Transaction control method, device, equipment, medium and program product

Abstract

The invention provides a transaction control method which can be applied to the technical field of financial science and technology. The transaction control method comprises the following steps: receiving first transaction information uploaded by a user; on the basis of the first transaction information, executing a pre-verification rule, and judging whether the first transaction information is released or not, so as to execute a corresponding current transaction on the basis of the first transaction information; under the condition that the current transaction is executed, an in-event monitoring rule is executed, whether an abnormal behavior occurs in the current transaction or not is judged, and the in-event monitoring rule comprises transaction behavior characteristic variables generated in the transaction monitoring process based on a preset machine learning model; and terminating the current transaction under the condition that the preset machine learning model judges that the abnormal behavior occurs in the current transaction. The invention further provides a transaction control device, equipment, a medium and a program product.

Description

Technical Field

[0001] The present disclosure relates to the field of financial technology, specifically to the field of artificial intelligence technology and information security technology, and more specifically to a transaction control method, device, equipment, medium and program product. Background Art

[0002] In the financial sector, some transactions are facilitated by distributing benefits, such as rewards and subsidies, intended to promote sales and activation. However, business risk control systems have identified instances where automated tools are used to engage in unauthorized online promotions, such as cashing out, to gain financial benefits. For example, in a typical scenario, at the start of a promotion, attackers use automated tools to rapidly log in to multiple accounts from multiple locations and participate in the promotion, reaping high profits at minimal cost.

[0003] To prevent such malicious transactions, existing technologies typically employ two solutions: adding verification steps during transactions and back-end monitoring of abnormal traffic. These solutions are as follows:

[0004] 1. Determine whether the current transaction was manually operated by adding more complex processes involving manual interaction on the user side. For example, facial recognition can be used to ensure that the current transaction was manually operated, or complex verification codes can be used to verify that the current transaction was manually operated.

[0005] 2. In order to allow normal users to use the service and prevent abnormal means from occupying traffic and server resources, a large number of operation and maintenance personnel are needed to monitor traffic at all times and manually block and limit traffic.

[0006] The solutions in the above-mentioned prior art cannot avoid the situations of poor user experience, incorrect identification on the user side, and low identification efficiency. Summary of the Invention

[0007] In view of the above problems, the present disclosure provides a transaction control method, apparatus, device, medium and program product that improve the reliability of abnormal transaction identification and user experience.

[0008] According to a first aspect of the present disclosure, a transaction control method is provided, comprising: receiving first transaction information submitted by a user; executing a pre-verification rule based on the first transaction information to determine whether to release the first transaction information, so as to execute a corresponding current transaction based on the first transaction information; when the current transaction is executed, executing an in-process monitoring rule to determine whether abnormal behavior occurs in the current transaction, wherein the in-process monitoring rule includes monitoring transaction behavior characteristic variables generated during the transaction process based on a preset machine learning model; and terminating the current transaction when the preset machine learning model determines that abnormal behavior occurs in the current transaction.

[0009] According to an embodiment of the present disclosure, executing a pre-verification rule based on the first transaction information to determine whether to release the first transaction information so as to execute the corresponding current transaction based on the first transaction information includes: determining whether the first transaction information exists in a preset blacklist; and releasing the current transaction corresponding to the first transaction information if the first transaction information does not exist in the preset blacklist.

[0010] According to an embodiment of the present disclosure, when the current transaction is executed, the in-process monitoring rules are executed to determine whether the current transaction has abnormal behavior, including: obtaining second transaction information, the second transaction information including N types of feature variables, N is a positive integer; reducing the N types of feature variables to M types of feature variables, M is a positive integer less than or equal to N; and based on the M types of feature variables, outputting the recognition result through the preset machine learning model.

[0011] According to an embodiment of the present disclosure, the N types of feature variables include continuous feature variables and discrete feature variables, and reducing the dimension of the N types of feature variables to M types of feature variables includes: converting the continuous feature variables in the N types of feature variables into discrete feature variables; fusing the P types of preset feature variables in the N types of feature variables to obtain Q types of new feature variables, where P and Q are positive integers; calculating the value of the fused Q type new feature variables, where the Q type new feature variables and the unfused (NP) type new feature variables are combined into M type feature variables.

[0012] According to an embodiment of the present disclosure, converting the continuous feature variables in the N types of feature variables into discrete feature variables includes: converting the continuous feature variables into discrete feature variables by adopting an equidistant binning method.

[0013] According to an embodiment of the present disclosure, the new feature variables include the first category feature variables before fusion and the second category feature variables before fusion, and the calculation of the value of the Q-category new feature variables after fusion includes: calculating the value of the Q-category new feature variables after fusion according to a preset offset calculation method, wherein, for any of the new feature variables, the preset offset calculation rule includes: obtaining the value of the bound feature variable based on the sum of the value of the first category feature variable, the value of the second category feature variable and the preset offset, wherein, if the value of the first category feature variable meets the offset addition condition, the preset offset is added, and if the value of the first category feature variable does not meet the offset addition condition, the preset offset is not added.

[0014] According to an embodiment of the present disclosure, the preset machine learning model includes a preset clustering model, and the recognition result is output based on the M-type feature variables through the preset machine learning model, including: forming a point to be identified based on the M-type feature variables; and judging whether the point to be identified and the preset abnormal core point are within a preset neighborhood radius, wherein, when the point to be identified and the preset abnormal core point are within the preset neighborhood radius, the point to be identified is judged to be the abnormal category corresponding to the preset abnormal core point, or when the point to be identified and the preset abnormal core point are not within the preset neighborhood radius, the point to be identified is judged to be an unincluded category.

[0015] According to an embodiment of the present disclosure, after outputting the recognition result based on the M-category feature variables through the input of the preset machine learning model, it also includes: when the point to be identified is an abnormal category or an unincluded category, extracting and restoring the feature variables of the unincluded category, wherein, for the new feature variables, restoration is performed based on the preset offset calculation rule; and recording the feature variables of the abnormal point.

[0016] According to an embodiment of the present disclosure, the method for determining the Q-type new feature variables includes: obtaining a second transaction information set, where the second transaction information set includes K second transaction information, where K is a positive integer; based on the K second transaction information, calculating the conflict ratio values ​​between each of the N types of feature variables; sorting based on the conflict ratio values, and binding the two types of feature variables whose conflict ratio values ​​are lower than a preset threshold.

[0017] The second aspect of the present disclosure provides a transaction control device, including: a receiving module for receiving first transaction information submitted by a user; a pre-verification module for executing a pre-verification rule based on the first transaction information to determine whether to release the first transaction information, so as to execute the corresponding current transaction based on the first transaction information; an in-process monitoring module for executing an in-process monitoring rule when the current transaction is executed to determine whether abnormal behavior occurs in the current transaction, wherein the in-process monitoring rule includes monitoring transaction behavior characteristic variables generated during the transaction process based on a preset machine learning model; and a transaction control module for terminating the current transaction when the preset machine learning model determines that abnormal behavior occurs in the current transaction.

[0018] According to an embodiment of the present disclosure, the pre-verification module includes: a blacklist judgment unit and a transaction release unit, the blacklist judgment unit is used to judge whether the first transaction information exists in a preset blacklist; and the transaction release unit is used to release the current transaction corresponding to the first transaction information if the first transaction information does not exist in the preset blacklist.

[0019] According to an embodiment of the present disclosure, the in-process monitoring module includes: a second transaction information acquisition unit, a dimensionality reduction unit and an identification unit, the second transaction information acquisition unit is used to obtain second transaction information, the second transaction information includes N types of feature variables, N is a positive integer; the dimensionality reduction unit is used to reduce the N types of feature variables to M types of feature variables, M is a positive integer less than or equal to N; and the identification unit is used to output an identification result based on the M types of feature variables through the preset machine learning model.

[0020] According to an embodiment of the present disclosure, the N types of feature variables include continuous feature variables and discrete feature variables, and the dimensionality reduction unit includes: a discretization subunit and a fusion subunit, the discretization subunit is used to convert the continuous feature variables in the N types of feature variables into discrete feature variables; the fusion subunit is used to fuse the P types of preset feature variables in the N types of feature variables to obtain Q types of new feature variables, where P and Q are positive integers; calculate the value of the fused Q type new feature variables, where the Q type new feature variables and the unfused (NP) type new feature variables are combined into M type feature variables.

[0021] According to an embodiment of the present disclosure, the discretization subunit is specifically configured to convert the continuous feature variables into discrete feature variables by adopting an equidistant binning method.

[0022] According to an embodiment of the present disclosure, the two types of feature variables that are lower than the preset threshold include first-type feature variables and second-type feature variables. The feature variable calculation unit is specifically used to calculate the value of the fused Q-type new feature variable according to a preset offset calculation method, wherein, for any of the new feature variables, the preset offset calculation rule includes: summing the value of the first-type feature variable, the value of the second-type feature variable and the preset offset to obtain the value of the bound feature variable, wherein, if the value of the first-type feature variable meets the offset addition condition, the preset offset is added, and if the value of the first-type feature variable does not meet the offset addition condition, the preset offset is not added.

[0023] According to an embodiment of the present disclosure, the preset machine learning model includes a preset clustering model, and the identification unit includes a to-be-identified point forming subunit and a clustering subunit, the to-be-identified point forming subunit is used to form the to-be-identified point based on the M type feature variables; and the clustering subunit is used to determine whether the to-be-identified point and the preset abnormal core point are within a preset neighborhood radius, wherein, when the to-be-identified point and the preset abnormal core point are within the preset neighborhood radius, the to-be-identified point is determined to be the abnormal category corresponding to the preset abnormal core point, or when the to-be-identified point and the preset abnormal core point are not within the preset neighborhood radius, the to-be-identified point is determined to be an unincluded category.

[0024] According to an embodiment of the present disclosure, the device further includes: an unincluded category maintenance module, which is used to extract and restore the characteristic variables of the unincluded category when the point to be identified is an abnormal category or an unincluded category, wherein for the new characteristic variables, restoration is performed based on the preset offset calculation rule; and record the characteristic variables of the abnormal point.

[0025] According to an embodiment of the present disclosure, the method for determining the Q-type new feature variables includes: obtaining a second transaction information set, where the second transaction information set includes K second transaction information, where K is a positive integer; based on the K second transaction information, calculating the conflict ratio values ​​between each of the N types of feature variables; sorting based on the conflict ratio values, and binding the two types of feature variables whose conflict ratio values ​​are lower than a preset threshold.

[0026] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above-mentioned transaction control method.

[0027] A fourth aspect of the present disclosure further provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the above-mentioned transaction control method.

[0028] A fifth aspect of the present disclosure further provides a computer program product, comprising a computer program, which implements the above-mentioned transaction control method when executed by a processor.

[0029] In the embodiments of the present disclosure, in order to solve the technical problems of poor transaction experience and easy misidentification, the embodiments of the present disclosure adopt a method of combining pre-transaction access verification with abnormal monitoring during transactions to identify users and control transactions. This method can greatly increase the accuracy of target identification and reduce the false alarm rate; and, when monitoring during the process, the use of machine learning models to perform automated monitoring can improve the execution efficiency and accuracy of transaction control; in addition, the transaction control method in the embodiments of the present disclosure is completely imperceptible to the user side because the logic is executed in the background, which can greatly improve the user experience and ensure the smoothness of user transaction execution. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0031] Figure 1 The following schematically shows an application scenario diagram of the transaction control method according to an embodiment of the present disclosure;

[0032] Figure 2 The flowchart of the transaction control method according to the embodiment of the present disclosure is schematically shown;

[0033] Figure 3 Schematically shows a flow chart of a pre-control method according to an embodiment of the present disclosure;

[0034] Figure 4 The flowchart of the in-process control method according to an embodiment of the present disclosure is schematically shown;

[0035] Figure 5A Schematically shows a flow chart of a dimensionality reduction method according to an embodiment of the present disclosure;

[0036] Figure 5B A schematic diagram of sorting coloring is shown schematically;

[0037] Figure 6 The flowchart of the method for clustering and identifying outliers according to an embodiment of the present disclosure is schematically shown;

[0038] Figure 7 Schematically shows a structural block diagram of a transaction control device according to an embodiment of the present disclosure; and

[0039] Figure 8 The block diagram schematically shows an electronic device suitable for implementing the transaction control method according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0040] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are merely exemplary and are not intended to limit the scope of the present disclosure. In the detailed description below, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of well-known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0041] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise," "include," etc. used herein indicate the presence of the features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0042] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0043] When expressions such as "at least one of A, B, and C, etc." are used, they should generally be interpreted in accordance with the meaning commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0044] In the technical solution of the present invention, the user information involved (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0045] In scenarios where personal information is used for automated decision-making, the methods, devices, and systems provided by embodiments of the present invention provide users with corresponding operational portals, allowing them to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The term "automated decision-making" herein refers to the activity of automatically analyzing and evaluating an individual's behavioral habits, interests, or economic, health, or credit status through computer programs and making decisions. The term "expert decision-making" herein refers to the activity of decision-making by individuals who specialize in a particular field, possess specialized experience, knowledge, and skills, and have reached a certain level of professional expertise.

[0046] Before the embodiments of the present disclosure are disclosed in detail, the key technical terms involved in the embodiments of the present disclosure are explained one by one as follows:

[0047] Correlation coefficient: The correlation coefficient is a statistic used to quantify the strength and direction of the linear relationship between two variables. Correlation coefficients are commonly calculated using methods such as the Pearson correlation coefficient, the Spearman rank correlation coefficient, and the cosine similarity.

[0048] Exclusive Feature Bundling (EFB) is a feature dimensionality reduction technique that reduces the number of features by combining mutually exclusive features into a single feature. The EFB algorithm treats features as graph vertices and connects two independent features with edges, transforming the feature bundling problem into a graph coloring problem. This approach allows the algorithm to reduce the number of features and improve computational efficiency while maintaining accuracy. Furthermore, the EFB algorithm allows for a certain degree of feature conflict, balancing accuracy and efficiency by setting a maximum conflict ratio, which provides flexibility in feature selection. Through the feature merging algorithm, the original features can be separated from the merged features, ensuring the effectiveness of the bundled features.

[0049] Density-Based Spatial Clustering of Applications with Noise (DBSCAN) is a density-based clustering algorithm that partitions areas of sufficiently high density into clusters and treats points in low-density areas as outliers or noise. The algorithm primarily involves the following steps: Parameter Definition: Two key parameters, ε (neighborhood radius) and MinPts (minimum number of points), determine the density criteria for each point. Core Point Identification: For each point, the algorithm checks whether there are at least MinPts points within the ε radius. If this condition is met, the point is considered a core point. Density Reachability: For each core point, the algorithm checks whether all points within its ε neighborhood also have at least MinPts points within their ε neighborhood. If so, these points are considered density reachable from the core point. Density Connectivity: If two points are density reachable from each other, they are considered density connected. This allows for the formation of density-connected clusters. Outlier Identification: Points that do not belong to any density-connected cluster are considered outliers or noise. Iterative process: Repeat the above steps until all points are classified as core points, boundary points or outliers. Result output: Finally, the DBSCAN algorithm outputs the clustering results and a list of outliers.

[0050] Relevant risk control systems have detected a large number of abnormal transactions that utilize automated tools to conduct malicious activities such as online promotions and cash-outs, aiming to gain financial benefits. This behavior is difficult to intercept in real time and is often mitigated through post-event analysis. At the start of a promotion, attackers use automated tools to rapidly log in to multiple accounts from multiple locations and participate in the promotion, reaping high profits at a minimal cost. However, legitimate users often miss out on promotional offers due to server overloads or slower participation than automated tools, significantly reducing the effectiveness of marketing promotions. To combat automated tools, more complex manual processes, such as facial recognition and complex verification codes, are the only viable approach. To ensure legitimate users and prevent illicit traffic and server resources from being consumed by these activities, a significant number of operations and maintenance personnel are required to constantly monitor traffic and manually block and throttle transactions. This ultimately leads to untimely responses and a high number of false positives. Therefore, there is an urgent need to improve the identification of malicious fraudulent users and improve resource allocation efficiency.

[0051] In order to solve the technical problems existing in the prior art, an embodiment of the present disclosure provides a transaction control method, which includes: receiving first transaction information submitted by a user; executing a pre-verification rule based on the first transaction information to determine whether to release the first transaction information, so as to execute the corresponding current transaction based on the first transaction information; when the current transaction is executed, executing an in-process monitoring rule to determine whether the current transaction has abnormal behavior, wherein the in-process monitoring rule includes monitoring transaction behavior characteristic variables generated during the transaction process based on a preset machine learning model; and terminating the current transaction when the preset machine learning model determines that the current transaction has abnormal behavior.

[0052] In the embodiments of the present disclosure, in order to solve the technical problems of poor transaction experience and easy misidentification, the embodiments of the present disclosure adopt a method of combining pre-transaction access verification with abnormal monitoring during transactions to identify users and control transactions. This method can greatly increase the accuracy of target identification and reduce the false alarm rate; and, when monitoring during the process, the use of machine learning models to perform automated monitoring can improve the execution efficiency and accuracy of transaction control; in addition, the transaction control method in the embodiments of the present disclosure is completely imperceptible to the user side because the logic is executed in the background, which can greatly improve the user experience and ensure the smoothness of user transaction execution.

[0053] Figure 1 The application scenario diagram of the transaction control method according to an embodiment of the present disclosure is schematically shown.

[0054] like Figure 1 As shown, the application scenario 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 is used as a medium for providing a communication link between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired or wireless communication links or optical fiber cables.

[0055] Users can use terminal devices 101, 102, and 103 to interact with server 105 via network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, and 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only as examples).

[0056] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0057] Server 105 may be a server that provides various services, such as a background management server (for example only) that supports websites browsed by users using terminal devices 101, 102, and 103. The background management server may analyze and process received data such as user requests, and feed back processing results (e.g., web pages, information, or data obtained or generated based on user requests) to the terminal device.

[0058] It should be noted that the transaction control method provided in the embodiments of the present disclosure can generally be executed by the server 105. Accordingly, the transaction control device provided in the embodiments of the present disclosure can generally be located in the server 105. The transaction control method provided in the embodiments of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and that is capable of communicating with the terminal devices 101, 102, 103 and / or the server 105. Accordingly, the transaction control device provided in the embodiments of the present disclosure can also be located in a server or server cluster that is different from the server 105 and that is capable of communicating with the terminal devices 101, 102, 103 and / or the server 105.

[0059] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0060] The following will be based on Figure 1 The scene described by Figures 2 to 6 The transaction control method of the disclosed embodiment is described in detail.

[0061] Figure 2 The flowchart of the transaction control method according to the embodiment of the present disclosure is schematically shown.

[0062] like Figure 2 As shown, the transaction control method of this embodiment includes operations S210 to S240 , and the transaction control method can be executed by the server 105 .

[0063] In operation S210, first transaction information submitted by a user is received.

[0064] Receive first transaction information sent by the user to identify the user, where the first transaction information includes: mobile device information (such as device model, IP address, and mobile phone system model), APP information (such as version number), and customer information (such as customer number and mobile phone number).

[0065] In operation S220 , a pre-verification rule is executed based on the first transaction information to determine whether to release the first transaction information, so as to execute the corresponding current transaction based on the first transaction information.

[0066] The backend verifies the user's identity using the first transaction information to determine if the user is legitimate. For example, the first transaction information can be used to determine if the user's identity verification is valid, thereby confirming the user's legitimacy. Alternatively, a blacklist / whitelist can be used to determine if the user is a legitimate user as verified by the backend. Subsequent transactions are initiated only if the user passes the pre-verification and is legitimate.

[0067] Figure 3 The flowchart of the advance control method according to the embodiment of the present disclosure is schematically shown.

[0068] like Figure 3 As shown, the pre-control method of this embodiment includes operations S310 to S320, and the operations S310 to S320 can at least partially execute the above-mentioned operation S220.

[0069] In operation S310, it is determined whether the first transaction information exists in a preset blacklist.

[0070] In operation S320 , if the first transaction information does not exist in the preset blacklist, the current transaction corresponding to the first transaction information is released.

[0071] For example, if the mobile device information, app information, and customer information do not appear on the preset blacklist, the user's identity is determined to be valid and not on the blacklist, and the transaction is allowed. This allows for subsequent monitoring of the user's abnormal behavior during the transaction process. The preset blacklist can eliminate a large number of users and devices with abnormal behavior.

[0072] In operation S230, when the current transaction is executed, the in-process monitoring rules are executed to determine whether the current transaction has abnormal behavior, wherein the in-process monitoring rules include monitoring the transaction behavior characteristic variables generated during the transaction process based on a preset machine learning model.

[0073] The preset machine learning model includes a supervised learning model and an unsupervised learning model. For the supervised learning model, a pre-trained supervised learning model can be used to determine whether abnormal behavior has occurred based on certain transaction-related data collected from user transactions. For example, data on abnormal behavior and corresponding abnormality labels are prepared in advance to pre-train the model. Subsequently, the model outputs whether there is an abnormality based on the existing transaction behavior. For the unsupervised learning model, certain transaction-related data collected from user transactions can be used to determine whether abnormal behavior has occurred. For example, existing transaction behaviors can be clustered to determine whether they are in a cluster with historical abnormal transaction behaviors.

[0074] Figure 4 The flowchart of the in-process control method according to an embodiment of the present disclosure is schematically shown.

[0075] like Figure 4 As shown, the in-process control method of this embodiment includes operations S410 to S430, and the operations S410 to S430 can at least partially execute the above-mentioned operation S230.

[0076] In operation S410, second transaction information is obtained, where the second transaction information includes N types of feature variables, where N is a positive integer.

[0077] Specifically, the second transaction information is more comprehensive than the first transaction information. The second transaction information adds the user's transaction data on the basis of the first transaction information. The second transaction information includes: mobile device information, APP information, customer information and transaction information (for example, time, merchant, payment card, amount, order number).

[0078] In an embodiment of the present disclosure, the user's consent or authorization may be obtained before obtaining the user's second transaction information. For example, before operation S410, a request to obtain the second transaction information may be issued to the user. If the user consents or authorizes obtaining the user information, operation S410 is performed.

[0079] In the embodiments of the present disclosure, a corresponding operation portal can be provided for the user to choose to agree or reject the automated decision result. That is, before the user information is processed / decided, an instruction to agree or reject the processing / decision can be obtained from the user through the corresponding operation portal. If the user agrees to the processing / decision, the user information is processed / decided. If the user rejects the processing / decision, the expert decision process is entered.

[0080] In operation S420, the N types of feature variables are reduced in dimension to M types of feature variables, where M is a positive integer less than or equal to N.

[0081] The dimensionality reduction method includes: deleting multiple feature categories that are irrelevant or insensitive to abnormal classification, and / or combining multiple feature categories that are irrelevant or insensitive to abnormal classification into new feature categories.

[0082] According to an embodiment of the present disclosure, the N types of feature variables include continuous feature variables and discrete feature variables.

[0083] Specifically, due to the different data characteristics of feature variables of different categories, the N categories of feature variables include continuous feature variables and discrete feature variables.

[0084] A continuous feature variable is one that can take any possible value within a certain interval. This means there are no "gaps" between the minimum and maximum values, and the data points can be infinitely subdivided. For example, a transaction amount of 10 yuan or 15.3 yuan is a continuous feature variable. A discrete feature variable is one that can only take specific values. That is, it is composed of countable individuals or objects, with clear intervals between these values. For example, male gender is 1, and female gender is 0. These are discrete feature variables.

[0085] Figure 5A The flowchart of the dimensionality reduction method according to an embodiment of the present disclosure is schematically shown.

[0086] like Figure 5A As shown, the dimensionality reduction method of this embodiment includes operations S510 to S530, and the operations S510 to S530 can at least partially perform the above-mentioned operation S420.

[0087] In operation S510 , the continuous feature variables in the N types of feature variables are converted into discrete feature variables.

[0088] In order to facilitate subsequent calculations, all continuous feature variables need to be discretized, and the conversion can be carried out using various types of binning methods.

[0089] According to an embodiment of the present disclosure, converting the continuous feature variables in the N types of feature variables into discrete feature variables includes: converting the continuous feature variables into discrete feature variables by adopting an equidistant binning method.

[0090] Specifically, equal-interval binning is a method of binning or grouping data by dividing the data into several equal-width intervals or bins. The width of each bin is the same, but the number of bins can be predetermined or determined based on the data distribution. For example, if the continuous amount data is 33 yuan, the equal-interval binning rule is pre-set: (0-50 yuan) is the discrete data 0, (51-100) is 1, and so on, then the discrete data is converted to 0.

[0091] In a typical scenario, the acquired second transaction information is assumed to contain seven feature variables, x1, x2, x3, x4, x5, x6, and x7. x1, x2, x3, x4, x5, x6, and x7 are: transaction time difference, transaction amount, mobile phone type, mobile phone system model, mobile phone number, merchant, and payment card, respectively. Specifically, Table 1 schematically illustrates the raw values ​​of various feature variables for multiple different pieces of second transaction information, as shown below:

[0092] Table 1

[0093]

[0094] As shown in Table 1, the feature attributes are divided into two categories: continuous features and discrete features. Among them, x1 and x2 are continuous data, and x3, x4, x5, x6, and x7 are discrete data. Therefore, the continuous feature variables x1 and x2 are equally spaced and binned to form y1 and y2. For the non-numeric discrete data x3, x4, x5, x6, and x7, they can be directly converted. The converted data is shown in Table 2 below:

[0095] Table 2

[0096]

[0097] In Table 2, all characteristic variable data have been converted into discrete data, and data operations can be performed based on the discrete data subsequently.

[0098] In operation S520 , P types of preset feature variables in the N types of feature variables are merged to obtain Q types of new feature variables, where P and Q are positive integers. Here, M=N-(PQ).

[0099] Select pre-defined types of fusionable feature vectors and perform the fusion. This fusion process can be performed on pairs of features or on more than two features. In a typical scenario, if the features to be fused are x3 and x4, the new fused feature variables are x3 & x4. The selection of feature variables to be fused can be implemented in advance using exclusive feature binding (EFB), as shown below:

[0100] According to an embodiment of the present disclosure, the method for determining the Q-type new feature variables includes: obtaining a second transaction information set, where the second transaction information set includes K second transaction information, where K is a positive integer; based on the K second transaction information, calculating the conflict ratio values ​​between each of the N types of feature variables; sorting based on the conflict ratio values, and binding the two types of feature variables whose conflict ratio values ​​are lower than a preset threshold.

[0101] Calculate the conflict ratio (or non-mutually exclusive ratio) between each pair of feature variables. When two features exhibit non-mutually exclusive behavior and simultaneously take non-zero values, they are considered to be in conflict; a larger conflict ratio indicates a lower degree of mutual exclusion. For example, the conflict ratio between x3 and x4 is 0.4. This conflict ratio can be calculated using various correlation coefficients. It is understood that when determining new feature variables, to ensure the reliability of the correlation coefficient calculation data, multiple pieces of second transaction information can be obtained. Therefore, a dataset similar to the one in Table 2 above can be used to determine the new feature variables.

[0102] In a typical scenario, as shown in Table 2 above, after calculating the conflict ratio for each data in Table 2 above, the values ​​of the conflict ratio between each feature variable are shown in Table 3 below:

[0103] Table 3

[0104]

[0105] According to the information in Table 3, sort and color the features, connect them according to the feature conflicts, calculate the total value of feature conflicts, and color them according to the results. Figure 5B A schematic diagram of sorting coloring is shown schematically. Figure 5B As shown in the figure, assuming that the maximum conflict ratio threshold is 0.3, no connection is made if the conflict ratio is lower than 0.3. x5 has the most connections and is colored red. The number of connections of y1, y2 and x6 features is the same, followed by x4 and x7, and x3 has the least number of connections. Figure 5B As shown in Table 3, the features are bundled. From the above analysis, we can see that x3 has the least connections and the (x3, x4) conflict ratio is the lowest at 0.14. Therefore, x3 and x4 are bundled, and x4 is used as the main feature.

[0106] In operation S530 , the value of the fused Q-type new feature variable is calculated, wherein the Q-type new feature variable and the unfused (NP)-type new feature variable are combined into an M-type feature variable.

[0107] After fusion, the value of the new feature variable can be fused in any form, such as accumulation, multiplication, etc. In the embodiment of the present disclosure, considering the later feature restoration and tracing, the calculation of the value after feature fusion is realized by adding an offset in special cases, as shown below:

[0108] According to an embodiment of the present disclosure, the new feature variables include the first category feature variables before fusion and the second category feature variables before fusion, and the calculation of the value of the Q-category new feature variables after fusion includes: calculating the value of the Q-category new feature variables after fusion according to a preset offset calculation method, wherein, for any of the new feature variables, the preset offset calculation rule includes: obtaining the value of the bound feature variable based on the sum of the value of the first category feature variable, the value of the second category feature variable and the preset offset, wherein, if the value of the first category feature variable meets the offset addition condition, the preset offset is added, and if the value of the first category feature variable does not meet the offset addition condition, the preset offset is not added.

[0109] The offset addition conditions include: when the first-category feature variable or the second-category feature variable is a specific value, the corresponding offset is applied. For example, when the interval of the first-category feature variable is 0, 1, or 2, and the interval of the second-category feature variable is 0, 1, 2, or 4, when the first-category feature variable is 0, the offset is not increased or decreased, and the sum is directly calculated; when the first-category feature variable is 1, the offset is increased by 1 times, and this offset is based on the interval of the second-category feature variable and must be at least greater than 4 to achieve the purpose of differentiation; when the first-category feature variable is 2, the offset is increased by 2 times.

[0110] Specifically, in the process of summing up the feature variables pairwise, the above-mentioned offset addition rule or condition can be used to ensure that each data is unique. When tracing the source, the offset rule can be used to split it into specific values ​​of two feature vectors.

[0111] In a typical scenario, as shown in Table 2 above, the values ​​of the fused features are as shown in Table 4 below:

[0112] Table 4

[0113]

[0114] When bundling features, considering the need to restore the feature values ​​later, the value range of the main feature x4 in Table 2 is [0, 6], so the maximum offset is set to 6. All non-zero values ​​of x3 are added to the offset and then added to x4 to obtain the bundled feature value. Combining the values ​​in Tables 2 and 4, when x3 is 0, the fused value does not have an offset added, that is, only the sum of x3 and x4 is calculated; when x3 is 1, the fused value has an offset of 6 added, that is, after calculating the sum of x3 and x4, an offset of 6 is added.

[0115] In operation S430, based on the M types of feature variables, a recognition result is output through the preset machine learning model.

[0116] After obtaining M feature data, the data is normalized, that is, all feature values ​​are converted to the same scale to ensure comparability and uniformity between the data. In the embodiments of the present disclosure, deviation normalization can be used, such as forward calculation or reverse calculation, to ensure that the data conversion value is in the interval [0,1].

[0117] After the data is reduced in dimensionality, the data of the M-type feature variables after dimensionality reduction can be used as the input of the preset machine learning model, and the recognition results are output through the machine learning model.

[0118] According to an embodiment of the present disclosure, the preset machine learning model includes a preset clustering model.

[0119] Specifically, considering the timeliness and computing power requirements for monitoring transaction behavior in promotional scenarios, a clustering model is used to identify transactions, as shown below:

[0120] Figure 6 The flowchart of the method for clustering and identifying outliers according to an embodiment of the present disclosure is schematically shown.

[0121] like Figure 6 As shown, the clustering outlier identification method of this embodiment includes operations S610 to S620, and the operations S610 to S620 can at least partially perform the above-mentioned operation S430.

[0122] In operation S610 , points to be identified are formed based on the M types of feature variables.

[0123] In operation S620, it is determined whether the point to be identified and the preset abnormal core point are within a preset neighborhood radius, wherein, when the point to be identified and the preset abnormal core point are within the preset neighborhood radius, the point to be identified is determined to be the abnormal category corresponding to the preset abnormal core point, or when the point to be identified and the preset abnormal core point are not within the preset neighborhood radius, the point to be identified is determined to be an unincluded category.

[0124] In this preset clustering model, each point in the historical data (i.e., the historical data after the dimensionality reduction of the second transaction information) has been classified according to the corresponding clustering algorithm. The historical data has been classified into multiple clusters, each of which corresponds to a corresponding type. Using the current M-type feature variables as input, the point to be classified is checked to see which cluster it falls into, thereby determining the type of the current transaction behavior.

[0125] Specifically, in the embodiments of the present disclosure, DBSCAN can be used as a preset clustering model to discover clusters of arbitrary shapes through DBSCAN and perform transaction blocking. The clustering process of DBSCAN is as follows:

[0126] (1) For a second transaction information (denoted as Fi) in the historical data, select any sample point Fi, calculate the distance between Fi and all samples, select the distance of the kth nearest neighbor and sort it from large to small, and obtain the k-distance curve. The distance corresponding to the inflection point of the curve is set to ε. Sample points with a kth nearest neighbor distance value less than ε are classified as clusters, and sample points with a distance value greater than ε are classified as noise points.

[0127] (2) Return the set of points whose distance is less than ε, find all density-reachable points, and form the current processing point NE(p).

[0128] (3) Determine whether the currently processed point is a core object. If the point is a core object (i.e., the number of points contained in the given neighborhood NE(p) is at least MinPts (the minimum number of points contained in the given neighborhood NE(p)), then cluster the point and the points contained in NE(p). If the point is not a core point, continue to access other points in the dataset.

[0129] Repeating the above steps can create multiple clusters, allowing for manual identification of normal and abnormal clusters. Subsequent anomaly detection is performed by determining whether the point corresponding to the current transaction is within an abnormal cluster (determined by whether it is within the neighborhood radius). If so, the transaction is considered abnormal. If it is in another cluster, it is not considered abnormal. If it is an outlier, it is not handled for now and is reported for subsequent manual analysis and processing.

[0130] According to an embodiment of the present disclosure, after outputting the recognition result based on the M-category feature variables through the input of the preset machine learning model, it also includes: when the point to be identified is an abnormal category or an unincluded category, extracting and restoring the feature variables of the unincluded category, wherein, for the new feature variables, restoration is performed based on the preset offset calculation rule; and recording the feature variables of the abnormal point.

[0131] By analyzing the data of customers who engage in malicious order-padding, we can understand which products or services are vulnerable to attacks, optimize risk control strategies, and improve product quality and security.

[0132] In operation S240, if the preset machine learning model determines that the current transaction has abnormal behavior, the current transaction is terminated.

[0133] For the identified abnormal points, measures to terminate the current transaction are taken.

[0134] In the embodiments of the present disclosure, in order to solve the technical problems of poor transaction experience and easy misidentification, the embodiments of the present disclosure adopt a method of combining pre-transaction access verification with abnormal monitoring during transactions to identify users and control transactions. This method can greatly increase the accuracy of target identification and reduce the false alarm rate; and, when monitoring during the process, the use of machine learning models to perform automated monitoring can improve the execution efficiency and accuracy of transaction control; in addition, the transaction control method in the embodiments of the present disclosure is completely imperceptible to the user side because the logic is executed in the background, which can greatly improve the user experience and ensure the smoothness of user transaction execution.

[0135] Based on the above transaction control method, the present disclosure also provides a transaction control device. Figure 7 The device is described in detail.

[0136] Figure 7 The structural block diagram of the transaction control device according to an embodiment of the present disclosure is schematically shown.

[0137] like Figure 7 As shown, the transaction control device 700 of this embodiment includes a receiving module 710 , a pre-verification module 720 , an in-process monitoring module 730 and a transaction control module 740 .

[0138] The receiving module 710 is used to receive the first transaction information sent by the user. In one embodiment, the receiving module 710 can be used to perform the operation S210 described above, which will not be repeated here.

[0139] Pre-verification module 720 is configured to execute pre-verification rules based on the first transaction information to determine whether to approve the first transaction information, thereby executing the corresponding current transaction based on the first transaction information. In one embodiment, pre-verification module 720 can be configured to execute operation S220 described above, which will not be further described here.

[0140] During-transaction monitoring module 730 is configured to execute during-transaction monitoring rules during the execution of the current transaction to determine whether the current transaction exhibits abnormal behavior. The during-transaction monitoring rules include monitoring transaction behavior characteristic variables generated during the transaction process based on a preset machine learning model. In one embodiment, during-transaction monitoring module 730 may be configured to execute operation S230 described above, and will not be further described here.

[0141] The transaction control module 740 is configured to terminate the current transaction if the preset machine learning model determines that the current transaction exhibits abnormal behavior. In one embodiment, the transaction control module 740 may be configured to execute operation S240 described above, which will not be described in detail herein.

[0142] In the embodiments of the present disclosure, in order to solve the technical problems of poor transaction experience and easy misidentification, the embodiments of the present disclosure adopt a method of combining pre-transaction access verification with abnormal monitoring during transactions to identify users and control transactions. This method can greatly increase the accuracy of target identification and reduce the false alarm rate; and, when monitoring during the process, the use of machine learning models to perform automated monitoring can improve the execution efficiency and accuracy of transaction control; in addition, the transaction control method in the embodiments of the present disclosure is completely imperceptible to the user side because the logic is executed in the background, which can greatly improve the user experience and ensure the smoothness of user transaction execution.

[0143] According to an embodiment of the present disclosure, the pre-verification module includes: a blacklist judgment unit and a transaction release unit, the blacklist judgment unit is used to judge whether the first transaction information exists in a preset blacklist; and the transaction release unit is used to release the current transaction corresponding to the first transaction information if the first transaction information does not exist in the preset blacklist.

[0144] According to an embodiment of the present disclosure, the in-process monitoring module includes: a second transaction information acquisition unit, a dimensionality reduction unit and an identification unit, the second transaction information acquisition unit is used to obtain second transaction information, the second transaction information includes N types of feature variables, N is a positive integer; the dimensionality reduction unit is used to reduce the N types of feature variables to M types of feature variables, M is a positive integer less than or equal to N; and the identification unit is used to output an identification result based on the M types of feature variables through the preset machine learning model.

[0145] According to an embodiment of the present disclosure, the N types of feature variables include continuous feature variables and discrete feature variables, and the dimensionality reduction unit includes: a discretization subunit and a fusion subunit, the discretization subunit is used to convert the continuous feature variables in the N types of feature variables into discrete feature variables; the fusion subunit is used to fuse the P types of preset feature variables in the N types of feature variables to obtain Q types of new feature variables, where P and Q are positive integers; calculate the value of the fused Q type new feature variables, where the Q type new feature variables and the unfused (NP) type new feature variables are combined into M type feature variables.

[0146] According to an embodiment of the present disclosure, the discretization subunit is specifically configured to convert the continuous feature variables into discrete feature variables by adopting an equidistant binning method.

[0147] According to an embodiment of the present disclosure, the two types of feature variables that are lower than the preset threshold include first-type feature variables and second-type feature variables. The feature variable calculation unit is specifically used to calculate the value of the fused Q-type new feature variable according to a preset offset calculation method, wherein, for any of the new feature variables, the preset offset calculation rule includes: summing the value of the first-type feature variable, the value of the second-type feature variable and the preset offset to obtain the value of the bound feature variable, wherein, if the value of the first-type feature variable meets the offset addition condition, the preset offset is added, and if the value of the first-type feature variable does not meet the offset addition condition, the preset offset is not added.

[0148] According to an embodiment of the present disclosure, the preset machine learning model includes a preset clustering model, and the identification unit includes a to-be-identified point forming subunit and a clustering subunit, the to-be-identified point forming subunit is used to form the to-be-identified point based on the M type feature variables; and the clustering subunit is used to determine whether the to-be-identified point and the preset abnormal core point are within a preset neighborhood radius, wherein, when the to-be-identified point and the preset abnormal core point are within the preset neighborhood radius, the to-be-identified point is determined to be the abnormal category corresponding to the preset abnormal core point, or when the to-be-identified point and the preset abnormal core point are not within the preset neighborhood radius, the to-be-identified point is determined to be an unincluded category.

[0149] According to an embodiment of the present disclosure, the device further includes: an unincluded category maintenance module, which is used to extract and restore the characteristic variables of the unincluded category when the point to be identified is an abnormal category or an unincluded category, wherein for the new characteristic variables, restoration is performed based on the preset offset calculation rule; and record the characteristic variables of the abnormal point.

[0150] According to an embodiment of the present disclosure, the method for determining the Q-type new feature variables includes: obtaining a second transaction information set, where the second transaction information set includes K second transaction information, where K is a positive integer; based on the K second transaction information, calculating the conflict ratio values ​​between each of the N types of feature variables; sorting based on the conflict ratio values, and binding the two types of feature variables whose conflict ratio values ​​are lower than a preset threshold.

[0151] According to embodiments of the present disclosure, any multiple modules among the receiving module 710, the pre-verification module 720, the in-process monitoring module 730, and the transaction control module 740 may be combined into a single module, or any one of these modules may be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules may be combined with at least part of the functionality of other modules and implemented in a single module. According to embodiments of the present disclosure, at least one of the receiving module 710, the pre-verification module 720, the in-process monitoring module 730, and the transaction control module 740 may be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or may be implemented in hardware or firmware through any other reasonable means of circuit integration or packaging, or may be implemented in any one of software, hardware, and firmware, or any appropriate combination of these. Alternatively, at least one of the receiving module 710 , the pre-verification module 720 , the in-process monitoring module 730 and the transaction control module 740 may be at least partially implemented as a computer program module, which may perform corresponding functions when executed.

[0152] Figure 8 The block diagram schematically shows an electronic device suitable for implementing the transaction control method according to an embodiment of the present disclosure.

[0153] like Figure 8 As shown, the electronic device 800 according to an embodiment of the present disclosure includes a processor 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 802 or a program loaded from a storage unit 808 into a random access memory (RAM) 803. The processor 801 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 801 may also include onboard memory for caching purposes. The processor 801 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0154] Various programs and data required for the operation of the electronic device 800 are stored in the RAM 803. The processor 801, ROM 802, and RAM 803 are connected to each other via a bus 804. The processor 801 executes the various operations of the method flow according to the embodiment of the present disclosure by executing the programs in the ROM 802 and / or RAM 803. It should be noted that the programs may also be stored in one or more memories other than the ROM 802 and RAM 803. The processor 801 may also execute the various operations of the method flow according to the embodiment of the present disclosure by executing the programs stored in the one or more memories.

[0155] According to an embodiment of the present disclosure, electronic device 800 may further include an input / output (I / O) interface 805, which is also connected to bus 804. Electronic device 800 may also include one or more of the following components connected to I / O interface 805: an input section 806 including a keyboard, mouse, etc.; an output section 807 including devices such as a cathode ray tube (CRT), liquid crystal display (LCD), and speakers; a storage section 808 including a hard disk; and a communication section 809 including a network interface card such as a LAN card or modem. Communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to I / O interface 805 as needed. Removable media 811, such as a magnetic disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed in drive 810 as needed, so that computer programs read from the removable media can be installed into storage section 808 as needed.

[0156] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments, or may exist independently and not be incorporated into the device / apparatus / system. The computer-readable storage medium carries one or more programs, and when executed, implements the method according to the embodiments of the present disclosure.

[0157] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, and may include, for example, but not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 802 and / or RAM 803 described above, and / or one or more memories other than ROM 802 and RAM 803.

[0158] The embodiments of the present disclosure also include a computer program product, which includes a computer program containing program code for executing the method shown in the flowchart. When the computer program product is executed in a computer system, the program code is used to cause the computer system to implement the item recommendation method provided by the embodiments of the present disclosure.

[0159] The computer program executes the above functions defined in the system / device of the embodiment of the present disclosure when the computer program is executed by the processor 801. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0160] In one embodiment, the computer program may be stored on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may be transmitted and distributed in the form of a signal on a network medium, downloaded and installed via the communication portion 809, and / or installed from a removable medium 811. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to wireless, wired, or any suitable combination thereof.

[0161] In such an embodiment, the computer program can be downloaded and installed from a network via the communication section 809, and / or installed from a removable medium 811. When the computer program is executed by the processor 801, the above-described functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the systems, devices, means, modules, units, etc. described above can be implemented by computer program modules.

[0162] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, languages ​​such as Java, C++, Python, "C" or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In cases involving a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect via the Internet).

[0163] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the above-mentioned module, program segment, or a part of code contains one or more executable instructions for implementing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0164] Those skilled in the art will appreciate that the features described in the various embodiments and / or claims of this disclosure may be combined and / or coupled in various ways, even if such combinations and / or couplings are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this disclosure may be combined and / or coupled in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or couplings are intended to fall within the scope of this disclosure.

[0165] The embodiments of the present disclosure are described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although each embodiment has been described separately above, this does not mean that the measures in each embodiment cannot be used in combination to advantage. The scope of the present disclosure is defined by the appended claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make various substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A transaction control method, characterized in that: The method comprises: Receiving the first transaction information sent by the user; executing a pre-verification rule based on the first transaction information to determine whether to release the first transaction information, so as to execute a corresponding current transaction based on the first transaction information; When the current transaction is executed, executing in-process monitoring rules to determine whether the current transaction exhibits abnormal behavior, wherein the in-process monitoring rules include monitoring transaction behavior characteristic variables generated during the transaction process based on a preset machine learning model; and If the preset machine learning model determines that the current transaction has abnormal behavior, terminate the current transaction.

2. The method according to claim 1, characterized in that The executing a pre-verification rule based on the first transaction information to determine whether to release the first transaction information, so as to execute a corresponding current transaction based on the first transaction information, includes: Determining whether the first transaction information exists in a preset blacklist; and When the first transaction information does not exist in the preset blacklist, the current transaction corresponding to the first transaction information is released.

3. The method according to claim 1 or 2, characterized in that When the current transaction is executed, executing the in-process monitoring rules to determine whether the current transaction has abnormal behavior includes: Acquire second transaction information, where the second transaction information includes N types of characteristic variables, where N is a positive integer; Reduce the dimension of the N-type feature variables to M-type feature variables, where M is a positive integer less than or equal to N; and Based on the M types of feature variables, the recognition result is output through the preset machine learning model.

4. The method according to claim 3, characterized in that The N types of feature variables include continuous feature variables and discrete feature variables. The reducing the dimension of the N-type feature variables to M-type feature variables includes: Converting the continuous feature variables in the N types of feature variables into discrete feature variables; Fusing P types of preset feature variables among the N types of feature variables to obtain Q types of new feature variables, where P and Q are positive integers; Calculate the value of the fused Q-type new feature variable, where the Q-type new feature variable and the unfused (NP)-type new feature variable are combined into the M-type feature variable.

5. The method according to claim 4, characterized in that The converting the continuous feature variables in the N types of feature variables into discrete feature variables includes: The continuous feature variables are converted into discrete feature variables by adopting the method of equal interval binning.

6. The method according to claim 4, characterized in that The new feature variables include the first type of feature variables before fusion and the second type of feature variables before fusion, The calculation of the value of the new Q-type feature variable after fusion includes: According to the preset offset calculation method, the value of the fused Q-type new feature variable is calculated, wherein, for any of the new feature variables, the preset offset calculation rule includes: Based on the sum of the value of the first-category feature variable, the value of the second-category feature variable and the preset offset, the value of the bound feature variable is obtained, wherein if the value of the first-category feature variable meets the offset adding condition, the preset offset is added, and if the value of the first-category feature variable does not meet the offset adding condition, the preset offset is not added.

7. The method according to claim 6, characterized in that The preset machine learning model includes a preset clustering model, The outputting of the recognition result based on the M type feature variables through the preset machine learning model includes: Based on the M types of characteristic variables, forming points to be identified; and Determine whether the point to be identified and the preset abnormal core point are within a preset neighborhood radius, Wherein, when the point to be identified and the preset abnormal core point are within the preset neighborhood radius, the point to be identified is determined to be the abnormal category corresponding to the preset abnormal core point; or when the point to be identified and the preset abnormal core point are not within the preset neighborhood radius, the point to be identified is determined to be an unincluded category. Wherein, when the point to be identified is in a preset abnormal behavior category, it is determined to be an abnormal point; or when the point to be identified is in an abnormal category or an unrecorded category, it is determined to be an abnormal point.

8. The method according to claim 7, characterized in that After outputting the recognition result based on the M types of feature variables and through the input of the preset machine learning model, the method further includes: In the case where the point to be identified is an abnormal category or an unincluded category, extracting and restoring the characteristic variables of the unincluded category, wherein the restoration is performed based on the preset offset calculation rule for the new characteristic variables; and The characteristic variables of the abnormal points are recorded.

9. The method according to any one of claims 4 to 8, characterized in that The method for determining the Q-type new characteristic variables includes: Obtain a second transaction information set, where the second transaction information set includes K pieces of second transaction information, where K is a positive integer; Calculating conflict ratios between any two of the N types of feature variables based on the K pieces of second transaction information; Sorting is performed based on the conflict ratio values, and two types of feature variables whose conflict ratio values ​​are lower than a preset threshold are bound.

10. A transaction control device, characterized in that: The device comprises: A receiving module, configured to receive first transaction information sent by a user; a pre-verification module, configured to execute a pre-verification rule based on the first transaction information to determine whether to release the first transaction information, so as to execute a corresponding current transaction based on the first transaction information; an in-process monitoring module, configured to execute in-process monitoring rules during the execution of the current transaction to determine whether the current transaction exhibits abnormal behavior, wherein the in-process monitoring rules include monitoring transaction behavior characteristic variables generated during the transaction process based on a preset machine learning model; and A transaction control module is used to terminate the current transaction when the preset machine learning model determines that the current transaction has abnormal behavior.

11. An electronic device comprising: one or more processors; a storage device for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 9.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

13. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

Images