines real-time data and historical data, and can adapt to different scenarios through comparative analysis and dynamic threshold adjustment. In traditional account anomaly detection methods, fixed thresholds cannot effectively cope with complex changes in business scenarios, and are prone to false positives or missed reports. By combining real-time data on user behavior, this method can dynamically adjust the sensitivity to user behavior based on factors such as traffic fluctuations during holidays and special periods. During holidays, users' login frequency and transaction frequency usually fluctuate to a certain extent, and traditional methods may misjudge them as abnormal behavior, but this method can avoid such excessive interception by dynamically adjusting the threshold, thereby improving the adaptability of this method.

[0033] This method pays special attention to the monitoring of device environment data, and can effectively identify and prevent malicious attackers from impersonating others by forging devices or IP addresses. Compared with traditional single model detection methods, this method can better identify complex attack behaviors, such as automated tools, forged account operations, etc., through multi-dimensional feature fusion. This method can timely identify abnormal device behavior by comparing device environment information in real-time and historical data. When this method detects that a user logs in from an unconventional device or geographical location, an alert is immediately generated and corresponding measures are taken, such as requiring the user to perform additional identity authentication or freezing the account to prevent further losses.

[0034] In the actual application of account anomaly detection, overly strict security detection may greatly affect the user experience, and frequent identity authentication, password reset and other operations may cause inconvenience to users. This method effectively balances security and user experience through multi-dimensional data fusion and dynamic threshold setting. This method will take corresponding measures according to the severity and risk level of abnormal behavior. For low-risk behaviors, this method can choose to only perform SMS verification or send reminders, while for high-risk behaviors, this method will immediately freeze the account and even require the user to provide additional verification information. This hierarchical response strategy minimizes interference with users' normal operations while ensuring account security.

[0035] This method significantly improves the accuracy and adaptability of account anomaly detection by integrating user behavior characteristics, device environment data, and context feature data. Compared with traditional methods, this method can comprehensively analyze the multi-dimensional behavior of users, reduce false alarm rates, and improve detection accuracy. By dynamically adjusting the detection threshold and adopting a graded response mechanism, this method can not only accurately identify abnormal behavior, but also optimize the user experience while ensuring security. In terms of defending against attacks, this method can more effectively identify and prevent attackers from bypassing detection through fake behavior, automated tools, and other means through multi-dimensional feature fusion.

[0036] Example 3: Please refer to Figure 1 In step S2, the real-time data set and historical data set generated by the data preprocessing module 2 are as follows: The real-time data set includes real-time login frequency A, real-time transaction amount fluctuation B, real-time behavior sequence abnormality C, real-time transaction frequency D, real-time device ID change frequency E, real-time IP address change frequency F, real-time device type distribution frequency G, real-time login device geographic location offset H, real-time login time abnormality I, real-time social behavior change J, real-time capital flow pattern K, and real-time activity range change L; The historical data set includes: historical login frequency, historical transaction amount fluctuations, historical behavior sequence abnormality and historical transaction frequency, historical device ID change frequency, historical IP address change frequency, historical device type distribution frequency and historical login device geographic location offset, historical login time abnormality, historical social behavior changes, historical capital flow patterns and historical activity range changes; The historical login frequencies FA are recorded as FA1, FA2, FA3, ..., FAn-1, FAn according to the timestamps; The historical transaction amount fluctuations FB are recorded as FB1, FB2, FB3, ..., FBn-1, FAn according to the timestamps; The abnormality degree FC of the historical behavior sequence is recorded as FC1, FC2, FC3, ..., FCn-1, FCn according to the timestamp; The historical transaction frequencies FD are recorded as FD1, FD2, FD3, ..., FDn-1, FDn according to the timestamps; The historical equipment ID change frequencies FE are recorded as FE1, FE2, FE3, ..., FEn-1, FEn according to the timestamp; The historical IP address change frequency FF is recorded as FF1, FF2, FF3, ..., FFn-1, FFn according to the timestamp; The historical equipment type distribution frequency FG is recorded as FG1, FG2, FG3, ..., FGn-1, FGn according to the timestamp; The geographical location offsets FH of historical login devices are recorded as FH1, FH2, FH3, ..., FHn-1, FHn according to the timestamps; The historical login time abnormality FIs are recorded as FI1, FI2, FI3, ..., FIn-1, FIn according to the timestamp; The historical social behavior changes FJ are recorded as FJ1, FJ2, FJ3, ..., FJn-1, FJn according to the timestamps; The historical fund flow pattern FK is recorded as FK1, FK2, FK3, ..., FKn-1, FKn according to the timestamp; The historical activity range changes FL are recorded as FL1, FL2, FL3, ..., FLn-1, FLn according to the timestamps.

[0037] In this embodiment: By refining the real-time data set and the historical data set in step S2, the method can provide more accurate account anomaly detection. The detailed records and timestamp identification of historical data provide the basis for long-term trend analysis and personalized detection for the method, so that the method can perform real-time comparison and anomaly identification based on the user's historical behavior patterns. In addition, the integration of historical data also improves the defense capability against attacks and enhances the dynamic adaptability and real-time response capability of the method. Through this method of combining real-time and historical data, the method can greatly improve the accuracy, flexibility and robustness of account anomaly detection, and effectively respond to diverse attack methods and complex user behavior patterns.

[0038] This method can provide more comprehensive and longer-term data support for account anomaly detection by combining real-time data sets with historical data sets. Real-time data sets can reflect the current state of user behavior, while historical data sets can provide trend information on user past behavior. By comparing and analyzing real-time data with historical data, this method can more accurately identify sudden abnormal behaviors. If the user's historical login frequency is very stable, but a large number of frequent logins occur in a certain period of time, this method can mark the behavior as abnormal and further analyze whether there is a security risk.

[0039] The historical data set is recorded in detail according to the timestamp, which can provide accurate historical behavior pattern analysis for this method. This time-series recording method enables this method to identify long-term trends and short-term fluctuations. By analyzing various types of historical behavior data, this method can establish the typical behavior pattern of users and detect behaviors that deviate from this pattern. When the real-time data deviates from the user's historical behavior pattern, this method will automatically issue a warning to indicate potential anomalies.

[0040] Each user has different behavioral characteristics, device environment, and contextual characteristics. This method can provide a personalized anomaly detection mechanism for each user through fine-grained analysis of historical data. The combination of real-time data and historical data makes the behavioral model of each user more accurate. For a specific user, this method can set a personalized behavioral benchmark based on the user's past login device ID, IP address, device type and other historical data, and then perform real-time detection and response when the user's behavior deviates. Compared with traditional global models, this method can greatly improve the accuracy and personalization of detection.

[0041] By combining the timestamp recording of historical data with the monitoring of real-time data, this method has the ability to dynamically adapt and can respond quickly to changing user behaviors and external environments. The combination of real-time and historical data sets provides this method with information on different time scales, ensuring that this method can flexibly adjust thresholds and risk assessment criteria when faced with scenarios such as sudden traffic surges and holiday effects, thereby effectively avoiding excessive interception or underreporting. During specific periods such as holidays, users' social behaviors, capital flow patterns, activity ranges and other characteristics may change to a certain extent. This method can adjust the criteria for determining abnormal behaviors based on similar patterns in historical data to ensure the accuracy of detection results.

[0042] Based on historical data recorded by timestamp, this method can identify more complex attack patterns, especially in defense against adversarial attacks. By recording historical device changes, IP address fluctuations and other information in detail, this method can promptly identify counterfeiting, IP address spoofing, automated attacks and other means. When an attacker disguises himself as a user and logs in frequently, this method can promptly detect anomalies by comparing the normal behavior patterns in the same time period in the historical data with the deviations in the real-time data. Based on historical data, this method can also identify subtle changes in long-term behavior and more effectively prevent attacks from adversarial samples.

[0043] Various timestamp records in the historical data set provide strong data support for risk assessment and dynamic threshold adjustment. Data such as historical login frequency and transaction amount fluctuations can serve as the basis for building a normal user behavior model, while historical social behavior changes and historical capital flow patterns can help this method assess the risk level of users in a specific period. Through continuous learning and adjustment, this method can refine and optimize the dynamic threshold based on historical data, ensuring that normal behavior is not misjudged during the detection process, and abnormal behavior can be captured in a timely manner.

[0044] The historical data recorded by timestamp provides the necessary training data for the long-term learning and continuous optimization of the model. During the model training process, this method can continuously adjust based on historical data to optimize the ability to identify abnormal behaviors. Through the fine-grained recording of historical data, this method can continuously learn and adapt to the evolution of user behavior, thereby improving the accuracy and robustness of detection. Whenever this method encounters a new attack or abnormal pattern, the historical data provides it with "historical lessons", allowing the detection method to gradually improve its anti-attack capabilities.

[0045] Example 4: Please refer to Figure 1 In step S3, the data analysis module 3 obtains the user behavior feature risk coefficient, the device environment risk coefficient, the context feature risk coefficient, the first dynamic threshold and the penalty coefficient, and the second dynamic threshold through the following steps: S3.1, the data analysis module 3 calculates the real-time data set and the historical data set to obtain the real-time user behavior feature risk coefficient SF1, the real-time device environment risk coefficient SF2, the real-time context feature risk coefficient SF3, the historical user behavior feature risk coefficient LF1, the historical device environment risk coefficient LF2 and the historical context feature risk coefficient LF3; S3.2, the data analysis module 3 generates a first dynamic threshold and a penalty coefficient by integrating and calculating the historical data set; S3.3, the data analysis module 3 integrates and calculates the first dynamic threshold and the penalty coefficient to generate a second dynamic coefficient.

[0046] The real-time user behavior feature risk coefficient SF1, the real-time device environment risk coefficient SF2, the real-time context feature risk coefficient SF3, the historical user behavior feature risk coefficient LF1, the historical device environment risk coefficient LF2, and the historical context feature risk coefficient LF3 are calculated using the following formula: ; ; ; ; ; ; Where: A is the real-time login frequency, B is the real-time transaction amount fluctuation, C is the real-time behavior sequence abnormality, D is the real-time transaction frequency, E is the real-time device ID change frequency, F is the real-time IP address change frequency, G is the real-time device type distribution frequency, H is the real-time login device geographic location offset, I is the real-time login time abnormality, J is the real-time social behavior change, K is the real-time capital flow pattern, and L is the real-time activity range change; FAn is the historical login frequency at timestamp n, FBn is the historical transaction amount fluctuation at timestamp n, FCn is the historical behavior sequence abnormality at timestamp n, FDn is the historical transaction frequency at timestamp n, FEn is the historical device ID change frequency at timestamp n, FFn is the historical IP address change frequency at timestamp n, FGn is the historical device type distribution frequency at timestamp n, FHn is the historical login device geographic location offset at timestamp n, FIn is the historical login time abnormality at timestamp n, FJn is the historical social behavior change at timestamp n, FKn is the historical capital flow pattern at timestamp n, and FLn is the historical activity range change at timestamp n; FAn-1 is the historical login frequency at timestamp n-1, FBn-1 is the historical transaction amount fluctuation at timestamp n-1, FCn-1 is the historical behavior sequence abnormality at timestamp n-1, FDn-1 is the historical transaction frequency at timestamp n-1, FEn-1 is the historical device ID change frequency at timestamp n-1, FFn-1 is the historical IP address change frequency at timestamp n-1, FGn-1 is the historical device type distribution frequency at timestamp n-1, FHn-1 is the historical login device geographic location offset at timestamp n-1, FIn-1 is the historical login time abnormality at timestamp n-1, FJn-1 is the historical social behavior change at timestamp n-1, FKn-1 is the historical capital flow pattern at timestamp n-1, and FLn-1 is the historical activity range change at timestamp n-1.

[0047] The first dynamic threshold Y1 and the penalty coefficient CF are calculated by the following formulas: ; ; Where: Z1 is the first proxy function, which is filled with the real-time user behavior feature risk coefficient SF1, the real-time device environment risk coefficient SF2, and the real-time context feature risk coefficient SF3; Z2 is the second proxy function, which is filled with the historical user behavior feature risk coefficient LF1, the historical device environment risk coefficient LF2, and the historical context feature risk coefficient LF3; b1 and b2 are weight values, and the values ​​of b1 and b2 are adjusted and set by the user.

[0048] The second dynamic threshold Y2 is calculated by the following formula: ; Where: Y1 is the first dynamic threshold, CF is the penalty coefficient.

[0049] In this embodiment: This method generates multi-dimensional user behavior feature risk coefficients, device environment risk coefficients, and context feature risk coefficients by combining real-time and historical data, and can accurately assess the user's risk level. Comparative analysis of real-time and historical data can help this method identify changes in user behavior and provide personalized risk assessment criteria for each user.

[0050] By introducing the first dynamic threshold value Y1 and the second dynamic threshold value Y2, the method can adjust the sensitivity of detection in real time according to the difference between real-time data and historical data, and adapt to the changing user behavior.

[0051] By calculating the penalty coefficient CF, the method can assign different risk levels to abnormal behaviors and adjust the security measures to be taken according to the abnormality of user behaviors. The penalty coefficient can help the method respond differently to risk events of different levels.

[0052] This method deeply integrates historical data and real-time data, uses historical data to build a user behavior model, and then combines real-time data to assess current risks. This combination can not only effectively identify current abnormal behaviors, but also compare them with historical behavior patterns, thereby further improving the accuracy of risk detection.

[0053] In this method, the weight value can be adjusted by the user according to actual business needs. This enables this method to flexibly configure different risk factor weights according to specific scenarios to increase the influence of different features in the overall risk assessment, thereby optimizing the detection algorithm and meeting diverse needs.

[0054] This method can comprehensively evaluate user risks from multiple dimensions. This multi-dimensional risk analysis method can more accurately identify complex abnormal behaviors. If a user frequently changes devices or login locations but still shows normal transaction patterns, this method can comprehensively evaluate these changes to determine whether there are potential security risks. This method can effectively identify and defend against various disguised attacks. Attackers usually disguise themselves as normal users to attack by changing devices, IP addresses, etc., and this method can detect these abnormal behaviors in a timely manner through a multi-dimensional risk assessment and dynamic adjustment mechanism, thereby enhancing the protection capabilities of this method. Therefore, this method has a strong ability to resist attacks.

[0055] Example 5: Please refer to Figure 1 The dynamic rating module 4 generates the first comparison result and the second comparison result through the following steps: S4.1. Compare the user behavior feature risk coefficient, the device environment risk coefficient, and the context feature risk coefficient with the first dynamic threshold respectively, thereby generating a first comparison result; The first comparison results are as follows: when When , it means that the risk coefficient of user behavior characteristics, the risk coefficient of device environment, and the risk coefficient of context characteristics are all normal; when When , it means that there is no abnormality in the risk coefficient of user behavior characteristics, device environment risk coefficient, and contextual characteristic risk coefficient; Z1 is the first proxy function, which is filled with the user behavior feature risk coefficient, device environment risk coefficient, and context feature risk coefficient respectively, and Y1 is the first dynamic threshold; S4.2, the user behavior feature risk coefficient, the device environment risk coefficient, and the context feature risk coefficient are respectively compared with the second dynamic threshold to generate a second comparison result; The second comparison results are as follows: when When , it means that the risk coefficient of user behavior characteristics, the risk coefficient of device environment, and the risk coefficient of context characteristics are all normal; when When , it means that there is no abnormality in the risk coefficient of user behavior characteristics, device environment risk coefficient, and contextual characteristic risk coefficient; Z1 is the first proxy function, which is filled with the user behavior feature risk coefficient, device environment risk coefficient, and context feature risk coefficient respectively, and Y2 is the first dynamic threshold; S4.3, based on the first comparison result and the second comparison result, generate a magnitude classification, as follows: when , which means no risk; when When only one of the user behavior risk factor, device environment risk factor, and context feature risk factor is abnormal, it means that a level 1 risk is currently present; when When any two of the user behavior risk factor, device environment risk factor, and contextual risk factor are abnormal, it means that a secondary risk has occurred. when When the user behavior feature risk factor, device environment risk factor, and context feature risk factor are all abnormal, it means that a third-level risk exists.

[0056] In step S5, the specific alarm method is as follows: When a level 1 risk occurs, the internal intelligent voice system will call the user and record the call, while also sending a transaction reminder message; When secondary risks occur, the internal intelligent voice system will call the user and record the call, send transaction reminder information, and mark the transaction account; When a third-level risk occurs, the account will be frozen urgently, and a call will be made to the user through the internal intelligent voice system and recorded. If the call is not answered within 10 seconds, an emergency call will be made to the relevant department. At the same time, a transaction reminder message will be sent to the user and the transaction account will be marked.

[0057] In this embodiment: This method generates an accurate risk level assessment by comparing different risk factors with dynamic thresholds in real time. By dividing risks into multiple levels, corresponding preventive measures can be taken according to different risk levels. This mechanism ensures that this method can quickly identify and handle different levels of account risks, thereby providing accurate security protection.

[0058] Based on risk detection, this method designs multiple levels of alarm response plans. When an account has a level 1, 2, or 3 risk, this method can proactively contact the user through intelligent voice at the first time and implement different security measures according to the risk level. This rapid response and multi-level protection method greatly improves account security and avoids possible financial losses and the risk of account abuse.

[0059] Through intelligent voice and automatic marking of trading accounts, users will receive real-time reminders and interventions when faced with abnormal transactions or risks. This not only effectively enhances the security of the account, but also provides users with an instant feedback mechanism, allowing users to have a greater sense of control and trust in account security.

[0060] The alarm mode and account freezing operations of this method are all completed automatically by this method, reducing the need for manual intervention. This automated processing method can greatly improve the response speed of this method, avoid the security risks caused by manual operation delays, and improve the real-time prevention capabilities of account risks.

[0061] Users can flexibly adjust thresholds and alarm strategies according to different risk requirements and scenarios, thereby achieving risk management that better meets specific needs. This flexible configuration capability enables this method to adapt to a variety of business scenarios and security requirements, enhancing the versatility of this method.

[0062] For level 3 risks, this method can quickly freeze the account and take emergency response measures, such as making an emergency call to the relevant department. This design effectively prevents malicious attackers from abusing or stealing funds through accounts, and promptly stops potential financial losses and security risks.

[0063] This method can comprehensively monitor and respond to abnormal account behaviors in different time periods and under different circumstances through multi-dimensional risk assessment and multi-level risk response mechanisms. Whether it is abnormal user behavior, abnormal device environment, or changes in contextual features, they can all be comprehensively considered, thereby improving the comprehensive ability of risk prevention.

[0064] This application also includes an account anomaly detection system, see Figure 2 , including a data acquisition module 1, a data preprocessing module 2, a data analysis module 3, a dynamic rating module 4, a response processing module 5 and a feedback module 6; The user's behavior data and historical behavior data are acquired in real time through the data acquisition module 1, and transmitted to the data preprocessing module 2; The data preprocessing module 2 cleans and dimensionlessly processes the data to generate standardized real-time data sets and historical data sets; The data analysis module 3 analyzes the sorted data set and calculates various risk factors, dynamic thresholds and penalty coefficients CF; The dynamic rating module 4 compares the risk coefficient and the dynamic threshold, generates a first comparison result and a second comparison result, and divides the risk level according to the results; The response processing module 5 takes corresponding warning measures according to the risk level; The feedback module 6 will promptly feed back the processing results to the user and generate alarm information for relevant personnel to handle according to the situation.

[0065] The contents not described in detail in this specification belong to the prior art known to professional and technical personnel in this field.

[0066] Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments, or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for detecting anomalies in an account, characterized in that: It includes a data acquisition module (1), a data preprocessing module (2), a data analysis module (3), a dynamic rating module (4), a response processing module (5) and a feedback module (6), and the specific steps are as follows: S1, collecting the user's real-time behavior data through the data collection module (1), and retrieving the user's historical behavior data, and inputting the user's real-time behavior data and the user's historical behavior data into the data preprocessing module (2); S2, using the data preprocessing module (2) to clean and dimensionlessly transform the user real-time behavior data and the user historical behavior data collected by the data collection module (1), and to reorganize them into a real-time data set and a historical data set; S3, analyzing the real-time data set and the historical data set generated by the data preprocessing module (2) through the data analysis module (3), and obtaining the real-time user behavior feature risk coefficient SF1, the real-time device environment risk coefficient SF2, the real-time context feature risk coefficient SF3, the historical user behavior feature risk coefficient LF1, the historical device environment risk coefficient LF2 and the historical context feature risk coefficient LF3, the first dynamic threshold value Y1 and the penalty coefficient CF and the second dynamic threshold value Y2 through calculation; S4, performing a comparative analysis on the risk coefficient generated by the data analysis module (3) and the dynamic threshold through the dynamic rating module (4), generating a first comparative result and a second comparative result, judging whether the current account has abnormal behavior according to the first comparative result and the second comparative result, and classifying the abnormal behavior magnitude based on the first comparative result and the second comparative result; S5. Through the response processing module (5), based on the magnitude classification of the dynamic rating module (4), matching warning measures are taken, and alarm information is sent through the feedback module (6).

2. The method for detecting anomalies in an account according to claim 1, characterized in that: In step S1, the data collected by the data collection module (1) includes a user behavior feature data group, a device environment data group, and a context feature data group; The user behavior feature data group includes real-time login frequency, real-time transaction amount fluctuation, real-time behavior sequence abnormality and real-time transaction frequency, historical login frequency, historical transaction amount fluctuation, historical behavior sequence abnormality and historical transaction frequency; Device environment data includes real-time device ID change frequency, real-time IP address change frequency, real-time device type distribution frequency, real-time login device geographic location offset, historical device ID change frequency, historical IP address change frequency, historical device type distribution frequency, and historical login device geographic location offset; The context feature data includes real-time login time abnormalities, real-time social behavior changes, real-time capital flow patterns, real-time activity range changes, historical login time abnormalities, historical social behavior changes, historical capital flow patterns, and historical activity range changes.

3. The method for detecting anomalies in an account according to claim 2, characterized in that: In step S2, the real-time data set and historical data set generated by the data preprocessing module (2) are as follows: The real-time data set includes real-time login frequency A, real-time transaction amount fluctuation B, real-time behavior sequence abnormality C, real-time transaction frequency D, real-time device ID change frequency E, real-time IP address change frequency F, real-time device type distribution frequency G, real-time login device geographic location offset H, real-time login time abnormality I, real-time social behavior change J, real-time capital flow pattern K, and real-time activity range change L; The historical data set includes: historical login frequency, historical transaction amount fluctuations, historical behavior sequence abnormality and historical transaction frequency, historical device ID change frequency, historical IP address change frequency, historical device type distribution frequency and historical login device geographic location offset, historical login time abnormality, historical social behavior changes, historical capital flow patterns and historical activity range changes; The historical login frequencies FA are recorded as FA1, FA2, FA3, ..., FAn-1, FAn according to the timestamps; The historical transaction amount fluctuations FB are recorded as FB1, FB2, FB3, ..., FBn-1, FAn according to the timestamps; The abnormality degree FC of the historical behavior sequence is recorded as FC1, FC2, FC3, ..., FCn-1, FCn according to the timestamp; The historical transaction frequencies FD are recorded as FD1, FD2, FD3, ..., FDn-1, FDn according to the timestamps; The historical equipment ID change frequencies FE are recorded as FE1, FE2, FE3, ..., FEn-1, FEn according to the timestamps; The historical IP address change frequency FF is recorded as FF1, FF2, FF3, ..., FFn-1, FFn according to the timestamp; The historical equipment type distribution frequency FG is recorded as FG1, FG2, FG3, ..., FGn-1, FGn according to the timestamp; The geographical location offsets FH of historical login devices are recorded as FH1, FH2, FH3, ..., FHn-1, FHn according to the timestamps; The historical login time abnormality FIs are recorded as FI1, FI2, FI3, ..., FIn-1, FIn according to the timestamp; The historical social behavior changes FJ are recorded as FJ1, FJ2, FJ3, ..., FJn-1, FJn according to the timestamps; The historical fund flow pattern FK is recorded as FK1, FK2, FK3, ..., FKn-1, FKn according to the timestamp; The historical activity range changes FL are recorded as FL1, FL2, FL3, ..., FLn-1, FLn according to the timestamps.

4. The method for detecting anomalies in an account according to claim 3, characterized in that: In step S3, the data analysis module (3) obtains the user behavior feature risk coefficient, the device environment risk coefficient, the context feature risk coefficient, the first dynamic threshold and the penalty coefficient, and the second dynamic threshold through the following steps: S3.1, the data analysis module (3) calculates the real-time data set and the historical data set to obtain the real-time user behavior feature risk coefficient SF1, the real-time device environment risk coefficient SF2, the real-time context feature risk coefficient SF3, the historical user behavior feature risk coefficient LF1, the historical device environment risk coefficient LF2 and the historical context feature risk coefficient LF3; S3.2, the data analysis module (3) generates a first dynamic threshold and a penalty coefficient by integrating and calculating the historical data set; S3.3, the data analysis module (3) integrates and calculates the first dynamic threshold and the penalty coefficient to generate a second dynamic coefficient.

5. The method for detecting anomalies in an account according to claim 4, characterized in that: The real-time user behavior feature risk coefficient SF1, the real-time device environment risk coefficient SF2, the real-time context feature risk coefficient SF3, the historical user behavior feature risk coefficient LF1, the historical device environment risk coefficient LF2 and the historical context feature risk coefficient LF3 are calculated and obtained by the following formula: ； ； ； ； ； ； Where: A is the real-time login frequency, B is the real-time transaction amount fluctuation, C is the real-time behavior sequence abnormality, D is the real-time transaction frequency, E is the real-time device ID change frequency, F is the real-time IP address change frequency, G is the real-time device type distribution frequency, H is the real-time login device geographic location offset, I is the real-time login time abnormality, J is the real-time social behavior change, K is the real-time capital flow pattern, and L is the real-time activity range change; FAn is the historical login frequency at timestamp n, FBn is the historical transaction amount fluctuation at timestamp n, FCn is the historical behavior sequence abnormality at timestamp n, FDn is the historical transaction frequency at timestamp n, FEn is the historical device ID change frequency at timestamp n, FFn is the historical IP address change frequency at timestamp n, FGn is the historical device type distribution frequency at timestamp n, FHn is the historical login device geographic location offset at timestamp n, FIn is the historical login time abnormality at timestamp n, FJn is the historical social behavior change at timestamp n, FKn is the historical capital flow pattern at timestamp n, and FLn is the historical activity range change at timestamp n; FAn-1 is the historical login frequency at timestamp n-1, FBn-1 is the historical transaction amount fluctuation at timestamp n-1, FCn-1 is the historical behavior sequence abnormality at timestamp n-1, FDn-1 is the historical transaction frequency at timestamp n-1, FEn-1 is the historical device ID change frequency at timestamp n-1, FFn-1 is the historical IP address change frequency at timestamp n-1, FGn-1 is the historical device type distribution frequency at timestamp n-1, FHn-1 is the historical login device geographic location offset at timestamp n-1, FIn-1 is the historical login time abnormality at timestamp n-1, FJn-1 is the historical social behavior change at timestamp n-1, FKn-1 is the historical capital flow pattern at timestamp n-1, and FLn-1 is the historical activity range change at timestamp n-1.

6. The method for detecting anomalies in an account according to claim 5, characterized in that: The first dynamic threshold Y1 and the penalty coefficient CF are calculated by the following formulas: ； ； Where: Z1 is the first proxy function, which is filled with the real-time user behavior feature risk coefficient SF1, the real-time device environment risk coefficient SF2, and the real-time context feature risk coefficient SF3; Z2 is the second proxy function, which is filled with the historical user behavior feature risk coefficient LF1, the historical device environment risk coefficient LF2, and the historical context feature risk coefficient LF3; b1 and b2 are weight values, and the values ​​of b1 and b2 are adjusted and set by the user.

7. The method for detecting anomalies in an account according to claim 6, characterized in that: The second dynamic threshold Y2 is calculated by the following formula: where: Y1 is the first dynamic threshold, and CF is the penalty coefficient.

8. The method for detecting anomalies in an account according to claim 7, characterized in that: In step S4, the dynamic rating module (4) generates a first comparison result and a second comparison result through the following steps: S4.

1. Compare the user behavior feature risk coefficient, the device environment risk coefficient, and the context feature risk coefficient with the first dynamic threshold respectively, thereby generating a first comparison result; The first comparison results are as follows: when When , it means that the risk coefficient of user behavior characteristics, the risk coefficient of device environment, and the risk coefficient of context characteristics are all normal; when When , it means that there is no abnormality in the risk coefficient of user behavior characteristics, device environment risk coefficient, and contextual characteristic risk coefficient; Z1 is the first proxy function, which is filled with the user behavior feature risk coefficient, device environment risk coefficient, and context feature risk coefficient respectively, and Y1 is the first dynamic threshold; S4.2, the user behavior feature risk coefficient, the device environment risk coefficient, and the context feature risk coefficient are respectively compared with the second dynamic threshold to generate a second comparison result; The second comparison results are as follows: when When , it means that the risk coefficient of user behavior characteristics, the risk coefficient of device environment, and the risk coefficient of context characteristics are all normal; when When , it means that there is no abnormality in the risk coefficient of user behavior characteristics, device environment risk coefficient, and contextual characteristic risk coefficient; Z1 is the first proxy function, which is filled with the user behavior feature risk coefficient, device environment risk coefficient, and context feature risk coefficient respectively, and Y2 is the second dynamic threshold; S4.3, based on the first comparison result and the second comparison result, generate a magnitude classification, as follows: when , which means no risk; when When only one of the user behavior risk factor, device environment risk factor, and context feature risk factor is abnormal, it means that a level 1 risk is currently present; when When any two of the user behavior risk factor, device environment risk factor, and contextual risk factor are abnormal, it means that a secondary risk has occurred. when When the user behavior feature risk factor, device environment risk factor, and context feature risk factor are all abnormal, it means that a third-level risk exists.

9. The method for detecting anomalies in an account according to claim 8, characterized in that: In step S5, the specific alarm method is as follows: When a level 1 risk occurs, the internal intelligent voice system will call the user and record the call, while also sending a transaction reminder message; When secondary risks occur, the internal intelligent voice system will call the user and record the call, send transaction reminder information, and mark the transaction account; When a third-level risk occurs, the account will be frozen urgently, and a call will be made to the user through the internal intelligent voice system and recorded. If the call is not answered within 10 seconds, an emergency call will be made to the relevant department. At the same time, a transaction reminder message will be sent to the user and the transaction account will be marked.

10. An account anomaly detection system, used to execute the account anomaly detection method according to any one of claims 1 to 9, characterized in that: It includes a data collection module (1), a data preprocessing module (2), a data analysis module (3), a dynamic rating module (4), a response processing module (5) and a feedback module (6); The data collection module (1) obtains the user's behavior data and historical behavior data in real time and transmits it to the data preprocessing module (2); The data preprocessing module (2) cleans and dimensionlessly processes the data to generate standardized real-time data sets and historical data sets; The data analysis module (3) analyzes the sorted data set and calculates various risk factors, dynamic thresholds and penalty coefficients CF; The dynamic rating module (4) compares the risk coefficient and the dynamic threshold, generates a first comparison result and a second comparison result, and divides the risk level according to the results; The response processing module (5) takes corresponding warning measures according to the risk level; The feedback module (6) will promptly feed back the processing results to the user and generate alarm information for relevant personnel to handle according to the situation.

Images