Account identification method and device, equipment and storage medium

Abstract

The invention relates to the field of artificial intelligence, in particular to an account identification method and device, equipment and a storage medium. The method comprises the following steps: acquiring a seed account, wherein the seed account is a verified abnormal account; according to the seed account, account association diffusion is carried out to obtain an account relationship network, and the account relationship network is a network representing an association relationship between accounts; performing group division on the account relation network to obtain a target group including the seed account; and determining member characteristics in the target group, and determining an account identification result of each member in the target group according to the member characteristics. According to the method, diffusion and group division are carried out based on the seed account which is verified as the abnormal account as the diffusion starting point, and the target group comprising the seed account is obtained for account identification, so that compared with a direct model identification method, the account identification result of the members in the target group can be determined more reliably.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence, and in particular to account identification methods, devices, equipment, and storage media. Background Technology

[0002] With the development of internet technology, online payment has become deeply integrated into people's daily lives, greatly improving the convenience of payments, but it has also brought security issues. A very small number of users may conduct transactions through illegitimate means, causing financial losses to users of online payment services.

[0003] To effectively and promptly identify users engaging in illegitimate activities, neural network models can be used to distinguish between legitimate and anomalous accounts. However, due to the limited number of anomalous account samples, these models are prone to overfitting or failure to identify anomalous accounts, hindering accurate and reliable account identification. Summary of the Invention

[0004] In view of this, embodiments of this application provide an account identification method, apparatus, device, and storage medium to solve the problem in the prior art that when identifying accounts through models, the models are prone to overfitting or cannot identify, which is not conducive to accurate and reliable account identification.

[0005] A first aspect of this application provides an account identification method, the method comprising:

[0006] Obtain the seed account; the seed account mentioned above is a verified abnormal account.

[0007] Based on the aforementioned seed accounts, the association and diffusion of accounts are carried out to obtain an account relationship network, which is a network representing the association relationships between accounts;

[0008] The aforementioned account relationship network is divided into groups to obtain target groups that include the aforementioned seed accounts;

[0009] Determine the characteristics of the members in the target group, and determine the account identification results of each member in the target group based on the characteristics of the members.

[0010] A second aspect of this application provides an account identification device, the device comprising:

[0011] The seed account acquisition unit is used to acquire seed accounts, which are verified abnormal accounts.

[0012] The diffusion unit is used to perform association diffusion of accounts based on the seed accounts to obtain an account relationship network, which is a network representing the association relationship between accounts;

[0013] A grouping unit is used to divide the above account relationship network into groups to obtain target groups that include the above seed accounts;

[0014] The identification unit is used to determine the member characteristics of the target group and to determine the account identification result of each member in the target group based on the member characteristics.

[0015] In conjunction with the second aspect, in a first possible implementation of the second aspect, the grouping unit includes:

[0016] The association weight determination sub-unit is used to determine the association weight of the above account relationship network according to the preset correspondence between association types and weights;

[0017] The group division subunit is used to divide the account relationship network into groups according to the above association weights, so as to obtain the target group including the above seed accounts.

[0018] In conjunction with the first possible implementation of the second aspect, in the second possible implementation of the second aspect, the group is divided into sub-units, including:

[0019] The group determination module is used to determine the group division results of the above account relationship network based on the above association weights and using a fast community detection algorithm;

[0020] The target group determination module is used to determine the average PPR of the groups that include the seed accounts in the above group division results. If the average PPR is greater than a predetermined first PPR threshold, the group is determined as a target group. Alternatively, the module can determine the maximum PPR of the groups and determine the group as a target group if the maximum PPR is greater than a predetermined second PPR threshold.

[0021] In conjunction with any of the second aspects to the second possible implementations of the second aspect, in the third possible implementation of the second aspect, the identification unit includes at least one of the following sub-units:

[0022] The identity feature determination subunit is used to determine the identity features of members in the aforementioned target group;

[0023] The transaction behavior characteristic determination subunit is used to determine the transaction behavior characteristics of members in the aforementioned target group;

[0024] The fund flow characteristics determination subunit is used to determine the fund flow characteristics of members in the above target group;

[0025] The account tag feature determination subunit is used to determine the account tag features of members in the aforementioned target group.

[0026] In conjunction with the third possible implementation of the second aspect, in the fourth possible implementation of the second aspect, the aforementioned identification unit includes:

[0027] The feature vector generation subunit is used to generate feature vectors based on the above member features;

[0028] The scoring determination subunit is used to input the above feature vectors into the scoring model to obtain the abnormality score of the above members. The scoring model is a neural network model trained based on feature samples. The above feature samples include sample feature vectors and corresponding label scores.

[0029] The anomaly type determination subunit is used to determine the account identification result based on the above anomaly degree score and in combination with the preset correspondence between anomaly type and score. The account identification result includes the anomaly type corresponding to the anomaly degree score of the above member.

[0030] In conjunction with any of the second aspects to the second possible implementations of the second aspect, in the fifth possible implementation of the second aspect, when the aforementioned member has relevant complaint information, the device further includes:

[0031] The complaint feature extraction subunit is used to extract complaint features based on complaint information.

[0032] The complaint score determination sub-unit is used to calculate complaint characteristics and determine the member's complaint score through a preset second scoring model;

[0033] The result correction subunit is used to correct the account identification result based on the complaint score.

[0034] In conjunction with any of the second aspects to the second possible implementations of the second aspect, in the sixth possible implementation of the second aspect, the diffusion unit includes at least one of the following sub-units:

[0035] The binding information diffusion subunit is used to spread the association of accounts based on the binding information of the seed accounts mentioned above.

[0036] The transaction information dissemination subunit is used to disseminate the associated information of the aforementioned seed accounts.

[0037] The environment diffusion subunit is used to spread the association of accounts based on the usage environment of the seed accounts mentioned above.

[0038] The behavior diffusion subunit is used to spread the association of accounts based on the usage behaviors associated with the aforementioned seed accounts.

[0039] In conjunction with the sixth possible implementation of the second aspect, in the seventh possible implementation of the second aspect, the binding information diffusion subunit includes at least one of the following diffusion modules:

[0040] The above binding information includes the account subject. The account subject diffusion module is used to diffuse accounts with the same account subject as the above seed account based on the account subject bound to the above seed account.

[0041] The aforementioned binding information includes administrator information. The administrator information diffusion module is used to diffuse accounts with the same administrator information as the aforementioned seed account based on the administrator information bound to the aforementioned seed account.

[0042] The aforementioned binding information includes suppliers. The supplier diffusion module is used to diffuse the accounts bound to the aforementioned suppliers based on the suppliers bound to the aforementioned seed accounts.

[0043] The aforementioned binding information includes contact information. The contact information diffusion module is used to diffuse information based on the contact information bound to the aforementioned seed account to obtain accounts that have the same contact information bound to the aforementioned seed account.

[0044] In conjunction with the sixth possible implementation of the second aspect, in the eighth possible implementation of the second aspect, the transaction information diffusion subunit includes at least one of the following diffusion modules:

[0045] The fund flow diffusion module is used to spread the association of accounts based on the transaction fund flow included in the above transaction information, and obtain the accounts related to the above transaction fund flow.

[0046] The complaint information dissemination module is used to disseminate the associated complaint information based on the complaint information included in the above transaction information, thereby obtaining the complaint accounts related to the above complaint information;

[0047] The intervention operation information dissemination module disseminates the information about intervention operations included in the transaction information to related accounts, thereby obtaining the intervened accounts related to the intervention operation information.

[0048] In conjunction with the sixth possible implementation of the second aspect, the ninth possible implementation of the second aspect uses an environmental diffusion subunit that includes at least one of the following diffusion modules:

[0049] The device diffusion module is used to spread the associated accounts based on the devices that log in to the seed account in the above-mentioned usage environment, so as to obtain accounts that log in on the same device.

[0050] The location information diffusion module is used to spread the association of accounts based on the location information of the seed account login in the above-mentioned usage environment, so as to obtain accounts with the same location information as the seed account.

[0051] The access point information diffusion module is used to spread the association of accounts based on the access point information of the login device of the seed account in the above-mentioned usage environment, so as to obtain accounts with the same access point information as the seed account.

[0052] In conjunction with the sixth possible implementation of the second aspect, the tenth possible implementation of the second aspect uses a behavior diffusion subunit that includes at least one of the following diffusion modules:

[0053] The name diffusion module is used to spread the association of accounts based on the names set by the seed accounts, including the above-mentioned usage behaviors, to obtain accounts with the same names.

[0054] The transaction behavior diffusion module is used to associate and diffuse accounts based on the transaction behaviors included in the above-mentioned usage behaviors, thereby obtaining accounts that match the aforementioned transaction behaviors.

[0055] The complaint behavior diffusion module is used to spread the association of accounts based on the complained behavior included in the above-mentioned usage behavior, and to obtain accounts that match the complained behavior.

[0056] A third aspect of this application provides an account identification device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of any of the methods described in the first aspect.

[0057] A fourth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the method described in any of the first aspects.

[0058] A fifth aspect of this application provides a chip for implementing the methods in the various implementations of the first aspect described above. Specifically, the chip includes a processor for calling and running a computer program from a memory, causing a device equipped with the chip to perform the methods as described in the first aspect or its various implementations.

[0059] A sixth aspect of this application provides a computer program product, including computer program instructions that cause a computer to perform the methods described in the first aspect or its various implementations.

[0060] A seventh aspect of this application provides a computer program that, when run on a computer, causes the computer to perform the methods described in the first aspect or its various implementations.

[0061] The beneficial effects of this application embodiment compared with the prior art are as follows: This application embodiment uses verified abnormal accounts as seed accounts for association diffusion to obtain an account relationship network, divides the account relationship network into groups, and determines the account identification results of members in the target group based on the member characteristics of the target group including the seed account. Since this method is based on the seed account verified as an abnormal account as the diffusion starting point for diffusion and group division, and obtains the target group including the seed account for account identification, it can more reliably determine the account identification results of members in the target group compared with the direct model identification method. Attached Figure Description

[0062] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0063] Figure 1 This is a schematic diagram illustrating the implementation process of an account identification method provided in an embodiment of this application;

[0064] Figure 2 This is a schematic diagram illustrating a seed account-based association propagation method provided in an embodiment of this application;

[0065] Figure 3 This is a schematic diagram illustrating association diffusion based on personal identification information provided in an embodiment of this application;

[0066] Figure 4 This is a schematic diagram illustrating association diffusion based on management personnel information, provided in an embodiment of this application.

[0067] Figure 5 This is a schematic diagram illustrating the association and diffusion based on location information from account login, provided in an embodiment of this application.

[0068] Figure 6 This is a schematic diagram illustrating association diffusion based on access point information of a login device, provided in an embodiment of this application.

[0069] Figure 7 This is a schematic diagram illustrating a diffusion process combining multiple related diffusion methods, as provided in an embodiment of this application.

[0070] Figure 8 This is a schematic diagram illustrating an implementation process for determining account identification results provided in an embodiment of this application;

[0071] Figure 9 This is a schematic diagram of an account identification device provided in an embodiment of this application;

[0072] Figure 10 This is a schematic diagram of an account identification device provided in an embodiment of this application. Detailed Implementation

[0073] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0074] To illustrate the technical solution described in this application, specific embodiments are provided below.

[0075] The relevant concepts involved in the embodiments of this application are introduced below.

[0076] Graph algorithms: Graph algorithms are a type of network analysis tool that provides methods for analyzing data connectivity. Based on graph theory, graph algorithms can infer the structure and changes of complex systems by utilizing the relationships between nodes.

[0077] Louvain's algorithm, also known as the fast community detection algorithm or modularity optimization algorithm, is a modularity-based community detection algorithm. Its basic idea is that nodes in the network attempt to traverse the community labels of all their neighbors and select the community label that maximizes the increment of modularity. After maximizing the modularity, each community is treated as a new node, and the process of trying and selecting the community label that maximizes the increment of modularity is repeated until the modularity no longer increases.

[0078] Modularity Increment: This is an important concept in community detection. It measures the increase in modularity of the entire network after merging two communities. Modularity is a measure of the quality of community partitioning. The modularity value typically ranges from -1 / 2 to 1. A higher modularity value indicates that the connections within a community are tight, while the connections between communities are sparse.

[0079] PPR algorithm: The full name of the English word is Personalized PageRank. It is a special form of the PageRank algorithm that can evaluate the importance of global nodes in a personalized way.

[0080] With the potential for fraudulent payments from unauthorized users to cause financial losses, the security of online payments is receiving increasing attention. To effectively identify accounts using illegitimate methods, neural network models can be used to distinguish between legitimate and fraudulent accounts. However, due to the limited number of fraudulent account samples, overfitting during model training can easily occur, affecting the model's generalization ability and hindering accurate and reliable account identification.

[0081] Based on the above problems, this application proposes an account identification method, such as... Figure 1 As shown, the method includes:

[0082] In S101, obtain the seed account.

[0083] Among them, the seed account is a verified abnormal account.

[0084] The seed accounts in this application embodiment include personal accounts and business accounts. Personal accounts are accounts registered using personal information. Personal accounts include accounts linked to personal social media accounts, personal financial service accounts, and personal lifestyle service accounts. Business accounts are accounts registered by commercial entities such as enterprises and public institutions.

[0085] Personal accounts and business accounts have different functions and transaction habits. For example, the main functions of personal accounts include daily consumption, savings, and transfers, while the main functions of business accounts are high-value transactions or receiving business revenue.

[0086] When acquiring seed accounts and determining the characteristics of members in the target group, the type of account can be included, such as personal or business accounts. This facilitates more accurate group segmentation or more precise account identification results.

[0087] The verified abnormal accounts in this application embodiment include verified personal abnormal accounts and commercial entity abnormal accounts. Verified abnormal accounts may include illegal accounts such as fraudulent accounts, pornography-related accounts, gambling-related accounts, and drug-related accounts verified based on account complaint information or other account-related information.

[0088] For example, the system recently received several reports about account A engaging in fraudulent activities. These reports included the type of report and information such as chat logs and financial transactions between the reporter and account A. Based on these multiple reports, and through verification methods such as manual review, it can be determined that the reported account A is an abnormal account.

[0089] For example, for business entity B, by searching for relevant, already-effective trial information through business entity B, and verifying in the trial information that business entity B is the perpetrator of fraudulent activities, the account can be verified as a seed account. Related information is not limited to trial information; it can also include news platforms that meet predetermined credibility requirements, etc.

[0090] In this embodiment, seed accounts in the system can be dynamically monitored. When a seed account in the system is updated, association diffusion can be performed based on the updated seed account. New target groups are obtained through group division, and account identification is performed based on the member characteristics in the new target groups, thus updating the account identification results.

[0091] In S102, the accounts are associated and propagated based on the seed account to obtain the account relationship network.

[0092] Among them, the account relationship network is a network that represents the association between accounts.

[0093] Since the number of verified abnormal accounts is small, the account identification results of the trained model will be biased when the model is trained using account samples with large positive-negative sample deviation. Therefore, this application embodiment performs association diffusion based on verified seed accounts. By using seed accounts for association diffusion, abnormal accounts can be found and identified more accurately and reliably.

[0094] like Figure 2 As shown, the method of association diffusion based on seed account in this application example may include at least one of binding information diffusion, transaction diffusion, usage environment diffusion, and usage behavior diffusion.

[0095] The binding information may include at least one of the following: account holder, administrator information, contact information, supplier information, etc.

[0096] Specifically, the binding information for an account can be determined based on its type. For example, the binding information for a personal account may include at least one of the following: account holder, contact information, or bank account information. The account holder may include personally identifiable information.

[0097] When expanding the reach of a seed account based on its linked information, if the seed account's linked information includes personally identifiable information, such as... Figure 3As shown, the binding information of seed account A includes personal identification identifier X1. Therefore, a search can be conducted within the system to identify other accounts with associated binding information, including accounts B and C. Since accounts B and C also include personal identification identifier X1 in their binding information, a connection is established between seed account A and account B, as well as between seed account A and account C. Because multiple accounts can be registered with the same personal identification information, if one account, i.e., the seed account, is an abnormal account, other accounts with the same binding information are highly likely to be abnormal accounts as well. This results in a high accuracy rate for identifying abnormal accounts. It is understood that the personal identification information bound to a personal account is not limited to an ID card and can also include facial features, fingerprint features, or iris features.

[0098] If the seed account's linked information includes contact information, such as a personal mobile phone number or email address, and this contact information has been verified, then other accounts with the same contact information can be found in the system and linked to the seed account.

[0099] If the seed account's linked information includes bank account information, other accounts linked to that bank account can be found in the system. Because bank account information is personal and confidential, other accounts found based on that bank account information have a high degree of correlation with the seed account.

[0100] The associated accounts obtained by linking and expanding through the binding information of an individual's seed account can be personal accounts or business entity accounts, or both personal accounts and business entity accounts.

[0101] The information linked to a business entity account may include at least one of the following: account holder, administrator information, contact information, and supplier information. The account holder may include, for example, a business entity identifier. Administrator information may include the business entity's legal representative, directors, general manager, senior executives, and other management personnel. Contact information may include, for example, a registered and verified mobile phone number and email address. Supplier information may include channel partner information or service provider information, or may include both.

[0102] When the binding information includes a business entity identifier, other accounts bound to that trademark entity identifier can be queried based on that business entity identifier, establishing a link between these other accounts and the seed account. These other accounts associated with the business entity identifier are also business entity accounts.

[0103] like Figure 4As shown, when the binding information includes management personnel information, all management personnel information related to the business entity identifier in the binding information of seed account A can be obtained, including general manager P1, legal representative P2, senior executive P3, and director P4, etc. Further association can be performed based on all relevant personnel to determine other accounts associated with all management personnel information, including at least one of the following: other account C1 associated with legal representative P2, other account C2 associated with general manager P1, other account C3 associated with senior executive P3, and other account C4 associated with director P4. It is understood that the positions of the management personnel in these other accounts associated with the seed account through management personnel can be different from their positions in the seed account.

[0104] When the binding information includes contact information, other accounts with the same contact information can be obtained, including other accounts whose contact information includes a mobile phone number and the mobile phone number is the same as the mobile phone number in the seed account's contact information, or other accounts whose contact information includes an email address and the email address is the same as the email address in the seed account's contact information.

[0105] When the seed account's binding information includes supplier information, it can retrieve service provider information, channel provider information, or both supplier and channel provider information. The retrieved supplier or channel provider information, or the corresponding accounts, is then associated with the seed account. The retrieved supplier information can include one or more suppliers, and a single supplier can be associated with one or more accounts.

[0106] In this embodiment, account association propagation can include account association propagation based on transaction information. Transaction information may include transaction fund flows, complaint information, and intervention operation information. Transaction information may include user contributions and merchant contributions. User contributions may include social payments and commercial payments; social payments include transactions between users, and commercial payments include payments initiated by users to merchants.

[0107] Accounts associated with the seed account, derived from the diffusion of funds through transaction information, can include accounts that transact with the seed account (e.g., accounts initiating payments to the seed account) and the target accounts for those payments. Besides accounts directly transacting with the seed account, this can also include accounts that are indirectly connected to the seed account through intermittent transactions. For example, if seed account A transacts with account B, account A establishes a connection with account B; if account B transacts with account C, account B establishes a connection with account C. Therefore, through first-order diffusion (direct connection with the seed account), second-order diffusion (indirect connection with the seed account), or multi-order diffusion (connection to the seed account through one or more other accounts), more accounts associated with the seed account can be obtained.

[0108] In possible implementations, transaction information may include complaint information. When the system receives a user's complaint, the corresponding transaction event may be in a suspended or halted state. The complaint information can be used to identify the complaint accounts associated with the seed account, including the initiating complaint account and the complained-against account. The complaint type can be determined based on complaint text characteristics; for example, complaint types may include dispute types and malicious complaint types. Determining the complaint type based on the complaint text allows for a more reliable assessment of the strength of the association between the seed account and other related accounts. For example, dispute-type complaints may have a weak association, while malicious complaint types may have a strong association.

[0109] In one possible implementation, the system can detect whether a transaction is abnormal based on a pre-defined anomaly detection method. Intervention is then implemented for abnormal transactions, suspending them. This can be done by linking the seed account with other affected accounts based on information about suspensions and other intervention actions between the seed account and other accounts. These other affected accounts can be personal accounts or business entity accounts.

[0110] In this embodiment, account association propagation can be based on the seed account's usage environment. The seed account's usage environment can include, for example, the seed account's login device, the seed account's login location information, and the access point information of the seed account's login device.

[0111] When the seed account's usage environment includes the login device, it's possible to retrieve all accounts logged in on the same login device and identify other accounts that have login records with the seed account on the same device. Since all accounts logged in on the same login device are typically operated by the same user, they exhibit strong correlation.

[0112] like Figure 5As shown, when the usage environment of seed account A includes the location information of the seed account login, the associated range S can be determined based on the location information W1 of the device where seed account A logs in, combined with a pre-set associated radius R. Other accounts are then searched within the associated range S by comparing the location information of the login devices of other accounts with the range S to determine if they belong to that range. If they belong to the range S, for example... Figure 5 Accounts B and C can be linked to seed account A, and account C can also be linked to seed account A. If an account is not within location range S, such as account D in the diagram, it is not necessary to link account D to seed account A for the time being. After establishing the link, the distance between the linked account and the seed account can be retained to assess the degree of association between the linked account and the seed account.

[0113] like Figure 6 As shown, when the usage environment of seed account A includes the access point information of the login device of the seed account, it can be determined whether the seed account is associated with other accounts based on whether the access point information is the same, that is, whether they are on the same access point. For example... Figure 6 As shown, the access point connected to the seed account is AP1, the access points connected to accounts B and C are AP1, and the access point connected to account D is AP2. Therefore, accounts B and C are connected to the same access point as the seed account. An association is established between account B and seed account A, and an association is established between account C and seed account A. An association is not established between seed account A and account D for the time being.

[0114] In this embodiment, account association propagation may include account association propagation based on seed account-related usage behavior. Seed account-related usage behavior includes at least one of the following: seed account name setting behavior, seed account transaction behavior, or seed account complaint behavior.

[0115] Specifically, when the usage behavior of the seed account includes the behavior of setting the seed account name, the association can be spread based on the name of the seed account and the similarity of the names set by other accounts. When the name similarity meets the predetermined requirements, such as being greater than the predetermined similarity value, the association between the seed account and other accounts whose name similarity meets the requirements is established.

[0116] When the usage behavior of the seed account includes the seed account's transaction behavior, the characteristics of the transaction behavior of other accounts can be obtained and compared with the characteristics of the seed account's transaction behavior. If the characteristics of the transaction behavior meet the predetermined similarity threshold, then an association is established between the seed account and other accounts with similar transaction behavior; otherwise, no association is established.

[0117] When the usage behavior of a seed account includes the behavior for which a complaint has been filed against it, the similarity between the behavioral characteristics of the complained behavior of other accounts and those of the seed account can be used to determine whether to establish a connection. If the similarity meets predetermined requirements, a connection is established; otherwise, no connection is established. In possible implementations, complaint information can also be used to assist in determining the similarity between the two accounts. For example, information such as abnormal transaction process characteristics and abnormal transaction duration characteristics in the complaint information can help determine the degree of connection between the two accounts.

[0118] By using various association diffusion methods, a relationship network including one or more seed accounts can be obtained.

[0119] Since the association relationships are dynamically updated, the account identification method in this application embodiment can dynamically spread the associations according to the set update frequency, dynamically update the established association relationship network, divide the groups based on the dynamically updated association relationship network, update the target groups including seed accounts, and identify accounts on the dynamically updated target groups, which helps to improve the real-time performance and accuracy of abnormal account detection.

[0120] It is understandable that the accounts identified after the aforementioned association diffusion can serve as the basis for further association diffusion, allowing for further association diffusion through various methods based on these accounts. For example... Figure 7 As shown, account B is generated through the binding information of seed account A; account C is generated through the transaction information of account B; account D is generated through the usage environment; and account E is generated through the usage behavior. The association is not limited to the possible association methods listed above; any two association methods may be combined for association diffusion.

[0121] In S103, the account relationship network is divided into groups to obtain target groups including seed accounts.

[0122] This application embodiment can generate an account association network through the associated diffusion of binding information, transaction information, usage environment, and usage behavior. This account relationship network includes one or more seed accounts, as well as other accounts obtained through associated diffusion besides the seed accounts. Two accounts with an association relationship can be connected by a straight line to indicate that they have an association relationship.

[0123] In this application embodiment, a pre-defined correspondence between different association types and the weights of the association relationships can be established. This correspondence can be obtained through statistical analysis of sample data, or the weights corresponding to different association types can be determined based on model training.

[0124] In general, the degree of association (also known as weight) established based on binding information can be greater than that of association established based on transaction information, and the degree of association established based on transaction information can be greater than that of association established based on usage behavior or usage environment.

[0125] After determining the weights of the associations between accounts in the account relationship network, we can construct a graph based on the association diffusion, using each account and the seed account as nodes, the association between accounts as edges, and the degree of association between accounts as the weights of the edges. Then, we can perform group partitioning based on the constructed graph.

[0126] A graph constructed based on an account relationship network can be partitioned into multiple groups. To improve partitioning efficiency, the network can be pruned before partitioning to remove isolated nodes. Isolated nodes can include nodes with fewer than a predetermined number of associations with other accounts, nodes with association weights less than a predetermined value, or nodes with both fewer than a predetermined number of associations and association weights less than a predetermined value. After removing isolated nodes, group partitioning algorithms, such as Louvain's algorithm, can be used to determine the groups within the relationship network.

[0127] When identifying groups within a network of relationships using a fast community detection algorithm, the following steps may be included:

[0128] The optimization process involves traversing each node in the graph of the relational network and calculating the change in modularity after moving a node to an adjacent group. If moving a node increases the modularity of the entire network (i.e., the increase in modularity is positive), then the move is executed until all possible moves of all nodes are completed.

[0129] The aggregation step, after moving nodes, yields groups with the same label. These groups are then aggregated into a new node, forming a new network.

[0130] Repeat the optimization and aggregation steps above until the modularity cannot be improved by moving nodes. At this point, the optimal solution for a group partitioning is reached, resulting in multiple partitioned groups.

[0131] To further improve identification efficiency, embodiments of this application can further filter the divided groups. For example, for groups including seed accounts, the average or maximum PPR of the group can be calculated. The average PPR can be compared with a predetermined first PPR threshold. If the average PPR is greater than the first PPR threshold, the group is determined to be a target group; if the average PPR is less than or equal to the first PPR threshold, the group is determined to be a non-target group. Alternatively, if the maximum PPR is greater than a second PPR threshold, the group is determined to be a target group; if the maximum PPR is less than or equal to the second PPR threshold, the group is determined to be a non-target group. Or, if the average PPR is greater than the first PPR threshold and the maximum PPR is greater than the second PPR threshold, the group is determined to be a target group; if the average PPR is less than or equal to the first PPR threshold and the maximum PPR is less than or equal to the second PPR threshold, the group is determined to be a non-target group. For non-target groups, including groups with an average PPR less than or equal to the first PPR threshold, groups with a maximum PPR less than or equal to the second PPR threshold, and isolated nodes, community merging can be performed.

[0132] The PPR (personal-pagerank) value is a numerical value used to represent the closeness or proximity between nodes in a network. The PPR values ​​between nodes in a group can be determined using Monte Carlo simulation, power methods, or forward and backward search methods. To obtain the mean PPR of a group, the PPR values ​​between any two related nodes in any group can be calculated individually, and the average of all related PPR values ​​is taken. Similarly, after determining the PPR values ​​between any two related nodes in a group, the largest PPR value in the group is selected as the maximum PPR value for that group.

[0133] In S104, the characteristics of the members in the target group are determined, and the account identification results of each member in the target group are determined based on the characteristics of the members.

[0134] After determining a loosely coupled, highly cohesive target group including a seed account, this application embodiment can further identify members in the target group based on the characteristics of the members in the target group to obtain accurate account identification results, including identifying abnormal accounts and normal accounts included in the members of the target group.

[0135] When determining the characteristics of members in the target group, the characteristic information of the members of the target group can be determined first. The characteristic information of the members of the target group can include at least one of the following characteristics: identity characteristics, transaction behavior characteristics, fund flow characteristics, and account tag characteristics.

[0136] Among these, identity characteristics may include account age, place of residence, card binding information, historical accounts with the same name, and the age of the user using the account.

[0137] The account's age refers to the length of time the account has been registered and used. Generally, the longer an account has been registered and used, the less likely it is to be a normal account. Conversely, the shorter the account's registration and usage time, the more likely it is to be an abnormal account.

[0138] The account's permanent location is its login location. When multiple login locations are considered, the location with the highest percentage of login time across all locations can be selected as the account's permanent location. The distance between the location of a verified suspicious account and the account's permanent location can also be used to help determine the likelihood of an account being suspicious. For example, the closer the account's permanent location is to a verified suspicious account, the greater the likelihood that the account is suspicious.

[0139] Account card binding information includes whether there are any abnormalities in the card binding process. Abnormalities in card binding indicate that the user of the account may have engaged in card binding-related activities that are not in compliance, such as frozen funds or transaction restrictions.

[0140] Historical accounts with the same name include the number of accounts used by the same account holder (individual or business entity), and may also include the number of historical accounts with the same name used by all account holders in the system. The more accounts used by the same account holder, or the more complex the names of historical accounts with the same name used by different account holders, the higher the likelihood that the account is an abnormal account.

[0141] The age of an account user can be determined based on personal identification information linked to the account, such as an ID card. Statistical analysis of abnormal accounts across different age groups, combined with the age of the account's users, can aid in account identification.

[0142] Transaction behavior characteristics can include transaction frequency and transaction amount.

[0143] Transaction frequency can include cumulative transaction frequency over different time periods. For example, cumulative transaction frequency over different time periods can be expressed as daily cumulative transaction count, weekly cumulative transaction count, and monthly cumulative transaction count. Alternatively, it can be expressed as weekly cumulative transaction days, monthly cumulative transaction days, etc. In possible implementations, transactions can be divided into payment transactions, income transactions, social payments, and commercial payments, with separate frequencies for each. Social payments can represent payment transactions between personal accounts, while commercial payments can represent payments from personal accounts to commercial accounts.

[0144] Transaction amounts can include the cumulative transaction amount within the park over different durations. For example, the cumulative transaction amount over different durations can be expressed as daily cumulative transaction amount, weekly cumulative transaction amount, and monthly cumulative transaction amount. In possible implementations, transactions can be divided into payment transactions, income transactions, social payments, and commercial payments, with cumulative payment amounts, cumulative income amounts, cumulative social payment amounts, and cumulative commercial payment amounts determined for different durations. Social payments can represent payment transactions between personal accounts, while commercial payments can represent payments from personal accounts to commercial accounts.

[0145] Fund flow characteristics can include frequency flow characteristics, large-amount flow characteristics, and fund transfer characteristics. Among these, frequency flow characteristics are used to determine the characteristics of high-frequency transactions between accounts. High-frequency transaction characteristics can include high-frequency transactions between individual accounts and business entity accounts (transaction frequency exceeding a predetermined frequency threshold), high-frequency transactions between individual accounts, high-frequency transactions between two or more individual accounts and a single individual account, or high-frequency transactions between two or more individual accounts and a single business entity account. When the transaction frequency of two related accounts is high-frequency, then the two related accounts exhibit frequency flow characteristics.

[0146] Large-value transaction links are account associations where the transaction amount between two accounts exceeds a predetermined threshold. Specifically, large-value transaction links include those between individual accounts and business entity accounts, between individual accounts, between two or more individual accounts and a single individual account, or between two or more individual accounts and a single business entity account. If the transaction amount between two linked accounts exceeds the predetermined threshold, it indicates a large-value transaction link between the two linked accounts.

[0147] Fund flow characteristics include fund outflow characteristics and fund inflow characteristics. Fund outflow characteristics can include funds from a specific account flowing back to an associated account after passing through N accounts. This includes accounts with the same name as the specific account or accounts with the same binding information as the specific account. For example, funds X from account A, after passing through N accounts, flow back to account B associated with account A. Account B has the same name as account A, or account A and account B have the same binding information. The same binding information can include at least one of the following: same account entity, same contact information, same supplier, or same management personnel information. The re-flow of funds X can include a single transaction or splitting funds X into two or more transactions. Fund outflow characteristics can also include funds from a specific account flowing out of the payment system after passing through N accounts, including withdrawals. For example, if funds X from account A, after passing through N accounts, are withdrawn and flow out of the payment system, then the relationship between the specific account and the N accounts exhibits a fund outflow characteristic.

[0148] Account tagging features include tag information added to accounts by different platforms, such as penalty tags, pornography tags, gambling tags, fraud tags, cash-out tags, and account complaint risk tags. For account complaint risk tags, information such as the amount of money complained about, the frequency of complaints, and the type of complaints can be included.

[0149] Based on the member characteristics of the target group, feature vectors can be generated in a predetermined order. An anomaly score corresponding to the feature vector is calculated using a pre-trained first scoring model. Based on the correspondence between the anomaly score and the anomaly type, the account identification result for the member of the target group is determined.

[0150] When generating feature vectors based on member characteristics, some continuous features, such as account age and user age, can be binned. This transforms continuous numerical variables into discrete intervals, simplifying the data and enhancing the model's stability and interpretability. The binned data can be encoded using WOE (Weight of Evidence) to represent the probability of response of the binned samples. Summing the WOE encodings yields the IV (Information Value) of the continuous feature, representing its contribution to the prediction result. A higher IV value indicates a greater contribution. By filtering feature importance, the computational load of the model can be reduced while effectively improving the accuracy of model predictions.

[0151] The parameters of the first scoring model can be initialized based on the importance or contribution of the features. The predicted score of the model can be obtained by calculating the sample data. The parameters of the first scoring model can be optimized and trained based on the difference between the predicted score and the label score. Through iterative optimization, the parameters of the model can be made more accurate.

[0152] The first scoring model can include any one of the following models: XGB (XGBoost), LR (Logistic Regression), RF (RandomForest), and GNN (Graph Neural Network).

[0153] For the trained first-stage anomaly scoring model, the PSI (Population Stability Index) value of the new data detection model can be used. Once the PSI value meets predetermined requirements, the feature vectors of the target group's member characteristics can be processed based on the trained first-stage scoring model to output an anomaly score. The account identification result, i.e., the anomaly type corresponding to the account, can be determined according to the pre-defined correspondence between the anomaly score and the anomaly type.

[0154] Among the possible implementations, such as Figure 8 As shown in the embodiments of this application, the complaint information can also be cleaned by performing word segmentation, annotation, and embedding operations to extract complaint features from the complaint information. A pre-trained second scoring model is then used to calculate the complaint score corresponding to the complaint features in the complaint information. The second scoring model can include any one of the following: TextCNN (a text classification method based on convolutional neural networks), FastText (a text classification algorithm based on n-grams), and BERT (a deep learning model based on Transformer).

[0155] After feature filtering of members, the filtered features are predicted and calculated, and an anomaly score is determined using a first scoring model. After text cleaning of complaint information, a complaint score is predicted using a second scoring model, which can correct the account identification results determined based on the first scoring model. For example, based on pre-set scoring weights, combined with the anomaly score and complaint score, a comprehensive score for each member in the group can be calculated. Based on the correspondence between this comprehensive score and account type, the account type of the group members can be corrected to obtain the account identification results, including identifying the account as a fraudulent account, a fraudulent individual account, a fraudulent merchant account, a test account, a money laundering individual account, and a money laundering merchant account, etc.

[0156] Since this application embodiment performs association diffusion based on verified seed accounts and divides the account relationship network after association diffusion into groups to obtain target groups including seed accounts, and obtains account identification results based on the member characteristics in the target groups, the method can more reliably identify abnormal accounts in the target groups because it is based on verified seed accounts and the target groups obtained include seed accounts, which is beneficial to improving the accuracy of identification.

[0157] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0158] Figure 9 This is a schematic diagram of an account identification device provided in an embodiment of this application. The device includes:

[0159] Seed account acquisition unit 901 is used to acquire seed accounts, which are verified abnormal accounts.

[0160] The diffusion unit 902 is used to perform association diffusion of accounts based on the seed account to obtain an account relationship network, which is a network representing the association relationship between accounts.

[0161] Grouping unit 903 is used to divide the account relationship network into groups to obtain target groups including seed accounts.

[0162] The identification unit 904 is used to determine the member characteristics in the target group and determine the account identification result of each member in the target group based on the member characteristics.

[0163] In possible implementations, the grouping unit includes:

[0164] The association weight determination sub-unit is used to determine the association weight of the above account relationship network according to the preset correspondence between association types and weights;

[0165] The group division subunit is used to divide the account relationship network into groups according to the above association weights, so as to obtain the target group including the above seed accounts.

[0166] In possible implementations, the group is divided into sub-units, including:

[0167] The group determination module is used to determine the group division results of the above account relationship network based on the above association weights and using a fast community detection algorithm;

[0168] The target group determination module is used to determine the average PPR of the groups that include the seed accounts in the above group division results. If the average PPR is greater than a predetermined first PPR threshold, the group is determined as a target group. Alternatively, the module can determine the maximum PPR of the groups and determine the group as a target group if the maximum PPR is greater than a predetermined second PPR threshold.

[0169] In possible implementations, the identification unit mentioned above includes at least one of the following sub-units:

[0170] The identity feature determination subunit is used to determine the identity features of members in the aforementioned target group;

[0171] The transaction behavior characteristic determination subunit is used to determine the transaction behavior characteristics of members in the aforementioned target group;

[0172] The fund flow characteristics determination subunit is used to determine the fund flow characteristics of members in the above target group;

[0173] The account tag feature determination subunit is used to determine the account tag features of members in the aforementioned target group.

[0174] In possible implementations, the aforementioned identification unit includes:

[0175] The feature vector generation subunit is used to generate feature vectors based on the above member features;

[0176] The scoring determination subunit is used to input the above feature vectors into the scoring model to obtain the abnormality score of the above members. The scoring model is a neural network model trained based on feature samples. The above feature samples include sample feature vectors and corresponding label scores.

[0177] The anomaly type determination subunit is used to determine the account identification result based on the above anomaly degree score and in combination with the preset correspondence between anomaly type and score. The account identification result includes the anomaly type corresponding to the anomaly degree score of the above member.

[0178] In one possible implementation, when the aforementioned member has relevant complaint information, the device further includes:

[0179] The complaint feature extraction subunit is used to extract complaint features based on complaint information.

[0180] The complaint score determination sub-unit is used to calculate complaint characteristics and determine the member's complaint score through a preset second scoring model;

[0181] The result correction subunit is used to correct the account identification result based on the complaint score.

[0182] In possible implementations, the diffusion unit includes at least one of the following sub-units:

[0183] The binding information diffusion subunit is used to spread the association of accounts based on the binding information of the seed accounts mentioned above.

[0184] The transaction information dissemination subunit is used to disseminate the associated information of the aforementioned seed accounts.

[0185] The environment diffusion subunit is used to spread the association of accounts based on the usage environment of the seed accounts mentioned above.

[0186] The behavior diffusion subunit is used to spread the association of accounts based on the usage behaviors associated with the aforementioned seed accounts.

[0187] In possible implementations, the binding information diffusion subunit includes at least one of the following diffusion modules:

[0188] The above binding information includes the account subject. The account subject diffusion module is used to diffuse accounts with the same account subject as the above seed account based on the account subject bound to the above seed account.

[0189] The aforementioned binding information includes administrator information. The administrator information diffusion module is used to diffuse accounts with the same administrator information as the aforementioned seed account based on the administrator information bound to the aforementioned seed account.

[0190] The aforementioned binding information includes suppliers. The supplier diffusion module is used to diffuse the accounts bound to the aforementioned suppliers based on the suppliers bound to the aforementioned seed accounts.

[0191] The aforementioned binding information includes contact information. The contact information diffusion module is used to diffuse information based on the contact information bound to the aforementioned seed account to obtain accounts that have the same contact information bound to the aforementioned seed account.

[0192] In possible implementations, the transaction information diffusion subunit includes at least one of the following diffusion modules:

[0193] The fund flow diffusion module is used to spread the association of accounts based on the transaction fund flow included in the above transaction information, and obtain the accounts related to the above transaction fund flow.

[0194] The complaint information dissemination module is used to disseminate the associated complaint information based on the complaint information included in the above transaction information, thereby obtaining the complaint accounts related to the above complaint information;

[0195] The intervention operation information dissemination module disseminates the information about intervention operations included in the transaction information to related accounts, thereby obtaining the intervened accounts related to the intervention operation information.

[0196] In possible implementations, the use of an environmental diffusion subunit includes at least one of the following diffusion modules:

[0197] The device diffusion module is used to spread the associated accounts based on the devices that log in to the seed account in the above-mentioned usage environment, so as to obtain accounts that log in on the same device.

[0198] The location information diffusion module is used to spread the association of accounts based on the location information of the seed account login in the above-mentioned usage environment, so as to obtain accounts with the same location information as the seed account.

[0199] The access point information diffusion module is used to spread the association of accounts based on the access point information of the login device of the seed account in the above-mentioned usage environment, so as to obtain accounts with the same access point information as the seed account.

[0200] In possible implementations, the behavior diffusion subunit includes at least one of the following diffusion modules:

[0201] The name diffusion module is used to spread the association of accounts based on the names set by the seed accounts, including the above-mentioned usage behaviors, to obtain accounts with the same names.

[0202] The transaction behavior diffusion module is used to associate and diffuse accounts based on the transaction behaviors included in the above-mentioned usage behaviors, thereby obtaining accounts that match the aforementioned transaction behaviors.

[0203] The complaint behavior diffusion module is used to spread the association of accounts based on the complained behavior included in the above-mentioned usage behavior, and to obtain accounts that match the complained behavior.

[0204] Figure 10 This is a schematic diagram of an account identification device provided in an embodiment of this application. Figure 10As shown, the account identification device 10 of this embodiment includes: a processor 100, a memory 101, and a computer program 102, such as an account identification program, stored in the memory 101 and executable on the processor 100. When the processor 100 executes the computer program 102, it implements the steps in the various account identification method embodiments described above. Alternatively, when the processor 100 executes the computer program 102, it implements the functions of each module / unit in the various device embodiments described above.

[0205] For example, the computer program 102 may be divided into one or more modules / units, which are stored in the memory 101 and executed by the processor 100 to complete this application. The one or more modules / units may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of the computer program 102 in the account identification device 10.

[0206] The account identification device 10 can be a computing device such as a desktop computer, laptop, handheld computer, or cloud server. The account identification device may include, but is not limited to, a processor 100 and a memory 101. Those skilled in the art will understand that... Figure 10 This is merely an example of an account identification device 10 and does not constitute a limitation on the account identification device 10. It may include more or fewer components than shown, or combine certain components, or different components. For example, the account identification device may also include input / output devices, network access devices, buses, etc.

[0207] The processor 100 may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0208] The memory 101 can be an internal storage unit of the account identification device 10, such as a hard disk or memory of the account identification device 10. The memory 101 can also be an external storage device of the account identification device 10, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the account identification device 10. Furthermore, the memory 101 can include both internal and external storage units of the account identification device 10. The memory 101 is used to store the computer program and other programs and data required by the account identification device. The memory 101 can also be used to temporarily store data that has been output or will be output.

[0209] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0210] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0211] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0212] In the embodiments provided in this application, it should be understood that the disclosed devices / terminal equipment and methods can be implemented in other ways. For example, the device / terminal equipment embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling or direct coupling or communication connection may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0213] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0214] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0215] If the integrated module / unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by hardware related to computer program instructions. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable medium can be appropriately added or removed according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media do not include electrical carrier signals and telecommunication signals.

[0216] This application also provides a chip including a processor for calling and running a computer program from a memory, causing a device equipped with the chip to perform the account identification method described above.

[0217] This application also provides a computer program product, including computer program instructions that, when run on a computer, cause the computer to execute the above-described account identification method.

[0218] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. An account identification method, characterized in that, The method includes: Obtain the seed account, which is a verified abnormal account; Based on the seed account, the association of accounts is propagated to obtain an account relationship network, which is a network representing the association relationship between accounts; The account relationship network is divided into groups to obtain target groups that include the seed accounts; Determine the member characteristics in the target group, and determine the account identification result of each member in the target group based on the member characteristics.

2. The method according to claim 1, characterized in that, The process of grouping the account relationship network to obtain target groups including the seed accounts includes: The association weights of the account relationship network are determined based on the preset correspondence between association types and weights. The account relationship network is divided into groups based on the association weights to obtain target groups that include the seed accounts.

3. The method according to claim 2, characterized in that, The step of dividing the account relationship network into groups based on the association weight to obtain a target group including the seed account includes: Based on the association weights, a fast community detection algorithm is used to determine the group division results of the account relationship network; For groups that include the seed account in the group segmentation results, determine the average PPR of the group. If the average PPR is greater than a predetermined first PPR threshold, determine the group as a target group. Alternatively, determine the maximum PPR of the group. If the maximum PPR is greater than a predetermined second PPR threshold, determine the group as a target group.

4. The method according to any one of claims 1 to 3, characterized in that, Determining the member characteristics of the target group includes at least one of the following methods: Determine the identity characteristics of the members in the target group; Determine the transaction behavior characteristics of members in the target group; Determine the financial transaction characteristics of members in the target group; Determine the account tag characteristics of members in the target group.

5. The method according to claim 4, characterized in that, The step of determining the account identification results of each member in the target group based on the member characteristics includes: Generate a feature vector based on the member characteristics; The abnormality score of the member is obtained by calculating the feature vector through a preset first scoring model. The first scoring model is a neural network model trained based on feature samples. The feature samples include sample feature vectors and corresponding label scores. Based on the anomaly score and the preset correspondence between anomaly types and scores, the account identification result is determined, and the account identification result includes the anomaly type corresponding to the member's anomaly score.

6. The method according to any one of claims 1 to 3, characterized in that, If the member has relevant complaint information, the method further includes: Extract complaint features based on the complaint information; The complaint characteristics are calculated using a preset second scoring model to determine the member's complaint score; The account identification result is corrected based on the complaint score.

7. The method according to any one of claims 1 to 3, characterized in that, The association and dissemination of accounts based on the seed account includes at least one of the following methods: The account is associated and disseminated based on the binding information of the seed account; The association and dissemination of accounts are carried out based on the transaction information of the seed accounts; The association and dissemination of accounts are based on the usage environment of the seed accounts; The association and dissemination of accounts are based on the usage behavior associated with the seed account.

8. The method according to claim 7, characterized in that, The process of associating and expanding the account based on the binding information of the seed account includes at least one of the following expansion methods: Based on the account holder included in the binding information, accounts with the same account holder as the seed account are obtained; Based on the administrator information included in the binding information, accounts with the same administrator information as the seed account are obtained; Based on the suppliers included in the binding information, the accounts bound to the suppliers are obtained; Based on the contact information included in the binding information, accounts with the same contact information as the seed account are obtained.

9. The method according to claim 7, characterized in that, The association and dissemination of accounts based on the transaction information of the seed account includes at least one of the following dissemination methods: Based on the transaction fund chain included in the transaction information, the accounts associated with the transaction fund chain are propagated to obtain the accounts related to the transaction fund chain; Based on the complaint information included in the transaction information, the accounts are associated and disseminated to obtain the complaint accounts related to the complaint information; Based on the intervention operation information included in the transaction information, the accounts are associated and diffused to obtain the intervened accounts related to the intervention operation information.

10. The method according to claim 7, characterized in that, The process of spreading account associations based on the usage environment of the seed account includes at least one of the following methods: Based on the devices used to log in to the seed account within the usage environment, the accounts are associated and propagated to obtain accounts logged in on the same devices. Based on the location information of the seed account login in the usage environment, the account association is diffused to obtain accounts with the same location information as the seed account; Based on the access point information of the login device of the seed account included in the usage environment, the account is associated and diffused to obtain an account with the same access point information as the seed account.

11. The method according to claim 7, characterized in that, The process of affixing and disseminating accounts based on the relevant usage behavior of the seed account includes at least one of the following methods: Based on the name set in the seed account included in the usage behavior, the account is associated and diffused to obtain accounts with the same name; Based on the transaction behaviors included in the usage behavior, the accounts are associated and diffused to obtain accounts that match the transaction behaviors; Based on the usage behavior, the accounts are associated and expanded to obtain accounts that match the complained behavior.

12. An account identification device, characterized in that, The device includes: Seed account acquisition unit, used to acquire seed accounts, wherein the seed accounts are verified abnormal accounts; A diffusion unit is used to perform association diffusion of accounts based on the seed account to obtain an account relationship network, wherein the account relationship network is a network representing the association relationship between accounts; A grouping unit is used to divide the account relationship network into groups to obtain target groups that include the seed accounts; The identification unit is used to determine the member characteristics in the target group and determine the account identification result of each member in the target group based on the member characteristics.

13. An account identification device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method as described in any one of claims 1 to 11.

14. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 11.

Images