Transaction interception method and related product

Abstract

The invention discloses a transaction interception method and a related product. The method comprises the following steps: determining a plurality of users, wherein the social accounts of the plurality of users have collection records; based on a pre-trained user evaluation model, transaction evaluation results corresponding to a plurality of users are obtained, the user evaluation model is obtained by training social data of a plurality of training nodes in advance, and the training nodes comprise normal user nodes, transaction user nodes of the normal user nodes and abnormal user nodes. The transaction user node is the abnormal user node; on the basis of the transaction evaluation results corresponding to the multiple users, determining the users with abnormal transaction evaluation results in the multiple users as abnormal users; and in response to a payment operation to the abnormal user, intercepting the payment operation. Therefore, the accurate transaction evaluation result can be obtained, the abnormal user can be accurately identified, payment to the abnormal user is intercepted, transaction between normal users is prevented from being intercepted, and the user experience is improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to transaction interception methods and related products. Background Technology

[0002] Social payment is a payment method that combines payment functionality with social media platforms or communication applications. Under this new payment model, users can conduct payment transactions directly within social media platforms or communication applications, enabling quick and convenient money transfers and purchases.

[0003] As user engagement with social payments continues to increase, there is a possibility that malicious users may try to trick legitimate users into making payment transactions, resulting in financial losses for the legitimate users. Currently, payment transactions can be identified during the transaction process, and alerts or blocking transactions if anomalies are detected. However, existing transaction identification methods lack accuracy and may misjudge, thus affecting transactions between legitimate users. Therefore, identifying and blocking legitimate transactions as abnormal would significantly impact the user experience. Summary of the Invention

[0004] This application provides a transaction interception method and related products to improve the accuracy of identifying abnormal users and avoid intercepting transactions between normal users.

[0005] The embodiments of this application disclose the following technical solutions:

[0006] In a first aspect, embodiments of this application provide a transaction interception method, including:

[0007] Multiple users were identified, and payment records existed under the social media accounts of these multiple users;

[0008] Based on a pre-trained user evaluation model, transaction evaluation results are obtained for each of the multiple users. The user evaluation model is pre-trained based on social data from multiple training nodes, including normal user nodes, transaction user nodes of the normal user nodes, abnormal user nodes, and transaction user nodes of the abnormal user nodes.

[0009] Based on the transaction evaluation results corresponding to the multiple users, users whose transaction evaluation results are abnormal are identified as abnormal users.

[0010] In response to a payment request to the abnormal user, the payment request is intercepted.

[0011] Secondly, embodiments of this application provide a transaction interception device, comprising:

[0012] The user identification module is used to identify multiple users whose social media accounts have payment records.

[0013] The user evaluation module is used to obtain transaction evaluation results for each of the multiple users based on a pre-trained user evaluation model. The user evaluation model is pre-trained based on social data from multiple training nodes, including normal user nodes, transaction user nodes of the normal user nodes, abnormal user nodes, and transaction user nodes of the abnormal user nodes.

[0014] The user identification module is used to identify users whose transaction evaluation results are abnormal as abnormal users based on the transaction evaluation results corresponding to the multiple users respectively.

[0015] The transaction interception module is used to intercept payment operations made to the abnormal user.

[0016] Thirdly, embodiments of this application provide an electronic device, the device including a processor and a memory:

[0017] The memory is used to store computer programs and to transfer the computer programs to the processor;

[0018] The processor is configured to execute the steps of the transaction interception method provided in the first aspect according to the instructions in the computer program.

[0019] Fourthly, embodiments of this application provide a computer-readable storage medium for storing program code for executing the steps of the transaction interception method provided in the first aspect.

[0020] Fifthly, embodiments of this application provide a computer program product, including a computer program or instructions, which, when executed by a processor, implement the steps of the transaction interception method provided in the first aspect.

[0021] As can be seen from the above technical solutions, the embodiments of this application have the following advantages:

[0022] In this embodiment, after identifying multiple users, transaction evaluation results for each user can be obtained based on a pre-trained user evaluation model. Since these users have payment records on their social media accounts, and the user evaluation model is pre-trained based on social data from multiple training nodes (including normal user nodes, transaction user nodes of normal user nodes, abnormal user nodes, and transaction user nodes of abnormal user nodes), the user evaluation model can effectively incorporate the social data of each training node in the social scenario into the network structure. By using the social data of each training node, it can determine whether a node is a normal or abnormal user node, thereby effectively improving the accuracy of the user evaluation model. Subsequently, based on the transaction evaluation results for each user, users whose transaction evaluation results indicate abnormality can be identified as abnormal users. In response to payment operations to abnormal users, payment operations can be intercepted. In this way, based on accurate transaction evaluation results, abnormal users can be accurately identified, and payments to abnormal users can be intercepted, thereby avoiding the interception of transactions between normal users and improving the user experience. Attached Figure Description

[0023] Figure 1 A schematic diagram of the overall architecture of a transaction interception method provided in an embodiment of this application;

[0024] Figure 2 A flowchart illustrating a transaction interception method provided in this application embodiment;

[0025] Figure 3 A flowchart illustrating the training process of a user evaluation model provided in this application embodiment;

[0026] Figure 4a A schematic diagram of a graph structure provided in an embodiment of this application;

[0027] Figure 4b A schematic diagram of a preset subgraph structure provided in an embodiment of this application;

[0028] Figure 4c A schematic diagram of another preset subgraph structure provided in the embodiments of this application;

[0029] Figure 4d This is a schematic diagram illustrating an implementation process for decomposing and obtaining the subgraph structure corresponding to the training nodes, as provided in an embodiment of this application.

[0030] Figure 5a A schematic diagram illustrating the implementation process of calculating the attention coefficient of a training node, provided in an embodiment of this application;

[0031] Figure 5bA schematic diagram illustrating an implementation process for calculating the updated features of training nodes based on a multi-channel attention mechanism, as provided in an embodiment of this application.

[0032] Figure 6 This is a schematic diagram of the structure of a transaction interception device provided in an embodiment of this application;

[0033] Figure 7 This application provides a schematic diagram of the structure of a server according to an embodiment of the present application.

[0034] Figure 8 This is a schematic diagram of the structure of a terminal device provided in an embodiment of this application. Detailed Implementation

[0035] As mentioned earlier, it's currently possible to identify payment transactions during the transaction process and issue alerts or block transactions when anomalies are detected. In practical applications, common identification methods involve: first, analyzing historical abnormal transaction cases and performing quantitative analysis using indicators such as information content to uncover features representing abnormal transactions; then, obtaining effective rule combinations based on expert experience or decision tree models. If a transaction meets this rule combination, it is determined that the transaction carries an abnormal risk, and the transaction is blocked or alerted.

[0036] However, because social payments involve a vast network of relationships containing a wealth of feature information, the aforementioned feature mining process struggles to handle such a large amount of data. Insufficient mining can lead to inaccurate identification and potential misjudgments, thus impacting transactions between legitimate users. Therefore, identifying and blocking legitimate transactions as abnormal would significantly negatively affect the user experience.

[0037] To address the aforementioned issues, this application provides a transaction interception method. This method includes: after identifying multiple users, obtaining transaction evaluation results for each user based on a pre-trained user evaluation model. Since the social accounts of these multiple users have payment records, and the user evaluation model is pre-trained based on social data from multiple training nodes (including normal user nodes, transaction user nodes of normal user nodes, abnormal user nodes, and transaction user nodes of abnormal user nodes), the user evaluation model can effectively incorporate the social data of each training node in the social scenario into the network structure. By leveraging the social data of each training node, it can determine whether a node is a normal or abnormal user node, thereby effectively improving the accuracy of the user evaluation model. Subsequently, based on the transaction evaluation results corresponding to each user, users whose transaction evaluation results indicate abnormality can be identified as abnormal users. In response to payment operations to abnormal users, payment operations are intercepted. In this way, based on accurate transaction evaluation results, abnormal users can be accurately identified, and payments to abnormal users can be intercepted, thereby avoiding the interception of transactions between normal users and improving user experience.

[0038] It should be noted that the embodiments of this application do not limit the executing entity of the technical solution of this application. For example, the transaction interception method provided in the embodiments of this application can be applied to a user terminal or a server, or it can be processed collaboratively by a user terminal and a server. As an example, the user terminal includes, but is not limited to, mobile phones, computers, smart voice interaction devices, smart home appliances, vehicle terminals, aircraft, etc. The server can be a standalone server, a cluster server, or a cloud server.

[0039] To enable those skilled in the art to better understand the present invention, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0040] First, to facilitate understanding of the specific implementation of the solution, the overall architecture of the transaction interception method will be described in this application embodiment. The overall architecture of the transaction interception method will be described below with reference to the embodiments and accompanying drawings.

[0041] Figure 1 This is a schematic diagram of the overall architecture of a transaction interception method provided in an embodiment of this application. Combined with... Figure 1As shown, the overall architecture of the transaction interception method provided in this application embodiment mainly includes a machine learning platform and risk strategy engine configured in the backend, and a social payment platform configured in the frontend.

[0042] The machine learning platform can deploy a pre-trained user rating model and determine the model's inference samples by periodically identifying users. Specifically, the platform can use users associated with social media accounts that have payment records within a preset timeframe, such as the past week, as inference samples for the user rating model. Then, the social data of the identified users is processed to obtain the features input to the user rating model.

[0043] Furthermore, the period for determining inference samples can be set to daily. In other words, the machine learning platform can determine the inference samples for each day and output the transaction evaluation results of the users determined that day through the user evaluation model.

[0044] In practical applications, the output of the user evaluation model, i.e., the transaction evaluation result, can be represented in the form of a score. This score indicates the probability that a user is an abnormal user or a normal user. Accordingly, the higher the score, the higher the probability that the user is an abnormal user and the lower the probability that the user is a normal user, meaning that the risk of the user engaging in abnormal transactions is higher; conversely, the lower the score, the lower the probability that the user is an abnormal user and the higher the probability that the user is a normal user, meaning that the risk of the user engaging in abnormal transactions is lower.

[0045] The risk strategy engine first receives the transaction evaluation results of each user from the machine learning platform and then identifies anomalous users based on pre-set score thresholds. For example, if the transaction evaluation results are represented as scores ranging from 0 to 1, the risk strategy engine can set a score threshold based on the specific business scenario; for instance, the score threshold could be set to 0.9. Accordingly, a transaction evaluation result greater than or equal to 0.9 indicates an anomalous transaction evaluation result, and therefore, the corresponding user is an anomalous user; a transaction evaluation result less than 0.9 indicates a normal transaction evaluation result, and therefore, the corresponding user is a normal user.

[0046] Furthermore, the risk strategy engine can continuously monitor each user's payment information. If it detects payment transactions to the identified abnormal users, it can directly intercept these transactions on the social payment platform. Correspondingly, it can also display a reminder message to the paying user on the payment transaction page, thereby preventing financial loss for the paying user.

[0047] Based on the above, in this embodiment of the application, the cooperation of the machine learning platform, the risk strategy engine, and the social payment platform can effectively identify each user with payment records and provide a transaction evaluation structure for these users. In this way, based on the accurate transaction evaluation results, abnormal users can be accurately identified and payments to abnormal users can be blocked, thereby avoiding financial losses to users and preventing the blocking of transactions between normal users, thus improving the user experience.

[0048] Based on the overall architecture of the transaction interception method provided in the above embodiments, this application can also provide corresponding transaction interception methods. The transaction interception methods are described below with reference to the embodiments and accompanying drawings.

[0049] Figure 2 This is a flowchart illustrating a transaction interception method provided in an embodiment of this application. (In conjunction with...) Figure 2 As shown in the figure, the transaction interception method provided in this application embodiment uses a corresponding transaction interception device as the execution subject to describe the specific implementation of the scheme. The transaction interception method may include the following steps S201-S204.

[0050] S201: Identify multiple users.

[0051] Among these users, all of whom have payment records on their social media accounts. Therefore, in identifying these users, if the social payment platform's associated database stores transaction records for each social media account, these records can be retrieved first. Then, payment records are filtered from the transaction records, and the social media accounts corresponding to these payment records are used to identify the aforementioned users.

[0052] S202: Based on a pre-trained user evaluation model, obtain transaction evaluation results for multiple users respectively.

[0053] In this embodiment of the application, the user evaluation model is pre-trained based on social data from multiple training nodes.

[0054] In this context, each of the aforementioned training nodes can represent a user on the social payment platform. Correspondingly, these training nodes serve as nodes in a graph structure. The social data from these training nodes allows us to determine the transaction behavior between users on the social payment platform, and these transaction behaviors are used to construct edges connecting the nodes. In this way, a graph structure can be constructed using the multiple training nodes and their social data, facilitating model training to obtain a user evaluation model.

[0055] Accordingly, multiple training nodes can be selected from users on the social payment platform. Specifically, these multiple training nodes can include normal user nodes, transaction user nodes of normal user nodes, abnormal user nodes, and transaction user nodes of abnormal user nodes. Thus, a normal user node can refer to a user who conducts normal transactions on the social payment platform. A transaction user node of a normal user node can refer to a node that transacts with a normal user node. An abnormal user node can refer to a user who has conducted abnormal transactions on the social payment platform. A transaction user node of an abnormal user node can refer to a node that transacts with an abnormal user node. For ease of understanding, the selection process for the above four types of training nodes will be illustrated below with examples.

[0056] For abnormal user nodes, if the database stores tags associated with user nodes, which are used to mark the user node as a normal user node or an abnormal user node, then the tags associated with each user node can be retrieved from the database first, and then the user nodes marked as abnormal user nodes can be identified.

[0057] In practical applications, if a user node is complained about for abnormal transactions on a social payment platform, and the abnormal transactions are confirmed by manual review, then the user node can be labeled as an abnormal user node.

[0058] Additionally, it should be noted that the representation of the above-mentioned tags is not specifically limited in this embodiment. For example, the tag for marking abnormal user nodes can be set to 1, and the tag for marking normal user nodes can be set to 0.

[0059] Furthermore, regarding normal user nodes, considering that the proportion of users conducting normal transactions on social payment platforms is relatively high, while the proportion of users who have conducted abnormal transactions is relatively low, to improve the learning performance and training effect of the user evaluation model, firstly, user nodes labeled as normal user nodes in the database can be selected. Then, these user nodes are sampled, and the sampling results are used as the final normal user nodes for model training. In practical applications, the ratio of normal user nodes to abnormal user nodes obtained after sampling can be 50:1.

[0060] Correspondingly, regarding the transaction user nodes of abnormal user nodes and normal user nodes, as mentioned earlier, the database can store the transaction records of each social account. Therefore, the transaction records of the abnormal user nodes can be directly retrieved from the database, and the other user node pointed to by the transaction records of the abnormal user nodes can be used as the transaction user node of the abnormal user nodes. Similarly, the transaction records of the sampled normal user nodes can be retrieved from the database, and the other user node pointed to by the sampled normal user node's transaction records can be used as the transaction user node of the normal user nodes.

[0061] Furthermore, the social data of multiple training nodes refers to the data presented by the social accounts of multiple training nodes on the social payment platform. In this embodiment, the social data of multiple training nodes may include account attribute data of multiple training nodes, as well as friendship data and transaction data between multiple training nodes.

[0062] The account attribute data may include the account's registration time, the number of bank cards linked to the account, the number of bank cards unlinked from the account, the user's age and gender entered during registration, the address associated with the user's identity document, the number of accounts the user currently owns, the number of accounts the user has cancelled, the number of historically abnormal accounts the user has, and the account's frequently used transaction addresses on social payment platforms. In practical applications, the address associated with the user's identity document can be the address indicated on the user's identification document. Additionally, if the user registers with a contact number, that contact number can be used as the account identifier, and the account attribute data may also include the address associated with that identifier, i.e., the address associated with the contact number.

[0063] Social data can include the intimacy between the account and its friends on social payment platforms, as well as the duration of time since the account was added as a friend.

[0064] Transaction data can include transaction records for every transaction made by the account. These records may include transaction amounts and times. Transaction records can reveal situations such as multiple transactions made by an account within a short period of time, rapid receipt and transfer of funds, and sudden increases in large-amount transactions.

[0065] It should be noted that the aforementioned social data involves specific user information. The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application embodiment are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0066] Based on the above, in the training phase of the user evaluation model, firstly, normal user nodes, transaction user nodes of normal user nodes, abnormal user nodes, and transaction user nodes of abnormal user nodes can be selected as training nodes on the social payment platform. Then, the social data of these training nodes is acquired for model training, thereby obtaining the user evaluation model. In this way, the user evaluation model can effectively incorporate the social data of each training node in the social scenario into the network structure, and use the social data of each training node to determine whether a node is a normal or abnormal user node, thus effectively improving the recognition accuracy of the user evaluation model. Furthermore, the specific training process of the above user evaluation model can be found in the following embodiments, and will not be described further here.

[0067] Furthermore, in this embodiment, during the usage phase of the user evaluation model, specifically step S202, the multiple users identified in step S201 can be used as inference samples for the model. Next, the social data of each user is processed to obtain feature data input to the user evaluation model. The user evaluation model then evaluates the corresponding users based on these feature data, outputting transaction evaluation results for each user. Based on this accurate transaction evaluation result, abnormal users can be accurately identified and payments to abnormal users can be blocked, thereby preventing the interception of transactions between normal users and improving user experience.

[0068] S203: Based on the transaction evaluation results of multiple users, identify users whose transaction evaluation results are abnormal as abnormal users.

[0069] In this embodiment, the transaction evaluation result can be represented as a score, which indicates the probability that a user is an abnormal user or a normal user. Accordingly, the higher the score, the higher the probability that the user is an abnormal user and the lower the probability that the user is a normal user; that is, the higher the risk of the user engaging in abnormal transactions. Conversely, the lower the score, the lower the probability that the user is an abnormal user and the higher the probability that the user is a normal user; that is, the lower the risk of the user engaging in abnormal transactions. For example, if the transaction evaluation result is represented as a score with a value range between 0 and 1, then the score threshold can be set to 0.9. Accordingly, a transaction evaluation result greater than or equal to 0.9 indicates an abnormal transaction, therefore, the corresponding user is an abnormal user; a transaction evaluation result less than 0.9 indicates a normal transaction, therefore, the corresponding user is a normal user.

[0070] S204: In response to a payment operation to an abnormal user, the payment operation is intercepted.

[0071] Here, in order to completely prevent transactions by abnormal users and avoid financial losses for normal users, a payment operation to an abnormal user can refer to a payment operation initiated by any user on the social payment platform to an abnormal user.

[0072] In other words, when any user acts as the payer and an abnormal user acts as the payee, the payment operation can be intercepted when it is detected that the payer is making a payment to the payee. Furthermore, in this embodiment, a notification message can be sent to the payer to improve their financial security. For example, when user A initiates a payment operation to an abnormal user, a pop-up window can be displayed on user A's payment page to restrict user A from continuing the payment operation, thus intercepting the payment operation. The pop-up window can also notify user A of the abnormality of the payee through relevant text.

[0073] Based on the relevant content of steps S201-S204 above, it can be seen that in this embodiment, after identifying multiple users, the transaction evaluation results corresponding to each user can be obtained based on a pre-trained user evaluation model. Since the social accounts of these multiple users have payment records, and the user evaluation model is pre-trained based on social data from multiple training nodes (including normal user nodes, transaction user nodes of normal user nodes, abnormal user nodes, and transaction user nodes of abnormal user nodes), the user evaluation model can effectively incorporate the social data of each training node in the social scenario into the network structure. By using the social data of each training node, it can determine whether a node is a normal or abnormal user node, thereby effectively improving the recognition accuracy of the user evaluation model. Next, based on the transaction evaluation results corresponding to each user, users whose transaction evaluation results indicate abnormality can be identified as abnormal users, and payment operations to abnormal users can be intercepted. In this way, based on accurate transaction evaluation results, abnormal users can be accurately identified, and payments to abnormal users can be intercepted, thereby avoiding the interception of transactions between normal users and improving the user experience.

[0074] Furthermore, based on the transaction interception method provided in the preceding embodiments, this application embodiment can also provide the training process of the aforementioned user evaluation model. The training process of the user evaluation model will be described below with reference to the embodiments and accompanying drawings.

[0075] Figure 3 This is a flowchart illustrating the training process of a user evaluation model provided in an embodiment of this application. (In conjunction with...) Figure 3 As shown, the training process of the user evaluation model provided in this application embodiment may include the following steps S301-S304.

[0076] S301: Construct a graph structure.

[0077] The graph structure includes multiple training nodes and edges between them. These edges represent transaction behaviors between the training nodes. In other words, during the construction of the graph structure, the training nodes are the nodes in the graph structure, and edges are constructed between them based on the transaction behaviors between them. Training nodes on an edge are neighbors of each other.

[0078] Specifically, the edges between the aforementioned training nodes are directed edges. For example, if there is a transaction between training node 1 and training node 2 where training node 1 makes a payment to training node 2, then an edge can be constructed pointing from training node 1 to training node 2. Furthermore, the edges between the training nodes have weights. To facilitate understanding, the following will combine... Figure 4a Please provide an explanation.

[0079] exist Figure 4a In the example, among the three training nodes, there is one abnormal user node and two normal user nodes. If there are edges between the two normal user nodes and the abnormal user node, and all edges point to the abnormal user node, then it can be concluded that both normal user nodes have made payment transactions to the abnormal user node.

[0080] Furthermore, in this embodiment, after constructing the edges between multiple training nodes, the out-degree and in-degree of each training node can be obtained. Then, training nodes with an out-degree or in-degree greater than a preset threshold are removed, and the final graph structure is constructed using the remaining training nodes and the edges between them. Here, the out-degree of a training node refers to the number of edges originating from that training node. The in-degree of a training node refers to the number of edges pointing to that training node. The preset threshold can be adjusted according to the actual transaction scenario, for example, to 1000. Therefore, in a payment transaction scenario, the out-degree and in-degree of a training node can represent the transaction frequency of that training node. In this way, by removing training nodes with an out-degree or in-degree greater than the preset threshold, i.e., removing training nodes with excessively high transaction frequencies, the size of the constructed graph structure is reduced, avoiding excessive data volume that could affect the subsequent model training effect.

[0081] S302: Extract transaction features from multiple training nodes from the graph structure.

[0082] In this embodiment, for each of the multiple training nodes, the graph structure includes a subgraph structure corresponding to each training node. Since the edges in the graph structure represent transaction behaviors between nodes, the subgraph structure corresponding to each training node can represent the transaction characteristics of each training node.

[0083] Based on this, in the specific process of step S302 in this embodiment of the application: First, a variety of preset subgraph structures can be obtained.

[0084] In practical applications, the predefined subgraph structure can be represented using a motif (a structure for representing subgraphs), such as... Figure 4b and Figure 4c As shown. In Figure 4b and Figure 4c In the diagram, black nodes represent the nodes currently being analyzed. Therefore, for the same type of motif, the transaction behavior of a node will differ depending on the position of the black node.

[0085] For example, combining Figure 4bAs shown, all edges between nodes are unidirectional. The motif of a white node pointing to a black node represents a payment received by the black node. The motif of a black node pointing to a white node represents a payment made by the black node. The motif of a white node pointing to a black node, and then a black node pointing to another white node, represents a transfer of funds through the black node. The motif of two white nodes both pointing to a black node represents a convergence of funds towards the black node. The motif of a black node pointing to a white node, and then that white node pointing to another white node, represents a second-order payment made by the black node. The motif of a white node pointing to another white node, and then that white node pointing to a black node, represents a second-order payment received by the black node. The motif of a black node pointing to a white node, then that white node pointing to another white node, and then that white node pointing to a black node, represents a unidirectional fund loop within the black node.

[0086] In practical applications, considering that payment transaction scenarios involve not only unidirectional edges but also bidirectional edges, that is, transactions between two users, therefore, in Figure 4c In Figure 4b Building upon this foundation, we add bidirectional edges and use black nodes as the current nodes in the analysis, enumerating 33 possible motifs. These 33 possible motifs can then serve as the preset subgraph structure mentioned above.

[0087] Next, for each training node, the subgraph structure corresponding to each training node can be decomposed from the graph structure constructed above based on a variety of preset subgraph structures.

[0088] In practical implementation, each training node in the graph structure can be decomposed according to the aforementioned 33 motifs to determine the frequency of each motif in each training node. This frequency of occurrence represents the subgraph structure corresponding to the training node. Figure 4d For example, the complete graph structure includes the above four training nodes. Taking eight of the 33 motifs as an example, according to... Figure 4d The eight listed motifs are broken down into their corresponding occurrences in the four training nodes, and this is then displayed. Figure 4d In the provided table.

[0089] Based on the above, it can be seen that in this embodiment of the application, by decomposing the subgraph structure corresponding to each training node from the graph structure constructed above based on a variety of preset subgraph structures, the transaction features of each training node can be accurately extracted, which helps to combine the transaction features for subsequent model training and improve the model performance.

[0090] S303: Based on the social data of multiple training nodes, extract the basic features of multiple training nodes, and determine the weights of the edges between multiple training nodes based on the social data of multiple training nodes.

[0091] As mentioned earlier, the social data of multiple training nodes includes account attribute data of multiple training nodes, as well as friendship data and transaction data between multiple training nodes. Furthermore, account attribute data, friendship data, and transaction data each include various types of data.

[0092] Based on this, the process of extracting the basic features of multiple training nodes in the embodiments of this application may include the following steps:

[0093] First, the processing dimensions of social data from multiple training nodes can be determined. Here, processing dimensions refer to the attributes used to describe the data. Therefore, determining the processing dimensions of social data is equivalent to determining the data attributes described by each of the aforementioned account attribute data, dating data, and transaction data.

[0094] Next, based on the processing dimensions, the social data from multiple training nodes can be processed to obtain the basic features of multiple training nodes. Here, any existing or future feature engineering algorithm can be used to process the social data into corresponding basic features based on the processing dimensions. In practical applications, there can be as many as 150 processing dimensions, and correspondingly, the basic features can also include 150 dimensions.

[0095] Furthermore, the multiple training nodes may include a first training node and a second training node, where the second training node is a transaction user node of the first training node. Taking the first and second training nodes as examples, the aforementioned account attribute data may include the first address information of the first training node on the social payment platform, and the second address information of the second training node on the social payment platform. The aforementioned social networking data may include the number of days since the first and second training nodes became friends. The aforementioned transaction data may include the transaction amount between the first and second training nodes.

[0096] Based on this, the process of determining the weights of edges between multiple training nodes in this embodiment of the application, for the first and second training nodes mentioned above, may include the following steps:

[0097] First, a first initial weight can be configured based on the first and second address information, a second initial weight can be configured based on the number of days since the friend was created, and a third initial weight can be configured based on the transaction amount. Next, the weights of the edge between the first and second training nodes can be determined based on the first, second, and third initial weights. In practical applications, the sum of the first, second, and third initial weights can be used as the weights of the edge between the first and second training nodes.

[0098] In real-world scenarios of abnormal transactions, the time it takes for abnormal user nodes to add friends with their trading counterparts is usually short, and inconsistencies in address information are common. Furthermore, the transaction amount also helps in identifying abnormal transactions. Based on this, by referencing the first address information of the first training node, the second address information of the second training node, the number of days since the first training node and the second training node were created as friends, and the transaction amount, the weight of the edge between the first and second training nodes is comprehensively calculated. This helps to incorporate the above information into the model during subsequent model training based on these weights, thereby further improving the accuracy of the user evaluation model.

[0099] For ease of understanding, the configuration process of the first initial weight, the second initial weight, and the third initial weight will be illustrated below.

[0100] As an example, the aforementioned first address information may include the first node's frequently used transaction address on the social payment platform, the address to which the account identifier belongs, and the address to which the identity identifier belongs. The second address information includes the second node's frequently used transaction address on the social payment platform, the address to which the account identifier belongs, and the address to which the identity identifier belongs. The implementation details for the address to which the account identifier belongs and the address to which the identity identifier belongs can be found in the above description and will not be repeated here.

[0101] Based on this, in configuring the first initial weight, the first step is to determine whether the first address information and the second address information are consistent, and then obtain the determination result. In practical applications, this determination process includes the following steps 1-3.

[0102] Step 1: Determine whether the frequently used transaction addresses of the first training node and the second training node on the social payment platform are consistent, and obtain the first determination result. Specifically, if they are consistent, the first determination result can be recorded as 1; if they are inconsistent, the first determination result can be recorded as 0.

[0103] Step 2: Determine whether the address of the account identifier of the first training node in the social payment platform is consistent with the address of the account identifier of the second training node in the social payment platform, and obtain the second judgment result. Specifically, if they are consistent, the first judgment result can be recorded as 1; if they are inconsistent, the first judgment result can be recorded as 0.

[0104] Step 3: Determine whether the address of the identity identifier of the first training node in the social payment platform is consistent with the address of the identity identifier of the second training node in the social payment platform to obtain the third judgment result. Specifically, if they are consistent, the first judgment result can be recorded as 1; if they are inconsistent, the first judgment result can be recorded as 0.

[0105] It should be noted that the embodiments of this application do not limit the execution order of steps 1-3. The above execution order of executing step 1 first, then step 2, and finally step 3 is only an illustrative example.

[0106] Next, the first initial weight can be calculated based on the first, second, and third judgment results. For ease of understanding, the first initial weight can be calculated using the following formula (1):

[0107] w1=0.3×(3-bool1-bool2-bool3) (1)

[0108] Where w1 is the first initial weight, bool1 is the first judgment result, bool2 is the second judgment result, and bool3 is the point judgment result.

[0109] The second initial weight can be configured using the following formula (2):

[0110]

[0111] Where w2 is the second initial weight and d is the number of days since the friend was created.

[0112] The third initial weight can be configured using the following formula (3):

[0113]

[0114] Where w3 is the third initial weight and amt is the transaction amount.

[0115] S304: The user evaluation model is obtained by training the model based on transaction features, basic features, and the weights of edges between multiple training nodes.

[0116] In this embodiment of the application, regarding step S304 above, firstly, in order to accelerate the convergence speed of the model, the above-mentioned intersection features and basic features can be normalized to obtain the final features for model training.

[0117] Next, an initial model can be constructed based on transaction features, basic features, and the weights of edges between multiple training nodes. In practical applications, the initial model can be implemented using a graph neural network model, such as Graph Attention Networks (GAT), Relational Graph Convolutional Networks (RGCN), or GraghSAGE (a type of inductive graph neural network model, short for Graph Sample and Aggregate). Correspondingly, this initial model can include an attention layer, a feature processing layer, and an output layer connected in sequence. For the specific implementation details of the attention layer, feature processing layer, and output layer, please refer to the following examples; they will not be described further here.

[0118] Then, the initial model can be trained based on a pre-defined loss function, resulting in a user evaluation model. In practical applications, because there are far more normal user nodes than abnormal user nodes in social payment platforms, the positive and negative samples in the model are extremely imbalanced (positive samples represent abnormal user nodes, and negative samples represent normal user nodes). Therefore, Focal Loss can be used as the loss function. This loss function allows the model to focus more on the fewer, harder-to-identify positive samples even when the positive and negative samples are imbalanced.

[0119] Accordingly, when Focal Loss is used as the loss function, the parameters of the loss function may include a first modulation coefficient and a second modulation coefficient. The first modulation coefficient is used to represent the weights of abnormal user nodes and normal user nodes in the multiple training nodes, and the second modulation coefficient is used to reduce the weights of normal user nodes in the multiple training nodes.

[0120] To facilitate understanding, the following explanation will be based on formula (4).

[0121] FL(p t )=-α t (1-p t ) γ log(p t (4)

[0122] Among them, FL(p t ) is the loss function, p t α represents the probability that the prediction is the true label. tThe first modulation coefficient, (1-p) t ) γ γ is the second modulation coefficient, where γ ≥ 0.

[0123] For example, suppose the user rating model predicts that the probability of a training node being a normal user node is 0.4. If the training node is labeled as a normal user, then p t If the label of the training node is marked as an abnormal user, then p is 0.4. t It is 0.6.

[0124] Furthermore, as mentioned earlier, the initial model can include an attention layer, a feature processing layer, and an output layer connected in sequence. For ease of understanding, the attention layer, feature processing layer, and output layer will be introduced separately below.

[0125] The attention layer can be used to determine the attention coefficient of each training node among multiple training nodes based on basic features, transaction features, and the weights of edges between multiple training nodes through an attention mechanism.

[0126] In practical implementation, the basic features and transaction features of each training node constitute the node features of each training node. Accordingly, the attention layer can first determine the transformation features of each training node by sharing parameters, that is, determine the transformation features that are common to the basic features and transaction features of each training node.

[0127] Next, the attention layer can map the concatenated features of each training node using a mapping function to obtain the similarity coefficient corresponding to each training node. Specifically, the concatenated features of each training node refer to the features obtained by concatenating the transformed features of each training node and the transformed features of the trading user nodes of each training node. The similarity coefficient corresponding to each training node refers to the similarity coefficient between each training node and the trading user nodes of each training node. For ease of understanding, the following explanation is based on formula (5).

[0128] e ij =a([Wh i ||Wh j ]), j∈N i (5)

[0129] Among them, e ij Let a() be the similarity coefficient between training node i and its neighboring node j, where a() represents the mapping function, W represents the shared parameters, and h is the similarity coefficient between training node i and its neighboring node j. i h represents the node features of training node i. j Wh represents the node features of training node j. i To train the transformation features of node i, Wh jTo train the transformation features of node j, [Wh i ||Wh j ] indicates Wh i and Wh j The splicing feature obtained by splicing, N i This represents the set of neighboring nodes corresponding to each of the multiple training nodes.

[0130] Then, the attention layer normalizes the similarity coefficient of each training node based on the weights of the edges between multiple training nodes, thus obtaining the attention coefficient for each training node. Here, the attention coefficient for each training node refers to the attention coefficient between each training node and the transaction user node of the training node. For ease of understanding, the following explanation is based on formula (6).

[0131]

[0132] Where, α ij w represents the attention coefficient between training node i and training node j. ij The weights of the edges between training node i and its neighbor node j are given by exp(), which represents the natural exponential function, and LeakyReLU(), which represents the activation function. ij Let N be the similarity coefficient between training node i and its neighboring node j, and let k be any neighboring node k among all the neighboring nodes of training node i. i This represents the set of neighboring nodes corresponding to each of the multiple training nodes.

[0133] To better understand the calculation process of the similarity coefficient, the following explanation uses training node i and its neighbor node j as an example, with reference to the accompanying diagram. Figure 5a As shown, Wh i To train the transformation features of node i, Wh j Transformation features for training node j. Through the mapping function a() (in Figure 5a Represented as This can be used to splice features, namely the aforementioned Wh i and Wh j The concatenated features are mapped to a real number to obtain the similarity coefficient between training node i and training node j. Then, the similarity coefficient is normalized using the softmax function. j The similarity coefficient between training node i and training node j is normalized to obtain the attention coefficient α between training node i and training node j. ij .

[0134] Furthermore, in the initial model, the feature processing layer can be used to determine the updated features of each training node based on the attention coefficient corresponding to each training node, the basic features of the transaction user nodes of each training node, and the transaction features, through the activation function. In this way, the updated features of each training node can be integrated with neighborhood information, that is, the node features of the neighboring nodes of each training node, which helps to make full use of the similarity between training nodes for model prediction, that is, to predict the probability of each training node being a normal user or an abnormal user, thereby improving the model performance. For ease of understanding, the following explanation is based on formula (7).

[0135]

[0136] Where, h′ i For the updated features of training node i, σ() represents the activation function, and α ij Wh represents the attention coefficient between training node i and training node j. j To train the transformation features of node j, N i This represents the set of neighboring nodes corresponding to each of the multiple training nodes.

[0137] Furthermore, in the embodiments of this application, a multi-channel attention mechanism can be introduced to improve the model's performance and generalization ability. Specifically, combined with Figure 5b As shown, taking training node 1 as an example, the node features of training node 1 are denoted as... Its neighboring nodes include 2, 3, 4, 5, and 6. Correspondingly, the node features of training node 2 are denoted as... The node features of training node 3 are denoted as The node features of training node 4 are denoted as The node features of training node 5 are denoted as The node features of training node 6 are denoted as Accordingly, there are three curves between the node features of training node 1 and the node features of its neighboring nodes, and each curve can represent a channel. Therefore, Figure 5b In the diagram, the node features of training node 1 have a total of 3 channels with each of its neighboring nodes. Furthermore, the attention coefficient between training node 1 and training node 2 is denoted as... The attention coefficient between training node 1 and training node 3 is denoted as The attention coefficient between training node 1 and training node 4 is denoted as The attention coefficient between training node 1 and training node 5 is denoted as The attention coefficient between training node 1 and training node 6 is denoted as Finally, using the multi-channel attention mechanism described above, the node features of training node 1 and the node features of its neighboring nodes are concatenated and averaged (concat / avg) to obtain the updated features of training node 1.

[0138] Furthermore, in this initial model, the output layer can be used to classify each training node based on the updated features of each training node, obtaining a predicted transaction evaluation result for each training node. This predicted transaction evaluation result represents the probability that each training node is a normal user or an abnormal user.

[0139] Based on the relevant content of steps S301-S304 above, it can be seen that in this embodiment, after constructing the graph structure, since the graph structure includes multiple training nodes and edges between multiple training nodes, and the edges between multiple training nodes are used to represent transaction behavior between multiple training nodes, transaction features of multiple training nodes can be extracted from the graph structure. Next, based on the social data of multiple training nodes, basic features of multiple training nodes can be extracted, and the weights of the edges between multiple training nodes can be determined based on the social data of multiple training nodes. Then, based on the transaction features, basic features, and the weights of the edges between multiple training nodes, the model is trained to obtain the user evaluation model. It can be seen that since the basic features and transaction features have many dimensions, combining the above-mentioned transaction features, basic features, and the edge weights determined based on social data for model training helps to incorporate the social data of each training node in the social payment platform into the model, thereby effectively improving the recognition accuracy of the user evaluation model. In this way, subsequently, the trained user evaluation model can accurately identify abnormal users and intercept payments to abnormal users, thereby avoiding the interception of transactions between normal users and improving the user experience.

[0140] Furthermore, based on the transaction interception method provided in the foregoing embodiments, this application embodiment may also provide a transaction interception device. The transaction interception device will now be described in conjunction with the embodiments and accompanying drawings.

[0141] Figure 6 This is a schematic diagram of a transaction interception device provided in an embodiment of this application. Figure 6 As shown, the transaction interception device 600 provided in this application embodiment includes:

[0142] User identification module 601 is used to identify multiple users whose social media accounts have payment records.

[0143] User evaluation module 602 is used to obtain transaction evaluation results corresponding to the multiple users based on a pre-trained user evaluation model. The user evaluation model is pre-trained based on social data from multiple training nodes, including normal user nodes, transaction user nodes of the normal user nodes, abnormal user nodes, and transaction user nodes of the abnormal user nodes.

[0144] The user identification module 603 is used to identify users whose transaction evaluation results are abnormal as abnormal users based on the transaction evaluation results corresponding to the multiple users respectively.

[0145] The transaction interception module 604 is used to intercept the payment operation in response to the payment operation to the abnormal user.

[0146] Optionally, the user evaluation model is trained using the following modules:

[0147] A graph construction module is used to construct a graph structure, which includes the plurality of training nodes and the edges between the plurality of training nodes, and the edges between the plurality of training nodes are used to represent the transaction behavior between the plurality of training nodes.

[0148] The first extraction module is used to extract the transaction features of the multiple training nodes from the graph structure;

[0149] The second extraction module is used to extract the basic features of the multiple training nodes based on the social data of the multiple training nodes, and to determine the weight of the edges between the multiple training nodes based on the social data of the multiple training nodes.

[0150] The model training module is used to train the model based on the transaction features, the basic features, and the weights of the edges between the multiple training nodes to obtain the user evaluation model.

[0151] Optionally, the first extraction module is specifically used for:

[0152] Obtain multiple preset subgraph structures;

[0153] For each of the plurality of training nodes, based on the plurality of preset subgraph structures, a subgraph structure corresponding to each training node is decomposed from the graph structure, and the subgraph structure corresponding to each training node is used to represent the transaction characteristics of each training node.

[0154] Optionally, the plurality of training nodes includes a first training node and a second training node, wherein the second training node is a transaction user node of the first training node, and the social data of the plurality of training nodes includes account attribute data of the plurality of training nodes, as well as friendship data and transaction data between the plurality of training nodes. The account attribute data includes the first address information of the first training node in the social payment platform and the second address information of the second training node in the social payment platform. The friendship data includes the number of days since the first training node and the second training node created their friendship. The transaction data includes the transaction amount between the first training node and the second training node.

[0155] For the first training node and the second training node, the second extraction module includes:

[0156] The weight configuration module is used to configure a first initial weight based on the first address information and the second address information, configure a second initial weight based on the number of days since the friend was created, and configure a third initial weight based on the transaction amount;

[0157] The weight determination module is used to determine the weight of the edge between the first training node and the second training node based on the first initial weight, the second initial weight and the third initial weight.

[0158] Optionally, the first address information includes the first node's frequently used transaction address on the social payment platform, the address to which the account identifier belongs, and the address to which the identity identifier belongs; the second address information includes the second node's frequently used transaction address on the social payment platform, the address to which the account identifier belongs, and the address to which the identity identifier belongs.

[0159] The weight configuration module is specifically used for:

[0160] Determine whether the commonly used transaction address of the first training node in the social payment platform is consistent with the commonly used transaction address of the second training node in the social payment platform, and obtain the first determination result;

[0161] Determine whether the address to which the account identifier of the first training node belongs in the social payment platform is consistent with the address to which the account identifier of the second training node belongs in the social payment platform, and obtain the second determination result;

[0162] The third judgment result is obtained by determining whether the address to which the identity identifier of the first training node belongs in the social payment platform is consistent with the address to which the identity identifier of the second training node belongs in the social payment platform.

[0163] Based on the first judgment result, the second judgment result, and the third judgment result, the first initial weight is calculated.

[0164] Optionally, the model training module is specifically used for:

[0165] An initial model is constructed based on the transaction features, the basic features, and the weights of the edges between the multiple training nodes;

[0166] The initial model is trained based on a pre-defined loss function, and the user evaluation model is obtained after training. The parameters of the loss function include a first modulation coefficient and a second modulation coefficient. The first modulation coefficient is used to represent the weight of abnormal user nodes and the weight of normal user nodes in the plurality of training nodes, and the second modulation coefficient is used to reduce the weight of normal user nodes in the plurality of training nodes.

[0167] Optionally, the initial model includes an attention layer, a feature processing layer, and an output layer connected in sequence;

[0168] The attention layer is used to determine the attention coefficient corresponding to each of the multiple training nodes based on the basic features, the transaction features, and the weights of the edges between the multiple training nodes through an attention mechanism. The attention coefficient corresponding to each training node is the attention coefficient between each training node and the transaction user node of the training node.

[0169] The feature processing layer is used to determine the updated features of each training node by means of an activation function, based on the attention coefficient corresponding to each training node, the basic features of the transaction user node of each training node, and the transaction features.

[0170] The output layer is used to classify each training node based on the updated features of each training node, and obtain the predicted transaction evaluation result of each training node. The predicted transaction evaluation result is used to represent the probability that each training node is a normal user or an abnormal user.

[0171] Optionally, the attention layer is specifically used for:

[0172] The transformation features corresponding to the basic features and transaction features of each training node are determined by sharing parameters;

[0173] The similarity coefficient of each training node is obtained by mapping the concatenated features of each training node through a mapping function. The concatenated features of each training node include the features obtained by concatenating the transformed features of each training node and the transformed features of the transaction user node of each training node. The similarity coefficient of each training node is the similarity coefficient between each training node and the transaction user node of each training node.

[0174] Based on the weights of the edges between the multiple training nodes, the similarity coefficients corresponding to each training node are normalized to obtain the attention coefficients corresponding to each training node.

[0175] Optionally, the second extraction module is specifically used for:

[0176] Determine the processing dimensions of the social data from the multiple training nodes;

[0177] Based on the processing dimension, the social data of the multiple training nodes are processed to obtain the basic features of the multiple training nodes.

[0178] The structure of the control equipment for implementing the above transaction interception methods is described below for both server-based and terminal-based configurations.

[0179] Figure 7 This is a schematic diagram of a server structure provided in an embodiment of this application. The server 900 can vary significantly due to different configurations or performance. It may include one or more central processing units (CPUs) 922 (e.g., one or more processors) and memory 932, and one or more storage media 930 (e.g., one or more mass storage devices) for storing application programs 942 or data 944. The memory 932 and storage media 930 can be temporary or persistent storage. The program stored in the storage media 930 may include one or more modules (not shown in the diagram), each module may include a series of instruction operations on the server. Furthermore, the CPU 922 may be configured to communicate with the storage media 930 and execute the series of instruction operations in the storage media 930 on the server 900.

[0180] Server 900 may also include one or more power supplies 926, one or more wired or wireless network interfaces 950, one or more input / output interfaces 958, and / or one or more operating systems 941, such as Windows Server. TM Mac OS X TM Unix TM Linux TM FreeBSD TM etc.

[0181] The steps performed by the server in the above embodiments can be based on this Figure 7 The server structure shown.

[0182] The CPU 922 is used in the following steps:

[0183] Multiple users were identified, and payment records existed under the social media accounts of these multiple users;

[0184] Based on a pre-trained user evaluation model, transaction evaluation results are obtained for each of the multiple users. The user evaluation model is pre-trained based on social data from multiple training nodes, including normal user nodes, transaction user nodes of the normal user nodes, abnormal user nodes, and transaction user nodes of the abnormal user nodes.

[0185] Based on the transaction evaluation results corresponding to the multiple users, users whose transaction evaluation results are abnormal are identified as abnormal users.

[0186] In response to a payment request to the abnormal user, the payment request is intercepted.

[0187] This application also provides another control device, such as... Figure 8 As shown, for ease of explanation, only the parts related to the embodiments of this application are shown. For specific technical details not disclosed, please refer to the method section of the embodiments of this application. The terminal can be any terminal device including mobile phones, tablets, personal digital assistants (PDAs), point-of-sale (POS) terminals, in-vehicle computers, etc. Taking a mobile phone as an example:

[0188] Figure 8 This is a block diagram illustrating a portion of the structure of a mobile phone related to the terminal provided in the embodiments of this application. (Reference) Figure 8 The mobile phone includes: a radio frequency (RF) circuit 1010, a memory 1020, an input unit 1030, a display unit 1040, a sensor 1050, an audio circuit 1060, a wireless fidelity (WiFi) module 1070, a processor 1080, and a power supply 1090, etc. Those skilled in the art will understand that... Figure 8 The mobile phone structure shown does not constitute a limitation on the mobile phone and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0189] The following is combined with Figure 8 A detailed introduction to each component of a mobile phone:

[0190] The RF circuit 1010 can be used for receiving and transmitting signals during information transmission or calls. Specifically, it receives downlink information from the base station and processes it with the processor 1080; additionally, it transmits uplink data to the base station. Typically, the RF circuit 1010 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low-noise amplifier (LNA), a duplexer, etc. Furthermore, the RF circuit 1010 can also communicate wirelessly with networks and other devices. The aforementioned wireless communications may use any communication standard or protocol, including but not limited to Global System for Mobile Communication (GSM), General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Long Term Evolution (LTE), email, and Short Messaging Service (SMS).

[0191] The memory 1020 can be used to store software programs and modules. The processor 1080 executes various mobile phone functions and data processing by running the software programs and modules stored in the memory 1020. The memory 1020 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, applications required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, phonebook, etc.). In addition, the memory 1020 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0192] The input unit 1030 can be used to receive input numerical or character information, and to generate key signal inputs related to user settings and function control of the mobile phone. Specifically, the input unit 1030 may include a touch panel 1031 and other input devices 1032. The touch panel 1031, also known as a touch screen, can collect touch operations performed by the user on or near it (such as operations performed by the user using a finger, stylus, or any suitable object or accessory on or near the touch panel 1031), and drive the corresponding connection devices according to a pre-set program. Optionally, the touch panel 1031 may include two parts: a touch detection device and a touch controller. The touch detection device detects the user's touch position and the signal generated by the touch operation, and transmits the signal to the touch controller; the touch controller receives touch information from the touch detection device, converts it into touch point coordinates, and sends it to the processor 1080, and can also receive and execute commands sent by the processor 1080. In addition, the touch panel 1031 can be implemented using various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the touch panel 1031, the input unit 1030 may also include other input devices 1032. Specifically, other input devices 1032 may include, but are not limited to, one or more of the following: physical keyboard, function keys (such as volume control buttons, power buttons, etc.), trackball, mouse, joystick, etc.

[0193] The display unit 1040 can be used to display information input by the user or information provided to the user, as well as various menus of the mobile phone. The display unit 1040 may include a display panel 1041, which may optionally be configured as a Liquid Crystal Display (LCD), Organic Light-Emitting Diode (OLED), or similar display panel 1041. Further, a touch panel 1031 may cover the display panel 1041. When the touch panel 1031 detects a touch operation on or near it, it transmits the information to the processor 1080 to determine the type of touch event. Subsequently, the processor 1080 provides corresponding visual output on the display panel 1041 according to the type of touch event. Although in Figure 8 In this embodiment, the touch panel 1031 and the display panel 1041 are two separate components to realize the input and output functions of the mobile phone. However, in some embodiments, the touch panel 1031 and the display panel 1041 can be integrated to realize the input and output functions of the mobile phone.

[0194] The mobile phone may also include at least one sensor 1050, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor may include an ambient light sensor and a proximity sensor. The ambient light sensor can adjust the brightness of the display panel 1041 according to the ambient light level, and the proximity sensor can turn off the display panel 1041 and / or the backlight when the phone is moved to the ear. As a type of motion sensor, an accelerometer sensor can detect the magnitude of acceleration in various directions (generally three axes). When stationary, it can detect the magnitude and direction of gravity and can be used for applications that recognize the phone's posture (such as landscape / portrait switching, related games, magnetometer posture calibration), vibration recognition-related functions (such as pedometer, taps), etc. Other sensors that may be configured in the mobile phone, such as gyroscopes, barometers, hygrometers, thermometers, and infrared sensors, will not be described in detail here.

[0195] The audio circuit 1060, speaker 1061, and microphone 1062 provide an audio interface between the user and the mobile phone. The audio circuit 1060 converts the received audio data into electrical signals and transmits them to the speaker 1061, where the speaker 1061 converts them into sound signals for output. On the other hand, the microphone 1062 converts the collected sound signals into electrical signals, which are then received by the audio circuit 1060, converted into audio data, and then processed by the processor 1080 before being transmitted via the RF circuit 1010 to, for example, another mobile phone, or the audio data can be output to the memory 1020 for further processing.

[0196] WiFi is a short-range wireless transmission technology. Through the WiFi module 1070, mobile phones can help users send and receive emails, browse web pages, and access streaming media, providing users with wireless broadband internet access. Although Figure 8 The WiFi module 1070 is shown, but it is understood that it is not an essential component of a mobile phone and can be omitted as needed without changing the essence of the invention.

[0197] The processor 1080 is the control center of the mobile phone, connecting various parts of the phone through various interfaces and lines. It executes software programs and / or modules stored in the memory 1020 and calls data stored in the memory 1020 to perform various functions and process data, thereby collecting overall data and information from the phone. Optionally, the processor 1080 may include one or more processing units; preferably, the processor 1080 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into the processor 1080.

[0198] The mobile phone also includes a power supply 1090 (such as a battery) that supplies power to various components. Preferably, the power supply can be logically connected to the processor 1080 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system.

[0199] Although not shown, mobile phones may also include a camera, Bluetooth module, etc., which will not be described in detail here.

[0200] In this embodiment of the application, the processor 1080 included in the terminal also has the following functions:

[0201] Multiple users were identified, and payment records existed under the social media accounts of these multiple users;

[0202] Based on a pre-trained user evaluation model, transaction evaluation results are obtained for each of the multiple users. The user evaluation model is pre-trained based on social data from multiple training nodes, including normal user nodes, transaction user nodes of the normal user nodes, abnormal user nodes, and transaction user nodes of the abnormal user nodes.

[0203] Based on the transaction evaluation results corresponding to the multiple users, users whose transaction evaluation results are abnormal are identified as abnormal users.

[0204] In response to a payment request to the abnormal user, the payment request is intercepted.

[0205] In this application embodiment, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0206] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0207] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0208] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0209] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0210] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes: USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, optical disks, and other media capable of storing program code.

[0211] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A transaction interception method, characterized in that, include: Multiple users were identified, and all of these users had payment records under their social media accounts. Based on a pre-trained user evaluation model, transaction evaluation results are obtained for each of the multiple users. The user evaluation model is pre-trained based on social data from multiple training nodes, including normal user nodes, transaction user nodes of the normal user nodes, abnormal user nodes, and transaction user nodes of the abnormal user nodes. Based on the transaction evaluation results corresponding to the multiple users, users whose transaction evaluation results are abnormal are identified as abnormal users. In response to a payment request to the abnormal user, the payment request is intercepted.

2. The transaction interception method according to claim 1, characterized in that, The user evaluation model is trained through the following steps: Construct a graph structure, which includes the plurality of training nodes and the edges between the plurality of training nodes, and the edges between the plurality of training nodes are used to represent the transaction behavior between the plurality of training nodes; Extract the transaction features of the multiple training nodes from the graph structure; Based on the social data of the multiple training nodes, the basic features of the multiple training nodes are extracted, and based on the social data of the multiple training nodes, the weights of the edges between the multiple training nodes are determined. The user evaluation model is obtained by training the model based on the transaction features, the basic features, and the weights of the edges between the multiple training nodes.

3. The transaction interception method according to claim 2, characterized in that, The step of extracting transaction features from the graph structure of the multiple training nodes includes: Obtain multiple preset subgraph structures; For each of the plurality of training nodes, based on the plurality of preset subgraph structures, a subgraph structure corresponding to each training node is decomposed from the graph structure, and the subgraph structure corresponding to each training node is used to represent the transaction characteristics of each training node.

4. The transaction interception method according to claim 2, characterized in that, The plurality of training nodes include a first training node and a second training node, wherein the second training node is a transaction user node of the first training node. The social data of the plurality of training nodes includes account attribute data of the plurality of training nodes, as well as friendship data and transaction data between the plurality of training nodes. The account attribute data includes the first address information of the first training node in the social payment platform and the second address information of the second training node in the social payment platform. The friendship data includes the number of days since the first training node and the second training node created their friendship. The transaction data includes the transaction amount between the first training node and the second training node. For the first training node and the second training node, determining the weights of the edges between the multiple training nodes based on the social data of the multiple training nodes includes: A first initial weight is configured based on the first address information and the second address information, a second initial weight is configured based on the number of days since the friend was created, and a third initial weight is configured based on the transaction amount; Based on the first initial weight, the second initial weight, and the third initial weight, the weight of the edge between the first training node and the second training node is determined.

5. The transaction interception method according to claim 4, characterized in that, The first address information includes the first node's commonly used transaction address on the social payment platform, the address to which the account identifier belongs, and the address to which the identity identifier belongs; the second address information includes the second node's commonly used transaction address on the social payment platform, the address to which the account identifier belongs, and the address to which the identity identifier belongs. The configuration of the first initial weight based on the first address information and the second address information includes: Determine whether the commonly used transaction address of the first training node in the social payment platform is consistent with the commonly used transaction address of the second training node in the social payment platform, and obtain the first determination result; Determine whether the address to which the account identifier of the first training node belongs in the social payment platform is consistent with the address to which the account identifier of the second training node belongs in the social payment platform, and obtain a second determination result; The third judgment result is obtained by determining whether the address to which the identity identifier of the first training node belongs in the social payment platform is consistent with the address to which the identity identifier of the second training node belongs in the social payment platform. Based on the first judgment result, the second judgment result, and the third judgment result, the first initial weight is calculated.

6. The transaction interception method according to claim 2, characterized in that, The process of training the model based on the transaction features, the basic features, and the weights of the edges between the multiple training nodes to obtain the user evaluation model includes: An initial model is constructed based on the transaction features, the basic features, and the weights of the edges between the multiple training nodes; The initial model is trained based on a pre-defined loss function, and the user evaluation model is obtained after training. The parameters of the loss function include a first modulation coefficient and a second modulation coefficient. The first modulation coefficient is used to represent the weight of abnormal user nodes and the weight of normal user nodes in the plurality of training nodes, and the second modulation coefficient is used to reduce the weight of normal user nodes in the plurality of training nodes.

7. The transaction interception method according to claim 6, characterized in that, The initial model comprises an attention layer, a feature processing layer, and an output layer connected in sequence. The attention layer is used to determine the attention coefficient corresponding to each of the multiple training nodes based on the basic features, the transaction features, and the weights of the edges between the multiple training nodes through an attention mechanism. The attention coefficient corresponding to each training node is the attention coefficient between each training node and the transaction user node of the training node. The feature processing layer is used to determine the updated features of each training node by means of an activation function, based on the attention coefficient corresponding to each training node, the basic features of the transaction user node of each training node, and the transaction features. The output layer is used to classify each training node based on the updated features of each training node, and obtain the predicted transaction evaluation result of each training node. The predicted transaction evaluation result is used to represent the probability that each training node is a normal user or an abnormal user.

8. The transaction interception method according to claim 7, characterized in that, The attention layer is specifically used for: The transformation features corresponding to the basic features and transaction features of each training node are determined by sharing parameters; The similarity coefficient of each training node is obtained by mapping the concatenated features of each training node through a mapping function. The concatenated features of each training node include the features obtained by concatenating the transformed features of each training node and the transformed features of the transaction user node of each training node. The similarity coefficient of each training node is the similarity coefficient between each training node and the transaction user node of each training node. Based on the weights of the edges between the multiple training nodes, the similarity coefficients corresponding to each training node are normalized to obtain the attention coefficients corresponding to each training node.

9. The transaction interception method according to any one of claims 2 to 8, characterized in that, The basic features of the multiple training nodes, extracted from the social data of those nodes, include: Determine the processing dimensions of the social data from the multiple training nodes; Based on the processing dimension, the social data of the multiple training nodes are processed to obtain the basic features of the multiple training nodes.

10. A transaction interception device, characterized in that, include: The user identification module is used to identify multiple users whose social media accounts have payment records. The user evaluation module is used to obtain transaction evaluation results for each of the multiple users based on a pre-trained user evaluation model. The user evaluation model is pre-trained based on social data from multiple training nodes, including normal user nodes, transaction user nodes of the normal user nodes, abnormal user nodes, and transaction user nodes of the abnormal user nodes. The user identification module is used to identify users whose transaction evaluation results are abnormal as abnormal users based on the transaction evaluation results corresponding to the multiple users respectively. The transaction interception module is used to intercept payment operations made to the abnormal user.

11. An electronic device, characterized in that, The device includes a processor and a memory: The memory is used to store computer programs and to transfer the computer programs to the processor; The processor is configured to execute the steps of the transaction interception method according to any one of claims 1 to 9, based on instructions in the computer program.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store a computer program that, when executed by a terminal device, implements the steps of the transaction interception method according to any one of claims 1 to 9.

13. A computer program product, characterized in that, It includes a computer program that, when executed by a terminal device, implements the steps of the transaction interception method according to any one of claims 1 to 9.

Images