Class determination method and device, equipment, readable storage medium and program product

Abstract

The embodiment of the invention provides a category determination method and device, equipment, a readable storage medium and a program product, and the method comprises the steps: obtaining a transaction feature data set of a to-be-processed resource transaction, the transaction feature data set comprising a target feature value of each feature category in a plurality of feature categories; determining a matched abnormal discrete value combination from the plurality of abnormal discrete value combinations according to the transaction feature data set, the matched abnormal discrete value combination having a sample feature value matched with the target feature value, and the matched target feature value and sample feature value belonging to the same feature category; and obtaining a reference abnormal score corresponding to each determined matching abnormal discrete value combination, and determining the transaction category of the to-be-processed resource transaction according to the reference abnormal score corresponding to each matching abnormal discrete value combination. Through the method provided by the invention, the transaction category of the to-be-processed resource transaction can be quickly determined by using the abnormal discrete value combination, and the accuracy and effectiveness of resource transaction category judgment are improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a category determination method, a category determination device, a computer device, a computer-readable storage medium, and a computer program product. Background Art

[0002] With the development of computer technology, the application of electronic resource transactions is becoming more and more widespread. Electronic resource transactions refer to the use of computer technology to transmit transaction information to the corresponding resource processing agency through the information network, thereby realizing the transfer of electronic resources. However, there are also abnormal transaction behaviors in electronic resource transactions, which usually cause more serious consequences. Therefore, it is necessary to determine the category of resource transactions.

[0003] When determining the category of resource transactions, professional technicians usually determine the abnormal characteristics of abnormal transaction behavior, and formulate corresponding judgment rules based on the abnormal characteristics, so as to determine the category of resource transactions using the judgment rules. This method is limited by the experience and technical level of professional technicians, and cannot accurately determine the category of resource transactions, which is prone to misjudgment. Summary of the invention

[0004] The embodiments of the present application provide a category determination method, apparatus, device, readable storage medium and program product, which can use abnormal discrete value combinations to quickly determine the transaction category of a pending resource transaction, thereby improving the accuracy and effectiveness of resource transaction category determination.

[0005] In one aspect, an embodiment of the present application provides a method for determining a category, the method comprising:

[0006] Acquire a transaction feature data group of a resource transaction to be processed, wherein the transaction feature data group includes a target feature value of each feature category in a plurality of feature categories;

[0007] Determining a matching abnormal discrete value combination from a plurality of abnormal discrete value combinations according to the transaction feature data group, wherein a sample feature value matching the target feature value exists in the matching abnormal discrete value combination, and the matched target feature value and the sample feature value belong to the same feature category;

[0008] Obtaining reference anomaly scores corresponding to each determined combination of matching anomaly discrete values, and determining a transaction category of the to-be-processed resource transaction according to the reference anomaly scores corresponding to each determined combination of matching anomaly discrete values;

[0009] Among them, the multiple abnormal discrete value combinations are obtained by clustering multiple abnormal discrete value sets, the abnormal discrete value sets are determined from multiple discrete value sets of each feature category according to the transaction category label, the multiple discrete value sets of each feature category are determined according to multiple sample feature values ​​of each feature category, the transaction category label and the multiple sample feature values ​​are included in a sample data set, the sample data set includes multiple sample transaction feature data groups and transaction category labels for each sample transaction feature data group, each sample transaction feature data group includes sample feature values ​​of each feature category, and the sample category label is used to indicate the transaction category of the resource transaction corresponding to the sample transaction feature data group.

[0010] In one aspect, an embodiment of the present application provides a category determination device, the device comprising:

[0011] An acquisition unit, used to acquire a transaction feature data group of a resource transaction to be processed, wherein the transaction feature data group includes a target feature value of each feature category in a plurality of feature categories;

[0012] a processing unit, configured to determine a matching abnormal discrete value combination from a plurality of abnormal discrete value combinations according to the transaction feature data group, wherein the matching abnormal discrete value combination contains a sample feature value that matches the target feature value, and the matched target feature value and the sample feature value belong to the same feature category;

[0013] A determination unit, configured to obtain reference anomaly scores corresponding to each determined combination of matching anomaly discrete values, and determine a transaction category of the to-be-processed resource transaction according to the reference anomaly scores corresponding to each determined combination of matching anomaly discrete values;

[0014] Among them, the multiple abnormal discrete value combinations are obtained by clustering multiple abnormal discrete value sets, the abnormal discrete value sets are determined from multiple discrete value sets of each feature category according to the transaction category label, the multiple discrete value sets of each feature category are determined according to multiple sample feature values ​​of each feature category, the transaction category label and the multiple sample feature values ​​are included in a sample data set, the sample data set includes multiple sample transaction feature data groups and transaction category labels for each sample transaction feature data group, each sample transaction feature data group includes sample feature values ​​of each feature category, and the sample category label is used to indicate the transaction category of the resource transaction corresponding to the sample transaction feature data group.

[0015] On the one hand, an embodiment of the present application provides a computer device, comprising: a processor, a communication interface and a memory, wherein the processor, the communication interface and the memory are interconnected, wherein the memory stores an executable program code, and the processor is used to call the executable program code to implement the category determination method provided in the embodiment of the present application.

[0016] Accordingly, an embodiment of the present application further provides a computer-readable storage medium, in which instructions are stored. When the computer-readable storage medium is executed on a computer, the computer implements the category determination method provided in the embodiment of the present application.

[0017] Accordingly, an embodiment of the present application further provides a computer program product, the computer program product comprising a computer program or a computer instruction, the computer program or the computer instruction being stored in a computer-readable storage medium. A processor of a computer device reads the computer program or the computer instruction from the computer-readable storage medium, and the processor executes the computer program or the computer instruction, so that the computer device implements the category determination method provided in the embodiment of the present application.

[0018] Through the category determination method provided in the embodiment of the present application, a matching abnormal discrete value group can be determined from multiple abnormal discrete value combinations based on the transaction feature data group of the resource transaction to be processed. The abnormal discrete value combination is determined based on the sample transaction feature data group in the sample data set. The abnormal discrete value combination can be used to indicate abnormal features common to abnormal resource transactions. Therefore, the matching abnormal discrete value group can indicate that the transaction feature data group includes abnormal features, which is conducive to accurately determining the transaction category of the resource transaction to be processed and enhancing the interpretability of the category determination; the transaction category of the resource transaction to be processed can be determined based on the reference abnormal score corresponding to the matching abnormal discrete value combination, which comprehensively considers the feature categories of multiple dimensions and does not require rules based on manual summary, so that the category determination of the resource transaction is accurately and effectively realized, reducing the situation of misjudgment. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 is a schematic diagram of the system architecture of a category determination system provided in an embodiment of the present application;

[0021] Figure 2 It is a flowchart of a method for determining an abnormal discrete value combination provided in an embodiment of the present application;

[0022] Figure 3 is a schematic diagram of a method for determining an abnormal discrete value combination provided in an embodiment of the present application;

[0023] Figure 4is a flow chart of a category determination method provided in an embodiment of the present application;

[0024] Figure 5 is a schematic diagram of a category determination method provided in an embodiment of the present application;

[0025] Figure 6 It is a schematic diagram of an abnormal prompt information display interface provided in an embodiment of the present application;

[0026] Figure 7 is a schematic diagram of an abnormal question and answer interface provided in an embodiment of the present application;

[0027] Figure 8 is a schematic diagram of a verification information submission interface provided in an embodiment of the present application;

[0028] Fig. 9 is a structural block diagram of a category determination device provided in an embodiment of the present application;

[0029] Fig.10 It is a structural block diagram of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0030] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0031] It should be noted that the descriptions of "first", "second", etc. involved in the embodiments of the present application are only for descriptive purposes and cannot be understood as indicating or implying their relative importance or implicitly indicating the number of the indicated technical features. Therefore, the technical features defined as "first" or "second" may explicitly or implicitly include at least one of the features.

[0032] With the development of computer technology, the application scenarios of electronic resource transactions are increasing. In order to ensure the security of electronic resources, it is usually necessary to classify electronic resource transactions and terminate abnormal resource transactions in a timely manner. Resource transactions are usually classified using resource transaction classification rules. However, resource transaction classification rules are determined by professional and technical personnel based on the common characteristics of abnormal resource transactions. This classification determination method cannot accurately distinguish similar features, cannot comprehensively consider abnormal features in different dimensions, and cannot accurately and effectively determine the transaction category of resource transactions. At the same time, this method relies heavily on the technical level and experience of professional and technical personnel, which can easily lead to misjudgment of the category of resource transactions.

[0033] Based on this, the embodiment of the present application provides a category determination method, which can obtain a transaction feature data group of a resource transaction to be processed, the transaction feature data group includes a target feature value of each feature category in multiple feature categories; according to the transaction feature data group, a matching abnormal discrete value combination is determined from multiple abnormal discrete value combinations, and there is a sample feature value matching the target feature value in the matching abnormal discrete value combination, and the matching target feature value and the sample feature value belong to the same feature category; obtain the reference abnormal score corresponding to each determined matching abnormal discrete value combination, and determine the transaction category of the resource transaction to be processed according to the reference abnormal score corresponding to each matching abnormal discrete value combination. Through the method provided by the embodiment of the present application, the transaction category of the resource transaction to be processed can be quickly determined by using the abnormal discrete value combination, which improves the accuracy and effectiveness of resource transaction category determination.

[0034] The category determination method provided in the embodiment of the present application can be applied to the field of artificial intelligence. Artificial Intelligence (AI) is a theory, method, technology and application system that uses a digital computer or a machine controlled by a digital computer to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. When conducting electronic resource transactions, the category determination method provided in the embodiment of the present application can be used to process the transaction feature data group of the resource transaction to be processed, determine the transaction category of the resource transaction to be processed, and use artificial intelligence technology to perform corresponding operations according to the transaction category of the resource transaction to be processed, thereby ensuring the security of the electronic resource transaction while improving the transaction experience.

[0035] The category determination method provided in the embodiment of the present application can also be applied to the field of cloud computing. Cloud computing is a computing model that distributes computing tasks on a resource pool composed of a large number of computers, so that various application systems can obtain computing power, storage space and information services as needed. The cloud computing resource pool mainly includes: computing devices (virtualized machines, including operating systems), storage devices, and network devices. The terminal device can initiate an electronic resource transaction request to the cloud server, and the cloud server can determine a matching abnormal discrete value combination from multiple abnormal discrete value combinations based on the transaction feature data group of the resource transaction to be processed, thereby determining the transaction category of the resource transaction to be processed, wherein the abnormal discrete value combination can be obtained by processing using cloud computing technology. The method provided in the present application can effectively improve the efficiency of category determination of resource transactions and ensure the accuracy of the determination results.

[0036] The following will introduce the architecture of the category determination system provided in the embodiments of the present application in conjunction with the accompanying drawings.

[0037] See also Figure 1, which is a schematic diagram of the system architecture of a category determination system provided in an embodiment of the present application, the category determination system includes a first transaction device 101, a category determination device 102, a database 103, and a second transaction device 104, and the category determination device 102 can exchange data with the first transaction device 101, the database 103, and the second transaction device 104. Among them:

[0038] The first transaction device 101 and the second transaction device 104 are two terminal devices for electronic resource transactions. The first transaction device 101 and the second transaction device 104 can initiate electronic resource transactions and can also receive data sent by the category determination device 102. The first transaction device 101 and the second transaction device 104 can be handheld devices (such as smart phones, tablet computers), computing devices (such as personal computers (PCs), vehicle terminals, aircraft, intelligent voice interaction devices, wearable devices or other intelligent devices with electronic resource transaction functions and communication functions, but are not limited thereto.

[0039] The category determination device 102 can receive the resource transaction request sent by the first transaction device 101 or the second transaction device 104, and perform category determination processing on the pending resource transaction corresponding to the resource transaction request, and send corresponding data according to the transaction category. The category determination device 102 can be a server for electronic resource transactions. The category determination device 102 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms.

[0040] The database 103 is used to store relevant data of the category determination device 102, such as: abnormal discrete value combinations, reference abnormal scores corresponding to abnormal discrete value combinations, etc. The database 103 can be a local database in the category determination device 102, or it can be a cloud database associated with the category determination device 102 (i.e., a database deployed in the cloud). Specifically, it can be based on any deployment of a private cloud, a public cloud, a hybrid cloud, an edge cloud, etc., so that the cloud database focuses on different functions. For example, the database deployed in a private cloud has the user's personal equipment as the basic cloud hardware, and focuses more on serving a small number of users, while the database deployed in the public cloud is deployed based on a cloud platform provided by a third party, which allows the data stored in the database to achieve data sharing. The data of any user can be stored in the database, and any user can also use the data in the database.

[0041] The following will explain in detail Figure 1 The category determination system shown works as follows:

[0042] The first transaction device 101 initiates an electronic resource transaction for the second transaction device 104. The first transaction device 101 sends the resource transaction request to the category determination device 102. The category determination device 102 can determine the transaction feature data group of the resource transaction to be processed according to the resource transaction request, and the transaction feature data group includes the target feature value of each feature category in the multiple feature categories; the category determination device 102 can obtain multiple abnormal discrete value combinations and reference abnormality scores corresponding to each abnormal discrete value combination from the database 103, wherein the multiple abnormal discrete value combinations are obtained by clustering multiple abnormal discrete value sets, the abnormal discrete value sets are determined from multiple discrete value sets of each feature category according to the transaction category label, and the multiple discrete value sets of each feature category are based on multiple sample features of each feature category. The value is determined, the transaction category label and multiple sample feature values ​​are included in the sample data set, the sample data set includes multiple sample transaction feature data groups and the transaction category label of each sample transaction feature data group, each sample transaction feature data group includes sample feature values ​​of each feature category, and the sample category label is used to indicate the transaction category of the resource transaction corresponding to the sample transaction feature data group; the category determination device 102 can determine the matching abnormal discrete value combination from multiple abnormal discrete value combinations according to the transaction feature data group, and there is a sample feature value matching the target feature value in the matching abnormal discrete value combination, and the matching target feature value and the sample feature value belong to the same feature category; the category determination device 102 can determine the transaction category of the resource transaction to be processed according to the reference abnormal score corresponding to each matching abnormal discrete value combination. If the transaction category of the resource transaction to be processed is a normal transaction, the category determination device 102 will complete the electronic resource transfer operation corresponding to the resource transaction request and send the resource transaction information to the second transaction device 104; if the transaction category of the resource transaction to be processed is an abnormal transaction, the category determination device 102 will not complete the electronic resource transfer operation corresponding to the resource transaction request, and send the abnormal resource transaction prompt information to the first transaction device 101. Through the category determination method provided in the embodiment of the present application, the transaction category of the resource transaction to be processed can be quickly and accurately determined based on a combination of multiple abnormal discrete values, thereby effectively improving the accuracy and efficiency of category determination and reducing misjudgment.

[0043] It is understandable that the schematic diagram of the category determination system described in the embodiment of the present application is to more clearly illustrate the category determination method of the embodiment of the present application, and does not constitute a limitation on the category determination method provided in the embodiment of the present application. For example, the category determination method provided in the embodiment of the present application can be executed by the category determination device 102, and can also be executed by other devices that are different from the category determination device 102 and can communicate with the first transaction device 101 and the second transaction device 104. It is known to those skilled in the art that Figure 1 The number of the first transaction device 101, the category determination device 102, and the second transaction device 104 is only illustrative. Any number of devices can be configured according to business implementation needs. Moreover, with the evolution of the system architecture and the emergence of new business scenarios, the category determination method provided in the embodiment of the present application is also applicable to similar technical problems.

[0044] The data collection and processing in this application should be strictly in accordance with the requirements of relevant laws and regulations when applied in practice, and the informed consent or separate consent of the personal information subject should be obtained. Subsequent data use and processing should be carried out within the scope of authorization of laws and regulations and the personal information subject.

[0045] See also Figure 2 , Figure 2 A flowchart of a method for determining an abnormal discrete value combination provided in an embodiment of the present application. The method can be implemented by the above-mentioned category determination device 102, or by other devices. The process of the method for determining an abnormal discrete value combination provided in an embodiment of the present application includes but is not limited to:

[0046] S201. Acquire a plurality of sample transaction feature data groups included in the sample data set and a transaction category label for each sample transaction feature data group; each sample transaction feature data group includes a sample feature value of each feature category in the plurality of feature categories, and the transaction category label is a normal category label or an abnormal category label.

[0047] In an embodiment of the present application, a sample data set can be obtained, and the sample data set may include multiple sample transaction feature data groups and transaction category labels for each sample transaction feature data group, wherein each sample transaction feature data group includes sample feature values ​​for each feature category in multiple feature categories, and the transaction category label is used to indicate the transaction category of the resource transaction corresponding to the sample transaction feature data group, and the transaction category label may be a normal category label or an abnormal category label. The sample data set may include a sample transaction feature data group whose transaction category label is a normal category label, and may also include a sample transaction feature data group whose transaction category label is an abnormal category label. The sample transaction feature data group may be determined based on completed electronic resource transactions in the electronic resource transaction system. In some cases, the sample transaction feature data group included in the sample data set may be as shown in Table 1 below.

[0048] Table 1

[0049]

[0050] As shown in Table 1, the sample data set includes 6 sample transaction feature data groups, each of which includes sample feature values ​​of each feature category in 8 feature categories and transaction category labels of each sample transaction feature data group. Among them, the feature category "attribute" indicates the attribute of the resource transaction initiation object corresponding to the sample transaction feature data group. This feature category is a continuous feature category, and the value range of the feature value corresponding to this feature category is an integer greater than 0; the feature category "category" indicates the category of the resource transaction initiation object corresponding to the sample transaction feature data group. This feature category is a discrete feature category, and the feature value corresponding to this feature category is "A" or "B"; the feature category "region" indicates the region to which the resource transaction object corresponding to the sample transaction feature data group belongs. This feature category is a discrete feature category, and the feature value corresponding to this feature category has 5 possible values, namely A, B, C, D, and E; feature The category “transaction quantity” indicates the quantity of electronic resources transferred in the resource transaction corresponding to the sample transaction feature data group. This feature category is a continuous feature category, and the value range of the feature value corresponding to this feature category is a number greater than 0; the feature category “transaction time” indicates the time when the resource transaction corresponding to the sample transaction feature data group occurs. This feature category is a continuous feature category; the feature category “binding time” indicates the association time of the resource transaction object corresponding to the sample transaction feature data group. This feature category is a continuous feature category; the feature category “unbinding time” indicates the disassociation time of the resource transaction object corresponding to the sample transaction feature data group. This feature category is a continuous feature category.

[0051] As shown in Table 1 above, the sample data set also includes transaction category labels for 7 sample transaction feature data groups: the transaction category labels of the sample transaction feature data groups numbered 1 and 2 in Table 1 are normal category labels, and the transaction category labels of the sample transaction feature data groups numbered 3, 4, 5, and 6 are abnormal category labels. In some cases, the sample transaction feature data groups (a total of n, n is an integer greater than 2) in the sample data set can be represented by x1, x2...xn, and the transaction category label corresponding to each sample transaction feature data group can be represented by y1, y2...yn (wherein, the value of y is 0, indicating that the transaction category label corresponding to the sample transaction feature data group is a normal transaction category, and the value of y is 1, indicating that the transaction category label corresponding to the sample transaction feature data group is an abnormal transaction category), and the feature value corresponding to the feature category in each sample transaction feature data group can be represented by f1, f2...fm, and the number of feature categories is m, and m is an integer greater than 2.

[0052] It should be noted that the above Table 1 only exemplarily shows the sample feature values ​​corresponding to the feature categories included in the sample transaction feature data group. In actual application, the sample transaction feature data group may also include sample feature values ​​corresponding to other feature categories. For example: the sample transaction feature data group may also include the feature category "interval time" used to indicate the time between the resource transaction corresponding to the sample transaction feature data group and the last resource transaction; the feature category "transaction object area" used to indicate the area to which the resource receiving object of the resource transaction corresponding to the sample transaction feature data group belongs; the feature category "number of transferred resources" used to indicate the number of transferred resources in the resource transaction corresponding to the sample transaction feature data group, etc. The feature category corresponding to the sample transaction feature data group matches the feature category corresponding to the transaction feature data group of the resource transaction to be processed. For example: the sample transaction feature data group includes the sample feature values ​​corresponding to the 7 feature categories shown in the above Table 1, and the transaction feature data group of the resource transaction to be processed also includes the target feature values ​​corresponding to the 7 feature categories shown in the above Table 1. The feature values ​​of different feature categories are distinctive to avoid data confusion. For example, the characteristic value of the characteristic category "region" is A, B, C, D, and E; the characteristic value of the characteristic category "category" is A or B. Through the method provided in the embodiment of the present application, a large number of sample transaction characteristic data groups and transaction category labels corresponding to the sample transaction characteristic data groups can be obtained, which is convenient for subsequent processing of the sample transaction characteristic data groups, thereby determining the common characteristics of abnormal transaction data, and facilitating accurate transaction category determination of resource transactions to be processed.

[0053] In one embodiment, the sample transaction feature data group whose transaction category label is an abnormal transaction category in the sample data set can be called an abnormal sample, and the sample transaction feature data group whose transaction category label is a normal transaction category in the sample data set can be called a normal sample; the abnormal sample can be obtained through abnormal resource transactions, and the normal sample can be obtained by random sampling from normal resource transactions. The number of normal samples and abnormal samples in the sample data set and the acquisition methods of normal samples and abnormal samples can be adaptively adjusted according to different actual application scenarios.

[0054] S202: Acquire multiple sample feature values ​​of each feature category from the multiple sample transaction feature data groups, and determine multiple discrete value sets of each feature category according to the multiple sample feature values ​​of each feature category.

[0055] In the embodiment of the present application, the sample transaction feature data group includes sample feature values ​​of multiple feature categories, and the feature category can be a continuous feature category and a discrete feature category. According to the multiple sample feature values ​​of each feature category, the sample feature values ​​with similarity can be merged to determine the multiple discrete value sets of each feature category. For example: the feature category "attribute" in the sample transaction feature data group in Table 1 above is a continuous feature category, and after calculation, it is found that the sample feature value of the feature category "attribute" is "23" and the sample feature value of the feature category "attribute" is "24" with similarity, then the feature values ​​can be merged to obtain the discrete value set (23, 24) of the feature category "attribute". For another example: the feature category "region" in the sample transaction feature data group in Table 1 above is a discrete feature category, and after calculation, it is found that the sample feature value of the feature category "region" is "A" and the sample feature value of the feature category "region" is "B" with similarity, then the feature values ​​can be merged to obtain the discrete value set (A, B) of the feature category "region". For another example: in the sample transaction feature data group in Table 1 above, the feature category "transaction time" is a continuous feature category, and after calculation, it is found that the sample feature value of the feature category "transaction time" is "10161553" and the sample feature value of the feature category "transaction time" is "10151113". They are similar, then the feature values ​​can be merged to obtain a discrete value set (10161553, 10151113) of the feature category "transaction time". Through the method provided in the embodiment of the present application, feature values ​​with similarity in the same feature category can be merged to obtain a discrete value set, which is conducive to the subsequent determination of abnormal discrete value combinations based on the discrete value set, so that the category of the resource transaction to be processed can be accurately and efficiently determined.

[0056] In one embodiment, the continuous feature categories and some discrete feature categories in the multiple feature categories corresponding to the sample transaction feature data set can be processed to obtain multiple discrete value sets. The number of bins is used to indicate the number of discrete value sets of each feature category corresponding to the sample transaction feature data set. For the continuous feature category, there are many possible values ​​for its feature value, so the discrete value set of the continuous feature category can be determined according to the number of bins. For example, if the number of bins is 3 for the continuous feature category "attribute" in Table 1 above, the three discrete value sets (23), (24, 25), and (28) corresponding to the continuous feature category "attribute" can be determined. For the discrete feature category, the possible values ​​for its feature value are limited. For the discrete feature category whose possible value number is less than or equal to the number of bins, no processing can be performed and the corresponding discrete value set can be directly determined. For example, if the possible value number (2) of the discrete feature category "category" in Table 1 above is less than the number of bins (3), the discrete value sets (A) and (B) corresponding to the discrete feature category "category" can be directly determined. For discrete feature categories whose number of possible values ​​is greater than the number of bins, processing can be performed to determine the discrete value set of the discrete feature category. For example, for the discrete feature category "region" in Table 1 above, the number of possible values ​​(5) of its feature value is greater than the number of bins (3), then processing can be performed to determine the discrete value set (A, B), (C, E) and (D) corresponding to the discrete feature category "region". Through the method provided in the embodiment of the present application, processing can be adaptively performed according to the type of feature category to obtain a discrete value set of each feature category, which is beneficial for subsequent similarity calculation.

[0057] It should be noted that the number of discrete value sets of each feature category is less than or equal to the number of bins. For example, for the sample data set shown in Table 1 above, assuming that the number of bins is 3, the number of discrete value sets of the feature category "category" is 2, and the number of discrete value sets of all feature categories except the feature category "category" is 3.

[0058] In one embodiment, the implementation method of determining multiple discrete value sets of each feature category based on multiple sample feature values ​​of each feature category can be as follows: for discrete feature categories in multiple feature categories, multiple discrete feature values ​​are determined based on multiple sample feature values ​​of the discrete feature category; if the number of multiple discrete feature values ​​is greater than the number of bins, the abnormal sample rate of the sample data subset corresponding to each discrete feature value is determined; the sample data subset is a subset of the sample data set, and each sample transaction feature data group included in the sample data subset contains sample feature values ​​that match the discrete feature value; the abnormal sample rates corresponding to the multiple discrete feature values ​​are binned according to the number of bins to obtain multiple discrete value sets of discrete feature categories. The embodiment of the present application introduces an implementation method of determining a discrete value set of a discrete feature category. For a discrete feature category among multiple feature categories, multiple discrete feature values ​​can be determined based on multiple sample feature values ​​of the discrete feature category. If the number of the multiple discrete feature values ​​is greater than the number of bins, it means that the number of discrete feature values ​​of the discrete feature category is large and the feature values ​​need to be merged. Therefore, the discrete feature category can be processed continuously so that the values ​​corresponding to the discrete feature category can be processed in bins. The abnormal sample rate of the sample data subset corresponding to each discrete feature value can be determined. The sample data subset is a subset of the sample data set. There are sample feature values ​​matching the discrete feature value in each sample transaction feature data group included in the sample data subset. The abnormal sample rate can be determined based on the ratio of the number of sample transaction feature data groups whose transaction category labels are abnormal transaction categories in the sample data subset to the number of all sample transaction feature data groups in the sample data subset. For the discrete feature value corresponding to the discrete feature category, the possible values ​​are limited and discrete, while the abnormal sample rate corresponding to the discrete feature value is continuous. Therefore, the discrete feature category can be continuous using the abnormal sample rate.For example: the discrete feature category "region" in Table 1 above can determine its corresponding 5 discrete feature values, namely A, B, C, D, and E; assuming that the number of bins is 3, the number of discrete feature values ​​is greater than the number of bins, and the abnormal sample rate of the sample data subset corresponding to each discrete feature value is determined. When the discrete feature value of the feature category "region" is "A", the corresponding sample data subset includes the sample transaction feature data group numbered 1. Then, it can be determined that the abnormal sample rate corresponding to the discrete feature value of the feature category "region" is the ratio of the number of sample transaction feature data groups with transaction category labels of abnormal transaction categories in the corresponding sample data subset to the number of all sample transaction feature data groups in the sample data subset, which is 0; when the discrete feature value of the feature category "region" is "B", the corresponding sample data subset includes sample transactions numbered 2 and 4. If the feature data group is a feature data group, it can be determined that the abnormal sample rate corresponding to the discrete feature value of the feature category "region" is 0.5 when the discrete feature value of the feature category "region" is "B"; if the sample data subset corresponding to the discrete feature value of the feature category "region" includes the sample transaction feature data group numbered 3 when the discrete feature value of the feature category "region" is "C", it can be determined that the abnormal sample rate corresponding to the discrete feature value of the feature category "region" is 1; if the sample data subset corresponding to the discrete feature value of the feature category "region" is "D" includes the sample transaction feature data group numbered 5, it can be determined that the abnormal sample rate corresponding to the discrete feature value of the feature category "region" is 1; if the sample data subset corresponding to the discrete feature value of the feature category "region" is "E" includes the sample transaction feature data group numbered 6, it can be determined that the abnormal sample rate corresponding to the discrete feature value of the feature category "region" is 1. After determining the abnormal sample rate corresponding to each discrete feature value, it is equivalent to converting the discrete feature category into a continuous feature category, and the corresponding relationship between each discrete feature value and its abnormal sample rate can be saved, and the abnormal sample rates corresponding to multiple discrete feature values ​​are binned according to the number of bins to obtain multiple discrete value sets of discrete feature categories. Through the method provided in the embodiment of the present application, discrete feature categories whose number of discrete feature values ​​is greater than the number of bins can be processed continuously, and the processed discrete features can be binned to obtain a discrete value set of the discrete feature category, which is convenient for subsequent similarity merging to obtain an abnormal discrete value combination.

[0059] In one embodiment, the implementation method of determining multiple discrete value sets of each feature category based on multiple sample feature values ​​of each feature category can be: for continuous feature categories in multiple feature categories, multiple sample feature values ​​of the continuous feature category are binned to obtain multiple discrete value sets of the continuous feature category. For continuous feature categories in multiple feature categories, multiple sample feature values ​​of the continuous feature category can be binned, and feature values ​​with similarity are divided into the same set to obtain multiple discrete value sets of the continuous feature category. Binning continuous features can make the system more stable as a whole and avoid overfitting. Through the method provided in the embodiment of the present application, continuous feature categories can be binned to discretize the continuous feature categories, which is convenient for subsequent similarity calculation.

[0060] In one embodiment, a method for binning multiple sample feature values ​​of a continuous feature category to obtain multiple discrete value sets of the continuous feature category can be: sorting multiple sample feature values ​​of the continuous feature category to obtain a sorting result, where the elements in the sorting result are the sample feature values; for any two adjacent sample feature values ​​in the sorting result, determining the sample distribution similarity of a sample data subset corresponding to any two adjacent sample feature values, where the sample data subset is a subset of the sample data set; merging two adjacent sample feature values ​​with the largest sample distribution similarity in the sorting result into one element to obtain a new sorting result, and executing the above steps according to the new sorting result; if the number of elements in the newly obtained sorting result is equal to the number of bins, then each element in the newly obtained sorting result is determined as a discrete value set of the continuous feature category. Multiple sample feature values ​​of the continuous feature category can be sorted to obtain a sorting result, and the elements in the sorting result are sample feature values; for any two adjacent sample feature values ​​in the sorting result, the sample distribution similarity of the sample data subset corresponding to any two adjacent sample feature values ​​can be determined, and the sample data subset is a subset of the sample data set, and each sample transaction feature data group included in the sample data subset contains a sample feature value that matches the feature value. For example: assuming that the number of bins is 2; the continuous feature category "attribute" in the above Table 1, its corresponding multiple sample feature values ​​are 23, 25, 28, and 24, and the multiple sample feature values ​​can be sorted to obtain a sorting result of 23, 24, 25, and 28. In the sorting result, the adjacent sample characteristic values ​​are 23 and 24, 24 and 25, 25 and 28, and the sample data subset corresponding to the sample characteristic value (23) includes the sample transaction characteristic data groups numbered 1 and 5, the sample data subset corresponding to the sample characteristic value (24) includes the sample transaction characteristic data group numbered 6, the sample data subset corresponding to the sample characteristic value (25) includes the sample transaction characteristic data groups numbered 2 and 4, and the sample data subset corresponding to the sample characteristic value (28) includes the sample transaction characteristic data group numbered 3. For any two adjacent sample characteristic values, the sample distribution similarity of the sample data subsets corresponding to them can be calculated.

[0061] After determining the sample distribution similarity of the sample data subsets corresponding to any two adjacent sample eigenvalues, the two adjacent sample eigenvalues ​​with the largest sample distribution similarity in the sorting result can be merged into one element to obtain a new sorting result. For example, assuming that it is calculated that the sample distribution similarity of the sample eigenvalue (23) and the sample eigenvalue (24) is the largest, the sample eigenvalue (23) and the sample eigenvalue (24) can be merged into one element and re-sorted according to the merged result to obtain new sorting results of (23, 24), 25, and 28. At this time, the number of elements in the sorting result (3) is greater than the number of bins 2. After determining the new sorting result, the sample similarity between any two adjacent sample feature values ​​can be recalculated according to the new sorting result, and the two sample feature values ​​corresponding to the maximum sample similarity are merged. For example, after merging the sample feature value (23) and the sample feature value (24), the sample feature value (23,24) is obtained. It can be determined that the sample data subset corresponding to (23,24) includes the sample transaction feature data groups numbered 1, 5, and 6; re-sorting according to the current sample feature values, the new sorting results are (23,24), 25 , 28; in the new sorting result, (23,24) and 25 are adjacent, and 25 and 28 are adjacent. The sample distribution similarity of the corresponding sample data subsets can be calculated. Assuming that the calculation result indicates that the sample distribution similarity of the sample eigenvalue (25) and the sample eigenvalue (28) is the largest, the sample eigenvalue (25) and the sample eigenvalue (28) can be merged into one element, which is (25,28). At this time, sorting is performed again according to the current sample eigenvalue, and the new sorting results obtained again are (23,24) and (25,28). If the number of elements in the new sorting result obtained again is equal to the number of bins, then each element in the new sorting result obtained again can be determined as a discrete value set of the continuous feature category. For example, the new sorting result obtained again is (23,24) and (25,28), and the number of bins is 2. Then (23,24) and (25,28) can be determined as a discrete value set of the continuous feature category "attribute". Through the method provided in the embodiment of the present application, continuous feature categories can be accurately binned according to the similarity of sample distribution to obtain a discrete value set, and feature values ​​with similarity can be effectively merged, which is conducive to the subsequent use of the discrete value set to determine abnormal discrete value combinations and accurately classify resource transactions.

[0062] It should be noted that the implementation method of binning the abnormal sample rates corresponding to multiple discrete feature values ​​according to the number of bins in the above embodiment to obtain multiple discrete value sets of discrete feature categories is the same as the implementation method of binning multiple sample feature values ​​of a continuous feature category to obtain multiple discrete value sets of the continuous feature category.

[0063] In one embodiment, a plurality of sample feature values ​​of a continuous feature category can be binned using a chi-square binning method to obtain a plurality of discrete value sets of the continuous feature category. The chi-square binning method is a supervised binning method, which is a bottom-up (i.e., merging-based) data discretization method that relies on the chi-square test: adjacent intervals with the smallest chi-square value are merged together until a certain stopping criterion is met. The smaller the chi-square value of two discrete values, the greater the similarity of the sample distributions of the two discrete values, and the greater the similarity of the two discrete values. The basic idea of ​​chi-square binning is that for accurate discretization, the relative class frequencies should be completely consistent within an interval, so if two adjacent intervals have very similar class distributions, the two intervals can be merged; otherwise, they should remain separate, and low chi-square values ​​indicate that they have similar class distributions. The method for performing chi-square binning can be: determining a chi-square threshold; obtaining multiple eigenvalues ​​of the feature category to be processed, and sorting the multiple eigenvalues ​​to obtain a sorting result; for any two adjacent eigenvalues ​​in the sorting result, determining the chi-square value of the sample data subset corresponding to any two adjacent eigenvalues, and merging the eigenvalues ​​of the two sample data subsets corresponding to the minimum chi-square value to obtain a new eigenvalue; judging whether the number of current eigenvalues ​​is less than or equal to the number of bins, if yes, stopping the merging operation, if not, re-sorting according to the current eigenvalues ​​and determining the chi-square value of the sample data subset corresponding to any two adjacent eigenvalues ​​in the sorting result. The calculation formulas for the chi-square value corresponding to the sample data subset of two adjacent sample eigenvalues ​​can be shown as follows:

[0064]

[0065] M=(A ij -E ij ) 2 / E ij (2)

[0066] E ij =(N i *C j ) / N (3)

[0067] In the above formulas (1), (2) and (3), the value of i is 1 or 2, indicating two sample data subsets (i.e., sample data subset 1 or sample data subset 2) for similarity calculation, and the value of j is 1 or 2. j is 1, indicating that the transaction category label of the sample transaction feature data group in the sample data subset is the normal transaction category; j is 2, indicating that the transaction category label of the sample transaction feature data group in the sample data subset is the abnormal transaction category; N indicates the number of sample transaction feature data groups included in the sample data set, N irepresents the number of sample transaction feature data groups in the i-th sample data subset, C j A represents the proportion of the j-th sample transaction feature data group in the sample data set, ij It represents the number of sample transaction feature data groups of the jth category in the i-th sample data subset. After determining the chi-square value, the pair of sample feature values ​​with the smallest chi-square value can be merged, and the steps of sorting and merging can be repeated until the condition is met (that is, the number of sample feature values ​​is the same as the number of bins). Through the chi-square binning method, sample data subsets with similar distributions can be quickly and accurately determined, so that similar sample feature values ​​can be determined based on the sample data subsets, and similar sample feature values ​​can be merged, so as to facilitate the determination of accurate abnormal feature groups and achieve accurate transaction category determination.

[0068] It should be noted that using chi-square binning to determine the discrete value set of feature categories is only a feasible implementation method provided in the embodiment of the present application, and other binning methods (for example, decision tree binning method) can also be used for binning processing to obtain discrete value combinations corresponding to feature categories. The embodiment of the present application does not specifically limit the binning method.

[0069] S203: Determine an abnormal discrete value set from multiple discrete value sets of each feature category according to the transaction category label.

[0070] In the embodiment of the present application, multiple discrete value sets of each feature category may include multiple feature values, and the feature values ​​in a discrete value set have similarity. After determining multiple discrete value sets of each feature category, the discrete value set can be abnormally calculated according to the transaction category label, so as to determine an abnormal discrete value set with a higher degree of abnormality. The abnormal discrete value set can represent the common abnormal feature value corresponding to the feature category. For example: Assuming that the number of bins is 3, the sample data set shown in Table 1 above is processed, and the discrete value set of the feature category "transaction quantity" can be determined to be (3000, 3500, 4000), (5000), (6000), and the abnormal discrete value set determined from the multiple discrete value sets of the feature category "transaction quantity" according to the transaction category label is (3000, 3500, 4000), which means that when the "transaction quantity" is 3000 or 3500 or 4000, the resource transaction may be an abnormal transaction. Through the method provided in the embodiment of the present application, an abnormal discrete value set can be effectively determined from multiple discrete value sets, the calculation complexity is reduced, and the abnormal characteristic value is effectively obtained.

[0071] In one embodiment, the implementation method of determining an abnormal discrete value set from multiple discrete value sets of each feature category according to a transaction category label can be: for any feature category among multiple feature categories, determine the abnormal sample rate of a sample data subset corresponding to each discrete value set in multiple discrete value sets of any feature category according to the transaction category label; the sample data subset is a subset of the sample data set, and some sample feature values ​​included in the sample transaction feature data group in the sample data subset are included in the discrete value set; the discrete value set whose corresponding abnormal sample rate in multiple discrete value sets of any feature category is greater than or equal to the abnormal sample rate threshold is determined as the abnormal discrete value set. For any feature category among multiple feature categories, the abnormal sample rate of a sample data subset corresponding to each discrete value set in multiple discrete value sets of the feature category can be determined according to the transaction category label, and the sample data subset is a subset of the sample data set, and some sample feature values ​​included in the sample transaction feature data group in the sample data subset are included in the discrete value set. For example, the number of bins is 3. After processing the sample data set shown in Table 1 above, the three discrete value sets of the feature category "transaction quantity" are (3000, 3500, 4000), (5000), and (6000). The sample data subset corresponding to the discrete value set (3000, 3500, 4000) includes the sample transaction feature data groups numbered 1, 3, 4, and 6. The transaction category label of the sample transaction feature data group numbered 1 is the normal transaction category, and the transaction category labels of the sample transaction feature data groups numbered 3, 4, and 6 are the abnormal transaction categories. Therefore, (3000, 3500, 4000) The abnormal sample rate corresponding to the (00) discrete value set is 3 / 4=0.75; the sample data subset corresponding to the (5000) discrete value set includes the sample transaction feature data group numbered 2, and the transaction category label of the sample transaction feature data group numbered 2 is the normal transaction category, so the abnormal sample rate corresponding to the (5000) discrete value set is 0 / 1=0; the sample data subset corresponding to the (6000) discrete value set includes the sample transaction feature data group numbered 5, and the transaction category label of the sample transaction feature data group numbered 5 is the abnormal transaction category, so the abnormal sample rate corresponding to the (6000) discrete value set is 1 / 1=1. The discrete value sets whose corresponding abnormal sample rates in the multiple discrete value sets of the feature category are greater than or equal to the abnormal sample rate threshold are determined as abnormal discrete value sets. For example: if the abnormal sample rate threshold is 0.1, the (3000, 3500, 4000) discrete value sets and the (6000) discrete value set whose abnormal sample rates are greater than the abnormal sample rate threshold can be determined as abnormal discrete value sets. Through the method provided in the embodiment of the present application, the feature values ​​that can reflect the common characteristics of abnormal transactions can be effectively retained, which is convenient for the subsequent determination of the category of resource transactions.

[0072] It should be noted that, for multiple discrete value sets of multiple feature categories, the above-mentioned processing can be performed on each discrete value set to determine an abnormal discrete value set. The number of abnormal discrete value sets is less than or equal to the number of discrete value sets. For example: the number of bins is 3, and 20 discrete value sets can be obtained by processing the sample data set shown in Table 1 above (wherein the feature category "category" corresponds to two discrete value sets, and the other 6 feature categories correspond to three discrete value sets); after performing the above-mentioned processing on each discrete value set, 10 abnormal discrete value sets can be determined. Through the method provided in the embodiment of the present application, abnormal feature discrete values ​​can be effectively screened out, which is conducive to the subsequent category determination of resource transactions.

[0073] S204: performing clustering processing on the determined multiple abnormal discrete value sets to obtain multiple abnormal discrete value combinations, where the abnormal discrete value combinations are unions of one or more abnormal discrete value sets.

[0074] In the embodiment of the present application, after determining the abnormal discrete value set of each feature category, the multiple abnormal discrete value sets can be clustered, and the abnormal discrete value sets with similar distributions between different feature categories are merged to obtain multiple abnormal discrete value combinations, each of which can be the union of one or more abnormal discrete value sets. The feature values ​​included in the abnormal discrete value combination can be used to indicate the common features of abnormal resource transactions. For example: according to the sample data set shown in Table 1 above, it is determined that the abnormal discrete value combination is (feature category "transaction amount" is 6000, feature category "region" is A), then it is explained that the abnormal discrete value set (feature category "transaction amount" is 6000) and the abnormal discrete value set (feature category "region" is A) have similarity and can be merged into an abnormal discrete value combination, and when the feature value of the feature category "transaction amount" in the transaction feature data group of the resource transaction to be processed is 6000 or the feature value of the feature category "region" is A, the transaction category of the resource transaction to be processed is very likely to be an abnormal transaction category. Through the method provided in the embodiment of the present application, features with similar distributions between different feature categories can be aggregated, avoiding the problem that manually summarized judgment rules cannot distinguish similar features, thereby accurately and effectively determining the transaction category of the resource transaction to be processed; at the same time, the method of determining the transaction category based on the combination of abnormal discrete values ​​can make the judgment result interpretable, and can more clearly reflect the abnormal feature values ​​hit by the transaction feature data group of the resource transaction to be processed.

[0075] In one embodiment, clustering is performed on the determined multiple abnormal discrete value sets to obtain multiple abnormal discrete value combinations, which can be implemented as follows: for any two abnormal discrete value sets that do not belong to the same feature category in the determined multiple abnormal discrete value sets, the set similarity of sample data subsets corresponding to the any two abnormal discrete value sets is determined, and the sample data subset is a subset of the sample data set; if the maximum set similarity of two abnormal discrete value sets determined for the multiple abnormal discrete value sets is greater than or equal to the similarity threshold, the two abnormal discrete value sets corresponding to the maximum set similarity in the multiple abnormal discrete value sets are merged to obtain new multiple abnormal discrete value sets, and the above steps are performed according to the new multiple abnormal discrete value sets; if the maximum similarity of two abnormal discrete value sets determined for the new multiple abnormal discrete value sets obtained again is less than the similarity threshold, each abnormal discrete value set in the new multiple abnormal discrete value sets obtained again is respectively determined as an abnormal discrete value combination. The method provided by the embodiment of the present application is to perform aggregation processing of discrete values ​​for different feature categories: for any two abnormal discrete value sets that do not belong to the same feature category in the determined multiple abnormal discrete value sets, the set similarity of sample data subsets corresponding to any two discrete value sets can be determined, and the sample data subset is a subset of the sample data set, and each sample transaction feature data group included in the sample data subset corresponding to the abnormal discrete value set contains sample feature values ​​that match the abnormal discrete feature values. For example: for the sample data set shown in Table 1 above, it is determined that the abnormal discrete value set of the feature category "attribute" is (23, 24), and the abnormal discrete value set of the feature category "transaction quantity" is (3000, 3500) and (4000); the sample data subset S1 whose abnormal discrete value set of the feature category "attribute" is (23, 24) includes sample transaction feature data groups numbered 1, 5 and 6; the sample data subset S2 whose abnormal discrete value set of the feature category "transaction quantity" is (3000, 3500) includes sample transaction feature data groups numbered 1, 4 and 6; the sample data subset S3 whose abnormal discrete value set of the feature category "transaction quantity" is (4000) includes the sample transaction feature data group numbered 3; the set similarity between the sample data subset S1 and the sample data subset S2, and between the sample data subset S1 and the sample data subset S3 can be determined.

[0076] After determining the set similarity of any two abnormal discrete value sets, if the maximum set similarity of the abnormal discrete value sets determined for multiple abnormal discrete value sets is greater than or equal to the similarity threshold, the two abnormal discrete value sets corresponding to the maximum set similarity in the multiple abnormal discrete value sets can be merged to obtain multiple abnormal discrete value sets, and the aforementioned set similarity calculation step can be performed based on the new multiple abnormal discrete value sets. For example: if the set similarity between sample data subset S1 and sample data subset S2 is 0.5, and the set similarity between sample data subset S1 and sample data subset S3 is 0, then the two abnormal discrete value sets corresponding to sample data subset S1 and sample data subset S2 (i.e., the abnormal discrete value set of feature category "attribute" is (23, 24), and the abnormal discrete value set of feature category "transaction quantity" is (3000, 3500)) can be merged to obtain a new abnormal discrete value set (the abnormal discrete value set of feature category "attribute" is (23, 24) or the abnormal discrete value set of feature category "transaction quantity" is (3000, 3500)), and the sample data subset S4 corresponding to the abnormal discrete value set includes sample transaction feature data groups numbered 1, 4, 5 and 6; calculate the set similarity between sample data subset S3 and sample data subset S4, and determine whether merging is required.

[0077] After performing set similarity calculation and abnormal discrete value set merging processing according to the new multiple abnormal discrete value sets, a new multiple abnormal discrete value sets can be obtained. If the maximum similarity of two abnormal discrete value sets determined for the new multiple abnormal discrete value sets obtained again is less than the similarity threshold, each abnormal discrete value set in the new multiple abnormal discrete value sets obtained again can be obtained as an abnormal discrete value combination, that is, after each merging processing of the abnormal discrete value sets, the set similarity between any two abnormal discrete value sets is recalculated, if the maximum set similarity among the multiple set similarities is greater than or equal to the similarity threshold, the abnormal discrete value sets are merged and the set similarity is recalculated, if the maximum set similarity among the multiple set similarities is less than the similarity threshold, it means that the similarity of the current abnormal discrete value sets is low, and no merging operation is required. For example: the set similarity between the sample data subset S3 and the sample data subset S4 is calculated, and the set similarity is less than the similarity threshold, which can indicate that there is no similar abnormal discrete feature value set at present, and no merging operation is required. Through the method provided in the embodiment of the present application, sets of abnormal discrete values ​​with similar distributions can be effectively merged to obtain abnormal discrete value combinations, which is conducive to making an abnormal discrete value combination contain similar discrete values ​​of different feature categories, and is conducive to using abnormal discrete value combinations to accurately determine transaction categories.

[0078] In one embodiment, the implementation method of determining the set similarity of sample data subsets corresponding to any two abnormal discrete value sets can be to use the Jaccard coefficient to determine the set similarity. For the sample data subsets SubA and the sample data subset SubB corresponding to the two abnormal discrete value sets, the set similarity can be calculated as shown in the following formula (4):

[0079] J = (A∩B) / (A∪B) (4)

[0080] In the above formula (4), A represents the sample data subset SubA, B represents the sample data subset SubB, and J represents the set similarity of the two sample data subsets. For example: the sample data subset SubA whose abnormal discrete value set of the feature category "attribute" is (23, 24) includes sample transaction feature data groups numbered 1, 5 and 6; the sample data subset SubB whose abnormal discrete value set of the feature category "transaction quantity" is (3000, 3500) includes sample transaction feature data groups numbered 1, 4 and 6. Then, it can be calculated that the set similarity of the two is 0.5. In some cases, the similarity threshold can be determined as 0.8. When the set similarity is less than 0.8, it can be considered that the two sample data subsets are not similar, that is, the abnormal discrete value sets corresponding to the two sample data subsets are not similar. Through the method provided in the embodiment of the present application, the set similarity can be determined quickly and effectively, which is conducive to improving the overall processing efficiency.

[0081] It should be noted that, in addition to using the Jaccard coefficient to determine the set similarity between any two abnormal discrete value sets, other methods may also be used to determine the set similarity between any two abnormal discrete value sets.

[0082] In one embodiment, the implementation method of determining each abnormal discrete value set in the newly obtained multiple abnormal discrete value sets as an abnormal discrete value combination can be: calculating the abnormal sample rate of each abnormal discrete value set in the newly obtained multiple abnormal discrete value sets, and determining the abnormal discrete value set whose abnormal sample rate is greater than the abnormal threshold as the abnormal discrete value combination. After the abnormal discrete value sets are clustered, the distribution similarity between the various abnormal discrete value sets is low, and the distribution similarity of the discrete feature values ​​within a single abnormal discrete value set is high. The abnormal sample rate of each abnormal discrete value set after clustering can be calculated, and the abnormal discrete value set with a higher abnormal sample rate can be determined as the abnormal discrete value combination. Through the method provided in the embodiment of the present application, the abnormal discrete value combination can be screened, and the abnormal discrete value combination with a higher abnormal sample rate is retained, so that it can be ensured that the abnormal discrete value combination can represent the common characteristics of abnormal transaction data, and the transaction category of resource transactions can be more accurately judged.

[0083] In one embodiment, after determining multiple abnormal discrete value combinations, it is also possible to: determine a first quantity ratio of normal samples to abnormal samples in a sample data set based on transaction category labels; normal samples refer to sample transaction feature data groups whose transaction category labels are normal category labels, and abnormal samples refer to sample transaction feature data groups whose transaction category labels are abnormal category labels; for any abnormal discrete value combination in multiple abnormal discrete value combinations, determine a sample data subset corresponding to any abnormal discrete value combination; the sample data subset is a subset of the sample data set, and some sample feature values ​​included in the sample transaction feature data group in the sample data subset are included in any abnormal discrete value combination; determine a second quantity ratio of normal samples to abnormal samples in the sample data subset based on the transaction category labels; and determine a reference abnormality score corresponding to any abnormal discrete value combination based on the first quantity ratio and the second quantity ratio. After determining the abnormal discrete value combinations, the reference abnormal score corresponding to each abnormal discrete value combination can be determined using the transaction category identifier: a first quantity ratio of normal samples to abnormal samples in the sample data set can be determined according to the transaction category label, the normal sample refers to a sample transaction feature data group whose transaction category label is a normal category label, and the abnormal sample refers to a sample transaction feature data group whose transaction category label is an abnormal category label; for any abnormal discrete value combination among multiple abnormal discrete value combinations, a sample data subset corresponding to any abnormal discrete value combination can be determined, the sample data subset is a subset of the sample data set, and some sample feature values ​​included in the sample transaction feature data group in the sample data subset are included in any abnormal discrete value combination; a second quantity ratio of normal samples to abnormal samples in the sample data subset can be determined according to the transaction category label; based on the first quantity ratio and the second quantity ratio, a reference abnormal score corresponding to the abnormal discrete value combination can be determined.

[0084] The calculation method for determining the reference anomaly score corresponding to the abnormal discrete value combination can be shown as follows:

[0085] Score i =ln(P i ) (5)

[0086] P i =(bad i / good i ) / (bad / good) (6)

[0087] In the above formula, i represents the i-th abnormal discrete value combination among multiple abnormal discrete value combinations, bad i Indicates the number of abnormal samples in the sample data subset corresponding to the i-th abnormal discrete value combination, good iIt represents the number of normal samples in the sample data subset corresponding to the i-th abnormal discrete value combination, bad represents the number of abnormal samples in the sample data set, good represents the number of normal samples in the sample data set, and Score i represents the reference abnormal score corresponding to the ith abnormal discrete value combination, ln(x) represents the logarithm operation of x, which can avoid the data being too large and affecting the category determination result. For example: for the sample data set shown in Table 1 above, the abnormal discrete value combination is determined to be (the abnormal discrete value set of the feature category "attribute" is (23, 24) or the abnormal discrete value set of the feature category "transaction quantity" is (3000, 3500)), and the sample data subset corresponding to the abnormal discrete value combination includes sample transaction feature data groups numbered 1, 4, 5 and 6. According to the calculation, it can be known that the first quantity ratio is 4 / 2=2, and the second quantity ratio is 3 / 1=3. Then, according to the above formula (5), it can be known that the reference abnormal score corresponding to the abnormal discrete value combination is ln(1.5) (approximately equal to 0.405). Through the method provided in the embodiment of the present application, the reference abnormal score of each abnormal discrete value combination can be determined, so that the category determination can be converted into an intuitive score, which is conducive to accurate category determination of transactions, while enhancing the interpretability and intuitiveness.

[0088] In one embodiment, after determining the reference abnormal score corresponding to each abnormal discrete value combination, it is also possible to: determine the sample abnormal score of each sample transaction feature data group in multiple sample transaction feature data groups according to multiple abnormal discrete value combinations and the reference abnormal score corresponding to each abnormal discrete value combination; determine the abnormal score threshold according to the score distribution of the sample abnormal scores of the multiple sample transaction feature data groups; the abnormal score threshold is used to determine the transaction category. After determining the reference abnormal score, the multiple abnormal discrete value combinations and the reference abnormal score corresponding to each abnormal discrete value combination can be used to determine and process each sample transaction feature data group to obtain the sample abnormal score of each sample transaction feature data group; the score distribution can be determined according to the sample abnormal score of the multiple sample transaction feature data groups and the transaction category label of each sample transaction feature data group, and the score distribution can indicate the distribution of the sample abnormal score of the sample transaction feature data group whose transaction category label is the abnormal transaction category, so that the abnormal score value range of the transaction feature data group of the abnormal transaction category can be specified, so that the abnormal score threshold can be determined. For example: after adopting the method provided in the embodiment of the present application, if the sample abnormal scores of the sample transaction feature data groups whose transaction category label is the abnormal transaction category are all greater than 6, the abnormal score threshold can be determined as 6. Through the method provided in the embodiment of the present application, the abnormality scoring threshold can be accurately determined, which is conducive to determining the transaction category of the resource transaction to be processed.

[0089] See also Figure 3, which is a schematic diagram of a method for determining an abnormal discrete value combination provided by an embodiment of the present application. After obtaining multiple sample transaction feature data groups and transaction category labels corresponding to each sample transaction feature data group contained in a sample data set, for a discrete feature category in multiple feature categories, determine whether the number of discrete feature values ​​of the discrete feature category is greater than or equal to (i.e., >=) the number of bins; if so, determine the abnormal sample rate corresponding to each discrete feature value in the discrete feature category, and bin the abnormal sample rate corresponding to multiple discrete feature values ​​in the discrete feature category according to the number of bins to obtain multiple discrete value sets of the discrete feature category; if not, directly determine multiple discrete value sets of the discrete feature category. For a continuous feature category in multiple feature categories, bin multiple feature values ​​in the continuous feature category can be binned according to the number of bins to obtain multiple discrete value sets of the continuous feature category; cluster multiple discrete value sets of the discrete feature category and multiple discrete value sets of the continuous feature category based on the Jaccard coefficient, and take a discrete value combination that meets the threshold to obtain multiple abnormal discrete value combinations, and the reference abnormal score corresponding to each abnormal discrete value combination can be calculated. The sample transaction feature data group can be processed using multiple abnormal discrete value combinations and reference abnormal scores corresponding to each abnormal discrete value combination to obtain sample abnormal scores for each sample transaction feature data group, and the abnormal score threshold can be determined based on the transaction category label and sample abnormal score corresponding to each sample transaction feature data group. The method provided by the embodiment of the present application can accurately determine the abnormal discrete value combination, making it easy to determine the transaction category of the resource transaction to be processed using multiple abnormal discrete value groups and abnormal score thresholds.

[0090] Through the method for determining abnormal discrete value combinations provided by the embodiments of the present application, the sample transaction feature data group and the transaction category identifier in the sample data set can be used to determine the abnormal discrete value combination, so that the abnormal discrete value combination can contain the common features of abnormal transactions, so that the transaction category can be determined by using the abnormal discrete value combination; the continuous feature category can be binned, so that the continuous feature category can be discretized for easy processing, and the feature values ​​with distribution similarity in the same feature category can also be merged; the abnormal discrete value sets of different feature categories can be merged, so that the abnormal discrete value sets with distribution similarity between different feature categories can be merged, while comprehensively considering the features of multiple dimensions, avoiding repeated determination of similar features, and improving the effectiveness and accuracy of the transaction category determination results; using the abnormal discrete value combination determined by the embodiments of the present application to determine the transaction category can effectively provide the accuracy and interpretability of the determination results.

[0091] See also Figure 4 , Figure 4A schematic diagram of a process flow of a category determination method provided in an embodiment of the present application. The category determination method can be implemented by the above-mentioned category determination device 102, or by other devices. The process flow of the category determination method provided in the embodiment of the present application includes but is not limited to:

[0092] S401. Acquire a transaction feature data group of a resource transaction to be processed, wherein the transaction feature data group includes a target feature value of each feature category in a plurality of feature categories.

[0093] In an embodiment of the present application, a category determination device can receive a resource transaction request sent by a terminal device, and determine a transaction feature data group of a pending resource transaction based on the resource transaction request. The pending resource transaction can be a resource transfer-out transaction or a resource transfer-in transaction. The transaction feature data group includes target feature values ​​for each feature category in a plurality of feature categories. For example: if the sample data set is shown in Table 1 above, the transaction feature data group of the pending resource transaction includes target feature values ​​corresponding to the 7 feature categories in Table 1. Through the method provided in an embodiment of the present application, the transaction feature data group of the pending resource transaction can be determined, so as to facilitate the subsequent rapid and accurate determination of the transaction category of the pending resource transaction based on the transaction feature data group.

[0094] S402. Determine a matching abnormal discrete value combination from a plurality of abnormal discrete value combinations according to the transaction feature data group, wherein a sample feature value matching the target feature value exists in the matching abnormal discrete value combination, and the matched target feature value and the sample feature value belong to the same feature category.

[0095] In the embodiment of the present application, an abnormal matching discrete value combination can be determined from a plurality of abnormal discrete value combinations according to a transaction feature data group, wherein the matching abnormal discrete value combination contains a sample feature value that matches the target feature value, and the matched target feature value and the sample feature value belong to the same feature category. The corresponding feature category in the transaction feature data group is the same as the corresponding feature category in the above-mentioned sample transaction feature data group. For example: using the sample data group shown in Table 1 above for processing, three abnormal discrete value combinations are obtained, namely (the abnormal discrete value set of the feature category "attribute" is (23, 24) or the abnormal discrete value set of the feature category "transaction quantity" is (3000, 3500)), (the feature category "region" is "B" or the feature category "category" is "A") and (the feature category "transaction time" is "10151420"); and the transaction feature data group of the resource transaction to be processed is shown in Table 2 below.

[0096] Table 2

[0097]

[0098] As can be seen from Table 2, the matching abnormal discrete value combinations corresponding to the transaction feature data set are (the abnormal discrete value set of the feature category "attribute" is (23, 24) or the abnormal discrete value set of the feature category "transaction quantity" is (3000, 3500)), (the feature category "region" is "B" or the feature category "category" is "A"). The method provided in the embodiment of the present application can accurately and intuitively reflect the abnormal discrete value combinations hit by the transaction feature data set, so as to facilitate the subsequent accurate determination of the transaction category of the resource transaction to be processed based on the hit abnormal discrete value combinations.

[0099] In one embodiment, multiple abnormal discrete value combinations are obtained by clustering multiple abnormal discrete value sets, the abnormal discrete value sets are determined from multiple discrete value sets of each feature category according to the transaction category label, the multiple discrete value sets of each feature category are determined according to multiple sample feature values ​​of each feature category, the transaction category label and the multiple sample feature values ​​are included in the sample data set, the sample data set includes multiple sample transaction feature data groups and transaction category labels of each sample transaction feature data group, each sample transaction feature data group includes sample feature values ​​of each feature category, and the sample category label is used to indicate the transaction category of the resource transaction corresponding to the sample transaction feature data group. The sample data set may include multiple sample transaction feature data groups and transaction category labels of each sample transaction feature data group, the transaction category label is used to indicate the transaction category of the resource transaction corresponding to the sample transaction feature data group, and the transaction category label is a normal category label or an abnormal category label. Multiple sample feature values ​​of each feature category can be obtained from multiple sample transaction feature data groups, and multiple discrete value sets of each feature category can be determined based on the multiple sample feature values ​​of each feature category, that is, the feature values ​​corresponding to the continuous feature category and some discrete feature categories in the multiple feature categories can be binned to obtain multiple discrete value sets; an abnormal discrete value set can be determined from the multiple discrete value sets of each feature category according to the transaction category label; after the abnormal discrete value set is determined, the multiple abnormal discrete value sets determined can be clustered so that the abnormal discrete value sets with higher similarity in the multiple abnormal discrete value sets corresponding to different feature categories can be merged, thereby obtaining multiple abnormal discrete value combinations, and the abnormal discrete value combination can be the union of one or more abnormal discrete value sets. The method for determining the abnormal discrete value combination in the embodiment of the present application can be as shown in the above steps S201-S204. Through the method provided in the embodiment of the present application, the sample data set can be effectively used to determine the abnormal discrete value combination, and the abnormal discrete value combination can include features of multiple different dimensions, and similar abnormal features can be merged, so that the transaction category of the resource transaction to be processed can be accurately determined.

[0100] S403: Obtain reference anomaly scores corresponding to each determined matching anomaly discrete value combination, and determine the transaction category of the to-be-processed resource transaction according to the reference anomaly scores corresponding to each matching anomaly discrete value combination.

[0101] In an embodiment of the present application, a reference anomaly score corresponding to each determined matching abnormal discrete value combination can be obtained. The reference anomaly score corresponding to each abnormal discrete value combination may be different. The larger the reference anomaly score corresponding to the abnormal discrete value combination, the greater the improvement of the abnormal discrete value combination, and the greater the probability that the pending resource transaction corresponding to the transaction feature data group that hits the abnormal discrete value combination is an abnormal transaction. The transaction category of the pending resource transaction can be determined based on the reference anomaly score corresponding to each matching abnormal discrete value combination. Through the method provided in the embodiment of the present application, the transaction category of the pending resource transaction can be accurately determined using the abnormal discrete value combination, which effectively improves the accuracy of category determination and is also conducive to ensuring the security of resource transactions.

[0102] In one embodiment, the implementation method of determining the transaction category of the resource transaction to be processed according to the reference abnormality score corresponding to each matching abnormal discrete value combination can be: determining the target abnormality score of the transaction feature data group according to the reference abnormality score corresponding to each matching abnormal discrete value combination; if the target abnormality score is greater than or equal to the abnormality score threshold, the transaction category of the resource transaction to be processed is determined to be an abnormal transaction category; if the target abnormality score is less than the abnormality score threshold, the transaction category of the resource transaction to be processed is determined to be a normal transaction category. The reference abnormality scores corresponding to each matching abnormal discrete value combination can be summed to obtain the target abnormality score of the transaction feature data group; and the target abnormality score of the transaction feature data group is compared with the abnormality score threshold. If the target abnormality score is greater than or equal to the abnormality score threshold, the transaction category of the resource transaction to be processed can be determined to be an abnormal transaction category; if the target abnormality score is less than the abnormality score threshold, the transaction category of the resource transaction to be processed can be determined to be a normal transaction category. For example, using the sample data set shown in Table 1 above for processing, three abnormal discrete value combinations are obtained, namely (the abnormal discrete value set of the feature category "attribute" is (23, 24) or the abnormal discrete value set of the feature category "transaction quantity" is (3000, 3500)), (the feature category "region" is "B" or the feature category "category" is "A") and (the feature category "transaction time" is "10151420"), and the reference abnormal scores corresponding to the three abnormal discrete value combinations are 3, 4, and 5, respectively, and the abnormal score threshold is 8; and the data to be processed is The transaction feature data group of the source transaction is shown in Table 2 above. It can be seen that the matching abnormal discrete value combination corresponding to the transaction feature data group is (the abnormal discrete value set of the feature category "attribute" is (23, 24) or the abnormal discrete value set of the feature category "transaction quantity" is (3000, 3500)), (the feature category "region" is "B" or the feature category "category" is "A"), then the target abnormal score of the transaction feature data group is 3+4=7, which is less than the abnormal score threshold. It can be determined that the transaction category of the pending resource transaction corresponding to the transaction feature data group is a normal transaction category. Through the method provided in the embodiment of the present application, the transaction category of the pending resource transaction can be accurately determined, the misjudgment situation is reduced, and the security of resource transactions is effectively guaranteed.

[0103] In one embodiment, the implementation method of determining the abnormal score threshold can be: determining the sample abnormal score of each sample transaction feature data group in multiple sample transaction feature data groups according to multiple abnormal discrete value combinations and reference abnormal scores corresponding to each abnormal discrete value combination; determining the abnormal score threshold according to the score distribution of the sample abnormal scores of the multiple sample transaction feature data groups; the abnormal score threshold is used to determine the transaction category. After determining the reference abnormal score, the multiple abnormal discrete value combinations and the reference abnormal scores corresponding to each abnormal discrete value combination can be used to determine and process each sample transaction feature data group to obtain the sample abnormal score of each sample transaction feature data group; the score distribution can be determined according to the sample abnormal scores of the multiple sample transaction feature data groups and the transaction category labels of each sample transaction feature data group, and the score distribution can indicate the distribution of the sample abnormal scores of the sample transaction feature data groups whose transaction category labels are abnormal transaction categories, so that the abnormal score value range of the transaction feature data groups of abnormal transaction categories can be specified, so that the abnormal score threshold can be determined. For example: after adopting the method provided in the embodiment of the present application, if the sample abnormal scores of the sample transaction feature data groups whose transaction category labels are abnormal transaction categories are all greater than 7, the abnormal score threshold can be determined as 7. By using the method provided in the embodiment of the present application, the abnormal scoring threshold can be accurately determined, which is conducive to determining the transaction category of the resource transaction to be processed. It should be noted that the sample data set used to determine the abnormal discrete value combination and the sample data set used to determine the abnormal scoring threshold may not be exactly the same.

[0104] See also Figure 5 , which is a schematic diagram of a category determination method provided by an embodiment of the present application. The category determination device can obtain a transaction feature data group of a resource transaction to be processed, and the transaction feature data group includes a target feature value of each feature category in a plurality of feature categories; a matching abnormal discrete value combination can be determined from a plurality of abnormal discrete value combinations according to the transaction feature data group, wherein a sample feature value matching the target feature value exists in the matching abnormal discrete value combination, and the matching target feature value and the sample feature value belong to the same feature category; a reference abnormal score corresponding to each determined matching abnormal discrete value combination can be obtained, and a target abnormal score of the transaction feature data group can be determined according to the reference abnormal score corresponding to each matching abnormal discrete value combination; it is determined whether the target abnormal score is greater than or equal to (i.e., >=) the abnormal score threshold, and if so, the transaction category of the resource transaction to be processed is determined to be an abnormal transaction category; if not, the transaction category of the resource transaction to be processed is determined to be a normal transaction category. Through the method provided by the embodiment of the present application, the transaction category of the resource transaction to be processed can be accurately and quickly determined, avoiding the use of manually summarized determination rules to determine the transaction category of the resource transaction, and effectively reducing the situation of category misjudgment.

[0105] In one embodiment, if the transaction category of the pending resource transaction is a normal transaction category, the category determination device can complete the relevant steps of the pending resource transaction to realize the transfer of electronic resources. For example: the specific content of the pending resource transaction is: the transaction object corresponding to the transaction device D1 transfers part of the electronic resources to the transaction object corresponding to the transaction device D2. After the method provided in the embodiment of the present application is used to determine that the transaction category of the pending resource transaction is a normal transaction category, the category determination device can complete the specific content of the pending resource transaction and transfer part of the electronic resources of the transaction object corresponding to the transaction device D1 to the transaction object corresponding to the transaction device D2. The method provided in the embodiment of the present application can ensure the security of normal resource transactions.

[0106] In one embodiment, if the transaction category of the pending resource transaction is an abnormal transaction category, the category determination device can intercept the pending resource transaction, send relevant prompt information to the initiating device of the pending resource transaction, and restrict the initiating device. For example: the specific content of the pending resource transaction is that the transaction object corresponding to the transaction device D3 transfers part of the electronic resources to the transaction object corresponding to the transaction device D4; the method provided in the embodiment of the present application is used to determine that the transaction category of the pending resource transaction is an abnormal transaction category, then the category determination device will terminate the processing process related to the pending resource transaction, and generate corresponding abnormal prompt information according to the error code corresponding to the abnormal transaction category; the category determination device can send the abnormal prompt information to the initiating device of the pending resource transaction, that is, the transaction device D3; at the same time, the transaction object corresponding to the initiating device is restricted (the restriction can be to prohibit the transaction object corresponding to the initiating device from transferring resources in or out for a period of time). After receiving the abnormal prompt information, the initiating device can determine the interception reason of the pending resource transaction according to the abnormal prompt information; if the initiating device needs to lift the restriction and complete the pending resource transaction, it can send verification information to the category determination device. After the category determination device completes the verification processing according to the verification information, it will lift the restriction on the transaction object corresponding to the initiating device, and the initiating device can re-initiate the pending resource transaction. Through the method provided in the embodiment of the present application, the pending resource transaction of the abnormal transaction category can be intercepted, which effectively ensures the security of resource transactions, and at the same time, improves the rationality of the system and enhances the user experience.

[0107] See also Figure 6 , which is a schematic diagram of an abnormal prompt information display interface provided in an embodiment of the present application. Figure 6In the display interface of abnormal prompt information, there are abnormal prompt information and abnormal prompt button, where the abnormal prompt information is "the current resource transaction is abnormal. To report the resource safety, this transaction cannot be completed temporarily"; the abnormal prompt button includes "Close" button and "Learn Details" button. The "Learn Details" button is associated with the abnormal question and answer interface. Please refer to Figure 7 , which is a schematic diagram of an abnormal question and answer interface provided in an embodiment of the present application. Figure 7 In the abnormal questions and answers interface, a frequently asked questions (FAQ) module may be included, which includes frequently asked questions and answers to the questions. Figure 7 In the FAQ module, the question "1. Why is it restricted?" related to abnormal transactions is displayed, as well as the answer to the question: "The following problems may exist, and the current resource transaction cannot be completed. 1. The transaction object is associated with abnormal behavior; 2. The transaction object is associated with abnormal transaction behavior due to abnormal use of relevant information of the transaction object; 3. Assisting other transaction objects to complete abnormal transaction behavior without knowing the relevant information of the resource." The abnormal question and answer interface also includes a prompt information and processing module, which includes the prompt information "2. Warm reminder: Please ensure the normal use of the transaction object and do not transfer unknown resources to other transaction objects." and the processing button "Submit verification information". The "Submit verification information" button is associated with the verification information submission interface. Please refer to Figure 8 , which is a schematic diagram of a verification information submission interface provided in an embodiment of the present application. Figure 8 In the verification information, the verification information includes "photo of holding ID", "other relevant ID", and "information proving the source of resources". After entering the verification information, the "Submit" button can be triggered to send the verification information to the category determination device. After the category determination device completes the verification processing according to the verification information, the restriction on the transaction object can be lifted. The method provided in the embodiment of the present application can effectively terminate abnormal resource transactions and effectively ensure the security of resource transactions.

[0108] Through the category determination method provided in the embodiment of the present application, a plurality of abnormal discrete value combinations can be used to determine a matching abnormal discrete value combination, which intuitively reflects the abnormal feature values ​​hit by the transaction feature data group of the resource transaction to be processed, thereby improving the interpretability of the category determination result. At the same time, by using a plurality of abnormal discrete values ​​rather than manually summarized category determination rules to determine the transaction category of the resource transaction, the abnormal features of various dimensions can be comprehensively considered to avoid the interference of similar features; the transaction category of the resource transaction to be processed can be determined according to the reference abnormal score corresponding to the matching abnormal discrete value combination, and the abnormal degree of the resource transaction to be processed can be accurately measured by the abnormal score, thereby effectively improving the accuracy of the transaction category of the determined resource transaction, improving the processing efficiency of the category determination, and ensuring the validity of the determination result; for the determined abnormal transaction, corresponding limitation and abnormal prompt processing can be performed to effectively ensure the security of the resource transaction.

[0109] See also Fig. 9 , Fig. 9 This is a structural block diagram of a category determination device provided in an embodiment of the present application. The device includes:

[0110] An acquisition unit 901 is used to acquire a transaction feature data group of a resource transaction to be processed, wherein the transaction feature data group includes a target feature value of each feature category in a plurality of feature categories;

[0111] A processing unit 902 is used to determine a matching abnormal discrete value combination from a plurality of abnormal discrete value combinations according to the transaction feature data group, wherein the matching abnormal discrete value combination contains a sample feature value that matches the target feature value, and the matched target feature value and the sample feature value belong to the same feature category;

[0112] A determination unit 903 is used to obtain reference anomaly scores corresponding to each determined matching anomaly discrete value combination, and determine the transaction category of the to-be-processed resource transaction according to the reference anomaly scores corresponding to each matching anomaly discrete value combination;

[0113] Among them, the multiple abnormal discrete value combinations are obtained by clustering multiple abnormal discrete value sets, the abnormal discrete value sets are determined from multiple discrete value sets of each feature category according to the transaction category label, the multiple discrete value sets of each feature category are determined according to multiple sample feature values ​​of each feature category, the transaction category label and the multiple sample feature values ​​are included in a sample data set, the sample data set includes multiple sample transaction feature data groups and transaction category labels for each sample transaction feature data group, each sample transaction feature data group includes sample feature values ​​of each feature category, and the sample category label is used to indicate the transaction category of the resource transaction corresponding to the sample transaction feature data group.

[0114] In one embodiment, when the determination unit 903 determines the transaction category of the resource transaction to be processed according to the reference abnormality scores corresponding to each matching abnormal discrete value combination, it is specifically used to: determine the target abnormality score of the transaction feature data group according to the reference abnormality scores corresponding to each matching abnormal discrete value combination; if the target abnormality score is greater than or equal to the abnormality score threshold, determine that the transaction category of the resource transaction to be processed is an abnormal transaction category; if the target abnormality score is less than the abnormality score threshold, determine that the transaction category of the resource transaction to be processed is a normal transaction category.

[0115] In one embodiment, the processing unit 902 is further used to: obtain multiple sample transaction feature data groups included in the sample data set and transaction category labels of each sample transaction feature data group; each sample transaction feature data group includes a sample feature value of each feature category in the multiple feature categories, and the transaction category label is a normal category label or an abnormal category label; obtain multiple sample feature values ​​of each feature category from the multiple sample transaction feature data groups, and determine multiple discrete value sets of each feature category according to the multiple sample feature values ​​of each feature category; determine an abnormal discrete value set from the multiple discrete value sets of each feature category according to the transaction category label; cluster the determined multiple abnormal discrete value sets to obtain multiple abnormal discrete value combinations, and the abnormal discrete value combination is the union of one or more abnormal discrete value sets.

[0116] In one embodiment, the processing unit 902 is further used to: determine a first quantity ratio of normal samples to abnormal samples in the sample data set according to the transaction category label; normal samples refer to sample transaction feature data groups whose transaction category labels are normal category labels, and abnormal samples refer to sample transaction feature data groups whose transaction category labels are abnormal category labels; for any abnormal discrete value combination among the multiple abnormal discrete value combinations, determine a sample data subset corresponding to the any abnormal discrete value combination; the sample data subset is a subset of the sample data set, and some sample feature values ​​included in the sample transaction feature data groups in the sample data subset are included in the any abnormal discrete value combination; determine a second quantity ratio of normal samples to abnormal samples in the sample data subset according to the transaction category label; and determine a reference anomaly score corresponding to the any abnormal discrete value combination according to the first quantity ratio and the second quantity ratio.

[0117] In one embodiment, the processing unit 902 is further used to: determine a sample abnormality score for each sample transaction feature data group in the multiple sample transaction feature data groups based on the multiple abnormal discrete value combinations and the reference abnormality scores corresponding to each abnormal discrete value combination; determine an abnormality score threshold based on the score distribution of the sample abnormality scores of the multiple sample transaction feature data groups; the abnormality score threshold is used to determine the transaction category.

[0118] In one embodiment, when the processing unit 902 determines multiple discrete value sets of each feature category based on multiple sample feature values ​​of each feature category, it is specifically used to: for a continuous feature category among the multiple feature categories, perform binning processing on the multiple sample feature values ​​of the continuous feature category to obtain multiple discrete value sets of the continuous feature category.

[0119] In one embodiment, when the processing unit 902 performs binning processing on multiple sample feature values ​​of the continuous feature category to obtain multiple discrete value sets of the continuous feature category, it is specifically used to: sort the multiple sample feature values ​​of the continuous feature category to obtain a sorting result, and the elements in the sorting result are the sample feature values; for any two adjacent sample feature values ​​in the sorting result, determine the sample distribution similarity of the sample data subset corresponding to the any two adjacent sample feature values, and the sample data subset is a subset of the sample data set; merge the two adjacent sample feature values ​​with the largest sample distribution similarity in the sorting result into one element to obtain a new sorting result, and execute the above steps according to the new sorting result; if the number of elements in the newly obtained sorting result is equal to the number of bins, then each element in the newly obtained sorting result is respectively determined as a discrete value set of the continuous feature category.

[0120] In one embodiment, when the processing unit 902 determines multiple discrete value sets for each feature category based on multiple sample feature values ​​for each feature category, it is specifically used to: for a discrete feature category among the multiple feature categories, determine multiple discrete feature values ​​based on multiple sample feature values ​​of the discrete feature category; if the number of the multiple discrete feature values ​​is greater than the number of bins, determine the abnormal sample rate of the sample data subset corresponding to each discrete feature value; the sample data subset is a subset of the sample data set, and each sample transaction feature data group included in the sample data subset contains a sample feature value that matches the discrete feature value; and bin the abnormal sample rates corresponding to the multiple discrete feature values ​​according to the number of bins to obtain multiple discrete value sets for the discrete feature category.

[0121] In one embodiment, when the processing unit 902 performs clustering processing on the determined multiple abnormal discrete value sets to obtain multiple abnormal discrete value combinations, it is specifically used to: determine the set similarity of sample data subsets corresponding to any two abnormal discrete value sets that do not belong to the same feature category in the determined multiple abnormal discrete value sets, and the sample data subset is a subset of the sample data set; if the maximum set similarity of two abnormal discrete value sets determined for the multiple abnormal discrete value sets is greater than or equal to a similarity threshold, merge the two abnormal discrete value sets corresponding to the maximum set similarity in the multiple abnormal discrete value sets to obtain new multiple abnormal discrete value sets, and perform the above steps according to the new multiple abnormal discrete value sets; if the maximum similarity of two abnormal discrete value sets determined for the new multiple abnormal discrete value sets obtained again is less than the similarity threshold, then determine each abnormal discrete value set in the new multiple abnormal discrete value sets obtained again as an abnormal discrete value combination.

[0122] In one embodiment, when the processing unit 902 determines an abnormal discrete value set from multiple discrete value sets of each feature category according to the transaction category label, it is specifically used to: for any feature category among the multiple feature categories, determine the abnormal sample rate of a sample data subset corresponding to each discrete value set in the multiple discrete value sets of any feature category according to the transaction category label; the sample data subset is a subset of the sample data set, and some sample feature values ​​included in the sample transaction feature data group in the sample data subset are included in the discrete value set; and a discrete value set whose corresponding abnormal sample rate in the multiple discrete value sets of any feature category is greater than or equal to an abnormal sample rate threshold is determined as an abnormal discrete value set.

[0123] It can be understood that the functions of each functional unit of the category determination device in the embodiment of the present application can be specifically implemented according to the category determination method in the above method embodiment, and its specific implementation process can refer to the relevant description in the above category determination method embodiment, which will not be repeated here.

[0124] Through the category determination device provided in the embodiment of the present application, a plurality of abnormal discrete value combinations can be used to determine a matching abnormal discrete value combination, which intuitively reflects the abnormal feature values ​​hit by the transaction feature data group of the resource transaction to be processed, thereby improving the interpretability of the category determination result. At the same time, by using a plurality of abnormal discrete values ​​rather than manually summarized category determination rules to determine the transaction category of the resource transaction, the abnormal features of various dimensions can be comprehensively considered to avoid the interference of similar features; the transaction category of the resource transaction to be processed can be determined according to the reference abnormal score corresponding to the matching abnormal discrete value combination, and the abnormal degree of the resource transaction to be processed can be accurately measured by the abnormal score, thereby effectively improving the accuracy of the transaction category of the determined resource transaction, improving the processing efficiency of the category determination, and ensuring the validity of the determination result; for the determined abnormal transaction, corresponding limitation and abnormal prompt processing can be performed to effectively ensure the security of the resource transaction.

[0125] See also Fig.10 , Fig.10 The present invention provides a block diagram of a computer device according to an embodiment of the present invention. The computer device described in the embodiment of the present invention includes: a processor 1001, a communication interface 1002, and a memory 1003. The processor 1001, the communication interface 1002, and the memory 1003 may be connected via a bus or other means, and the present invention takes the bus connection as an example.

[0126] Among them, the processor 1001 (or CPU (Central Processing Unit)) is the computing core and control core of the computer device, which can parse various instructions in the computer device and process various data of the computer device. For example, the CPU can be used to parse the power on and off instructions sent by the user to the computer device, and control the computer device to perform power on and off operations; for another example, the CPU can transmit various interactive data between the internal structures of the computer device, and so on. The communication interface 1002 can optionally include a standard wired interface, a wireless interface (such as Wi-Fi, a mobile communication interface, etc.), which is controlled by the processor 1001 to send and receive data. The memory 1003 (Memory) is a memory device in the computer device for storing programs and data. It can be understood that the memory 1003 here can include both the built-in memory of the computer device and the extended memory supported by the computer device. The memory 1003 provides a storage space, which stores the operating system of the computer device, which may include but is not limited to: Android system, iOS system, Windows Phone system, etc., and this application does not limit this.

[0127] In the embodiment of the present application, the processor 1001 performs the following operations by running the executable program code in the memory 1003:

[0128] Acquire a transaction feature data group of a resource transaction to be processed, wherein the transaction feature data group includes a target feature value of each feature category in a plurality of feature categories;

[0129] Determining a matching abnormal discrete value combination from a plurality of abnormal discrete value combinations according to the transaction feature data group, wherein a sample feature value matching the target feature value exists in the matching abnormal discrete value combination, and the matched target feature value and the sample feature value belong to the same feature category;

[0130] Obtaining reference anomaly scores corresponding to each determined combination of matching anomaly discrete values, and determining a transaction category of the to-be-processed resource transaction according to the reference anomaly scores corresponding to each determined combination of matching anomaly discrete values;

[0131] Among them, the multiple abnormal discrete value combinations are obtained by clustering multiple abnormal discrete value sets, the abnormal discrete value sets are determined from multiple discrete value sets of each feature category according to the transaction category label, the multiple discrete value sets of each feature category are determined according to multiple sample feature values ​​of each feature category, the transaction category label and the multiple sample feature values ​​are included in a sample data set, the sample data set includes multiple sample transaction feature data groups and transaction category labels for each sample transaction feature data group, each sample transaction feature data group includes sample feature values ​​of each feature category, and the sample category label is used to indicate the transaction category of the resource transaction corresponding to the sample transaction feature data group.

[0132] In one embodiment, when the processor 1001 determines the transaction category of the resource transaction to be processed according to the reference anomaly scores corresponding to each matching anomaly discrete value combination, it is specifically used to: determine the target anomaly score of the transaction feature data group according to the reference anomaly scores corresponding to each matching anomaly discrete value combination; if the target anomaly score is greater than or equal to the anomaly score threshold, determine that the transaction category of the resource transaction to be processed is an abnormal transaction category; if the target anomaly score is less than the anomaly score threshold, determine that the transaction category of the resource transaction to be processed is a normal transaction category.

[0133] In one embodiment, the processor 1001 is further used to: obtain multiple sample transaction feature data groups included in the sample data set and transaction category labels of each sample transaction feature data group; each sample transaction feature data group includes a sample feature value of each feature category in the multiple feature categories, and the transaction category label is a normal category label or an abnormal category label; obtain multiple sample feature values ​​of each feature category from the multiple sample transaction feature data groups, and determine multiple discrete value sets of each feature category according to the multiple sample feature values ​​of each feature category; determine an abnormal discrete value set from the multiple discrete value sets of each feature category according to the transaction category label; and perform clustering processing on the determined multiple abnormal discrete value sets to obtain multiple abnormal discrete value combinations, and the abnormal discrete value combination is the union of one or more abnormal discrete value sets.

[0134] In one embodiment, the processor 1001 is further used to: determine a first quantity ratio of normal samples to abnormal samples in the sample data set according to the transaction category label; normal samples refer to sample transaction feature data groups whose transaction category labels are normal category labels, and abnormal samples refer to sample transaction feature data groups whose transaction category labels are abnormal category labels; for any abnormal discrete value combination among the multiple abnormal discrete value combinations, determine a sample data subset corresponding to the any abnormal discrete value combination; the sample data subset is a subset of the sample data set, and some sample feature values ​​included in the sample transaction feature data groups in the sample data subset are included in the any abnormal discrete value combination; determine a second quantity ratio of normal samples to abnormal samples in the sample data subset according to the transaction category label; and determine a reference anomaly score corresponding to the any abnormal discrete value combination according to the first quantity ratio and the second quantity ratio.

[0135] In one embodiment, the processor 1001 is further used to: determine a sample abnormality score for each sample transaction feature data group in the multiple sample transaction feature data groups based on the multiple abnormal discrete value combinations and the reference abnormality scores corresponding to each abnormal discrete value combination; determine an abnormality score threshold based on the score distribution of the sample abnormality scores of the multiple sample transaction feature data groups; the abnormality score threshold is used to determine the transaction category.

[0136] In one embodiment, when the processor 1001 determines multiple discrete value sets of each feature category based on multiple sample feature values ​​of each feature category, it is specifically used to: for a continuous feature category among the multiple feature categories, perform binning processing on the multiple sample feature values ​​of the continuous feature category to obtain multiple discrete value sets of the continuous feature category.

[0137] In one embodiment, when the processor 1001 performs binning processing on multiple sample feature values ​​of the continuous feature category to obtain multiple discrete value sets of the continuous feature category, it is specifically used to: sort the multiple sample feature values ​​of the continuous feature category to obtain a sorting result, and the elements in the sorting result are the sample feature values; for any two adjacent sample feature values ​​in the sorting result, determine the sample distribution similarity of the sample data subset corresponding to the any two adjacent sample feature values, and the sample data subset is a subset of the sample data set; merge the two adjacent sample feature values ​​with the largest sample distribution similarity in the sorting result into one element to obtain a new sorting result, and execute the above steps according to the new sorting result; if the number of elements in the newly obtained sorting result is equal to the number of bins, then each element in the newly obtained sorting result is respectively determined as a discrete value set of the continuous feature category.

[0138] In one embodiment, when the processor 1001 determines multiple discrete value sets for each feature category based on multiple sample feature values ​​for each feature category, it is specifically used to: for a discrete feature category among the multiple feature categories, determine multiple discrete feature values ​​based on multiple sample feature values ​​of the discrete feature category; if the number of the multiple discrete feature values ​​is greater than the number of bins, determine the abnormal sample rate of the sample data subset corresponding to each discrete feature value; the sample data subset is a subset of the sample data set, and each sample transaction feature data group included in the sample data subset contains a sample feature value that matches the discrete feature value; and bin the abnormal sample rates corresponding to the multiple discrete feature values ​​according to the number of bins to obtain multiple discrete value sets for the discrete feature category.

[0139] In one embodiment, when the processor 1001 performs clustering processing on the determined multiple abnormal discrete value sets to obtain multiple abnormal discrete value combinations, it is specifically used to: determine the set similarity of sample data subsets corresponding to any two abnormal discrete value sets that do not belong to the same feature category in the determined multiple abnormal discrete value sets, where the sample data subset is a subset of the sample data set; if the maximum set similarity of two abnormal discrete value sets determined for the multiple abnormal discrete value sets is greater than or equal to a similarity threshold, merge the two abnormal discrete value sets corresponding to the maximum set similarity in the multiple abnormal discrete value sets to obtain new multiple abnormal discrete value sets, and perform the above steps according to the new multiple abnormal discrete value sets; if the maximum similarity of two abnormal discrete value sets determined for the new multiple abnormal discrete value sets obtained again is less than the similarity threshold, then determine each abnormal discrete value set in the new multiple abnormal discrete value sets obtained again as an abnormal discrete value combination.

[0140] In one embodiment, when the processor 1001 determines an abnormal discrete value set from multiple discrete value sets of each feature category according to the transaction category label, it is specifically used to: for any feature category among the multiple feature categories, determine the abnormal sample rate of a sample data subset corresponding to each discrete value set in the multiple discrete value sets of any feature category according to the transaction category label; the sample data subset is a subset of the sample data set, and some sample feature values ​​included in the sample transaction feature data group in the sample data subset are included in the discrete value set; and determine a discrete value set whose corresponding abnormal sample rate in the multiple discrete value sets of any feature category is greater than or equal to an abnormal sample rate threshold as an abnormal discrete value set.

[0141] In a specific implementation, the processor 1001, communication interface 1002 and memory 1003 described in the embodiments of the present application can execute the implementation method of the category determination device described in a category determination method provided in an embodiment of the present application, and can also execute the implementation method described in a category determination device provided in an embodiment of the present application, which will not be repeated here.

[0142] Through the computer device provided by the embodiment of the present application, a plurality of abnormal discrete value combinations can be used to determine a matching abnormal discrete value combination, which intuitively reflects the abnormal feature values ​​hit by the transaction feature data group of the resource transaction to be processed, thereby improving the interpretability of the category determination result. At the same time, by using a plurality of abnormal discrete values ​​rather than manually summarized category determination rules to determine the transaction category of the resource transaction, the abnormal features of various dimensions can be comprehensively considered to avoid the interference of similar features; the transaction category of the resource transaction to be processed can be determined according to the reference abnormal score corresponding to the matching abnormal discrete value combination, and the abnormal degree of the resource transaction to be processed can be accurately measured by the abnormal score, which effectively improves the accuracy of the transaction category of the determined resource transaction, improves the processing efficiency of the category determination, and ensures the validity of the determination result; for the determined abnormal transaction, corresponding limitation and abnormal prompt processing can be performed to effectively ensure the security of the resource transaction.

[0143] The embodiment of the present application also provides a computer-readable storage medium, in which a computer program is stored, and when the computer program is run on a computer, the computer executes the category determination method as described in the embodiment of the present application. The specific implementation method can be referred to the above description, and will not be repeated here.

[0144] The embodiment of the present application also provides a computer program product, the computer program product includes a computer program or a computer instruction, and the computer program or the computer instruction is stored in a computer-readable storage medium. The processor of the computer device reads the computer program or the computer instruction from the computer-readable storage medium, and the processor executes the computer program or the computer instruction, so that the computer device performs the category determination method as described in the embodiment of the present application. The specific implementation method can be referred to the above description, which will not be repeated here.

[0145] It should be noted that, for the above-mentioned various method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that this application is not limited by the order of the actions described, because according to this application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by this application.

[0146] A person skilled in the art may understand that all or part of the steps in the various methods of the above embodiments may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0147] The above disclosure is only part of the embodiments of the present application, which certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope covered by the present application.

Claims

1. A method for determining a category, characterized in that: The method comprises: Acquire a transaction feature data group of a resource transaction to be processed, wherein the transaction feature data group includes a target feature value of each feature category in a plurality of feature categories; Determining a matching abnormal discrete value combination from a plurality of abnormal discrete value combinations according to the transaction feature data group, wherein a sample feature value matching the target feature value exists in the matching abnormal discrete value combination, and the matched target feature value and the sample feature value belong to the same feature category; Obtaining reference anomaly scores corresponding to each determined combination of matching anomaly discrete values, and determining a transaction category of the to-be-processed resource transaction according to the reference anomaly scores corresponding to each determined combination of matching anomaly discrete values; Among them, the multiple abnormal discrete value combinations are obtained by clustering multiple abnormal discrete value sets, the abnormal discrete value sets are determined from multiple discrete value sets of each feature category according to the transaction category label, the multiple discrete value sets of each feature category are determined according to multiple sample feature values ​​of each feature category, the transaction category label and the multiple sample feature values ​​are included in a sample data set, the sample data set includes multiple sample transaction feature data groups and transaction category labels for each sample transaction feature data group, each sample transaction feature data group includes sample feature values ​​of each feature category, and the sample category label is used to indicate the transaction category of the resource transaction corresponding to the sample transaction feature data group.

2. The method according to claim 1, characterized in that The determining the transaction category of the to-be-processed resource transaction according to the reference anomaly scores corresponding to the respective matching anomaly discrete value combinations includes: Determine a target anomaly score for the transaction feature data set according to reference anomaly scores corresponding to each matching anomaly discrete value combination; If the target anomaly score is greater than or equal to the anomaly score threshold, determining that the transaction category of the to-be-processed resource transaction is an abnormal transaction category; If the target anomaly score is less than the anomaly score threshold, the transaction category of the to-be-processed resource transaction is determined to be a normal transaction category.

3. The method according to claim 1 or 2, characterized in that: The method further comprises: Acquire a plurality of sample transaction feature data groups and a transaction category label of each sample transaction feature data group included in the sample data set; each sample transaction feature data group includes a sample feature value of each feature category in the plurality of feature categories, and the transaction category label is a normal category label or an abnormal category label; Acquire multiple sample feature values ​​of each feature category from the multiple sample transaction feature data groups, and determine multiple discrete value sets of each feature category according to the multiple sample feature values ​​of each feature category; Determining an abnormal discrete value set from a plurality of discrete value sets of each feature category according to the transaction category label; Clustering is performed on the determined multiple abnormal discrete value sets to obtain multiple abnormal discrete value combinations, where the abnormal discrete value combination is a union of one or more abnormal discrete value sets.

4. The method according to claim 3, characterized in that: The method further comprises: Determining a first quantity ratio of normal samples to abnormal samples in the sample data set according to the transaction category label; normal samples refer to a sample transaction feature data group whose transaction category label is a normal category label, and abnormal samples refer to a sample transaction feature data group whose transaction category label is an abnormal category label; For any abnormal discrete value combination among the multiple abnormal discrete value combinations, determine a sample data subset corresponding to the any abnormal discrete value combination; the sample data subset is a subset of the sample data set, and part of the sample feature values ​​included in the sample transaction feature data group in the sample data subset are included in the any abnormal discrete value combination; Determining a second quantity ratio of normal samples to abnormal samples in the sample data subset according to the transaction category label; A reference abnormality score corresponding to any abnormal discrete value combination is determined according to the first quantity ratio and the second quantity ratio.

5. The method according to claim 4, characterized in that The method further comprises: Determining a sample anomaly score for each sample transaction feature data group in the multiple sample transaction feature data groups according to the multiple abnormal discrete value combinations and the reference anomaly scores corresponding to each abnormal discrete value combination; An abnormality score threshold is determined according to the score distribution of sample abnormality scores of the plurality of sample transaction feature data groups; the abnormality score threshold is used to determine the transaction category.

6. The method according to claim 3, characterized in that Determining a plurality of discrete value sets of each feature category according to a plurality of sample feature values ​​of each feature category includes: For a continuous feature category among the multiple feature categories, a plurality of sample feature values ​​of the continuous feature category are binned to obtain a plurality of discrete value sets of the continuous feature category.

7. The method according to claim 6, characterized in that The binning process is performed on the multiple sample feature values ​​of the continuous feature category to obtain multiple discrete value sets of the continuous feature category, including: Sorting a plurality of sample feature values ​​of the continuous feature category to obtain a sorting result, wherein the elements in the sorting result are the sample feature values; For any two adjacent sample feature values ​​in the sorting result, determine the sample distribution similarity of a sample data subset corresponding to the any two adjacent sample feature values, the sample data subset being a subset of the sample data set; Merge the characteristic values ​​of two adjacent samples with the greatest sample distribution similarity in the sorting result into one element to obtain a new sorting result, and execute the above steps according to the new sorting result; If the number of elements in the newly obtained sorted result is equal to the number of bins, each element in the newly obtained sorted result is determined as a discrete value set of the continuous feature category.

8. The method according to claim 3, characterized in that Determining a plurality of discrete value sets of each feature category according to a plurality of sample feature values ​​of each feature category includes: For a discrete feature category among the multiple feature categories, determining multiple discrete feature values ​​according to multiple sample feature values ​​of the discrete feature category; If the number of the plurality of discrete eigenvalues ​​is greater than the number of bins, then determining the abnormal sample rate of the sample data subset corresponding to each discrete eigenvalue; the sample data subset is a subset of the sample data set, and each sample transaction feature data group included in the sample data subset has a sample feature value matching the discrete eigenvalue; The abnormal sample rates corresponding to the plurality of discrete characteristic values ​​are binned according to the bin number to obtain a plurality of discrete value sets of the discrete characteristic category.

9. The method according to claim 3, characterized in that: The clustering process is performed on the determined multiple abnormal discrete value sets to obtain multiple abnormal discrete value combinations, including: For any two abnormal discrete value sets that do not belong to the same feature category among the determined multiple abnormal discrete value sets, determine the set similarity of sample data subsets corresponding to the any two abnormal discrete value sets, where the sample data subset is a subset of the sample data set; If the maximum set similarity of two abnormal discrete value sets determined for the multiple abnormal discrete value sets is greater than or equal to the similarity threshold, merging the two abnormal discrete value sets corresponding to the maximum set similarity in the multiple abnormal discrete value sets to obtain new multiple abnormal discrete value sets, and performing the above steps according to the new multiple abnormal discrete value sets; If the maximum similarity between two abnormal discrete value sets determined for the newly obtained multiple abnormal discrete value sets is less than the similarity threshold, each abnormal discrete value set in the newly obtained multiple abnormal discrete value sets is determined as an abnormal discrete value combination.

10. The method according to claim 3, characterized in that: The step of determining an abnormal discrete value set from a plurality of discrete value sets of each feature category according to the transaction category label includes: For any feature category among the multiple feature categories, determine the abnormal sample rate of a sample data subset corresponding to each discrete value set in a plurality of discrete value sets of the any feature category according to the transaction category label; the sample data subset is a subset of the sample data set, and part of the sample feature values ​​included in the sample transaction feature data group in the sample data subset are included in the discrete value set; A discrete value set whose corresponding abnormal sample rate is greater than or equal to the abnormal sample rate threshold among the multiple discrete value sets of any feature category is determined as an abnormal discrete value set.

11. A category determination device, characterized in that: The device comprises: An acquisition unit, used to acquire a transaction feature data group of a resource transaction to be processed, wherein the transaction feature data group includes a target feature value of each feature category in a plurality of feature categories; a processing unit, configured to determine a matching abnormal discrete value combination from a plurality of abnormal discrete value combinations according to the transaction feature data group, wherein the matching abnormal discrete value combination contains a sample feature value that matches the target feature value, and the matched target feature value and the sample feature value belong to the same feature category; A determination unit, configured to obtain reference anomaly scores corresponding to each determined combination of matching anomaly discrete values, and determine a transaction category of the to-be-processed resource transaction according to the reference anomaly scores corresponding to each determined combination of matching anomaly discrete values; Among them, the multiple abnormal discrete value combinations are obtained by clustering multiple abnormal discrete value sets, the abnormal discrete value sets are determined from multiple discrete value sets of each feature category according to the transaction category label, the multiple discrete value sets of each feature category are determined according to multiple sample feature values ​​of each feature category, the transaction category label and the multiple sample feature values ​​are included in a sample data set, the sample data set includes multiple sample transaction feature data groups and transaction category labels for each sample transaction feature data group, each sample transaction feature data group includes sample feature values ​​of each feature category, and the sample category label is used to indicate the transaction category of the resource transaction corresponding to the sample transaction feature data group.

12. A computer device, characterized in that: include: A processor, a communication interface and a memory, wherein the processor, the communication interface and the memory are connected to each other, wherein the memory stores an executable program code, and the processor is used to call the executable program code to implement the category determination method according to any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, which, when executed on a computer, enable the computer to implement the category determination method according to any one of claims 1 to 10.

14. A computer program product, characterized in that The computer program product comprises a computer program or a computer instruction, and when the computer program or the computer instruction is executed by a processor, the category determination method according to any one of claims 1 to 10 is implemented.

Images