Abnormal detection and abnormal resource transfer interception method and device

Abstract

The invention discloses an anomaly detection and anomaly resource transfer interception method and device. The method can be applied to various scenes such as cloud technology, artificial intelligence, intelligent traffic and auxiliary driving. According to the method, a long period after a target object group establishes a social relation is segmented into a plurality of small periods to extract resource transfer features, target mode features are determined on the basis of the resource transfer features, and the finally obtained target mode features can reflect the development of the abnormal social behavior type along with time, the change of the resource transfer mode of the target object group and the change of the abnormal social behavior type along with time. And then through feature comparison, whether the current target object group and the abnormal object group have the same resource transfer mode can be determined, so that whether the target object group has the abnormal social behavior can be accurately identified, and the accuracy of anomaly detection is improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology and provides a method and device for anomaly detection and abnormal resource transfer interception. Background Art

[0002] While the development of instant messaging technology has brought convenience to daily social interaction, it has also brought certain social risks. For example, there are currently abnormal social behaviors in which social object A uses social networking as a medium to approach another social object B through social networking, and after gaining the trust of social object B, guides social object B to transfer electronic resources to social object A, causing social object B to lose resources.

[0003] Anomaly detection refers to mining abnormal objects with abnormal social behaviors from social networks. The detection method used in related technologies usually builds a classification model based on social objects and interaction features, and then uses the classification model to identify in real time whether social objects have abnormal social behaviors.

[0004] However, in actual applications, the execution cycle of abnormal social behavior is relatively long (e.g., lasting for 1 month or even several months), and the classification model is limited by the amount of data and model complexity, which will limit the time window for processing data. Therefore, when using the above detection method to detect abnormal social behavior, it is impossible to accurately extract the characteristics of the abnormal social process, which seriously affects the accuracy of the detection results. Summary of the invention

[0005] The embodiments of the present application provide a method and device for anomaly detection and abnormal resource transfer interception, which are used to improve the accuracy of anomaly detection results.

[0006] In one aspect, a method for detecting anomalies is provided, the method comprising:

[0007] Extracting target social interaction features of the target object group according to historical social data between two social objects included in the target object group;

[0008] For the two social objects, historical resource transfer data corresponding to at least one social cycle starting from the moment when the social relationship is established is obtained, and target pattern features of the target object group are extracted based on the at least one historical resource transfer data obtained; the target pattern features represent: changes in the resource transfer patterns of the two social objects between different social cycles;

[0009] Matching the social interaction feature and the resource transfer pattern feature with a preset abnormal reference feature set to obtain a matching result; wherein the abnormal reference feature set includes: a reference social interaction feature and a reference pattern feature of at least one abnormal object group;

[0010] According to the matching result, an abnormality detection result for the target object group is obtained.

[0011] On the one hand, a method for intercepting abnormal resource transfer is provided, the method comprising:

[0012] receiving a resource transfer request sent by a first social object, wherein the resource transfer request indicates initiating a resource transfer to a second social object;

[0013] Obtaining a target social interaction feature and a target pattern feature of a target object group consisting of the first social object and the second social object; the target social interaction feature is determined based on historical social data between the first social object and the second social object, and the target pattern feature is determined based on historical resource transfer data corresponding to at least one social cycle starting from the moment when the social relationship between the first social object and the second social object is established, and the target pattern feature represents: changes in resource transfer patterns of the two social objects between different social cycles;

[0014] Matching the social interaction feature and the resource transfer pattern feature with a preset abnormal reference feature set to obtain a matching result; wherein the abnormal reference feature set includes: a reference social interaction feature and a reference pattern feature of at least one abnormal object group;

[0015] When the matching result indicates a successful match, the resource transfer request is intercepted, and an abnormal prompt message is sent to the first social object.

[0016] In one aspect, an abnormality detection device is provided, the device comprising:

[0017] a feature extraction unit, configured to extract a target social interaction feature of the target object group based on historical social data between two social objects included in the target object group;

[0018] A data acquisition unit, configured to acquire, for the two social objects, historical resource transfer data corresponding to at least one social cycle starting from the moment when the social relationship is established;

[0019] The feature extraction unit is further used to extract the target pattern feature of the target object group according to the obtained at least one historical resource transfer data; the target pattern feature represents: the change of the resource transfer pattern of the two social objects between different social cycles;

[0020] A feature matching unit, configured to match the social interaction feature and the resource transfer mode feature with a preset abnormal reference feature set to obtain a matching result; wherein the abnormal reference feature set includes: a reference social interaction feature and a reference mode feature of at least one abnormal object group;

[0021] A detection unit is used to obtain an abnormality detection result for the target object group based on the matching result.

[0022] On the one hand, a device for intercepting abnormal resource transfer is provided, the device comprising:

[0023] A receiving unit, configured to receive a resource transfer request sent by a first social object, wherein the resource transfer request indicates initiating a resource transfer to a second social object;

[0024] a feature extraction unit, configured to obtain a target social interaction feature and a target pattern feature of a target object group consisting of the first social object and the second social object; the target social interaction feature is determined based on historical social data between the first social object and the second social object, the target pattern feature is determined based on historical resource transfer data corresponding to at least one social cycle starting from the moment when the social relationship between the first social object and the second social object is established, and the target pattern feature represents: changes in resource transfer patterns of the two social objects between different social cycles;

[0025] A feature matching unit, configured to match the social interaction feature and the resource transfer mode feature with a preset abnormal reference feature set to obtain a matching result; wherein the abnormal reference feature set includes: a reference social interaction feature and a reference mode feature of at least one abnormal object group;

[0026] a request interception unit, configured to intercept the resource transfer request when the matching result indicates a successful match;

[0027] A sending unit is used to send abnormal prompt information to the first social object.

[0028] On the one hand, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any one of the above methods when executing the computer program.

[0029] In one aspect, a computer storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the steps of any of the above methods are implemented.

[0030] In one aspect, a computer program product is provided, the computer program product comprising a computer program, the computer program being stored in a computer-readable storage medium. A processor of a computer device reads the computer program from the computer-readable storage medium, and the processor executes the computer program, so that the computer device performs the steps of any of the above methods.

[0031] In the embodiment of the present application, the resource transfer features are extracted by dividing the long period after the target object group establishes a social relationship into multiple small periods, and the target pattern features are determined in this way. The target pattern features finally obtained can reflect the changes in the resource transfer pattern of the target object group over time as the abnormal social behavior type develops. By comparing with the reference social interaction features and reference pattern features obtained in the same way in the abnormal reference feature set, it can be confirmed whether the current target object group and the abnormal object group have the same resource transfer pattern, and then accurately identify whether the target object group has abnormal social behavior, thereby improving the accuracy of abnormal detection. In addition, the method of the embodiment of the present application takes into account the entire social cycle after the establishment of social relationships, and is more suitable for the detection of long-term types such as abnormal social behavior. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only the embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0033] Figure 1 A schematic diagram of an application scenario provided for an embodiment of the present application;

[0034] Figure 2 A schematic diagram of the system framework provided for an embodiment of the present application;

[0035] Figure 3 A flowchart of an anomaly detection method provided in an embodiment of the present application;

[0036] Figure 4 A schematic diagram of a process for extracting social interaction features provided in an embodiment of the present application;

[0037] Figure 5 A schematic diagram of a process for extracting target pattern features provided in an embodiment of the present application;

[0038] Figure 6A to Figure 6B A schematic diagram of target pattern features provided by an embodiment of the present application;

[0039] Figure 7A schematic diagram of the mode characteristics provided by the embodiment of the present application;

[0040] Figure 8 A schematic diagram of a feature matching process provided in an embodiment of the present application;

[0041] Fig. 9 An example diagram of a feature hash value of an object group provided in an embodiment of the present application;

[0042] Fig.10 Another flowchart of the anomaly detection method provided in the embodiment of the present application;

[0043] Fig.11 A schematic diagram of the principle of the real-time stage provided by an embodiment of the present application;

[0044] Fig.12 A flowchart of an abnormal resource transfer interception method provided in an embodiment of the present application;

[0045] Fig.13 Another schematic diagram of a process flow of the abnormal resource transfer interception method provided in an embodiment of the present application;

[0046] Fig.14 A schematic diagram of the structure of an abnormality detection device provided in an embodiment of the present application;

[0047] Fig.15 A schematic diagram of a structure of an abnormal resource transfer interception device provided in an embodiment of the present application;

[0048] Fig.16 A schematic diagram of the composition structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical scheme and advantages of the present application clearer, the technical scheme in the embodiment of the present application will be clearly and completely described below in conjunction with the drawings in the embodiment of the present application. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other arbitrarily. In addition, although the logical order is shown in the flow chart, in some cases, the steps shown or described can be performed in an order different from that here.

[0050] It is understandable that in the following specific implementations of the present application, social object data may be involved, such as object data of social objects or resource transfer data, etc. Therefore, when the various embodiments of the present application are applied to specific products or technologies, relevant licenses or consents need to be obtained, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0051] To facilitate understanding of the technical solutions provided in the embodiments of the present application, some key terms used in the embodiments of the present application are explained here:

[0052] Resource transfer data: Resource transfer refers to the process of transferring electronic resources from one party to another, which can also be called "transaction". The electronic resources here refer to resources that can be circulated on platforms such as online trading platforms and asset management institutions' platforms, such as currency, goods, etc.

[0053] One hot encoding: It can also be called one-bit effective encoding. It uses an N-bit state register to encode N states. Each state has its own independent register bit, and only one of them is valid at any time. One hot encoding is a data preprocessing technology commonly used in machine learning. It can be used to convert discrete data into vector data, map each possible value to a unique binary bit in the vector, and when a value is selected, the corresponding position is assigned a value of 1, and other positions are assigned a value of 0.

[0054] For example, if a feature has three possible values: A, B, and C, then One hot encoding will convert them into a vector of length 3. For example, [A, B, C] can be converted to [1, 0, 0], [0, 1, 0], [0, 0, 1].

[0055] Abnormal social behavior: refers to abnormal behavior between social objects, which can also be called friendship fraud or social fraud, etc. Specifically, it refers to abnormal social behavior in which social object A, using social networks as a medium, approaches another social object B by social friendship, and after gaining the trust of social object B, guides social object B to transfer electronic resources to social object A, causing social object B to suffer resource loss.

[0056] Social objects: refers to users on social platforms. In social networks, each social object corresponds to a social account. Social objects can interact with each other by establishing social relationships. For example, they can add each other as friends on social platforms to view each other's information, chat, send messages, transfer resources, and other social interactions.

[0057] Social data: Social data may include data related to social objects, such as object data of social objects, such as age, region or gender, etc., and may also include interaction information between social objects. For example, interaction information may include method indication data indicating the method of establishing a social relationship between two social objects, and may also include chat interaction related data between social objects. For example, the method indication data indicates the direction of establishing a social relationship when two social objects establish a social relationship. For example, for a social object A and a social object B, the direction of establishing a social relationship refers to whether social object A initiates the establishment of a social relationship with social object B, or whether social object B initiates the establishment of a social relationship with social object A.

[0058] Resource transfer pattern: For abnormal social behavior, there is a certain regularity in the resource transfer process between social objects. This regularity is the resource transfer pattern mentioned in the embodiments of the present application. The pattern characteristics in the embodiments of the present application characterize the changes in the resource transfer pattern of two social objects between different social cycles, which can also be understood as the changes in the resource transfer pattern as the social cycle progresses.

[0059] For example, after social object A gains the trust of social object B, it tells social object B that it can manage his finances. At first, social object B transfers a small amount of electronic resources to social object A, and social object A transfers the income from these financial management to social object B. After a certain number of times, social object B completely trusts social object A and transfers a large amount of electronic resources to him. This pattern of abnormal social behavior follows a pattern in which the number of resources transferred increases from a small amount to a large amount.

[0060] For another example, after social object A has gained the trust of social object B, it tells him that their relationship can be further improved, for example, it can be determined to be a social relationship higher than the social platform. Then social object B will continue to transfer electronic resources to social object A, and the number of resources will also have a certain pattern, such as usually special values ​​such as 520, 521, or 5201314.

[0061] The technical ideas of the embodiments of the present application are briefly described below.

[0062] At present, anomaly detection for abnormal social behavior can be performed mainly in the following two ways:

[0063] The first method is usually to build a classification model based on social objects and interaction features, and then use the classification model to identify in real time whether the social objects have abnormal social behaviors.

[0064] However, the classification model is limited by the amount of data and the complexity of the model, and will have some restrictions on the time window of the data to be processed. It is more common to use data in a time window of days as the data to be processed, while the cycle of abnormal social behavior is longer, for example, it may be 1 month or even several months. Therefore, when using the above detection method to detect abnormal social behavior, it is impossible to accurately extract the characteristics of the abnormal social process, which seriously affects the accuracy of the detection results.

[0065] The second method is to identify by coloring. The more common method is to color some devices or Internet Protocol Addresses (IP addresses) and other single dimensions, and then identify them based on the colored devices or IP addresses.

[0066] However, with the development of technology, these methods have been resisted by criminals in some confrontational ways, and the number of accurate identifications through equipment or network environments has gradually decreased. It is difficult to produce good results in the detection of abnormal social behaviors.

[0067] Based on this, in order to improve the accuracy of detecting abnormal social behaviors, the present application proposes an anomaly detection method. This method is based on the consideration that the resource transfer process between social objects has certain rules. The resource transfer data of different social cycles are introduced to extract the changing rules of the resource transfer pattern between social objects. The method is combined with the characteristic anomalies of the social object group itself to identify abnormal social behaviors in the social platform.

[0068] Specifically, in the embodiment of the present application, an object group consisting of two social objects is used as a detection object for abnormal social behavior, and an abnormal reference feature set is pre-constructed, which stores relevant features of the abnormal object group with abnormal social behavior.

[0069] When actually detecting, on the one hand, based on the historical social data between the two social objects included in the target object group, the target social interaction features of the target object group are extracted; on the other hand, for the two social objects, the historical resource transfer data corresponding to at least one social cycle starting from the moment when the social relationship is established is obtained, and based on the at least one historical resource transfer data obtained, the target pattern features of the target object group are extracted, and the target pattern features represent the changes in the resource transfer patterns of the two social objects between different social cycles. Then, the social interaction features and resource transfer pattern features can be matched with the preset abnormal reference feature set, and the abnormal detection results for the target object group can be obtained according to the matching results.

[0070] In the above method, the information of the object group itself can reflect the possibility that the object group may have abnormal social behavior, and by dividing the long period after the target object group establishes a social relationship into multiple small periods to extract resource transfer features, and thereby determine the target pattern features, the target pattern features finally obtained can reflect the type of abnormal social behavior as time goes by, and the changes in the resource transfer pattern of the target object group, and by comparing with the reference social interaction features and reference pattern features obtained in the same way in the abnormal reference feature set, it can be confirmed whether the current target object group and the abnormal object group have the same resource transfer pattern, and then accurately identify whether the target object group has abnormal social behavior, thereby improving the accuracy of abnormal detection. In addition, the method of the embodiment of the present application takes into account the entire social cycle after the establishment of a social relationship, and is more suitable for the detection of long-term types of abnormal social behavior.

[0071] In addition, the embodiment of the present application also performs feature hash encoding on the extracted features through feature hashing, so that the final social interaction features and pattern features are more lightweight to save storage space, and the feature hash value obtained after feature hash encoding can also reduce the complexity of feature matching and improve the detection efficiency of abnormal social behavior.

[0072] The embodiment of the present application also provides a method for intercepting abnormal resource transfer. The method adopts the same technical concept as the above-mentioned abnormal social behavior. When a first social object initiates a resource transfer to a second social object, it will detect whether the target object group composed of the first social object and the second social object is an abnormal object group. When it is an abnormal object group, the resource transfer will be intervened, for example, the resource transfer request will be intercepted, and an abnormal prompt information will be sent to the first social object to reduce the degree of resource loss of the first social object and improve the security of the social platform.

[0073] The following briefly introduces the application scenarios to which the technical solutions of the embodiments of the present application can be applied. It should be noted that the application scenarios introduced below are only used to illustrate the embodiments of the present application and are not limited. In the specific implementation process, the technical solutions provided by the embodiments of the present application can be flexibly applied according to actual needs.

[0074] The solution provided in the embodiment of the present application can be applied to social platform scenarios. Figure 1 As shown, it is a schematic diagram of an application scenario provided by an embodiment of the present application. In this scenario, multiple terminal devices 101 and a server 102 may be included.

[0075] The terminal device 101 can be, for example, a mobile phone, a tablet computer (PAD), a laptop computer, a desktop computer, a smart TV, a smart car device, a smart wearable device, a smart TV, and an aircraft, and any device with social platform capabilities. The terminal device 101 can be installed with a social platform application, and the server 102 can be a background server of the social platform application. The social platform application has functions such as social interaction and resource transfer, such as instant messaging applications, music applications, video applications, short video applications, news applications, and shopping applications. The application involved in the embodiment of the present application can be a software client, or a client such as a web page or a small program, and the server 102 is a server corresponding to the software or web page, small program, etc., without limiting the specific type of the client. The server 102 can be, for example, an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, i.e., content delivery networks (CDN), and basic cloud computing services such as big data and artificial intelligence platforms, but is not limited to this.

[0076] Among them, the server 102 and the terminal device 101 may include one or more processors, memories, and interactive I / O interfaces, etc. In addition, the server 102 may also be configured with a database, which may be used to store the social interaction features and pattern features involved in the embodiments of the present application. Among them, the memories of the server 102 and the terminal device 101 may also store program instructions required to be executed in the anomaly detection method provided in the embodiments of the present application, and these program instructions can be used to implement the anomaly detection process provided in the embodiments of the present application when executed by the processor.

[0077] In the embodiment of the present application, the terminal device 101 and the server 102 can be directly or indirectly connected to each other through one or more networks 103. The network 103 can be a wired network or a wireless network. For example, the wireless network can be a mobile cellular network or a wireless fidelity (Wireless-Fidelity, WIFI) network. Of course, it can also be other possible networks, which are not limited in the embodiment of the present application. It should be noted that Figure 1 The figure is only an example. In fact, the number of terminal devices and servers is not limited and is not specifically limited in the embodiments of the present application.

[0078] See also Figure 2 As shown, it is a schematic diagram of an anomaly detection framework provided by an embodiment of the present application, in which a resource transfer system, a feature system, a common feature library, a strategy system and an anomaly reference feature library may be included.

[0079] (1) A resource transfer system can be used to record the historical social data of each object group and the historical resource transfer data in each social cycle, and send them to the feature system. In some embodiments, the resource transfer system can also perform feature extraction on the historical social data to generate a group feature for each object group, and perform feature extraction on the historical resource transfer data in each social cycle to generate a resource transfer feature for each social cycle, and then send the group feature and resource transfer feature to the feature system.

[0080] (2) A feature system can be used to extract features from historical social data to generate group features for each object group, and can extract features from resource transfer data within each social cycle to generate resource transfer features for each social cycle. In some embodiments, the feature system can also perform feature hash encoding on the group features and resource transfer features to obtain corresponding feature hash values.

[0081] (3) A common feature library, which can be used to store group features and resource transfer features obtained by a resource transfer system or feature system, and / or corresponding feature hash values. An abnormal reference feature library, which can be used to store group features and resource transfer features marked as abnormal object groups, and / or corresponding feature hash values.

[0082] (4) A policy system can be used to identify abnormal object groups based on abnormal case information, and black-mark the group features and resource transfer features of these abnormal object groups, and / or the corresponding feature hash values, and add them to the abnormal reference feature library. In some embodiments, a risk control inquiry can also be provided. For example, when a resource transfer is triggered, the policy system can be requested to inquire whether there is a risk in this resource transfer. When the policy system detects that the group features and resource transfer features of the current object group, or the corresponding feature hash values ​​are black-marked, or can match the black-marked group features and resource transfer features, or the corresponding feature hash values, it will intervene in this resource transfer, such as refusing to respond or prompting the social object that there is a risk at present.

[0083] (5) An abnormal reference feature library, which can be used to store group features and resource transfer features that are colored black, and / or corresponding feature hash values.

[0084] Below, in combination with the application scenarios and system framework described above, the method provided by the exemplary embodiment of the present application is described with reference to the accompanying drawings. It should be noted that the above application scenarios are only shown to facilitate understanding of the spirit and principles of the present application, and the implementation methods of the present application are not limited in this regard.

[0085] See also Figure 3FIG. 1 is a flow chart of an abnormality detection method provided in an embodiment of the present application. The method can be executed by a computer device, which can be Figure 1 The terminal device or server shown in the figure, the specific implementation process of the method is as follows:

[0086] Step 301: extracting target social interaction features of the target object group based on historical social data between two social objects included in the target object group.

[0087] In the embodiment of the present application, historical social data refers to information involved in the historical social process, or information formed in the social process, and may include but is not limited to at least one of the following data:

[0088] (1) Object data: Object data refers to the object data corresponding to the two social objects included in a target object group. Object data is used to describe social objects and can also be understood as object attributes of social objects. Each social object can be described from one or more object information dimensions. Therefore, for each social object, object data may include object data on at least one object information dimension. At least one object information dimension may include, for example, information such as region, age, or gender.

[0089] (2) Method indication data, which is used to indicate the method of establishing a social relationship between two social objects. The establishment of a social relationship can be simply understood as the process of two people becoming social friends with each other. The method indication data may include, for example, the direction of establishing the social relationship, that is, which social object in the target object group actively initiates the establishment of the social relationship, and how the social object searches for another social object.

[0090] Of course, any other possible information may also be included, and the embodiments of the present application do not limit this.

[0091] In a possible implementation, the process of step 301 may be performed when the social relationship of the target object is established, or may be performed at a certain time before the two trigger the abnormal social behavior detection, and the obtained social interaction features are stored in the feature library. In this case, when abnormal social behavior detection is required, there is no need to perform step 301 to obtain the social interaction features, but it can be directly obtained from the feature library, thereby avoiding the execution of too many tasks when abnormal social behavior detection is triggered, causing excessive device load, reducing the burden on the device, and also improving the efficiency of abnormal social behavior detection.

[0092] In a possible implementation, the process of step 301 may be performed only when abnormal social behavior detection is triggered. In this case, historical social data may be recorded in advance, and when abnormal social behavior detection is triggered, the process of step 301 is performed to obtain corresponding social interaction features. The advantage of this approach is that the feature extraction process is performed only when abnormal social behavior detection is considered necessary, and it is understandable that the proportion of abnormal social behavior in actual scenarios is low. In this way, it is possible to avoid the need to perform feature extraction processes on a large number of non-abnormal object groups, thereby reducing the burden on the device.

[0093] For details, see Figure 4 As shown, the process of extracting social interaction features can be performed in the following manner.

[0094] Step 3011: extracting object sub-features of the two social objects in at least one object information dimension respectively according to the object data of the two social objects in each object information dimension.

[0095] Specifically, for at least one information dimension, the following operations are performed respectively: for one information dimension, object sub-features of two social objects in one object information dimension are extracted respectively according to object data of two social objects in one object information dimension.

[0096] For example, when at least one object information dimension includes object information dimensions 1 to 3, and the object group includes social object A and social object B, then for social object A, object sub-features of social object A on object information dimensions 1 to 3, i.e., three object sub-features, can be extracted respectively. Similarly, for social object B, object sub-features of social object B on object information dimensions 1 to 3, i.e., three object sub-features, can be extracted respectively.

[0097] Exemplarily, object information dimensions 1 to 3 may be information dimensions such as region, gender, and age. Here, region, gender, and age are taken as examples. For the region information dimension of a social object, the granularity of the region may be pre-configured, such as the granularity accurate to the province or city, and then the region of the social object may be extracted from the address information or location information of the social object according to the pre-configured granularity as the object sub-feature of the region information dimension; for the gender information dimension of a social object, there are two candidate values, and the corresponding candidate value is determined according to the actual gender of the social object as the object sub-feature of the gender information dimension; for the age information dimension of a social object, since the numerical discreteness of age is high, age may be bucketed, that is, age may be divided into multiple age groups, and then the age group to which the social object belongs may be determined according to the age-related information of the social object as the object sub-feature of the age information dimension.

[0098] Step 3012: Extract establishment mode features based on mode indication data.

[0099] Specifically, when the method indication data includes only one information dimension, the establishment method features can be directly extracted according to the extraction method of the information dimension; when the method indication data includes multiple information dimensions, the corresponding establishment method features can be extracted according to the extraction method of each information dimension.

[0100] Exemplarily, the method indication data may include information such as the direction of adding friends and the method of adding friends. Here, taking the direction of adding friends and the method of adding friends as an example, for an object group including social object A and social object B, there are two candidate options for the direction of adding friends, namely A plus B, or B plus A. The direction of adding friends can be determined based on the interactive request of adding friends by an object group. The method of adding friends can be distinguished from the way of obtaining the information of another social object when adding friends, for example, it can be obtained by searching through the mobile phone number, or by searching through the social account, or by searching in the social group where both are in. Therefore, the candidate options of the method of adding friends can be set in advance, and then the method of adding friends can be determined according to the actual situation of an object group. Therefore, the combination of the direction of adding friends and the method of adding friends can constitute the establishment method feature.

[0101] Step 3013: Obtain a target social interaction feature based on at least one object sub-feature and an establishment method feature obtained.

[0102] Specifically, the above extracted features can be spliced ​​in a pre-set order to obtain the target social interaction features. For example, the three object sub-features of social object A and the three object sub-features of social object B, as well as the establishment method features of the friend adding direction and friend adding method combination can be spliced ​​in order to serve as the target social interaction features of the target object group. Alternatively, the above extracted features can be stored in the same table or file to obtain the target social interaction features.

[0103] It should be noted that the above feature extraction process is applicable to any object group, and the social interaction features of any object group can be obtained through the above process.

[0104] In a possible implementation, the extraction of object sub-features can also be carried out through a vectorization model to vectorize social objects in a social platform according to relevant information of the social objects to obtain object feature vectors (embedding) of each social object, and then the object feature vectors of two social objects in an object group and the characteristics of the social relationship establishment method can be spliced ​​to serve as the group features of the object group (i.e., social interaction features).

[0105] Specifically, the vectorization model can be, for example, a graph embedding model, which constructs a graph of all social objects and then uses a graph algorithm for supervised training (the supervised label can be, for example, whether the social object is an abnormal social object), generates an embedding for each account, and then can piece together the edbeddings of both parties in the object group as the group feature of the object group.

[0106] Step 302: For two social objects, obtain historical resource transfer data corresponding to at least one social cycle starting from the moment when the social relationship is established.

[0107] In the embodiment of the present application, the social cycle is a cycle configured according to the changing rules of abnormal social behavior, so as to divide the long cycle of abnormal social behavior into multiple small cycles, and measure the changing rules of the resource transfer mode of the entire long cycle from the resource group transfer characteristics of multiple social cycles, so as to judge whether it conforms to the changing rules of abnormal social behavior. That is to say, in the embodiment of the present application, the moment when each object group establishes a social relationship is used as the starting moment of the first social cycle, and the resource transfer situation between social objects in the object group is accumulated and recorded in time intervals.

[0108] In practical applications, the value of the social cycle can be set according to experience, or a better value can be measured according to experimental determination of the changing pattern of abnormal social behavior. For example, the value of a social cycle can be, for example, a week or a month, etc., which is not limited in the present embodiment.

[0109] Exemplarily, taking a social cycle of one week as an example, starting from the moment when the two social objects establish a social relationship, the resource transfer data of each week will be recorded in sequence, so as to facilitate the subsequent statistics of the flow resource transfer water situation of the object group by week. Normally, abnormal social behavior will occur within a certain time range. For example, social object A will usually complete the resource deception of social object B within a week after establishing a social relationship with social object B. Therefore, when actually recording, the resource transfer situation of the first four weeks can be focused on. Of course, the resource transfer situation from four weeks to the present can also be recorded as a basis for judging abnormal social behavior. It can be understood that the four weeks here are only an example. In actual scenarios, the threshold can be flexibly configured according to actual conditions, and the embodiments of the present application do not limit this.

[0110] The historical resource transfer data corresponding to a social cycle is the relevant information involved in the resource transfer process occurring in the social cycle. The historical resource transfer data of each social cycle may include resource transfer data of at least one resource transfer information dimension.

[0111] Specifically, the aforementioned at least one resource transfer information dimension may include, but is not limited to, at least one of the following dimensions:

[0112] (1) Resource transfer direction. For social objects A and B in the target object group, the resource transfer direction refers to whether the resource is transferred from social object A to social object B or from social object B to social object A.

[0113] (2) The resource transfer method used when transferring resources, as well as the number of resource transfers and the amount of resources for each resource transfer method. The resource transfer method refers to the method used when transferring resources, such as money transfer, face-to-face payment, or sending red envelopes; the number of resource transfers refers to the number of times the same resource transfer method occurs within a social cycle, such as sending N red envelopes within a week; the amount of resources refers to the specific amount of resources transferred each time a resource is transferred, such as the amount of the red envelope when sending a red envelope.

[0114] (3) Time information of resource transfer. The time information may be a specific time of occurrence; or, in order to more conveniently count the time periods during which resource transfers between object groups often occur, the time information may also be the time period during which the time of occurrence is located. The division of time periods may be configured according to actual needs, for example, it may be divided into morning, afternoon, and evening, or it may be divided into hours, and the embodiments of the present application do not limit this.

[0115] (4) The maximum number of resources transferred in a social cycle and the number of resource transfers for the maximum number of resources.

[0116] (5) The number of target resources with the most transfers in a social cycle and the number of resource transfers for the number of target resources.

[0117] Of course, any other possible information may also be included, and the embodiments of the present application do not limit this.

[0118] In an embodiment of the present application, the data related to the resource transfer process involved can be saved to a database in real time by the object group, such as resource transfer flow data, for subsequent calculation of corresponding pattern features.

[0119] In actual application, for each social cycle, the resource transfer flow data between two social objects in the object group can be recorded, that is, the data involved in each resource transfer process occurring in each social cycle can be recorded, and the resource transfer data of the two social objects in at least one resource transfer information dimension can be extracted based on the resource transfer flow data, and then the historical resource transfer data of a social cycle can be obtained based on the resource transfer data in at least one resource transfer information dimension. In other words, in actual application, the data of at least one resource transfer information dimension can be recorded in a targeted manner, and other unnecessary data can be filtered out to reduce the space occupied by data storage.

[0120] Step 303: extracting target pattern features of the target object group based on the at least one historical resource transfer data obtained; the target pattern features represent: changes in the resource transfer patterns of the two social objects between different social cycles.

[0121] Similar to the process of step 301, in a possible implementation, the process of step 303 can be performed when the social relationship of the target object is established, or it can be performed at a certain time before the two trigger the abnormal social behavior detection, and the obtained pattern features are stored in the feature library. In this case, when abnormal social behavior detection is required, there is no need to perform the steps of step 303 to obtain the pattern features, but it can be directly obtained from the feature library, thereby avoiding the execution of too many tasks when abnormal social behavior detection is triggered, which makes the device load too high, reduces the burden on the device, and also improves the efficiency of abnormal social behavior detection.

[0122] In a possible implementation, the process of step 303 may be performed only when abnormal social behavior detection is triggered. In this case, historical resource transfer data may be recorded in advance, and when abnormal social behavior detection is triggered, the process of step 303 is performed to obtain corresponding pattern features. The advantage of this approach is that the feature extraction process is performed only when abnormal social behavior detection is considered necessary, and it is understandable that the proportion of abnormal social behavior in actual scenarios is low. In this way, it is possible to avoid the need to perform feature extraction processes on a large number of non-abnormal object groups, thereby reducing the burden on the device.

[0123] In the present application examples, see Figure 5 As shown, the process of extracting target pattern features can be achieved through the following steps:

[0124] Step 3031: extracting resource transfer sub-features of the social cycle in at least one resource transfer information dimension according to the historical resource transfer data corresponding to each social cycle.

[0125] Specifically, each social cycle corresponds to a historical resource transfer data, and the following operations are performed for at least one historical resource transfer data: according to the resource transfer data of at least one resource transfer information dimension included in the historical resource transfer data, the resource transfer sub-features corresponding to the at least one resource transfer information dimension are obtained respectively.

[0126] Exemplarily, taking the aforementioned resource transfer information dimension as an example, for the social object A and the social object B included in the target object group, the extraction process of each resource transfer information dimension can be illustrated as follows:

[0127] (1) Resource transfer direction: When there is only a one-way resource transfer direction between social objects A and B, that is, only one party transfers resources to the other party, then only the features of one resource transfer direction are extracted. If there is a two-way resource transfer process, then the features can be extracted separately, that is, the features of the subsequent dimensions are extracted for the A→B direction and the B→B direction respectively.

[0128] (2) The resource transfer method used during resource transfer, as well as the number of resource transfers and the number of resources for each resource transfer method. For each resource transfer direction, the values ​​of the resource transfer method, number of times, and number are extracted.

[0129] Specifically, in actual application, each resource transfer record can be traversed, and according to the actual situation of the currently traversed resource transfer record, it can be recorded on the corresponding candidate item. For example, a record of social object A transferring 100 yuan to social object B can be recorded in the direction of A→B, the number of resource transfer methods for the transfer is increased by one, and the value of this transfer is recorded as 100.

[0130] In some implementations, the discreteness of the times and numbers of values ​​may complicate the subsequent matching process, and in practical applications, it is not necessary to care about the specific times and numbers of resource transfers, but rather the order of magnitude or granularity of the times and numbers of resource transfers. Therefore, in the embodiments of the present application, the times and numbers of resource transfers may be bucketed, and each bucket may be recorded separately.

[0131] For example, the number of resource transfers can be divided into less than 10 times, 11 to 50 times, 51 to 100 times, and more than 100 times, and then the buckets corresponding to each resource transfer method in a social cycle can be counted. The number of resources can also be counted in the same way, and finally the number buckets and number buckets corresponding to various resource transfer methods are formed as the resource transfer sub-features of the resource transfer information dimension.

[0132] (3) Time information of resource transfer. For example, the time when each resource transfer record occurs can be extracted, and the time period in which the time period is located can be determined and recorded. Then, the time period in which the resource transfer of the target object group mainly occurs within a social cycle can be counted as the resource transfer sub-feature of the resource transfer information dimension; or, the number of resource transfers occurring in each time period can be counted as the resource transfer sub-feature of the resource transfer information dimension. Of course, other possible methods can also be used, and the embodiments of the present application are not limited to this.

[0133] (4) The maximum number of resources transferred in a social cycle and the number of resource transfers of the maximum number of resources. From all resource transfer records of the currently extracted social cycle, the maximum amount involved is extracted, and the number of resource transfer records involved in the amount can be counted as the resource transfer sub-feature of the resource transfer information dimension.

[0134] (5) The number of target resources with the most transfer times in a social cycle and the number of resource transfers of the target resource number. From all resource transfer records of the currently extracted social cycle, extract the number of resource transfers corresponding to each number of resources, and determine the number of target resources with the most times, so that the target resource number and its corresponding number of resource transfers are used as resource transfer sub-features of the resource transfer information dimension. Alternatively, in actual application, the number of resources can also be divided into intervals, for example, one interval can be divided for every 100 yuan, and then the number of times is counted for each number interval to determine the number interval with the most times, and the number interval and its corresponding number of times are used as resource transfer sub-features of the resource transfer information dimension. In this way, it is possible to reduce the focus on the numerical value and focus on the numerical interval or order of magnitude corresponding to the resource transfer between the object groups as a measurement indicator to measure whether there is abnormal social behavior between the two.

[0135] Step 3032: Obtain resource transfer characteristics of the corresponding social cycle according to the at least one resource transfer sub-characteristic obtained.

[0136] Specifically, the combination of the resource transfer sub-features extracted above is the resource transfer feature of a social cycle. Figure 5 As shown in , at least one resource transfer information dimension includes resource transfer information dimensions 1 to n, and each resource transfer information dimension generates a resource transfer sub-feature, that is, Figure 5 The resource transfer sub-features 1 to n shown can then be combined to obtain the resource transfer features of the social cycle.

[0137] In some implementations, the resource transfer sub-features may be spliced ​​in a pre-set order to obtain the resource transfer feature of the social cycle.

[0138] In some implementations, the extracted features may also be stored in the same table or file to obtain target social interaction features.

[0139] Step 3033: Obtain a target mode feature based on at least one resource transfer feature obtained.

[0140] In the embodiment of the present application, the target mode features the changes in the resource transfer mode of two social objects between different social cycles. Figure 5 As shown, when the historical resource transfer data of M social cycles are recorded, the corresponding resource transfer features 1-M can be obtained, and then the target pattern features of the target object group can be determined according to the resource transfer features 1-M.

[0141] In a possible implementation, at least one resource transfer feature may be sorted according to the order of the social cycles corresponding to each resource transfer feature to obtain a resource transfer feature sequence, and the resource transfer feature sequence may be determined as the target pattern feature. Fig. 6A As shown in FIG. 1 , a schematic diagram of a target pattern feature is shown. Taking a social cycle of one week as an example, the resource transfer features of each week are spliced ​​in the order of the 1st to Mth weeks to obtain the target pattern feature. In this way, the changes in the resource transfer of the target object group in each week over time can be accurately recorded.

[0142] In a possible implementation, the change information between different social cycles can also be recorded as the target pattern feature. Specifically, the resource transfer features of adjacent social cycles can be compared, and then the change value between every two social cycles can be recorded, and the change values ​​can be spliced ​​in chronological order as the target pattern feature. Figure 6B As shown in the figure, it is a schematic diagram of a target pattern feature. Taking the social cycle of one week as an example, the resource transfer features of two consecutive weeks can be compared to obtain the change information of the resource transfer features of these two weeks, that is, the resource transfer features of the first week are compared with the second week, the resource transfer features of the second week are compared with the third week, and so on. When comparing the resource transfer features of two consecutive weeks, you can also refer to Figure 6B As shown, the resource transfer sub-features of each resource transfer information dimension are compared to obtain the sub-change information of each resource transfer information dimension, so as to obtain the change information of the adjacent two weeks, such as Figure 6B The change information 1 between the 1st week and the 2nd week, the change information 2 between the 2nd week and the 3rd week, and so on, and then the change information 1 to M-1 are spliced ​​in chronological order to obtain the target pattern features.

[0143] In a possible implementation, the resource transfer feature sequence of each social cycle can also be used as the input of the serialization model, and the serialization features can be extracted through the serialization model as the target pattern features. The serialization model can be, for example, a recurrent neural network (RNN) model or a long-short term memory (LSTM) model, etc., which is not limited in the embodiments of the present application.

[0144] Step 304: Match the social interaction features and resource transfer pattern features with a preset abnormal reference feature set to obtain a matching result; wherein the abnormal reference feature set includes: reference social interaction features and reference pattern features of at least one abnormal object group.

[0145] In the embodiment of the present application, the features included in the abnormal reference feature set are features that have been confirmed as abnormal object groups. The determination of these abnormal object groups can be detected using the method of the embodiment of the present application, or can be detected using other detection methods.

[0146] In actual scenarios, the method of steps 301 to 303 can be used to extract social interaction features and resource transfer pattern features for an object group with social relationships, or to extract social interaction features and resource transfer pattern features for an object group with suspicious behaviors. These features can be stored in a general feature library. When an object group with abnormal social behaviors is identified, the relevant features of the object group in the feature library can be colored, that is, marked, and added to the abnormal reference feature library as a reference for subsequent detection. Alternatively, abnormal case information can also be obtained, which can be identified by other online strategies or external feedback data. Similarly, for at least one abnormal object group that has been confirmed to be abnormal as indicated by the abnormal case information, the social interaction features and pattern features of at least one abnormal object group can also be annotated with abnormal labels, and the social interaction features and pattern features of at least one abnormal object group can be added to the abnormal reference feature library as a reference for subsequent detection.

[0147] In the embodiment of the present application, the feature matching process may be triggered by the following situations:

[0148] (1) Triggering of resource transfer, that is, once the resource transfer process is triggered in the target object group, the feature matching process will be triggered.

[0149] Specifically, when it is detected that a resource transfer request is initiated between two social objects in the target object group, the social interaction features and resource transfer mode features of the target object group are matched with the abnormal reference feature set to obtain a matching result.

[0150] (2) Triggering of suspicious behavior, that is, once the preset suspicious behavior is triggered in the target object group, the feature matching process will be triggered.

[0151] Among them, the preset suspicious behavior can be pre-configured and can be an abnormal behavior associated with abnormal social behavior, such as sending suspicious links (such as links containing Trojans, etc.), requesting remote control, etc., and other suspicious behaviors that may cause resource loss.

[0152] Therefore, when a preset suspicious behavior is detected between two social objects in the target object group, the social interaction features and resource transfer pattern features of the target object group are matched with the abnormal reference feature set to obtain a matching result.

[0153] In the present application examples, see Figure 7 As shown, for the target object group, its corresponding target social interaction features and target pattern features are extracted, and for each abnormal object group in the abnormal reference feature library, the corresponding reference social interaction features and reference pattern features can also be extracted in the aforementioned manner. The social interaction features and pattern features of an object group can be considered as a feature record. However, it can be understood that the reference social interaction features and target social interaction features, as well as the reference pattern features and target pattern features, are named differently just to distinguish them, but the contents they contain are the same. The same contents here do not mean that the specific values ​​of each feature are the same, but that the feature dimensions are the same.

[0154] Furthermore, when performing feature matching, the feature record of the target object group can be matched with the feature record of each abnormal object group in the abnormal reference feature set, see Figure 7 As shown, the feature records corresponding to the abnormal groups 1 to P are matched one by one to determine whether the two are identical or similar. Generally speaking, if there are identical or similar features with the abnormal object group, it can be considered that the target object group may also have abnormal social behavior.

[0155] Since the matching process of the target object group and each abnormal object group is similar, the target object group and one abnormal object group are taken as an example here.

[0156] In a possible implementation, Fig. 6A The implementation method corresponds to that, that is, the target pattern feature is obtained by splicing the resource transfer features of different social cycles, and the reference pattern feature of the abnormal object group is also obtained by splicing the resource transfer features of different social cycles. In this case, the following is adopted: Figure 8 The figure is a flow chart of the feature matching process provided in the embodiment of the present application.

[0157] See also Figure 8 As shown, for an abnormal object group in the abnormal reference feature set, the target social interaction feature is matched with the reference social interaction feature of the abnormal object group to obtain a first matching sub-result. Among them, the first matching sub-result represents whether the two object groups match at the object information level, or is understood as whether the account level matches. "Match" in the embodiment of the present application means that the two are exactly the same, or the difference between the two is within the allowable difference range, or the similarity between the two is greater than a set threshold.

[0158] See also Figure 8 As shown, at least one resource transfer feature included in the target pattern feature can also be matched with at least one resource transfer feature included in the reference pattern feature of the abnormal object group to obtain at least one second matching sub-result. The second matching sub-result represents the relationship between the two object groups in each social cycle ( Figure 8 In the example of a social cycle of one week, whether there is a match at the resource transfer level. Alignment matching refers to matching the resource transfer characteristics of the same social cycle, for example, the first social cycle of the target object group is matched with the first social cycle of the abnormal object group, the second social cycle of the target object group is matched with the second social cycle of the abnormal object group, and so on. Generally speaking, when the resource transfer patterns of the two are the same or similar, the resource transfer characteristics of each social cycle are the same or similar.

[0159] Furthermore, the first matching sub-result and the second matching sub-result of each social cycle can be combined to determine whether the two object groups match. Optionally, when the first matching sub-result and the second matching sub-result of each social cycle both match, the two object groups can be considered to match, otherwise the two object groups do not match.

[0160] In a possible implementation, Figure 6B The implementation method corresponds to that, that is, the target pattern feature is obtained by splicing the change information of the resource transfer features of the two social cycles, then the reference pattern feature of the abnormal object group is also obtained by splicing the change information of the resource transfer features of the two social cycles. In this case, the change information can be matched to obtain the corresponding matching sub-results, and the matching of the social interaction features is similar to the previous implementation method, so it will not be elaborated here.

[0161] In the embodiment of the present application, in order to reduce the storage space occupied by the features and improve the utilization of the storage space, after extracting the features, the extracted social interaction features and pattern features can also be subjected to feature hashing processing to make the features more lightweight, so as to reduce the storage space occupied by the features. Among them, the features of each object group can be encoded by feature hashing to obtain the feature hash values ​​corresponding to the social interaction features and pattern features, including the features of the target object group and each abnormal object group in the abnormal reference feature library, and the feature hashing process of each object group is similar, so the feature hashing process of a specific object group is introduced as an example.

[0162] In a possible implementation, the feature hash coding process may use a hash function to map the feature value into a hash value represented by a numerical value, thereby accelerating the efficiency of feature matching and reducing the occupied storage space.

[0163] In a possible implementation, considering that the number of candidate values ​​corresponding to each feature dimension in the embodiment of the present application is not large, the feature hash encoding process can be performed using one-hot encoding. Through one-hot encoding, feature characters can be converted into corresponding binary strings, which can greatly accelerate the efficiency of feature matching and occupy very little storage space. Of course, in actual applications, other possible encoding methods can also be used for feature hash encoding, and the embodiment of the present application does not limit this.

[0164] Taking one-hot encoding as an example, the one-hot encoding value corresponding to each feature value can be pre-configured according to each feature dimension (including the feature dimension of social interaction features and the feature dimension of pattern features), and then the feature value in the actual situation can be mapped to the corresponding one-hot encoding value to form a feature hash value.

[0165] For social interaction features, taking the region, gender, and age of the object group as an example, the region can set corresponding codes for the region candidates, and then map them to the corresponding codes according to the actual region; there are two gender candidates, which can be represented by one byte, that is, 0 can represent males and 1 can represent females; age is divided into intervals during feature extraction, for example, 0 to 18, 18 to 30, 30 to 40, 40 to 50, and above 50, then corresponding codes can be configured for different intervals, and then mapped to the corresponding codes according to the actual bucket.

[0166] As for the way of establishing social relationships, the direction of adding friends can be 1 to indicate that A actively adds B, and 0 to indicate that B actively adds A. Adding friends uses one-hot encoding, and each way of adding friends can also be mapped to a corresponding encoding value.

[0167] Similarly, the resource transfer information dimension within each social cycle can be encoded using one-hot encoding to obtain the corresponding encoding value.

[0168] See also Fig. 9 As shown, an example of a feature hash value of an object group provided in an embodiment of the present application is provided. The account pair feature is obtained by concatenating the various feature dimensions after feature hashing the social interaction feature of the object group, and the transaction feature of each week is obtained by concatenating the various feature dimensions after feature hashing the resource transfer feature of the object group in each week. It can be seen that in this way, the features of each object group can be expressed by a binary string, which can greatly accelerate the efficiency of feature matching and occupy very little storage space.

[0169] It is understandable that the above distances are only examples and do not limit the values ​​in actual scenarios.

[0170] Then, after feature hash coding, when performing feature matching, the feature hash values ​​of the target social interaction feature and the target pattern feature can be matched with the feature hash values ​​of each reference social interaction feature and each reference pattern feature in the abnormal reference feature set to obtain a matching result. Fig. 9 As shown, the account pair features of the two object groups can be compared, as well as the transaction features of the same week. If they are the same, it is considered that the two object groups can match, otherwise the two object groups do not match.

[0171] It should be noted that, because the two object groups may have different numbers of resource transfer cycles, the comparison can be made based on the value with the smallest number of cycles in the two object groups. For example, if object group 1 has transaction characteristics for 3 weeks, and object group 2 has transaction characteristics for 4 weeks, the transaction characteristics of the first 3 weeks can be compared.

[0172] Step 305: Obtain anomaly detection results for the target object group based on the matching results.

[0173] In an embodiment of the present application, based on the matching results, it can be determined whether there is an abnormal object group that matches the target object group. If there is an abnormal object group that matches the target object group, it indicates that the account characteristics and transaction pattern characteristics of the target object group can match those of the abnormal object group, and the target object group may be an abnormal object group with abnormal social behavior; if there is no abnormal object group that matches the target object group, it is determined that the target object group is not an abnormal object group with abnormal social behavior.

[0174] For example, with the above Figure 8Corresponding to the implementation manner, for an abnormal object group, when the first matching sub-result and at least one second matching sub-result both indicate a successful match, it is determined that the target object group matches the abnormal object group, and the target object group can be determined to be an abnormal object group.

[0175] Below, an example is used to introduce the solution of the embodiment of the present application. In this example, a method based on object group features (i.e., the aforementioned social interaction features) and resource transfer flow features (i.e., the aforementioned resource transfer features of each social cycle) is adopted to perform hash coding and then coloring to black out abnormal social behavior patterns and subsequent detection. Fig.10 , which is another flow chart of the anomaly detection method provided in the embodiment of the present application. Specifically, the implementation of the method can be divided into the following three stages.

[0176] Step 1001: Real-time stage: In this stage, the corresponding feature hash value can be calculated for each suspicious relationship pair.

[0177] For details, see Fig.11 As shown, first, the resource transfer features of different social cycles are accumulated in real time and stored in the general feature library. Every time a resource transfer occurs or a suspicious behavior is triggered, a feature hash value of an object group can be calculated based on the object group features and the previously accumulated resource transfer features, and the feature hash value of the object group can be updated in real time to the general feature library.

[0178] Specifically, the process of step 1001 may include the following steps:

[0179] Step 10011: Save the resource transfer data involved in the object group to the feature library in real time. The feature library may be a common feature library, such as resource transfer flow data, etc., for subsequent feature calculation.

[0180] Step 10012: Taking the time when the object group adds friends as the time starting point, calculate the transaction characteristics of the object group in periods.

[0181] For example, you can calculate the payment flow of the target group by week, and count the transaction characteristics of the first four weeks after adding friends, and the next four weeks until now. For each period, you can record the following information:

[0182] (1) Transaction direction: A pays B, or B pays A.

[0183] (2) The amount and number of each transaction method (such as transfer, face-to-face payment, red envelope, etc.).

[0184] (3) Trading hours can be divided into hourly levels.

[0185] (4) Record the largest transaction amount and the number of transactions corresponding to that amount.

[0186] Step 10013: Whenever a transaction or other suspicious behavior occurs in an object group, the characteristic hash value of the object group will be calculated.

[0187] Specifically, the characteristic hash value is constructed as follows:

[0188] (1) Obtain the region, gender, age and other information of the account pair respectively, and perform feature hash coding on them respectively. Region and gender can be coded using one-hot coding, while age can be divided into intervals and coded using one-hot coding.

[0189] (2) Record the friend adding information of the account pair, including the friend adding direction. For example, 1 can indicate that social object A actively adds social object B, and 0 can indicate that social object B actively adds social object A. The friend adding method can be encoded using one-hot coding.

[0190] (3) For the features obtained in the second step above, the features of the transaction are recorded in each cycle. For the record of transaction direction, 1 can be used to indicate that social object A pays social object B, and 0 can be used to indicate that social object B pays social object A. For the records of various transaction methods and their respective amounts and times, the amounts and times can be bucketed and then encoded. For the records of transaction periods, the main transaction periods can be recorded, for example, in hours. For the records of the amount with the most transactions, the intervals can be divided into intervals to record the amount interval with the most transactions, and the number of transactions corresponding to the amount can be recorded at the same time. For some special amounts, such as 1314 or 520, the amount value can be directly used, and the number of transactions corresponding to the amount can be recorded at the same time.

[0191] Furthermore, through the above method, we can get Fig. 9 The feature hash values ​​for a group of objects shown.

[0192] Step 10014: store the feature hash value in a feature library, which may be a common feature library, for example.

[0193] Step 1002: dyeing stage, in which it includes Fig.10 The step 10021 shown is to color and mark the characteristic hash values ​​of the abnormal object group.

[0194] For example, after an abnormal social behavior case is identified through other online strategies or external feedback data, the feature hash value of the object group can be marked as abnormal, that is, the coloring mark mentioned above, and its feature hash value can be stored in the abnormal reference feature library. Alternatively, after an abnormal social behavior case is detected, the feature hash value obtained above can also be colored and marked.

[0195] Step 1003: Identification stage, in which abnormal social behaviors can be detected with the help of the abnormal reference feature library marked in the staining stage.

[0196] Specifically, the process of step 1003 may include the following steps:

[0197] Step 10031: Determine whether the feature hash value of the current object group is located in the abnormal reference feature library.

[0198] Step 10032: If the result of step 10031 is yes, that is, if it is an existing abnormal feature hash value, then the interaction process of the current object group can be intervened, for example, intervention will be made when a transaction occurs between the two parties.

[0199] Based on the same inventive concept, the present application also provides a method for intercepting abnormal resource transfer, see Fig.12 As shown, it is a flow chart of the method, and the method can also be executed by a computer device, which can be Figure 1 The server shown in the figure, the specific implementation process of the method is as follows:

[0200] Step 1201: The server receives a resource transfer request sent by a first social object, where the resource transfer request indicates initiating a resource transfer to a second social object.

[0201] In the embodiment of the present application, the resource transfer request may be a request initiated by any resource transfer method, such as transferring money, sending a red envelope, or collecting money face to face.

[0202] Step 1202: The server obtains a target social interaction feature and a target pattern feature of a target object group consisting of a first social object and a second social object; the target social interaction feature is determined based on historical social data between the first social object and the second social object, and the target pattern feature is determined based on historical resource transfer data corresponding to at least one social cycle starting from the moment when the social relationship between the first social object and the second social object is established, and the target pattern feature represents: changes in resource transfer patterns of the two social objects between different social cycles.

[0203] The server may obtain the target social interaction features and target pattern features of the target object group from the feature library, or calculate the target social interaction features and target pattern features of the target object group in real time based on relevant data. The target social interaction features and target pattern features here may also be feature hash values.

[0204] Step 1203: The server matches the social interaction features and resource transfer pattern features with a preset abnormal reference feature set to obtain a matching result; wherein the abnormal reference feature set includes: reference social interaction features and reference pattern features of at least one abnormal object group.

[0205] The process of steps 1202 and 1203 is the same as that of the above Figure 3 The corresponding parts in the illustrated embodiments are the same, so the aforementioned introduction can be briefly mentioned, and the embodiments of the present application will not be described in detail here.

[0206] Step 1204: When the matching result indicates a successful match, the server intercepts the resource transfer request.

[0207] Step 1205: The server sends abnormal prompt information to the first social object.

[0208] When the match with the abnormal object group is successful, it can be determined that the current target object group is an abnormal group. Then, in order to reduce the resource loss of the social object, the current resource transfer request can be intercepted, or rejected, so that the resource transfer fails, and an abnormal prompt message can be sent to the first social object to prompt it that it may be involved in abnormal social behavior. In order to avoid resource loss, the identity of the other party should be verified in time.

[0209] Below, Figure 2 The system framework shown in FIG. 1 is taken as an example to introduce the method in the embodiment of the present application. Fig.13 As shown, it is another flow chart of the abnormal resource transfer interception method provided in an embodiment of the present application.

[0210] Step 1301: The resource transfer system accumulates resource transfer data of each social cycle and sends it to the feature system.

[0211] Step 1302: The feature system extracts corresponding resource transfer features for each social cycle.

[0212] Step 1303: The feature system calculates the feature hash value of the resource transfer feature of each social cycle.

[0213] Step 1304: The feature system stores the obtained resource transfer feature and feature hash value in a common feature library.

[0214] Step 1305: After receiving an abnormal social behavior case, the policy system can obtain a feature hash value from a common feature library.

[0215] Step 1306: The policy system will obtain the feature hash value and color it black, and store it in the abnormal reference feature library for subsequent identification with the help of the abnormal reference feature library.

[0216] Step 1307: When the resource transfer system receives a resource transfer request, it will initiate a resource transfer risk control request to the policy system to confirm whether the resource transfer of the current object group is allowed.

[0217] Step 1308: The policy system may obtain a feature hash value of the current object group from a common feature library.

[0218] Step 1309: The policy system compares the acquired feature hash value with the feature hash value in the abnormal reference feature library to determine whether the feature hash value of the current object group is the same as or similar to the feature hash value of the abnormal object group, that is, whether it meets the characteristics of the abnormal object group. It can also be understood as whether the feature hash value of the current object group is marked black.

[0219] Step 1310: If the characteristic hash value of the current object group is marked black, the current resource transfer is not allowed, and the policy system indicates to the resource transfer system that resource transfer intervention is required, such as intercepting the current resource transfer request or prompting the social object that there is a resource transfer risk.

[0220] In summary, the embodiments of the present application can be applied to anomaly detection such as social payment, which has a long duration. Based on the original risk control, the embodiments of the present application can reflect the changes in the resource transfer pattern of the object group over time by dividing the long period into multiple small periods to calculate the resource transfer characteristics. It can characterize the changes in the abnormal behavior pattern over the time period and convert the abnormal behavior pattern of the object group into a feature hash value. The feature hash can be easily integrated with the existing risk control system. When a new abnormal behavior pattern is found, it can be quickly colored and marked black and used for subsequent real-time detection, which has a very obvious effect on this type of detection and intervention. The feature hash value has very good interpretability and optimizability. The explanation of the pattern can be given directly based on the feature hash value, and the coloring of the feature hash value is used to achieve the coloring of the entire abnormal behavior pattern, which has greater generalization than device or IP coloring.

[0221] See also Fig.14 Based on the same inventive concept, the embodiment of the present application further provides an abnormality detection device 140, which includes:

[0222] A feature extraction unit 1401 is used to extract a target social interaction feature of the target object group based on historical social data between two social objects included in the target object group;

[0223] The data obtaining unit 1402 is used to obtain, for two social objects, historical resource transfer data corresponding to at least one social cycle starting from the moment when the social relationship is established;

[0224] The feature extraction unit 1401 is further configured to extract target pattern features of the target object group according to the at least one historical resource transfer data obtained; the target pattern features represent: changes in the resource transfer patterns of the two social objects between different social cycles;

[0225] The feature matching unit 1403 is used to match the social interaction feature and the resource transfer mode feature with a preset abnormal reference feature set to obtain a matching result; wherein the abnormal reference feature set includes: a reference social interaction feature and a reference mode feature of at least one abnormal object group;

[0226] The detection unit 1404 is used to obtain an abnormality detection result for the target object group according to the matching result.

[0227] In a possible implementation, the abnormal reference feature set includes feature hash values ​​of the reference social interaction feature and the reference pattern feature; the feature matching unit 1403 is specifically configured to:

[0228] Performing feature hash encoding on the target social interaction feature and the target pattern feature respectively to obtain feature hash values ​​of the target social interaction feature and the target pattern feature;

[0229] The feature hash values ​​of the target social interaction feature and the target pattern feature are matched with the feature hash values ​​of each reference social interaction feature and each reference pattern feature in the abnormal reference feature set to obtain a matching result.

[0230] In a possible implementation, the historical social data includes object data of two social objects in at least one object information dimension, and mode indication data indicating the mode of establishing the social relationship between the two social objects; the feature extraction unit 1401 is specifically configured to:

[0231] For at least one information dimension, perform the following operations:

[0232] For one information dimension, according to the object data of two social objects in one object information dimension, object sub-features of the two social objects in one object information dimension are respectively extracted;

[0233] Extracting establishment mode features according to mode indication data;

[0234] A target social interaction feature is obtained according to the obtained at least one object sub-feature and the establishment mode feature.

[0235] In a possible implementation manner, each historical resource transfer data in the at least one historical resource transfer data includes resource transfer data of at least one resource transfer information dimension; then the feature extraction unit 1401 is specifically configured to:

[0236] For at least one historical resource transfer data, perform the following operations respectively:

[0237] According to resource transfer data of at least one resource transfer information dimension included in a historical resource transfer data, respectively obtaining resource transfer sub-features corresponding to at least one resource transfer information dimension;

[0238] Obtaining resource transfer features of corresponding social cycles according to the obtained at least one resource transfer sub-feature;

[0239] A target mode feature is obtained according to the obtained at least one resource transfer feature.

[0240] In a possible implementation, the feature extraction unit 1401 is specifically configured to:

[0241] Sorting at least one resource transfer feature according to the sequence of social cycles corresponding to each of the at least one resource transfer feature to obtain a resource transfer feature sequence, and determining the resource transfer feature sequence as a target pattern feature;

[0242] The feature matching unit 1403 is specifically configured to perform the following operations for each abnormal object group in the abnormal reference feature set:

[0243] For an abnormal object group, matching the target social interaction feature with a reference social interaction feature of the abnormal object group to obtain a first matching sub-result;

[0244] respectively performing position matching on at least one resource transfer feature and at least one resource transfer feature included in a reference pattern feature of an abnormal object group to obtain at least one second matching sub-result;

[0245] The detecting unit 1404 is specifically configured to determine that the target object group is an abnormal object group when the first matching sub-result and at least one second matching sub-result both indicate a successful match.

[0246] In a possible implementation, the data obtaining unit 1402 is specifically configured to:

[0247] For at least one social cycle, perform the following operations:

[0248] For a social cycle, record the resource transfer flow data between two social objects;

[0249] Extracting resource transfer data of two social objects in at least one resource transfer information dimension according to the resource transfer flow data;

[0250] According to the resource transfer data in at least one resource transfer information dimension, historical resource transfer data of a social cycle is obtained.

[0251] In a possible implementation manner, the at least one resource transfer information dimension includes at least one of the following dimensions:

[0252] Direction of resource transfer;

[0253] The resource transfer methods used when transferring resources, as well as the number of resource transfers and the number of resources for each resource transfer method;

[0254] Information about the time when the resource transfer occurs;

[0255] The maximum number of resources transferred in a social cycle and the number of resource transfers for the maximum number of resources;

[0256] The number of target resources with the most transfers in a social cycle and the number of resource transfers for the number of target resources.

[0257] In a possible implementation manner, the feature matching unit 1403 is specifically configured to:

[0258] When a resource transfer request is detected between two social objects, the social interaction feature and the resource transfer mode feature are matched with the abnormal reference feature set to obtain a matching result; or,

[0259] When a preset suspicious behavior is detected between two social objects, the social interaction features and resource transfer pattern features are matched with the abnormal reference feature set to obtain a matching result.

[0260] In a possible implementation, the device further includes a dyeing unit 1405, which is used to:

[0261] Obtaining abnormal case information, the abnormal case information indicating: at least one abnormal object group that has been confirmed to be abnormal;

[0262] An abnormal label is marked on the social interaction features and pattern features of at least one abnormal object group, and the social interaction features and pattern features of at least one abnormal object group are added to the abnormal reference feature library.

[0263] The device can be used to execute the methods shown in the various embodiments of the present application. Therefore, for the functions that can be implemented by the various functional modules of the device, reference can be made to the description of the aforementioned embodiments and no further details will be given.

[0264] See also Fig.15 Based on the same inventive concept, the embodiment of the present application further provides an abnormal resource transfer interception device 150, which includes:

[0265] The receiving unit 1501 is configured to receive a resource transfer request sent by a first social object, where the resource transfer request indicates initiating a resource transfer to a second social object;

[0266] The feature extraction unit 1502 is used to obtain a target social interaction feature and a target pattern feature of a target object group consisting of a first social object and a second social object; the target social interaction feature is determined based on historical social data between the first social object and the second social object, and the target pattern feature is determined based on historical resource transfer data corresponding to at least one social cycle starting from the moment when the social relationship between the first social object and the second social object is established, and the target pattern feature represents: changes in resource transfer patterns of the two social objects between different social cycles;

[0267] The feature matching unit 1503 is used to match the social interaction feature and the resource transfer pattern feature with a preset abnormal reference feature set to obtain a matching result; wherein the abnormal reference feature set includes: a reference social interaction feature and a reference pattern feature of at least one abnormal object group;

[0268] The request interception unit 1504 is used to intercept the resource transfer request when the matching result indicates a successful match;

[0269] The sending unit 1505 is configured to send abnormal prompt information to the first social object.

[0270] The device can be used to execute the methods shown in the various embodiments of the present application. Therefore, for the functions that can be implemented by the various functional modules of the device, reference can be made to the description of the aforementioned embodiments and no further details will be given.

[0271] See also Fig.16 Based on the same technical concept, the present application also provides a computer device. In one embodiment, the computer device can be Figure 1 The server shown or Figure 2 The device corresponding to the cloud shown in FIG. Fig.16 As shown, it includes a memory 1601 , a communication module 1603 and one or more processors 1602 .

[0272] The memory 1601 is used to store computer programs executed by the processor 1602. The memory 1601 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and programs required for running the instant messaging function, etc.; the data storage area may store various instant messaging information and operation instruction sets, etc.

[0273] The memory 1601 may be a volatile memory, such as a random-access memory (RAM); the memory 1601 may also be a non-volatile memory, such as a read-only memory, a flash memory, a hard disk drive (HDD) or a solid-state drive (SSD); or the memory 1601 may be any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto. The memory 1601 may be a combination of the above memories.

[0274] The processor 1602 may include one or more central processing units (CPU) or a digital processing unit, etc. The processor 1602 is used to implement the above-mentioned abnormality detection or abnormal resource transfer interception method when calling the computer program stored in the memory 1601.

[0275] The communication module 1603 is used to communicate with terminal devices and other servers.

[0276] The specific connection medium between the memory 1601, the communication module 1603 and the processor 1602 is not limited in the embodiment of the present application. Fig.16 In the embodiment, the memory 1601 and the processor 1602 are connected via a bus 1604. The bus 1604 is connected to the processor 1602 via a bus 1604. Fig.16 The connections between the other components are only for illustration and are not intended to be limiting. The bus 1604 can be divided into an address bus, a data bus, a control bus, etc. For ease of description, Fig.16 The diagram shows that only one thick line is used, but this does not mean that there is only one bus or only one type of bus.

[0277] The memory 1601 stores a computer storage medium, which stores computer executable instructions. The computer executable instructions are used to implement the anomaly detection or abnormal resource transfer interception method of the embodiments of the present application. The processor 1602 is used to execute the anomaly detection or abnormal resource transfer interception method of the above-mentioned embodiments.

[0278] Based on the same inventive concept, an embodiment of the present application also provides a storage medium, which stores a computer program. When the computer program runs on a computer, the computer executes the steps of the anomaly detection or abnormal resource transfer interception method described above in this specification according to various exemplary embodiments of the present application.

[0279] In some possible implementations, various aspects of the anomaly detection or abnormal resource transfer interception method provided in the present application can also be implemented in the form of a computer program product, which includes a computer program. When the program product is run on a computer device, the computer program is used to enable the computer device to execute the steps of the anomaly detection or abnormal resource transfer interception method according to various exemplary embodiments of the present application described above in this specification. For example, the computer device can execute the steps of each embodiment.

[0280] The program product may use any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above.

[0281] The program product of the embodiment of the present application may adopt a portable compact disk read-only memory (CD-ROM) and include a computer program, and can be run on a computer device. However, the program product of the present application is not limited thereto. In the present application, the readable storage medium may be any tangible medium containing or storing a program, and the computer program included therein may be used by or in combination with a command execution system, apparatus or device.

[0282] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable computer program is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the foregoing. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with a command execution system, apparatus, or device.

[0283] The computer program embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0284] Computer programs for performing the operations of the present application may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" language or similar programming languages.

[0285] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0286] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0287] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0288] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0289] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. An anomaly detection method, characterized in that: The method comprises: Extracting target social interaction features of the target object group according to historical social data between two social objects included in the target object group; For the two social objects, historical resource transfer data corresponding to at least one social cycle starting from the moment when the social relationship is established is obtained, and target pattern features of the target object group are extracted based on the at least one historical resource transfer data obtained; the target pattern features represent: changes in the resource transfer patterns of the two social objects between different social cycles; Matching the social interaction feature and the resource transfer pattern feature with a preset abnormal reference feature set to obtain a matching result; wherein the abnormal reference feature set includes: a reference social interaction feature and a reference pattern feature of at least one abnormal object group; According to the matching result, an abnormality detection result for the target object group is obtained.

2. The method according to claim 1, characterized in that The abnormal reference feature set includes feature hash values ​​of the reference social interaction feature and the reference pattern feature; Then, matching the social interaction feature and the resource transfer mode feature with a preset abnormal reference feature set to obtain a matching result includes: Performing feature hash coding on the target social interaction feature and the target mode feature respectively to obtain feature hash values ​​of the target social interaction feature and the target mode feature; The feature hash values ​​of each of the target social interaction feature and the target pattern feature are matched with the feature hash values ​​of each reference social interaction feature and each reference pattern feature in the abnormal reference feature set to obtain the matching result.

3. The method according to claim 1 or 2, characterized in that The historical social data includes object data of each of the two social objects in at least one object information dimension, and mode indication data indicating a mode of establishing a social relationship between the two social objects; Then, extracting the target social interaction feature of the target object group according to the historical social data between two social objects included in the target object group includes: For the at least one information dimension, perform the following operations respectively: For one information dimension, according to the object data of the two social objects in the one object information dimension, respectively extracting the object sub-features of the two social objects in the one object information dimension; extracting establishment mode features according to the mode indication data; The target social interaction feature is obtained according to the obtained at least one object sub-feature and the establishment mode feature.

4. The method according to claim 1 or 2, characterized in that: Each of the at least one historical resource transfer data includes resource transfer data of at least one resource transfer information dimension; Then, extracting the target pattern features of the target object group according to the obtained at least one historical resource transfer data includes: For the at least one historical resource transfer data, perform the following operations respectively: According to resource transfer data of at least one resource transfer information dimension included in one historical resource transfer data, respectively obtaining resource transfer sub-features corresponding to the at least one resource transfer information dimension; Obtaining resource transfer features of corresponding social cycles according to the obtained at least one resource transfer sub-feature; The target mode feature is obtained according to the obtained at least one resource transfer feature.

5. The method according to claim 4, characterized in that The step of obtaining the target mode feature according to the obtained at least one resource transfer feature comprises: Sorting the at least one resource transfer feature according to the sequence of social cycles corresponding to each of the at least one resource transfer features to obtain a resource transfer feature sequence, and determining the resource transfer feature sequence as the target pattern feature; Then, matching the social interaction feature and the resource transfer mode feature with a preset abnormal reference feature set to obtain a matching result includes: For each abnormal object group in the abnormal reference feature set, perform the following operations respectively: For an abnormal object group, matching the target social interaction feature with a reference social interaction feature of the abnormal object group to obtain a first matching sub-result; respectively performing position matching on the at least one resource transfer feature and the at least one resource transfer feature included in the reference pattern feature of the one abnormal object group to obtain at least one second matching sub-result; Then, according to the matching result, an abnormality detection result for the target object group is obtained, including: When the first matching sub-result and at least one second matching sub-result both indicate a successful match, the target object group is determined to be an abnormal object group.

6. The method according to claim 4, characterized in that For the two social objects, obtaining historical resource transfer data corresponding to at least one social cycle starting from the moment when the social relationship is established, including: For the at least one social cycle, the following operations are performed respectively: For a social cycle, record the resource transfer flow data between the two social objects; Extracting resource transfer data of the two social objects in the at least one resource transfer information dimension according to the resource transfer flow data; According to the resource transfer data in the at least one resource transfer information dimension, historical resource transfer data of the one social cycle is obtained.

7. The method according to claim 6, characterized in that The at least one resource transfer information dimension includes at least one of the following dimensions: Direction of resource transfer; The resource transfer methods used when transferring resources, as well as the number of resource transfers and the number of resources for each resource transfer method; Information about the time when the resource transfer occurs; The maximum number of resources among the number of resources transferred in one social cycle and the number of resource transfers of the maximum number of resources; The number of target resources with the largest number of transfers in the social cycle and the number of resource transfers of the target resources.

8. The method according to claim 1 or 2, characterized in that: The matching of the social interaction feature and the resource transfer mode feature with a preset abnormal reference feature set to obtain a matching result includes: When a resource transfer request is detected between the two social objects, the social interaction feature and the resource transfer mode feature are matched with the abnormal reference feature set to obtain a matching result; or, When a preset suspicious behavior is detected to be triggered between the two social objects, the social interaction feature and the resource transfer mode feature are matched with the abnormal reference feature set to obtain a matching result.

9. The method according to claim 1 or 2, characterized in that: The method further comprises: Obtaining abnormal case information, the abnormal case information indicating: at least one abnormal object group that has been confirmed to be abnormal; The social interaction features and pattern features of the at least one abnormal object group are respectively marked with abnormal labels, and the social interaction features and pattern features of the at least one abnormal object group are respectively added to the abnormal reference feature library.

10. A method for intercepting abnormal resource transfer, characterized in that: The method comprises: receiving a resource transfer request sent by a first social object, wherein the resource transfer request indicates initiating a resource transfer to a second social object; Obtaining a target social interaction feature and a target pattern feature of a target object group consisting of the first social object and the second social object; the target social interaction feature is determined based on historical social data between the first social object and the second social object, and the target pattern feature is determined based on historical resource transfer data corresponding to at least one social cycle starting from the moment when the social relationship between the first social object and the second social object is established, and the target pattern feature represents: changes in resource transfer patterns of the two social objects between different social cycles; Matching the social interaction feature and the resource transfer pattern feature with a preset abnormal reference feature set to obtain a matching result; wherein the abnormal reference feature set includes: a reference social interaction feature and a reference pattern feature of at least one abnormal object group; When the matching result indicates a successful match, the resource transfer request is intercepted, and an abnormal prompt message is sent to the first social object.

11. An abnormality detection device, characterized in that: The device comprises: a feature extraction unit, configured to extract a target social interaction feature of the target object group based on historical social data between two social objects included in the target object group; A data acquisition unit, configured to acquire, for the two social objects, historical resource transfer data corresponding to at least one social cycle starting from the moment when the social relationship is established; The feature extraction unit is further used to extract the target pattern feature of the target object group according to the obtained at least one historical resource transfer data; the target pattern feature represents: the change of the resource transfer pattern of the two social objects between different social cycles; A feature matching unit, configured to match the social interaction feature and the resource transfer mode feature with a preset abnormal reference feature set to obtain a matching result; wherein the abnormal reference feature set includes: a reference social interaction feature and a reference mode feature of at least one abnormal object group; A detection unit is used to obtain an abnormality detection result for the target object group based on the matching result.

12. An abnormal resource transfer interception device, characterized in that: The device comprises: A receiving unit, configured to receive a resource transfer request sent by a first social object, wherein the resource transfer request indicates initiating a resource transfer to a second social object; a feature extraction unit, configured to obtain a target social interaction feature and a target pattern feature of a target object group consisting of the first social object and the second social object; the target social interaction feature is determined based on historical social data between the first social object and the second social object, the target pattern feature is determined based on historical resource transfer data corresponding to at least one social cycle starting from the moment when the social relationship between the first social object and the second social object is established, and the target pattern feature represents: changes in resource transfer patterns of the two social objects between different social cycles; A feature matching unit, configured to match the social interaction feature and the resource transfer mode feature with a preset abnormal reference feature set to obtain a matching result; wherein the abnormal reference feature set includes: a reference social interaction feature and a reference mode feature of at least one abnormal object group; a request interception unit, configured to intercept the resource transfer request when the matching result indicates a successful match; A sending unit is used to send abnormal prompt information to the first social object.

13. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 9 or 10 are implemented.

14. A computer storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 9 or 10 are implemented.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 9 or 10 are implemented.

Images