Target account determination method and device, storage medium and product

Abstract

The invention discloses a target account determination method and device, a storage medium and a product, and relates to the field of finance. The target account determination method comprises the steps of performing similarity comparison on a plurality of transaction features of a first account in a first time period and a plurality of first risk features in a risk feature library, and determining a plurality of first similarities between the plurality of transaction features and the plurality of first risk features; determining whether the first account is a high-risk candidate account or not according to the plurality of first similarities, and performing risk scoring on the first account through a risk scoring model under the condition that the first account is determined to be the high-risk candidate account, so as to determine whether the first account is the high-risk account or not; and under the condition that the first account is determined to be the high-risk account, determining a target account in the plurality of second accounts according to the first association rule. By adopting the technical scheme, the problem of low efficiency of judging high-risk accounts and checking victim accounts in mass transaction data in related technologies is solved.

Description

Technical Field

[0001] This application relates to the financial field, and more specifically, to a method and apparatus, storage medium and product for determining a target account. Background Technology

[0002] Traditional risk identification methods used by financial institutions, such as rule-based static analysis and statistical models, fall short when faced with massive amounts of data and complex transaction patterns. For example, rule engines rely on pre-set rules, which struggle to be updated in a timely manner to address emerging risk characteristics in the face of constantly changing criminal methods, resulting in a lag in the identification of high-risk accounts. Furthermore, current methods heavily rely on manual review when identifying victim accounts, requiring risk control personnel to manually analyze and compare vast amounts of transaction data to find potential victim account leads. This manual review approach is not only time-consuming and labor-intensive but also prone to misjudgments or omissions due to human factors, especially when dealing with millions or even hundreds of millions of data points, where efficiency issues become particularly prominent.

[0003] There is still no effective solution to the problem of low efficiency in identifying high-risk accounts and investigating victim accounts from massive amounts of transaction data in related technologies. Summary of the Invention

[0004] This application provides a method, apparatus, storage medium, and product for determining target accounts, in order to at least solve the problems in the related art of low efficiency in judging high-risk accounts from massive transaction data and investigating victim accounts.

[0005] According to one embodiment of this application, a method for determining a target account is provided, comprising: comparing the similarity of multiple transaction features of a first account within a first time period with multiple first risk features in a risk feature database to determine multiple first similarities between the multiple transaction features and the multiple first risk features, wherein the multiple transaction features, the multiple first risk features, and the multiple first similarities are all in one-to-one correspondence; determining whether the first account is a high-risk candidate account based on the multiple first similarities; if the first account is determined to be a high-risk candidate account, performing a risk score on the first account using a risk scoring model to determine whether the first account is a high-risk account; if the first account is determined to be a high-risk account, determining a target account among multiple second accounts according to a first association rule, wherein the multiple second accounts are accounts that transact with the first account, and the first association rule is used to characterize multiple abnormal transactions and the combination relationship between the multiple abnormal transactions.

[0006] In an optional embodiment, comparing the similarity of multiple transaction features of a first account within a first time period with multiple first risk features in a risk feature database to determine multiple first similarities between the multiple transaction features and the multiple first risk features includes: comparing the similarity of the multiple transaction features with multiple second risk features in the risk feature database to obtain multiple sets of similarity, wherein the multiple second risk features include the multiple first risk features, any set of similarity contains multiple second similarities, the multiple second similarities correspond one-to-one with the multiple second risk features, and the multiple sets of similarity correspond one-to-one with the multiple transaction features; for any set of similarity, determining a third similarity among the multiple second similarities, wherein the third similarity is the maximum value among the multiple second similarities; determining the multiple second risk features corresponding to the multiple third similarities as the multiple first risk features, and determining the multiple third similarities as the multiple first similarities, wherein the multiple third similarities correspond one-to-one with the multiple sets of similarity.

[0007] In an optional embodiment, determining whether the first account is a high-risk candidate account based on the plurality of first similarities includes: determining the weights corresponding to the plurality of transaction features; performing a weighted average of the plurality of first similarities based on the weights to obtain a fourth similarity, and determining whether the fourth similarity is greater than a first threshold; if the fourth similarity is determined to be greater than the first threshold, determining the first account as the high-risk candidate account.

[0008] In one optional embodiment, a risk scoring model is used to assess the risk of the first account to determine whether the first account is a high-risk account. This includes: assessing the risk of the first account using the risk scoring model to obtain a first score; determining the risk level of the first account to be high if the first score is greater than or equal to a first preset value; determining the risk level to be medium if the first score is less than the first preset value and greater than or equal to a second preset value; determining the risk level to be low if the first score is less than the second preset value; and determining the first account to be a high-risk account if the risk level is either high or medium.

[0009] In an optional embodiment, before determining the target account among multiple second accounts according to the first association rule, the method further includes: determining the accuracy of multiple association rules; and if, among the multiple accuracies, there is a first accuracy greater than a second threshold, determining the association rule corresponding to the first accuracy as the first association rule.

[0010] In an optional embodiment, determining a target account among a plurality of second accounts according to a first association rule includes: for a third account among the plurality of second accounts, if the third account completes a first transaction with the first account, determining whether the first transaction conforms to the first association rule; if the first transaction conforms to the first association rule, determining that the first transaction is an abnormal transaction, and determining whether the number of abnormal transactions of the first account is greater than a third threshold; if the number of abnormal transactions is greater than the third threshold, determining the confidence level of the third account based on the number of abnormal transactions, and determining whether the confidence level is greater than a fourth threshold, wherein the confidence level is used to characterize the probability that the third account is the target account; if the confidence level is greater than the fourth threshold, determining that the third account is the target account.

[0011] In an optional embodiment, before comparing the similarity of multiple transaction features of the first account within a first time period with multiple first risk features in a risk feature library, the method further includes: acquiring multiple transaction data of the first account within the first time period; preprocessing the multiple transaction data, wherein the preprocessing includes: removing missing data and duplicate data from the multiple transaction data; and extracting features from the preprocessed multiple transaction data to obtain the multiple transaction features.

[0012] According to another aspect of the present invention, an apparatus for determining a target account is also provided, comprising: a comparison module, configured to compare the similarity of multiple transaction features of a first account within a first time period with multiple first risk features in a risk feature library, and determine multiple first similarities between the multiple transaction features and the multiple first risk features, wherein there is a one-to-one correspondence between the multiple transaction features, the multiple first risk features, and the multiple first similarities; a scoring module, configured to determine whether the first account is a high-risk candidate account based on the multiple first similarities, and if the first account is determined to be a high-risk candidate account, to perform a risk score on the first account using a risk scoring model to determine whether the first account is a high-risk account; and a determination module, configured to determine a target account among multiple second accounts according to a first association rule if the first account is determined to be a high-risk account, wherein the multiple second accounts are accounts that transact with the first account, and the first association rule is used to characterize multiple abnormal transactions and the combination relationship between the multiple abnormal transactions.

[0013] According to another aspect of the embodiments of this application, a computer-readable storage medium is also provided, wherein a computer program is stored in the computer program, and the computer program is configured to execute the above-described method for determining the target account when it is run.

[0014] According to another aspect of the embodiments of this application, an electronic device is also provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the method for determining the target account through the computer program.

[0015] According to another aspect of the embodiments of this application, a computer program product is also provided, including a computer program that, when executed by a processor, implements the above-described method for determining the target account.

[0016] In this embodiment, multiple transaction characteristics of a first account within a first time period are compared with multiple first risk characteristics in a risk characteristic database to determine multiple first similarities between the multiple transaction characteristics and the multiple first risk characteristics. Based on these multiple first similarities, it is determined whether the first account is a high-risk candidate account. If the first account is determined to be a high-risk candidate account, a risk scoring model is used to score the first account to determine whether it is a high-risk account. If the first account is determined to be a high-risk account, a target account is determined from multiple second accounts according to a first association rule. This technical solution solves the problem of low efficiency in judging high-risk accounts from massive transaction data and in screening victim accounts in related technologies. Attached Figure Description

[0017] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a schematic diagram of the hardware environment for a method of determining a target account according to an embodiment of this application;

[0020] Figure 2 This is a flowchart of a method for determining a target account according to an embodiment of this application;

[0021] Figure 3 This is a structural block diagram of a target account determination device according to an embodiment of this application. Detailed Implementation

[0022] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0023] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0024] The collection, storage, use, processing, transmission, provision, and disclosure of financial data or user data involved in the technical solution of this application all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0025] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0026] The methods and embodiments provided in this application can be executed on a computer terminal or similar computing device. Taking running on a computer terminal as an example, Figure 1 This is a hardware structure block diagram of a computer terminal for a method of determining a target account according to an embodiment of this application. For example... Figure 1 As shown, a computer terminal may include one or more ( Figure 1Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a central processing unit (CPU) or a field-programmable gate array (FPGA)) and a memory 104 for storing data are also shown. The computer terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the computer terminal described above. For example, the computer terminal may also include components that are more complex than those described above. Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0027] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the method for determining the target account in this embodiment. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to a computer terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0028] The computer terminal uses a wireless network provided by a communications provider. In one example, transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, transmission device 106 may be a Radio Frequency (RF) module used for wireless communication with the Internet.

[0029] This embodiment provides a method for determining a target account, which is applied to the aforementioned computer terminal. Figure 2 This is a flowchart of a method for determining a target account according to an embodiment of this application, such as... Figure 2 As shown, the process includes the following steps:

[0030] Step S202: Compare the similarity of multiple transaction features of the first account within the first time period with multiple first risk features in the risk feature database to determine multiple first similarities between the multiple transaction features and the multiple first risk features, wherein there is a one-to-one correspondence between the multiple transaction features, the multiple first risk features and the multiple first similarities;

[0031] Step S204: Determine whether the first account is a high-risk candidate account based on the plurality of first similarities. If the first account is determined to be a high-risk candidate account, perform a risk score on the first account using a risk scoring model to determine whether the first account is a high-risk account.

[0032] Step S206: If the first account is determined to be the high-risk account, the target account is determined among multiple second accounts according to the first association rule, wherein the multiple second accounts are accounts that transact with the first account, and the first association rule is used to characterize multiple abnormal transactions and the combination relationship between the multiple abnormal transactions.

[0033] In this embodiment, multiple transaction characteristics of a first account within a first time period are compared with multiple first risk characteristics in a risk characteristic database to determine multiple first similarities between the multiple transaction characteristics and the multiple first risk characteristics. Based on these multiple first similarities, it is determined whether the first account is a high-risk candidate account. If the first account is determined to be a high-risk candidate account, a risk scoring model is used to score the first account to determine whether it is a high-risk account. If the first account is determined to be a high-risk account, a target account is determined from multiple second accounts according to a first association rule. This technical solution solves the problem of low efficiency in judging high-risk accounts from massive transaction data and in screening victim accounts in related technologies.

[0034] In an optional embodiment, comparing the similarity of multiple transaction features of a first account within a first time period with multiple first risk features in a risk feature database to determine multiple first similarities between the multiple transaction features and the multiple first risk features includes: comparing the similarity of the multiple transaction features with multiple second risk features in the risk feature database to obtain multiple sets of similarity, wherein the multiple second risk features include the multiple first risk features, any set of similarity contains multiple second similarities, the multiple second similarities correspond one-to-one with the multiple second risk features, and the multiple sets of similarity correspond one-to-one with the multiple transaction features; for any set of similarity, determining a third similarity among the multiple second similarities, wherein the third similarity is the maximum value among the multiple second similarities; determining the multiple second risk features corresponding to the multiple third similarities as the multiple first risk features, and determining the multiple third similarities as the multiple first similarities, wherein the multiple third similarities correspond one-to-one with the multiple sets of similarity.

[0035] The process compares a series of transaction characteristics of each account to be analyzed against multiple characteristics (referred to as second risk characteristics) in a risk characteristic database. This database contains various characteristics of previously identified high-risk accounts, including but not limited to transaction frequency, amount, timing, and counterparties involved. Each comparison calculates a similarity value, reflecting the degree of feature matching between the two. For each transaction characteristic, the above process generates a similarity set containing multiple second similarities. Each similarity set is iterated through, and the maximum value (third similarity) is found. The risk characteristic that produces the third similarity (i.e., the second risk characteristic) is considered the first risk characteristic that is closest to the account to be analyzed.

[0036] Optionally, assuming multiple transaction features are ABC and multiple second risk features are abcde, for transaction feature A, a similarity comparison with multiple second risk features abcde can yield a set of similarity scores: Aa-78%, Ab-45%, Ac-67%, Ad-34%, Ae-25%. Among these similarity scores, the maximum value is determined to be 78%. The second risk feature corresponding to a similarity score of 78% is a. Therefore, the first risk feature corresponding to transaction feature A can be determined to be a, and the first similarity score between transaction feature A and the first risk feature a is 78%.

[0037] In an optional embodiment, determining whether the first account is a high-risk candidate account based on the plurality of first similarities includes: determining the weights corresponding to the plurality of transaction features; performing a weighted average of the plurality of first similarities based on the weights to obtain a fourth similarity, and determining whether the fourth similarity is greater than a first threshold; if the fourth similarity is determined to be greater than the first threshold, determining the first account as the high-risk candidate account.

[0038] Multiple transaction features are assigned weights, reflecting their relative importance in assessing account risk. For example, large transactions may be more indicative of risk than small transactions, thus receiving a higher weight. Since multiple first similarities correspond one-to-one with multiple transaction features, a weighted average is calculated based on the weights of these features. This ensures that more important transaction features carry greater weight in the final similarity calculation. The result is a comprehensive similarity assessment, known as the fourth similarity score. The fourth similarity score is then used to determine if it exceeds a preset first threshold (e.g., 0.7). This threshold is based on analysis of a risk feature database and extensive research on fraudulent accounts, used to distinguish normal accounts from potentially high-risk accounts. If the fourth similarity score is indeed greater than the first threshold, the account is marked as a high-risk candidate, indicating that its transaction characteristics highly match known high-risk patterns, requiring further risk management and review. This weighted averaging and threshold-based process effectively filters out truly high-risk accounts from a massive database, reducing the possibility of false positives and false negatives, and improving the accuracy and efficiency of risk identification.

[0039] In one optional embodiment, a risk scoring model is used to assess the risk of the first account to determine whether the first account is a high-risk account. This includes: assessing the risk of the first account using the risk scoring model to obtain a first score; determining the risk level of the first account to be high if the first score is greater than or equal to a first preset value; determining the risk level to be medium if the first score is less than the first preset value and greater than or equal to a second preset value; determining the risk level to be low if the first score is less than the second preset value; and determining the first account to be a high-risk account if the risk level is either high or medium.

[0040] By inputting multiple trading characteristics of the first account into a pre-built risk scoring model, the model calculates a first score for the first account based on these characteristics and their inherent relationships. If the first score reaches or exceeds a first preset value, it indicates that the account's trading pattern highly matches known high-risk characteristics, and its risk level will be determined as high. If the first score is lower than the first preset value but still reaches or exceeds a second preset value, the account's risk level will be marked as medium. If the first score is lower than the second preset value, the account's risk level will be determined as low. This classification is generally applicable to accounts with relatively normal trading patterns and low risk. Nevertheless, low-risk accounts will still be continuously monitored to guard against future changes in risk conditions. After completing the above risk level assessment, if the first account's risk level is determined to be high or medium, the account will be automatically identified as a high-risk account.

[0041] In an optional embodiment, before determining the target account among multiple second accounts according to the first association rule, the method further includes: determining the accuracy of multiple association rules; and if, among the multiple accuracies, there is a first accuracy greater than a second threshold, determining the association rule corresponding to the first accuracy as the first association rule.

[0042] For the multiple association rules identified, their respective accuracy is calculated. Accuracy here refers to the reliability and predictive power of the association rule in practical application when a specific anomalous transaction event or combination of anomalous transaction events (i.e., the association rule) appears in an account's transaction history, and the account is subsequently identified as a victim of telecom fraud. To filter out effective association rules, a second threshold is set, representing the minimum standard for association rule accuracy. The accuracy of all association rules is calculated to see if there are any cases where the first accuracy is greater than the second threshold. If a first accuracy meeting the criteria is found, then the corresponding first association rule is considered to have sufficient reliability to play an important role in identifying risky accounts and potential victims.

[0043] Optionally, for abnormal transaction events such as large overnight transfers, frequent transactions to new accounts, rapid inflows and outflows within a short period, and multi-level fund diversion, a set of interrelated abnormal transaction events is identified. For example, large overnight transfers - rapid inflows and outflows within a short period, or large overnight transfers - multi-level fund diversions. The aforementioned individual abnormal transaction events and / or sets of abnormal transaction events are then identified as association rules, and the accuracy of each association rule is calculated. Association rules with an accuracy greater than 1.2 are identified as the first association rule.

[0044] In an optional embodiment, determining a target account among a plurality of second accounts according to a first association rule includes: for a third account among the plurality of second accounts, if the third account completes a first transaction with the first account, determining whether the first transaction conforms to the first association rule; if the first transaction conforms to the first association rule, determining that the first transaction is an abnormal transaction, and determining whether the number of abnormal transactions of the first account is greater than a third threshold; if the number of abnormal transactions is greater than the third threshold, determining the confidence level of the third account based on the number of abnormal transactions, and determining whether the confidence level is greater than a fourth threshold, wherein the confidence level is used to characterize the probability that the third account is the target account; if the confidence level is greater than the fourth threshold, determining that the third account is the target account.

[0045] When a transaction is detected between a third account and a first account (an identified high-risk account) (i.e., the first transaction), immediately check if this transaction conforms to the first association rule. If the first transaction does conform to the first association rule, it indicates a high-risk transaction and is immediately marked as an abnormal transaction. Simultaneously, the number of abnormal transactions for the first account is recorded. Determine if the number of abnormal transactions exceeds a preset third threshold. If the number exceeds the third threshold, calculate the confidence level of the third account based on the number of abnormal transactions. This confidence level reflects the probability that the third account is a victim account. If the calculated confidence level exceeds a set fourth threshold, the third account will be marked as a target account, meaning it is highly likely to be a potential victim account. The downstream accounts of the potential victim are traced further, and the counterparty accounts are further associated and marked as second-level potential victims. This process continues downwards, identifying potential victims in multiple layers of transaction intermediaries. Finally, the information of the victim group is output, including the victim account, the penetration level, the transaction time, and the penetration time.

[0046] Optionally, consider existing high-risk account A, and fund transfer links such as account F → A. If high-risk account A has 100 multi-level fund transactions, analyze the fund transfer links of accounts that transacted with A and were defrauded. It is found that after the victim's funds were transferred to high-risk account A, the link exhibits rapid in-and-out transactions within a short period and multiple levels of fund transfers, meeting the first association rule. Furthermore, the number of abnormal transactions is ≥5 within 30 days. Further, calculate the confidence level of account F based on the number of abnormal transactions. The higher the number of abnormal transactions, the higher the confidence level, indicating a greater probability that account F was defrauded. If the confidence level of account F is greater than 75%, account F is considered a victim's account that was defrauded. Set a two-month experimental period, combining clues about involved accounts and defrauded accounts reported by the police, and reverse-search victim accounts that transferred funds to involved accounts and suffered financial losses to verify the accuracy of the above process in predicting victim accounts. Further optimize the corresponding association rules to improve the accuracy of victim identification.

[0047] In an optional embodiment, before comparing the similarity of multiple transaction features of the first account within a first time period with multiple first risk features in a risk feature library, the method further includes: acquiring multiple transaction data of the first account within the first time period; preprocessing the multiple transaction data, wherein the preprocessing includes: removing missing data and duplicate data from the multiple transaction data; and extracting features from the preprocessed multiple transaction data to obtain the multiple transaction features.

[0048] Acquire all transaction data for the first account within a specific time window (i.e., the first time period), including basic transaction data (transaction account, customer ID, transaction amount, etc.), channel scenario data (transaction channel, terminal device ID, etc.), and operation trace data (login IP, transaction codes involved, etc.). Preprocess all transaction data, including identifying and removing missing values ​​and duplicate records to eliminate potential interference from invalid or redundant data in subsequent analysis. Perform feature extraction on the preprocessed data; this is a crucial step in transforming raw transaction data into meaningful analytical features. Feature extraction may involve multiple levels, including but not limited to: Basic statistical features: such as transaction frequency, average transaction amount, and standard deviation of transaction amount, which reveal the account's regular trading habits. Time-series features: Analyze the time series of transactions to extract information such as transaction time preferences, transaction time interval distribution, and whether transactions were conducted at abnormal times to capture possible abnormal transaction patterns. Correlation features: Examine the transaction frequency between the account and the counterparty account, and the counterparty account attributes (such as whether it is a newly registered account), to explore whether there are abnormal or suspicious links in the transaction network.

[0049] In another optional embodiment, for fragmented transaction information obtained from other channels, optical character recognition (OCR) technology is used to extract the text content from the fragmented transaction information, and the text content is converted into structured data. A time-series encoder is used to determine the correlation of the structured data in the time dimension. Based on the correlation, the structured data is concatenated to obtain multiple sets of transaction data. Based on the counterparty accounts and transaction behaviors of the multiple sets of transaction data, target transaction data is determined, transaction accounts are identified from the target transaction data, and the transaction accounts are marked as high-risk accounts.

[0050] Fragmented transaction information is commonly found in text screenshots that have been anonymized, such as "Ma XX" or "6217". Transfer details such as "2645" were processed using optical character recognition (OCR) technology to extract readable text from screenshots containing anonymized elements. While partially obscured, key transaction elements such as amount, last digit of account number, and bank name were retained. The extracted text was then analyzed using a large-scale model to transform unstructured information into structured data. This structured data was input into a time-series encoder, an algorithm capable of identifying implicit time-series patterns, particularly in transaction time, frequency, and amount variations. Analysis determined the temporal correlations of this structured data, allowing for the inference of potential connections between transaction events. Based on the correlations identified by the time-series encoder, the structured data was intelligently concatenated to form multiple sets of transaction data, aiming to reconstruct the complete transaction sequence. Secondary features such as counterparty and transaction behavior were introduced from these sets for further filtering and matching optimization. Through multiple iterations, each comparison and enhancement gradually narrowed the matching range until a unique true transaction sequence (i.e., the target transaction data) was finally identified. Once the true transaction sequence was successfully reconstructed, the relevant real accounts were marked as high-risk accounts.

[0051] Obviously, the embodiments described above are only some embodiments of this application, and not all embodiments. To better understand the method for determining the target account described above, the process is explained below with reference to embodiments, but this is not intended to limit the technical solutions of the embodiments of this application. Specifically:

[0052] Figure 3 This is a structural block diagram of a target account determination device according to an embodiment of this application; as shown... Figure 3 As shown, it includes:

[0053] Comparison module 32 is used to compare the similarity of multiple transaction features of the first account within a first time period with multiple first risk features in the risk feature database, and determine multiple first similarities between the multiple transaction features and the multiple first risk features, wherein there is a one-to-one correspondence between the multiple transaction features, the multiple first risk features and the multiple first similarities;

[0054] The scoring module 34 is used to determine whether the first account is a high-risk candidate account based on the plurality of first similarities. If the first account is determined to be a high-risk candidate account, a risk scoring model is used to score the first account to determine whether the first account is a high-risk account.

[0055] The determination module 36 is used to determine a target account among a plurality of second accounts according to a first association rule when the first account is determined to be the high-risk account. The plurality of second accounts are accounts that have transacted with the first account. The first association rule is used to characterize the plurality of abnormal transactions and the combination relationship between the plurality of abnormal transactions.

[0056] In this embodiment, multiple transaction characteristics of a first account within a first time period are compared with multiple first risk characteristics in a risk characteristic database to determine multiple first similarities between the multiple transaction characteristics and the multiple first risk characteristics. Based on these multiple first similarities, it is determined whether the first account is a high-risk candidate account. If the first account is determined to be a high-risk candidate account, a risk scoring model is used to score the first account to determine whether it is a high-risk account. If the first account is determined to be a high-risk account, a target account is determined from multiple second accounts according to a first association rule. This technical solution solves the problem of low efficiency in judging high-risk accounts from massive transaction data and in screening victim accounts in related technologies.

[0057] In an optional embodiment, the comparison module 32 is further configured to compare the similarity of the plurality of transaction features with the plurality of second risk features in the risk feature library to obtain multiple sets of similarity, wherein the plurality of second risk features include the plurality of first risk features, any set of similarity in the multiple sets of similarity contains multiple second similarities, the plurality of second similarities correspond one-to-one with the plurality of second risk features, and the multiple sets of similarity correspond one-to-one with the plurality of transaction features; for any set of similarity, a third similarity is determined among the plurality of second similarities, wherein the third similarity is the maximum value among the plurality of second similarities; the plurality of second risk features corresponding to the plurality of third similarities are determined as the plurality of first risk features, and the plurality of third similarities are determined as the plurality of first similarities, wherein the plurality of third similarities correspond one-to-one with the multiple sets of similarity.

[0058] In an optional embodiment, the scoring module 34 is further configured to determine the weights corresponding to the plurality of transaction features; to perform a weighted average of the plurality of first similarities according to the weights to obtain a fourth similarity, and to determine whether the fourth similarity is greater than a first threshold; if the fourth similarity is determined to be greater than the first threshold, the first account is determined to be the high-risk candidate account.

[0059] In an optional embodiment, the scoring module 34 is further configured to perform a risk score on the first account using the risk scoring model to obtain a first score; if the first score is greater than or equal to a first preset value, determine that the risk level of the first account is high; if the first score is less than the first preset value and the first score is greater than or equal to a second preset value, determine that the risk level is medium; if the first score is less than the second preset value, determine that the risk level is low; and if the risk level is high or medium, determine that the first account is a high-risk account.

[0060] In an optional embodiment, the determining module 36 is further configured to determine the accuracy of a plurality of association rules; if a first accuracy is greater than a second threshold among the plurality of accuracies, the association rule corresponding to the first accuracy is determined as the first association rule.

[0061] In an optional embodiment, the determining module 36 is further configured to, for a third account among the plurality of second accounts, determine whether the first transaction conforms to the first association rule if the third account completes a first transaction with the first account; if the first transaction conforms to the first association rule, determine that the first transaction is an abnormal transaction and determine whether the number of abnormal transactions of the first account is greater than a third threshold; if the number of abnormal transactions is greater than the third threshold, determine the confidence level of the third account based on the number of abnormal transactions and determine whether the confidence level is greater than a fourth threshold, wherein the confidence level is used to characterize the probability that the third account is the target account; if the confidence level is greater than the fourth threshold, determine that the third account is the target account.

[0062] In an optional embodiment, the comparison module 32 is further configured to acquire multiple transaction data of the first account within the first time period; preprocess the multiple transaction data, wherein the preprocessing includes: removing missing data and duplicate data from the multiple transaction data; and extracting features from the preprocessed multiple transaction data to obtain the multiple transaction features.

[0063] Embodiments of this application also provide a storage medium including a stored program, wherein the program executes any of the methods described above when it is run.

[0064] Optionally, in this embodiment, the storage medium may be configured to store program code for performing the following steps:

[0065] S1, compare the similarity of multiple transaction features of the first account within the first time period with multiple first risk features in the risk feature database, and determine multiple first similarities between the multiple transaction features and the multiple first risk features, wherein there is a one-to-one correspondence between the multiple transaction features, the multiple first risk features and the multiple first similarities;

[0066] S2, determine whether the first account is a high-risk candidate account based on the multiple first similarities. If the first account is determined to be a high-risk candidate account, perform a risk score on the first account through a risk scoring model to determine whether the first account is a high-risk account.

[0067] S3, if the first account is determined to be the high-risk account, the target account is determined among a plurality of second accounts according to the first association rule, wherein the plurality of second accounts are accounts that have transacted with the first account, and the first association rule is used to characterize the plurality of abnormal transactions and the combination relationship between the plurality of abnormal transactions.

[0068] Embodiments of this application also provide an electronic device including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0069] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0070] Optionally, in this embodiment, the processor can be configured to perform the following steps via a computer program:

[0071] S1, compare the similarity of multiple transaction features of the first account within the first time period with multiple first risk features in the risk feature database, and determine multiple first similarities between the multiple transaction features and the multiple first risk features, wherein there is a one-to-one correspondence between the multiple transaction features, the multiple first risk features and the multiple first similarities;

[0072] S2, determine whether the first account is a high-risk candidate account based on the multiple first similarities. If the first account is determined to be a high-risk candidate account, perform a risk score on the first account through a risk scoring model to determine whether the first account is a high-risk account.

[0073] S3, if the first account is determined to be the high-risk account, the target account is determined among a plurality of second accounts according to the first association rule, wherein the plurality of second accounts are accounts that have transacted with the first account, and the first association rule is used to characterize the plurality of abnormal transactions and the combination relationship between the plurality of abnormal transactions.

[0074] Optionally, in this embodiment, the storage medium may include, but is not limited to, various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0075] Embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above method embodiments.

[0076] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in any of the above method embodiments.

[0077] The embodiments described herein also provide a computer program that includes computer instructions stored in a computer-readable storage medium; a processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the steps in any of the above method embodiments.

[0078] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementations, and will not be repeated here.

[0079] Obviously, those skilled in the art should understand that the modules or steps of this application described above can be implemented using general-purpose computing devices. They can be centralized on a single computing device or distributed across a network of multiple computing devices. Optionally, they can be implemented using computer-executable program code, thereby storing them in a storage device for execution by a computing device. In some cases, the steps shown or described can be performed in a different order than those presented here, or they can be fabricated as separate integrated circuit modules, or multiple modules or steps can be fabricated as a single integrated circuit module. Thus, this application is not limited to any particular combination of hardware and software.

[0080] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for determining a target account, characterized in that, include: The similarity of multiple transaction features of the first account within a first time period with multiple first risk features in the risk feature database is compared to determine multiple first similarities between the multiple transaction features and the multiple first risk features, wherein there is a one-to-one correspondence between the multiple transaction features, the multiple first risk features and the multiple first similarities; Based on the multiple first similarities, it is determined whether the first account is a high-risk candidate account. If the first account is determined to be a high-risk candidate account, a risk score is performed on the first account through a risk scoring model to determine whether the first account is a high-risk account. If the first account is determined to be the high-risk account, a target account is determined from a plurality of second accounts according to a first association rule, wherein the plurality of second accounts are accounts that have transacted with the first account, and the first association rule is used to characterize the plurality of abnormal transactions and the combination relationship between the plurality of abnormal transactions.

2. The method for determining the target account according to claim 1, characterized in that, The similarity of multiple transaction characteristics of the first account within a first time period with multiple first risk characteristics in the risk characteristic database is compared to determine multiple first similarities between the multiple transaction characteristics and the multiple first risk characteristics, including: The multiple transaction features are compared with the multiple second risk features in the risk feature library to obtain multiple similarity sets. The multiple second risk features include the multiple first risk features. Each of the multiple similarity sets contains multiple second similarities. The multiple second similarities correspond one-to-one with the multiple second risk features. The multiple similarity sets correspond one-to-one with the multiple transaction features. For any set of similarities, a third similarity is determined among the plurality of second similarities, wherein the third similarity is the maximum value among the plurality of second similarities; The multiple second risk features corresponding to the multiple third similarities are determined as the multiple first risk features, and the multiple third similarities are determined as the multiple first similarities, wherein the multiple third similarities correspond one-to-one with the multiple sets of similarities.

3. The method for determining the target account according to claim 1, characterized in that, Determining whether the first account is a high-risk candidate account based on the plurality of first similarities includes: Determine the weights corresponding to the multiple transaction features; The multiple first similarities are weighted and averaged according to the weights to obtain a fourth similarity, and it is determined whether the fourth similarity is greater than a first threshold. If the fourth similarity is determined to be greater than the first threshold, the first account is determined to be the high-risk candidate account.

4. The method for determining the target account according to claim 1, characterized in that, The first account is risk-scored using a risk scoring model to determine whether it is a high-risk account, including: The risk score is obtained by applying the risk scoring model to the first account; If the first score is greater than or equal to the first preset value, the risk level of the first account is determined to be high. If the first score is less than the first preset value and the first score is greater than or equal to the second preset value, the risk level is determined to be medium. If the first score is less than the second preset value, the risk level is determined to be low. If the risk level is either high or medium, the first account is determined to be a high-risk account.

5. The method for determining the target account according to claim 1, characterized in that, Before determining the target account among multiple second accounts according to the first association rule, the method further includes: Determine the accuracy of multiple association rules; If, among the multiple accuracies, a first accuracy is greater than a second threshold, the association rule corresponding to the first accuracy is determined as the first association rule.

6. The method for determining the target account according to claim 1, characterized in that, The target account is identified from multiple second accounts based on the first association rule, including: For the third account among the plurality of second accounts, if the third account completes a first transaction with the first account, it is determined whether the first transaction conforms to the first association rule; If the first transaction is determined to conform to the first association rule, the first transaction is determined to be an abnormal transaction, and it is determined whether the number of abnormal transactions of the first account is greater than the third threshold. If the number of abnormal transactions is determined to be greater than the third threshold, the confidence level of the third account is determined based on the number of abnormal transactions, and it is determined whether the confidence level is greater than the fourth threshold, wherein the confidence level is used to characterize the probability that the third account is the target account; If the confidence level is greater than the fourth threshold, the third account is determined to be the target account.

7. The method for determining the target account according to claim 1, characterized in that, Before comparing the similarity of multiple transaction characteristics of the first account within the first time period with multiple first risk characteristics in the risk characteristic database, the method further includes: Obtain multiple transaction data of the first account within the first time period; The multiple transaction data are preprocessed, wherein the preprocessing includes: removing missing data and duplicate data from the multiple transaction data; Feature extraction is performed on the preprocessed transaction data to obtain the multiple transaction features.

8. A device for determining a target account, characterized in that, include: The comparison module is used to compare the similarity of multiple transaction features of the first account within a first time period with multiple first risk features in the risk feature database, and determine multiple first similarities between the multiple transaction features and the multiple first risk features, wherein there is a one-to-one correspondence between the multiple transaction features, the multiple first risk features and the multiple first similarities; The scoring module is used to determine whether the first account is a high-risk candidate account based on the multiple first similarities. If the first account is determined to be a high-risk candidate account, a risk scoring model is used to score the first account to determine whether the first account is a high-risk account. The determination module is used to determine a target account among a plurality of second accounts according to a first association rule when the first account is determined to be the high-risk account. The plurality of second accounts are accounts that have transacted with the first account. The first association rule is used to characterize the plurality of abnormal transactions and the combination relationship between the plurality of abnormal transactions.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein the program, when executed, performs the method described in any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images