Risk transaction identification method, device and equipment, storage medium and program product

Abstract

The invention provides a risk transaction identification method and device, equipment, a storage medium and a program product, which can be applied to the technical fields of financial science and technology and data security. The method comprises the following steps: under the condition that user authorization is obtained, respectively obtaining respective information sets of a plurality of transaction devices in a distributed cluster; generating a joint transaction network diagram according to the respective information sets of the plurality of transaction devices; according to respective risk scores of a plurality of nodes in the joint transaction network diagram, a target node is screened from the joint transaction network diagram, and the risk scores are determined based on edge weights of edges with the nodes as vertexes; and according to a predetermined evaluation index, carrying out statistics on a transaction information set of a target user corresponding to the target node, and determining evaluation information matched with the evaluation index, so that the transaction equipment in the distributed cluster carries out risk identification on the transaction processed by the transaction equipment based on the evaluation information.

Description

Technical Field

[0001] The present application relates to the fields of financial technology and data security technology, and specifically to a method, apparatus, equipment, medium and program product for identifying risky transactions. Background Art

[0002] Identifying financial transaction risks is fundamental to ensuring the sound operation of financial activities. Its accuracy is directly related to the security and efficiency of capital flows. Effective risk identification is the core support for maintaining financial market order and strengthening risk prevention.

[0003] When identifying financial transaction risks, relevant technologies primarily employ detection methods based on rule engines. Traditional rule engines screen for risks using preset static thresholds (such as upper limits on single transaction amounts and transaction frequency limits). While this detection method is simple to implement, it is prone to false positives and false negatives, resulting in low recognition accuracy. Summary of the Invention

[0004] In view of the above problems, the present application provides a method, apparatus, device, medium and program product for identifying risky transactions.

[0005] According to the first aspect of the present application, a method for identifying risky transactions is provided, comprising: with user authorization, respectively obtaining information sets of multiple transaction devices in a distributed cluster, wherein the information sets include multiple transaction information in the transaction devices; generating a joint transaction network graph based on the information sets of the multiple transaction devices, wherein the joint transaction network graph includes multiple nodes, multiple edges for connecting the multiple nodes, and edge weights of the multiple edges, the nodes represent users, the edges represent transactions between users corresponding to the two nodes connected by the edges, and the edge weights are determined based on the transaction information between the users corresponding to the two nodes connected by the edges; screening a target node from the joint transaction network graph based on the risk scores of the multiple nodes in the joint transaction network graph, wherein the risk score is determined based on the edge weight of the edge with the node as the vertex; and statistically analyzing the transaction information set of the target user corresponding to the target node based on predetermined evaluation indicators to determine evaluation information that matches the evaluation indicators, so that the transaction devices in the distributed cluster can perform risk identification on transactions processed by the transaction devices based on the evaluation information.

[0006] According to an embodiment of the present application, a joint transaction network diagram is generated based on the respective information sets of multiple transaction devices, including: removing the same users in the respective information sets of the multiple transaction devices to obtain nodes representing the users; connecting edges between the two nodes when it is determined based on multiple information sets that there is a transaction between two users corresponding to the two nodes; determining the edge weight of the edge between the two nodes based on the transaction information of the transaction between the two users corresponding to the two nodes; and generating a joint transaction network diagram based on multiple nodes, the edges between the multiple nodes, and the edge weights of the edges.

[0007] According to an embodiment of the present application, the risky transaction identification method also includes: for each node in the joint transaction network graph, determining at least one edge with the node as an endpoint; and determining the risk score of the node based on the respective weights of at least one edge and the number of at least one edge.

[0008] According to an embodiment of the present application, based on the risk scores of each of the multiple nodes in the joint transaction network graph, a target node is screened from the joint transaction network graph, including: arranging the multiple nodes in order of risk scores to obtain a node sequence; repeating the following operations until the node sequence is an empty set, and determining multiple target nodes: taking the first node in the node sequence as the target node, and deleting the target node from the node sequence; according to the joint transaction network graph, deleting at least one node that has a connection relationship with the target node from the node sequence.

[0009] According to an embodiment of the present application, statistics are performed on the transaction information set of the target user corresponding to the target node according to predetermined evaluation indicators, and evaluation information matching the evaluation indicators is determined, including: classifying multiple transaction information in the target transaction set according to the users participating in the transaction, so that the target transaction subsets of multiple users respectively include transaction information of at least one transaction in which the users participated; and statistics are performed on multiple target transaction subsets respectively according to the evaluation indicators to determine the evaluation information of the transactions in which the users participated.

[0010] According to an embodiment of the present application, the information set includes masked transaction information; the transaction information in the information set is masked in the following manner: using a transaction device to mask information related to the user identity in the transaction information.

[0011] According to an embodiment of the present application, the risk transaction identification method also includes: judging the transaction information in multiple information sets based on the evaluation information, determining the target transaction device to which the target user belongs; and sending the evaluation information to the target transaction device so that the target transaction device can identify the risks of the transactions processed by the target transaction device based on the evaluation information.

[0012] The second aspect of the present application provides a risk transaction identification device, including: an information acquisition module, which is used to obtain the information sets of each of multiple transaction devices in a distributed cluster with user authorization, wherein the information sets include multiple transaction information in the transaction devices; a network diagram generation module, which is used to generate a joint transaction network diagram based on the information sets of each of the multiple transaction devices, wherein the joint transaction network diagram includes multiple nodes, multiple edges for connecting the multiple nodes, and edge weights of the multiple edges, the nodes represent users, the edges represent the existence of transactions between the users corresponding to the two nodes connected by the edges, and the edge weights are determined based on the transaction information between the users corresponding to the two nodes connected by the edges; a node screening module, which is used to screen the target node from the joint transaction network diagram based on the risk scores of each of the multiple nodes in the joint transaction network diagram, and the risk score is determined based on the edge weight of the edge with the node as the vertex; and an information statistics module, which is used to count the transaction information set of the target user corresponding to the target node according to a predetermined evaluation index, and determine evaluation information that matches the evaluation index, so that the transaction devices in the distributed cluster can perform risk identification on the transactions processed by the transaction devices based on the evaluation information.

[0013] The third aspect of the present application provides an electronic device, comprising: one or more processors; a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0014] The fourth aspect of the present application further provides a computer-readable storage medium having a computer program or instructions stored thereon, which implements the steps of the above method when the computer program or instructions are executed by a processor.

[0015] The fifth aspect of the present application further provides a computer program product, comprising a computer program or instructions, which implement the steps of the above method when executed by a processor.

[0016] According to the embodiments of the present application, by constructing a joint transaction network graph, the transaction data stored in a distributed network can be integrated into a unified network structure. The characteristics of nodes representing users, edges representing transaction relationships, and edge weights quantifying transaction information are used to achieve global modeling of complex transaction networks. Based on the network topology and transaction weights to calculate risk scores, the transaction characteristics of all transactions in which users corresponding to the nodes participate can be analyzed, thereby effectively identifying potential target nodes. Targeted statistical analysis is then performed in combination with predetermined evaluation indicators, enabling distributed transaction devices to accurately identify risks based on network-level risk assessment results. This allows transaction nodes without target users to also detect information in the transaction node based on the characteristics of the target node in the entire distributed network, thereby improving the efficiency and accuracy of risk identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The above contents and other objects, features and advantages of the present application will become more apparent through the following description of the embodiments of the present application with reference to the accompanying drawings, in which:

[0018] Figure 1 A diagram schematically illustrates an application scenario of the risky transaction identification method, apparatus, device, storage medium, and program product according to an embodiment of the present application;

[0019] Figure 2 The following schematically shows a flow chart of a method for identifying risky transactions according to an embodiment of the present application;

[0020] Figure 3 Schematically shows a joint transaction network diagram established according to the risk transaction identification method of an embodiment of the present application;

[0021] Figure 4 A flowchart schematically illustrates the method for identifying risky transactions according to an embodiment of the present application for determining a target node based on a node sequence;

[0022] Figure 5 A schematic diagram of a structure of a risky transaction identification device according to an embodiment of the present application is shown; and

[0023] Figure 6 A block diagram of an electronic device suitable for implementing a risky transaction identification method according to an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0024] Hereinafter, embodiments of the present application will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present application. In the detailed description below, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present application. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessarily confusing the concepts of the present application.

[0025] The terms used herein are only for describing specific embodiments and are not intended to limit this application. The terms "comprise," "include," etc. used herein indicate the presence of the features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0026] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0027] When expressions such as "at least one of A, B, and C, etc." are used, they should generally be interpreted in accordance with the meaning commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0028] In the technical solution of this application, the user information involved (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0029] In recent years, machine learning-based risk identification methods have gradually gained application, such as building classification models by analyzing user transaction behavior characteristics or using graph neural networks to detect anomalous transaction networks. However, these methods still have shortcomings in distributed trading scenarios. On the one hand, local data from a single device cannot fully reflect the associated risks across institutions and platforms. On the other hand, existing graph analysis methods generally rely on centralized data processing, which cannot effectively balance data privacy protection and global risk identification.

[0030] An embodiment of the present application provides a method for identifying risky transactions, including: with user authorization, respectively obtaining information sets of multiple transaction devices in a distributed cluster, wherein the information sets include multiple transaction information in the transaction devices; generating a joint transaction network graph based on the information sets of the multiple transaction devices, wherein the joint transaction network graph includes multiple nodes, multiple edges for connecting the multiple nodes, and edge weights of the multiple edges, the nodes represent users, the edges represent transactions between users corresponding to the two nodes connected by the edges, and the edge weights are determined based on the transaction information between the users corresponding to the two nodes connected by the edges; based on the risk scores of the multiple nodes in the joint transaction network graph, filtering out a target node from the joint transaction network graph, wherein the risk score is determined based on the edge weight of the edge with the node as the vertex; and based on predetermined evaluation indicators, statistically analyzing the transaction information set of the target user corresponding to the target node to determine evaluation information that matches the evaluation indicator, so that the transaction devices in the distributed cluster can perform risk identification on transactions processed by the transaction devices based on the evaluation information.

[0031] Figure 1The application scenario diagram of the risk transaction identification method, device, equipment, storage medium and program product according to the embodiment of the present application is schematically shown.

[0032] like Figure 1 As shown, the application scenario 100 according to this embodiment may include a first transaction device 101, a second transaction device 102, a third transaction device 103, a fourth transaction device 104, a fifth transaction device 105, a sixth transaction device 106, a central device 107, and a network 108. The network 108 is a medium for providing communication links between the first transaction device 101, the second transaction device 102, the third transaction device 103, the fourth transaction device 104, the fifth transaction device 105, the sixth transaction device 106, and the central device 107. The network 108 may include various connection types, such as wired or wireless communication links or fiber optic cables.

[0033] The first transaction device 101, the second transaction device 102, the third transaction device 103, the fourth transaction device 104, the fifth transaction device 105, and the sixth transaction device 106 are respectively set up in different transaction centers to manage user information of the transaction center and transaction information participated in by users managed by the transaction center.

[0034] The first transaction device 101, the second transaction device 102, the third transaction device 103, the fourth transaction device 104, the fifth transaction device 105, and the sixth transaction device 106 can be devices that can perform data desensitization, such as masking operations. After the first transaction device 101, the second transaction device 102, the third transaction device 103, the fourth transaction device 104, the fifth transaction device 105, and the sixth transaction device 106 mask the data related to user information in the transaction information they manage, they send the information to the central device 107 through the network 108.

[0035] The central device 107 can be a server for data topology construction and data calculation. For example, based on the data that has completed data desensitization and sent by the first transaction device 101, the second transaction device 102, the third transaction device 103, the fourth transaction device 104, the fifth transaction device 105, and the sixth transaction device 106, a joint transaction network diagram for calculating risk scores is constructed, and the target node and the evaluation indicators of the target node are determined based on the risk scores of the nodes in the joint transaction network diagram.

[0036] The first transaction device 101 , the second transaction device 102 , the third transaction device 103 , the fourth transaction device 104 , the fifth transaction device 105 , and the sixth transaction device 106 can also identify risks of the transaction information they manage based on the evaluation indicators issued by the central device 107 to determine risky transactions.

[0037] It should be noted that the risk transaction identification method provided in the embodiment of the present application can generally be executed by the central device 107. Accordingly, the risk transaction identification device provided in the embodiment of the present application can generally be set in the central device 107. The risk transaction identification method provided in the embodiment of the present application can also be executed by a device that is different from the central device 107 and can communicate with the first transaction device 101, the second transaction device 102, the third transaction device 103, the fourth transaction device 104, the fifth transaction device 105, the sixth transaction device 106 and / or the central device 107. Accordingly, the risk transaction identification device provided in the embodiment of the present application can also be set in a device that is different from the central device 107 and can communicate with the first transaction device 101, the second transaction device 102, the third transaction device 103, the fourth transaction device 104, the fifth transaction device 105, the sixth transaction device 106 and / or the central device 107.

[0038] It should be understood that Figure 1 The number of transaction devices, central devices and networks in the embodiment is merely illustrative. Any number of transaction devices, central devices and networks may be provided as required.

[0039] The following will be based on Figure 1 The scene described by Figures 2 to 4 A method for identifying risky transactions according to an embodiment of the present application is described in detail.

[0040] Figure 2 The flowchart of the risk transaction identification method according to an embodiment of the present application is schematically shown.

[0041] like Figure 2 As shown, the risky transaction identification method of this embodiment includes operations S210 to S240, and the transaction processing method can be executed by a central device of a distributed cluster.

[0042] In operation S210 , after obtaining user authorization, respective information sets of a plurality of transaction devices in a distributed cluster are obtained.

[0043] In operation S220 , a joint transaction network diagram is generated based on the respective information sets of the plurality of transaction devices.

[0044] In operation S230 , a target node is screened from the joint transaction network graph according to the risk scores of the plurality of nodes in the joint transaction network graph.

[0045] In operation S240, based on predetermined evaluation indicators, the transaction information set of the target user corresponding to the target node is counted to determine evaluation information that matches the evaluation indicators, so that the transaction devices in the distributed cluster can identify risks of transactions processed by the transaction devices based on the evaluation information.

[0046] According to an embodiment of the present application, a distributed cluster includes one or more central devices and multiple transaction devices. Each transaction device can be deployed in a transaction center and is used to record transaction information of transactions occurring in the transaction center. An information set includes multiple transaction information recorded by the transaction device, including the users participating in the transaction and the transaction resource value of the transaction.

[0047] According to an embodiment of the present application, a central device may be used to send information upload instructions to multiple transaction devices respectively, so that after receiving the information upload instructions, the multiple transaction devices send the information set of the transaction device to the central device.

[0048] According to an embodiment of the present application, a joint transaction network graph includes multiple nodes, multiple edges for connecting the multiple nodes, and edge weights of the multiple edges, wherein the nodes represent users, the edges represent transactions between the users corresponding to the two nodes connected by the edges, and the edge weights are determined based on the transaction information between the users corresponding to the two nodes connected by the edges.

[0049] According to an embodiment of the present application, the information sets of multiple transaction devices are aggregated, and a joint transaction network diagram can be generated based on the aggregated multiple transaction information. Based on the multiple transaction information, the users participating in the multiple transactions can be identified, and the nodes corresponding to the multiple users can be determined. After the multiple nodes are determined, the nodes corresponding to two users involved in the transaction can be connected with an edge based on the multiple transaction information, and the edge weight of the edge can be determined based on the transaction information of all transactions between the two users.

[0050] According to embodiments of the present application, since all edges and edge weights centered around a node represent all transactions involving the user associated with that node, a node's risk score can be determined based on the edge weights of the edges centered around that node. The risk score is used to assess the probability that the user associated with that node is engaging in risky transactions.

[0051] According to an embodiment of the present application, based on the risk scores of the multiple nodes in the joint transaction network graph, at least one node with a higher risk score can be selected from the multiple nodes and used as the target node.

[0052] According to an embodiment of the present application, the transaction information in which the target user corresponding to the target node participates is counted to obtain a transaction information set, and the transaction information set is counted according to predetermined evaluation indicators to obtain evaluation information matching the evaluation indicators, wherein the predetermined evaluation indicators may include one or more fields in the transaction information, such as transaction frequency, transaction accumulated resource value, whether the transaction involves different transaction devices, etc.

[0053] According to embodiments of the present application, the assessment information can be used to evaluate nodes corresponding to other users to determine whether the user has engaged in risky transactions. Once the assessment information is determined, it can be sent to a transaction device in the distributed cluster. The transaction device can then use the assessment information to identify risks in transactions processed by the transaction device and users managed by the transaction device, thereby determining whether a transaction is risky or whether the user has engaged in risky transactions.

[0054] According to the embodiments of the present application, by constructing a joint transaction network graph, the transaction data stored in a distributed network can be integrated into a unified network structure. The characteristics of nodes representing users, edges representing transaction relationships, and edge weights quantifying transaction information are used to achieve global modeling of complex transaction networks. Based on the network topology and transaction weights to calculate risk scores, the transaction characteristics of all transactions in which users corresponding to the nodes participate can be analyzed, thereby effectively identifying potential target nodes. Targeted statistical analysis is then performed in combination with predetermined evaluation indicators, enabling distributed transaction devices to accurately identify risks based on network-level risk assessment results. This allows transaction nodes without target users to also detect information in the transaction node based on the characteristics of the target node in the entire distributed network, thereby improving the efficiency and accuracy of risk identification.

[0055] According to an embodiment of the present application, the information set includes masked transaction information; the transaction information in the information set is masked in the following manner: using a transaction device to mask information related to the user identity in the transaction information.

[0056] According to an embodiment of the present application, multiple transaction devices use the same masking logic to mask information related to user identity, so as to ensure that after multiple transaction devices mask the user identity information of the same user, the user identifications obtained are the same.

[0057] According to the embodiments of the present application, the information related to the user identity is masked locally using the transaction device, so that sensitive information can be desensitized during the data collection stage, which not only meets the privacy protection requirements but also does not affect the construction of the joint transaction network diagram and the accuracy of risk analysis.

[0058] According to an embodiment of the present application, a joint transaction network diagram is generated based on the respective information sets of multiple transaction devices, including: removing the same users in the respective information sets of the multiple transaction devices to obtain nodes representing the users; connecting edges between the two nodes when it is determined based on multiple information sets that there is a transaction between two users corresponding to the two nodes; determining the edge weight of the edge between the two nodes based on the transaction information of the transaction between the two users corresponding to the two nodes; and generating a joint transaction network diagram based on multiple nodes, the edges between the multiple nodes, and the edge weights of the edges.

[0059] According to the embodiments of the present application, since each transaction device belongs to a different transaction center, each user belongs to only one transaction center. Users in different transaction centers can conduct transactions and obtain transaction information. Therefore, the transaction information stored and managed by the transaction device may include users who do not belong to the transaction center. Furthermore, the same user can have multiple transactions, and the transaction information for each transaction will store the user who participated in that transaction. These situations may result in duplicate counting of the same user when extracting users from the transaction information stored by multiple transaction devices.

[0060] For example, if user a belongs to trading center A and user b belongs to trading center B, and user a initiates a transaction with user b, the transaction information for this transaction can be stored in the trading devices of both trading center A and trading center B, or it can be stored only in the trading device of the trading center mentioned by the user who initiated the transaction, that is, the trading device of trading center A. In this case, the transaction information of this transaction will include both parties involved in the transaction, namely user a and user b. Therefore, the transaction information stored in the trading device of trading center A includes user b, who does not belong to trading center A.

[0061] According to an embodiment of the present application, in order to avoid multiple statistics on the same user, which results in multiple nodes representing the same user appearing in the joint transaction network diagram, the same user can be removed from the information sets of multiple transaction devices, and then the users can be mapped into nodes to obtain multiple nodes representing the users.

[0062] According to an embodiment of the present application, for each pair of nodes, based on transaction information in multiple information sets, it is determined whether there is a transaction between the users corresponding to the two nodes. If no transaction exists, then there is no edge between the two nodes. If a transaction exists, the two nodes are connected using an edge, and all transactions that have occurred between the users corresponding to the two nodes are determined from the transaction information in the multiple information sets. Based on the transaction information of all transactions that have occurred between the users corresponding to the two nodes, the edge weight of the edge between the two nodes is determined.

[0063] Specifically, the edge weight between node u and node v can be calculated using formula (1):

[0064] (1)

[0065] Among them, α, β, and γ are hyperparameters, and α+β+γ=1. Amt uv represents the cumulative transaction resource value between the users corresponding to node u and node v, that is, the sum of the transaction resource values ​​of all transactions between the users corresponding to node u and node v, f uvIndicates the transaction frequency between users corresponding to node u and node v, cross uv It is a Boolean value that can be used to indicate whether the transaction between the users corresponding to node u and node v is cross-transaction center, that is, whether the transaction involves different transaction devices. If the transaction does not involve different transaction devices, cross uv Can be 0. In the case of transactions involving different trading devices, cross uv You can choose 1.

[0066] According to an embodiment of the present application, after the above-mentioned method is used to judge and calculate between each two nodes, a joint transaction network graph can be determined based on multiple nodes, edges between multiple nodes, and the edge weights of each edge.

[0067] According to the embodiments of this application, deduplication ensures the uniqueness of user nodes and dynamically constructs network edges based on actual transaction relationships, ensuring that the network diagram accurately reflects the actual transaction topology. The design of dynamically calculating edge weights based on transaction information allows key risk factors such as transaction frequency and amount to be quantified as network features, providing a computable network topology foundation for subsequent risk scoring, overcoming the drawback of static rules that are unable to adapt to dynamic transaction patterns.

[0068] Figure 3 The diagram schematically shows a joint transaction network diagram established according to the risky transaction identification method according to an embodiment of the present application.

[0069] like Figure 3 As shown, the joint transaction network diagram involves three transaction devices, namely transaction device 310, transaction device 320 and transaction device 330, wherein transaction device 310 stores information of three users and transaction information of each user, transaction device 320 stores information of four users and transaction information of each user, and transaction device 330 stores information of three users and transaction information of each user.

[0070] Each transaction device masks the information related to user identity in the transaction information it stores and manages, and sends the masked transaction information to the central device. The central device parses the transaction information, determines the user identification of the users participating in the transaction, deduplicates the user representation, and determines the node representing the user.

[0071] In this embodiment, parsing the transaction information sent by transaction device 310 identifies six users: users corresponding to nodes 311, 312, 313, 321, 323, and 331. Parsing the transaction information sent by transaction device 330 identifies five users: users corresponding to nodes 313, 324, 331, 332, and 333. During deduplication, users corresponding to nodes 313 and 331 are deduplicated. The same parsing and subsequent deduplication process is performed on transaction device 320, and nodes are then determined based on the deduplicated users.

[0072] Based on the transaction information of the three transaction information, it is determined whether there is a transaction between the users corresponding to each two nodes. Based on whether there is a transaction, it is determined whether to use an edge to connect the nodes. For example, if there is a transaction between the users corresponding to nodes 312 and 323, but there is no transaction between the users corresponding to nodes 311 and 323, then there is an edge between nodes 312 and 323, but there is no edge between nodes 311 and 323.

[0073] When determining the edge weight, take the edge between node 312 and node 323 as an example. From the transaction information, we determine the transactions in which the users corresponding to nodes 312 and 323 participated. There are three transaction information in total. Therefore, the transaction frequency between the above users is three times. The sum of the resource values ​​corresponding to the three transaction information, that is, the cumulative transaction resource value, is 2000. The transactions between nodes 312 and 323 involve different transaction devices. Therefore, according to formula (1), the edge weight of the edge between nodes 312 and 323 can be calculated as αlog2001+4β+γ. The edge weights of other edges in the figure are calculated in the same way and are not shown in the figure.

[0074] According to an embodiment of the present application, the risky transaction identification method also includes: for each node in the joint transaction network graph, determining at least one edge with the node as an endpoint; and determining the risk score of the node based on the respective weights of at least one edge and the number of at least one edge.

[0075] According to an embodiment of the present application, for each node in the joint transaction network graph, all edges in the graph structure with the node as an endpoint are determined, and the weight of each edge and the number of edges with the node as an endpoint are determined. Taking node v as an example, the risk score R(v) of node v can be calculated using formula (2):

[0076] (2)

[0077] Among them, there are n edges with node v as the endpoint in the joint transaction network graph. represents the i-th edge with node i as the endpoint, Represents an edge The edge weight of .

[0078] According to an embodiment of the present application, based on the weights of the edges with nodes as endpoints and the number of edges, the average edge weight of transactions between the user corresponding to each node and multiple other users can be comprehensively determined, and the average edge weight is used as the risk score of the node, thereby accurately representing the average characteristics of transactions in which the user participates, so that the target node can be accurately screened according to the risk score.

[0079] According to an embodiment of the present application, based on the risk scores of multiple nodes in the joint transaction network graph, a target node is screened from the joint transaction network graph, including: arranging the multiple nodes in order of risk scores to obtain a node sequence, and then sequentially selecting one or more nodes from the node sequence as the target node.

[0080] According to the embodiments of the present application, users who conduct sensitive transactions or risky transactions usually do not conduct transactions directly with each other, so as to avoid the detection of more similar accounts by further checking the associated transaction users after a risky transaction user is detected and identified.

[0081] In one embodiment, in view of the above characteristics, after obtaining the node sequence, the following operations can be repeated until the node sequence is an empty set to determine multiple target nodes: the first node in the node sequence is used as the target node, and the target node is deleted from the node sequence; according to the joint transaction network diagram, at least one node that has a connection relationship with the target node is deleted from the node sequence.

[0082] According to an embodiment of the present application, the first node in the node sequence is used as the target node, and the node with the highest risk score in the current node sequence can be selected as the target node. Deleting the target node from the node sequence can avoid the situation in which the node is selected again in the subsequent processing process, which affects the result of selecting the target node.

[0083] According to embodiments of the present application, since users engaging in sensitive or risky transactions typically do not directly transact with each other, nodes connected to the target node will not be selected as target nodes and can be removed from the node sequence to avoid being selected as target nodes due to their high risk scores. Specifically, based on the joint transaction network graph, nodes connected to the target node can be identified and removed from the node sequence.

[0084] According to an embodiment of the present application, after performing the above operations, it is determined whether there are any remaining nodes in the node sequence. If so, the above operations are continued until the node sequence is an empty set. When the node sequence is an empty set, the at least one target node obtained in the above operations can be determined as the target node in the joint transaction network graph.

[0085] According to the embodiments of the present application, through iterative node screening, nodes with high risk scores are preferentially selected, and the node and the nodes associated with it are deleted, which not only ensures the priority identification of the target user, but also avoids repeated detection of associated users. While ensuring the detection coverage, the computational redundancy is significantly reduced, and the efficiency of the target node determination process is improved.

[0086] Figure 4 A flowchart of determining a target node according to a node sequence using the risk transaction identification method according to an embodiment of the present application is schematically shown.

[0087] like Figure 4 As shown, calculate according to formula (2) Figure 3 The risk scores of multiple nodes in the , and multiple nodes are arranged in descending order according to the risk scores to obtain a node sequence, that is, Figure 4 The state at the moment (1).

[0088] In the first iteration, the first node, node 323, is selected from the node sequence, determined as the target node, and deleted from the node sequence. The nodes connected to node 323 (node ​​312, node 313, and node 322) are then determined based on the joint transaction network graph and deleted from the node sequence, resulting in the state at time (2).

[0089] After the first iteration, there are still nodes in the node sequence, so the second iteration continues, identifying node 311 as the target node and deleting it from the node sequence. The nodes connected to node 311 (nodes 321 and 312; since node 312 is no longer in the node sequence, no operation is required) are then determined based on the joint transaction network graph and deleted from the node sequence, resulting in the state at time (3).

[0090] After the second iteration, there are still nodes in the node sequence, so the third iteration is continued, node 332 is determined as the target node, and it is deleted from the node sequence. Then, based on the joint transaction network graph, the nodes connected to node 332 (node ​​333, node 324) are determined and deleted from the node sequence as well, resulting in the state at time (4).

[0091] After the third iteration, there are still nodes in the node sequence, so the fourth iteration is continued, node 331 is determined as the target node, and it is deleted from the node sequence. Then, according to the joint transaction network graph, the nodes connected to node 331 (nodes 313 and 324, since these nodes are no longer in the node sequence, no operation is required) are determined, and the state at time (5) is obtained.

[0092] After the fourth iteration, the node sequence is an empty set, so the iteration can be ended, and the target node determined in the above iteration process is determined as the target node in the joint transaction network graph.

[0093] According to an embodiment of the present application, statistics are performed on the transaction information set of the target user corresponding to the target node according to predetermined evaluation indicators, and evaluation information matching the evaluation indicators is determined, including: classifying multiple transaction information in the target transaction set according to the users participating in the transaction, so that the target transaction subsets of multiple users respectively include transaction information of at least one transaction in which the users participated; and statistics are performed on multiple target transaction subsets respectively according to the evaluation indicators to determine the evaluation information of the transactions in which the users participated.

[0094] According to an embodiment of the present application, the multiple transaction information in the target transaction set is categorized according to the users participating in the transactions, resulting in multiple target transaction subsets. For example, taking the node corresponding to user a as the target node, the target transaction set is comprised of the transaction information for all transactions in which user a participated. The transaction information in the target transaction set is categorized based on the users participating in the transactions. Since all of the aforementioned transactions involved user a, categorization only needs to be based on the other party involved in the transactions. Each target transaction subset includes transaction information for transactions between a user and user a. For example, all transaction information for transactions between user b and user a constitutes one target transaction subset, while all transaction information for transactions between user c and user a constitutes another target transaction subset.

[0095] According to the embodiments of the present application, statistics are collected for multiple target transaction subsets based on evaluation indicators, and evaluation information such as the transaction frequency, accumulated transaction resource value, and whether transactions involve different transaction devices can be determined for each transaction between user A and different users. By aggregating the evaluation information for user A's transactions with different users, evaluation information matching the evaluation indicators can be obtained.

[0096] According to the embodiments of the present application, through the classification and statistics of transaction information in the user dimension, the risk score in the graph structure is mapped back to the analysis of the user's transaction behavior and transaction information, so that the evaluation indicators can be accurately matched with the transaction characteristics of the user corresponding to the target node, thereby improving the accuracy of risk transaction identification.

[0097] According to an embodiment of the present application, the risk transaction identification method also includes: judging the transaction information in multiple information sets based on the evaluation information, determining the target transaction device to which the target user belongs; and sending the evaluation information to the target transaction device so that the target transaction device can identify the risks of the transactions processed by the target transaction device based on the evaluation information.

[0098] For the transaction device or transaction center to which the target user belongs, there may be other transactions or users involving risks. Therefore, priority risk identification can be carried out on the transaction device to which the target user belongs in a targeted manner.

[0099] According to embodiments of the present application, based on the evaluation information, the target transaction device to which the target user belongs can be determined from the transaction information in multiple information sets. After the evaluation information is sent to the target transaction device, the target transaction device can then use the evaluation information to identify risks in transactions it processes and transactions involving users it manages, thereby quickly determining whether the target transaction device has other risky transactions or users involved in risky transactions.

[0100] According to the embodiments of the present application, through the targeted feedback mechanism of risk assessment results, the risk information obtained from the global analysis is accurately pushed to the relevant trading devices, which can realize the collaborative sharing of assessment information by taking advantage of the distributed architecture and effectively enhance the cross-institutional joint prevention and control capabilities.

[0101] Based on the above-mentioned risky transaction identification method, this application also provides a risky transaction identification device. Figure 5 The device is described in detail.

[0102] Figure 5 The following schematically shows a structural block diagram of a risky transaction identification device according to an embodiment of the present application.

[0103] like Figure 5 As shown, the risky transaction identification device 500 of this embodiment includes an information acquisition module 510 , a network diagram generation module 520 , a node screening module 530 and an information statistics module 540 .

[0104] Information acquisition module 510 is configured to obtain, upon user authorization, information sets from each of multiple transaction devices in the distributed cluster, where the information sets include multiple pieces of transaction information from the transaction devices. In one embodiment, information acquisition module 510 may be configured to perform operation S210 described above, which will not be further described here.

[0105] The network graph generation module 520 is configured to generate a joint transaction network graph based on the respective information sets of the multiple transaction devices. The joint transaction network graph includes multiple nodes, multiple edges connecting the multiple nodes, and edge weights for the multiple edges. A node represents a user, and an edge represents a transaction between the users corresponding to the two connected nodes. The edge weight is determined based on the transaction information between the users corresponding to the two connected nodes. In one embodiment, the network graph generation module 520 can be configured to perform operation S220 described above and will not be further described here.

[0106] Node screening module 530 is configured to screen target nodes from the joint transaction network graph based on the risk scores of multiple nodes in the joint transaction network graph. The risk scores are determined based on the edge weights of the edges centered at the nodes. In one embodiment, node screening module 530 can be configured to perform operation S230 described above and will not be further described here.

[0107] Information statistics module 540 is configured to collect statistics on the target user's transaction information set corresponding to the target node based on predetermined evaluation indicators, and determine evaluation information that matches the evaluation indicators. This allows trading devices in the distributed cluster to identify risks in transactions processed by the trading devices based on the evaluation information. In one embodiment, information statistics module 540 can be used to perform operation S240 described above, and will not be further described here.

[0108] According to an embodiment of the present application, the network graph generation module 520 includes a node determination submodule, an edge determination submodule, a weight determination submodule, and a network graph generation submodule.

[0109] The node determination submodule is used to remove the same users from the information sets of multiple transaction devices to obtain nodes representing the users.

[0110] The edge determination submodule is used to connect an edge between two nodes when it is determined based on multiple information sets that there is a transaction between two users corresponding to the two nodes.

[0111] The weight determination submodule is used to determine the edge weight of the edge between two nodes based on transaction information of the transaction between two users corresponding to the two nodes.

[0112] The network graph generation submodule is used to generate a joint transaction network graph based on multiple nodes, edges between multiple nodes, and edge weights of the edges.

[0113] According to an embodiment of the present application, the risky transaction identification device 500 further includes an edge determination module and a score determination module.

[0114] The edge determination module is used to determine, for each node in the joint transaction network graph, at least one edge with the node as an endpoint.

[0115] The score determination module is used to determine the risk score of the node according to the weight of at least one edge and the number of at least one edge.

[0116] According to an embodiment of the present application, the node screening module 530 includes a node arrangement submodule and a node screening submodule.

[0117] The node arrangement submodule is used to arrange multiple nodes in order of risk scores to obtain a node sequence.

[0118] The node screening submodule is used to repeat the following operations until the node sequence is an empty set to determine multiple target nodes: the first node in the node sequence is used as the target node, and the target node is deleted from the node sequence; according to the joint transaction network diagram, at least one node that has a connection relationship with the target node is deleted from the node sequence.

[0119] According to an embodiment of the present application, the information statistics module 540 includes an information classification submodule and an information statistics submodule.

[0120] The information classification submodule is used to classify the multiple transaction information in the target transaction set according to the users who participated in the transactions, so that the target transaction subsets of multiple users respectively include the transaction information of at least one transaction in which the users participated.

[0121] The information statistics submodule is used to perform statistics on multiple target transaction subsets according to the evaluation indicators to determine the evaluation information of the transactions in which the user participates.

[0122] According to an embodiment of the present application, the risky transaction identification 500 further includes an information masking module.

[0123] The information masking module is used to mask the information related to the user identity in the transaction information using the transaction device.

[0124] According to an embodiment of the present application, the risky transaction identification 500 further includes a device determination module and an information sending module.

[0125] The device determination module is used to judge the transaction information in the multiple information sets based on the evaluation information and determine the target transaction device to which the target user belongs.

[0126] The information sending module is used to send the evaluation information to the target transaction device so that the target transaction device can identify the risks of the transactions processed by the target transaction device based on the evaluation information.

[0127] According to an embodiment of the present application, any multiple modules among the information acquisition module 510, the network diagram generation module 520, the node screening module 530, and the information statistics module 540 can be combined into a single module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules can be combined with at least part of the functionality of other modules and implemented in a single module. According to an embodiment of the present application, at least one of the information acquisition module 510, the network diagram generation module 520, the node screening module 530, and the information statistics module 540 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or can be implemented by hardware or firmware in any other reasonable manner of integrating or packaging circuits, or can be implemented in any one of the three implementation methods of software, hardware, and firmware, or in an appropriate combination of any of them. Alternatively, at least one of the information acquisition module 510, the network diagram generation module 520, the node screening module 530 and the information statistics module 540 may be at least partially implemented as a computer program module, which may perform corresponding functions when executed.

[0128] Figure 6 A block diagram of an electronic device suitable for implementing a risky transaction identification method according to an embodiment of the present application is schematically shown.

[0129] like Figure 6 As shown, an electronic device 600 according to an embodiment of the present application includes a processor 601, which can perform various appropriate actions and processes based on a program stored in a read-only memory (ROM) 602 or a program loaded from a storage unit 608 into a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present application.

[0130] Various programs and data required for the operation of the electronic device 600 are stored in the RAM 603. The processor 601, ROM 602, and RAM 603 are connected to each other via a bus 604. The processor 601 performs various operations of the method flow according to the embodiment of the present application by executing the programs in the ROM 602 and / or RAM 603. It should be noted that the programs may also be stored in one or more memories other than the ROM 602 and RAM 603. The processor 601 may also perform various operations of the method flow according to the embodiment of the present application by executing the programs stored in the one or more memories.

[0131] According to an embodiment of the present application, electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to bus 604. Electronic device 600 may also include one or more of the following components connected to I / O interface 605: an input section 606 including a keyboard, mouse, etc.; an output section 607 including devices such as a cathode ray tube (CRT), liquid crystal display (LCD), and speakers; a storage section 608 including a hard disk; and a communication section 609 including a network interface card such as a LAN card or modem. Communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to I / O interface 605 as needed. Removable media 611, such as a magnetic disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed in drive 610 as needed, so that computer programs read from the removable media can be installed into storage section 608 as needed.

[0132] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments, or may exist independently and not be incorporated into the device / apparatus / system. The computer-readable storage medium carries one or more programs, and when the one or more programs are executed, the method according to the embodiments of this application is implemented.

[0133] According to an embodiment of the present application, a computer-readable storage medium may be a non-volatile computer-readable storage medium, and may include, for example, but not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present application, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present application, a computer-readable storage medium may include the ROM 602 and / or RAM 603 described above and / or one or more memories other than ROM 602 and RAM 603.

[0134] The embodiments of the present application also include a computer program product, which includes a computer program containing program code for executing the method shown in the flowchart. When the computer program product is executed in a computer system, the program code is used to enable the computer system to implement the risky transaction identification method provided in the embodiments of the present application.

[0135] The computer program executes the above functions defined in the system / device of the embodiment of the present application when the computer program is executed by the processor 601. According to the embodiment of the present application, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0136] In one embodiment, the computer program may be stored on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may be transmitted and distributed in the form of a signal on a network medium, downloaded and installed via the communication portion 609, and / or installed from a removable medium 611. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to wireless, wired, or any suitable combination thereof.

[0137] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 609, and / or installed from a removable medium 611. When the computer program is executed by the processor 601, the above-mentioned functions defined in the system of the embodiment of the present application are performed. According to the embodiment of the present application, the systems, devices, means, modules, units, etc. described above can be implemented by computer program modules.

[0138] According to an embodiment of the present application, the program code for executing the computer program provided by the embodiment of the present application can be written in any combination of one or more programming languages. Specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C" or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect via the Internet).

[0139] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the above-mentioned module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of the boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0140] Those skilled in the art will appreciate that the features described in the various embodiments of this application may be combined and / or coupled in various ways, even if such combinations or couplings are not explicitly described in this application. In particular, the features described in the various embodiments of this application may be combined and / or coupled in various ways without departing from the spirit and teachings of this application. All such combinations and / or couplings fall within the scope of this application.

Claims

1. A method for identifying risky transactions, characterized in that: The method comprises: Upon obtaining user authorization, respectively obtain information sets of multiple transaction devices in the distributed cluster, wherein the information sets include multiple transaction information in the transaction devices; generating a joint transaction network graph based on respective information sets of the plurality of transaction devices, wherein the joint transaction network graph includes a plurality of nodes, a plurality of edges for connecting the plurality of nodes, and a plurality of edge weights of the edges, wherein the nodes represent the users, the edges represent the existence of a transaction between the users corresponding to the two nodes connected by the edge, and the edge weights are determined based on transaction information between the users corresponding to the two nodes connected by the edge; screening a target node from the joint transaction network graph according to respective risk scores of a plurality of the nodes in the joint transaction network graph, wherein the risk score is determined based on an edge weight of an edge with the node as a vertex; and According to predetermined evaluation indicators, the transaction information set of the target user corresponding to the target node is counted to determine the evaluation information that matches the evaluation indicator, so that the transaction device in the distributed cluster can identify risks of transactions processed by the transaction device based on the evaluation information.

2. The method according to claim 1, characterized in that Generating a joint transaction network diagram according to respective information sets of the plurality of transaction devices includes: removing identical users from the information sets of the plurality of transaction devices to obtain the nodes representing the users; When it is determined based on the plurality of information sets that a transaction exists between two users corresponding to the two nodes, connecting an edge between the two nodes; determining an edge weight of an edge between the two nodes based on transaction information of a transaction between two users corresponding to the two nodes; and The joint transaction network graph is generated based on the plurality of nodes, the edges between the plurality of nodes, and the edge weights of the edges.

3. The method according to claim 2, characterized in that The method further comprises: For each of the nodes in the joint transaction network graph, determining at least one edge having the node as an endpoint; and A risk score of the node is determined according to the weight of each of the at least one edge and the number of the at least one edge.

4. The method according to claim 1, wherein The step of screening a target node from the joint transaction network diagram according to the risk scores of the plurality of nodes in the joint transaction network diagram comprises: Arrange the plurality of nodes in order of risk scores to obtain a node sequence; Repeat the following operations until the node sequence is an empty set, and determine multiple target nodes: Taking the first node in the node sequence as the target node, and deleting the target node from the node sequence; and According to the joint transaction network graph, at least one node that is connected to the target node is deleted from the node sequence.

5. The method according to claim 1, wherein The step of collecting statistics on the transaction information set of the target user corresponding to the target node according to the predetermined evaluation index and determining the evaluation information matching the evaluation index includes: Classifying the plurality of transaction information in the target transaction set according to users who participated in the transactions, so that target transaction subsets of the plurality of users respectively include transaction information of at least one transaction in which the users participated; and According to the evaluation indicators, statistics are collected for each of the plurality of target transaction subsets to determine evaluation information of the transactions in which the user participates.

6. The method according to claim 1, characterized in that The information set includes masked transaction information; the transaction information in the information set is masked in the following manner: The transaction device is used to mask the information related to the user identity in the transaction information.

7. The method according to any one of claims 1 to 6, characterized in that The method further comprises: Judging the transaction information in the plurality of information sets based on the evaluation information, and determining the target transaction device to which the target user belongs; and The evaluation information is sent to the target transaction device, so that the target transaction device can identify risks of transactions processed by the target transaction device based on the evaluation information.

8. A risky transaction identification device, characterized in that: The device comprises: An information acquisition module, configured to obtain, upon user authorization, information sets of respective transaction devices in a distributed cluster, wherein the information sets include a plurality of transaction information in the transaction devices; a network graph generation module, configured to generate a joint transaction network graph based on respective information sets of the plurality of transaction devices, wherein the joint transaction network graph includes a plurality of nodes, a plurality of edges connecting the plurality of nodes, and edge weights of the plurality of edges, wherein the nodes represent the users, the edges represent the existence of a transaction between the users corresponding to the two nodes connected by the edge, and the edge weights are determined based on transaction information between the users corresponding to the two nodes connected by the edge; a node screening module, configured to screen a target node from the joint transaction network graph based on risk scores of each of the plurality of nodes in the joint transaction network graph, wherein the risk scores are determined based on edge weights of edges with the nodes as vertices; and The information statistics module is used to collect statistics on the transaction information set of the target user corresponding to the target node according to predetermined evaluation indicators, and determine the evaluation information that matches the evaluation indicators, so that the transaction devices in the distributed cluster can identify risks of transactions processed by the transaction devices based on the evaluation information.

9. An electronic device comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images