Abnormal account identification method and device, equipment, storage medium and program product

Abstract

The invention discloses an abnormal account identification method and device, equipment, a storage medium and a program product, and the method comprises the steps: obtaining first transaction information of a first payment account and second transaction information corresponding to a plurality of second payment accounts, one of the first transaction information and the second transaction information being corresponding to a block chain transaction, the other one corresponds to a traditional electronic payment transaction; determining a first similarity based on the transaction amount and the transaction time in the first transaction information and the second transaction information; determining a second similarity based on transaction frequencies of the first payment account and the second payment account and respective transaction opposite-side accounts; determining a first adjustment weight and a second adjustment weight based on the transaction frequencies corresponding to the first payment account and the second payment account respectively; determining a third similarity based on the first adjustment weight, the second adjustment weight, the first similarity and the second similarity; and identifying the second payment account corresponding to the third similarity meeting the similarity condition as an abnormal account matched with the first payment account.

Description

Technical Field

[0001] This application belongs to the field of payment technology, and in particular relates to a method, apparatus, device, storage medium and program product for identifying abnormal accounts. Background Technology

[0002] With the rapid development of blockchain networks, their applications have extended to illicit fund transfers. Specifically, illicit funds are transferred between cryptocurrency wallet addresses via blockchain networks, while fiat currency settlements are completed through personal accounts. These two transaction channels operate in parallel and complement each other, dividing the entire illicit fund transfer process into two relatively independent parts: online cryptocurrency circulation and offline fiat currency circulation. The cryptocurrency transactions on the blockchain are often difficult to trace accurately due to the use of anonymization technologies such as coin mixers. Offline person-to-person account transfers are mixed in with a massive amount of legitimate personal transfers, making their characteristics extremely indistinct. Therefore, this parallel transaction model poses a significant challenge to the identification and prevention of transaction risks.

[0003] Therefore, there is an urgent need for a method to identify abnormal accounts in order to achieve a two-way mapping between blockchain wallet addresses and real-world payment accounts, thereby providing reliable technical support for preventing and controlling transaction risks. Summary of the Invention

[0004] This application provides a method, apparatus, electronic device, computer-readable storage medium, and computer program product for identifying abnormal accounts. It not only realizes a two-way mapping between blockchain wallet addresses and real-world payment accounts, but also improves the accuracy and robustness of identifying abnormal accounts, thereby providing reliable technical support for preventing and controlling transaction risks.

[0005] In a first aspect, embodiments of this application provide a method for identifying abnormal accounts, the method comprising: Obtain first transaction information of a first payment account within a target time period and second transaction information of multiple second payment accounts within the target time period respectively. The first transaction information corresponds to a first transaction type, and the second transaction information corresponds to a second transaction type. One of the first transaction type and the second transaction type is a blockchain transaction, and the other is a traditional electronic payment transaction. Both the first transaction information and the second transaction information include transaction time, transaction amount, and counterparty account. Based on the transaction amount and transaction time in the first transaction information, and the transaction amount and transaction time in each of the second transaction information, a first similarity between the first payment account and each of the second payment accounts is determined; Based on the transaction frequency between the counterparty account and the first payment account in the first transaction information, and the transaction frequency between the counterparty account and the second payment account in each of the second transaction information, a second similarity between the first payment account and each of the second payment accounts is determined; Based on the transaction frequency corresponding to the first payment account, a first adjustment weight negatively correlated with the transaction frequency is determined, and based on the transaction frequency corresponding to each second payment account, a second adjustment weight negatively correlated with the transaction frequency is determined for each second payment account. For each second payment account, a third similarity is determined based on the first adjustment weight, the second adjustment weight, the first similarity, and the second similarity; If the target similarity with the largest value among the multiple third similarities is greater than the first similarity threshold, the second payment account corresponding to the target similarity is identified as an abnormal account that matches the first payment account.

[0006] Secondly, embodiments of this application provide an abnormal account identification device, the device comprising: The acquisition module is used to acquire the first transaction information of the first payment account within the target time period and the second transaction information of multiple second payment accounts within the target time period respectively. The first transaction information corresponds to the first transaction type, and the second transaction information corresponds to the second transaction type. One of the first transaction type and the second transaction type is a blockchain transaction, and the other is a traditional electronic payment transaction. Both the first transaction information and the second transaction information include the transaction time, transaction amount, and counterparty account. The determination module is used to determine a first similarity between the first payment account and each of the second payment accounts based on the transaction amount and transaction time in the first transaction information and the transaction amount and transaction time in each of the second transaction information. The determining module is further configured to determine a second similarity between the first payment account and each of the second payment accounts based on the transaction frequency between the counterparty account and the first payment account in the first transaction information, and the transaction frequency between the counterparty account and the second payment account in each of the second transaction information. The determining module is further configured to determine a first adjustment weight negatively correlated with the transaction frequency based on the transaction frequency corresponding to the first payment account, and to determine a second adjustment weight negatively correlated with the transaction frequency corresponding to each second payment account based on the transaction frequency corresponding to each second payment account; The determining module is further configured to, for each of the second payment accounts, determine a third similarity based on the first adjustment weight, the second adjustment weight, the first similarity, and the second similarity; The identification module is used to identify the second payment account corresponding to the target similarity as an abnormal account that matches the first payment account when the target similarity with the largest value among multiple third similarities is greater than the first similarity threshold.

[0007] Thirdly, embodiments of this application provide an electronic device, which includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements any of the possible implementations of the first aspect described above.

[0008] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement the method in any of the possible implementations of the first aspect described above.

[0009] Fifthly, embodiments of this application provide a computer program product in which instructions, when executed by a processor of an electronic device, cause the electronic device to perform a method as described in any of the possible implementations of the first aspect above.

[0010] This application embodiment determines the first similarity between a first payment account and each second payment account based on the transaction amount and time in the first transaction information, and the transaction amount and time in each second transaction information. This allows for the identification of whether accounts have mutual transfer relationships at the transaction behavior level from the perspective of monetary equivalence and temporal proximity. Furthermore, the transaction frequency between the counterparty account and the payment account can characterize the structural role played by the payment account in the transaction network. Therefore, by determining the second similarity between the first payment account and each second payment account based on the transaction frequency between the counterparty account and the first payment account in the first transaction information, and the transaction frequency between the counterparty account and the second payment account in each second transaction information, it is possible to identify whether two payment accounts have similarities at the structural role level from the perspective of the structural roles played by the first and second payment accounts in their respective transaction networks. This, in turn, identifies potentially related accounts controlled by the same entity or used for the same purpose. Furthermore, by determining a first adjustment weight negatively correlated with transaction frequency based on the transaction frequency corresponding to the first payment account, and a second adjustment weight negatively correlated with transaction frequency for each second payment account based on the transaction frequency corresponding to each second payment account, and by jointly determining a third similarity for each second payment account based on the first adjustment weight, the second adjustment weight, the first similarity, and the second similarity, the influence of high-frequency accounts in similarity calculation can be automatically reduced. Thus, when the target similarity with the largest value among multiple third similarities exceeds the first similarity threshold, the second payment account corresponding to the target similarity is identified as an abnormal account matching the first payment account. This not only achieves a two-way mapping between blockchain wallet addresses and real-world payment accounts but also improves the accuracy and robustness of abnormal account identification, thereby providing reliable technical support for preventing transaction risks. Attached Figure Description

[0011] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 This is a flowchart illustrating a method for identifying abnormal accounts according to an embodiment of this application; Figure 2 This is a flowchart illustrating a method for identifying abnormal accounts provided in another embodiment of this application; Figure 3 This is a schematic diagram of the structure of an abnormal account identification device provided in one embodiment of this application; Figure 4 This is a schematic diagram of the structure of an electronic device provided in one embodiment of this application. Detailed Implementation

[0013] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples.

[0014] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0015] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0016] Furthermore, the acquisition, storage, use, and processing of data in this application's technical solution all comply with relevant national laws and regulations.

[0017] As described in the background section, with the rapid development of blockchain networks, their applications have extended to the transfer of illicit funds. Specifically, illicit funds are transferred between cryptocurrency wallet addresses via blockchain networks, while fiat currency settlements are completed through personal accounts. These two transaction channels operate in parallel and complement each other, dividing the entire illicit fund transfer process into two relatively independent parts: online cryptocurrency circulation and offline fiat currency circulation. Due to the use of anonymization technologies such as coin mixers, the transaction paths of cryptocurrency transactions on the blockchain are often difficult to trace accurately. Offline person-to-person personal account transfers are mixed in with a massive amount of normal personal transfers, making their characteristics extremely indistinct. Therefore, this parallel transaction model poses a significant challenge to the identification and prevention of transaction risks.

[0018] Therefore, there is an urgent need for a method to identify abnormal accounts in order to achieve a two-way mapping between blockchain wallet addresses and real-world payment accounts, thereby providing reliable technical support for preventing and controlling transaction risks.

[0019] To address the related technical issues, embodiments of this application provide a method, apparatus, electronic device, computer-readable storage medium, and computer program product for identifying abnormal accounts.

[0020] The method for identifying abnormal accounts provided in the embodiments of this application will be described below.

[0021] Figure 1 A flowchart illustrating an embodiment of the abnormal account identification method provided in this application is shown. Figure 1 As shown, the method for identifying abnormal accounts provided in this application includes the following steps: S110. Obtain the first transaction information of the first payment account within the target time period and the second transaction information of multiple second payment accounts within the target time period respectively. The first transaction information corresponds to the first transaction type, and the second transaction information corresponds to the second transaction type. One of the first transaction type and the second transaction type is a blockchain transaction, and the other is a traditional electronic payment transaction. Both the first transaction information and the second transaction information include the transaction time, the transaction amount, and the counterparty account. S120. Based on the transaction amount and transaction time in the first transaction information, and the transaction amount and transaction time in each second transaction information, determine the first similarity between the first payment account and each second payment account; S130. Based on the transaction frequency between the counterparty account and the first payment account in the first transaction information, and the transaction frequency between the counterparty account and the second payment account in each second transaction information, determine the second similarity between the first payment account and each second payment account; S140. Based on the transaction frequency corresponding to the first payment account, determine a first adjustment weight that is negatively correlated with the transaction frequency, and based on the transaction frequency corresponding to each second payment account, determine a second adjustment weight that is negatively correlated with the transaction frequency corresponding to each second payment account. S150. For each second payment account, a third similarity is determined based on the first adjustment weight, the second adjustment weight, the first similarity, and the second similarity. S160. If the target similarity with the largest value among multiple third similarities is greater than the first similarity threshold, the second payment account corresponding to the target similarity is identified as an abnormal account that matches the first payment account.

[0022] This application embodiment determines the first similarity between a first payment account and each second payment account based on the transaction amount and time in the first transaction information, and the transaction amount and time in each second transaction information. This allows for the identification of whether accounts have mutual transfer relationships at the transaction behavior level from the perspective of monetary equivalence and temporal proximity. Furthermore, the transaction frequency between the counterparty account and the payment account can characterize the structural role played by the payment account in the transaction network. Therefore, by determining the second similarity between the first payment account and each second payment account based on the transaction frequency between the counterparty account and the first payment account in the first transaction information, and the transaction frequency between the counterparty account and the second payment account in each second transaction information, it is possible to identify whether two payment accounts have similarities at the structural role level from the perspective of the structural roles played by the first and second payment accounts in their respective transaction networks. This, in turn, identifies potentially related accounts controlled by the same entity or used for the same purpose. Furthermore, by determining a first adjustment weight negatively correlated with transaction frequency based on the transaction frequency corresponding to the first payment account, and a second adjustment weight negatively correlated with transaction frequency for each second payment account based on the transaction frequency corresponding to each second payment account, and by jointly determining a third similarity for each second payment account based on the first adjustment weight, the second adjustment weight, the first similarity, and the second similarity, the influence of high-frequency accounts in similarity calculation can be automatically reduced. Thus, when the target similarity with the largest value among multiple third similarities exceeds the first similarity threshold, the second payment account corresponding to the target similarity is identified as an abnormal account matching the first payment account. This not only achieves a two-way mapping between blockchain wallet addresses and real-world payment accounts but also improves the accuracy and robustness of abnormal account identification, thereby providing reliable technical support for preventing transaction risks.

[0023] The specific implementation methods for each of the above steps are described below.

[0024] In some embodiments, in S110, traditional electronic payment transactions refer to fund transfers where authorization, clearing, and settlement processes are completed by centralized financial institutions and their back-end systems. Traditional electronic payment transactions include, but are not limited to, over-the-counter transactions, online electronic payment transactions, and offline electronic payment transactions. Blockchain transactions refer to value transfer operations based on distributed ledger technology, verified and recorded through peer-to-peer networks and cryptographic consensus mechanisms. The authorization, clearing, and settlement processes of blockchain transactions are jointly completed by decentralized network nodes.

[0025] In this embodiment, one of the first transaction type and the second transaction type is a blockchain transaction, and the other is a traditional electronic payment transaction. If the first transaction type is a blockchain transaction and the second transaction type is a traditional electronic payment transaction, then the first payment account can be a blockchain wallet address, the second payment account can be a bank card number or an electronic wallet account identifier, the transaction amount in the first transaction information can be the transaction amount corresponding to a stablecoin, and the transaction amount in the second transaction information can be the transaction amount corresponding to fiat currency. The stablecoin can be, for example, Tether (United States Dollar Tether, USDT).

[0026] In addition, both the first and second transaction information can include transaction time, transaction type, transaction amount, and counterparty account. The transaction time can be accurate to the second, and the transaction type can include transfer in and transfer out. If the transaction type corresponding to the first transaction information is a blockchain transaction, and the transaction type corresponding to the second transaction information is a traditional electronic payment transaction, then the transaction amount in the first transaction information can be, for example, in USDT, rounded to two decimal places, and the transaction amount in the second transaction information can be, for example, in RMB, rounded to two decimal places. The counterparty account in the first transaction information can be an anonymous blockchain wallet address or an exchange's public blockchain address, and the counterparty account in the second transaction information can be a bank card number or an e-wallet account identifier.

[0027] In addition, both the first transaction information and the second transaction information can include transaction information corresponding to multiple transactions respectively.

[0028] Based on this, the transaction information corresponding to a blockchain wallet address provided in this application embodiment can be shown in Table 1 below: Table 1

[0029] The transaction information corresponding to a bank card number provided in this embodiment can be shown in Table 2 below: Table 2

[0030] In addition, the target duration can be, for example, 30 days, 60 days, etc.

[0031] As an example, assuming the first transaction type is a blockchain transaction and the second transaction type is a traditional electronic payment transaction, a blockchain explorer (such as Etherscan) can collect the transaction records of a blockchain wallet address (e.g., 0x7a250d56...) for the past 30 days to obtain the first transaction information, and extract the transfer records of all bank cards for the past 30 days from the clearing and settlement system to obtain the second transaction information.

[0032] In addition, regardless of whether the second payment account is a blockchain wallet address or a bank card number, the number of second payment accounts is relatively large within the target time period.

[0033] Therefore, in order to improve the efficiency of identifying abnormal accounts, in some embodiments, the above-mentioned S110 may specifically include: Obtain the first transaction information of the first payment account within the target time period and the second transaction information of each of the multiple third payment accounts within the target time period; Randomly select at least one first transaction from multiple transactions; Extend the transaction time of each first transaction to obtain at least one transaction time range; In cases where a second transaction exists in the third payment account within each transaction timeframe, the size of the first transaction is determined based on the transaction type and transaction amount of at least one first transaction, and the size of the second transaction is determined based on the transaction type and transaction amount of at least one second transaction. If the first transaction size matches the second transaction size, the third payment account will be designated as the second payment account.

[0034] Here, assuming the first payment account is a blockchain wallet address and the third payment account is a bank card number, the first transaction information can include transaction information corresponding to multiple blockchain transactions. Additionally, for each bank card, the corresponding second transaction information may include transaction information corresponding to one or more traditional electronic payment transactions, or it may contain no transaction information, i.e., the second transaction information is empty. Based on this, the first transaction can be a blockchain transaction randomly selected from multiple blockchain transactions corresponding to the blockchain wallet address.

[0035] As an example, after obtaining the first transaction information, 1-3 blockchain transactions can be randomly selected from the first transaction information. Then, all bank cards that have undergone traditional electronic payment transactions (i.e., the second transaction) within half an hour before and after each blockchain transaction (i.e., the first transaction) can be queried as candidate bank cards. Each candidate bank card can have one or more transactions within half an hour before and after each first transaction; this is not limited here. For example, assuming there are 3 first transactions, then the candidate bank cards must have at least 3 corresponding second transactions.

[0036] For each candidate bank card, if the transaction size of at least one second transaction corresponding to that candidate bank card (i.e., the second transaction size) matches the transaction size of at least one randomly selected first transaction (i.e., the first transaction size), then the candidate bank card can be identified as the second payment account. Whether the transaction sizes of at least one second transaction match those of at least one first transaction can be determined by the transaction type and transaction amount. For example, for each candidate bank card and a specific first transaction, if the transaction type corresponding to the first transaction is transfer in, the transaction type corresponding to the second transaction is transfer out, and the difference between the transfer-in transaction amount and the transfer-out transaction amount is within a preset amount range, then it can be determined that the transaction sizes of at least one second transaction match those of at least one first transaction. As another example, for each candidate bank card and multiple first transactions, if the difference between the total final transfer-out / transfer-in transaction amount corresponding to the multiple first transactions and the total final transfer-in / transfer-out transaction amount corresponding to the multiple second transactions is within a preset amount range, then it can be determined that the transaction sizes of at least one second transaction match those of at least one first transaction.

[0037] This application embodiment filters multiple third payment accounts based on transaction time, transaction type, and transaction amount to obtain multiple second payment accounts. This reduces the number of second payment accounts used for similarity calculation with the first payment account, thereby increasing the speed of subsequent similarity calculation and improving the efficiency of abnormal account identification.

[0038] After obtaining the first transaction information and multiple second transaction information, data preprocessing can be performed on the first transaction information and multiple second transaction information to further improve the efficiency and accuracy of abnormal account identification.

[0039] Specifically, in order to further improve the efficiency and accuracy of identifying abnormal accounts, in some embodiments, after S110 and before S120, the method for identifying abnormal accounts may further include: Time alignment is performed between the transaction times in the first and second transaction information; The transaction amounts in the first and second transaction information are converted using exchange rates to unify the settlement unit corresponding to the transaction amounts; Transactions in the first and second transaction information that have a transaction amount less than the amount threshold are excluded.

[0040] Here, the transaction times in the first and second transaction information can be uniformly converted to Beijing time to ensure the comparability of the data in the time dimension.

[0041] In addition, for the transaction amount corresponding to blockchain transactions (such as those settled in USDT), it can be converted into RMB at the exchange rate at the time of the transaction (such as 1 USDT = 7.2 CNY) and two decimal places can be retained. This unifies the settlement unit of the transaction amount in the first and second transaction information and ensures the comparability of data in terms of amount.

[0042] In addition, to control the data size, after the settlement unit corresponding to the same transaction amount, small transactions with a transaction amount less than or equal to 100 CNY can be removed, so that the transaction amounts in the first and second transaction information are both greater than the amount threshold (such as 100 CNY).

[0043] This application's embodiments, by pre-aligning time and converting exchange rates, ensure data comparability across both time and monetary dimensions, providing a reliable data foundation for identifying abnormal accounts and thus improving the accuracy of such identification. Furthermore, by removing small transactions, the data size can be reduced, further enhancing the efficiency of abnormal account identification.

[0044] In some embodiments, in S120, in order to identify whether there is a mutual transfer relationship between the first payment account and the second payment account at the transaction behavior level from the perspective of monetary equivalence and temporal proximity, a first similarity between the first payment account and each second payment account can be determined based on the transaction amount and transaction time in the first transaction information, and the transaction amount and transaction time in each second transaction information.

[0045] Therefore, in order to improve the accuracy of the first similarity, in some embodiments, the above-mentioned S120 may specifically include: For each secondary payment account, perform the following: Based on the transaction amount and transaction time in the first transaction information, and the transaction amount and transaction time in the second transaction information, a dynamic time warping matrix is ​​constructed; Determine the cumulative minimum distance corresponding to the optimal alignment path in the dynamic time warp matrix; Based on the transaction amount and transaction time in the first transaction information, and the transaction amount and transaction time in the second transaction information, the normalization factor is determined; The normalized difference is determined based on the ratio of the cumulative minimum distance to the normalization factor; Based on the normalized difference, the first similarity is determined to be negatively correlated with the normalized difference.

[0046] Here, Dynamic Time Warping (DTW) is an algorithm used to measure the similarity between two time series. Its core capability lies in its ability to "warp" or "stretch" the time axis to find the best match between two series, even if they are not perfectly aligned in time. The DTW matrix systematically records the cumulative distance between two time series under all possible alignment methods.

[0047] To construct a dynamic time warp matrix, we can first construct a first transaction sequence based on the transaction amount and time from the first transaction information, and then construct a second transaction sequence based on the transaction amount and time from the second transaction information. Finally, we construct the dynamic time warp matrix based on the first and second transaction sequences. The first transaction sequence can be denoted as Q, and it can include multiple feature points. = ( The second transaction sequence can be denoted as C, and it can include multiple feature points. = ( ), j=1,…,n. Where m represents the number of elements (i.e., the number of transactions) in sequence Q, and n represents the number of elements (i.e., the number of transactions) in sequence C.

[0048] The process of constructing a dynamic time warping matrix based on the first and second transaction sequences can be described as follows.

[0049] First, for each pair of positions (i, j), the weighted distance is calculated using the following formula (1): (1) In formula (1), For example, it could be 0.6. For example, it could be 0.4. =0.6, =0.4 can be considered a better parameter obtained by the grid search method.

[0050] By iterating through all combinations of (i, j), the initial distance matrix D can be generated. In matrix D, D[i][j] = .

[0051] Next, create a matrix W with the same size as D, initialize W[0][0] = D[0][0], and initialize the first row and first column as the cumulative path distance (for example, W[i][0] = W[i-1][0] + D[i][0], and similarly W[0][j] = W[0][j-1] + D[0][j]), to obtain the initialized cumulative distance matrix W.

[0052] Then, from i = 1 to m, j = 1 to n, update W according to the following formula (2) to obtain the dynamic time warp matrix: (2) Based on this, the cumulative minimum distance corresponding to the optimal alignment path can be found in the dynamic time warp matrix. The corresponding value.

[0053] The normalization factor can be determined by the following formula (3): (3) Based on this, the first similarity can be determined using the following formula (4). : (4) In formula (4), This indicates the normalized difference.

[0054] The embodiments of this application construct a dynamic time warping matrix based on transaction time and transaction amount, and determine the first similarity based on the dynamic time warping matrix. This can determine the first similarity from two dimensions: monetary equivalence and time proximity, thereby improving the accuracy of the first similarity.

[0055] Based on this, in order to further improve the accuracy of the first similarity, in some embodiments, a dynamic time warping matrix is ​​constructed based on the transaction amount and transaction time in the first transaction information and the transaction amount and transaction time in the second transaction information. Specifically, this may include: Based on the transaction amount and transaction time in the first transaction information, an initial first transaction sequence is constructed, and based on the transaction amount and transaction time in the second transaction information, an initial second transaction sequence is constructed. The transaction amounts and transaction times in the initial first transaction sequence and the initial second transaction sequence are normalized respectively to obtain the first transaction sequence and the second transaction sequence. A dynamic time warping matrix is ​​constructed based on the first and second transaction sequences.

[0056] Here, the transaction amounts and transaction times in the initial first transaction sequence and the initial second transaction sequence are normalized, including: normalizing the transaction amounts in the initial first transaction sequence; normalizing the transaction times in the initial first transaction sequence; normalizing the transaction amounts in the initial second transaction sequence; and normalizing the transaction times in the initial second transaction sequence.

[0057] The transaction amounts and transaction times in the initial first transaction sequence and the initial second transaction sequence can be normalized using the following formula (5): (5) In formula (5), This represents the transaction amount / transaction time before normalization. This represents the normalized transaction amount / transaction time. This is the average of all transaction amounts / transaction times in the transaction sequence. This represents the standard deviation of the total transaction amount / transaction time in the transaction sequence.

[0058] This application embodiment normalizes the transaction amount and transaction time in the initial first transaction sequence and the initial second transaction sequence to obtain the first transaction sequence and the second transaction sequence, and constructs a dynamic time warping matrix based on the first transaction sequence and the second transaction sequence. This can reduce the impact of outlier data on subsequent calculations, thereby improving the accuracy of the first similarity.

[0059] In addition, as mentioned above, the second transaction sequence may include multiple feature points. = ( ), j=1,…,n.

[0060] Based on this, in order to improve the efficiency of determining multiple first similarities and thus improve the efficiency of identifying abnormal accounts, in some embodiments, the above-mentioned construction of a dynamic time warping matrix based on the first transaction sequence and the second transaction sequence may specifically include: Obtain the target's cumulative minimum distance, which is the smallest among multiple existing cumulative minimum distances. Construct the envelope region based on the first transaction sequence; Feature points located outside the envelope region are identified as target feature points; Based on at least one target feature point, determine the lower bound value of the envelope corresponding to the second transaction sequence; When the lower bound of the envelope is less than or equal to the target cumulative minimum distance, a dynamic time warping matrix is ​​constructed based on the first transaction sequence and the second transaction sequence.

[0061] Here, for each dynamically time-warped matrix constructed, a cumulative minimum distance is obtained. Among multiple existing cumulative minimum distances, the one with the smallest value can be determined as the target cumulative minimum distance.

[0062] The envelope region can be the area between the upper envelope line U and the lower envelope line L of the first transaction sequence Q. The upper envelope line U can be the maximum value near each feature point of Q (within a sliding window). The lower envelope line L can be the minimum value near each feature point of Q (within the same sliding window).

[0063] Then, the relative positional relationship between the second transaction sequence C and the envelope region is compared. If a certain feature point C of sequence C... k It ran above the envelope region (i.e., C) k > U k ), then take the square of this vertical distance (C) k -U k The sum is added to the lower bound of the envelope value LB_Keogh. If a certain feature point C of sequence C... k It ran to the lower part of the envelope region (i.e., C). k <L k Then take the square of this vertical distance (L) k -C k The sum is added to the lower bound of the envelope value LB_Keogh. If a certain feature point C of sequence C... k If a point falls within the envelope region, it is considered that the point is likely well aligned and its contribution is 0.

[0064] Now we have LB_Keogh, which is an absolute lower bound on the DTW distance between sequences Q and C. That is, no matter how the two sequences are bent, their final DTW distance (i.e., ...) remains constant. It must be greater than or equal to LB_Keogh.

[0065] As can be seen from formula (4) above, The smaller the cumulative minimum distance (LB_Keogh), the greater the first similarity. Therefore, if the lower bound of the envelope value LB_Keogh is greater than the target cumulative minimum distance, then the second transaction sequence C corresponding to that lower bound of the envelope value is... Since the distance is greater than the target cumulative minimum distance, the second payment account corresponding to the second transaction sequence C is not necessarily the account that best matches the first payment account. Therefore, the second transaction sequence C corresponding to the lower boundary value of the envelope can be discarded, and the dynamic time warping matrix is ​​no longer constructed based on the second transaction sequence. This reduces the number of dynamic time warping matrices that can be constructed, thereby improving the efficiency of determining multiple first similarities and thus improving the efficiency of identifying abnormal accounts.

[0066] In some embodiments, in S130, the transaction frequency between the counterparty account and the payment account can characterize the structural role played by the payment account in the transaction network. If the interaction patterns of two payment accounts with their respective transaction circles are highly similar, it indicates that they may be controlled by the same entity or used for the same illegal purpose, thereby penetrating anonymity and identifying potential related accounts. Therefore, in order to identify whether there is similarity between two payment accounts at the structural role level from the perspective of the structural roles played by the first payment account and the second payment account in their respective transaction networks, and thus identify potential related accounts controlled by the same entity or used for the same purpose, a second similarity between the first payment account and each second payment account can be determined based on the transaction frequency between the counterparty account and the first payment account in the first transaction information, and the transaction frequency between the counterparty account and the second payment account in each second transaction information.

[0067] Therefore, in order to improve the accuracy of the second similarity, in some embodiments, the above-mentioned S130 may specifically include: Based on the transaction frequency between the counterparty account and the first payment account in the first transaction information, determine the first frequency vector corresponding to the first payment account; Based on the transaction frequency between the counterparty account and the second payment account in each second transaction information, determine the second frequency vector corresponding to each second payment account; Based on the cosine similarity between the first frequency vector and each second frequency vector, the second similarity between the first payment account and each second payment account is determined.

[0068] For any target frequency vector among the first frequency vector and the second frequency vector, determining the target frequency vector can specifically include: Obtain the first number of transactions, the second number of counterparty accounts, and the number of times each counterparty account appears in the target transaction information. The target transaction information is the transaction information in the first and second transaction information that corresponds to the target frequency vector. For each counterparty account, the word frequency of the counterparty account is determined based on the ratio of the number of times to the first quantity; Based on the logarithmic reciprocal of the second quantity, the amount of information corresponding to the second target payment account is determined. The second target payment account is the payment account that corresponds to the target transaction information among the first payment account and the second payment account. The target frequency vector corresponding to the second target payment account is determined by multiplying multiple word frequencies by their respective information content.

[0069] Here, if the target transaction information is the first transaction information, then the second target payment account is the first payment account, and the target frequency vector is the first frequency vector. If the target transaction information is the second transaction information, then the second target payment account is the second payment account, and the target frequency vector is the second frequency vector.

[0070] As an example, suppose the target transaction information includes 100 transactions, and these 100 transactions involve 3 counterparty accounts. The first quantity can be 100, the second quantity can be 3, and the information volume corresponding to the second target payment account can be lg(1 / 3). Furthermore, suppose that among the 3 counterparty accounts, counterparty account A appears 50 times, counterparty account B appears 20 times, and counterparty account C appears 30 times. Then the word frequency of counterparty account A can be 5 / 100 = 0.05, the word frequency of counterparty account B can be 20 / 100 = 0.2, and the word frequency of counterparty account C can be 30 / 100 = 0.3. The second target word frequency vector can be (0.05×lg(1 / 3), 0.2×lg(1 / 3), 0.3×lg(1 / 3)).

[0071] In this embodiment, the principle of determining the target frequency vector based on the first number of transactions in the target transaction information, the second number of counterparty accounts, and the number of times each counterparty account appears in the target transaction information is similar to the principle of determining Term Frequency - Inverse Document Frequency (TF-IDF). By determining the term frequency of each counterparty account based on the ratio of the number of occurrences to the first number, the importance of the counterparty account to the second target payment account can be determined. By determining the information content corresponding to the second target payment account based on the logarithm of the second number, the uniqueness of the second target payment account can be measured, i.e., whether the second target payment account is a public account. Thus, by determining the target frequency vector corresponding to the second target payment account based on the product of multiple term frequencies and information contents, the importance of each counterparty account to the second target payment account is multiplied by a weight determined based on the uniqueness of the second target payment account, which can automatically identify and reduce the interference of public accounts (such as large exchanges and payment platforms).

[0072] Thus, by determining the second similarity between the first payment account and each second payment account based on the cosine similarity between the first frequency vector and each second frequency vector, the accuracy of the second similarity can be improved.

[0073] In some embodiments, in S140, an active merchant's or exchange's hot wallet address may have tens of thousands of transactions per day. Most of these transactions are normal, routine business transactions (such as user deposits and withdrawals). If these transactions were matched with each transaction of an ordinary personal bank card with equal weight, the few key transaction signals from that bank card would be drowned out by a massive amount of irrelevant transaction noise. Furthermore, deliberately generating a large number of small, high-frequency transactions to pollute data signatures is a common counter-surveillance tactic.

[0074] Therefore, in order to reduce the influence of high-frequency accounts in similarity calculation and thus improve the accuracy and robustness of similarity calculation, a first adjustment weight negatively correlated with the transaction frequency can be determined based on the transaction frequency corresponding to the first payment account, a second adjustment weight negatively correlated with the transaction frequency corresponding to each second payment account can be determined based on the transaction frequency corresponding to each second payment account, and similarity adjustment can be performed based on the first adjustment weight and the second adjustment weight.

[0075] Therefore, in order to reduce the influence of high-frequency accounts in similarity calculation and thus improve the accuracy and robustness of similarity calculation, in some embodiments, for any target adjustment weight among the first adjustment weight and the second adjustment weight, a target adjustment weight is determined, which may specifically include: Obtain the transaction frequency corresponding to multiple fourth payment accounts. The multiple fourth payment accounts include the first target payment account. The multiple fourth payment accounts have the same account type as the first target payment account. The first target payment account is the payment account that corresponds to the target adjustment weight among the first payment account and the second payment account. Determine the target transaction frequency with the highest value among the transaction frequencies corresponding to multiple fourth payment accounts; Based on the transaction frequency of the first target payment account and the target transaction frequency, the normalized logarithmic frequency is determined; Based on the normalized logarithmic frequency, a target adjustment weight that is negatively correlated with the normalized logarithmic frequency is determined.

[0076] Here, if the target adjustment weight is the first adjustment weight, then the first target payment account is the first payment account. If the target adjustment weight is the second adjustment weight, then the first target payment account is the second payment account. Additionally, if the first target payment account is a blockchain wallet address, then multiple fourth payment accounts are blockchain wallet addresses. If the first target payment account is a bank card number, then multiple fourth payment accounts are bank card numbers.

[0077] As an example, if the first target payment account is a blockchain wallet address, the blockchain explorer can collect the transaction frequency of multiple blockchain wallet addresses within a preset time period (such as 30 days or 60 days), and determine the transaction frequency of each blockchain wallet address based on the ratio of the transaction frequency to the preset time period.

[0078] If the transaction frequency of the first target payment account is denoted as... The target trading frequency is denoted as The target adjustment weight can then be determined using the following formula (6). : (6) In formula (6), This represents the normalized logarithmic frequency.

[0079] This application embodiment reduces the influence of high-frequency accounts in similarity calculation by assigning lower target adjustment weights to higher-frequency transactions, thereby improving the accuracy and robustness of similarity calculation.

[0080] In some embodiments, in S150, if the first payment account is a blockchain wallet address and the second payment account is a bank card number, then the first adjustment weight can be denoted as... The second adjustment weight can be denoted as If the first similarity is denoted as... Let the second similarity be denoted as The third similarity can be determined by the following formula (7). : (7) In formula (7), For example, it could be 0.8. =0.8 can be a better parameter obtained by grid search.

[0081] In some embodiments, in S160, the first similarity threshold can be, for example, 70%. Over 70% of the first and second payment accounts can be withdrawn. The second payment account corresponding to the maximum value is used as the output result to obtain the abnormal account that matches the first payment account.

[0082] for Between 30% and 70% of the first and second payment accounts, it is possible to comprehensively determine whether the second payment account is an abnormal account that matches the first payment account through manual review or external tags.

[0083] for If the first and second payment accounts account for less than 30% of the total, no results will be output, meaning there are no abnormal accounts that match the first payment account.

[0084] Therefore, in order to improve the accuracy of abnormal account identification, in some embodiments, after S150 above, the abnormal account identification method may further include: Among multiple third similarities, a fourth similarity is determined that is no greater than the first similarity threshold and greater than the second similarity threshold; Obtain the account tag of the second payment account corresponding to the fourth similarity; If the account label indicates that the second payment account has transaction risks, the second payment account will be identified as an abnormal account that matches the first payment account.

[0085] Here, the first similarity threshold could be, for example, 70%, and the second similarity threshold could be, for example, 30%. Between 30% and 70% of the first and second payment accounts, account tags can be obtained for the second payment accounts. If the account tag indicates that the second payment account poses a transaction risk, then the second payment account can be identified as an abnormal account matching the first payment account. Since the account tags of 30% to 70% of the second payment accounts indicate that there is no transaction risk, no matching result can be reported. In this case, manual review can be carried out, and the identification result of abnormal accounts can be determined based on the results of manual review.

[0086] In this embodiment of the application, the accuracy of abnormal account identification can be improved by combining the fourth similarity between the second similarity threshold and the first similarity threshold with account tags for abnormal account identification.

[0087] To better describe the overall solution, some specific examples are given based on the above embodiments.

[0088] For example, such as Figure 2 As shown, if the first payment account is a blockchain wallet address and the second payment account is a bank card number, then the abnormal account identification method provided in one embodiment of this application may include the following steps: S21. Enter the specified blockchain wallet address; S22. Query recent transactions of a specified blockchain wallet address to obtain the first transaction information; S23. Extract recent bank card transfer transactions to obtain the second transaction information corresponding to multiple bank cards; S24. Perform data cleaning on the first transaction information and multiple second transaction information; S25. Construct a first transaction sequence based on the transaction time and transaction amount in the first transaction information, and construct a second transaction sequence based on the transaction time and transaction amount in the second transaction information; S26. Construct the DTW matrix based on the first and second transaction sequences; S27. Determine the first similarity based on the DTW matrix; S28. Based on the transaction frequency between the counterparty account and the designated blockchain wallet address in the first transaction information, determine the first frequency vector, and based on the transaction frequency between the counterparty account and the bank card in the second transaction information, determine the second frequency vector. S29. Determine the second similarity based on the cosine similarity between the first frequency vector and the second frequency vector; S210. Based on the transaction frequency corresponding to the specified blockchain wallet address, determine a first adjustment weight that is negatively correlated with the transaction frequency, and based on the transaction frequency corresponding to the bank card, determine a second adjustment weight that is negatively correlated with the transaction frequency. S211. Based on the first adjustment weight, the second adjustment weight, the first similarity, and the second similarity, determine the third similarity; S212. Determine the relationship between the third similarity and the similarity threshold; if the third similarity is less than 30%, proceed to S213; if the third similarity is greater than 70%, proceed to S214; if the third similarity is between 30% and 70%, proceed to S215. S213, No matching results reported; S214. Output the bank card with the highest similarity in the third category; S215. Prioritize outputting bank cards that match the risk label, and then output bank cards after manual review.

[0089] In summary, this application integrates the functions of blockchain coin mixing transaction identification and two-way mutual verification between blockchain and bank card transactions. Starting from on-chain transactions, it can restore the real wallet address and transaction information before coin mixing, allowing users to easily query the bank card transactions that best match their transaction behavior by entering the wallet address and time range, and vice versa.

[0090] Based on the abnormal account identification method provided in the above embodiments, this application also provides specific implementation methods of the abnormal account identification device. Please refer to the following embodiments.

[0091] like Figure 3 As shown, an embodiment of this application provides an abnormal account identification device 300, which includes the following modules: The acquisition module 310 is used to acquire the first transaction information of the first payment account within the target time period and the second transaction information of multiple second payment accounts within the target time period. The first transaction information corresponds to the first transaction type, and the second transaction information corresponds to the second transaction type. One of the first transaction type and the second transaction type is a blockchain transaction, and the other is a traditional electronic payment transaction. Both the first transaction information and the second transaction information include the transaction time, the transaction amount, and the counterparty account. The determination module 320 is used to determine the first similarity between the first payment account and each second payment account based on the transaction amount and transaction time in the first transaction information and the transaction amount and transaction time in each second transaction information. The determining module 320 is further configured to determine a second similarity between the first payment account and each second payment account based on the transaction frequency between the counterparty account and the first payment account in the first transaction information, and the transaction frequency between the counterparty account and the second payment account in each second transaction information. The determining module 320 is also used to determine a first adjustment weight that is negatively correlated with the transaction frequency based on the transaction frequency corresponding to the first payment account, and to determine a second adjustment weight that is negatively correlated with the transaction frequency corresponding to each second payment account based on the transaction frequency corresponding to each second payment account. The determination module 320 is also used to determine a third similarity for each second payment account based on a first adjustment weight, a second adjustment weight, a first similarity, and a second similarity. The identification module 330 is used to identify the second payment account corresponding to the target similarity as an abnormal account that matches the first payment account when the target similarity with the largest value among multiple third similarities is greater than the first similarity threshold.

[0092] The identification device 300 for the aforementioned abnormal account is described in detail below: In some embodiments, the abnormal account identification device 300 may further include: The determining module 320 is also used to determine a fourth similarity among multiple third similarities that is not greater than a first similarity threshold and is greater than a second similarity threshold; The acquisition module 310 is also used to acquire the account tag of the second payment account corresponding to the fourth similarity; The identification module 330 is also used to identify the second payment account as an abnormal account that matches the first payment account when the account tag indicates that the second payment account has transaction risks.

[0093] In some embodiments, the first transaction information includes transaction information corresponding to multiple transactions, and the transaction information also includes transaction type. Based on this, the acquisition module 310 may specifically include: The acquisition submodule is used to acquire the first transaction information of the first payment account within the target time period and the second transaction information of each of the multiple third payment accounts within the target time period. The selection submodule is used to randomly select at least one first transaction from multiple transactions; An extension submodule is used to extend the transaction time of each first transaction to obtain at least one transaction time range; The determination submodule is used to determine the size of a first transaction based on the transaction type and transaction amount of at least one first transaction, and to determine the size of a second transaction based on the transaction type and transaction amount of at least one second transaction, when there is a second transaction in the third payment account within each transaction time range. The determination submodule is also used to determine the third payment account as the second payment account when the first transaction size matches the second transaction size.

[0094] In some embodiments, the determining module 320 may specifically include: The acquisition submodule is also used to acquire the transaction frequency corresponding to multiple fourth payment accounts. The multiple fourth payment accounts include the first target payment account. The multiple fourth payment accounts have the same account type as the first target payment account. The first target payment account is the payment account that corresponds to the target adjustment weight among the first payment account and the second payment account. The determination submodule is also used to determine the target transaction frequency with the largest value among the transaction frequencies corresponding to multiple fourth payment accounts; The determination submodule is also used to determine the normalized logarithm frequency based on the transaction frequency of the first target payment account and the target transaction frequency; The determination submodule is also used to determine the target adjustment weights that are negatively correlated with the normalized logarithmic frequency, based on the normalized logarithmic frequency.

[0095] In some embodiments, the determining module 320 may specifically include: The execution submodule performs the following operations for each second payment account: Based on the transaction amount and transaction time in the first transaction information, and the transaction amount and transaction time in the second transaction information, a dynamic time warping matrix is ​​constructed; Determine the cumulative minimum distance corresponding to the optimal alignment path in the dynamic time warp matrix; Based on the transaction amount and transaction time in the first transaction information, and the transaction amount and transaction time in the second transaction information, the normalization factor is determined; The normalized difference is determined based on the ratio of the cumulative minimum distance to the normalization factor; Based on the normalized difference, the first similarity is determined to be negatively correlated with the normalized difference.

[0096] In some embodiments, the execution submodule is specifically used for: Based on the transaction amount and transaction time in the first transaction information, an initial first transaction sequence is constructed, and based on the transaction amount and transaction time in the second transaction information, an initial second transaction sequence is constructed. The transaction amounts and transaction times in the initial first transaction sequence and the initial second transaction sequence are normalized respectively to obtain the first transaction sequence and the second transaction sequence. A dynamic time warping matrix is ​​constructed based on the first and second transaction sequences.

[0097] In some embodiments, the second transaction sequence includes multiple feature points. Based on this, the execution submodule is specifically used for: Obtain the target's cumulative minimum distance, which is the smallest among multiple existing cumulative minimum distances. Construct the envelope region based on the first transaction sequence; Feature points located outside the envelope region are identified as target feature points; Based on at least one target feature point, determine the lower bound value of the envelope corresponding to the second transaction sequence; When the lower bound of the envelope is less than or equal to the target cumulative minimum distance, a dynamic time warping matrix is ​​constructed based on the first transaction sequence and the second transaction sequence.

[0098] In some embodiments, the determining module 320 may specifically include: The determination submodule is also used to determine the first frequency vector corresponding to the first payment account based on the transaction frequency between the counterparty account and the first payment account in the first transaction information; The determination submodule is also used to determine the second frequency vector corresponding to each second payment account based on the transaction frequency between the counterparty account and the second payment account in each second transaction information; The determination submodule is also used to determine the second similarity between the first payment account and each second payment account based on the cosine similarity between the first frequency vector and each second frequency vector.

[0099] In some embodiments, determining a submodule may specifically include: The acquisition unit is used to acquire the first number of transactions, the second number of counterparty accounts, and the number of times each counterparty account appears in the target transaction information. The target transaction information is the transaction information in the first and second transaction information that corresponds to the target frequency vector. A determination unit is used to determine the word frequency of each counterparty account based on the ratio of the number of occurrences to a first quantity; The determining unit is also used to determine the amount of information corresponding to the second target payment account based on the logarithmic reciprocal of the second quantity, wherein the second target payment account is the payment account that corresponds to the target transaction information among the first payment account and the second payment account. The determining unit is also used to determine the target frequency vector corresponding to the second target payment account based on the product of multiple word frequencies and information content respectively.

[0100] In some embodiments, the abnormal account identification device 300 may further include: The alignment module is used to time-align the transaction times in the first transaction information and the second transaction information before determining the first similarity between the first payment account and each second payment account based on the transaction amount and transaction time in the first transaction information and the transaction amount and transaction time in each second transaction information. The conversion module is used to convert the transaction amounts in the first and second transaction information to a unified settlement unit corresponding to the transaction amounts; The elimination module is used to eliminate transactions in the first and second transaction information whose transaction amounts are less than a threshold amount.

[0101] This application embodiment determines the first similarity between a first payment account and each second payment account based on the transaction amount and time in the first transaction information, and the transaction amount and time in each second transaction information. This allows for the identification of whether accounts have mutual transfer relationships at the transaction behavior level from the perspective of monetary equivalence and temporal proximity. Furthermore, the transaction frequency between the counterparty account and the payment account can characterize the structural role played by the payment account in the transaction network. Therefore, by determining the second similarity between the first payment account and each second payment account based on the transaction frequency between the counterparty account and the first payment account in the first transaction information, and the transaction frequency between the counterparty account and the second payment account in each second transaction information, it is possible to identify whether two payment accounts have similarities at the structural role level from the perspective of the structural roles played by the first and second payment accounts in their respective transaction networks. This, in turn, identifies potentially related accounts controlled by the same entity or used for the same purpose. Furthermore, by determining a first adjustment weight negatively correlated with transaction frequency based on the transaction frequency corresponding to the first payment account, and a second adjustment weight negatively correlated with transaction frequency for each second payment account based on the transaction frequency corresponding to each second payment account, and by jointly determining a third similarity for each second payment account based on the first adjustment weight, the second adjustment weight, the first similarity, and the second similarity, the influence of high-frequency accounts in similarity calculation can be automatically reduced. Thus, when the target similarity with the largest value among multiple third similarities exceeds the first similarity threshold, the second payment account corresponding to the target similarity is identified as an abnormal account matching the first payment account. This not only achieves a two-way mapping between blockchain wallet addresses and real-world payment accounts but also improves the accuracy and robustness of abnormal account identification, thereby providing reliable technical support for preventing transaction risks.

[0102] Based on the abnormal account identification method provided in the above embodiments, this application also provides specific implementation methods for electronic devices. Figure 4 A schematic diagram of the structure of an electronic device provided in one embodiment of this application is shown.

[0103] like Figure 4 As shown, the electronic device 400 may include a processor 410 and a memory 420 storing computer program instructions.

[0104] Specifically, the processor 410 may include a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0105] Memory 420 may include mass storage for data or instructions. For example, and not limitingly, memory 420 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where suitable, memory 420 may include removable or non-removable (or fixed) media. Where suitable, memory 420 may be internal or external to electronic device 400. In a particular embodiment, memory 420 is a non-volatile solid-state memory.

[0106] In a specific embodiment, the memory 420 may be implemented as a read-only memory (ROM), random access memory (RAM), static storage device, dynamic storage device, etc. The memory 420 may store the operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 420 and executed by the processor 410. The processor 410 implements any of the abnormal account identification methods in the above embodiments by reading and executing the computer program instructions stored in the memory 420.

[0107] The processor 410 reads and executes computer program instructions stored in the memory 420 to implement any of the abnormal account identification methods in the above embodiments.

[0108] In one example, the electronic device 400 may also include a communication interface 430 and a bus 440. For example, Figure 4 As shown, the processor 410, memory 420, and communication interface 430 are connected via bus 440 and communicate with each other.

[0109] The communication interface 430 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0110] Bus 440 includes hardware, software, or both, that couples components of an electronic device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-E) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses, or a combination of two or more of these. Where appropriate, bus 440 may include one or more buses. Although specific buses are described and illustrated in the embodiments of this application, this application considers any suitable bus or interconnection.

[0111] For example, the electronic device 400 can be a mobile phone, tablet computer, laptop computer, handheld computer, in-vehicle electronic device, ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), etc.

[0112] The electronic device can execute the abnormal account identification method in the embodiments of this application, thereby achieving a combination of Figures 1 to 2 The method for identifying abnormal accounts described herein, and the beneficial effects of the corresponding method embodiments, will not be elaborated further here.

[0113] Furthermore, in conjunction with the abnormal account identification methods in the above embodiments, this application embodiment can provide a computer-readable storage medium for implementation. This computer-readable storage medium stores computer program instructions; when executed by a processor, these computer program instructions implement any of the abnormal account identification methods in the above embodiments. Examples of such computer-readable storage media include non-transitory computer-readable storage media, such as read-only memory (ROM).

[0114] The computer program instructions stored in the storage medium of the above embodiments are used to cause the computer to execute the abnormal account identification method as shown in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0115] Based on the abnormal account identification methods in the above embodiments, this application embodiment can provide a computer program product for implementation. When the instructions in this computer program product are executed by the processor of an electronic device, they implement any of the abnormal account identification methods in the above embodiments.

[0116] The computer program products of the above embodiments are used to implement the abnormal account identification method as shown in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0117] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0118] The functional blocks shown in the above-described block diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0119] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0120] The aspects of this application have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by dedicated hardware performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0121] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A method for identifying abnormal accounts, characterized in that, include: Obtain first transaction information of a first payment account within a target time period and second transaction information of multiple second payment accounts within the target time period respectively. The first transaction information corresponds to a first transaction type, and the second transaction information corresponds to a second transaction type. One of the first transaction type and the second transaction type is a blockchain transaction, and the other is a traditional electronic payment transaction. Both the first transaction information and the second transaction information include transaction time, transaction amount, and counterparty account. Based on the transaction amount and transaction time in the first transaction information, and the transaction amount and transaction time in each of the second transaction information, a first similarity between the first payment account and each of the second payment accounts is determined; Based on the transaction frequency between the counterparty account and the first payment account in the first transaction information, and the transaction frequency between the counterparty account and the second payment account in each of the second transaction information, a second similarity between the first payment account and each of the second payment accounts is determined; Based on the transaction frequency corresponding to the first payment account, a first adjustment weight negatively correlated with the transaction frequency is determined, and based on the transaction frequency corresponding to each second payment account, a second adjustment weight negatively correlated with the transaction frequency is determined for each second payment account. For each second payment account, a third similarity is determined based on the first adjustment weight, the second adjustment weight, the first similarity, and the second similarity; If the target similarity with the largest value among the multiple third similarities is greater than the first similarity threshold, the second payment account corresponding to the target similarity is identified as an abnormal account that matches the first payment account.

2. The method according to claim 1, characterized in that, After determining a third similarity for each second payment account based on the first adjustment weight, the second adjustment weight, the first similarity, and the second similarity, the method further includes: Among the plurality of said third similarities, a fourth similarity is determined that is not greater than the first similarity threshold and is greater than the second similarity threshold; Obtain the account tag of the second payment account corresponding to the fourth similarity; If the account label indicates that the second payment account has transaction risks, the second payment account will be identified as an abnormal account that matches the first payment account.

3. The method according to claim 1, characterized in that, The first transaction information includes transaction information corresponding to multiple transactions, and the transaction information also includes transaction type; obtaining the first transaction information of the first payment account within the target time period and the second transaction information corresponding to each of the multiple second payment accounts within the target time period includes: Obtain the first transaction information of the first payment account within the target time period and the second transaction information of each of the multiple third payment accounts within the target time period; Randomly select at least one first transaction from the plurality of transactions; The transaction time of each of the first transactions is extended to obtain at least one transaction time range; If the third payment account has a second transaction in each of the transaction time ranges, the first transaction size is determined based on the transaction type and transaction amount of the at least one first transaction, and the second transaction size is determined based on the transaction type and transaction amount of the at least one second transaction; If the first transaction size matches the second transaction size, the third payment account will be designated as the second payment account.

4. The method according to claim 1, characterized in that, For any target adjustment weight among the first adjustment weight and the second adjustment weight, determining the target adjustment weight includes: Obtain the transaction frequency corresponding to multiple fourth payment accounts, wherein the multiple fourth payment accounts include a first target payment account, and the multiple fourth payment accounts have the same account type as the first target payment account. The first target payment account is the payment account that corresponds to the target adjustment weight among the first payment account and the second payment account. Among the transaction frequencies corresponding to the plurality of fourth payment accounts, determine the target transaction frequency with the largest value; Based on the transaction frequency of the first target payment account and the target transaction frequency, the normalized logarithmic frequency is determined; Based on the normalized logarithmic frequency, a target adjustment weight that is negatively correlated with the normalized logarithmic frequency is determined.

5. The method according to claim 1, characterized in that, The step of determining the first similarity between the first payment account and each of the second payment accounts based on the transaction amount and transaction time in the first transaction information, and the transaction amount and transaction time in each of the second transaction information, includes: For each second payment account, perform the following operations: Based on the transaction amount and transaction time in the first transaction information, and the transaction amount and transaction time in the second transaction information, a dynamic time warping matrix is ​​constructed; Determine the cumulative minimum distance corresponding to the optimal alignment path in the dynamic time warp matrix; Based on the transaction amount and transaction time in the first transaction information, and the transaction amount and transaction time in the second transaction information, a normalization factor is determined; The normalized difference is determined based on the ratio of the cumulative minimum distance to the normalization factor; Based on the normalized difference, a first similarity that is negatively correlated with the normalized difference is determined.

6. The method according to claim 5, characterized in that, The step of constructing a dynamic time warping matrix based on the transaction amount and transaction time in the first transaction information and the transaction amount and transaction time in the second transaction information includes: Based on the transaction amount and transaction time in the first transaction information, an initial first transaction sequence is constructed, and based on the transaction amount and transaction time in the second transaction information, an initial second transaction sequence is constructed. The transaction amounts and transaction times in the initial first transaction sequence and the initial second transaction sequence are normalized respectively to obtain the first transaction sequence and the second transaction sequence. Based on the first transaction sequence and the second transaction sequence, the dynamic time warping matrix is ​​constructed.

7. The method according to claim 6, characterized in that, The second transaction sequence includes multiple feature points. The construction of the dynamic time warping matrix based on the first and second transaction sequences includes: Obtain the target's cumulative minimum distance, which is the smallest of multiple existing cumulative minimum distances; Based on the first transaction sequence, construct the envelope region; Feature points located outside the envelope region are identified as target feature points; Based on at least one of the target feature points, determine the lower bound value of the envelope corresponding to the second transaction sequence; When the lower bound of the envelope is less than or equal to the target cumulative minimum distance, the dynamic time warping matrix is ​​constructed based on the first transaction sequence and the second transaction sequence.

8. The method according to claim 1, characterized in that, The step of determining the second similarity between the first payment account and each of the second payment accounts based on the transaction frequency between the counterparty account and the first payment account in the first transaction information, and the transaction frequency between the counterparty account and the second payment account in each of the second transaction information, includes: Based on the transaction frequency between the counterparty account and the first payment account in the first transaction information, a first frequency vector corresponding to the first payment account is determined. Based on the transaction frequency between the counterparty account and the second payment account in each of the second transaction information, a second frequency vector is determined for each of the second payment accounts; Based on the cosine similarity between the first frequency vector and each of the second frequency vectors, a second similarity between the first payment account and each of the second payment accounts is determined.

9. The method according to claim 8, characterized in that, For any target frequency vector among the first frequency vector and the second frequency vector, determining the target frequency vector includes: Obtain the first number of transactions, the second number of counterparty accounts, and the number of times each counterparty account appears in the target transaction information, wherein the target transaction information is the transaction information in the first transaction information and the second transaction information that corresponds to the target frequency vector; For each of the counterparty accounts, the word frequency of the counterparty account is determined based on the ratio of the number of times to the first quantity; Based on the logarithmic reciprocal of the second quantity, the amount of information corresponding to the second target payment account is determined. The second target payment account is the payment account that corresponds to the target transaction information in the first payment account and the second payment account. The target frequency vector corresponding to the second target payment account is determined based on the product of multiple word frequencies and the information content.

10. The method according to any one of claims 1-9, characterized in that, Before determining the first similarity between the first payment account and each of the second payment accounts based on the transaction amount and transaction time in the first transaction information, and the transaction amount and transaction time in each of the second transaction information, the method further includes: Time alignment is performed on the transaction times in the first transaction information and the second transaction information; The transaction amounts in the first transaction information and the second transaction information are converted using exchange rates to unify the settlement unit corresponding to the transaction amounts; Transactions in the first and second transaction information that have a transaction amount less than the amount threshold are excluded.

11. A device for identifying abnormal accounts, characterized in that, The device includes: The acquisition module is used to acquire the first transaction information of the first payment account within the target time period and the second transaction information of multiple second payment accounts within the target time period respectively. The first transaction information corresponds to the first transaction type, and the second transaction information corresponds to the second transaction type. One of the first transaction type and the second transaction type is a blockchain transaction, and the other is a traditional electronic payment transaction. Both the first transaction information and the second transaction information include the transaction time, transaction amount, and counterparty account. The determination module is used to determine a first similarity between the first payment account and each of the second payment accounts based on the transaction amount and transaction time in the first transaction information and the transaction amount and transaction time in each of the second transaction information. The determining module is further configured to determine a second similarity between the first payment account and each second payment account based on the transaction frequency between the counterparty account and the first payment account in the first transaction information, and the transaction frequency between the counterparty account and the second payment account in each second transaction information. The determining module is further configured to determine a first adjustment weight negatively correlated with the transaction frequency based on the transaction frequency corresponding to the first payment account, and to determine a second adjustment weight negatively correlated with the transaction frequency corresponding to each second payment account based on the transaction frequency corresponding to each second payment account; The determining module is further configured to, for each of the second payment accounts, determine a third similarity based on the first adjustment weight, the second adjustment weight, the first similarity, and the second similarity; The identification module is used to identify the second payment account corresponding to the target similarity as an abnormal account that matches the first payment account when the target similarity with the largest value among multiple third similarities is greater than the first similarity threshold.

12. An electronic device, characterized in that, The electronic device includes: a processor and a memory storing computer program instructions; When the processor executes the computer program instructions, it implements the abnormal account identification method as described in any one of claims 1-10.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions, which, when executed by a processor, implement the abnormal account identification method as described in any one of claims 1-10.

14. A computer program product, characterized in that, When the instructions in the computer program product are executed by the processor of the electronic device, the electronic device causes the electronic device to perform the abnormal account identification method as described in any one of claims 1-10.

Images