Abnormal service identification method and device and electronic equipment

Abstract

The invention provides an abnormal service identification method and device and electronic equipment, and relates to the technical field of data processing. The abnormal service identification method comprises the steps of obtaining service data of a to-be-identified user of a target object, and screening first service doubtful point data from the service data of the to-be-identified user according to a preset screening condition; according to the user basic data, determining an affiliation organization type of the user to be identified; determining supplementary data of the to-be-identified user based on the attribution organization category, and determining second service doubtful point data in the service data according to the supplementary data and the holiday and festival data; the target business doubtful point data is determined according to the first business doubtful point data and the second business doubtful point data, and the verification information is generated based on the target business doubtful point data and is sent to the client for verification, so that effective identification of various credit card sleeve scenes is realized, and the accuracy of the doubtful point data is higher.

Description

Technical Field

[0001] The present disclosure relates to the field of data processing technology, and in particular to a method, device and electronic device for identifying abnormal business. Background Art

[0002] The existing technology for identifying credit card cash-out risks requires a large amount of transaction merchant and payment settlement data, which takes a lot of computing time. In addition, the cash-out behaviors and scenarios identified in the process of generating cash-out warning suspicious data are limited, and it is difficult to capture all current cash-out behaviors. As a result, there is a certain gap between commercial banks' assessments of capital flows and asset risks in the credit card field and actual business risks, and the accuracy of identifying abnormal businesses is low. Summary of the invention

[0003] The present disclosure aims to solve one of the technical problems in the related art at least to some extent.

[0004] The first embodiment of the present disclosure provides a method for identifying abnormal services, including:

[0005] Acquire business data of a user to be identified of a target object, and filter first suspicious business data from the business data of the user to be identified according to a preset filtering condition;

[0006] Determine the category of the organization to which the user to be identified belongs according to the user basic data, wherein the category of the organization to which the user to be identified belongs includes an internal organization and an external organization;

[0007] Based on the category of the affiliated organization, determine the supplementary data of the user to be identified, and determine the second business doubt data in the business data according to the supplementary data and the holiday data, wherein the supplementary data includes at least one of the behavior data of the user to be identified and the description data of the business target;

[0008] Target business doubtful point data is determined according to the first business doubtful point data and the second business doubtful point data, and verification information is generated based on the target business doubtful point data and sent to the client for verification.

[0009] The second aspect of the present disclosure provides an abnormal service identification device, including:

[0010] A first acquisition module, used to acquire business data of a user to be identified of a target object, and filter first suspicious business data from the business data of the user to be identified according to a preset filtering condition;

[0011] A second acquisition module is used to determine the category of the organization to which the user to be identified belongs based on the user basic data, where the category of the organization to which the user belongs includes an internal organization and an external organization;

[0012] A third acquisition module is used to determine the supplementary data of the user to be identified based on the category of the affiliated organization, and determine the second business doubt data in the business data according to the supplementary data and the holiday data, wherein the supplementary data includes at least one of the behavior data of the user to be identified and the description data of the business target;

[0013] An identification module is used to determine target business doubtful data according to the first business doubtful data and the second business doubtful data, generate verification information based on the target business doubtful data, and send it to the client for verification.

[0014] The third aspect of the present disclosure provides an electronic device, including:

[0015] at least one processor; and

[0016] a memory communicatively connected to at least one processor; wherein,

[0017] The memory stores instructions that can be executed by at least one processor, and the instructions are executed by at least one processor so that the at least one processor can execute the method for identifying abnormal business provided in the embodiment of the first aspect of the present disclosure.

[0018] The fourth aspect embodiment of the present disclosure proposes a computer-readable storage medium having computer instructions stored thereon, wherein the computer instructions are used to enable a computer to execute the abnormal business identification method provided in the first aspect embodiment of the present disclosure.

[0019] The fifth aspect embodiment of the present disclosure proposes a computer program product, including a computer program, which, when executed by a processor, implements the abnormal business identification method provided in the first aspect embodiment of the present disclosure.

[0020] The present application can filter out first business suspicious data from the business data of the user to be identified through preset screening conditions; determine the category of the affiliated institution of the user to be identified according to the user basic data, and obtain different supplementary data of the user to be identified based on the affiliated institution category, determine the second business suspicious data in the business data based on the supplementary data combined with holiday data, improve the accuracy of identifying the suspicious data, comprehensively determine the target business suspicious data based on the first business data and the second business data, and further generate verification information based on the target business suspicious data, so as to realize effective identification of various credit card cash-out scenarios, and the accuracy of the suspicious data is higher. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 is a flow chart of a method for identifying abnormal services provided by an embodiment of the present disclosure;

[0022] Figure 2is a flow chart of obtaining first business doubt data provided by an embodiment of the present disclosure;

[0023] Figure 3 is a flow chart of obtaining second business doubt data provided by an embodiment of the present disclosure;

[0024] Figure 4 is a flow chart of another abnormal business identification method provided by an embodiment of the present disclosure;

[0025] Figure 5 is a schematic diagram of verification information provided by an embodiment of the present disclosure;

[0026] Figure 6 It is a structural block diagram of an abnormal service identification device provided by an embodiment of the present disclosure;

[0027] Figure 7 It is a block diagram of an electronic device according to an exemplary embodiment. DETAILED DESCRIPTION

[0028] Embodiments of the present disclosure are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present disclosure, and should not be construed as limiting the present disclosure.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0030] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in this application are all authorized by the user or fully authorized by all parties, and the acquisition, storage, use, processing, etc. of data in the technical solution of this application comply with the relevant provisions of relevant laws and regulations.

[0031] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be considered as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the solution.

[0032] The following describes the abnormal service identification method, device and electronic device according to the embodiments of the present disclosure in conjunction with the accompanying drawings.

[0033] Figure 1 is a flow chart of a method for identifying abnormal services provided by an embodiment of the present disclosure, such as Figure 1 As shown, the method comprises the following steps:

[0034] S101, obtaining business data of a target user to be identified, and filtering first suspicious business data from the business data of the target user to be identified according to a preset filtering condition.

[0035] This embodiment is applicable to the identification of abnormal cash withdrawal business of commercial bank credit cards, that is, the target object in this embodiment is a credit card, the user of the credit card is the user to be identified of the target object, and the transaction data of the user to be identified is the business data of the user to be identified; it can be understood that there are one or more users to be identified for a credit card, and each user to be identified has one or more transaction data, and all transaction data are collected to obtain the business data of the user to be identified.

[0036] In some implementations, the business data of the user to be identified can be pushed for identification in a cycle of six months, and the data that has been pushed will not be pushed again in the identification of this quarter; when actually identifying the business data, the positions with query permissions can also be determined, such as business management positions or business operation positions, and the institutions at the fourth level and above can also be queried to ensure data security and customer privacy while identifying business data.

[0037] The existing technology already has means to identify abnormal credit card business. For example, models are used to effectively identify abnormal scenarios such as credit card maximum limit usage, credit card transaction exemptions, merchant fund repatriation, credit card transactions concentrated a few days after the billing date, credit card transactions that are paid and swiped immediately, frequent repayments by others, and concentrated transactions at the same merchant. It is understandable that an abnormal recognition model corresponding to each abnormal scenario can be trained based on historical data, with the abnormal recognition model of credit card transaction exemption as the basis. On the basis of the data basic conditions of credit card transaction exemption, funds reflux after large credit card consumption; the cumulative transaction amount of the credit card is large; in order to obtain a long-term interest-free period during multiple consecutive billing periods, the transaction amount reaches a certain proportion of the credit limit a few days after the billing date, or even the full amount is used; there is no excess funds to repay, but in order to ensure that it is not overdue, the card is maintained in a cycle in the form of virtual deposit first and then swiping the card, and there is a certain difference between the deposited amount and the swiped amount; after the credit card is lent to others for cash, it is repaid by others; the credit card is concentrated in one merchant transaction and other abnormal recognition models are used to identify cash withdrawal behavior.

[0038] Optionally, the existing abnormal identification model can be used as a screening condition to screen the business data of the user to be identified, and the data in the business data of the user to be identified that meets the existing abnormal identification model is determined. The screened data is data that may meet the above-mentioned abnormal cash-out behavior. Therefore, the business data screened according to the preset screening conditions will be used as the first business suspicious data.

[0039] In some implementations, before analyzing and processing the business data, the business data of the identified user may be preprocessed. In this embodiment, the preprocessing may be to remove obviously normal business data from the business data. For example, based on a pre-trained classification model, the business data classified as normal may be distinguished and removed, while other business data may be retained and subsequently analyzed. The purpose is to reduce the amount of subsequent analysis and calculation of the business data and avoid resource consumption caused by analyzing obviously normal business data.

[0040] S102: Determine the category of the organization to which the user to be identified belongs based on the user basic data.

[0041] Optionally, the user basic data may include data such as user identification, and the user identification uniquely corresponds to the user, so as to determine the category of the affiliated organization of the user to be identified based on the user basic data. The affiliated organization category includes internal affiliated organization and external affiliated organization. It can be understood that internal affiliated organization refers to employees within the current implementing organization, and external affiliated organization refers to employees outside the current implementing organization.

[0042] As an example, if the current institution A conducts abnormal risk identification for users of its credit card, the category of the institution to which the user to be identified belongs is determined based on the user's basic data, and it is judged whether the user to be identified is an internal employee of institution A. It can be understood that institution A can determine the employee information database by retrieving internal employee information, and search the employee information database based on the user's basic data of the user to be identified. If it is determined that the user's basic data of the user to be identified is in the employee information database, then the category of the institution to which the user to be identified belongs is determined to be internal to the institution.

[0043] S103, based on the category of the affiliated organization, determine the supplementary data of the user to be identified, and determine the second business doubt data in the business data according to the supplementary data and the holiday data.

[0044] It is understandable that if the organization category of the user to be identified is within the organization, more supplementary information of the user to be identified can be obtained for more accurate identification of suspicious data; the supplementary data of the user to be identified includes at least one of the behavior data of the user to be identified and the description data of the business objectives.

[0045] In some implementations, if the organization category of the user to be identified is within the organization, the work attendance information of the user to be identified can be obtained as the user's behavior data. The work attendance information can be used to determine whether the user to be identified has special events such as business trips and vacations, thereby determining the location and behavior of the user to be identified in a specific period of time; for example, there is a transaction data in the business data of the user to be identified that was conducted in city A, and according to the work attendance information, it is determined that the user to be identified was on a business trip in city B during the same period, then the transaction data in city A may contain abnormal cash-out behavior.

[0046] Optionally, the business target refers to the transaction merchant with which the user to be identified conducts transactions. The descriptive data of the business target may be data such as the location, merchant type and merchant status of the transaction merchant. For example, the merchant type may be hairdressing, daily chemicals, cosmetics, tobacco, alcohol or catering, and the merchant status may be whether the merchant is in operation, revoked or cancelled.

[0047] It can be understood that if the category of the affiliated organization of the user to be identified is external to the affiliated organization, the descriptive data of the business objectives can only be determined based on the business data of the user to be identified. At this time, the supplementary data of the user to be identified is the descriptive data of the business objectives. If the category of the affiliated organization of the user to be identified is internal to the affiliated organization, the supplementary data of the user to be identified is the behavioral data of the user to be identified and the descriptive data of the business objectives.

[0048] Furthermore, the second suspicious data in the business data can be identified based on the supplementary data and holiday data. Holiday data refers to holidays in daily life, such as traditional festivals such as the Mid-Autumn Festival, Spring Festival or Dragon Boat Festival, and shopping festivals such as November 11, December 12 or June 18. By identifying the suspicious data through holiday data and supplementary data, the impact of holiday data on the transaction habits of the user to be identified is comprehensively considered, and the identification accuracy is higher.

[0049] It is understandable that when identifying business data, it can be determined based on the descriptive data of the business objectives in the supplementary data. For example, a user to be identified within the affiliated organization has made a transaction of 50,000 yuan in a restaurant in City A. According to the behavioral data of the user to be identified, it is determined that the user to be identified was on marriage leave during the corresponding transaction time. In this case, the probability of doubt in the transaction data of the user to be identified is low. On the contrary, if the user to be identified was working in City B at that time, the probability of doubt that the user to be identified made a transaction of 50,000 yuan in a restaurant in City A is high. If the user to be identified outside the affiliated organization spends 80,000 yuan in an ordinary tobacco and alcohol shop, and according to the holiday data, it is determined that the transaction time is around the Mid-Autumn Festival or after the Spring Festival, the probability of doubt for high consumption in the tobacco and alcohol shop will be reduced. On the contrary, consumption of 80,000 yuan of tobacco and alcohol on normal working days needs to be paid special attention. In some implementations, the normal consumption amount corresponding to the merchant can also be obtained. For example, according to the evaluation information of restaurant c, it is determined that restaurant c is a small ordinary restaurant and the normal consumption amount is 50 / person. In this case, the probability of doubt that the user to be identified made a transaction of 50,000 yuan in the restaurant is high.

[0050] Optionally, model training can be performed based on historical data to obtain a pre-trained anomaly recognition model, and the anomaly recognition model is combined with the user's behavior data and the description data of the business goal to identify the business data of the user to be identified, thereby obtaining second business doubt data in the business data.

[0051] S104, determining target business doubtful data according to the first business doubtful data and the second business doubtful data, generating verification information based on the target business doubtful data, and sending the information to the client for verification.

[0052] Optionally, all business data in the first business doubt data and the second business doubt data can be used as target business doubt data, or the same business data in the first business doubt data and the second business doubt data can be obtained as target business doubt data. The target business doubt data can also be determined by screening based on the probability distribution of the first business doubt data and the probability distribution of the second business doubt data.

[0053] Furthermore, verification information is generated based on the target business suspicious data, and the verification information at least includes the target business suspicious data and the user to be identified corresponding to the target business suspicious data. The verification information is fed back to the client for verification, thereby accurately identifying the cash-out behavior among credit card users and reducing the risk of credit card cash-out.

[0054] In this embodiment, the first business suspicious data is screened out from the business data of the user to be identified through preset screening conditions; the category of the institution to which the user to be identified belongs is determined based on the user basic data, and the supplementary data of the user to be identified is obtained based on the category of the institution to which it belongs. For the internal employees of the institution, more abundant supplementary data is obtained for analysis, and the second business suspicious data in the business data is determined in combination with the holiday data to improve the accuracy of the identification of the suspicious data. The target business suspicious data is comprehensively determined based on the first business data and the second business data, and verification information is further generated based on the target business suspicious data, so as to realize the effective identification of various credit card cash-out scenarios, and the accuracy of the suspicious data is higher and has more reference value.

[0055] Based on the above embodiments, Figure 2 is a flowchart of obtaining first business doubt data provided by an embodiment of the present disclosure, such as Figure 2 As shown, the method comprises the following steps:

[0056] S201, obtaining anomaly recognition models corresponding to different abnormal business types as screening conditions.

[0057] In some implementations, sample data corresponding to different abnormal business types can be obtained, and the abnormal recognition model can be trained based on the sample data to obtain a pre-trained abnormal recognition model corresponding to each abnormal business type, and the pre-trained abnormal recognition model corresponding to each abnormal business type can be used as a screening condition.

[0058] Optionally, abnormal business types may include, but are not limited to: use of credit card maximum limit, credit card transaction exemptions, merchant capital repatriation, credit card transactions concentrated a few days after the billing date, credit card transactions that are paid and swiped immediately, frequent repayments by others, concentrated transactions at the same merchant, and other scenario types.

[0059] S202, determining an anomaly score of the user's business data according to the anomaly identification model, and in response to the anomaly score being greater than or equal to a preset value, determining that the business data meets the screening condition of the anomaly identification model.

[0060] Optionally, the user's business data can be input into each pre-trained anomaly recognition model, and the anomaly recognition model outputs an anomaly score corresponding to the business data. The higher the anomaly score, the more consistent the business data is with the recognition result of the corresponding anomaly recognition model. When the anomaly score is greater than or equal to the preset value, it is determined that the business data meets the screening conditions of the anomaly recognition model.

[0061] For example, assuming that the anomaly scores of the business data in anomaly identification model A, anomaly identification model B and anomaly identification model C are 40, 30 and 85 respectively, and the preset value is 80, then the anomaly score of the business data in anomaly identification model C is greater than the preset value, and it is determined that the business data meets the screening conditions of anomaly identification model C, that is, the business data meets the abnormal scenario corresponding to anomaly identification model C.

[0062] S203: extracting the business data that meets the screening conditions of the anomaly recognition model to obtain first business doubt data.

[0063] All data that meets the screening conditions of the anomaly recognition model are extracted from the business data as the first business suspicious data. The first business suspicious data are all data that have the risk of credit card cash withdrawal.

[0064] In this embodiment, a corresponding abnormality identification model is constructed based on the scenarios of various abnormal business types in the prior art, and the business data is analyzed based on the corresponding abnormality identification model to determine the first business suspicious data, thereby improving the processing efficiency of the business data. The first business suspicious data in the business data is quickly screened based on the existing model, and the computational cost is low.

[0065] Based on the above embodiments, Figure 3 is a flow chart of obtaining second business doubt data provided by an embodiment of the present disclosure, such as Figure 3 As shown, the method comprises the following steps:

[0066] S301, determining the category of the organization of the user to be identified according to the user basic data, where the category of the organization includes internal organization and external organization.

[0067] Optionally, you can obtain an organization employee list, which includes user data of organization employees; match it in the organization employee list based on user basic data; the organization employee list includes all employee information of the organization, and match the corresponding user data in the organization employee list based on the user basic data to determine whether the user to be identified is an employee within the organization.

[0068] In response to the existence of an institution employee corresponding to the user's basic data in the institution employee list, the institution category of the user to be identified is determined to be internal to the institution; in response to the absence of an institution employee corresponding to the user's basic data in the institution employee list, the institution category of the user to be identified is determined to be external to the institution, and different supplementary data is acquired based on employees inside or outside the institution to perform more accurate analysis and identification.

[0069] S302, determining supplementary data of the user to be identified based on the category of the affiliated organization.

[0070] In response to the category of the affiliated institution being internal to the affiliated institution, the historical business data, attendance records and debit card settlement information of the user to be identified are obtained as the behavioral data of the user to be identified, and the business time, business volume, business location and nature of the business merchant in the corresponding business data of the user to be identified are obtained as the descriptive data of the business target; wherein the attendance record may include the leave data of the user to be identified, such as the number of leave days and the reason for the leave; the debit card settlement information may include the debit card settlement date and settlement amount, and the business target refers to the target for doing business with the user to be identified, that is, the target merchant for the transaction with the user to be identified, and the transaction time, transaction amount (business volume), merchant location and merchant nature between the user to be identified and the target merchant are the descriptive data of the target merchant. According to the different types of users to be identified, more abundant and comprehensive supplementary data are obtained for identification to improve the accuracy of business data identification.

[0071] Furthermore, the nature of the merchant may include the merchant status and merchant type. The merchant status may include cancelled, revoked and normal, and the merchant type may include hairdressing, tobacco and alcohol, catering, accommodation, education and other types, which are used to determine whether the merchant is a virtual merchant, as well as the normal transaction amount range corresponding to the merchant, and to determine whether there is transaction data that obviously exceeds normal consumption. For example, when cashing out through a third-party card swiping machine, the actual status of the merchant is cancelled or revoked, then the probability that the business data is a cash-out behavior is high. When the transaction amount obviously exceeds the normal transaction amount range corresponding to the merchant, the probability that the business data is a cash-out behavior is also high.

[0072] In response to the belonging organization category being outside the belonging organization, the business time, business volume, business merchant location and business merchant nature in the business data corresponding to the user to be identified are obtained as description data of the business target.

[0073] S303, determining control data according to the supplementary data and the holiday data, and comparing the business data with the control data to obtain a feature information set.

[0074] In some implementations, the control data includes holiday intervals, business status, business hours and normal business volume intervals of the business target and the usual business locations of the users to be identified; optionally, the holiday intervals can be determined based on the holiday data; the business status, business hours and normal business volume intervals of the business target can be determined based on the nature of the business object in the supplementary data; the historical business locations of the users to be identified can be determined based on the historical business data in the supplementary data, and the usual business locations of the users to be identified can be determined to obtain all the control data; based on the comparison between the control data and the business data and supplementary data of the users to be identified, it can be determined whether the relevant data of the users to be identified meets the control data, thereby screening out suspicious data.

[0075] By comparing whether the business occurrence time in the supplementary data meets the holiday interval, the first characteristic information is obtained; the first characteristic information is used to indicate whether the business occurrence time, that is, the transaction time, is within the holiday interval or not within the holiday interval. For example, the probability of suspicion of high consumption of gifts such as cigarettes and alcohol during the Spring Festival will be reduced.

[0076] According to the description data of the business target, the second characteristic information of whether the business target is in a normal business state, the third characteristic information of whether the transaction time is within the business hours, and the fourth characteristic information of whether the business volume is within the normal business volume range are determined; the second characteristic information is used to indicate that the business target is in a normal business state or the business target is in an abnormal business state, such as the merchant has been deregistered; the third characteristic information is used to indicate that the transaction time is within the normal business hours of the merchant or is not within the normal business hours of the merchant. If the transaction is conducted during abnormal business hours, the probability of suspicion is high; the fourth characteristic information is used to indicate that the business volume is within the normal business volume range or is not within the normal business volume range. In this embodiment, the business volume refers to the transaction amount, that is, to determine whether the transaction amount is within the normal consumption range of the merchant. For example, when the consumption of tens of thousands of yuan in an ordinary express hotel is obviously beyond the normal consumption range of the merchant, the transaction data may be suspicious data of cash-out behavior.

[0077] Based on the description data of the business target, determine the fifth characteristic information of whether the business location is a common business location; the fifth characteristic information is used to indicate whether the business location is a common business location of the user to be identified, that is, whether the transaction location is the permanent residence of the user to be identified. When multiple card swiping transactions occur in different locations, it is necessary to pay special attention to whether they are cash-out behaviors.

[0078] Based on the user behavior data in the supplementary data, determine the sixth characteristic information of whether the user to be identified has a special event leave, and determine the seventh characteristic information of whether the user to be identified has a business volume equal to the debit card settlement business value; the sixth characteristic information is used to indicate whether the user to be identified has a special event leave such as marriage leave, bereavement leave or maternity leave, which leads to some high consumption, and the seventh characteristic information is used to indicate whether the user to be identified has a transaction amount equal to the holiday card settlement amount; it can be understood that if the category of the affiliated institution of the user to be identified is outside the affiliated institution, the user behavior data of the user to be identified cannot be obtained, and the sixth characteristic information and the seventh characteristic information do not exist.

[0079] Furthermore, a feature information set is determined based on the first to seventh feature information, that is, the feature information set is composed of the first to seventh feature information, and the feature information set covers feature information of multiple possible cash-out scenarios, such as whether the nature of the merchant of the user to be identified does not match the transaction amount, the transaction is conducted during non-normal business hours, the transaction merchant is a virtual merchant, the transaction location is changeable, whether the transaction is during the holiday period, whether the user to be identified is on special vacation, and transactions with the same amount before the debit card clearing amount, so as to improve the accuracy of identifying suspicious data.

[0080] S304: Determine second suspicious business data in the business data according to the feature information set.

[0081] Optionally, a pre-trained anomaly prediction model can be obtained; the feature information set is input into the anomaly prediction model to obtain the anomaly probability corresponding to the feature information set; in some implementations, the anomaly prediction model may include one or more pre-trained sub-models, each sub-model corresponds to a suspected cash-out behavior, and the business data and corresponding feature information are input into the corresponding sub-model to obtain the output anomaly probability. The higher the anomaly probability, the more likely it is that the business data is the corresponding abnormal cash-out behavior, thereby improving the efficiency of anomaly identification.

[0082] Furthermore, a preset probability threshold can be obtained to determine whether the abnormal probability is greater than or equal to the probability threshold. When the abnormal probability of the business data in any sub-model is greater than or equal to the probability threshold, the business data is determined to be the second business suspicious data, that is, the business data with an abnormal probability greater than or equal to the probability threshold is extracted as the second business suspicious data, thereby determining the second business suspicious data in the business data according to the abnormal probability.

[0083] In this embodiment, it is determined whether the user to be identified belongs to the institution based on the institution's employee list, and different supplementary data are obtained for the users to be identified who belong to the institution and those who belong to outside the institution. Users within the institution can obtain behavioral data such as work attendance to identify suspicious data more accurately and comprehensively. Users outside the institution obtain relevant data of transaction merchants as descriptive data, and control data is determined based on the supplementary data and holiday data. The control data is used as a reference to compare with the business data to determine whether the business data satisfies the feature information set of the control data situation. The feature information set obtains richer features related to the business data, and whether the business data is suspicious business data is determined based on the feature information set, taking into account more comprehensive cash-out situations, thereby improving the accuracy of screening suspicious business data.

[0084] Based on the above embodiments, Figure 4 is a flow chart of another abnormal business identification method provided by an embodiment of the present disclosure, such as Figure 4As shown, the method comprises the following steps:

[0085] S401, obtaining the business data of the target user to be identified, and obtaining the abnormality identification models corresponding to different abnormal business types as screening conditions.

[0086] In some implementations, a marked list can also be obtained; the marked list can include a blacklist and a whitelist, and the blacklist data can come from multiple channels such as regulatory agencies, public security organs, and the bank's internal risk control system. The blacklist data includes the identity information and transaction characteristics of high-risk objects such as known cash-out users, cash-out gangs, and cash-out merchants; the whitelist is used to come from channels such as the institution's internal high-quality customer database and merchant cooperation list. The whitelist data includes key information such as the identity information of high-quality customers, credit card numbers, card swiping limits, merchant nature, and capital flows.

[0087] Furthermore, the users of the target object are screened according to the marked list to obtain a first user list, a second user list and a third user list among the users of the target object; the users on the first user list and the third user list are taken as the users to be identified of the target object; in this embodiment, the first user list is the blacklist users, the second user list is the whitelist users, and the third user list is other users except the blacklist users and the whitelist users.

[0088] Blacklisted users and other users are taken as target objects for analysis of unidentified users, so as to promptly determine business data with abnormal behaviors such as cash-out, and focus on monitoring blacklisted users. Once blacklisted users are monitored to have transaction behaviors, the early warning mechanism should be triggered immediately, that is, the transaction data of blacklisted users should be extracted as suspicious data and conduct in-depth verification and analysis. When it is determined to be an abnormal business, measures such as reducing the credit limit, blocking the card, or listing in the list of dishonest persons should be taken to deal with it. This can quickly identify and accurately strike high-risk objects, reduce the risk of cash-out.

[0089] For whitelist users, since they are high-quality customers or merchants, the monitoring level can be lowered or exempted from health checks. For example, whitelist users can be regularly checked and analyzed to reduce resource consumption for real-time analysis and processing and improve customer experience and satisfaction.

[0090] In the embodiments of the present disclosure, the implementation method of step S401 may be implemented in any manner in the embodiments of the present disclosure, which is not limited here and will not be described in detail.

[0091] S402, determining an anomaly score of the user's business data according to the anomaly identification model, and in response to the anomaly score being greater than or equal to a preset value, determining that the business data meets the screening condition of the anomaly identification model.

[0092] In the embodiments of the present disclosure, the implementation method of step S402 may be implemented in any manner in the embodiments of the present disclosure, which is not limited here and will not be described in detail.

[0093] S403: extracting business data that meets the screening conditions of the anomaly recognition model to obtain first business doubt data.

[0094] In the embodiments of the present disclosure, the implementation method of step S403 may be implemented in any manner in the embodiments of the present disclosure, which is not limited here and will not be described in detail.

[0095] S404, determining the category of the organization to which the user to be identified belongs according to the user basic data, where the category of the organization to which the user to be identified belongs includes the category of the organization inside and the category of the organization outside.

[0096] In the embodiments of the present disclosure, the implementation method of step S404 may be implemented in any manner in the embodiments of the present disclosure, which is not limited here and will not be described in detail.

[0097] S405, determining supplementary data of the user to be identified based on the category of the affiliated organization.

[0098] In the embodiments of the present disclosure, the implementation method of step S405 can be implemented by any of the methods in the embodiments of the present disclosure, which is not limited here and will not be described in detail.

[0099] S406, determining control data according to the supplementary data and the holiday data, and comparing the business data with the control data to obtain a feature information set.

[0100] In the embodiments of the present disclosure, the implementation method of step S406 may be implemented in any manner in the embodiments of the present disclosure, which is not limited here and will not be described in detail.

[0101] S407: Determine second suspicious business data in the business data according to the feature information set.

[0102] In the embodiments of the present disclosure, the implementation method of step S407 may be implemented in any manner in the embodiments of the present disclosure, which is not limited here and will not be described in detail.

[0103] S408, determining target business doubtful data according to the first business doubtful data and the second business doubtful data, generating verification information based on the target business doubtful data, and sending the information to the client for verification.

[0104] Optionally, a first data distribution function of the first business doubt data and a second data distribution function of the second business doubt data can be obtained; a joint probability density function is determined based on the first data distribution function and the second data distribution function, and a cumulative distribution function is determined based on the joint probability density function; a screening rule is determined based on the cumulative distribution function and a preset value, and the target business doubt data in the first business doubt data and the second business doubt data is determined based on the screening rule.

[0105] In some implementations, the joint probability density function is defined as a function of the total return z, expressed as:

[0106]

[0107] Among them, f Z (z) is the joint probability density function; f S (s) is the first data distribution function of the first business doubt data; f I (i) is the second data distribution function of the second business questionable data, z=s+i.

[0108] For the comprehensive doubt probability A, the corresponding cumulative distribution function is expressed as:

[0109]

[0110] Among them, F Z (A) is the cumulative distribution function of the comprehensive doubt probability A; P is the probability value.

[0111] Furthermore, the joint probability density function and the cumulative distribution function are combined and the total return z is integrated to obtain: Among them, F I (t, v) is the cumulative distribution function of the point-t distribution, is the corresponding standard deviation, v is other parameters, such as degrees of freedom, etc.; the overall risk distribution f S (s) is a discrete distribution, where s is a function of the historical time period t, starting from the first historical segment t 0 Starting from the previous period T-1 to the current date; therefore, the cumulative distribution function of the combined overall doubts is:

[0112] Furthermore, when screening rules in this embodiment, the first percentile of the overall warning rate distribution corresponding to the suspicious result under 99% probability is obtained, and the It means that the formula is satisfied That is, find the value that satisfies the formula Optionally, it can be determined by numerical analysis methods such as secant method or bisection method The value of is taken, and the target business doubtful point data in the first business doubtful point data and the second business doubtful point data is further determined according to the obtained result, and verification information is generated according to the target business doubtful point data and sent to the client for verification.

[0113] In some implementations, the users whose abnormal business is verified can also be marked. For example, users with serious cash-out situations can be marked as blacklisted users, and the marked list can be updated based on the new blacklisted users to improve the efficiency and accuracy of subsequent identification of business data anomalies.

[0114] In some implementations, such as Figure 5 As shown, the verification information displayed by the client may include information such as the data number of the business data to be verified, the risk level of the business data, the organization to which the verification data belongs, the personnel involved in the verification data, the verification point, the model type, the data source, and the description of the verification data; in other embodiments, it may also include information such as the initial issuing organization of the verification data, the first distribution date of the verification data, the management context of the network where the personnel involved in the verification data are located, the distributed verification data verification organization, and the distributed verification data verification personnel; the risk level of the business data may include different levels such as red, orange, blue and concern, which are divided according to the risk score of the business data, for example, greater than or equal to 8 points but less than 9 points is blue, greater than or equal to 5 points and less than 8 points is concern, greater than or equal to 9 points and less than 9.5 points is orange, and greater than or equal to 9.5 points is red.

[0115] In the embodiments of the present disclosure, the implementation method of step S408 may be implemented in any manner in the embodiments of the present disclosure, which is not limited here and will not be described in detail.

[0116] In this embodiment, blacklist users and whitelist users are added to classify the users to be identified, and different monitoring intensities are adopted to analyze the blacklist users and the whitelist users, and different users to be identified are identified in a targeted manner, thereby improving the identification efficiency while enhancing the customer experience and satisfaction. The first business suspicious data is further screened based on the screening conditions preset in the prior art, and different supplementary data are further screened according to the category of the institution to which the user to be identified belongs. The different supplementary data and the holiday data are processed and identified to obtain the second business suspicious data in the business data, and the target business suspicious data with higher accuracy is obtained by fusing the first business suspicious data and the second business suspicious data, thereby improving the accuracy of abnormal business identification, and making the identification result of abnormal business have more practical reference value.

[0117] Figure 6 is a structural block diagram of an abnormal service identification device provided by an embodiment of the present disclosure, such as Figure 6 As shown, the abnormal service identification device 600 of the embodiment of the present disclosure includes:

[0118] The first acquisition module 601 is used to acquire the business data of the user to be identified of the target object, and filter the first business suspicious data from the business data of the user to be identified according to a preset filtering condition;

[0119] The second acquisition module 602 is used to determine the category of the organization to which the user to be identified belongs based on the user basic data, and the category of the organization to which the user belongs includes the category of the organization inside and the category of the organization outside;

[0120] The third acquisition module 603 is used to determine the supplementary data of the user to be identified based on the category of the affiliated organization, and determine the second business doubt data in the business data according to the supplementary data and the holiday data, wherein the supplementary data includes at least one of the behavior data of the user to be identified and the description data of the business target;

[0121] The identification module 604 is used to determine the target business doubtful data according to the first business doubtful data and the second business doubtful data, generate verification information based on the target business doubtful data, and send it to the client for verification.

[0122] In some implementations, the first acquisition module 601 includes:

[0123] Obtain the anomaly recognition models corresponding to different abnormal business types as screening conditions;

[0124] Determining an anomaly score of the user's business data according to the anomaly identification model, and in response to the anomaly score being greater than or equal to a preset value, determining that the business data meets the screening condition of the anomaly identification model;

[0125] The business data that meets the screening conditions of the anomaly recognition model is extracted to obtain the first business suspicious data.

[0126] In some implementations, the second acquisition module 602 includes:

[0127] Get the list of organization employees, which includes the user data of the organization employees;

[0128] According to the basic user data, match it in the list of employees of the organization;

[0129] In response to the existence of an organization employee corresponding to the user basic data in the organization employee list, determining that the organization category of the user to be identified is within the organization;

[0130] In response to the fact that there is no organization employee corresponding to the user basic data in the organization employee list, it is determined that the category of the organization of the user to be identified is outside the organization.

[0131] In some implementations, the third acquisition module 603 includes:

[0132] In response to the belonging institution category being internal to the belonging institution, historical business data, attendance records, and debit card settlement information of the user to be identified are obtained as the behavior data of the user to be identified, and business time, business volume, business location, and business merchant nature in the business data corresponding to the user to be identified are obtained as the description data of the business target;

[0133] In response to the belonging organization category being outside the belonging organization, the business time, business volume, business merchant location and business merchant nature in the business data corresponding to the user to be identified are obtained as description data of the business target.

[0134] In some implementations, the third acquisition module 603 includes:

[0135] Determine the control data based on the supplementary data and holiday data, and compare the business data with the control data to obtain a feature information set;

[0136] The second suspicious business data in the business data is determined according to the feature information set.

[0137] In some implementations, the third acquisition module 603 includes:

[0138] Determine the holiday interval based on holiday data;

[0139] Determine the business status, business hours and normal business volume range of the business target based on the nature of the business object in the supplementary data;

[0140] Determine the historical business locations of the user to be identified based on the historical business data in the supplementary data, and determine the common business locations of the user to be identified;

[0141] The comparison data includes holiday intervals, business status of business targets, business hours and normal business volume intervals and the usual business locations of the users to be identified.

[0142] In some implementations, the third acquisition module 603 includes:

[0143] Compare whether the business occurrence time in the supplementary data meets the holiday interval to obtain the first characteristic information;

[0144] According to the description data of the business target, second characteristic information for determining whether the business target is in a normal business state, third characteristic information for determining whether the transaction time is within business hours, and fourth characteristic information for determining whether the business volume is within a normal business volume range;

[0145] Determine fifth characteristic information of whether the business location is a common business location based on the description data of the business target;

[0146] Determine, based on the user behavior data in the supplementary data, whether the user to be identified has sixth characteristic information indicating that he or she is on leave for a special event, and whether the user to be identified has seventh characteristic information indicating that his or her business volume is the same as the debit card clearing business value;

[0147] A feature information set is determined based on the first to seventh feature information.

[0148] In some implementations, the third acquisition module 603 includes:

[0149] Get the pre-trained anomaly prediction model;

[0150] Input the feature information set into the anomaly prediction model to obtain the anomaly probability corresponding to the feature information set;

[0151] The second suspicious business data in the business data is determined according to the abnormal probability.

[0152] In some implementations, the identification module 604 includes:

[0153] Obtain a first data distribution function of the first business doubtful data and a second data distribution function of the second business doubtful data;

[0154] Determine a joint probability density function based on the first data distribution function and the second data distribution function, and determine a cumulative distribution function based on the joint probability density function;

[0155] A screening rule is determined based on the cumulative distribution function and the preset value, and target business doubtful point data in the first business doubtful point data and the second business doubtful point data is determined according to the screening rule.

[0156] In some implementations, the first acquisition module 601 further includes:

[0157] Get the list of tags;

[0158] Screening the users of the target object according to the marked list to obtain a first user list, a second user list, and a third user list among the users of the target object;

[0159] The users in the first user list and the third user list are taken as target users to be identified.

[0160] In this embodiment, the first business suspicious data is screened out from the business data of the user to be identified through preset screening conditions; the category of the institution to which the user to be identified belongs is determined based on the user basic data, and the supplementary data of the user to be identified is obtained based on the category of the institution to which it belongs. For the internal employees of the institution, more abundant supplementary data is obtained for analysis, and the second business suspicious data in the business data is determined in combination with the holiday data to improve the accuracy of the identification of the suspicious data. The target business data is comprehensively determined based on the first business data and the second business data, and verification information is further generated based on the target business data to achieve effective identification of various credit card cash-out scenarios. The accuracy of the suspicious data is higher and has more reference value.

[0161] Figure 7 FIG. 1 is a block diagram of an electronic device according to an exemplary embodiment. Figure 7 As shown, the electronic device 700 includes:

[0162] The memory 710 and the processor 720, a bus 730 connecting different components (including the memory 710 and the processor 720), the memory 710 stores a computer program, and when the processor 720 executes the program, the method for identifying abnormal business described in the embodiment of the present disclosure is implemented.

[0163] Bus 730 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. For example, these architectures include but are not limited to Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus and Peripheral Component Interconnect (PCI) bus.

[0164] The electronic device 700 typically includes a variety of electronic device readable media. These media can be any available media that can be accessed by the electronic device 700, including volatile and non-volatile media, removable and non-removable media.

[0165] The memory 710 may also include computer system readable media in the form of volatile memory, such as random access memory (RAM) 740 and / or cache memory 750. The electronic device 700 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 760 may be used to read and write non-removable, non-volatile magnetic media ( Figure 7 not shown, usually called a "hard drive"). Although Figure 7Not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 730 via one or more data medium interfaces. The memory 710 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present disclosure.

[0166] A program / utility 780 having a set (at least one) of program modules 770 may be stored, for example, in the memory 710, such program modules 770 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. The program modules 770 generally perform the functions and / or methods of the embodiments described in the present disclosure.

[0167] The electronic device 700 may also communicate with one or more external devices 790 (e.g., keyboard, pointing device, display 791, etc.), one or more devices that enable a user to interact with the electronic device 700, and / or any device that enables the electronic device 700 to communicate with one or more other computing devices (e.g., network card, modem, etc.). Such communication may be performed through an input / output (I / O) interface 792. Furthermore, the electronic device 700 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) through a network adapter 793. Figure 7 As shown, the network adapter 793 communicates with other modules of the electronic device 700 via the bus 730. It should be understood that although Figure 7 Not shown, other hardware and / or software modules may be used in conjunction with electronic device 700, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0168] The processor 720 executes various functional applications and data processing by running the programs stored in the memory 710 .

[0169] It should be noted that the implementation process and technical principles of the electronic device of this embodiment refer to the aforementioned explanation of the method for identifying abnormal services in the embodiment of the present disclosure, and will not be repeated here.

[0170] In order to implement the above embodiments, the present disclosure also proposes a computer-readable storage medium.

[0171] When the instructions in the computer-readable storage medium are executed by the processor of the service server, the service server can execute the above-mentioned abnormal service identification method. Optionally, the computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0172] In order to implement the above embodiments, the present disclosure further provides a computer program product, including a computer program, characterized in that when the computer program is executed by a processor, the method for identifying abnormal business as described above is implemented.

[0173] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims. It should be understood that the present disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A method for identifying abnormal business, characterized in that: include: Acquire business data of a user to be identified of a target object, and filter first suspicious business data from the business data of the user to be identified according to a preset filtering condition; Determine the category of the organization to which the user to be identified belongs according to the user basic data, wherein the category of the organization to which the user to be identified belongs includes an internal organization and an external organization; Based on the category of the affiliated organization, determine the supplementary data of the user to be identified, and determine the second business doubt data in the business data according to the supplementary data and the holiday data, wherein the supplementary data includes at least one of the behavior data of the user to be identified and the description data of the business target; Target business doubtful point data is determined according to the first business doubtful point data and the second business doubtful point data, and verification information is generated based on the target business doubtful point data and sent to the client for verification.

2. The method according to claim 1, characterized in that The filtering of the first suspicious business data from the business data of the to-be-identified user according to the preset filtering condition includes: Obtain the anomaly recognition models corresponding to different abnormal business types as screening conditions; Determining an anomaly score of the user's business data according to the anomaly identification model, and in response to the anomaly score being greater than or equal to a preset value, determining that the business data meets the screening condition of the anomaly identification model; The business data that meets the screening conditions of the anomaly recognition model is extracted to obtain first business doubt data.

3. The method according to claim 1 or 2, characterized in that: Determining the category of the organization to which the user to be identified belongs based on the user basic data includes: Obtaining an organization employee list, wherein the organization employee list includes user data of the organization employees; According to the basic user data, matching is performed in the employee list of the organization; In response to the existence of an institution employee corresponding to the user basic data in the institution employee list, determining that the category of the institution to be identified is within the institution; In response to the fact that the organization employee list does not contain an organization employee corresponding to the user basic data, it is determined that the category of the organization to which the user to be identified belongs is outside the organization.

4. The method according to claim 3, characterized in that The determining, based on the category of the affiliated institution, the supplementary data of the user to be identified includes: In response to the category of the affiliated institution being internal to the affiliated institution, historical business data, attendance records, and debit card settlement information of the user to be identified are obtained as behavioral data of the user to be identified, and business time, business volume, business location, and business merchant nature in the business data corresponding to the user to be identified are obtained as descriptive data of the business target; In response to the belonging organization category being outside the belonging organization, the business time, business volume, business merchant location and business merchant nature in the business data corresponding to the user to be identified are obtained as description data of the business target.

5. The method according to claim 4, characterized in that The determining, based on the supplementary data and the holiday data, second suspicious business data in the business data includes: Determine reference data according to the supplementary data and holiday data, and compare the business data with the reference data to obtain a feature information set; The second suspicious business data in the business data is determined according to the feature information set.

6. The method according to claim 5, characterized in that The determining of control data according to the supplementary data and holiday data includes: Determine a holiday interval according to the holiday data; Determine the business status, business hours and normal business volume range of the business target according to the nature of the business object in the supplementary data; Determine the historical business location of the user to be identified based on the historical business data in the supplementary data, and determine the common business location of the user to be identified; The comparison data includes the holiday interval, the business status, business hours and normal business volume interval of the business target and the common business location of the user to be identified.

7. The method according to claim 6, characterized in that The comparing the business data with the control data to obtain a feature information set includes: Comparing whether the business occurrence time in the supplementary data meets the holiday interval to obtain the first characteristic information; According to the description data of the business target, second characteristic information for determining whether the business target is in a normal business state, third characteristic information for determining whether the transaction time is within business hours, and fourth characteristic information for determining whether the business volume is within a normal business volume range; Determining, based on the description data of the business target, whether the business location is the fifth characteristic information of the common business location; Determine, based on the user behavior data in the supplementary data, whether the user to be identified has sixth characteristic information indicating that the user has a special event vacation, and determine whether the user to be identified has seventh characteristic information indicating that the business volume is the same as the debit card clearing business value; The feature information set is determined based on the first to seventh feature information.

8. The method according to claim 7, characterized in that The determining the second suspicious business data in the business data based on the feature information set includes: Get the pre-trained anomaly prediction model; Inputting the feature information set into the abnormality prediction model to obtain the abnormality probability corresponding to the feature information set; Determine second suspicious business data in the business data according to the abnormal probability.

9. The method according to claim 1, characterized in that: The determining target business doubtful point data according to the first business doubtful point data and the second business doubtful point data includes: Obtaining a first data distribution function of the first business doubtful data and a second data distribution function of the second business doubtful data; Determine a joint probability density function based on the first data distribution function and the second data distribution function, and determine a cumulative distribution function based on the joint probability density function; A screening rule is determined based on the cumulative distribution function and a preset value, and target business doubtful point data in the first business doubtful point data and the second business doubtful point data is determined according to the screening rule.

10. The method according to claim 1, characterized in that Before obtaining the business data of the to-be-identified user of the target object, the method further includes: Get the list of tags; Screening the users of the target object according to the marked list to obtain a first user list, a second user list, and a third user list among the users of the target object; The users in the first user list and the third user list are used as the target users to be identified.

11. A device for identifying abnormal business, characterized in that: include: A first acquisition module, used to acquire business data of a user to be identified of a target object, and filter first suspicious business data from the business data of the user to be identified according to a preset filtering condition; A second acquisition module is used to determine the category of the organization to which the user to be identified belongs based on the user basic data, where the category of the organization to which the user belongs includes an internal organization and an external organization; A third acquisition module is used to determine the supplementary data of the user to be identified based on the category of the affiliated organization, and determine the second business doubt data in the business data according to the supplementary data and the holiday data, wherein the supplementary data includes at least one of the behavior data of the user to be identified and the description data of the business target; An identification module is used to determine target business doubtful data according to the first business doubtful data and the second business doubtful data, generate verification information based on the target business doubtful data, and send it to the client for verification.

12. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 10 when executed by a processor.

14. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 10 when being executed by a processor.

Images