Abnormal transaction determination method and device, equipment and storage medium

Abstract

The embodiment of the invention provides an abnormal transaction determination method and device, equipment and a storage medium, and relates to the technical field of big data. The method comprises the following steps: in response to a target transaction of user equipment, determining feature vectors corresponding to a plurality of feature objects of the target transaction; performing feature analysis processing on the feature vector through a preset evaluation model to obtain a risk prediction value of the target transaction; determining the behavior deviation degree of a target user corresponding to the target transaction, wherein the behavior deviation degree is used for indicating the behavior deviation degree of the target user in the approaching time period compared with the historical time period; data processing is carried out on the behavior deviation degree and the user level of the target user, a risk threshold value of the target user is obtained, and the user level is used for indicating a preset level in a system corresponding to the target user; and if the difference value between the risk prediction value and the risk threshold value is greater than a preset threshold value, determining the target transaction as an abnormal transaction. According to the method, the accuracy of determining the abnormal transaction is improved.

Description

Technical Field

[0001] The present application relates to the field of big data technology, and in particular to a method, apparatus, device, and storage medium for determining abnormal transactions. Background Art

[0002] With the development of financial technology, the types of transactions are increasing, and the frequency of users' transactions is also increasing, which brings comprehensive challenges to existing transaction supervision.

[0003] In related technologies, abnormal transactions can be monitored using rule-based algorithms, such as logistic regression, support vector machines, decision trees, and random forests. However, traditional rule-based engines use fixed criteria to determine whether a transaction is abnormal, and each user has their own specific trading behavior. The same transaction behavior may or may not be abnormal for different users. Using the same criteria can lead to misjudgments, resulting in low accuracy in determining abnormal transactions. Summary of the Invention

[0004] The present application provides a method, apparatus, device and storage medium for determining abnormal transactions, which are used to solve the technical problem of low accuracy in abnormal transaction judgment.

[0005] In a first aspect, the present application provides a method for determining abnormal transactions, comprising:

[0006] In response to a target transaction of a user device, determining feature vectors corresponding to a plurality of feature objects of the target transaction;

[0007] Performing feature analysis on the feature vector using a preset evaluation model to obtain a risk prediction value for the target transaction;

[0008] Determining a behavior deviation of a target user corresponding to the target transaction, where the behavior deviation indicates a degree of deviation of the target user's behavior in a recent time period compared to a historical time period;

[0009] Performing data processing on the behavior deviation and the user level of the target user to obtain a risk threshold of the target user, wherein the user level indicates a preset level of the target user corresponding to the system;

[0010] If the difference between the risk prediction value and the risk threshold is greater than a preset threshold, the target transaction is determined to be an abnormal transaction.

[0011] In a second aspect, the present application provides a device for determining abnormal transactions, comprising a first determination module, an analysis and processing module, a second determination module, a data processing module, and a third determination module:

[0012] The first determining module is configured to, in response to a target transaction of a user device, determine feature vectors corresponding to a plurality of feature objects of the target transaction;

[0013] The analysis and processing module is used to perform feature analysis on the feature vector using a preset evaluation model to obtain a risk prediction value for the target transaction;

[0014] The second determining module is used to determine the behavior deviation of the target user corresponding to the target transaction, where the behavior deviation indicates the degree of deviation of the target user's behavior in the recent period compared with the historical period;

[0015] The data processing module is used to process the behavior deviation and the user level of the target user to obtain a risk threshold of the target user, wherein the user level is used to indicate the preset level of the target user corresponding to the system;

[0016] The third determination module is configured to determine the target transaction as an abnormal transaction if the difference between the risk prediction value and the risk threshold is greater than a preset threshold.

[0017] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a memory, a processor;

[0018] The memory stores computer-executable instructions;

[0019] The processor executes the computer-executable instructions stored in the memory, so that the processor executes the above first aspect and / or various possible implementations of the first aspect.

[0020] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the first aspect above and / or various possible implementation methods of the first aspect.

[0021] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above first aspect and / or various possible implementation methods of the first aspect.

[0022] The method, apparatus, device, and storage medium for determining abnormal transactions provided herein can use a preset assessment model to predict the risk value of a target transaction, then determine a risk threshold for the target user corresponding to the target transaction. When the risk prediction value exceeds the risk threshold, the target transaction is identified as an abnormal transaction. This can determine the abnormality of the target transaction based on the target user corresponding to the target transaction, thereby improving the accuracy of abnormal transaction determination. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0024] Figure 1 A schematic diagram of an application scenario provided in an embodiment of the present application;

[0025] Figure 2 A flowchart of a method for determining abnormal transactions provided in an embodiment of the present application;

[0026] Figure 3 A schematic diagram of the architecture of a model training provided in an embodiment of the present application;

[0027] Figure 4 A schematic diagram of the structure of a CNN model provided in an embodiment of the present application;

[0028] Figure 5 A schematic diagram of a process for determining a behavior deviation provided in an embodiment of the present application;

[0029] Figure 6 A schematic diagram of the architecture of a method for determining abnormal transactions provided in an embodiment of the present application;

[0030] Figure 7 A schematic diagram of the structure of a device for determining abnormal transactions provided in an embodiment of the present application;

[0031] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0032] The above drawings illustrate specific embodiments of the present application, which will be described in more detail below. These drawings and the textual description are not intended to limit the scope of the present application in any way, but rather to illustrate the concepts of the present application to those skilled in the art by reference to specific embodiments. DETAILED DESCRIPTION

[0033] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0034] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with the relevant laws, regulations and standards of the relevant countries and regions, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0035] In addition, this application involves conducting big data analysis of user information (including but not limited to personal biometrics, identity data, consumption data, asset data, electronic terminal operation data, etc.), and using artificial intelligence technology to make automated decisions, and making technical solutions that have a significant impact on personal rights and interests based on the results of automated decisions. The application provides users with corresponding operation entrances for them to choose to agree or reject the results of automated decisions; if the user chooses to reject, the expert decision-making process will be entered.

[0036] It should be noted that the method, device, equipment and storage medium for determining abnormal transactions provided in this application can be used in the field of big data technology, and can also be used in any field other than big data technology. The application field of the method, device, equipment and storage medium for determining abnormal transactions in this application is not limited.

[0037] Figure 1 This is a schematic diagram of an application scenario provided by an embodiment of this application. Figure 1 , including a user device 101, a storage device 102 and a server 103.

[0038] A trading system may be installed in user device 101, and users may trade individual orders through user device 101. Server 103 may respond to a target transaction from user device 101 by determining a feature vector corresponding to multiple features of the target transaction and, using a preset assessment model, perform feature analysis on the feature vector to obtain a risk prediction value for the target transaction.

[0039] Storage device 101 can store each user's historical transaction information and user level. The user level indicates the target user's corresponding preset level in the system. Server 103 can retrieve the target user's user information from storage device 102 and determine the target user's behavior deviation corresponding to the target transaction. The behavior deviation indicates the degree to which the target user's behavior in the recent period deviates from that in the historical period.

[0040] Server 103 can obtain the target user's user level from storage device 101 and process the behavior deviation and user level to obtain the target user's risk threshold. If the difference between the risk prediction value and the risk threshold is greater than a preset threshold, server 103 can determine the target transaction as an abnormal transaction.

[0041] In existing technologies, abnormal transactions can be monitored using rule-based algorithms, such as logistic regression, support vector machines, decision trees, and random forests. However, traditional rule-based engines use fixed criteria to determine whether a transaction is abnormal, and each user has their own specific trading behavior. The same transaction behavior may or may not be abnormal for different users. Using the same criteria can lead to misjudgments, resulting in low accuracy in determining abnormal transactions.

[0042] The method for determining a normal transaction provided in an embodiment of the present application can use a preset assessment model to predict the risk value of a target transaction, then determine a risk threshold for the target user corresponding to the target transaction. When the risk prediction value exceeds the risk threshold, the target transaction is identified as an abnormal transaction. This method can determine the abnormality of the target transaction based on the target user corresponding to the target transaction, thereby improving the accuracy of abnormal transaction determination.

[0043] The following specific embodiments describe in detail the technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0044] Figure 2 This is a flow chart of a method for determining abnormal transactions provided in an embodiment of the present application. Figure 2 , the method may include:

[0045] S201: In response to a target transaction of a user device, determine feature vectors corresponding to multiple feature objects of the target transaction.

[0046] The execution subject of the embodiment of the present application can be a server, or a device for determining abnormal transactions set in the server. The device for determining abnormal transactions can be implemented by software, or by a combination of software and hardware.

[0047] Feature objects can include transaction amount, transaction time, transaction location, user information, terminal information, etc. User information can include occupation, income, number of transactions, etc. Terminal information can include identity authentication identifier, location information, device fingerprint, etc.

[0048] The feature vectors corresponding to the multiple feature objects are vectors that can be identified and processed by the preset evaluation model.

[0049] In some possible embodiments, multiple feature information corresponding to multiple feature objects of a target transaction may be obtained; and data processing may be performed on the multiple feature information to obtain feature vectors corresponding to the multiple feature objects.

[0050] For example, suppose multiple feature objects include transaction amount, transaction time, and transaction location. The target transaction is transaction 1. It can be determined that the transaction amount is 100, the transaction time is 00:30 on January 21, 2024, and the transaction location is a certain community. The feature vector is a vector composed of the corresponding feature information of the transaction amount, transaction time, and transaction location.

[0051] In this application, data processing can be performed on multiple feature information of multiple feature objects of the target transaction to obtain feature vectors. The feature vectors can be processed through a preset evaluation model, and the feature information can be processed in advance to standardize the feature vectors input into the preset evaluation model, which can improve the accuracy of the prediction of the preset evaluation model.

[0052] The multiple feature objects may include at least one feature to be encoded and at least one non-encoded feature. The feature to be encoded is used to indicate the feature object whose feature information needs to be encoded, and the non-encoded feature is used to indicate the feature object whose feature information does not need to be encoded.

[0053] Specifically, the feature information corresponding to at least one feature to be encoded can be encoded to obtain the encoded data corresponding to each feature to be encoded; according to the preset order of multiple features, the encoded data corresponding to each feature to be encoded and the feature information of each non-encoded feature are spliced ​​to obtain a feature vector.

[0054] The at least one feature to be encoded may include the transaction time and / or the transaction location. The at least one non-encoded feature may include the transaction amount, user information, and terminal information.

[0055] For any transaction location, a location code information table is obtained. The location code information table may include multiple location codes corresponding to multiple transaction locations. The location code corresponding to the transaction location can be determined in the location code information table.

[0056] For any transaction moment, determine the attribute code, frequency code and transaction proportion code corresponding to the transaction moment, and concatenate the attribute code, frequency code and transaction proportion code to obtain the moment code corresponding to the transaction moment.

[0057] Attribute coding can be used to indicate discrete events such as holidays, shopping festivals, and weekends at the time of transaction. Discrete events such as holidays, shopping festivals, and weekends can be marked by binary value (for example, 1 indicates a holiday and 0 indicates a non-holiday).

[0058] Frequency codes can be used to indicate the frequency of related events in the past N days (for example, the number of holidays in the past 7 days).

[0059] In view of periodic patterns, when the trading time is a high-frequency period (such as the trading peak on Friday), a weight coefficient can be designed (for example, 1.5 times the weight on Friday), and the proportion of transactions within the period can be counted through a sliding window.

[0060] The attribute coding, frequency coding and transaction proportion can be normalized to the range of [0,1].

[0061] By encoding the feature information corresponding to at least one feature to be encoded, validity information in the feature information can be extracted, and the accuracy of the preset evaluation model analysis can be improved.

[0062] S202: Perform feature analysis on the feature vector using a preset evaluation model to obtain a risk prediction value for the target transaction.

[0063] The preset evaluation model may be a trained and solidified Convolutional Neural Network (CNN) model.

[0064] Before determining the preset risk value of a target transaction using a preset assessment model, the CNN model needs to be trained using a training set. The training set includes multiple training samples, each of which includes a feature vector and a risk value for the transaction sample.

[0065] Figure 3 This is a schematic diagram of the architecture of a model training provided in the embodiment of this application. Figure 3 , we can obtain the initial transaction information of each historical transaction. This information needs to be standardized and preprocessed to obtain the target transaction information for each transaction sample. The preprocessing process can include data cleaning, deduplication, and normalization (using Z-score standardization).

[0066] A plurality of feature information corresponding to each transaction sample is determined in the target transaction information of each transaction sample, and a feature vector corresponding to each transaction sample is obtained after data processing is performed on the plurality of feature information.

[0067] The risk threshold corresponding to each transaction sample can be determined by analyzing the transaction information of each transaction sample. For details on how to do this, please refer to the following section on the process of determining the risk threshold corresponding to a target transaction.

[0068] The feature vector and risk threshold corresponding to each transaction sample are taken as a transaction sample, and multiple transaction samples are determined to train the CNN model to obtain a preset evaluation model.

[0069] Figure 4 This is a schematic diagram of the structure of a CNN model provided in the embodiment of this application. Figure 4 A CNN model can include an input layer, at least one hidden layer, and an output layer. Feature vectors can be input into the input layer, and after being processed by at least one hidden layer, predicted values ​​can be output at the output layer. Hidden layers are used to handle nonlinear relationships and feature recognition. Stacked convolutional neural networks capture the correlation between local features, while incorporating the Leaky ReLU activation function to enhance the model's nonlinear expression capabilities, as shown in the formula.

[0070]

[0071] in, is a constant less than 1, and X is the input data.

[0072] Each hidden layer integrates and transforms the features extracted by the previous hidden layer into more abstract features, thereby improving the expressive power of the model. Figure 3 As shown in the figure, there are two hidden layers. After the feature vector is input, the predicted value is obtained through processing in the two hidden layers.

[0073] The model parameters can ultimately be optimized by the reconstruction error (mean square error, MSE) between the predicted value and the true risk value.

[0074]

[0075] in, is the risk value of the i-th transaction sample, is the predicted value of the i-th transaction sample generated by the CNN model, and n is the number of samples.

[0076] After the CNN model is trained and solidified through the training set, a preset evaluation model is obtained. The preset evaluation model can be used to analyze and process the feature vector of the target transaction to obtain a risk prediction value.

[0077] S203: Determine the behavior deviation of the target user corresponding to the target transaction.

[0078] Behavior deviation is used to indicate the degree of deviation of the target user's behavior in the recent period compared with the historical period.

[0079] For example, assuming that the near period is 7 days before the current moment of the target transaction, the historical period may be 3 months before the current moment of the target transaction.

[0080] Behavior deviation can be used to determine whether the target user conforms to their trading habits. The greater the behavioral deviation, the less consistent the trading behavior is with the target user's trading habits, and the greater the risk. The smaller the behavioral deviation, the more consistent the trading behavior is with the target user's trading habits, and the lower the risk.

[0081] S204: Process the behavior deviation and the user level of the target user to obtain a risk threshold of the target user.

[0082] Each user has a corresponding user level in the transaction system, and the user level can be used to indicate the preset level of the target user corresponding to the system.

[0083] User levels can be updated periodically based on the target user's transaction status in the trading system.

[0084] Specifically, the behavior deviation coefficient corresponding to the behavior deviation degree, the level weight coefficient corresponding to the user level, and the behavior deviation baseline value can be obtained; the product of the behavior deviation degree and the behavior deviation coefficient is determined as the first product; the product of the user level and the level weight coefficient is determined as the second product; the sum of the first product, the second product and the deviation baseline value is determined as the risk threshold.

[0085] Please refer to the following formula:

[0086]

[0087] in, is the risk threshold of the target user, is the behavioral deviation coefficient, is the behavioral deviation, is the grade weight coefficient, For user level, Deviates from the baseline value.

[0088] In this application, the behavior deviation coefficient and the level weight coefficient of the target user can be used to adjust the behavior deviation degree and the user level respectively, which can improve the accuracy of determining the risk threshold.

[0089] The behavior deviation coefficient and the level weight coefficient are preset values ​​and can be determined according to actual application conditions.

[0090] In some possible embodiments, the deviation from the baseline value may be 50.

[0091] S205: If the difference between the risk prediction value and the risk threshold is greater than the preset threshold, the target transaction is determined to be an abnormal transaction.

[0092] For example, assuming the risk prediction value is 85, the risk threshold is 80, and assuming the preset threshold is 3, it can be determined that the difference between the risk prediction value and the risk threshold is greater than the preset threshold, and the target transaction is determined to be an abnormal transaction.

[0093] We can traverse the time series data, set a 7-day observation window, and calculate the mean μ and standard deviation σ of the reconstruction error. According to the 3σ principle, under a normal distribution, 99.7% of the data falls within the range of μ±3σ, so μ±3σ is determined as the preset threshold.

[0094] After a target transaction is identified as an abnormal transaction, it will be intercepted in real time and pushed for manual review. During the manual review stage, the staff can choose to maintain the target transaction as an abnormal transaction or modify it to a normal transaction. If the target transaction is modified to a normal transaction, the real-time interception of the target transaction will be cancelled.

[0095] It is worth noting that during the manual phase, once a target transaction is determined to be abnormal, the target transaction's feature vector and risk prediction value can be used as training samples to train and update the preset assessment model, thereby enabling real-time updates of the assessment model. This can improve the accuracy of the preset assessment model.

[0096] The method for determining abnormal transactions provided in this embodiment can determine a risk prediction value for a target transaction using a preset assessment model. Furthermore, it can determine a risk threshold for the target user based on the behavioral deviation and user level of the target user. When the risk prediction value exceeds the risk threshold, the target transaction is determined to be abnormal. This can improve the accuracy of abnormal transaction determination by determining the abnormality of the target transaction based on the target user.

[0097] Based on the above embodiments, Figure 4 , the execution process of determining the behavioral deviation of the target user provided in the embodiment of the present application is described.

[0098] Figure 5 This is a flow chart of determining behavior deviation provided in an embodiment of the present application. Figure 5 , the method may include:

[0099] S501. Acquire multiple transaction moments of a target user in a recent time period and multiple historical moments in a historical time period.

[0100] Multiple transaction moments of the target user in a recent period and multiple historical moments in a historical period can be obtained in the storage device.

[0101] For example, assuming the near-term period is 7 days before the current time of the target transaction, and the historical period is 3 months before the current time of the target transaction, the transaction times of multiple transactions of the target user within 7 days and the historical times of multiple transactions of the target user within 3 months can be obtained from the storage device.

[0102] S502: Determine the time period distribution deviation of the target user based on multiple transaction moments in the adjacent time period and multiple historical moments in the historical time period.

[0103] The time period distribution deviation is used to indicate the degree of difference between the target user's transactions in the recent period and the historical period. The greater the difference, the greater the time period distribution deviation.

[0104] In some possible embodiments, the transaction frequency corresponding to each preset sub-period can be determined based on multiple transaction moments in an adjacent period; the historical frequency corresponding to each preset sub-period can be determined based on multiple historical moments in a historical period; and the period distribution deviation can be determined based on the transaction frequency and historical frequency corresponding to each preset sub-period.

[0105] The near-term period can include at least one determination period, and the historical period can include multiple determination periods. Each determination period can include multiple preset sub-periods. For example, assuming the near-term period is 7 days, the historical period is 30 days, and the determination period is 1 day, then the near-term period includes 7 determination periods, and the historical period includes 30 determination periods. Assuming the preset sub-period is 1 hour, then one determination period includes 24 preset sub-periods.

[0106] For any preset sub-period, when determining the transaction frequency corresponding to the preset sub-period, at least one first frequency corresponding to the preset sub-period can be determined in at least one determination period of the adjacent period, and the average value of the at least one first frequency is determined as the transaction frequency of the preset sub-period.

[0107] For example, assuming the approach period is 7 days, the determination period is 1 day, the preset sub-periods are each hour of the day, and the determination period includes 24 preset sub-periods. Assuming preset sub-period 1 is 00:00-01:00, then, within the 7-day approach period, the first frequency of each day (i.e., the determination period) within the preset sub-period 1 of 00:00-01:00 is determined to be 1, 0, 0, 0, 1, 1, and 0 respectively. Therefore, the transaction frequency of preset sub-period 1 can be determined to be 0.43.

[0108] For any preset sub-period, when determining the historical frequency corresponding to the preset sub-period, multiple second frequencies corresponding to the preset sub-period can be determined in multiple determination periods of the historical period, and the average value of the multiple second frequencies is determined as the historical frequency of the preset sub-period.

[0109] The execution process of the historical frequency corresponding to each preset sub-period can be found in the execution process of the trading frequency corresponding to each preset sub-period above, which will not be repeated here.

[0110] By dividing the adjacent time periods and historical time periods into sub-time periods, and determining the time period distribution deviation through the transaction frequency and historical frequency corresponding to each preset sub-time period, the accuracy of determining the time period distribution deviation can be improved, thereby improving the accuracy of determining transaction anomalies.

[0111] The concept of mutual information entropy can be used to quantify the distribution differences in target users' transaction situations between historical periods and recent periods.

[0112] Specifically, the transaction frequency corresponding to each preset sub-period can be determined based on the transaction frequency corresponding to each preset sub-period; the historical frequency corresponding to each preset sub-period can be determined based on the historical frequency corresponding to each preset sub-period; for any preset sub-period, the product of the transaction frequency corresponding to the preset sub-period and the historical frequency is determined to be the ratio of the maximum value of the transaction frequency and the historical frequency as the overlap corresponding to the preset sub-period; and the complementary number of the sum of the overlaps corresponding to each preset sub-period is determined as the period distribution deviation.

[0113] The overlap degree is used to indicate the degree of overlap between the target user's recent period and the historical period within a preset sub-period.

[0114] Please refer to the following formula:

[0115]

[0116] in, is the time period distribution deviation, is the trading frequency of the t-th preset sub-period of the adjacent period, is the historical frequency of the t-th preset sub-period of the historical period, and M is the number of preset sub-periods (for example, if the preset sub-period is one hour, the number is 24 hours).

[0117] Based on mutual information entropy, the information of the target user in the adjacent time period and the historical time period can be quantified, revealing the essential correlation between the variables in the adjacent time period and the historical time period in the preset sub-time period, achieving accurate quantitative differences, and improving the accuracy of determining the behavioral deviation of the target user.

[0118] S503: Determine the target user's amount distribution deviation based on the transaction amount at each transaction moment in the adjacent time period and the transaction amount at each historical moment in the historical time period.

[0119] The amount distribution deviation indicates the concentration change of transaction amounts in the recent period compared to the historical trading period. The greater the concentration change, the greater the amount distribution deviation; the smaller the concentration change, the smaller the amount distribution deviation.

[0120] In the embodiment of the present application, the deviation of the amount distribution can be determined based on the interquartile range (IQR), and the IQR can be used as an indicator to measure the degree of data dispersion.

[0121] In some possible embodiments, the first quartile range corresponding to the adjacent time period can be determined based on the transaction amount of each transaction moment in the adjacent time period; the second quartile range corresponding to the historical time period can be determined based on the transaction amount of each historical moment in the historical time period; and the amount distribution deviation can be determined by taking the complementary number of the ratio of the first quartile range to the second quartile range.

[0122] The first interquartile range can be determined by referring to the following formula: :

[0123]

[0124] in, Used to indicate the third quartile of multiple trading moments in the adjacent period. Indicates the first quartile of multiple trading moments within a nearby period.

[0125] It refers to the value at the 25th percentile after sorting multiple trading moments from smallest to largest. The first quartile indicates that the values ​​in the top 25% of the multiple trading moments do not exceed this value. It refers to the value at the 75% position after sorting multiple trading moments from small to large.

[0126] The second interquartile range can be determined by referring to the following formula: :

[0127]

[0128] in, Used to indicate the third quartile of multiple historical moments in a historical period. Used to indicate the first quartile of multiple historical moments within a historical period.

[0129] It refers to the value at the 25th percentile after sorting multiple historical moments from smallest to largest. The first quartile indicates that the top 25% of the values ​​in multiple historical moments do not exceed this value. It refers to the value at the 75th percentile after sorting multiple historical moments from smallest to largest.

[0130] Refer to the following formula to determine the amount distribution deviation :

[0131]

[0132] in, Used to indicate the interquartile range corresponding to the adjacent time period. Used to indicate the interquartile range corresponding to the historical period.

[0133] The deviation of the amount distribution is determined by the first quartile range corresponding to the adjacent time period and the second quartile range corresponding to the historical time period. The interquartile range is Q3 minus Q1, which is the range of the middle 50% of the data. This can reflect the degree of dispersion of the adjacent time period and the historical time period, improve the accuracy of determining the deviation of the amount distribution, and thus improve the accuracy of determining transaction anomalies.

[0134] S504: Sum the product of the time period distribution deviation and its corresponding first weight, and sum the product of the amount distribution deviation and its corresponding second weight, and determine the sum result as the behavior deviation.

[0135] The following formula can be used to determine the degree of behavioral deviation: :

[0136]

[0137]

[0138] in, is the time period distribution deviation, is the deviation of the amount distribution, is the first weight, is the second weight.

[0139] The method for determining abnormal transactions provided in the embodiment of the present application can comprehensively consider the time period distribution deviation and the amount distribution deviation of the target user to determine the behavior deviation of the target user. The time period distribution deviation can be used to consider the user's transaction time, and the amount distribution deviation can be used to consider the user's transaction amount, which can improve the accuracy of determining the behavior deviation.

[0140] Figure 6 This is a schematic diagram of the architecture of a method for determining abnormal transactions provided in an embodiment of the present application. Figure 6 , obtain the feature information corresponding to each feature object of the target transaction, perform data processing on the multiple feature information, and obtain feature vectors corresponding to the multiple feature objects. Using a preset assessment model, perform feature analysis on the feature vectors to obtain a risk prediction value for the target transaction. Determine the risk threshold for the target user corresponding to the target transaction.

[0141] The difference between the risk prediction value and the risk threshold is determined to be greater than a preset threshold. If so, the target transaction is identified as an abnormal transaction, intercepted in real time, and pushed for manual review. After the review is completed, if the target transaction is determined to be an abnormal transaction, the corresponding feature vector and risk prediction value can be used as samples to train and update the preset assessment model. If not, the target transaction is normal, and the corresponding feature vector and risk prediction value are used as samples to train and update the preset assessment model.

[0142] Figure 7 This is a schematic diagram of the structure of a device for determining abnormal transactions provided in an embodiment of the present application. Figure 7 The abnormal transaction determination device 700 includes a first determination module 701, an analysis and processing module 702, a second determination module 703, a data processing module 704 and a third determination module 705:

[0143] The first determining module 701 is configured to, in response to a target transaction of a user device, determine feature vectors corresponding to a plurality of feature objects of the target transaction;

[0144] The analysis and processing module 702 is used to perform feature analysis on the feature vector using a preset evaluation model to obtain a risk prediction value for the target transaction;

[0145] The second determining module 703 is used to determine the behavior deviation of the target user corresponding to the target transaction, where the behavior deviation indicates the degree of deviation of the target user's behavior in the recent period compared with the historical period;

[0146] The data processing module 704 is used to process the behavior deviation and the user level of the target user to obtain a risk threshold of the target user. The user level is used to indicate the preset level of the target user in the system.

[0147] The third determination module 705 is configured to determine the target transaction as an abnormal transaction if the difference between the risk prediction value and the risk threshold is greater than a preset threshold.

[0148] In some possible embodiments, the second determining module 703 is specifically configured to:

[0149] Obtain the target user's multiple transaction times and transaction amounts at each transaction time in the recent period, as well as multiple historical times and transaction amounts at each historical time in the historical period;

[0150] Determine the time period distribution deviation of the target user based on multiple transaction moments in the adjacent time period and multiple historical moments in the historical time period;

[0151] Determine the target user's balance distribution deviation based on the transaction amounts at each transaction moment in the nearby time period and the transaction amounts at each historical moment in the historical time period;

[0152] The product of the time period distribution deviation and its corresponding first weight, and the product of the amount distribution deviation and its corresponding second weight are summed, and the sum result is determined as the behavior deviation.

[0153] In some possible embodiments, the second determining module 703 is specifically configured to:

[0154] Determine the transaction frequency corresponding to each preset sub-period based on multiple transaction times in the adjacent period;

[0155] Determine the historical frequency corresponding to each preset sub-period based on multiple historical moments within the historical period;

[0156] The time period distribution deviation is determined based on the transaction frequency and historical frequency corresponding to each preset sub-period.

[0157] In some possible embodiments, the second determining module 703 is specifically configured to:

[0158] Determine the transaction frequency corresponding to each preset sub-period based on the transaction frequency corresponding to each preset sub-period;

[0159] Determine the historical frequency corresponding to each preset sub-period based on the historical frequency corresponding to each preset sub-period;

[0160] For any predefined sub-period, the overlap degree corresponding to the predefined sub-period is determined as the ratio of the product of the transaction frequency and the historical frequency corresponding to the predefined sub-period to the maximum value of the transaction frequency and the historical frequency. The overlap degree indicates the degree of overlap between the adjacent period and the historical period within the predefined sub-period for the target user.

[0161] The complementary number of the sum of the overlapping degrees corresponding to the preset sub-time periods is determined as the time period distribution deviation.

[0162] In some possible embodiments, the second determining module 703 is specifically configured to:

[0163] Determine the first quartile range corresponding to the adjacent time period based on the transaction amount at each transaction time within the adjacent time period;

[0164] Determine the second quartile range corresponding to the historical period based on the transaction amount at each historical moment within the historical period;

[0165] The complementary number of the ratio of the first interquartile range to the second interquartile range is used to determine the deviation of the quota distribution.

[0166] In some possible embodiments, the first determining module 701 is specifically configured to:

[0167] Obtain multiple feature information corresponding to multiple feature objects of the target transaction;

[0168] Data processing is performed on multiple feature information to obtain feature vectors corresponding to multiple feature objects.

[0169] In some possible embodiments, the multiple feature objects include at least one feature to be encoded and at least one non-encoded feature; and the first determining module 701 is specifically configured to:

[0170] Encoding feature information corresponding to at least one feature to be encoded to obtain encoding data corresponding to each feature to be encoded, wherein at least one feature to be encoded includes a transaction time and / or a transaction location;

[0171] According to the preset order of multiple features, the encoding data corresponding to each feature to be encoded and the feature information of each non-encoded feature are spliced ​​together to obtain a feature vector.

[0172] In some possible embodiments, the data processing module 704 is specifically configured to:

[0173] Obtaining the behavior deviation coefficient corresponding to the behavior deviation degree, the level weight coefficient corresponding to the user level, and the behavior deviation baseline value;

[0174] The product of the behavior deviation degree and the behavior deviation coefficient is determined as the first product;

[0175] Determine the product of the user level and the level weight coefficient as the second product;

[0176] The sum of the first product, the second product and the deviation from the baseline value is determined as the risk threshold.

[0177] The device for determining abnormal transactions provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effects are similar and will not be described in detail in this embodiment.

[0178] Figure 8 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 8 The electronic device 800 may include a processor 801 and a memory 802. Exemplarily, the processor 801 and the memory 802 are interconnected via a bus 803.

[0179] Memory 802 stores computer-executable instructions;

[0180] The processor 801 executes the computer-executable instructions stored in the memory 802 , so that the processor 801 executes the method for determining abnormal transactions as shown in the above method embodiment.

[0181] Accordingly, an embodiment of the present application provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the method for determining abnormal transactions of the above-mentioned method embodiment.

[0182] Accordingly, an embodiment of the present application may also provide a computer program product, including a computer program. When the computer program is executed by a processor, it can implement the method for determining abnormal transactions shown in the above method embodiment.

[0183] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0184] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowcharts and / or block diagrams, as well as combinations of processes and / or blocks in the flowcharts and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowcharts and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0185] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0186] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0187] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0188] Memory may include non-permanent storage in a computer-readable medium, in the form of random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0189] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can be implemented using any method or technology for information storage. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change RAM (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices, or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media, such as modulated data signals and carrier waves.

[0190] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0191] The above are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A method for determining abnormal transactions, characterized in that: include: In response to a target transaction of a user device, determining feature vectors corresponding to a plurality of feature objects of the target transaction; Performing feature analysis on the feature vector using a preset evaluation model to obtain a risk prediction value for the target transaction; Determining a behavior deviation of a target user corresponding to the target transaction, where the behavior deviation indicates a degree of deviation of the target user's behavior in a recent time period compared to a historical time period; Performing data processing on the behavior deviation and the user level of the target user to obtain a risk threshold of the target user, wherein the user level indicates a preset level of the target user corresponding to the system; If the difference between the risk prediction value and the risk threshold is greater than a preset threshold, the target transaction is determined to be an abnormal transaction.

2. The method according to claim 1, characterized in that Determining the behavior deviation of the target user corresponding to the target transaction includes: Obtaining multiple transaction times and transaction amounts of the target user in a recent time period, as well as multiple historical times and transaction amounts of the target user in a historical time period; Determining a time period distribution deviation of the target user based on the multiple transaction moments in the adjacent time period and the multiple historical moments in the historical time period; Determining the target user's transaction amount distribution deviation based on the transaction amount at each transaction moment in the adjacent time period and the transaction amount at each historical moment in the historical time period; The product of the time period distribution deviation and its corresponding first weight, and the product of the amount distribution deviation and its corresponding second weight are summed, and the sum result is determined as the behavior deviation.

3. The method according to claim 2, characterized in that Determining the time period distribution deviation of the target user based on the multiple transaction moments in the adjacent time period and the multiple historical moments in the historical time period includes: Determining the transaction frequency corresponding to each preset sub-period based on multiple transaction times within the adjacent period; Determining the historical frequency corresponding to each preset sub-period based on multiple historical moments within the historical period; The time period distribution deviation is determined according to the transaction frequency and historical frequency corresponding to each preset sub-period.

4. The method according to claim 3, characterized in that Determining the time period distribution deviation based on the transaction frequency and historical frequency corresponding to each preset sub-period includes: Determining the transaction frequency corresponding to each preset sub-period according to the transaction frequency corresponding to each preset sub-period; Determining the historical frequency corresponding to each preset sub-period according to the historical frequency corresponding to each preset sub-period; For any preset sub-period, the overlap degree corresponding to the preset sub-period is determined as the ratio of the product of the transaction frequency corresponding to the preset sub-period and the historical frequency to the maximum value of the transaction frequency and the historical frequency. The overlap degree is used to indicate the degree of overlap between the adjacent period and the historical period of the target user within the preset sub-period; The complementary number of the sum of the overlapping degrees corresponding to the preset sub-time periods is determined as the time period distribution deviation.

5. The method according to claim 2, characterized in that Determining the target user's amount distribution deviation based on the transaction amount at each transaction moment in the adjacent time period and the transaction amount at each historical moment in the historical time period includes: Determining the first quartile range corresponding to the adjacent time period based on the transaction amount at each transaction moment within the adjacent time period; Determining the second interquartile range corresponding to the historical period based on the transaction amount at each historical moment within the historical period; The amount distribution deviation is determined by taking the complementary number of the ratio of the first interquartile range to the second interquartile range.

6. The method according to claim 1, characterized in that Determine the feature vectors corresponding to multiple feature objects of the target transaction, including: Obtain multiple feature information corresponding to multiple feature objects of the target transaction; Data processing is performed on the plurality of feature information to obtain feature vectors corresponding to the plurality of feature objects.

7. The method according to claim 6, characterized in that The multiple feature objects include at least one feature to be encoded and at least one non-encoded feature; Performing data processing on the plurality of feature information to obtain feature vectors corresponding to the plurality of feature objects includes: Performing encoding processing on feature information corresponding to the at least one feature to be encoded to obtain encoding data corresponding to each feature to be encoded, wherein the at least one feature to be encoded includes a transaction time and / or a transaction location; According to the preset order of the multiple features, the encoding data corresponding to each feature to be encoded and the feature information of each non-encoded feature are spliced ​​together to obtain the feature vector.

8. The method according to claim 1, characterized in that Processing the behavior deviation and the target user's user level to obtain a risk threshold for the target user includes: Obtaining a behavior deviation coefficient corresponding to the behavior deviation degree, a level weight coefficient corresponding to the user level, and a behavior deviation reference value; determining the product of the behavior deviation degree and the behavior deviation coefficient as a first product; Determine the product of the user level and the level weight coefficient as a second product; The sum of the first product, the second product and the deviation reference value is determined as the risk threshold.

9. A device for determining abnormal transactions, characterized in that: It includes a first determination module, an analysis and processing module, a second determination module, a data processing module and a third determination module: The first determining module is configured to, in response to a target transaction of a user device, determine feature vectors corresponding to a plurality of feature objects of the target transaction; The analysis and processing module is used to perform feature analysis on the feature vector using a preset evaluation model to obtain a risk prediction value for the target transaction; The second determining module is used to determine the behavior deviation of the target user corresponding to the target transaction, where the behavior deviation indicates the degree of deviation of the target user's behavior in the recent period compared with the historical period; The data processing module is used to process the behavior deviation and the user level of the target user to obtain a risk threshold of the target user, wherein the user level is used to indicate the preset level of the target user corresponding to the system; The third determination module is configured to determine the target transaction as an abnormal transaction if the difference between the risk prediction value and the risk threshold is greater than a preset threshold.

10. An electronic device, characterized in that: include: a processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 8.

11. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 8 when executed by a processor.

12. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 8 when the computer program is executed by a processor.

Images