Abnormal account identification method and device based on machine learning, equipment and medium

Abstract

The invention discloses an abnormal account identification method and device based on machine learning, equipment and a medium. The invention relates to the technical field of artificial intelligence. The method comprises the following steps: acquiring a target message queue which corresponds to a current service system and contains first time sequence operation data after standardization processing; performing short-term historical feature aggregation on the first time sequence operation data based on a preset time window to obtain second time sequence operation data; performing key field matching on the second time sequence operation data based on a preset association dimension table to determine an offline feature, and performing rule judgment on the second time sequence operation data based on a preset business rule and the offline feature to obtain a to-be-selected feature wide table; and performing feature enhancement on the to-be-selected feature wide table based on the target machine learning model to obtain a target feature wide table, and performing account identification on the target feature wide table based on the target machine learning model to determine an abnormal account identifier. According to the technical scheme, the processing efficiency of the time sequence operation data can be improved, and the identification efficiency of the abnormal account number is improved.

Description

TECHNICAL FIELD

[0001] The embodiment of the present application relates to the technical field of artificial intelligence, and particularly relates to an abnormal account identification method and device based on machine learning, equipment and medium. BACKGROUND

[0002] With the gradual development of computer technology, users can remotely handle resource transfer services such as account transfer, shopping payment or financial management through various electronic service channels. Therefore, it is very important to identify abnormal behaviors of user accounts in electronic service channels to ensure the security of user resources.

[0003] In the prior art, artificial screening, rule model or offline machine learning are usually used to identify abnormal accounts. Artificial screening mainly relies on experience to judge suspicious accounts. Rule model mainly forms a set of monitoring rules for similar abnormal behaviors through data analysis technology, uses big data technology to monitor business processes in real time and intercepts abnormal accounts that meet the rules. Offline machine learning mainly calculates historical features based on flow data generated by suspicious accounts, and uses a classification machine learning model to identify suspicious accounts.

[0004] However, artificial screening requires staff to check suspicious business scenarios one by one, which is extremely high in labor cost and low in identification efficiency. The monitoring rules of the rule model have poor flexibility and a long adjustment interval after rule change. Offline machine learning cannot cope with abnormal behaviors of accounts in real-time situations. Therefore, how to improve the processing efficiency of time series operation data and improve the identification efficiency of abnormal accounts is a problem to be solved at present. SUMMARY

[0005] The embodiment of the present application provides an abnormal account identification method and device based on machine learning to solve the problem of low identification efficiency of abnormal accounts.

[0006] In a first aspect, the embodiment of the present application provides an abnormal account identification method based on machine learning, which comprises:

[0007] Obtaining a target message queue corresponding to a current business system, wherein the target message queue contains first time series operation data after standardization processing;

[0008] Based on a preset time window, the first time series operation data is aggregated for short-term historical features to obtain second time series operation data containing short-term historical features;

[0009] The second time sequence operation data is matched based on a preset association dimension table to determine offline features corresponding to the second time sequence operation data, and the second time sequence operation data is judged based on a preset business rule and the offline features to obtain a candidate feature wide table corresponding to the second time sequence operation data.

[0010] The target feature wide table is identified based on the target machine learning model to determine an abnormal account identifier corresponding to the current business system.

[0011] In a second aspect, the embodiment of the present application further provides an abnormal account identification device based on machine learning, which comprises:

[0012] A queue acquisition module is configured to acquire a target message queue corresponding to a current business system, wherein the target message queue comprises first time sequence operation data processed by standardization.

[0013] A real-time calculation module is configured to aggregate short-term historical features of the first time sequence operation data based on a preset time window to obtain second time sequence operation data comprising the short-term historical features.

[0014] A data processing module is configured to match key fields of the second time sequence operation data based on a preset association dimension table to determine offline features corresponding to the second time sequence operation data, and judge the second time sequence operation data based on a preset business rule and the offline features to obtain a candidate feature wide table corresponding to the second time sequence operation data.

[0015] An abnormal identification module is configured to enhance features of the candidate feature wide table based on a target machine learning model to obtain a target feature wide table corresponding to the candidate feature wide table, and identify the target feature wide table based on the target machine learning model to determine an abnormal account identifier corresponding to the current business system.

[0016] In a third aspect, the embodiment of the present application further provides an electronic device, which comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the abnormal account identification method based on machine learning as any of the embodiments of the present application.

[0017] In a fourth aspect, the embodiment of the present application further provides a computer readable storage medium, which stores a computer program, and the program is executable on the processor to implement the abnormal account identification method based on machine learning as any of the embodiments of the present application.

[0018] In a fifth aspect, an embodiment of the present application further provides a computer program product comprising a computer program which, when executed by a processor, implements the machine learning-based abnormal account identification method according to any one of the embodiments of the present application.

[0019] In the embodiment of the present application, the target message queue containing the first time-series operation data after standardization processing corresponding to the current business system is obtained. Then, the first time-series operation data is aggregated based on a preset time window to obtain second time-series operation data containing short-term historical features. Further, the second time-series operation data is matched based on a preset association dimension table to determine offline features corresponding to the second time-series operation data, and the second time-series operation data is judged based on a preset business rule and the offline features to obtain a candidate feature wide table corresponding to the second time-series operation data. Finally, the candidate feature wide table is enhanced based on a target machine learning model to obtain a target feature wide table corresponding to the candidate feature wide table, and the target feature wide table is identified based on the target machine learning model to determine an abnormal account identifier corresponding to the current business system. Since the real-time big data technology is combined with machine learning, the timeliness of the data is ensured, and the model is not easily invalidated. At the same time, the time-series operation data is processed for a second time and transmitted to the model within a short time, so that the model has strong robustness. Therefore, the processing efficiency of the time-series operation data can be improved, and the identification efficiency of the abnormal account can be improved. BRIEF DESCRIPTION OF DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0021] Figure 1 A flowchart of a machine learning-based abnormal account identification method provided by an embodiment of the present application;

[0022] Figure 2 A flowchart of another machine learning-based abnormal account identification method provided by an embodiment of the present application;

[0023] Figure 3 A flowchart of a target message queue set generation process provided by an embodiment of the present application;

[0024] Figure 4 A flowchart of a candidate feature wide table generation process provided by an embodiment of the present application;

[0025] Figure 5A flowchart of a first account identification process based on a target machine learning model provided for an embodiment of the present application;

[0026] Figure 6 A flowchart of a target feature wide table generation process provided for an embodiment of the present application;

[0027] Figure 7 A structural schematic diagram of an abnormal account identification device based on machine learning provided for an embodiment of the present application;

[0028] Figure 8 A structural schematic diagram of an electronic device for implementing an abnormal account identification method based on machine learning of an embodiment of the present application. DETAILED DESCRIPTION

[0029] The present application will be further described below in conjunction with the accompanying drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the present application, but not to limit the present application. In addition, it should be noted that, for the convenience of description, only the parts related to the present application are shown in the drawings, not all the structures.

[0030] It should be noted that: similar reference numerals and letters represent similar items in the following drawings, therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of the present application, the terms "first", "second", "target" and the like are only used to distinguish the description, and cannot be understood as indicating or implying relative importance. The acquisition, storage, use, processing and the like of data in the technical solution of the present application all comply with the relevant provisions of national laws and regulations. It should be noted that, in the embodiments of the present application, some industry existing solutions, components, models and the like may be mentioned, which should be considered as exemplary, and the purpose is only to illustrate the feasibility of the implementation of the technical solution of the present application, but it does not mean that the applicant has or will necessarily use the related content of the solution.

[0031] Figure 1 A flowchart of an abnormal account identification method based on machine learning provided for an embodiment of the present application, the present embodiment can be applicable to the real-time identification of abnormal accounts in an electronic business channel, the method can be executed by an abnormal account identification device based on machine learning, the abnormal account identification device based on machine learning can be realized in the form of hardware and / or software, and the abnormal account identification device based on machine learning can be configured in an electronic device. As shown in the figure, the method comprises: Figure 1

[0032] S101, acquiring a target message queue corresponding to a current business system; wherein the target message queue contains first time sequence operation data after standardization processing.

[0033] ​The business system can refer to a computer system related to a remote resource transfer business. For example, the business system can be an electronic business system for transferring money, an electronic business system for shopping payment, or an electronic business system for financial management. The current business system can refer to a business system selected for abnormal account identification at the current time. Generally, the current business system can be selected according to actual application requirements. The time sequence operation data can refer to data with time sequence characteristics for basic description of resource transfer business operation. For example, the time sequence operation data can be real-time resource transfer business data, real-time resource transfer login data, and real-time resource transfer alarm data. For example, a time sequence operation data can include a resource transfer unique identifier, a resource transfer timestamp, a resource transfer state, participant information, an amount of money, and a payment method corresponding to a time point. Generally, after completing the resource transfer business on the front end, the time sequence operation data can be obtained through pre-buried points or real-time collection. It is worth noting that in the embodiment of the present application, the time sequence operation data is data collected after user authorization.

[0034] The first time sequence operation data can refer to time sequence operation data that meets the set filtering condition after standardization processing. In an optional embodiment, the operation of determining the first time sequence operation data in the target message queue includes: performing data filtering on each time sequence operation data in the target message queue based on a preset static condition, and taking the time sequence operation data meeting the preset static condition as the first time sequence operation data. The preset static condition can refer to a rule preset for limiting the filtering process of the time sequence operation data. For example, the preset static condition can be a preset resource transfer type or a preset resource transfer content. Thus, by using the preset static condition to filter each time sequence operation data in the target message queue, the first time sequence operation data meeting the preset static condition can be obtained, which can reduce the amount of data for subsequent data processing and improve the identification efficiency of abnormal accounts. The message queue can refer to a data cluster for storing time sequence operation data. For example, the message queue can be a distributed stream data platform. Generally, a user account corresponds to a message queue, and the message queue sequentially stores time sequence operation data of the corresponding user account at each time point. The target message queue can refer to a message queue selected for abnormal account identification. Generally, the target message queue can be selected according to actual application requirements. For example, any message queue corresponding to the current business system can be selected as the target message queue.

[0035] S102, performing short-term historical feature aggregation on the first time sequence operation data based on a preset time window to obtain second time sequence operation data containing short-term historical features.

[0036] The preset time window can refer to a preset time value for limiting the length of the aggregated data corresponding to the first time-series operation data. Generally, the preset time window can represent a specific length of time interval. For example, the preset time window can be 24 hours of the historical resource transfer timestamp in the first time-series operation data. The historical feature can refer to the historical resource transfer operation feature of the same entity, such as an account, in a historical time period. The short-term historical feature can refer to the historical feature of the entity to which the first time-series operation data belongs in the preset time window. The second time-series operation data can refer to the time-series operation data obtained by aggregating the short-term historical feature and the corresponding first time-series operation data.

[0037] In S103, the second time-series operation data is matched based on the preset association dimension table, the offline feature corresponding to the second time-series operation data is determined, and the second time-series operation data is judged based on the preset business rule and the offline feature, to obtain the to-be-selected feature wide table corresponding to the second time-series operation data.

[0038] The dimension table can refer to a description information table for filtering, grouping, and labeling fact data. Generally, the dimension table stores the context and environment information of the business process, for example, has text, descriptive, and relatively static data. The fact table can refer to the core table in the data warehouse that stores the measurement value of the business process. Generally, the fact table contains data directly related to business operations and can be quantified. The association dimension table can refer to the result of connecting the fact table and the dimension table through the primary-foreign key relationship. The preset association dimension table can refer to a dimension table that is preset for storing the historical feature of the long-term time-series operation data. For example, the preset association dimension table can include the historical feature corresponding to the long-term time-series operation data and the entity to which it belongs. The key field can refer to a field identifier that is preset for limiting the association process of the dimension table. For example, the key field can be the entity name, such as the account or account unique identifier. The offline feature can refer to the historical feature in the preset association dimension table that matches the second time-series operation data.

[0039] The preset business rule can refer to a pre-set strategy for limiting the rule judgment process. For example, the preset business rule can include a judgment condition between the second time sequence operation data and the offline feature. Specifically, if the offline feature is the number of historical transaction counterparties, the preset business rule can be to judge whether the number of transaction counterparties in the second time sequence operation data exceeds the number of historical transaction counterparties. If the number of transaction counterparties in the second time sequence operation data exceeds the offline feature, a high-frequency transaction counterparty label is generated. If the offline feature is a historical transaction counterparty queue arranged in descending order of frequency, the preset business rule can be to judge whether the transaction counterparty in the second time sequence operation data is in the top three transaction counterparties of the historical transaction counterparty queue. If the transaction counterparty in the second time sequence operation data is in the top three transaction counterparties of the historical transaction counterparty queue, a known counterparty label is generated. If the offline feature is the historical monthly average resource transfer amount, the preset business rule can be to judge whether the resource transfer amount in the second time sequence operation data exceeds three times the historical monthly average resource transfer amount. If the resource transfer amount in the second time sequence operation data exceeds three times the historical monthly average resource transfer amount, an abnormal resource transfer label is generated. The wide table can refer to a data table with a large number of fields obtained after important fields in the dimension table are integrated into the fact table. The feature wide table can refer to a flattened table containing a large number of features. Generally, each row in the feature wide table represents an entity, such as an account or an account unique identifier; and each column represents a feature label. The candidate feature wide table can refer to a preliminarily generated feature wide table that has not been processed.

[0040] In S104, the target feature wide table corresponding to the candidate feature wide table is obtained by performing feature enhancement on the candidate feature wide table based on a target machine learning model, and account identification is performed on the target feature wide table based on the target machine learning model to determine an abnormal account identifier corresponding to the current business system.

[0041] The machine learning model can refer to a mathematical function that automatically learns rules from data and makes predictions. Generally, the machine learning model can discover regular patterns by analyzing historical data, thereby making decisions or predictions on unknown data. The target machine learning model can refer to a pre-trained machine learning model for real-time identification of abnormal accounts. The target feature wide table can refer to a feature wide table obtained by performing feature enhancement on the candidate feature wide table. The account identifier can refer to an identifier for uniquely representing an entity. For example, the account identifier can be an account unique code (Identity Document). The abnormal account identifier can refer to an account identifier with abnormal behavior in the current business system. For example, the abnormal account identifier can be an account identifier involving a large amount of resource transfer at a time.

[0042] In an optional implementation, after the target feature wide table is identified based on the target machine learning model, and the abnormal account identifier corresponding to the current business system is determined, the method further includes:

[0043] Step a1, combining the abnormal account identifier and the target message queue to obtain an abnormal message queue corresponding to the current business system.

[0044] The abnormal message queue can refer to a message queue for storing and managing the abnormal account identifier.

[0045] Step a2, performing strategy judgment on the abnormal message queue based on a preset data management rule to generate a time sequence operation management strategy corresponding to the abnormal message queue.

[0046] The preset data management rule can refer to a rule predefined for limiting the strategy generation process of the abnormal message queue. For example, the preset data management rule can include a predefined data management level and a corresponding data management measure. Specifically, the preset data management rule can be to input the abnormal message queue into a risk control engine to select a control strategy for the abnormal message queue through the risk control engine. The time sequence operation management strategy can refer to a management strategy corresponding to the abnormal message queue. For example, if the abnormal message queue is of a high risk level, the time sequence operation management strategy can be to freeze the account identifier corresponding to the abnormal message queue and limit the resource transfer function. If the abnormal message queue is of a medium risk level, the time sequence operation management strategy can be to enhance the verification mechanism and set a resource transfer limit.

[0047] Specifically, after the abnormal account identifier corresponding to the current business system is determined, the abnormal account identifier can be added to the target message queue in the form of a label to generate an abnormal message queue. Then, the abnormal message queue is selected based on the preset data management rule to obtain a time sequence operation management strategy corresponding to the abnormal message queue. Thus, by executing the time sequence operation management strategy, the abnormal account can be timely controlled, and the occurrence of abnormal resource transfer business can be avoided, thereby ensuring the security of the resource transfer business.

[0048] In the embodiment of the present application, the target message queue corresponding to the current business system and containing the first time sequence operation data after standardization processing is obtained. Then, the first time sequence operation data is aggregated based on a preset time window to obtain second time sequence operation data containing short-term historical features. Further, the second time sequence operation data is matched based on a preset association dimension table to determine offline features corresponding to the second time sequence operation data, and the second time sequence operation data is judged based on a preset business rule and the offline features to obtain a candidate feature wide table corresponding to the second time sequence operation data. Finally, the target feature wide table corresponding to the candidate feature wide table is obtained by feature enhancement of the candidate feature wide table based on a target machine learning model, and the target feature wide table is used for account identification based on the target machine learning model to determine an abnormal account identifier corresponding to the current business system. Since the real-time big data technology is combined with machine learning, the timeliness of the data is ensured, and the model is not easy to fail. At the same time, the time sequence operation data is processed twice in a short time and transmitted to the model, so that the model has strong robustness. Therefore, the processing efficiency of the time sequence operation data can be improved, and the identification efficiency of the abnormal account can be improved.

[0049] Figure 2 The flowchart of another abnormal account identification method based on machine learning is provided in the embodiment of the present application. The embodiment is based on the above-mentioned embodiment and is refined. In the embodiment, the operation of aggregating the first time sequence operation data based on a preset time window to obtain second time sequence operation data containing short-term historical features is refined. Specifically, the operation can include: obtaining an account identifier corresponding to the first time sequence operation data, determining short-term historical data in a preset time window range in a historical data source based on the account identifier; performing feature statistics on the short-term historical data based on a preset feature field to obtain short-term historical features corresponding to the first time sequence operation data; and aggregating and processing the first time sequence operation data and the short-term historical features to obtain second time sequence operation data containing short-term historical features. As shown in Figure 2 The method includes:

[0050] S201, obtaining a basic time sequence operation data set corresponding to a current business system.

[0051] The basic time sequence operation data can refer to the time sequence operation data collected initially. For example, the basic time sequence operation data can be real-time collected time sequence operation data. The basic time sequence operation data set can refer to a set composed of various basic time sequence operation data corresponding to the current business system at the current time. Generally, the basic time sequence operation data set can contain basic time sequence operation data corresponding to multiple entities.

[0052] S202. Perform standardized processing on the set of basic time-series operation data based on a preset data processing rule to obtain a set of candidate time-series operation data corresponding to the set of basic time-series operation data.

[0053] The preset data processing rule can refer to a rule predefined for defining a standardized processing procedure of the basic time-series operation data. For example, the preset data processing rule can include an invalid field elimination rule, a field identification rule, and a format conversion rule, etc. The candidate time-series operation data can refer to time-series operation data obtained after the standardized processing of the basic time-series operation data. The set of candidate time-series operation data can refer to a set of candidate time-series operation data corresponding to the same set of basic time-series operation data.

[0054] In an optional embodiment, the standardized processing of the set of basic time-series operation data based on the preset data processing rule to obtain the set of candidate time-series operation data corresponding to the set of basic time-series operation data includes:

[0055] b1. Perform field identification on the set of basic time-series operation data based on a preset stream calculation identification rule to obtain a set of intermediate time-series operation data corresponding to the set of basic time-series operation data.

[0056] The preset stream calculation identification rule can refer to a rule predefined for defining the field identification process. For example, the preset stream calculation identification rule can be to take the data feature in the basic time-series operation data as the stream calculation identification result. For example, the resource transfer amount in the basic time-series operation data can be taken as the stream calculation identification result. Generally, the preset stream calculation identification rule can generate a key field, i.e., an identification field, for uniquely distinguishing different entities or events in the data stream. The intermediate time-series operation data can refer to time-series operation data obtained after adding the stream calculation identification result to the basic time-series operation data. Generally, one basic time-series operation data corresponds to one intermediate time-series operation data. The set of intermediate time-series operation data can refer to a set of intermediate time-series operation data corresponding to the same set of basic time-series operation data.

[0057] It is worth noting that in the embodiment of the present application, before performing the field identification on the set of basic time-series operation data based on the preset stream calculation identification rule, the basic time-series operation data with failed resource transfer or empty account identification in the set of basic time-series operation data can be removed first. Thus, by performing data cleaning on the set of basic time-series operation data, the effectiveness of the data in the set of basic time-series operation data can be ensured, the resource waste caused by processing invalid data can be avoided, and the data processing efficiency is improved.

[0058] The step b2 comprises: standardizing the intermediate time sequence operation data set based on a preset data format, to obtain a candidate time sequence operation data set corresponding to the basic time sequence operation data set.

[0059] The preset data format can be a standard for defining the data format in advance. For example, the preset data format can be an interface format.

[0060] Specifically, after obtaining the basic time sequence operation data set corresponding to the current business system, the field identification of each basic time sequence operation data in the basic time sequence operation data set can be performed by using a preset stream calculation identification rule to determine the identification field corresponding to each basic time sequence operation data, and then the identification field is added to the corresponding basic time sequence operation data as a feature label to form an intermediate time sequence operation data such as (identification field, basic time sequence operation data). Further, the intermediate time sequence operation data set is formed by combining each intermediate time sequence operation data according to the data order of the basic time sequence operation data set, and the intermediate time sequence operation data set is standardized according to the preset data format. Thus, the candidate time sequence operation data set corresponding to the basic time sequence operation data set is obtained, the data processing and standardization of the basic time sequence operation data are realized, and an effective data basis is provided for subsequent operations.

[0061] S203, based on the account identification of each candidate time sequence operation data in the candidate basic time sequence operation data set, the candidate time sequence operation data set is divided into a queue to obtain a target message queue set corresponding to the current business system; wherein the target message queue set comprises each target message queue, and each time sequence operation data corresponding to the same account identification in the same target message queue.

[0062] The target message queue set can refer to a set composed of each target message queue corresponding to the current business system. Generally, the number of target message queues in the target message queue set is consistent with the number of account identifications corresponding to the current business system.

[0063] Figure 3A flowchart of a target message queue set generation process is provided for an embodiment of the present application. Specifically, first, a basic time sequence operation data set corresponding to a current business system is obtained from a source number in real time. Then, the basic time sequence operation data set is processed using a preset stream calculation identification rule to obtain an intermediate time sequence operation data set. Further, the intermediate time sequence operation data set is standardized using a preset data format to obtain a selected time sequence operation data set. Finally, according to the account identifier of each selected time sequence operation data in the selected basic time sequence operation data set, the selected time sequence operation data with the same account identifier is divided into the same message queue and marked as a target message queue. Thus, by combining each target message queue corresponding to the current business system, a target message queue set corresponding to the current business system can be obtained, providing an effective data basis for subsequent operations.

[0064] S204, obtaining a target message queue corresponding to a current business system; wherein the target message queue contains the first time sequence operation data after standardization processing.

[0065] Specifically, after obtaining the target message queue set corresponding to the current business system, one of the target message queues can be selected as the data basis for the subsequent abnormal account identification process to determine whether the target message queue is an abnormal account with abnormal behavior.

[0066] It is worth noting that in the embodiment of the present application, each target message queue in the target message queue set can perform the abnormal account identification process in parallel, and the embodiment of the present application does not make specific limitation.

[0067] S205, obtaining an account identifier corresponding to the first time sequence operation data, and determining short-term historical data in a preset time window range in a historical data source based on the account identifier.

[0068] The historical data source can refer to a database that stores source numbers in a historical time period. The short-term historical data can refer to historical time sequence operation data in a preset time window range. For example, the short-term historical data can be time sequence operation data consistent with the account identifier of the first time sequence operation data within the first 24 hours of the first time sequence operation data.

[0069] S206, performing feature statistics on the short-term historical data based on a preset feature field to obtain short-term historical features corresponding to the first time sequence operation data.

[0070] The preset feature field can refer to a field standard predefined for limiting the short-term historical data feature statistics process. For example, the preset feature field can be resource transfer amount or resource transfer times, etc.

[0071] S207, aggregate the first time series operation data and the short-term historical feature to obtain second time series operation data containing the short-term historical feature.

[0072] Specifically, after determining the target message queue that needs to be subjected to abnormal account identification, the account identifier corresponding to the first time series operation data in the target message queue can be acquired first, and then the historical data consistent with the account identifier in the preset time window range of the historical data source is determined as the short-term historical data corresponding to the first time series operation data. Further, the short-term historical data is subjected to feature statistics by using the preset feature field to obtain the short-term historical feature. Finally, the short-term historical feature is added to the first time series operation data as the label of the first time series operation data to obtain the second time series operation data containing the short-term historical feature. Thus, an effective data basis is provided for subsequent data processing.

[0073] It is worth noting that in the embodiment of the present application, the Flink framework can be used to perform the process of real-time data processing and analysis. Thus, the continuously generated real-time data stream can be processed and analyzed, and the results can be produced in a low-delay manner.

[0074] S208, perform key field matching on the second time series operation data based on a preset association dimension table to determine offline features corresponding to the second time series operation data.

[0075] Specifically, after obtaining the second time series operation data, the account identifier of the second time series operation data can be used as the key field, and the key field matching can be performed by using the account identifier in the preset association dimension table to determine the offline features corresponding to the account identifier as the offline features corresponding to the second time series operation data.

[0076] In an optional embodiment, before the key field matching on the second time series operation data based on the preset association dimension table to determine the offline features corresponding to the second time series operation data, the method further comprises:

[0077] Step c1, determine a long-term historical data set corresponding to the current business system in the historical data source based on a preset time period.

[0078] The preset time period can refer to a preset time value for defining a long time period. For example, the preset time period can be 180 days. The long-term historical data can refer to historical time sequence operation data in the preset time period. For example, the long-term historical data can be time sequence operation data consistent with the account identifier of the first time sequence operation data in the last 180 days of the first time sequence operation data. Generally, one long-term historical data corresponds to one day. The long-term historical data set can refer to a set of long-term historical data corresponding to the same first time sequence operation data. Generally, the number of long-term historical data in the long-term historical data set is consistent with the number of days in the preset time period.

[0079] It is worth noting that in the embodiments of the present application, long-term and short-term are relatively present, that is, long-term and short-term can be relatively distinguished by the preset time period and the preset time window, and the embodiments of the present application do not make additional elaboration on this.

[0080] In step c2, feature statistics are performed on each long-term historical data in the long-term historical data set based on a preset business field, to obtain a long-term historical feature set corresponding to the long-term historical data set.

[0081] The preset business field can refer to a field standard preset for defining the feature statistics process of the long-term historical data. For example, the preset business field can be resource transfer amount, resource transfer index, or high-frequency resource transfer counterpart. The long-term historical feature can refer to a historical feature corresponding to the entity to which the first time sequence operation data belongs in the preset time period. Generally, one preset business field corresponds to one long-term historical feature. Specifically, taking the preset business field as an example, the high-frequency resource transfer counterpart, the resource transfer counterpart in each long-term historical data can be counted and arranged in descending order of frequency, and the top three resource transfer counterparts can be summarized as the long-term historical feature corresponding to the high-frequency resource transfer counterpart. The long-term historical feature set can refer to a set of long-term historical features corresponding to the same long-term historical data set. Generally, one account identifier corresponds to one long-term historical feature set, and the number of long-term historical features in the long-term historical feature set is consistent with the number of preset business fields.

[0082] In step c3, the long-term historical feature set is spliced based on a preset identifier to obtain an offline feature corresponding to the current business system, and the offline feature is stored in a dimension table to obtain a preset association dimension table.

[0083] The preset identifier can refer to a component preset for connecting the respective long-term historical features corresponding to the same account identifier. For example, the preset identifier can be a vertical bar component "|". The feature splicing can refer to an operation of connecting the respective long-term historical features corresponding to the same account identifier by using the preset identifier. That is, the operation of connecting the long-term historical features in the same long-term historical feature set by using the preset identifier.

[0084] It is worth noting that in the embodiment of the present application, the preset association dimension table is generated in an offline state, one account identifier corresponds to one offline feature, and the number of offline features in the preset association dimension table is related to the number of account identifiers corresponding to the current business system.

[0085] Specifically, while determining the second time sequence operation data, the long-term historical data corresponding to the same account identifier as the first time sequence operation data in the preset time period of the current business system can be determined in the historical data source first, and each long-term historical data in the same preset time period is combined to obtain a long-term historical data set. Then, the feature statistics of each long-term historical data in the long-term historical data set is performed by using the preset business field, the long-term historical features corresponding to each long-term historical data are determined, and each long-term historical feature corresponding to the same long-term historical data set is combined and processed to obtain a long-term historical feature set. Finally, the feature splicing of each long-term historical feature in the same long-term historical feature set is performed by using the preset identifier, the offline feature corresponding to the account identifier of the first time sequence operation data is obtained, and the offline feature is stored in a dimension table to obtain the preset association dimension table corresponding to the current business system. Thus, by means of offline data processing, the resource transfer data calculation historical features generated according to the account identifier of the first time sequence operation data can compress high-dimensional features into lightweight identifiers, reduce the computing power requirement when processing a large amount of historical data, and improve the data processing efficiency.

[0086] S209, based on the preset identifier, the offline feature is parsed and processed to obtain the long-term historical feature corresponding to the second time sequence operation data.

[0087] The parsing and processing can refer to the operation of extracting the fields of the offline feature according to the preset identifier. For example, taking the offline feature "user_123 | opponent_cnt: 12 | avg_amt: 5000" as an example, the offline feature can be parsed and processed according to the preset identifier "|", and the long-term historical feature in the form of (account identifier: user_123, resource transfer opponent: 12, average resource transfer amount: 5000) can be obtained.

[0088] S210, based on the preset business rule, the second time sequence operation data and the long-term historical feature are compared to generate a data comparison result.

[0089] The data comparison can refer to a difference calculation operation on the second time-series operation data and the long-term historical feature by using a preset business rule. The data comparison result can refer to a comparison result generated after the data comparison on the second time-series operation data and the long-term historical feature based on the preset business rule. For example, if the preset business rule is to determine whether the number of counterparties in the second time-series operation data exceeds the number of historical counterparties, the data comparison result can be that the number of counterparties in the second time-series operation data exceeds the number of historical counterparties, or that the number of counterparties in the second time-series operation data does not exceed the number of historical counterparties. Similarly, if the preset business rule is to determine whether the counterparty in the second time-series operation data is in the top three counterparties in the historical counterparty queue, the data comparison result can be that the counterparty in the second time-series operation data is in the top three counterparties in the historical counterparty queue, or that the counterparty in the second time-series operation data is not in the top three counterparties in the historical counterparty queue.

[0090] S211, determining an offline feature label corresponding to the second time-series operation data based on the data comparison result, and combining the second time-series operation data and the offline feature label to obtain a candidate feature wide table corresponding to the second time-series operation data.

[0091] The offline feature label can refer to a feature label matched with the data comparison result in the preset business rule. For example, if the preset business rule is to determine whether the number of counterparties in the second time-series operation data exceeds the number of historical counterparties, and the data comparison result is that the number of counterparties in the second time-series operation data exceeds the number of historical counterparties, the offline feature label can be a high-frequency counterparty label. If the preset business rule is to determine whether the counterparty in the second time-series operation data is in the top three counterparties in the historical counterparty queue, and the data comparison result is that the counterparty in the second time-series operation data is in the top three counterparties in the historical counterparty queue, the offline feature label can be a known counterparty label.

[0092] Specifically, after obtaining the offline feature corresponding to the second time-series operation data, the offline feature can be analyzed and processed by using a preset identifier to obtain a long-term historical feature corresponding to the second time-series operation data. Then, the data comparison is performed on the second time-series operation data and the long-term historical feature by using a preset business rule to generate a data comparison result. Finally, the data comparison result is matched with a label by using the preset business rule to determine an offline feature label corresponding to the second time-series operation data, and the offline feature label is added to the second time-series operation data to obtain a candidate feature wide table corresponding to the second time-series operation data. Thus, an effective data basis is provided for subsequent operations.

[0093] S212, account identification is performed on the candidate feature wide table based on the target machine learning model, to obtain a first identification result corresponding to the candidate feature wide table and a candidate feature.

[0094] The identification result can refer to an identification result for identifying whether the resource transfer account is an abnormal behavior account. For example, the identification result can be that the account A is an abnormal account, or the account A is a normal account. The first identification result can refer to an identification result obtained after preliminary identification by the target machine learning model. The candidate feature can refer to an intermediate feature or a converted feature output in the process of account identification of the target machine learning model on the candidate feature wide table.

[0095] S213, the target feature is obtained by performing feature enhancement on the candidate feature based on a preset feature optimization rule, and the target feature and the candidate feature wide table are combined and processed to obtain a target feature wide table corresponding to the candidate feature wide table.

[0096] The preset feature optimization rule can refer to a rule predefined for limiting the feature enhancement process. For example, the preset feature optimization rule can be the feature importance obtained according to model training, only important features are retained, noise is reduced, or the original features are crossed to realize feature crossing. Generally, the preset feature optimization rule can be selected according to actual application requirements, and the embodiments of the present application do not make specific limitations. The target feature can refer to a secondary processed feature obtained by performing feature enhancement on the candidate feature by using the preset feature optimization rule.

[0097] Specifically, after obtaining the candidate feature wide table corresponding to the second time sequence operation data, the candidate feature wide table can be input into the target machine learning model, the model prediction is performed on the candidate feature wide table by the target machine learning model, and the first identification result corresponding to the candidate feature wide table and the candidate feature are obtained. Then, the target feature is obtained by performing feature enhancement on the candidate feature by using the preset feature optimization rule. Further, the short-term historical feature aggregation is performed on the target feature based on the preset time window to obtain the aggregated feature containing the short-term historical feature, the key field matching is performed on the aggregated feature based on the preset association dimension table to determine the offline feature corresponding to the aggregated feature, and the rule judgment is performed on the aggregated feature based on the preset business rule and the offline feature to determine the corresponding feature label. Finally, the feature label is added to the candidate feature wide table to obtain the target feature wide table corresponding to the candidate feature wide table. Thus, the model has strong robustness by secondary processing of features and passing to the model in a short time, and the accuracy of the model is further improved.

[0098] S214, account identification is performed on the target feature wide table based on the target machine learning model, to obtain a second identification result corresponding to the target feature wide table.

[0099] The second identification result can refer to an identification result obtained after secondary identification using the target machine learning model.

[0100] S215, combining the first identification result and the second identification result to obtain an abnormal account identification corresponding to the current business system.

[0101] Specifically, after obtaining the target feature wide table corresponding to the candidate feature wide table, the target feature wide table can be input into the target machine learning model, and the target feature wide table is predicted by the target machine learning model to obtain the second identification result. Further, the first identification result and the second identification result are combined and processed, and the abnormal account identification is determined according to the combined result. For example, if the first identification result is that the account A is a normal account, and the second identification result is that the account A is an abnormal account, then the account A can be identified as an abnormal account. Thus, by enhancing the features and partially preliminary features to train the machine learning model twice, the ability of the model to identify abnormal accounts can be enhanced, and the efficiency of identifying abnormal accounts is improved.

[0102] In the embodiment of the present application, by acquiring the basic time sequence operation data set corresponding to the current business system, the basic time sequence operation data set is standardized based on the preset data processing rule to obtain the selected time sequence operation data set corresponding to the basic time sequence operation data set, and the selected time sequence operation data set is divided into queues based on the account identifier of each selected time sequence operation data in the selected basic time sequence operation data set to obtain the target message queue set corresponding to the current business system. Then, in the target message queue set, the target message queue corresponding to the current business system containing the first time sequence operation data after standardization is acquired, and the account identifier corresponding to the first time sequence operation data is acquired. The short-term historical data in the preset time window range is determined in the historical data source based on the account identifier. Further, the short-term historical data is statistically characterized based on the preset feature field to obtain the short-term historical feature corresponding to the first time sequence operation data. The first time sequence operation data and the short-term historical feature are aggregated to obtain the second time sequence operation data containing the short-term historical feature. The second time sequence operation data is matched based on the preset association dimension table to determine the offline feature corresponding to the second time sequence operation data. Further, the offline feature is parsed based on the preset identifier to obtain the long-term historical feature corresponding to the second time sequence operation data. The second time sequence operation data and the long-term historical feature are compared based on the preset business rule to generate a data comparison result. The offline feature label corresponding to the second time sequence operation data is determined based on the data comparison result, and the second time sequence operation data and the offline feature label are combined to obtain the selected feature wide table corresponding to the second time sequence operation data. Finally, the target machine learning model is used for account recognition on the selected feature wide table to obtain the first identification result and the selected feature corresponding to the selected feature wide table. The target feature is obtained by feature enhancement of the selected feature based on the preset feature optimization rule. The target feature and the selected feature wide table are combined to obtain the target feature wide table corresponding to the selected feature wide table. The target machine learning model is used for account recognition on the target feature wide table to obtain the second identification result corresponding to the target feature wide table. The first identification result and the second identification result are combined to obtain the abnormal account identifier corresponding to the current business system. Since the real-time big data technology is combined with machine learning, the timeliness of the data is guaranteed, and the model is not easy to fail. At the same time, the time sequence operation data is processed twice in a short time and transmitted to the model, so that the model has strong robustness. Therefore, the processing efficiency of the time sequence operation data can be improved, and the identification efficiency of the abnormal account can be improved.

[0103] Figure 4A flowchart of a candidate feature wide table generation process provided for an embodiment of the present application is provided. Specifically, first, a basic time sequence operation data set corresponding to a current business system is obtained, then the basic time sequence operation data set is standardized based on a preset data processing rule to obtain a candidate time sequence operation data set corresponding to the basic time sequence operation data set, and the candidate time sequence operation data set is divided into queues based on the account identifier of each candidate time sequence operation data in the candidate basic time sequence operation data set to obtain a target message queue set corresponding to the current business system, thereby realizing real-time data processing. Further, the first time sequence operation data in the target message queue in the target message queue set is aggregated based on a preset time window to obtain second time sequence operation data containing short-term historical features, thereby realizing real-time feature calculation. Furthermore, the second time sequence operation data is matched based on a preset association dimension table to determine the offline features corresponding to the second time sequence operation data, and the second time sequence operation data is judged based on a preset business rule and the offline features, thereby obtaining a candidate feature wide table corresponding to the second time sequence operation data according to the rule judgment result.

[0104] Figure 5 A flowchart of a first account identification process based on a target machine learning model provided for an embodiment of the present application is provided. Specifically, after obtaining the candidate feature wide table corresponding to the second time sequence operation data, the candidate feature wide table can be input into the target machine learning model, and the model prediction of the candidate feature wide table is performed through the target machine learning model, and the first identification result and the candidate feature corresponding to the candidate feature wide table are obtained.

[0105] Figure 6 A flowchart of a target feature wide table generation process provided for an embodiment of the present application is provided. Specifically, after obtaining the candidate feature corresponding to the candidate feature wide table, the candidate feature can be enhanced by using a preset feature optimization rule to obtain a target feature. Further, the target feature is aggregated based on a preset time window to realize real-time feature calculation, and an aggregated feature containing short-term historical features is obtained, the aggregated feature is matched based on a preset association dimension table to determine the offline features corresponding to the aggregated feature, and the aggregated feature is judged based on a preset business rule and the offline features to determine the corresponding feature label. Finally, the feature label is added to the candidate feature wide table to obtain a target feature wide table corresponding to the candidate feature wide table.

[0106] Figure 7 A structural schematic diagram of an abnormal account identification device based on machine learning provided for an embodiment of the present application is provided. The device can perform the abnormal account identification method based on machine learning involved in each of the above embodiments. The device can be realized in the form of software and / or hardware, such as a server, a computer, a mobile phone, a tablet computer, a personal digital assistant, a wearable device, etc. Figure 7As shown, the machine learning-based abnormal account identification device specifically comprises: a queue acquisition module 310, a real-time calculation module 320, a data processing module 330, and an abnormal identification module 340;

[0107] The queue acquisition module 310 is configured to acquire a target message queue corresponding to a current business system, wherein the target message queue contains first time-series operation data after standardization processing.

[0108] The real-time calculation module 320 is configured to perform short-term historical feature aggregation on the first time-series operation data based on a preset time window, to obtain second time-series operation data containing short-term historical features.

[0109] The data processing module 330 is configured to perform key field matching on the second time-series operation data based on a preset association dimension table, to determine offline features corresponding to the second time-series operation data, and perform rule judgment on the second time-series operation data based on a preset business rule and the offline features, to obtain a candidate feature wide table corresponding to the second time-series operation data.

[0110] The abnormal identification module 340 is configured to perform feature enhancement on the candidate feature wide table based on a target machine learning model, to obtain a target feature wide table corresponding to the candidate feature wide table, and perform account identification on the target feature wide table based on the target machine learning model, to determine an abnormal account identifier corresponding to the current business system.

[0111] In the embodiment of the application, the target message queue containing the first time-series operation data after standardization processing corresponding to the current business system is acquired. Then, the first time-series operation data is aggregated based on the preset time window to obtain the second time-series operation data containing short-term historical features. Further, the second time-series operation data is matched based on the preset association dimension table to determine the offline features corresponding to the second time-series operation data, and the second time-series operation data is judged based on the preset business rule and the offline features to obtain the candidate feature wide table corresponding to the second time-series operation data. Finally, the candidate feature wide table is enhanced based on the target machine learning model to obtain the target feature wide table corresponding to the candidate feature wide table, and the target feature wide table is identified based on the target machine learning model to determine the abnormal account identifier corresponding to the current business system. Since the real-time big data technology is combined with machine learning, the timeliness of the data is ensured, and the model is not easily invalidated. At the same time, the time-series operation data is processed twice in a short time and transmitted to the model, so that the model has strong robustness. Therefore, the processing efficiency of the time-series operation data can be improved, and the identification efficiency of the abnormal account can be improved.

[0112] Optionally, the machine learning-based abnormal account identification apparatus can further include a queue preprocessing module configured to: obtain a basic time-series operation data set corresponding to a current business system before obtaining a target message queue corresponding to the current business system; perform standardization processing on the basic time-series operation data set based on a preset data processing rule to obtain a to-be-selected time-series operation data set corresponding to the basic time-series operation data set; perform queue division on the to-be-selected time-series operation data set based on account identifiers of each to-be-selected time-series operation data in the to-be-selected time-series operation data set to obtain a target message queue set corresponding to the current business system; and wherein the target message queue set includes each target message queue, and each time-series operation data corresponding to the same account identifier in a same target message queue.

[0113] Optionally, the queue preprocessing module can be specifically configured to:

[0114] perform field identification on the basic time-series operation data set based on a preset stream calculation identifier rule to obtain an intermediate time-series operation data set corresponding to the basic time-series operation data set;

[0115] perform standardization processing on the intermediate time-series operation data set based on a preset data format to obtain the to-be-selected time-series operation data set corresponding to the basic time-series operation data set.

[0116] Optionally, the machine learning-based abnormal account identification apparatus can further include a data screening module configured to: perform data screening on each time-series operation data in the target message queue based on a preset static condition, and take the time-series operation data satisfying the preset static condition as first time-series operation data.

[0117] Optionally, the real-time calculation module 320 can be specifically configured to:

[0118] obtain an account identifier corresponding to the first time-series operation data, and determine short-term historical data in a preset time window range in a historical data source based on the account identifier;

[0119] perform feature statistics on the short-term historical data based on a preset feature field to obtain short-term historical features corresponding to the first time-series operation data;

[0120] aggregate the first time-series operation data and the short-term historical features to obtain second time-series operation data containing short-term historical features.

[0121] Optionally, the machine learning-based abnormal account identification apparatus can further include a dimension table construction module configured to: before determining the offline feature corresponding to the second time-series operation data by performing key field matching on the second time-series operation data based on the preset association dimension table, determine a long-term historical data set corresponding to the current business system in a historical data source based on a preset time period; perform feature statistics on each long-term historical data in the long-term historical data set based on a preset business field, to obtain a long-term historical feature set corresponding to the long-term historical data set; perform feature splicing on the long-term historical feature set based on a preset identifier, to obtain the offline feature corresponding to the current business system, and store the offline feature in a dimension table to obtain the preset association dimension table.

[0122] Optionally, the preset association dimension table is generated in an offline state.

[0123] Optionally, the data processing module 330 can be specifically configured to:

[0124] perform analysis processing on the offline feature based on a preset identifier, to obtain a long-term historical feature corresponding to the second time-series operation data;

[0125] perform data comparison on the second time-series operation data and the long-term historical feature based on a preset business rule, to generate a data comparison result;

[0126] determine an offline feature label corresponding to the second time-series operation data based on the data comparison result, and combine the second time-series operation data and the offline feature label to obtain a to-be-selected feature wide table corresponding to the second time-series operation data.

[0127] Optionally, the abnormal identification module 340 can be specifically configured to:

[0128] perform account identification on the to-be-selected feature wide table based on a target machine learning model, to obtain a first identification result corresponding to the to-be-selected feature wide table and a to-be-selected feature;

[0129] perform feature enhancement on the to-be-selected feature based on a preset feature optimization rule to obtain a target feature, and combine the target feature and the to-be-selected feature wide table to obtain a target feature wide table corresponding to the to-be-selected feature wide table.

[0130] Optionally, the abnormal identification module 340 can be specifically configured to:

[0131] perform account identification on the target feature wide table based on the target machine learning model, to obtain a second identification result corresponding to the target feature wide table;

[0132] combine the first identification result and the second identification result to obtain an abnormal account identification corresponding to the current business system.

[0133] Optionally, the machine learning-based abnormal account identification device can further include a policy generation module configured to, after determining the abnormal account identifier corresponding to the current business system based on the target machine learning model performing account identification on the target feature wide table, combine the abnormal account identifier and the target message queue to obtain an abnormal message queue corresponding to the current business system, and generate a time sequence operation management policy corresponding to the abnormal message queue based on a preset data management rule.

[0134] The machine learning-based abnormal account identification device provided by the embodiments of the present application can execute the machine learning-based abnormal account identification method provided by any of the embodiments of the present application, and has the corresponding function modules and beneficial effects of the execution method.

[0135] Figure 8 To implement the electronic device of the machine learning-based abnormal account identification method according to the embodiments of the present application, as shown in Figure 8 , the electronic device includes a processor 410, a memory 420, an input device 430, and an output device 440; the number of processors 410 in the electronic device can be one or more, Figure 8 , taking one processor 410 as an example; the processor 410, the memory 420, the input device 430, and the output device 440 in the electronic device can be connected through a bus or other means, Figure 8 , taking connection through a bus as an example.

[0136] The memory 420, as a kind of computer readable storage medium, can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the machine learning-based abnormal account identification method in the embodiments of the present application (for example, the queue acquisition module 310, the real-time calculation module 320, the data processing module 330, and the abnormal identification module 340 in the machine learning-based abnormal account identification device). The processor 410 executes the software programs, instructions and modules stored in the memory 420, thereby performing various functional applications and data processing of the electronic device, that is, implementing the machine learning-based abnormal account identification method described above.

[0137] The memory 420 can include a program storage area and a data storage area. The program storage area can store an operating system, applications required for at least one function, and the like. The data storage area can store data created based on a use of the terminal, and the like. In addition, the memory 420 can include a high-speed random access memory, and can further include a nonvolatile memory such as at least one of a magnetic disk storage device, a flash memory device, or other non-volatile solid state storage device. In some examples, the memory 420 can further include a memory disposed remotely from the processor 410, which can be connected to the electronic device through a network. Examples of the network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0138] The input device 430 can be used to receive input digital or character information, and to generate key signal input related to user settings and function controls of the electronic device. The output device 440 can include a display device such as a display screen.

[0139] The embodiment of the present application also provides a storage medium containing computer executable instructions, which are used to execute a machine learning based abnormal account identification method when executed by a computer processor. The method comprises the following steps:

[0140] Obtaining a target message queue corresponding to a current business system; wherein the target message queue contains first time sequence operation data after standardization processing;

[0141] Performing short-term historical feature aggregation on the first time sequence operation data based on a preset time window to obtain second time sequence operation data containing short-term historical features;

[0142] Performing key field matching on the second time sequence operation data based on a preset association dimension table to determine offline features corresponding to the second time sequence operation data, and performing rule judgment on the second time sequence operation data based on a preset business rule and the offline features to obtain a candidate feature wide table corresponding to the second time sequence operation data;

[0143] Performing feature enhancement on the candidate feature wide table based on a target machine learning model to obtain a target feature wide table corresponding to the candidate feature wide table, and performing account identification on the target feature wide table based on the target machine learning model to determine an abnormal account identifier corresponding to the current business system.

[0144] Of course, the computer executable instructions of the storage medium provided by the embodiment of the present application are not limited to the method operations as described above, but can also perform related operations in the machine learning based abnormal account identification method provided by any embodiment of the present application.

[0145] Through the above description of the embodiments, those skilled in the art can clearly understand that the present application can be realized by means of software and necessary general hardware, and of course can also be realized by hardware, but in many cases the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product in essence or in the form of a part that contributes to the prior art, and the computer software product can be stored in a computer readable storage medium, such as a floppy disk, a read-only memory (ROM), a random access memory (RAM), a FLASH, a hard disk, or an optical disk, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in various embodiments of the present application.

[0146] It is worth noting that in the above embodiments of the machine learning-based abnormal account identification device, each unit and module included is only divided according to functional logic, but is not limited to the above division, as long as the corresponding functions can be realized; in addition, the specific names of each functional unit are only for easy mutual differentiation, and do not limit the protection scope of the present application.

[0147] The embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the machine learning-based abnormal account identification method provided by any embodiment of the present application.

[0148] The computer program product in the implementation process can be written in one or more program design languages or combinations thereof to execute the computer program code for performing the operations of the present application, and the program design language includes an object-oriented program design language such as Java, Smalltalk, C++, and a conventional procedural program design language such as "C" language or similar program design language. The program code can be completely executed on a user computer, partially executed on a user computer, executed as a separate software package, partially executed on a user computer and partially executed on a remote computer, or completely executed on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user computer through any kind of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, connected through the Internet by using an Internet service provider).

[0149] Note that the above merely describes preferred embodiments of the present application and the principles of the technology applied. Those skilled in the art will understand that the present application is not limited to the specific embodiments described herein, and that various obvious changes, modifications and substitutions can be made thereto without departing from the scope of the present application. Therefore, although the present application has been described in detail through the above embodiments, the present application is not limited to the above embodiments, and can include more other equivalent embodiments without departing from the concept of the present application, and the scope of the present application is determined by the scope of the claims.

Claims

1. A method for identifying an abnormal account based on machine learning, characterized in that, The method comprises the following steps: obtaining a target message queue corresponding to a current business system; wherein the target message queue comprises first time sequence operation data after standardization processing; performing short-term historical feature aggregation on the first time sequence operation data based on a preset time window to obtain second time sequence operation data comprising short-term historical features; performing key field matching on the second time sequence operation data based on a preset association dimension table to determine offline features corresponding to the second time sequence operation data, and performing rule judgment on the second time sequence operation data based on a preset business rule and the offline features to obtain candidate feature wide tables corresponding to the second time sequence operation data; performing feature enhancement on the candidate feature wide tables based on a target machine learning model to obtain target feature wide tables corresponding to the candidate feature wide tables, and performing account identification on the target feature wide tables based on the target machine learning model to determine an abnormal account identifier corresponding to the current business system.

2. The method of claim 1, wherein, Before the step of obtaining the target message queue corresponding to the current business system, the method further comprises the following steps: obtaining a basic time sequence operation data set corresponding to the current business system; performing standardization processing on the basic time sequence operation data set based on a preset data processing rule to obtain a candidate time sequence operation data set corresponding to the basic time sequence operation data set; performing queue division on the candidate time sequence operation data set based on account identifiers of each candidate time sequence operation data in the candidate basic time sequence operation data set to obtain a target message queue set corresponding to the current business system; wherein the target message queue set comprises each target message queue, and each time sequence operation data corresponding to the same account identifier in the same target message queue.

3. The method of claim 2, wherein, The step of performing standardization processing on the basic time sequence operation data set based on a preset data processing rule to obtain a candidate time sequence operation data set corresponding to the basic time sequence operation data set comprises the following steps: performing field identification on the basic time sequence operation data set based on a preset stream calculation identifier rule to obtain an intermediate time sequence operation data set corresponding to the basic time sequence operation data set; performing data format standardization processing on the intermediate time sequence operation data set to obtain the candidate time sequence operation data set corresponding to the basic time sequence operation data set.

4. The method of claim 1, wherein, The operation of determining the first time sequence operation data in the target message queue comprises the following steps: performing data screening on each time sequence operation data in the target message queue based on a preset static condition, and taking the time sequence operation data satisfying the preset static condition as the first time sequence operation data.

5. The method of claim 1, wherein, The step of performing short-term historical feature aggregation on the first time sequence operation data based on a preset time window to obtain second time sequence operation data comprising short-term historical features comprises the following steps: obtaining an account identifier corresponding to the first time sequence operation data, and determining short-term historical data in a preset time window range in a historical data source based on the account identifier; performing feature statistics on the short-term historical data based on a preset feature field to obtain short-term historical features corresponding to the first time sequence operation data; performing aggregation processing on the first time sequence operation data and the short-term historical features to obtain the second time sequence operation data comprising short-term historical features.

6. The method of claim 1, wherein, Before the key field matching of the second time sequence operation data based on the preset association dimension table, the method further comprises: determining a long-term historical data set corresponding to the current business system in a historical data source based on a preset time period; performing feature statistics on each long-term historical data in the long-term historical data set based on a preset business field to obtain a long-term historical feature set corresponding to the long-term historical data set; performing feature splicing on the long-term historical feature set based on a preset identifier to obtain an offline feature corresponding to the current business system, and performing dimension table storage on the offline feature to obtain a preset association dimension table.

7. The method of claim 6, wherein, The preset association dimension table is generated in an offline state.

8. The method of claim 1, wherein, The rule judgment of the second time sequence operation data based on the preset business rule and the offline feature to obtain a candidate feature wide table corresponding to the second time sequence operation data comprises: analyzing and processing the offline feature based on a preset identifier to obtain a long-term historical feature corresponding to the second time sequence operation data; performing data comparison on the second time sequence operation data and the long-term historical feature based on a preset business rule to generate a data comparison result; determining an offline feature label corresponding to the second time sequence operation data based on the data comparison result, and combining and processing the second time sequence operation data and the offline feature label to obtain a candidate feature wide table corresponding to the second time sequence operation data.

9. The method of claim 1, wherein, The feature enhancement of the candidate feature wide table based on the target machine learning model to obtain a target feature wide table corresponding to the candidate feature wide table comprises: performing account identification on the candidate feature wide table based on a target machine learning model to obtain a first identification result and a candidate feature corresponding to the candidate feature wide table; performing feature enhancement on the candidate feature based on a preset feature optimization rule to obtain a target feature, and combining and processing the target feature and the candidate feature wide table to obtain a target feature wide table corresponding to the candidate feature wide table.

10. The method of claim 9, wherein, The account identification of the target feature wide table based on the target machine learning model to determine an abnormal account identifier corresponding to the current business system comprises: performing account identification on the target feature wide table based on the target machine learning model to obtain a second identification result corresponding to the target feature wide table; combining and processing the first identification result and the second identification result to obtain an abnormal account identifier corresponding to the current business system.

11. The method of claim 1, wherein, After the account identification of the target feature wide table based on the target machine learning model to determine an abnormal account identifier corresponding to the current business system, the method further comprises: combining and processing the abnormal account identifier and the target message queue to obtain an abnormal message queue corresponding to the current business system; performing strategy judgment on the abnormal message queue based on a preset data management rule to generate a time sequence operation management strategy corresponding to the abnormal message queue. 12.A machine learning based abnormal account identification apparatus, characterized by, The method comprises: a queue acquisition module configured to acquire a target message queue corresponding to a current business system; wherein the target message queue comprises standardized first time sequence operation data. The real-time calculation module is configured to perform short-term historical feature aggregation on the first time-series operation data based on a preset time window, to obtain second time-series operation data containing short-term historical features; The data processing module is configured to perform key field matching on the second time-series operation data based on a preset association dimension table, to determine offline features corresponding to the second time-series operation data, and to perform rule judgment on the second time-series operation data based on a preset business rule and the offline features, to obtain a to-be-selected feature wide table corresponding to the second time-series operation data; The abnormality identification module is configured to perform feature enhancement on the to-be-selected feature wide table based on a target machine learning model, to obtain a target feature wide table corresponding to the to-be-selected feature wide table, and to perform account identification on the target feature wide table based on the target machine learning model, to determine an abnormal account identifier corresponding to the current business system.

13. An electronic device, comprising: The computer program is stored in the memory and executable in the processor, and when the processor executes the computer program, the method for identifying an abnormal account based on machine learning is implemented.

14. A computer readable storage medium having stored thereon a computer program, characterized in that, The program is executed by the processor to implement the method for identifying an abnormal account based on machine learning.

15. A computer program product comprising a computer program, characterized in that, The computer program is stored in the memory and executable in the processor, and when the processor executes the computer program, the method for identifying an abnormal account based on machine learning is implemented.

Images