Account abnormity identification method, device and equipment
By combining a base model with a transfer learning approach and multi-layered model nesting, the accuracy and stability issues of account anomaly identification caused by the lack of non-public data are resolved, resulting in more efficient account anomaly identification.
Patent Information
- Application Number
- CN202511516278.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-10-22
- Publication Date
- 2026-03-03
AI Technical Summary
In existing technologies, the lack of non-public data leads to poor accuracy and unstable prediction results in the identification of abnormal accounts by artificial intelligence models, making it impossible to effectively identify abnormal accounts.
By employing transfer learning and multi-layered model nesting, and combining a base model with a transfer learning model, the model is trained using non-randomly sampled non-common data. This approach integrates the anomaly recognition characteristics of non-common data types to improve the model's stability and accuracy.
It improves the accuracy of account anomaly identification and the stability of model prediction results, enabling timely identification of account anomalies and reducing losses for users or operators.
Smart Images
Figure CN121598074A_ABST
Abstract
Description
Technical Field
[0001] The embodiments in this specification relate to the field of computer technology, and in particular to a method, apparatus and device for identifying abnormal accounts. Background Technology
[0002] With the development of information technology, users mostly conduct transactions at offline merchants using electronic or physical cards. Online transactions generally require users to log in to an online merchant platform with an account before making the transaction. In other scenarios, users also use their accounts to log in to virtual resource platforms to apply for and obtain virtual resources. However, whether it is an electronic card, a physical card, or an online account, all have security risks such as fraudulent use and misuse. Ensuring account security is currently a major concern.
[0003] In existing technologies, most methods rely on artificial intelligence models to identify whether an account has anomalies. However, the data used to train these models contains non-random missing values. For example, some important types of data (i.e., non-shared data) are not present in all accounts. These non-random missing values result in poor anomaly identification accuracy for artificial intelligence models. Summary of the Invention
[0004] To address the problems existing in the prior art, embodiments of this specification provide a method, apparatus, and device for identifying account anomalies. By utilizing transfer learning and multi-layer model nesting, the method solves the problems of poor model performance and unstable probability distribution of model prediction results caused by the non-random missing data of non-common data in non-random sampling samples. It improves the model performance and the stability of the probability distribution of model prediction results after finally fusing non-common data, and improves the accuracy of account anomaly identification by using the model after finally fusing non-common data.
[0005] The specific technical solutions of the embodiments in this specification are as follows:
[0006] On the one hand, embodiments of this specification provide a method for identifying account anomalies, the method comprising:
[0007] Obtain data of the account to be identified;
[0008] The data is input into a pre-trained base model and a transfer learning model for processing to obtain a first anomaly risk output by the base model and a second anomaly risk output by the transfer learning model. The transfer learning model is obtained by training the base model with non-public data of the sample accounts as the training dataset. The sample accounts are obtained by non-random sampling from all sample accounts used to train the base model.
[0009] Based on the first and second abnormal risks, the final abnormal risk is obtained;
[0010] The anomaly risk is used to determine whether the account to be identified is abnormal.
[0011] Furthermore,
[0012] The further processing of the data by inputting it into a pre-trained base model and a transfer learning model includes:
[0013] If the non-common type data in the classification result of the data is empty, then the basic type data in the classification result of the data will be input into the basic model and the transfer learning model for processing respectively;
[0014] If the non-common type data in the classification results of the data is not empty, then the basic type data in the classification results is input into the basic model for processing, and the non-common type data is input into the transfer learning model for processing.
[0015] Furthermore, the steps for training the transfer learning model include:
[0016] Extract multiple first sample accounts that are actually abnormal from the full sample accounts, and obtain the first sample data of non-common type for each first sample account;
[0017] Extract second sample accounts from the full sample accounts whose actual abnormal situation is normal and whose number is the same as the number of first sample accounts, and obtain the second sample data of the non-common type of each second sample account;
[0018] Using the basic sample data of the basic types of the first and second sample accounts, as well as the first and second sample data, as training datasets, transfer learning is performed on the trained basic model to obtain the transfer learning model.
[0019] Furthermore, the full sample of accounts includes multiple account categories;
[0020] The first sample accounts extracted from the full sample accounts that are actually abnormal include:
[0021] Each account category is taken as the target category in turn, and all first sample accounts with non-common type data corresponding to the target category are extracted from the full sample accounts;
[0022] The second sample accounts, whose actual abnormal situations are normal and whose number is the same as the number of the first sample accounts, are extracted from the full sample accounts.
[0023] Extract the second sample account with non-common type data corresponding to the target category from the full sample accounts.
[0024] Furthermore, based on the first and second anomaly risks, the final anomaly risks include:
[0025] The first and second anomalies are processed based on the first degree of influence of the base model on the final anomaly risk and the second degree of influence of the transfer learning model on the final anomaly risk to obtain the final anomaly risk.
[0026] Furthermore, the first degree of influence and the second degree of influence are obtained by training a logistic regression model, which is used to classify and decide on the actual abnormal situation of the target account based on the first abnormal risk of the target account output by the base model and the third abnormal risk of the target account output by the anomaly identification model corresponding to the non-common type.
[0027] Furthermore, the steps for training the logistic regression model include:
[0028] Obtain the third sample data of the basic type of the third sample account and the fourth sample data of the non-public type;
[0029] The third sample data is input into the trained base model for processing to obtain the first abnormal risk of the third sample account.
[0030] The fourth sample data is input into the anomaly identification model for processing to obtain the third anomaly risk of the third sample account. The anomaly identification model is trained using the target data corresponding to the non-common type and the actual anomaly situation corresponding to the target data.
[0031] The first and third anomaly risks are processed based on the initial first influence level of the base model and the initial second influence level of the transfer learning model to obtain the predicted anomaly situation.
[0032] Based on the predicted anomalies and the actual anomalies in the third sample data, it is determined whether the logistic regression model has converged. If it has not converged, the initial first influence degree and the initial second influence degree are adjusted until the logistic regression model converges, thus obtaining the first influence degree and the second influence degree.
[0033] Furthermore, based on the first degree of influence of the base model and the second degree of influence of the transfer learning model, the first anomaly risk and the second anomaly risk are processed to obtain the formula for the final anomaly risk:
[0034] Prob = A × Prob base + B× Prob qy + C;
[0035] Where Prob represents the final anomaly risk, Prob base Indicates the first abnormal risk, Prob qy A represents the second abnormal risk, B represents the first degree of impact, C represents the second degree of impact, and C represents a constant.
[0036] Furthermore, the data includes the account's operational data.
[0037] On the other hand, embodiments of this specification also provide an account anomaly identification device, the device comprising:
[0038] The data acquisition unit is used to acquire data of the account to be identified;
[0039] The model processing unit is used to input the data into a pre-trained base model and a transfer learning model for processing, to obtain a first anomaly risk output by the base model and a second anomaly risk output by the transfer learning model. The transfer learning model is obtained by training the base model with non-public data of the sample accounts as the training dataset, and the sample accounts are obtained by non-random sampling from all sample accounts used to train the base model.
[0040] The result fusion unit is used to obtain the final abnormal risk based on the first abnormal risk and the second abnormal risk;
[0041] An anomaly identification unit is used to determine whether the account to be identified is abnormal based on the final anomaly risk.
[0042] On the other hand, embodiments of this specification also provide a computer device, including a memory, a processor, and a computer program stored in the memory, wherein the processor executes the computer program to implement the above-described method.
[0043] On the other hand, embodiments of this specification also provide a computer storage medium storing a computer program thereon, which, when run by the processor of a computer device, executes instructions according to the method described above.
[0044] In existing technologies, the generation of non-public account data is due to objective factors such as account privacy, which result in the unobserved presence of certain variables. Non-public data can have a certain impact on model performance. When non-public data is related to certain privacy-related factors, it can introduce systematic bias. This bias manifests as systematic errors in the results, causing the variable distribution to deviate from its true state. In addition, non-public data can change statistical properties of the data, such as mean and variance. These changes may cause the data distribution to exhibit an abnormal state. Non-public data may also affect the correlation and causal relationship between variables. When data for certain key variables is missing, the previously existing correlation or causal relationship may become insignificant or even disappear.
[0045] To address the technical problem of poor account anomaly detection accuracy caused by unobserved variables resulting in non-shared data due to objective factors, this specification proposes training a base model using shared basic data from accounts. This base model predicts account anomaly risk values based on shared data. A non-random stratified sampling method is used to obtain non-shared data from a subset of accounts. This non-shared data and the basic data are used as training datasets to perform transfer learning on the trained base model. This allows the transfer learning model to incorporate anomaly detection features based on non-shared data, thus integrating the anomaly detection effects of non-shared data and mitigating the problem of imbalanced sample distribution in non-random sampling. Furthermore, the data used to train the transfer learning model in this specification includes not only non-shared data but also basic data, enabling the transfer learning model to detect anomalies even when non-shared data is missing.
[0046] Furthermore, because the embodiments of this specification use full sample data of full sample accounts corresponding to multiple account categories to train the basic model, non-random sampling is performed from the full sample accounts to obtain sample accounts corresponding to each account category, and sample data of the sample accounts is obtained. Due to the use of non-random sampling, there is a certain difference between the proportion of sample data corresponding to each account category and the proportion of full sample data corresponding to each account category. That is, there is a certain difference between the proportion of sample data corresponding to each account category used to train the transfer learning model and the proportion of full data of each account category used to train the basic model. Therefore, the anomaly identification effect of the transfer learning model for different categories of accounts is somewhat weakened compared with the basic model. Therefore, the embodiments of this specification obtain the final anomaly risk based on the anomaly risk output by the basic model and the anomaly risk output by the transfer learning model, thereby balancing the problem of decreased anomaly identification accuracy caused by sample imbalance due to non-random sampling. This can make the final anomaly identification accuracy higher, make the probability distribution of the model prediction results more stable, and improve the anomaly identification performance. This makes it easier to determine whether the account to be identified is abnormal based on the final anomaly risk, providing a basis for staff to handle abnormal accounts in a timely manner and reducing the losses of abnormal account holders. Attached Figure Description
[0047] To more clearly illustrate the technical solutions in the embodiments of this specification or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the embodiments of this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0048] Figure 1 The diagram shown is a flowchart illustrating an account anomaly identification method according to an embodiment of this specification.
[0049] Figure 2 The diagram shown is a flowchart illustrating the risk calculation process for the data of the account to be identified in an embodiment of this specification.
[0050] Figure 3 The diagram shown is a flowchart illustrating the training process of the transfer learning model in an embodiment of this specification.
[0051] Figure 4 The diagram shown is a flowchart illustrating the training process of the logistic regression model in an embodiment of this specification.
[0052] Figure 5 The diagram shown is a structural schematic of an account anomaly identification device according to an embodiment of this specification.
[0053] Figure 6 The diagram shown is a structural schematic of the computer device in an embodiment of this specification.
[0054] [Explanation of Figure Markers]:
[0055] 501. Data Acquisition Unit;
[0056] 502. Model processing unit;
[0057] 503. Result Fusion Unit;
[0058] 504. Anomaly Detection Unit;
[0059] 602. Computer equipment;
[0060] 604, Processor;
[0061] 606. Memory;
[0062] 608. Drive mechanism;
[0063] 610. Input / output module;
[0064] 612. Input devices;
[0065] 614. Output devices;
[0066] 616. Presentation equipment;
[0067] 618. Graphical User Interface;
[0068] 620. Network interface;
[0069] 622. Communication link;
[0070] 624. Communication bus. Detailed Implementation
[0071] The technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the embodiments of this specification, and not all embodiments. Based on the embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of the embodiments of this specification.
[0072] It should be noted that the terms "first," "second," etc., in the description, claims, and accompanying drawings of the embodiments herein are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the embodiments described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, apparatus, product, or device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.
[0073] It should be noted that the acquisition, storage, use, and processing of data in the technical solutions of the embodiments of this specification all comply with the relevant provisions of national laws and regulations.
[0074] It should be noted that in the embodiments of this specification, certain existing solutions in the industry, such as software, components, and models, may be mentioned. These should be considered as exemplary, intended only to illustrate the feasibility of implementing the technical solution of this application, and do not imply that the applicant has already used or necessarily used such solutions. The information, data, and signals involved in the embodiments of this specification are all authorized by the user or fully authorized by all parties, and the collection, use, and processing of related data comply with the relevant laws, regulations, and standards of the relevant countries and regions.
[0075] In current account anomaly detection scenarios, due to account privacy settings set by operators or users themselves, some types of data are unavailable. Therefore, this type of data is only available to some accounts, not all accounts, and is considered non-public data, such as order data, recharge amounts, and overdue payment records. Non-public data can impact model performance. When non-public data is related to specific privacy settings, it introduces systematic bias, manifesting as systematic errors in the results, causing variable distributions to deviate from their true state. Furthermore, non-public data alters statistical properties such as the mean and variance of the data, potentially leading to anomalies in the data distribution. Non-public data can also affect the correlation and causal relationships between variables. When data for certain key variables is missing, previously existing correlations or causal relationships may become insignificant or even disappear. Therefore, existing account anomaly detection methods based on non-public data cannot accurately predict account anomalies, resulting in users' account resources not being protected in a timely manner.
[0076] To address the problems existing in the prior art, this specification proposes an embodiment that uses data of common basic account types to train a basic model. This basic model is used to predict the abnormal risk value of an account based on the data of these basic account types (common basic types refer to data types shared by multiple accounts, such as account name, user identity information, etc.). A non-random stratified sampling method is used to obtain data of non-common types shared by some accounts. This non-common type data and the basic type data are used as training datasets to perform transfer learning on the trained basic model. This allows the transfer learning model to add anomaly detection characteristics including non-common type data to the basic model, integrating the anomaly detection effect of non-common type data and mitigating the problem of imbalanced distribution of non-random sampling samples. This specification's embodiment utilizes basic models and transfer learning techniques to uncover the inherent correlation between account data and account abnormal risk that conforms to natural laws. This solves the technical problem of low reliability or accuracy in account abnormal risk analysis in the account application field, improves the reliability or accuracy of account abnormal risk analysis using big data in the account application field, and also achieves the technical effect of mitigating the imbalanced distribution of non-random sampling samples.
[0077] Specifically, the embodiments of this specification provide a method for identifying abnormal accounts. Figure 1 The diagram shown is a flowchart illustrating the account anomaly identification method in an embodiment of this specification. The process for anomaly identification of an account is described in this diagram. The order of steps listed in the embodiment is merely one possible execution order among many steps and does not represent the only possible execution order. In actual system or device products, the methods shown in the embodiments or accompanying drawings can be executed sequentially or in parallel.
[0078] Specific examples Figure 1 As shown, the method can be executed by a computer, and the method may include:
[0079] Step 101: Obtain data for the account to be identified;
[0080] Step 102: Input the data into the pre-trained base model and transfer learning model for processing to obtain the first anomaly risk output by the base model and the second anomaly risk output by the transfer learning model. The transfer learning model is obtained by training the base model with non-public data of the sample accounts as the training dataset. The sample accounts are obtained by non-random sampling from all sample accounts used to train the base model.
[0081] Step 103: Based on the first and second abnormal risks, obtain the final abnormal risk;
[0082] Step 104: Determine whether the account to be identified is abnormal based on the final abnormal risk.
[0083] By utilizing the embodiments in this specification, and employing transfer learning and multi-layer model nesting, the problems of poor model performance and unstable probability distribution of model prediction results caused by the non-random missing data of non-common types in non-random sampling samples are solved. This improves the performance of the model after fusing non-common type data and the stability of the probability distribution of model prediction results. The model after fusing non-common type data is then used to identify account anomalies, thereby improving the accuracy of account anomaly identification.
[0084] In the embodiments of this specification, accounts include, but are not limited to, bank accounts, public transport card accounts, fuel card accounts, online shopping accounts, and virtual resource platform accounts. Abnormal account situations include, but are not limited to, abnormal account login, abnormal account operation, and abnormal account spending. For example, most public transport cards or fuel cards are password-free. If a user loses their public transport card or fuel card and does not discover the loss within a short period, the funds on the card may be spent by others, resulting in a loss of the user's account resources. Similarly, if a user's bank account is maliciously stolen, and the thief can pass the bank account's identity verification, the funds in the bank account may be fraudulently withdrawn, resulting in a loss of the user's account resources. Furthermore, if a user's virtual resource platform account is stolen or the account itself is risky, it may lead to the non-compliant acquisition of virtual resources (such as an inappropriate amount of resources allocated to the user, or virtual resources that should not have been issued being approved by the virtual resource platform), and the risk that the virtual resources will not be returned subsequently.
[0085] The methods described in this specification enable operators to identify whether an account is abnormal based on transaction data (such as transaction frequency, transaction amount, transaction location, recharge amount, overdue status, etc.) of bank accounts, public transport card accounts, fuel card accounts, or online shopping accounts, or to identify whether a virtual resource platform account is abnormal based on virtual resource transaction records, virtual resource approval data, etc., so that operators can take timely account protection measures when they identify account abnormalities, thereby reducing the loss of account resources for users or operators.
[0086] Specifically, in the embodiments of this specification, data types are pre-divided, including basic types and non-common types. The basic types are data types that multiple accounts have, such as the consumption amount and frequency of bank accounts, public transport card accounts, and gas card accounts. They may also include the identity information of the account holder, such as gender, age, and income level. The non-common types are data types that some accounts have, such as the consumption location and recharge amount of the account.
[0087] Furthermore, such as Figure 2As shown, before inputting the data into the pre-trained base model and transfer learning model for computation, the method further includes:
[0088] Step 201: Classify the data according to the predetermined type;
[0089] Step 202: Determine whether the data of the non-common type in the classification result is empty;
[0090] The further processing of the data by inputting it into a pre-trained base model and a transfer learning model includes:
[0091] Step 203: If the data of the non-common type in the classification result is empty, then input the data of the basic type in the classification result into the basic model and the transfer learning model for processing respectively;
[0092] Step 204: If the non-common type data in the classification result is not empty, then input the basic type data in the classification result into the basic model for processing, and input the non-common type data into the transfer learning model for processing.
[0093] This specification's embodiments define a basic model for processing basic data types to obtain a first anomaly risk. The transfer learning model is trained on the basic model using both non-public and basic data as training datasets. Therefore, the transfer learning model can process non-public data types to obtain a second anomaly risk. If non-public data types are absent, the transfer learning model can also process basic data types to obtain a second anomaly risk. Thus, the transfer learning model in this specification's embodiments possesses the ability to identify anomalies when non-public data types are missing. Even if the account to be identified does not have non-public data types, the transfer learning model can still identify the second anomaly risk corresponding to the basic data type of the account to be identified, improving the applicability of anomaly identification.
[0094] In the embodiments described in this specification, the first abnormal risk and the second abnormal risk can be numerical, such as anomaly probability.
[0095] In the embodiments described in this specification, the base model can be a machine learning algorithm model based on gradient boosting decision tree (GBDT) (LightGBM), and the training process of the base model may include the following steps:
[0096] Obtain sample data for the basic types of sample accounts;
[0097] The sample data is labeled based on the actual anomalies of the sample accounts to form a training dataset;
[0098] The LightGBM model is trained using the training dataset to obtain a trained base model (hereinafter referred to as model_base).
[0099] The anomaly line output by the base model can be considered the first anomaly probability, hereinafter referred to as Prob. base .
[0100] In the embodiments of this specification, the actual abnormal situation can be determined by the staff based on the actual abnormal situation of the account, and then the actual abnormal situation of the sample data is marked in a tagged form, for example, 0 represents normal and 1 represents abnormal.
[0101] Then, transfer learning is performed on the basis of the base model. This requires sampling a small amount of non-public data from the full dataset (because the full dataset is too large, and the cost of obtaining non-public data is high if non-random sampling is not performed). The actual anomalies of the sample accounts are labeled by staff. Since the proportion of sample accounts with actual anomalies is small (e.g., less than 10% of the full samples), if random sampling is used, the number of abnormal samples obtained will be much smaller than the number of normal samples. This will cause the anomaly identification ability of the transfer learning model to be more biased towards identifying normal samples. The transfer learning model has no incentive to learn and identify the features of the small number of abnormal samples. In fact, the transfer learning model may completely ignore the features of abnormal samples, resulting in the inability to identify abnormal accounts. Therefore, to enable the transfer learning model to more fully predict anomalous features, the embodiments in this specification adjust the number of samples corresponding to non-public data and basic data. The adjustment logic is as follows: non-random sampling is performed on the full sample set. First sample data of a first sample account with non-public data type is obtained from sample accounts whose actual anomalous situation is anomalous. Second sample data of a second sample account with non-public data type is obtained from sample accounts whose actual anomalous situation is normal. The number of second sample accounts is the same as the number of first sample accounts. Then, the first sample data, the second sample data, and the basic sample data of each of the first and second sample accounts are used as training datasets to perform transfer learning on the trained basic model.
[0102] Specifically, such as Figure 3 As shown, the steps for training the transfer learning model include:
[0103] Step 301: Extract multiple first sample accounts that are actually abnormal from the full sample accounts, and obtain the first sample data of non-common type for each first sample account;
[0104] Step 302: Extract second sample accounts from the full sample accounts whose actual abnormal situation is normal and whose number is the same as the number of first sample accounts, and obtain the second sample data of the non-common type of each second sample account;
[0105] Step 303: Using the basic sample data of the basic types of the first sample account and the second sample account, as well as the first sample data and the second sample data, as training datasets, perform transfer learning on the trained basic model to obtain the transfer learning model.
[0106] This can be understood as follows: the embodiments in this specification use non-random sampling to ensure that the number of abnormal samples is equal to the number of normal samples, so that the transfer learning model can fully learn the features of normal sample accounts and the features of abnormal sample accounts, thereby avoiding bias in the anomaly identification ability of the transfer learning model and improving the accuracy of anomaly identification.
[0107] In the embodiments of this specification, because there are certain differences in the characteristics of different account categories, the number of abnormal sample accounts may also differ between different account categories. In order to enable the transfer learning model to learn the characteristics of abnormal accounts corresponding to each account category and improve the anomaly identification effect for each account category, the embodiments of this specification propose a non-random stratified sampling method, that is, in Figure 3 Based on the training method shown, stratified sampling is introduced. Specifically, the full sample of accounts includes multiple account categories;
[0108] The first sample accounts extracted from the full sample accounts that are actually abnormal include:
[0109] Each account category is taken as the target category in turn, and all non-common types of the first sample accounts with non-common type data corresponding to the target category are extracted from the full sample accounts;
[0110] The second sample accounts, whose actual abnormal situations are normal and whose number is the same as the number of the first sample accounts, are extracted from the full sample accounts.
[0111] Extract the second sample account with non-common type data corresponding to the target category from the full sample accounts.
[0112] In the embodiments of this specification, the account category can be determined in advance by staff based on experience. The account category can be the account's spending level, account activity level, etc. The embodiments of this specification do not limit the specific account category.
[0113] In this embodiment, the first sample data of all first sample accounts under each account category whose actual abnormal situation is abnormal and which have non-common type data are obtained sequentially. For second sample accounts whose actual abnormal situation is normal, the second sample data of the second sample accounts under the account category with the same number of first sample data are obtained.
[0114] The embodiments in this specification use non-random stratified sampling according to account category. Examples are shown in Table 1:
[0115] Table 1
[0116]
[0117] This can be understood as follows: the embodiments of this specification use non-random stratified sampling to extract the first sample data of all first sample accounts that are actually abnormal and have non-common data types for each account category. This increases the proportion of abnormal accounts for each account category, allowing the transfer learning model to learn the characteristics of abnormal accounts in each account category more fully and improving the abnormal identification effect of the transfer learning model for each account category.
[0118] The final non-random stratified sampling result is a small part of the full sample (about 10% to 20%). The sampling result is completely inconsistent with the proportion of sample categories in the full sample, and the proportion of normal and abnormal has also changed significantly.
[0119] For example, the training process of transfer learning is as follows:
[0120] 1. Feature selection and dataset partitioning:
[0121] Define the feature set used for training, which includes non-public type variables and basic type variables;
[0122] The feature set is divided into a training set and a test set;
[0123] Used to perform format conversions on data to adapt to the underlying model, such as converting to the LightGBM data format;
[0124] 2. Transfer training parameters:
[0125] Define the training parameters for LightGBM, including the learning rate, the number of trees, the maximum depth (max_depth), and the regularization parameter;
[0126] The configuration allows for continued training based on the existing model;
[0127] Multi-threading settings: This specifies the use of multiple threads for training. If the number of CPU cores on the machine is insufficient, it may cause performance degradation. It is recommended to adjust the number of threads according to the actual situation.
[0128] Log output: Sets the number of iterations from which logs are output. Decrease this value if more frequent logging is required.
[0129] 3. Transfer training:
[0130] Use lgb.train for training, where: specify the base model, specify the number of new trees, configure to retain existing trees (this is the default behavior, but specifying it explicitly can increase code readability), specify the validation set and its name, specify the number of iterations before early stopping training on the validation set without performance improvement, and configure to save evaluation results.
[0131] 4. Evaluation Results:
[0132] During training, the evaluation results are stored in the results dictionary, with the key being the validation set name (such as 'train' and 'test') and the value being the corresponding evaluation metric (such as AUC, KS).
[0133] For non-randomly sampled samples, transfer learning applies all the basic variables of the base model (e.g., LightGBM model type) and adds a non-shared variable (special_X). It adds m decision trees to the n decision trees of the base model (e.g., LightGBM model type), fusing the effects of important variables and mitigating the problem of imbalanced distribution in non-randomly sampled samples. The transfer learning model solves the problem of chaotic model results distribution across different channel types when directly introducing the non-shared variable (special_X) into logistic regression or LightGBM-type models with non-randomly sampled samples. The transfer learning model shows improvement on both the training and test sets. (Non-shared type).
[0134] This embodiment uses full sample data corresponding to multiple account categories to train a basic model. Non-random sampling is performed from the full sample data to obtain non-shared data corresponding to each account category. Due to the use of non-random sampling, the proportion of non-shared data corresponding to each account category used to train the transfer learning model differs from the proportion of full data used to train the basic model. Therefore, the anomaly detection performance of the transfer learning model for different account categories may be somewhat weaker than that of the basic model. Therefore, this embodiment determines the final anomaly risk based on the first anomaly risk of the basic model and the second anomaly risk of the transfer learning model. Specifically, based on the first and second anomaly risks, the final anomaly risk includes:
[0135] The first and second anomalies are processed based on the first degree of influence of the base model on the final anomaly risk and the second degree of influence of the transfer learning model on the final anomaly risk to obtain the final anomaly risk.
[0136] Feasibly, the first degree of influence of the base model on the final anomaly risk can be the first weight, and the second degree of influence of the transfer learning model on the final anomaly risk can be the second weight.
[0137] Based on the first degree of influence of the base model on the final anomaly risk and the second degree of influence of the transfer learning model on the final anomaly risk, the first anomaly risk and the second anomaly risk are processed to obtain the final anomaly, which further includes:
[0138] The first anomaly risk and the second anomaly risk are weighted and calculated based on the first degree of influence of the base model and the second degree of influence of the transfer learning model to obtain the final anomaly risk.
[0139] The first anomaly risk and the second anomaly risk are weighted and calculated based on the first degree of influence of the base model and the second degree of influence of the transfer learning model, resulting in the formula for the final anomaly risk:
[0140] Prob = A × Prob base + B× Prob qy + C;
[0141] Where Prob represents the final anomaly risk, Prob base Indicates the first abnormal risk, Prob qy A represents the second abnormal risk, B represents the first degree of impact, C represents the second degree of impact, and C represents a constant.
[0142] This specification can be understood as follows: the embodiments of this specification perform weighted calculations on the first anomaly risk output by the basic model and the second anomaly risk output by the transfer learning model to obtain the final anomaly risk. This can balance the problem of decreased anomaly identification accuracy caused by sample imbalance due to non-random sampling, resulting in higher final anomaly identification accuracy and a more stable probability distribution of the model prediction results. This improves anomaly identification performance, making it easier to determine whether the account to be identified is abnormal based on the final anomaly probability. This provides a basis for staff to handle abnormal accounts in a timely manner and reduces the losses of abnormal account holders.
[0143] Preferably, the first degree of influence and the second degree of influence in the embodiments of this specification are obtained by training a logistic regression model. The logistic regression model is used to classify and decide on the actual abnormal situation of the account based on the first abnormal risk of the account and the third abnormal risk of the account output by the abnormal identification sub-model corresponding to the non-random missing type.
[0144] In the embodiments of this specification, the anomaly recognition model corresponding to the non-common type is trained using the target data corresponding to the non-common type and the actual anomaly situation corresponding to the target data. The model type of the anomaly recognition model can be LightGBM.
[0145] In the embodiments described in this specification, a logistic regression model is first constructed as A × Prob base + B× important X + C; where A, B, and C are the same as A, B, and C in the final abnormal risk calculation formula, important X This indicates the third abnormal risk of the account as output by the anomaly identification model corresponding to the non-common type.
[0146] This can be understood as follows: the logistic regression model learns the degree to which the anomaly risks corresponding to basic data types and non-common data types determine the final anomaly risk, i.e., the first influence A and the second influence B. Here, C is a learnable parameter in the logistic regression model; after training, C becomes a constant. Then, parameters A, B, and C are used to weight and calculate the first anomaly risk corresponding to the basic model of the account to be identified and the second anomaly risk corresponding to the transfer learning model, thus obtaining the final anomaly risk. By training the logistic regression model, the accuracy of anomaly identification can be effectively improved.
[0147] According to one embodiment of this specification, such as Figure 4 As shown, the steps for training the logistic regression model include:
[0148] Step 401: Obtain the third sample data of the basic type and the fourth sample data of the non-public type of the third sample account;
[0149] Step 402: Input the third sample data into the trained base model for processing to obtain the first abnormal risk of the third sample account;
[0150] Step 403: Input the fourth sample data into the anomaly identification model corresponding to the non-common type for calculation to obtain the third anomaly risk of the third sample account;
[0151] Step 404: Calculate the first and third anomaly risks by weighting them according to the initial first influence level of the base model and the initial second influence level of the transfer learning model to obtain the predicted anomaly situation;
[0152] Step 405: Determine whether the logistic regression model has converged based on the predicted anomalies and the actual anomalies of the third sample data. If it has not converged, adjust the initial first influence degree and the initial second influence degree until the logistic regression model converges, and obtain the first influence degree and the second influence degree.
[0153] In the embodiments of this specification, in order to reduce the amount of computation, the first sample account or the second sample account can be used as the third sample account for training the logistic regression model. This embodiment of the specification does not impose any restrictions.
[0154] In some other embodiments of this specification, in order to simplify the calculation of the transfer learning model, the training process of the transfer learning model can be improved, that is, the original training dataset (first sample data, second sample data) of the transfer learning model is replaced with the abnormal risk output by the anomaly recognition model, while the output format of the transfer learning model remains the second abnormal risk. In this way, the training process of the transfer learning model changes from the original data feature extraction of the first sample data and the second sample data to the risk fusion of the abnormal risk output by the anomaly recognition model, which can simplify the calculation to a certain extent.
[0155] Specifically, an anomaly detection model corresponding to the basic type is pre-trained. This model can also be of the LightGBM type. The anomaly detection model corresponding to the basic type can calculate the fourth anomaly risk based on the input basic type data. The steps for training the transfer learning model are improved as follows:
[0156] The basic sample data of the basic type of the first sample account and the basic sample data of the basic type of the second sample account are respectively input into the anomaly identification model corresponding to the basic type for processing to obtain the fourth anomaly risk of the first sample account and the second sample account respectively.
[0157] The first sample data of the first sample account and the second sample data of the second sample account are respectively input into the anomaly identification model corresponding to the non-common type for processing to obtain the third anomaly risk of the first sample account and the second sample account respectively.
[0158] Using the third and fourth anomaly risks of the first sample account and the third and fourth anomaly risks of the second sample account as training datasets, transfer learning is performed on the trained base model to obtain the transfer learning model.
[0159] When performing anomaly identification on the data of the account to be identified, the step of inputting the data into a pre-trained base model and a transfer learning model for processing and outputting a second anomaly risk can be improved as follows:
[0160] If the data of the account to be identified includes non-public data, the non-public data is input into the anomaly identification model corresponding to the non-public type for processing to obtain the third anomaly risk. The third anomaly risk is then input into the transfer learning model for processing to obtain the second anomaly risk.
[0161] If the data of the account to be identified does not include non-common data, then the basic data is input into the basic model and the anomaly identification model corresponding to the basic type for processing to obtain the fourth anomaly risk. The fourth anomaly risk is then input into the transfer learning model for processing to obtain the second anomaly risk.
[0162] In the embodiments of this specification, after obtaining the final anomaly probability, it can be compared with a set probability threshold. For example, if the final anomaly probability exceeds the probability threshold, it indicates that the account to be identified is abnormal; otherwise, the account to be identified is not abnormal. Staff can promptly investigate the account or take corresponding protective measures based on the anomaly identification results to reduce the loss of account resources for users or operators.
[0163] Based on the same inventive concept, embodiments of this specification also provide an account anomaly identification device, such as... Figure 5 As shown, the device includes:
[0164] Data acquisition unit 501 is used to acquire data of the account to be identified;
[0165] The model processing unit 502 is used to input the data into a pre-trained base model and a transfer learning model for processing, to obtain a first abnormal risk output by the base model and a second abnormal risk output by the transfer learning model. The transfer learning model is obtained by using non-public data of sample accounts as a training dataset to train the base model through transfer learning. The sample accounts are obtained by non-random sampling from all sample accounts used to train the base model.
[0166] The result fusion unit 503 is used to perform a weighted calculation on the first abnormal risk and the second abnormal risk to obtain the final abnormal risk.
[0167] Anomaly identification unit 504 is used to determine whether the account to be identified is abnormal based on the final anomaly risk.
[0168] Furthermore, processing the data by inputting it into a pre-trained base model and a transfer learning model further includes:
[0169] If the non-common type data in the classification result of the data is empty, then the basic type data in the classification result of the data will be input into the basic model and the transfer learning model for processing respectively;
[0170] If the non-common type data in the classification results of the data is not empty, then the basic type data in the classification results is input into the basic model for processing, and the non-common type data is input into the transfer learning model for processing.
[0171] Since the principle of the above-mentioned device in solving the problem is similar to that of the above-mentioned method, the implementation of the above-mentioned system can refer to the implementation of the above-mentioned method, and the repeated parts will not be described again.
[0172] like Figure 6 The diagram shown is a structural schematic of a computer device according to an embodiment of this specification. The methods described in this specification can be applied to the computer device of this embodiment.
[0173] Computer device 602 may include one or more processors 604, such as one or more central processing units (CPUs), each of which may implement one or more hardware threads. Computer device 602 may also include any memory 606 for storing information of any kind, such as code, settings, data, etc. Non-limitingly, for example, memory 606 may include any type of RAM, any type of ROM, flash memory, hard disk, optical disk, etc. More generally, any storage resource can be used to store information using any technology.
[0174] Furthermore, any storage resource can provide volatile or non-volatile retention of information.
[0175] Furthermore, any storage resource can represent a fixed or removable component of the computer device 602. In one case, when the processor 604 executes associated instructions stored in any storage resource or combination of storage resources, the computer device 602 can perform any operation of the associated instructions. The computer device 602 also includes one or more drive mechanisms 608 for interacting with any storage resource, such as a hard disk drive system, an optical disk drive system, etc.
[0176] Computer device 602 may also include an input / output module 610 (I / O) for receiving various inputs (via input device 612) and providing various outputs (via output device 614). A specific output mechanism may include a presentation device 616 and an associated graphical user interface (GUI) 618. In other embodiments, the input / output module 610 (I / O), input device 612, and output device 614 may be omitted, and the device may function solely as a computer device within a network. Computer device 602 may also include one or more network interfaces 620 for exchanging data with other devices via one or more communication links 622. One or more communication buses 624 couple the components described above together.
[0177] Communication link 622 can be implemented in any way, such as via a local area network, a wide area network (e.g., the Internet), a point-to-point connection, or any combination thereof. Communication link 622 may include any combination of hardwired links, wireless links, routers, gateway functions, name servers, etc., governed by any protocol or combination of protocols.
[0178] This specification also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method.
[0179] This specification also provides computer-readable instructions, wherein when a processor executes the instructions, the program therein causes the processor to perform the above-described method.
[0180] It should be understood that in the various embodiments of this specification, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this specification.
[0181] It should also be understood that, in the embodiments of this specification, the term "and / or" is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Furthermore, in the embodiments of this specification, the character " / " generally indicates that the preceding and following related objects have an "or" relationship.
[0182] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this specification can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of the embodiments in this specification.
[0183] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.
[0184] In the embodiments provided in this specification, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the couplings or direct couplings or communication connections shown or discussed may be indirect couplings or communication connections through some interfaces, devices, or units, or they may be electrical, mechanical, or other forms of connection.
[0185] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of the embodiments described in this specification, depending on actual needs.
[0186] Furthermore, the functional units in the various embodiments of this specification can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.
[0187] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this specification, in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this specification. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0188] This specification describes the principles and implementation methods of the embodiments using specific examples. The above descriptions of the embodiments are only for the purpose of helping to understand the methods and core ideas of the embodiments in this specification. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the embodiments in this specification. Therefore, the content of this specification should not be construed as a limitation on the embodiments in this specification.
Claims
1. A method for identifying abnormal accounts, characterized in that, The method includes: Obtain data of the account to be identified; The data is input into a pre-trained base model and a transfer learning model for processing to obtain a first anomaly risk output by the base model and a second anomaly risk output by the transfer learning model. The transfer learning model is obtained by training the base model with non-public data of the sample accounts as the training dataset. The sample accounts are obtained by non-random sampling from all sample accounts used to train the base model. Based on the first and second abnormal risks, the final abnormal risk is obtained; The anomaly risk is used to determine whether the account to be identified is abnormal.
2. The method according to claim 1, characterized in that, The further processing of the data by inputting it into a pre-trained base model and a transfer learning model includes: If the non-common type data in the classification results of the data is empty, then the basic type data in the classification results of the data will be input into the basic model and the transfer learning model for processing respectively. If the non-common type data in the classification results of the data is not empty, then the basic type data in the classification results is input into the basic model for processing, and the non-common type data is input into the transfer learning model for processing.
3. The method according to claim 1, characterized in that, The steps for training the transfer learning model include: Extract multiple first sample accounts that are actually abnormal from the full sample accounts, and obtain the first sample data of non-common type for each first sample account; Extract second sample accounts from the full sample accounts whose actual abnormal situation is normal and whose number is the same as the number of first sample accounts, and obtain the second sample data of the non-common type of each second sample account; Using the basic sample data of the basic types of the first and second sample accounts, as well as the first and second sample data, as training datasets, transfer learning is performed on the trained basic model to obtain the transfer learning model.
4. The method according to claim 3, characterized in that, The full sample of accounts includes multiple account categories; The first sample accounts extracted from the full sample accounts that are actually abnormal include: Each account category is taken as the target category in turn, and all first sample accounts with non-common type data corresponding to the target category are extracted from the full sample accounts; The second sample accounts, whose actual abnormal situations are normal and whose number is the same as the number of the first sample accounts, are extracted from the full sample accounts. Extract the second sample account with non-common type data corresponding to the target category from the full sample accounts.
5. The method according to claim 1, characterized in that, Based on the first and second anomaly risks, the final anomaly risks include: The first and second anomalies are processed based on the first degree of influence of the base model on the final anomaly risk and the second degree of influence of the transfer learning model on the final anomaly risk to obtain the final anomaly risk.
6. The method according to claim 5, characterized in that, The first degree of influence and the second degree of influence are obtained by training a logistic regression model. The logistic regression model is used to classify and decide on the actual abnormal situation of the target account based on the first abnormal risk of the target account output by the base model and the third abnormal risk of the target account output by the anomaly identification model corresponding to the non-common type.
7. The method according to claim 6, characterized in that, The steps for training the logistic regression model include: Obtain the third sample data of the basic type of the third sample account and the fourth sample data of the non-public type; The third sample data is input into the trained base model for processing to obtain the first abnormal risk of the third sample account. The fourth sample data is input into the anomaly identification model for processing to obtain the third anomaly risk of the third sample account. The anomaly identification model is trained using the target data corresponding to the non-common type and the actual anomaly situation corresponding to the target data. The first and third anomaly risks are processed based on the initial first influence level of the base model and the initial second influence level of the transfer learning model to obtain the predicted anomaly situation. Based on the predicted anomalies and the actual anomalies in the third sample data, it is determined whether the logistic regression model has converged. If it has not converged, the initial first influence degree and the initial second influence degree are adjusted until the logistic regression model converges, thus obtaining the first influence degree and the second influence degree.
8. The method according to claim 5, characterized in that, The first anomaly risk and the second anomaly risk are processed based on the first degree of influence of the base model and the second degree of influence of the transfer learning model, resulting in the formula for the final anomaly risk: Prob = A × Prob base + B× Prob qy + C; Where Prob represents the final anomaly risk, Prob base Indicates the first abnormal risk, Prob qy A represents the second abnormal risk, B represents the first degree of impact, C represents the second degree of impact, and C represents a constant.
9. The method according to claim 1, characterized in that, The data includes the account's operational data.
10. An account anomaly identification device, characterized in that, The device includes: The data acquisition unit is used to acquire data of the account to be identified; The model processing unit is used to input the data into a pre-trained base model and a transfer learning model for processing, to obtain a first anomaly risk output by the base model and a second anomaly risk output by the transfer learning model. The transfer learning model is obtained by training the base model with non-public data of the sample accounts as the training dataset, and the sample accounts are obtained by non-random sampling from all sample accounts used to train the base model. The result fusion unit is used to obtain the final abnormal risk based on the first abnormal risk and the second abnormal risk; An anomaly identification unit is used to determine whether the account to be identified is abnormal based on the final anomaly risk.
11. A computer device comprising a memory, a processor, and a computer program stored in the memory, characterized in that, When the processor executes the computer program, it implements the method according to any one of claims 1 to 9.
12. A computer storage medium having a computer program stored thereon, characterized in that, When the computer program is run by the processor of the computer device, it executes the instructions of the method according to any one of claims 1 to 9.