Abnormal account detection method and related device

Abstract

The invention discloses an abnormal account detection method and a related device, and relates to the field of computers, and the method comprises the steps: obtaining the multi-dimensional information of a to-be-detected account, extracting the features of the to-be-detected account from the multi-dimensional information, inputting the features of the to-be-detected account into a pre-trained Bayesian neural network detection model, and predicting an abnormal probability value that the to-be-detected account is an abnormal account and a confidence coefficient of the abnormal probability value, and determining whether the to-be-detected account is an abnormal account according to a size relationship between the abnormal probability value and a probability threshold value and a size relationship between the confidence coefficient and a confidence coefficient threshold value. According to the method, anomaly detection is carried out based on the multi-dimensional information of the to-be-detected account, and compared with a traditional single-dimensional detection method, the false alarm rate is effectively reduced; the abnormal probability value that the to-be-detected account is an abnormal account and the confidence corresponding to the abnormal probability value are predicted through the Bayesian neural network detection model, so that the recognition capability of a novel variation fraud means is improved, a complex association type fraud mode can be effectively dealt with, and the occurrence of missing detection conditions is reduced.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and more particularly to an abnormal account detection method and related devices. Background Art

[0002] Bank accounts are the core hub of capital flow, and detecting abnormal accounts has become a crucial line of defense against telecom fraud. Traditional detection methods rely on rule engines and static blacklist mechanisms, triggering alerts through pre-set transaction amount limits, non-business hour transaction monitoring, and simple behavioral feature matching (such as transaction frequency and sudden changes in IP / device location).

[0003] However, this type of method has obvious limitations - its core relies on single-dimensional data analysis, focusing only on isolated indicators such as transaction frequency and geographic location mutations, resulting in a high false alarm rate; at the same time, in the face of new types of variant fraud methods, the recognition ability is obviously insufficient, and it is difficult to deal with complex related fraud patterns (such as gang crimes and multi-layer nested capital chains), resulting in an increase in the missed detection rate. Summary of the Invention

[0004] In view of this, the present invention discloses an abnormal account detection method and related devices to effectively reduce the false alarm rate, improve the ability to identify new and variant fraud methods, and reduce the occurrence of missed detections.

[0005] A method for detecting abnormal accounts, comprising:

[0006] Obtain multi-dimensional information of the account to be tested;

[0007] Extracting features of the account to be detected from the multi-dimensional information;

[0008] Inputting the features of the account to be detected into a pre-trained Bayesian neural network detection model to predict the abnormal probability value of the account to be detected as an abnormal account and the confidence level of the abnormal probability value;

[0009] Whether the account to be detected is an abnormal account is determined based on the relationship between the abnormal probability value and the probability threshold, and the relationship between the confidence level and the confidence threshold.

[0010] Optionally, extracting the features of the account to be detected from the multi-dimensional information includes:

[0011] Extracting static features from the static data of the multi-dimensional information using a sparse autoencoder;

[0012] Extracting dynamic features from the dynamic data of the multi-dimensional information using a spatiotemporal graph neural network;

[0013] The static features and the dynamic features are fused to obtain the features of the account to be detected.

[0014] Optionally, the static data includes: account attributes and device information;

[0015] The dynamic data includes: transaction behavior and social network topology, and the social network topology includes: capital flow graph and geographic location sequence.

[0016] Optionally, the training process of the Bayesian neural network detection model includes:

[0017] Construct multiple multi-dimensional account dynamic profiles based on historical account information, each of which corresponds to multi-dimensional information of an account, wherein the multi-dimensional information is multi-dimensional information of historical abnormal accounts or multi-dimensional information of historical normal accounts;

[0018] Extracting abnormal account features from the multi-dimensional information of historical abnormal accounts, and extracting normal account features from the multi-dimensional information of historical normal accounts;

[0019] The abnormal account features and the normal account features are used together as training samples, and the label types corresponding to the abnormal account features and the normal account features are used as sample labels to train the Bayesian neural network to obtain the Bayesian neural network detection model, wherein the label types include: abnormal labels and normal labels.

[0020] Optionally, extracting abnormal account features from the multi-dimensional information of historical abnormal accounts, and extracting normal account features from the multi-dimensional information of historical normal accounts, includes:

[0021] A sparse autoencoder is used to extract a first static feature from the static data of the multi-dimensional information of the historical abnormal accounts, and a spatiotemporal graph neural network is used to extract a first dynamic feature from the dynamic data of the multi-dimensional information of the historical abnormal accounts;

[0022] fusing the first static feature and the first dynamic feature to obtain the abnormal account feature;

[0023] A sparse autoencoder is used to extract a second static feature from the static data of the multi-dimensional information of the historical normal accounts, and a spatiotemporal graph neural network is used to extract a second dynamic feature from the dynamic data of the multi-dimensional information of the historical normal accounts;

[0024] The second static feature and the second dynamic feature are fused to obtain the normal account feature.

[0025] Optionally, when it is determined that the account to be detected is an abnormal account, the method further includes:

[0026] Determining the abnormal account level of the account to be detected according to the abnormal probability value interval in which the abnormal probability value is located and the confidence interval in which the confidence level is located;

[0027] Take corresponding countermeasures for the abnormal account level.

[0028] Optionally, when it is determined that the account to be detected is an abnormal account, the method further includes:

[0029] Based on the incremental parameter learning mechanism of the Bayesian neural network, the multi-dimensional information of the abnormal account is used to update the Bayesian neural network detection model.

[0030] An abnormal account detection device, comprising:

[0031] An information acquisition unit, used to acquire multi-dimensional information of the account to be detected;

[0032] A feature extraction unit, configured to extract features of the account to be detected from the multi-dimensional information;

[0033] A prediction unit, configured to input the features of the account to be detected into a pre-trained Bayesian neural network detection model, and predict an abnormality probability value that the account to be detected is an abnormal account and a confidence level of the abnormality probability value;

[0034] The abnormal account determination unit is used to determine whether the account to be detected is an abnormal account based on the relationship between the abnormal probability value and the probability threshold, and the relationship between the confidence level and the confidence threshold.

[0035] A computer storage medium stores at least one instruction, wherein the at least one instruction implements any abnormal account detection method when executed by a processor.

[0036] An electronic device, comprising: a memory and a processor;

[0037] The memory is used to store at least one instruction;

[0038] The processor is configured to execute the at least one instruction to implement any abnormal account detection method.

[0039] As can be seen from the above technical solutions, the present invention discloses an abnormal account detection method and related devices, which obtain multi-dimensional information of the account to be detected, extract the features of the account to be detected from the multi-dimensional information, input the features of the account to be detected into a pre-trained Bayesian neural network detection model, predict the abnormal probability value of the account to be detected as an abnormal account and the confidence of the abnormal probability value, and determine whether the account to be detected is an abnormal account based on the relationship between the abnormal probability value and the probability threshold, and the confidence value and the confidence threshold. The present invention carries out abnormality detection based on the multi-dimensional information of the account to be detected, which effectively reduces the false alarm rate compared with the traditional single-dimensional detection method; through the Bayesian neural network detection model, the abnormal probability value of the account to be detected as an abnormal account and its corresponding confidence are simultaneously predicted, which not only improves the ability to identify new variant fraud methods, but also effectively responds to complex associated fraud patterns, thereby significantly reducing the occurrence of missed detections. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the disclosed drawings without any creative work.

[0041] Figure 1 This is a flow chart of an abnormal account detection method disclosed in an embodiment of the present invention;

[0042] Figure 2 A flowchart of a method for extracting features of an account to be detected from multi-dimensional information disclosed in an embodiment of the present invention;

[0043] Figure 3 A flowchart of a training method for a Bayesian neural network detection model disclosed in an embodiment of the present invention;

[0044] Figure 4 This is a structural diagram of an abnormal account detection device disclosed in an embodiment of the present invention;

[0045] Figure 5 The figure is a schematic structural diagram of an electronic device disclosed in an embodiment of the present invention. DETAILED DESCRIPTION

[0046] It is understandable that before using the technical solutions disclosed in the embodiments of the present invention, the type, scope of use, usage scenarios, etc. of the personal information involved in the present invention should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0047] For example, in response to a user's active request, a prompt message is sent to the user to clearly inform the user that the operation requested will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the electronic device, application, server, storage medium, or other software or hardware that performs the operation of the technical solution of the present invention based on the prompt message.

[0048] As an optional but non-limiting implementation, in response to receiving a user's active request, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. Furthermore, the pop-up window may also contain a selection control for the user to select "agree" or "disagree" to provide personal information to the electronic device.

[0049] It is understandable that the above notification and user authorization process is merely illustrative and does not limit the implementation of the present invention. Other methods that comply with relevant laws and regulations may also be applied to the implementation of the present invention.

[0050] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) must comply with the requirements of relevant laws, regulations and relevant provisions.

[0051] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0052] The embodiment of the present invention discloses an abnormal account detection method and related devices, which obtain multi-dimensional information of the account to be detected, extract the characteristics of the account to be detected from the multi-dimensional information, input the characteristics of the account to be detected into a pre-trained Bayesian neural network detection model, predict the abnormal probability value of the account to be detected as an abnormal account and the confidence level of the abnormal probability value, and determine whether the account to be detected is an abnormal account based on the relationship between the abnormal probability value and the probability threshold, and the confidence level and the confidence threshold. The present invention carries out abnormality detection based on the multi-dimensional information of the account to be detected, which effectively reduces the false alarm rate compared to the traditional single-dimensional detection method; through the Bayesian neural network detection model, the abnormal probability value of the account to be detected as an abnormal account and its corresponding confidence level are simultaneously predicted, which not only improves the ability to identify new variant fraud methods, but also effectively responds to complex associated fraud patterns, thereby significantly reducing the occurrence of missed detections.

[0053] Explanation of related terms

[0054] Sparse autoencoder: A neural network-based autoencoder model whose goal is to reconstruct the input data through the learned sparse representation, which can better capture the important features of the input data.

[0055] Spatiotemporal Graph Neural Network: A neural network framework that uses graph neural network algorithms to model spatiotemporal dependencies in data.

[0056] Bayesian neural network: A model that combines Bayesian statistical methods with neural networks. Its characteristic is that the network's weight parameters are represented as probability distributions rather than deterministic point values, which can quantify the uncertainty of the model and prediction results.

[0057] Incremental learning, also known as continuous learning or lifelong learning, is a machine learning method that allows a model to continuously learn from new data rather than retraining the entire model from scratch. This method allows the model to continuously learn new knowledge and maintain performance in a changing environment.

[0058] Multi-dimensional account dynamic portrait: a collection of account features dynamically portrayed from multiple dimensions such as transaction behavior, spatiotemporal correlation, and device information.

[0059] See also Figure 1 , a flow chart of an abnormal account detection method disclosed in an embodiment of the present invention, the method comprising:

[0060] Step S101: Obtain multi-dimensional information of the account to be detected.

[0061] The multi-dimensional information of the account to be tested includes: static data and dynamic data.

[0062] Static data includes: account attributes and device information.

[0063] Among them, account attributes include account level, category, balance, account opening time, account age, etc.

[0064] Device information, such as device model and IP location.

[0065] Dynamic data includes: transaction behavior and social network topology.

[0066] Among them, transaction behaviors include transaction time, counterparty, transaction amount, etc.

[0067] Social network topology includes: capital flow graph and geographic location sequence.

[0068] Step S102: extracting features of the account to be detected from the multi-dimensional information.

[0069] Among them, the features of the account to be detected are obtained by fusing static features and dynamic features.

[0070] Static features include but are not limited to basic attributes (such as account registration time and account type), behavioral patterns (such as the average daily number of logins and the entropy of login time distribution), associated features (such as whether the account is a sub-account), device identification, network features (such as the geographical distribution of historical login IP addresses), etc.

[0071] Dynamic features include spatial interaction relationships (such as transactions between accounts) and temporal evolution patterns (such as changes in transaction frequency).

[0072] Step S103: Input the features of the account to be detected into a pre-trained Bayesian neural network detection model to predict the abnormal probability value of the account to be detected being an abnormal account and the confidence level of the abnormal probability value.

[0073] In this application, the Bayesian neural network detection model uses account features as training samples and the label types corresponding to the account features as sample labels, and is obtained after training the Bayesian neural network.

[0074] Among them, account characteristics include: abnormal account characteristics and normal account characteristics.

[0075] The Bayesian neural network detection model in this application can not only predict the abnormal probability value of whether it is an abnormal account, but also output uncertainty quantification.

[0076] Uncertainty quantification is a broader methodology that aims to quantify the uncertainty of predictions or parameters through statistical or machine learning techniques. Confidence is a specific manifestation of uncertainty quantification, used to measure the degree of confidence in a prediction. Uncertainty quantification provides a quantitative basis for confidence, and confidence is one of the core outputs of uncertainty quantification in practice.

[0077] Step S104: Determine whether the account to be detected is an abnormal account based on the relationship between the abnormal probability value and the probability threshold, and the relationship between the confidence level and the confidence threshold.

[0078] Abnormality probability value: The model predicts the posterior probability that the account to be tested is an abnormal account (such as 0.8 means "80% probability of abnormality"), which is the prediction result itself.

[0079] Confidence: The model measures the reliability of the "abnormal probability value", reflecting the certainty of the prediction result. For example, "confidence 0.9" means that the model is very certain about the prediction of "80% probability abnormality".

[0080] If the abnormal probability value is high (such as 80%) and the confidence level is high (such as 0.9), then the possibility that the account to be detected is abnormal is indeed high.

[0081] If the anomaly probability value is low (such as 0.2), but the confidence level is high (such as 0.9), then the likelihood that the account is anomaly is low (the model determines that it is normal).

[0082] In this embodiment, when the abnormal probability value of the account to be detected is not lower than the probability threshold and the confidence level is not lower than the confidence level threshold, the account to be detected is determined to be an abnormal account.

[0083] The value of the probability threshold is determined according to actual needs, for example, the probability threshold is 60%.

[0084] The value of the confidence threshold is determined according to actual needs, for example, the confidence threshold is 0.9.

[0085] For example, the abnormal probability value of the account to be detected being an abnormal account is 80%, the confidence level is 0.95, the probability threshold is 60%, and the confidence threshold is 0.05. Since 80%>60% and 0.95>0.9, the account to be detected is determined to be an abnormal account.

[0086] In summary, the present invention discloses a method for detecting abnormal accounts, which obtains multi-dimensional information of the account to be detected, extracts the features of the account to be detected from the multi-dimensional information, inputs the features of the account to be detected into a pre-trained Bayesian neural network detection model, predicts the abnormal probability value of the account to be detected as an abnormal account and the confidence of the abnormal probability value, and determines whether the account to be detected is an abnormal account based on the relationship between the abnormal probability value and the probability threshold, and the confidence value and the confidence threshold. The present invention carries out abnormality detection based on the multi-dimensional information of the account to be detected, which effectively reduces the false alarm rate compared with the traditional single-dimensional detection method; through the Bayesian neural network detection model, the abnormal probability value of the account to be detected as an abnormal account and its corresponding confidence are simultaneously predicted, which not only improves the ability to identify new variant fraud methods, but also effectively responds to complex correlated fraud patterns, thereby significantly reducing the occurrence of missed detections.

[0087] In one embodiment, see Figure 2 , a flowchart of a method for extracting features of an account to be detected from multi-dimensional information disclosed in an embodiment of the present invention, the method comprising:

[0088] Step S201: Use a sparse autoencoder to extract static features from static data of multi-dimensional information.

[0089] Sparse autoencoder is an unsupervised learning neural network model whose core goal is to learn a more compact and representative static feature from static data through the encoding-decoding process.

[0090] Encoder: Maps the input static data (such as account attributes, device information) to the hidden layer to generate a low-dimensional "feature representation" (i.e. static features).

[0091] Decoder: Reconstructs the feature representation of the hidden layer back to the original data space, generating reconstructed data that is as close as possible to the input data.

[0092] In this embodiment, static features extracted from static data include but are not limited to basic attributes (such as account registration time, account type), behavioral patterns (such as average daily login times, entropy of login time distribution), associated features (such as whether the account is a sub-account), device identification, network features (such as geographical distribution of historical login IPs), etc.

[0093] In order to improve the accuracy of static features, after extracting the static features, the static features can also be denoised.

[0094] Step S202: Use a spatiotemporal graph neural network to extract dynamic features from the dynamic data of multi-dimensional information.

[0095] A temporal graph neural network is a model that combines graph-structured data with time series analysis to capture the time-evolution patterns of nodes (such as accounts) and edges (such as transaction relationships) in dynamic systems.

[0096] The time-series graph neural network extracts dynamic features from dynamic data that include both spatial interaction relationships (such as transactions between accounts) and time evolution patterns (such as changes in transaction frequency) through the mechanism of "time-series graph modeling → time dependency capture → spatial feature aggregation".

[0097] Step S203: Fusing the static features and the dynamic features to obtain features of the account to be detected.

[0098] The essence of the fusion of static features and dynamic features is the expansion and constraint of the feature space. When fusing static features and dynamic features, it is necessary to ensure that the key information of static features and dynamic features is not lost. Irrelevant noise in static features and dynamic features (such as redundant fields of device models) can be filtered out, and association mining can be performed to capture potential associations between static features and dynamic features, such as high-risk equipment + abnormal transaction amount, thereby obtaining the characteristics of the account to be detected.

[0099] In one embodiment, see Figure 3 , a flow chart of a training method for a Bayesian neural network detection model disclosed in an embodiment of the present invention, the method comprising:

[0100] Step S301: Construct multiple multi-dimensional account dynamic portraits based on historical account information;

[0101] Among them, each multi-dimensional account dynamic portrait corresponds to the multi-dimensional information of an account.

[0102] The multi-dimensional information of an account may be the multi-dimensional information of a historically abnormal account or the multi-dimensional information of a historically normal account.

[0103] In this embodiment, constructing multiple multi-dimensional account dynamic portraits based on historical account information actually involves extracting multi-dimensional information of historical abnormal accounts and multi-dimensional information of historical normal accounts from the historical account information.

[0104] Step S302: extract abnormal account features from the multi-dimensional information of historical abnormal accounts, and extract normal account features from the multi-dimensional information of historical normal accounts.

[0105] The process of extracting abnormal account features from multi-dimensional information of historical abnormal accounts includes:

[0106] A sparse autoencoder is used to extract the first static feature from the static data of the multi-dimensional information of historical abnormal accounts, and a spatiotemporal graph neural network is used to extract the first dynamic feature from the dynamic data of the multi-dimensional information of historical abnormal accounts. The first static feature and the first dynamic feature are fused to obtain the abnormal account feature.

[0107] The process of extracting normal account features from the multi-dimensional information of historical normal accounts includes:

[0108] A sparse autoencoder is used to extract a second static feature from the static data of historical multi-dimensional information about normal accounts, and a spatiotemporal graph neural network is used to extract a second dynamic feature from the dynamic data of historical multi-dimensional information about normal accounts. The second static feature and the second dynamic feature are fused to obtain the normal account feature.

[0109] It should be noted that, in this embodiment, the static data of the multi-dimensional information of historical abnormal accounts and the static data of the multi-dimensional information of historical normal accounts both include: account attributes (such as account level, category, balance, account opening time, account age, etc.) and device information (such as device model, IP location).

[0110] In this embodiment, the dynamic data of the multi-dimensional information of historical abnormal accounts and the dynamic data of the multi-dimensional information of historical normal accounts both include: transaction behavior (such as transaction time, transaction counterparty, transaction amount, etc.), capital flow diagram and geographic location sequence.

[0111] Step S303: Take the abnormal account features and the normal account features as training samples, use the label types corresponding to the abnormal account features and the normal account features as sample labels, train the Bayesian neural network, and obtain a Bayesian neural network detection model.

[0112] Among them, the label type corresponding to abnormal account features is: abnormal label, and the label type corresponding to normal account features is normal label.

[0113] In one embodiment, when the account to be detected is determined to be an abnormal account, the abnormal account detection method may further include:

[0114] Determine the abnormal account level of the account to be detected based on the abnormal probability value interval and the confidence interval of the abnormal probability value;

[0115] Take corresponding countermeasures for abnormal account levels.

[0116] This application sets different abnormal probability value intervals and confidence intervals for different abnormal account levels. The values ​​of the abnormal probability value intervals and confidence intervals are determined according to actual needs. Corresponding response measures are also set for different abnormal account levels.

[0117] For example, when the abnormal account level is high, the response measure is: circuit breaker account, that is, the protection mechanism is triggered due to risks or abnormalities, resulting in the restriction of account functions.

[0118] When the abnormal account level is medium, the response measures are: verify the account, that is, output verification instructions and manually verify the account.

[0119] When the abnormal account is of low level, the response measure is: warning. That is, output warning instructions

[0120] In this embodiment, when the account to be detected is determined to be an abnormal account, the abnormal account level of the account to be detected is determined by determining the abnormal probability value interval and the confidence interval of the abnormal probability value so as to take corresponding countermeasures.

[0121] For example, if the abnormal probability of the account to be detected is greater than 90% and the confidence level is greater than 0.9, which corresponds to a high-level abnormal probability value interval and confidence level interval, it means that the abnormal account level of the account to be detected is high. The response measure is to activate the circuit breaker mechanism, which can trigger automatic restriction of account functions due to account risk.

[0122] The abnormal probability of the account to be detected is greater than 60% and the confidence level is greater than 0.7, corresponding to the medium-level abnormal probability value interval and confidence level interval, indicating that the abnormal account level of the account to be detected is medium, and the response measure taken is manual verification of the account.

[0123] The abnormal probability of the account to be detected is greater than 50% and the confidence level is greater than 0.4, corresponding to a low-level abnormal probability value interval and confidence level interval, indicating that the abnormal account level of the account to be detected is low, and the response measure taken is to output a warning instruction.

[0124] In one embodiment, when the account to be detected is determined to be an abnormal account, the abnormal account detection method may further include:

[0125] Based on the incremental parameter learning mechanism of Bayesian neural network, the multi-dimensional information of abnormal accounts is used to update the Bayesian neural network detection model.

[0126] The incremental parameter learning mechanism based on the Bayesian neural network is combined with the multi-dimensional information update detection model of abnormal accounts. Its core principle is to quantify the uncertainty of model parameters through the Bayesian framework, and use incremental learning to dynamically integrate new data to achieve continuous and adaptive detection of abnormal accounts.

[0127] Each time this application completes anomaly detection of an account to be detected, it will update the Bayesian neural network detection model based on the incremental parameter learning mechanism of the Bayesian neural network and utilize the multi-dimensional information of the abnormal account.

[0128] In addition, the multi-dimensional information of the account to be detected can also be used to update the multi-dimensional account dynamic portrait used in the training of the Bayesian neural network detection model.

[0129] Corresponding to the above method embodiment, the present invention also discloses an abnormal account detection device.

[0130] See also Figure 4 , a schematic diagram of the structure of an abnormal account detection device disclosed in an embodiment of the present invention, the device may include:

[0131] The information acquisition unit 401 is used to acquire multi-dimensional information of the account to be detected.

[0132] The multi-dimensional information of the account to be tested includes: static data and dynamic data.

[0133] Static data includes: account attributes and device information.

[0134] Among them, account attributes include account level, category, balance, account opening time, account age, etc.

[0135] Device information, such as device model and IP location.

[0136] Dynamic data includes: transaction behavior and social network topology.

[0137] Among them, transaction behaviors include transaction time, counterparty, transaction amount, etc.

[0138] Social network topology includes: capital flow graph and geographic location sequence.

[0139] The feature extraction unit 402 is configured to extract features of the account to be detected from the multi-dimensional information.

[0140] Among them, the features of the account to be detected are obtained by fusing static features and dynamic features.

[0141] Static features include but are not limited to basic attributes (such as account registration time and account type), behavioral patterns (such as the average daily number of logins and the entropy of login time distribution), associated features (such as whether the account is a sub-account), device identification, network features (such as the geographical distribution of historical login IP addresses), etc.

[0142] Dynamic features include spatial interaction relationships (such as transactions between accounts) and temporal evolution patterns (such as changes in transaction frequency).

[0143] The prediction unit 403 is configured to input the features of the account to be detected into a pre-trained Bayesian neural network detection model to predict an abnormal probability value that the account to be detected is an abnormal account and a confidence level of the abnormal probability value.

[0144] In this application, the Bayesian neural network detection model uses account features as training samples and the label types corresponding to the account features as sample labels, and is obtained after training the Bayesian neural network.

[0145] Among them, account characteristics include: abnormal account characteristics and normal account characteristics.

[0146] The Bayesian neural network detection model in this application can not only predict the abnormal probability value of whether it is an abnormal account, but also output uncertainty quantification.

[0147] Uncertainty quantification is a broader methodology that aims to quantify the uncertainty of predictions or parameters through statistical or machine learning techniques. Confidence is a specific manifestation of uncertainty quantification, used to measure the degree of confidence in a prediction. Uncertainty quantification provides a quantitative basis for confidence, and confidence is one of the core outputs of uncertainty quantification in practice.

[0148] The abnormal account determination unit 404 is configured to determine whether the account to be detected is an abnormal account based on the relationship between the abnormal probability value and the probability threshold, and the relationship between the confidence level and the confidence threshold.

[0149] Abnormality probability value: The model predicts the posterior probability that the account to be tested is an abnormal account (such as 0.8 means "80% probability of abnormality"), which is the prediction result itself.

[0150] Confidence: The model measures the reliability of the "abnormal probability value", reflecting the certainty of the prediction result. For example, "confidence 0.9" means that the model is very certain about the prediction of "80% probability abnormality".

[0151] In summary, the present invention discloses an abnormal account detection device, which obtains multi-dimensional information of an account to be detected, extracts features of the account to be detected from the multi-dimensional information, inputs the features of the account to be detected into a pre-trained Bayesian neural network detection model, predicts the abnormal probability value of the account to be detected as an abnormal account and the confidence level of the abnormal probability value, and determines whether the account to be detected is an abnormal account based on the relationship between the abnormal probability value and the probability threshold, and the confidence level and the confidence threshold. The present invention carries out abnormality detection based on the multi-dimensional information of the account to be detected, which effectively reduces the false alarm rate compared to the traditional single-dimensional detection method; through the Bayesian neural network detection model, the abnormal probability value of the account to be detected as an abnormal account and its corresponding confidence level are simultaneously predicted, which not only improves the ability to identify new variant fraud methods, but also effectively responds to complex correlated fraud patterns, thereby significantly reducing the occurrence of missed detections.

[0152] In one embodiment, the feature extraction unit 402 may be specifically configured to:

[0153] Extracting static features from the static data of the multi-dimensional information using a sparse autoencoder;

[0154] Extracting dynamic features from the dynamic data of the multi-dimensional information using a spatiotemporal graph neural network;

[0155] The static features and the dynamic features are fused to obtain the features of the account to be detected.

[0156] In one embodiment, the abnormal account detection apparatus may further include: a model training unit;

[0157] The model training unit is used to:

[0158] Construct multiple multi-dimensional account dynamic profiles based on historical account information, each of which corresponds to multi-dimensional information of an account, wherein the multi-dimensional information is multi-dimensional information of historical abnormal accounts or multi-dimensional information of historical normal accounts;

[0159] Extracting abnormal account features from the multi-dimensional information of historical abnormal accounts, and extracting normal account features from the multi-dimensional information of historical normal accounts;

[0160] The abnormal account features and the normal account features are used together as training samples, and the label types corresponding to the abnormal account features and the normal account features are used as sample labels to train the Bayesian neural network to obtain the Bayesian neural network detection model, wherein the label types include: abnormal labels and normal labels.

[0161] In one embodiment, the model training unit may also be used to:

[0162] A sparse autoencoder is used to extract a first static feature from the static data of the multi-dimensional information of the historical abnormal accounts, and a spatiotemporal graph neural network is used to extract a first dynamic feature from the dynamic data of the multi-dimensional information of the historical abnormal accounts;

[0163] fusing the first static feature and the first dynamic feature to obtain the abnormal account feature;

[0164] A sparse autoencoder is used to extract a second static feature from the static data of the multi-dimensional information of the historical normal accounts, and a spatiotemporal graph neural network is used to extract a second dynamic feature from the dynamic data of the multi-dimensional information of the historical normal accounts;

[0165] The second static feature and the second dynamic feature are fused to obtain the normal account feature.

[0166] In one embodiment, the abnormal account detection device may further include:

[0167] an account level determination unit, configured to, when determining that the account to be detected is an abnormal account, determine the abnormal account level of the account to be detected based on the abnormal probability value interval in which the abnormal probability value falls and the confidence interval in which the confidence value falls;

[0168] The measure taking unit is used to take corresponding countermeasures according to the abnormal account level.

[0169] In one embodiment, the abnormal account detection device may further include:

[0170] A model updating unit is used to update the Bayesian neural network detection model using multi-dimensional information of the abnormal account based on the incremental parameter learning mechanism of the Bayesian neural network when the account to be detected is determined to be an abnormal account.

[0171] Corresponding to the above embodiment, the present invention further discloses a computer storage medium, which stores at least one instruction. When the at least one instruction is executed by a processor, the steps shown in the embodiment of the abnormal account detection method are implemented.

[0172] Computer storage media can be tangible media that can contain or store programs for use by or in conjunction with an instruction execution system, device, or apparatus. Computer storage media can be machine-readable signal media or machine-readable storage media. Computer storage media can include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or equipment, or any suitable combination of the foregoing. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0173] Corresponding to the above embodiment, Figure 5 As shown, the present invention also provides a structural diagram of an electronic device, which may include: a processor 1 and a memory 2;

[0174] The processor 1 and the memory 2 communicate with each other via a communication bus 3.

[0175] Processor 1, configured to execute at least one instruction;

[0176] Memory 2, used to store at least one instruction;

[0177] The processor 1 may be a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present invention.

[0178] The memory 2 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0179] Among them, the processor executes at least one instruction to implement the steps shown in the embodiment of the abnormal account detection method.

[0180] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0181] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0182] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting abnormal accounts, characterized in that: include: Obtain multi-dimensional information of the account to be tested; Extracting features of the account to be detected from the multi-dimensional information; Inputting the features of the account to be detected into a pre-trained Bayesian neural network detection model to predict the abnormal probability value of the account to be detected as an abnormal account and the confidence level of the abnormal probability value; Whether the account to be detected is an abnormal account is determined based on the relationship between the abnormal probability value and the probability threshold, and the relationship between the confidence level and the confidence threshold.

2. The abnormal account detection method according to claim 1, characterized in that: The extracting the characteristics of the account to be detected from the multi-dimensional information includes: Extracting static features from the static data of the multi-dimensional information using a sparse autoencoder; Extracting dynamic features from the dynamic data of the multi-dimensional information using a spatiotemporal graph neural network; The static features and the dynamic features are fused to obtain the features of the account to be detected.

3. The abnormal account detection method according to claim 2, characterized in that: The static data includes: account attributes and device information; The dynamic data includes: transaction behavior and social network topology, and the social network topology includes: capital flow graph and geographic location sequence.

4. The abnormal account detection method according to any one of claims 1 to 3, characterized in that: The training process of the Bayesian neural network detection model includes: Construct multiple multi-dimensional account dynamic profiles based on historical account information, each of which corresponds to multi-dimensional information of an account, wherein the multi-dimensional information is multi-dimensional information of historical abnormal accounts or multi-dimensional information of historical normal accounts; Extracting abnormal account features from the multi-dimensional information of historical abnormal accounts, and extracting normal account features from the multi-dimensional information of historical normal accounts; The abnormal account features and the normal account features are used together as training samples, and the label types corresponding to the abnormal account features and the normal account features are used as sample labels to train the Bayesian neural network to obtain the Bayesian neural network detection model, wherein the label types include: abnormal labels and normal labels.

5. The abnormal account detection method according to claim 4, characterized in that: Extracting abnormal account features from the multi-dimensional information of historical abnormal accounts, and extracting normal account features from the multi-dimensional information of historical normal accounts, including: A sparse autoencoder is used to extract a first static feature from the static data of the multi-dimensional information of the historical abnormal accounts, and a spatiotemporal graph neural network is used to extract a first dynamic feature from the dynamic data of the multi-dimensional information of the historical abnormal accounts; fusing the first static feature and the first dynamic feature to obtain the abnormal account feature; A sparse autoencoder is used to extract a second static feature from the static data of the multi-dimensional information of the historical normal accounts, and a spatiotemporal graph neural network is used to extract a second dynamic feature from the dynamic data of the multi-dimensional information of the historical normal accounts; The second static feature and the second dynamic feature are fused to obtain the normal account feature.

6. The abnormal account detection method according to any one of claims 1 to 3, characterized in that: In the case where the account to be detected is determined to be an abnormal account, the method further includes: Determining the abnormal account level of the account to be detected according to the abnormal probability value interval in which the abnormal probability value is located and the confidence interval in which the confidence level is located; Take corresponding countermeasures for the abnormal account level.

7. The abnormal account detection method according to claim 1, characterized in that: In the case where the account to be detected is determined to be an abnormal account, the method further includes: Based on the incremental parameter learning mechanism of the Bayesian neural network, the multi-dimensional information of the abnormal account is used to update the Bayesian neural network detection model.

8. An abnormal account detection device, characterized in that: include: An information acquisition unit, used to acquire multi-dimensional information of the account to be detected; A feature extraction unit, configured to extract features of the account to be detected from the multi-dimensional information; A prediction unit, configured to input the features of the account to be detected into a pre-trained Bayesian neural network detection model, and predict an abnormality probability value that the account to be detected is an abnormal account and a confidence level of the abnormality probability value; The abnormal account determination unit is used to determine whether the account to be detected is an abnormal account based on the relationship between the abnormal probability value and the probability threshold, and the relationship between the confidence level and the confidence threshold.

9. A computer storage medium, characterized in that The computer storage medium stores at least one instruction, and when the at least one instruction is executed by the processor, the abnormal account detection method according to any one of claims 1 to 7 is implemented.

10. An electronic device, characterized in that: The electronic device includes: a memory and a processor; The memory is used to store at least one instruction; The processor is configured to execute the at least one instruction to implement the abnormal account detection method according to any one of claims 1 to 7.

Images