Risk detection method and device for transaction account and electronic equipment

Abstract

The invention discloses a risk detection method and device for a transaction account and electronic equipment, and relates to the field of financial science and technology or other related technical fields, and the method comprises the steps: carrying out the clustering operation of L transaction accounts based on a target feature corresponding to each transaction account in the L transaction accounts, and obtaining K account sets; determining a first score, a second score and a third score of each account set based on transaction data of all transaction accounts included in each account set; and determining a risk detection result of the transaction account in each account set based on the first score, the second score and the third score of each account set. The technical problem of low accuracy of risk detection of the transaction account participating in the financial transaction in the prior art is solved.

Description

Technical Field

[0001] This application relates to the field of financial technology or other related technical fields, and more specifically, to a risk detection method, device, and electronic device for trading accounts. Background Technology

[0002] In today's financial trading environment, with the rapid expansion of trading volume and the increasing complexity of trading methods, identifying accounts involved in abnormal trading activities has become a major challenge for financial institutions. Current technologies generally have low accuracy in risk detection of trading accounts involved in financial transactions, mainly due to the following two aspects:

[0003] (1) Limited ability to identify complex behavioral patterns: Traditional risk detection models are often based on preset threshold rules or simple statistical anomaly detection methods. These methods only focus on limited dimensions such as the size of the transaction amount and the frequency of transactions, while ignoring the complexity and multi-dimensional characteristics of transaction behavior. In practice, many risky trading groups may have transaction patterns that are very similar to typical business behavior in order to evade detection. It is difficult to distinguish them from normal trading activities from a single or few dimensions, resulting in poor effectiveness of detection methods against deliberate imitation behaviors that are "normal in form but abnormal in substance".

[0004] (2) Lack of operational-level collaborative analysis: Existing technologies for detecting risky transactions typically focus on analyzing the behavior of individual accounts, failing to adequately consider the operational-level collaboration between accounts. For example, non-financial information such as account login IP, devices used, and transaction locations is crucial for identifying dispersed but organized risky trading groups with highly coordinated operations. Ignoring these traces of collaborative activity makes it impossible to detect subtle signals that appear normal in their trading behavior but exhibit abnormally concentrated or regular patterns at the operational level.

[0005] The aforementioned technical bottlenecks severely limit the effectiveness of existing risk warning systems, not only increasing the false alarm rate but also reducing the detection rate of truly high-risk trading groups, putting enormous pressure on financial institutions' risk management and compliance costs.

[0006] There is currently no effective solution to the above problems. Summary of the Invention

[0007] This application provides a risk detection method, apparatus, and electronic device for trading accounts, to at least solve the technical problem of low accuracy in risk detection of trading accounts participating in financial transactions in the prior art.

[0008] According to one aspect of this application, a risk detection method for trading accounts is provided, comprising: clustering the L trading accounts based on target features corresponding to each of the L trading accounts to obtain K account sets, where L and K are both positive integers, the target features are used to characterize the trading behavior pattern of each trading account, and the similarity between the target features corresponding to any two trading accounts included in the same account set is less than or equal to a preset similarity; determining a first score, a second score, and a third score for each account set based on the trading data of all trading accounts included in each account set, wherein the first score is used to characterize the ratio of the number of synchronous trading pairs to the number of trading pairs involved in the account set, the second score is used to characterize the similarity between the trading IPs / trading devices corresponding to the trading accounts in the account set, and the third score is used to characterize the similarity between the trading area identifiers corresponding to the trading accounts in the account set; and determining the risk detection result of the trading accounts in each account set based on the first score, the second score, and the third score of each account set.

[0009] Optionally, before clustering the L trading accounts, the risk detection method for the trading accounts further includes: after receiving the authorization information from the user of each trading account, collecting the original trading data of each trading account within a preset historical time period; cleaning the original trading data of each trading account to obtain the target trading data of each trading account, wherein the data cleaning is used to remove noise data in the original trading data; extracting features from the target trading data of each trading account to obtain N trading features corresponding to each trading account, wherein N is a positive integer; and determining the target features corresponding to each trading account based on the N trading features corresponding to each trading account.

[0010] Optionally, the N transaction characteristics are at least one of the following transaction characteristics:

[0011] The first transaction feature is the entropy value used to characterize the transaction amount of all historical transactions involved in a transaction account;

[0012] The second transaction feature is used to characterize the standard deviation of the transaction times of all historical transactions involved in a trading account;

[0013] The third transaction feature is used to characterize the distribution information of counterparties in all historical transactions involving a transaction account;

[0014] The fourth transaction feature is used to characterize the ratio of the number of all first historical transactions involved in a transaction account to the number of all historical transactions, wherein the first historical transactions are historical transactions that occurred within a preset period at the time of the transaction;

[0015] The fifth transaction feature is used to characterize the distribution information of transaction frequency corresponding to the transaction account;

[0016] The sixth transaction feature is used to characterize the ratio of incoming to outgoing amounts for a transaction account;

[0017] The seventh transaction feature is used to characterize the difference between the average transaction amount of all historical transactions involved in the transaction account and a preset standard value.

[0018] Optionally, based on the N transaction features corresponding to each transaction account, the target feature corresponding to each transaction account is determined, including: performing a linear space transformation operation on the N transaction features to obtain the transformation result corresponding to the N transaction features, wherein the linear space transformation operation is used to reduce the dimensionality of the N transaction features; and encoding the transformation result corresponding to the N transaction features to obtain the target feature corresponding to each transaction account.

[0019] Optionally, based on the trading data of all trading accounts included in each account set, a first score for each account set is determined, including: based on the trading data of all trading accounts included in each account set, determining all synchronous trading pairs involved in each account set and all trading pairs; and using the ratio of the number of all synchronous trading pairs involved in each account set to the number of all trading pairs as the first score for each account set.

[0020] Optionally, based on the transaction data of all trading accounts included in each account set, determine all synchronous trading pairs and all trading pairs involved in each account set, including: determining all transactions involved in the i-th account set based on the transaction data of all trading accounts included in the i-th account set; if the counterparty corresponding to the x-th historical transaction and the y-th historical transaction in all transactions is the same, treat the x-th historical transaction and the y-th historical transaction as a trading pair, wherein the initiator of the transactions corresponding to the x-th historical transaction and the y-th historical transaction is a trading account in the i-th account set; if the counterparty corresponding to the x-th historical transaction and the y-th historical transaction is the same, and the time difference between the transaction times corresponding to the x-th historical transaction and the y-th historical transaction is less than a preset time difference, treat the x-th historical transaction and the y-th historical transaction as a synchronous trading pair.

[0021] Optionally, based on the first score, second score, and third score of each account set, the risk detection result of the trading accounts in each account set is determined, including: weighted summing of the first score, second score, and third score of each account set to obtain the target score of each account set; if the target score of the j-th account set is greater than the preset score, all trading accounts included in the j-th account set are identified as risky trading accounts; and warning information is generated based on the trading data of the risky trading accounts.

[0022] According to another aspect of this application, a risk detection device for trading accounts is also provided, comprising: a clustering operation unit, configured to perform clustering operations on the L trading accounts based on target features corresponding to each trading account in the L trading accounts, to obtain K account sets, wherein L and K are both positive integers, the target features are used to characterize the trading behavior pattern of each trading account, and the similarity between the target features corresponding to any two trading accounts included in the same account set is less than or equal to a preset similarity; a scoring determination unit, configured to determine a first score, a second score, and a third score for each account set based on the trading data of all trading accounts included in each account set, wherein the first score is used to characterize the ratio of the number of synchronous trading pairs to the number of trading pairs involved in the account set, the second score is used to characterize the similarity between the trading IPs / trading devices corresponding to the trading accounts in the account set, and the third score is used to characterize the similarity between the trading area identifiers corresponding to the trading accounts in the account set; and a risk detection unit, configured to determine the risk detection result of the trading accounts in each account set based on the first score, the second score, and the third score of each account set.

[0023] According to another aspect of this application, a computer program product is also provided, which stores a computer program, wherein a risk detection method for a trading account is controlled to execute any of the above-mentioned methods when the computer program is running.

[0024] According to another aspect of this application, an electronic device is also provided, wherein the electronic device includes one or more processors and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to implement the risk detection method for trading accounts described above.

[0025] In this application, firstly, based on the target features corresponding to each of the L trading accounts, clustering is performed on the L trading accounts to obtain K account sets, where L and K are both positive integers. The target features are used to characterize the trading behavior pattern of each trading account, and the similarity between the target features corresponding to any two trading accounts included in the same account set is less than or equal to a preset similarity. Then, based on the trading data of all trading accounts included in each account set, this application determines a first score, a second score, and a third score for each account set. The first score is used to characterize the ratio of the number of synchronous trading pairs to the number of trading pairs involved in the account set, the second score is used to characterize the similarity between the trading IPs / trading devices corresponding to the trading accounts in the account set, and the third score is used to characterize the similarity between the trading area identifiers corresponding to the trading accounts in the account set. Finally, based on the first score, the second score, and the third score for each account set, this application determines the risk detection result of the trading accounts in each account set.

[0026] As described above, this application employs a multi-level intelligent analysis approach. By performing deep behavioral pattern recognition on trading accounts, it obtains the target features corresponding to the trading accounts. Subsequently, trading accounts with similar target features are grouped into the same account set. Then, based on the target features, the operational coordination of trading accounts in each account set is tested from three dimensions: transaction synchronization, concentration of transaction IP / transaction device, and clustering of transaction area. This achieves the goal of accurately distinguishing between normal trading accounts and risky trading accounts, thereby improving the technical effect of improving the accuracy of risk detection for trading accounts. This solves the technical problem of low accuracy in risk detection of trading accounts participating in financial transactions in existing technologies when facing complex trading patterns that are "normal in appearance but abnormal in reality" and cross-account collaborative operations. Attached Figure Description

[0027] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0028] Figure 1 This is a hardware structure block diagram of an optional computer terminal (or mobile device) for implementing a risk detection method for a transaction account, according to an embodiment of this application.

[0029] Figure 2 This is a flowchart of an optional risk detection method for a trading account according to an embodiment of this application;

[0030] Figure 3 This is a schematic diagram of an optional risk detection device for a trading account according to an embodiment of this application;

[0031] Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0032] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0033] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0034] It should also be noted that all relevant information (including but not limited to information used for display and analysis) and data (including but not limited to the original transaction data of each trading account) involved in this application are information and data authorized by the user or fully authorized by all parties. For example, this system has an interface with the relevant user or institution. Before obtaining relevant information, it needs to send an acquisition request to the aforementioned user or institution through the interface, and obtain the relevant information after receiving the consent information from the aforementioned user or institution.

[0035] Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of relevant information and data involved in this application all comply with the relevant laws, regulations, and standards of the relevant regions, and necessary confidentiality measures have been taken. This application does not violate public order and good morals. In addition, this application provides a corresponding operation entry point for users to choose to agree to or refuse authorization. If the user chooses to refuse authorization, the corresponding expert decision-making process will be initiated.

[0036] The present invention will now be described in detail with reference to various embodiments.

[0037] Example 1

[0038] According to an embodiment of this application, a risk detection method for a trading account is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0039] The methods and embodiments provided in this application can be executed on mobile terminals, computer terminals, or similar computing devices. Figure 1 This is a hardware structure block diagram of an optional computer terminal (or mobile device) for implementing a risk detection method for trading accounts, according to an embodiment of this application. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0040] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0041] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the risk detection method for trading accounts in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned risk detection method for trading accounts. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0042] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0043] The display can be configured as a touchscreen liquid crystal display (LCD) that allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0044] Under the aforementioned operating environment, this application provides a risk detection system for trading accounts (hereinafter referred to as the detection system) for executing the risk detection method for trading accounts described in this application. Figure 2 This is a flowchart of an optional risk detection method for a trading account according to an embodiment of this application, such as... Figure 2 As shown, the method includes the following steps:

[0045] Step S201: Based on the target features corresponding to each of the L trading accounts, perform clustering operations on the L trading accounts to obtain a set of K accounts, where L and K are both positive integers. The target features are used to characterize the trading behavior pattern of each trading account. The similarity between the target features corresponding to any two trading accounts included in the same account set is less than or equal to a preset similarity.

[0046] Alternatively, clustering operations may preferentially use unsupervised machine learning clustering algorithms, such as the DBSCAN algorithm.

[0047] Optionally, the detection system first determines the cosine similarity between the behavioral DNA (i.e. target features) of all trading accounts to form a similarity matrix. Then, it uses the DBSCAN density clustering algorithm to cluster the trading accounts. DBSCAN can discover "arbitrary-shaped clusters" and exclude sparse outliers. Thus, the detection system obtains a set of K accounts with "highly cloned behavioral patterns".

[0048] Optionally, the set of K accounts is represented as .

[0049] Optionally, the above steps can identify sets of accounts with similar transaction patterns through deep behavioral feature analysis. Even if the transaction behavior of the transaction accounts in the same set of accounts conforms to normal business operation patterns, this application can solve the problem of complex behavioral patterns of transaction accounts that cannot be captured by static rules or simple models in the prior art by performing cross-account collaborative operation analysis on the transaction accounts in each set of accounts obtained by clustering. This lays a solid data foundation for subsequent collaborative analysis.

[0050] Step S202: Based on the transaction data of all trading accounts included in each account set, determine a first score, a second score, and a third score for each account set. The first score is used to characterize the ratio of the number of synchronous trading pairs to the number of trading pairs involved in the account set. The second score is used to characterize the similarity between the trading IPs / trading devices corresponding to the trading accounts in the account set. The third score is used to characterize the similarity between the trading area identifiers corresponding to the trading accounts in the account set.

[0051] Optionally, after obtaining K sets of accounts with "highly cloned behavioral patterns", the detection system targets each set of accounts... For all accounts within the system, analyze all their transaction records to obtain a first score, a second score, and a third score, as follows:

[0052] (1) For any two transactions (from trading account) )and (from trading account) If they satisfy:

[0053] a) The counterparties of the two transactions are the same entity P (e.g., the same receiving account) or belong to the same category (e.g., agency accounts of the same bank).

[0054] b) Transaction time difference | - |<ΔT (ΔT is a very short time window, such as 10 seconds).

[0055] The two transactions mentioned above are then referred to as a "synchronous trading pair".

[0056] Cluster Synchronization score ( ), which is the proportion of the number of "synchronized trading pairs" generated by all accounts in the cluster to their total number of trading pairs.

[0057] (2) Determine the clustering score of transaction IP / transaction device ( This refers to the cardinality and concentration (HHI index) of account login IP addresses and device fingerprints within a cluster. For example, a cloned cluster operated by different accounts, but with highly concentrated IPs or devices, poses a potential transaction risk.

[0058] (3) Geographic clustering score ( This involves analyzing the geographic centrality of account operations (e.g., the standard deviation of latitude and longitude) through IP resolution or mobile base station location. For example, a cluster whose behavior mimics global e-commerce patterns but whose operations are highly concentrated in a specific neighborhood may pose a potential transaction risk.

[0059] Optionally, the above three scores provide a comprehensive risk assessment of the account set from three perspectives: micro (time synchronization), meso (similarity of trading devices / trading IPs), and macro (geographical clustering). In this way, the synergy of the account set at the operational level can be analyzed in depth, thereby effectively identifying risky trading groups that appear independent on the surface but are highly coordinated in actual operation, significantly improving the accuracy and comprehensiveness of the detection.

[0060] Step S203: Based on the first score, second score, and third score of each account set, determine the risk detection result of the trading accounts in each account set.

[0061] Optionally, the detection system scores the target value for each set of accounts using a weighted summation method. ( A comprehensive evaluation will be conducted.

[0062] ( )=α ( )+β ( )+γ ( );

[0063] Where α, β, γ are configurable weight parameters, if ( If the score exceeds the preset score Θ, the cluster will be ultimately identified as a risky trading group, and a warning message will be reported.

[0064] Optionally, the risk detection results, i.e. the conclusions drawn from the comprehensive analysis of the first, second and third scores, are used to determine whether each trading account in the account set is at risk of participating in abnormal trading activities.

[0065] Optionally, the comprehensive scoring method in the above steps integrates the results of multi-dimensional collaborative analysis and determines a risk level for each set of trading accounts. This method reduces the possibility of false positives and false negatives in account risk detection and improves the overall detection accuracy. In addition, since the scoring system considers various types of collaborative behavior, even if the trading patterns of risky trading groups are very complex and covert, it is difficult for them to bypass such a comprehensive evaluation system, thus achieving a more accurate risk detection method.

[0066] As described above, this application employs a multi-level intelligent analysis approach. By performing deep behavioral pattern recognition on trading accounts, it obtains the target features corresponding to the trading accounts. Subsequently, trading accounts with similar target features are grouped into the same account set. Then, based on the target features, the operational coordination of trading accounts in each account set is tested from three dimensions: transaction synchronization, concentration of transaction IP / transaction device, and clustering of transaction area. This achieves the goal of accurately distinguishing between normal trading accounts and risky trading accounts, thereby improving the technical effect of improving the accuracy of risk detection for trading accounts. This solves the technical problem of low accuracy in risk detection of trading accounts participating in financial transactions in existing technologies when facing complex trading patterns that are "normal in appearance but abnormal in reality" and cross-account collaborative operations.

[0067] In one optional embodiment, in order to obtain the target features of each transaction account, after receiving the authorization information of the user of each transaction account, the detection system first collects the original transaction data of each transaction account within a preset historical time period; then, the detection system performs data cleaning on the original transaction data of each transaction account to obtain the target transaction data of each transaction account, wherein the data cleaning is used to remove noise data in the original transaction data; then, the detection system extracts features from the target transaction data of each transaction account to obtain N transaction features corresponding to each transaction account, wherein N is a positive integer; subsequently, the detection system determines the target features corresponding to each transaction account based on the N transaction features corresponding to each transaction account.

[0068] Optionally, authorization information includes the permissions granted by the account holder for data collection, including authorization to access the account's transaction history.

[0069] Optionally, the preset historical time period can be set to the past 180 days.

[0070] Optionally, the raw transaction data, which are unprocessed transaction records extracted directly from the transaction account or financial institution database, includes at least the transaction time, transaction amount, transaction area identifier, and counterparty information for each transaction involved in the transaction account.

[0071] Optionally, the detection system first cleans the raw transaction data of each transaction account within a preset historical time period (e.g., the past 180 days). Then, it extracts multi-dimensional transaction features from the cleaned target transaction data. Finally, it encodes the extracted N transaction features into behavioral patterns to obtain the "behavioral DNA" corresponding to each transaction account, i.e., the target features. .

[0072] Optionally, the N transaction features include, but are not limited to, the first transaction feature. Second transaction characteristics Third transaction characteristics Fourth transaction characteristics Fifth Transaction Characteristics Sixth Transaction Feature and the seventh transaction feature .

[0073] Optionally, upon receiving authorization information from the user of each trading account, the detection system collects the original trading data of each trading account, ensuring the legality and accuracy of the data collection and providing a solid foundation for subsequent risk analysis. By obtaining authorization, the risk of privacy infringement on users is avoided. Furthermore, the data samples collected within the preset historical time period are large enough to reflect the long-term behavioral patterns of trading accounts, which helps to more comprehensively identify risky trading characteristics.

[0074] Optionally, the detection system performs data cleaning on the raw transaction data of each trading account to avoid interference from noisy data on the analysis results. By removing erroneous or abnormal transaction records, the detection system can more accurately extract the behavioral characteristics of trading accounts, thereby improving the accuracy and reliability of risk detection.

[0075] Optionally, the detection system extracts multi-dimensional features from the target transaction data of each trading account, thereby comprehensively extracting the behavioral patterns of the trading account. Compared with traditional methods that rely on only a single or a few transaction features, multi-dimensional feature extraction can more accurately identify subtle differences in account trading behavior. This multi-dimensional feature analysis helps to capture abnormal trading behaviors that may be overlooked in conventional analysis, improving the sensitivity and comprehensiveness of risk detection.

[0076] Optionally, the detection system can encode and compress N transaction features using a machine learning model to obtain a lower-dimensional feature representation, i.e., the target feature, thereby enabling more efficient subsequent clustering and risk assessment.

[0077] Optionally, the detection system transforms high-dimensional transaction features into target features, thereby reducing the dimensionality and condensing the patterns of multi-dimensional transaction feature data. This makes cluster analysis more efficient and enables the rapid identification of account sets with similar transaction behavior patterns. This method not only reduces the consumption of computing resources but also improves the ability to identify complex and hidden transaction patterns, enabling more accurate detection of risky trading groups.

[0078] In one optional embodiment, the detection system extracts features from the target transaction data of each transaction account, and the resulting N transaction features are at least one of the following transaction features:

[0079] The first transaction feature is the entropy value used to characterize the transaction amount of all historical transactions involved in a transaction account;

[0080] The second transaction feature is used to characterize the standard deviation of the transaction times of all historical transactions involved in a trading account;

[0081] The third transaction feature is used to characterize the distribution information of counterparties in all historical transactions involving a transaction account;

[0082] The fourth transaction feature is used to characterize the ratio of the number of all first historical transactions involved in a transaction account to the number of all historical transactions, wherein the first historical transactions are historical transactions that occurred within a preset period at the time of the transaction;

[0083] The fifth transaction feature is used to characterize the distribution information of transaction frequency corresponding to the transaction account;

[0084] The sixth transaction feature is used to characterize the ratio of incoming to outgoing amounts for a transaction account;

[0085] The seventh transaction feature is used to characterize the difference between the average transaction amount of all historical transactions involved in the transaction account and a preset standard value.

[0086] Optionally, the process for determining the N transaction features is as follows:

[0087] First Transaction Characteristics The entropy value of the transaction amount;

[0088] Second transaction characteristics Standard deviation of transaction time;

[0089] Third transaction characteristics Concentration of the number of adversaries as determined by the Herfindahl-Hirschman index;

[0090] Fourth transaction characteristics : Percentage of nighttime transactions;

[0091] Fifth Transaction Characteristics The periodicity of the trading frequency obtained through Fourier transform;

[0092] Sixth Transaction Characteristics The ratio of incoming funds to outgoing funds;

[0093] Seventh Transaction Characteristics : The deviation of the average transaction amount from the average of the peer group.

[0094] Optionally, during the extraction of the first transaction feature, the detection system can assess whether the distribution of the transaction amount is random by calculating the entropy value of the transaction amount. A high entropy value means that the transaction amount of the transaction account is widely distributed and difficult to predict, while a low entropy value indicates that the amount distribution is relatively concentrated and has regularity. The first transaction feature can help the detection system identify whether the account transaction amount conforms to normal transaction logic and whether it shows an abnormal regularity distribution.

[0095] Optionally, during the extraction of the second transaction feature, the detection system can reveal whether the transaction account has a fixed trading time habit, such as frequent trading at night, by detecting the standard deviation of the trading time of all historical transactions involved in the trading account. A small standard deviation means that the trading time is relatively regular. The second transaction feature is of great significance for identifying abnormal operation time and potential risks.

[0096] Optionally, during the extraction of the third transaction feature, the detection system analyzes the distribution information of counterparties in all historical transactions involving the transaction account and uses indicators such as the Herfindahl-Hirschman Index (HHI) to determine whether the transaction account is overly concentrated on a few counterparties, thereby revealing abnormal trading object preferences.

[0097] Optionally, during the extraction of the fourth transaction feature, the detection system can detect whether an account exhibits abnormally active trading behavior during certain periods, such as holidays or non-working hours, by detecting the ratio of the number of all first-historical transactions involved in the transaction account to the number of all historical transactions.

[0098] Optionally, in the process of extracting the fifth transaction feature, the detection system can identify whether the account transactions exhibit periodic characteristics by detecting the distribution information of the transaction frequency corresponding to the transaction account. For example, whether an account frequently engages in small-amount, high-frequency transactions.

[0099] Optionally, during the extraction of the sixth transaction feature, the detection system can reveal the directionality of account fund flows by detecting the ratio of the amount received to the amount withdrawn from the transaction account. This helps to identify whether there are abnormal sources or destinations of funds, especially when the amount withdrawn is much greater than the amount received, which should raise suspicion of potential risky fund transfer behavior.

[0100] Optionally, during the extraction of the seventh transaction feature, the detection system can detect whether the account's transaction amount deviates from the normal range by comparing the average transaction amount of all historical transactions involving the transaction account with a preset standard value. This deviation may indicate abnormal transaction activity.

[0101] Optionally, the detection system integrates the above seven transaction features and encodes them using a machine learning model (such as a variational autoencoder, VAE) to generate target features for each transaction account. The target feature is a low-dimensional representation that contains essential information about the account's transaction patterns, which can effectively capture and condense the complex transaction behavior of the account, thereby making subsequent clustering and scoring analysis more accurate and efficient.

[0102] Optionally, by using target feature encoding based on multi-dimensional transaction features, the detection system can achieve the following technical effects:

[0103] (1) Enhanced identification capability: The target features not only cover conventional dimensions such as amount, time and counterparty, but also delve into details such as transaction frequency and income-expenditure ratio, so as to more comprehensively reflect the dynamic behavior of the transaction account and enhance the ability to identify complex transaction patterns.

[0104] (2) Improve detection accuracy: Dimensionality reduction of high-dimensional features not only simplifies the complexity of data analysis, but also effectively improves the accuracy of risk detection by retaining the key information that best distinguishes the behavioral differences between accounts, and reduces false alarms and false negatives.

[0105] (3) Optimize computational efficiency: Compared with directly processing high-dimensional raw transaction data, the generation of target features significantly reduces the computational resources and time required for subsequent clustering and scoring analysis, thereby improving the efficiency of the entire risk detection process.

[0106] (4) Enhance risk prediction: The construction of target features is based on the integration of multi-dimensional transaction information, which helps financial institutions to build a more powerful risk prediction model. Even when faced with abnormal transaction patterns that appear for the first time, they can provide early warnings through pattern recognition, thereby enhancing the security of the financial system.

[0107] In summary, by defining and applying the seven transaction characteristics mentioned above, and generating target characteristics based on them, the detection system enhances the risk management capabilities of financial institutions, enabling more accurate and efficient identification of accounts involved in abnormal transactions, and providing technical support for combating risky financial activities.

[0108] In one optional embodiment, during the processing of N transaction features, the detection system first performs a linear space transformation operation on the N transaction features to obtain the transformation results corresponding to the N transaction features. The linear space transformation operation is used to reduce the dimensionality of the N transaction features. Then, the detection system encodes the transformation results corresponding to the N transaction features to obtain the target features corresponding to each transaction account.

[0109] Optionally, linear space transformation operations are used to reduce the dimensionality of the original N transaction features through linear transformation. Common linear space transformation techniques include principal component analysis and linear discriminant analysis. These methods find linear combinations in the data to represent the original high-dimensional features with lower dimensions while preserving as much important information in the data as possible.

[0110] Optionally, in order to compress N high-dimensional transaction features into a low-dimensional representation that contains the essence of behavioral patterns, the detection system can employ an unsupervised learning approach using a variational autoencoder (VAE), as follows:

[0111] (1) VAE's encoder Will Mapped to the mean and variance vectors in the latent space:

[0112] μ,σ=Encoder ( );

[0113] In the above formula, μ represents the input data. In the most likely location or central point within the potential space, μ captures the most essential and stable part of an account's behavioral pattern. For example, the μ of a normal payroll transaction account might point to the core area of ​​"low frequency, fixed amount, monthly cycle"; while the μ of a risky transaction account disguised as an e-commerce account might be close to the core area of ​​a real e-commerce account, characterized by "high frequency, multiple transactions, and dispersed amounts." μ is responsible for capturing "clones of behavioral patterns."

[0114] In the above formula, σ represents the range of uncertainty or volatility around the mean μ in the latent space. σ in each dimension indicates the variability of that dimension's characteristics. σ captures the natural volatility and diversity of a trading account's behavior. For example, a genuine e-commerce trading account, due to real business activities, will exhibit certain natural fluctuations in behavior (moderate σ value); a cluster of risky trading accounts controlled by programs and deliberately mimicking behavior may exhibit rigid behavior (smaller σ value), or deliberately display illogical and chaotic fluctuations (larger σ value) in order to disguise behavior.

[0115] (2) Generate the latent vector z using the reparameterization technique:

[0116] z = μ + σ⊙ε;

[0117] Where ε N(0,1);

[0118] (3) The decoder θ attempts to reconstruct the input from z:

[0119] =Decoderθ(z);

[0120] (4) The training objective is to minimize the reconstruction loss and KL divergence:

[0121] L( ,θ; )=|| - ||²+β KL[N(μ,σ²)||N(0,1)];

[0122] After training, the behavioral DNA of each account is its corresponding latent vector z.

[0123] Optionally, linear space transformation operations can efficiently process high-dimensional data, reducing the computational complexity and storage requirements of subsequent processing. This application transforms multidimensional transaction features into fewer linear combinations, removing redundant information and reducing multicollinearity issues among features, making the model more efficient and stable during training and prediction. Simultaneously, the dimensionality-reduced features help improve the performance of clustering and classification algorithms because they can better reveal the essential attributes of account transaction patterns without being obscured by surface complexity and noise.

[0124] Optionally, the detection system can further optimize feature representation by encoding the transformation results corresponding to N transaction features. Compressive encoding not only reduces the dimensionality of the features but also enhances their expressive power and discriminative power. The target features are not only low-dimensional, facilitating storage and transmission, but more importantly, they can capture typical transaction account behavior patterns in a compact form, providing high-quality input for subsequent risk clustering and scoring. Simultaneously, the encoding process is essentially an unsupervised learning process that can automatically discover and extract hidden patterns in transaction data without requiring manually preset complex rules or thresholds, enhancing the flexibility and adaptability of the solution and effectively addressing the ever-changing and evolving financial risk environment.

[0125] In summary, the steps in the above embodiments, through the application of linear space transformation and encoding techniques, not only reduce the dimensionality of the processed data and improve computational and storage efficiency, but also generate more refined and abstract target features, thereby enhancing the identification ability and robustness of the risk detection model.

[0126] In one alternative embodiment, in determining the first score for each account set, the detection system first determines all synchronous trading pairs and all trading pairs involved in each account set based on the trading data of all trading accounts included in each account set; then, the detection system uses the ratio of the number of all synchronous trading pairs involved in each account set to the number of all trading pairs as the first score for each account set.

[0127] Optionally, a synchronous trading pair refers to two accounts in a set of accounts that transfer funds to the same counterparty / the same counterparty's agent account at the same or similar time (i.e., the time difference is less than a preset time difference) within a given time window. These two transactions are considered a synchronous trading pair.

[0128] Optionally, the detection system can identify accounts with close operational collaboration by deeply analyzing the consistency of trading times among trading accounts in the account set. Identifying synchronized trading pairs essentially involves finding potential connections between accounts, particularly those attempting to conceal their coordinated operations. By quantifying the ratio of synchronized trading pairs to all trading pairs, the detection system can assess the degree of coordination in trading behavior within the account set, thereby gaining deeper insights into account interactions. Even trading accounts that appear to exhibit normal patterns individually, but whose trading behavior with other accounts constitutes coordinated risky trading behavior, can be identified as risky accounts, thus improving the accuracy of risk detection for trading accounts.

[0129] Optionally, the detection system uses the ratio of the number of synchronized trading pairs to the total number of trading pairs as the primary score, which can intuitively reflect the level of synchronicity of trading behavior within an account set. This scoring mechanism has the following functions:

[0130] (1) Enhanced sensitivity: Even if there are no abnormalities in the explicit characteristics of the transaction behavior such as amount and frequency, the coordinated behavior shown in the transaction time can be keenly captured by the system, thereby improving the ability to identify hidden risk activities.

[0131] (2) Quantitative assessment: By converting time synergy into numerical scores, it is easier to conduct comprehensive analysis with other scoring standards (such as similarity of transaction IP / transaction device, concentration of transaction area identifiers) to form an overall risk assessment of the account set.

[0132] In summary, the detection system improves the accuracy and detail of risk detection by precisely identifying and quantifying the temporal synergy of transaction behaviors within an account set. The introduction of the first score not only enriches the risk assessment system but also reduces false alarms, enabling financial institutions to focus on high-risk account sets, thereby improving the efficiency and effectiveness of risk management.

[0133] In an optional embodiment, during the determination of all synchronous trading pairs and all trading pairs involved in each account set, the detection system first determines all transactions involved in the i-th account set based on the transaction data of all trading accounts included in the i-th account set; if the counterparty corresponding to the x-th historical transaction and the y-th historical transaction in all transactions is the same, the detection system treats the x-th historical transaction and the y-th historical transaction as a trading pair, wherein the initiator of the x-th historical transaction and the y-th historical transaction is a trading account in the i-th account set; if the counterparty corresponding to the x-th historical transaction and the y-th historical transaction is the same, and the time difference between the transaction times corresponding to the x-th historical transaction and the y-th historical transaction is less than a preset time difference, the detection system treats the x-th historical transaction and the y-th historical transaction as a synchronous trading pair.

[0134] Optionally, the i-th account set refers to one of the multiple account sets obtained through the clustering operation in the previous stage.

[0135] Optionally, the i-th account set refers to all transactions involved, specifically all transaction records of all trading accounts within the i-th account set within a certain historical period (e.g., 180 days).

[0136] Optionally, by identifying and constructing trading pairs, the detection system can initially screen the correlation between trading accounts within an account set and specific counterparties. This correlation analysis can reveal indirect connections between accounts. Even if there is no direct financial transaction between them, frequent transactions to the same counterparty may indicate potential collaborative risk behavior. This helps to initially screen transactions that may involve collaborative operations, providing a foundation for subsequent more in-depth time synchronization analysis.

[0137] Optionally, by identifying and constructing synchronized trading pairs, the detection system can further accurately identify and uncover highly coordinated operations among trading accounts within an account set. Even if these accounts deliberately mimic normal business activities in their behavioral patterns, they can still be effectively identified by the system if they exhibit unreasonable synchronicity in time. Furthermore, the definition of synchronized trading pairs not only considers the consistency of counterparties but also incorporates time interval constraints. This allows the system to capture hidden risk trading groups attempting to evade detection through time misalignment, improving the comprehensiveness and depth of risk detection. In addition, compared to simple counterparty matching, incorporating time synchronization conditions can more accurately distinguish between normal business transactions and abnormal coordinated activities, helping to reduce the risk of misjudging genuine business activities as suspicious transactions, thereby lowering the overall false alarm rate.

[0138] In summary, by constructing and synchronizing trading pairs, the detection system can deeply analyze the trading synergy within an account set, and is particularly capable of identifying carefully designed, covert risk trading activities designed to evade routine detection. These steps not only enhance the sensitivity to risky trading, but also reduce the false alarm rate through precise time synchronization conditions.

[0139] In one optional embodiment, in the process of determining the risk detection result of the trading accounts in each account set based on the first score, second score, and third score of each account set, the detection system first performs a weighted sum of the first score, second score, and third score of each account set to obtain the target score of each account set; if the target score of the j-th account set is greater than the preset score, the detection system regards all trading accounts included in the j-th account set as risky trading accounts; subsequently, the detection system generates early warning information based on the trading data of the risky trading accounts.

[0140] Optionally, the detection system obtains a target score for each account set by weighted summing of the first, second, and third scores. This target score is a comprehensive score that integrates three aspects: the time synchronization of trading accounts, the clustering of operational traces, and the abnormality of trading behavior. The target score can comprehensively assess the risk level of the account set from multiple perspectives. This not only enhances the comprehensive analysis capability of the risk detection model, but also ensures that any abnormality in any single indicator will not lead to a false alarm. Instead, a comprehensive consideration is required to trigger an alert, thereby significantly reducing the false alarm rate and improving the identification accuracy.

[0141] Optionally, by setting preset scoring thresholds, the detection system can automatically filter out sets of high-risk accounts without requiring manual review of each account. This improves the speed at which financial institutions can identify sets of accounts that require attention, enhances the responsiveness and efficiency of risk management, and avoids over-monitoring of low-risk accounts, thus saving financial institutions' monitoring resources.

[0142] Optionally, when the detection system identifies a trading account with potential risks, it immediately generates an early warning message based on the trading data of the risky trading account. The early warning message includes, but is not limited to, the basic account information of the trading account, the risky trading behavior, the target score, and the risk behavior interception suggestion.

[0143] Optionally, by generating early warning information in real time, the detection system enables financial institutions to be aware of the existence of risky transaction accounts immediately and take swift action to prevent the further spread of potential risky transactions. At the same time, the early warning information includes specific transaction details and scoring criteria, providing technical personnel with sufficient information for in-depth analysis and decision-making, enhancing the transparency and traceability of the risk management process, and facilitating subsequent audits and compliance checks.

[0144] In summary, by automatically generating comprehensive scores and early warning information, the detection system can achieve automated and accurate assessment and early warning of account portfolio risks, thereby improving the efficiency and accuracy of financial institutions in risk management.

[0145] Therefore, the beneficial effects that the technical solution provided in this embodiment can achieve are as follows:

[0146] (1) Improve detection rate: It can detect high-risk groups that deliberately imitate normal behavior patterns and cannot be identified by current technology.

[0147] (2) Reduce false alarm rate: Through two-stage verification of “behavioral cloning” and “spatiotemporal coordination”, the normal transaction groups (such as chain stores and e-commerce agents) with similar behaviors but no trace of coordinated crime are effectively filtered out, thus reducing the false alarm rate.

[0148] (3) Enhanced interpretability: The final warning information is accompanied by detailed evidence of similarity in behavioral patterns and evidence of spatiotemporal coordination (such as IP aggregation list and synchronous transaction timestamps), which facilitates the technical personnel's judgment of the warning information and investigation of risky trading accounts.

[0149] (4) Improve adaptability: The unsupervised learning algorithm used in the detection system enables it to automatically discover new and unknown risk behavior patterns without relying on a large number of labeled risk samples, and has a natural adaptability to new risk trading behaviors.

[0150] As described above, this application employs a multi-level intelligent analysis approach. By performing deep behavioral pattern recognition on trading accounts, it obtains the target features corresponding to the trading accounts. Subsequently, trading accounts with similar target features are grouped into the same account set. Then, based on the target features, the operational coordination of trading accounts in each account set is tested from three dimensions: transaction synchronization, concentration of transaction IP / transaction device, and clustering of transaction area. This achieves the goal of accurately distinguishing between normal trading accounts and risky trading accounts, thereby improving the technical effect of improving the accuracy of risk detection for trading accounts. This solves the technical problem of low accuracy in risk detection of trading accounts participating in financial transactions in existing technologies when facing complex trading patterns that are "normal in appearance but abnormal in reality" and cross-account collaborative operations.

[0151] Example 2

[0152] This application embodiment can also provide a risk detection device for trading accounts. It should be noted that the risk detection device for trading accounts in this application embodiment can be used to execute the risk detection method for trading accounts provided in this application embodiment. The risk detection device for trading accounts provided in this application embodiment is described below.

[0153] According to an embodiment of this application, an apparatus for implementing the above-described risk detection method for trading accounts is also provided. Figure 3 This is a schematic diagram of an optional risk detection device for a trading account according to an embodiment of this application, such as... Figure 3 As shown, the device includes: a clustering operation unit 301, a scoring determination unit 302, and a risk detection unit 303.

[0154] Optionally, the clustering operation unit 301 is used to perform clustering operations on the L trading accounts based on the target features corresponding to each trading account in the L trading accounts, to obtain K account sets, where L and K are both positive integers, the target features are used to characterize the trading behavior pattern of each trading account, and the similarity between the target features corresponding to any two trading accounts included in the same account set is less than or equal to a preset similarity; the scoring determination unit 302 is used to determine a first score, a second score, and a third score for each account set based on the trading data of all trading accounts included in each account set, where the first score is used to characterize the ratio of the number of synchronous trading pairs to the number of trading pairs involved in the account set, the second score is used to characterize the similarity between the trading IPs / trading devices corresponding to the trading accounts in the account set, and the third score is used to characterize the similarity between the trading area identifiers corresponding to the trading accounts in the account set; the risk detection unit 303 is used to determine the risk detection result of the trading accounts in each account set based on the first score, the second score, and the third score of each account set.

[0155] In one optional embodiment, the risk detection device for trading accounts further includes: a data acquisition unit, a data cleaning unit, a feature extraction unit, and a feature determination unit.

[0156] Optionally, the data acquisition unit is used to collect the original transaction data of each transaction account within a preset historical time period after receiving the authorization information of the user of each transaction account; the data cleaning unit is used to clean the original transaction data of each transaction account to obtain the target transaction data of each transaction account, wherein the data cleaning is used to remove noise data in the original transaction data; the feature extraction unit is used to extract features from the target transaction data of each transaction account to obtain N transaction features corresponding to each transaction account, wherein N is a positive integer; and the feature determination unit is used to determine the target features corresponding to each transaction account based on the N transaction features corresponding to each transaction account.

[0157] In one optional embodiment, the N transaction characteristics in the risk detection device for the transaction account are at least one of the following transaction characteristics:

[0158] The first transaction feature is the entropy value used to characterize the transaction amount of all historical transactions involved in a transaction account;

[0159] The second transaction feature is used to characterize the standard deviation of the transaction times of all historical transactions involved in a trading account;

[0160] The third transaction feature is used to characterize the distribution information of counterparties in all historical transactions involving a transaction account;

[0161] The fourth transaction feature is used to characterize the ratio of the number of all first historical transactions involved in a transaction account to the number of all historical transactions, wherein the first historical transactions are historical transactions that occurred within a preset period at the time of the transaction;

[0162] The fifth transaction feature is used to characterize the distribution information of transaction frequency corresponding to the transaction account;

[0163] The sixth transaction feature is used to characterize the ratio of incoming to outgoing amounts for a transaction account;

[0164] The seventh transaction feature is used to characterize the difference between the average transaction amount of all historical transactions involved in the transaction account and a preset standard value.

[0165] In one alternative embodiment, the feature determination unit includes a linear space subunit and a feature encoding subunit.

[0166] Optionally, a linear space subunit is used to perform linear space transformation operations on N transaction features to obtain the transformation results corresponding to the N transaction features, wherein the linear space transformation operation is used to reduce the dimensionality of the N transaction features; a feature encoding subunit is used to encode the transformation results corresponding to the N transaction features to obtain the target features corresponding to each transaction account.

[0167] In an optional embodiment, the scoring determination unit 302 includes a trading pair determination subunit and a first scoring determination subunit.

[0168] Optionally, the trading pair determination subunit is used to determine all synchronous trading pairs and all trading pairs involved in each account set based on the trading data of all trading accounts included in each account set; the first score determination subunit is used to take the ratio of the number of all synchronous trading pairs involved in each account set to the number of all trading pairs as the first score of each account set.

[0169] In one optional embodiment, the transaction pair determination subunit includes: a transaction determination module, a first transaction pair determination module, and a second transaction pair determination module.

[0170] Optionally, the transaction determination module is used to determine all transactions involving the i-th account set based on the transaction data of all transaction accounts included in the i-th account set; the first transaction pair determination module is used to treat the x-th historical transaction and the y-th historical transaction as a transaction pair if the counterparty corresponding to the x-th historical transaction and the y-th historical transaction in all transactions is the same, wherein the initiator of the transaction corresponding to the x-th historical transaction and the y-th historical transaction is a transaction account in the i-th account set; the second transaction pair determination module is used to treat the x-th historical transaction and the y-th historical transaction as a synchronous transaction pair if the counterparty corresponding to the x-th historical transaction and the y-th historical transaction is the same, and the time difference between the transaction times corresponding to the x-th historical transaction and the y-th historical transaction is less than a preset time difference.

[0171] In one optional embodiment, the risk detection unit 303 includes: a weighted summation subunit, a risk transaction account determination subunit, and an early warning information generation subunit.

[0172] Optionally, a weighted summation subunit is used to perform a weighted summation of the first score, second score, and third score of each account set to obtain the target score of each account set; a risky trading account determination subunit is used to identify all trading accounts included in the j-th account set as risky trading accounts if the target score of the j-th account set is greater than the preset score; and an early warning information generation subunit is used to generate early warning information based on the trading data of the risky trading accounts.

[0173] As described above, this device employs a multi-level intelligent analysis approach. By performing deep behavioral pattern recognition on trading accounts, it obtains the target features corresponding to the trading accounts. Subsequently, trading accounts with similar target features are grouped into the same account set. Then, based on the target features, the device examines the operational coordination of trading accounts in each account set from three dimensions: transaction synchronization, concentration of transaction IP / transaction devices, and clustering of transaction areas. This achieves the goal of accurately distinguishing between normal trading accounts and risky trading accounts, thereby improving the accuracy of risk detection for trading accounts. This solves the technical problem of low accuracy in risk detection of trading accounts participating in financial transactions in existing technologies when facing complex trading patterns that are "normal in appearance but abnormal in reality" and cross-account collaborative operations.

[0174] It should be noted that the clustering operation unit 301, the scoring determination unit 302, and the risk detection unit 303 mentioned above correspond to steps S201 to S203 in the method embodiment. The three units and the corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed in the above embodiments. It should be noted that the above modules or units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above modules can also be part of the device and run in the computer terminal 10 provided in the embodiment.

[0175] Example 3

[0176] Embodiments of this application can also provide an electronic device. Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application, such as... Figure 4 As shown, the electronic device includes: one or more ( Figure 4 (Only one is shown) Processor 402, memory 404, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0177] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and devices in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby realizing the above-mentioned risk detection method for trading accounts.

[0178] The memory may include high-speed random access memory (RAM), and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, which can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks (LANs), mobile communication networks, and combinations thereof.

[0179] The processor can access information and applications stored in memory via a transmission device to execute the following steps: Based on the target features corresponding to each of the L trading accounts, cluster the L trading accounts to obtain K account sets, where L and K are both positive integers. The target features characterize the trading behavior pattern of each trading account, and the similarity between the target features of any two trading accounts within the same account set is less than or equal to a preset similarity. Based on the trading data of all trading accounts included in each account set, determine a first score, a second score, and a third score for each account set. The first score characterizes the ratio of the number of synchronous trading pairs to the number of trading pairs involved in the account set; the second score characterizes the similarity between the trading IPs / trading devices corresponding to the trading accounts in the account set; and the third score characterizes the similarity between the trading area identifiers corresponding to the trading accounts in the account set. Based on the first score, the second score, and the third score for each account set, determine the risk detection result for the trading accounts in each account set.

[0180] The processor can access information and applications stored in the memory via a transmission device to perform the following steps: After receiving authorization information from the user of each trading account, it collects the raw transaction data of each trading account within a preset historical time period; it cleans the raw transaction data of each trading account to obtain the target transaction data of each trading account, wherein the data cleaning is used to remove noise data from the raw transaction data; it extracts features from the target transaction data of each trading account to obtain N transaction features corresponding to each trading account, where N is a positive integer; and it determines the target features corresponding to each trading account based on the N transaction features corresponding to each trading account.

[0181] The processor can access the information and application programs stored in the memory via the transmission device to perform the following steps: perform a linear space transformation operation on N transaction features to obtain the transformation results corresponding to the N transaction features, wherein the linear space transformation operation is used to reduce the dimensionality of the N transaction features; encode the transformation results corresponding to the N transaction features to obtain the target features corresponding to each transaction account.

[0182] The processor can access the information and application stored in the memory via the transmission device to perform the following steps: based on the transaction data of all trading accounts included in each account set, determine all synchronous trading pairs and all trading pairs involved in each account set; and use the ratio of the number of all synchronous trading pairs and all trading pairs involved in each account set as the first score of each account set.

[0183] The processor can invoke information and applications stored in the memory via the transmission device to perform the following steps: Based on the transaction data of all transaction accounts included in the i-th account set, determine all transactions involved in the i-th account set; If the counterparty corresponding to the x-th historical transaction and the y-th historical transaction in all transactions is the same, treat the x-th historical transaction and the y-th historical transaction as a transaction pair, wherein the initiator of the transactions corresponding to the x-th historical transaction and the y-th historical transaction is a transaction account in the i-th account set; If the counterparty corresponding to the x-th historical transaction and the y-th historical transaction is the same, and the time difference between the transaction times corresponding to the x-th historical transaction and the y-th historical transaction is less than a preset time difference, treat the x-th historical transaction and the y-th historical transaction as a synchronous transaction pair.

[0184] The processor can call the information and application stored in the memory through the transmission device to perform the following steps: weighted summation of the first score, second score and third score of each account set to obtain the target score of each account set; if the target score of the j-th account set is greater than the preset score, all trading accounts included in the j-th account set are designated as risky trading accounts; and warning information is generated based on the trading data of the risky trading accounts.

[0185] This application provides a risk detection scheme for trading accounts. The scheme employs a multi-level intelligent analysis approach. By performing deep behavioral pattern recognition on trading accounts, it obtains the target features corresponding to each trading account. Then, trading accounts with similar target features are grouped into the same account set. Based on these target features, the scheme examines the operational coordination of trading accounts within each account set from three dimensions: transaction synchronization, concentration of transaction IP / devices, and clustering of transaction areas. This achieves the goal of accurately distinguishing between normal and risky trading accounts, thereby improving the accuracy of risk detection for trading accounts. Furthermore, it solves the technical problem of low accuracy in risk detection of trading accounts participating in financial transactions in existing technologies, which struggle to identify complex trading patterns that appear normal but are actually abnormal, and cross-account collaborative operations.

[0186] Those skilled in the art will understand that Figure 4 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, PDAs, mobile internet devices, PADs, and other terminal devices. Figure 4 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 4 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 4 The different configurations shown.

[0187] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0188] Example 4

[0189] Embodiments of this application may also provide a storage medium.

[0190] Optionally, in this embodiment of the application, the storage medium can be used to store the program code executed by the risk detection method for transaction accounts provided in the above method embodiments.

[0191] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0192] This application also provides a computer program product, which, when executed on a data processing device, is suitable for performing risk detection method steps for a trading account.

[0193] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0194] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0195] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0196] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0197] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0198] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0199] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method of detecting risk of a transaction account, the method comprising: The method comprises the following steps: Based on the target feature corresponding to each of the L transaction accounts, the L transaction accounts are clustered to obtain K account sets, wherein L and K are positive integers, the target feature is used to represent the transaction behavior mode of each transaction account, and the similarity between the target features corresponding to any two transaction accounts in the same account set is less than or equal to a preset similarity; Based on the transaction data of all transaction accounts included in each account set, the first score, the second score and the third score of each account set are determined, wherein the first score is used to represent the ratio of the number of synchronous transaction pairs to the number of transaction pairs involved in the account set, the second score is used to represent the similarity between the transaction IP / transaction device corresponding to the transaction accounts in the account set, and the third score is used to represent the similarity between the transaction area identifiers corresponding to the transaction accounts in the account set; Based on the first score, the second score and the third score of each account set, the risk detection result of the transaction accounts in each account set is determined.

2. The transaction account risk detection method of claim 1, wherein, Before clustering the L transaction accounts, the risk detection method of the transaction accounts further comprises: After receiving the authorization information of the user of each transaction account, the original transaction data of each transaction account in a preset historical time period is collected; The original transaction data of each transaction account is data cleaned to obtain the target transaction data of each transaction account, wherein the data cleaning is used to remove noise data in the original transaction data; Feature extraction is performed on the target transaction data of each transaction account to obtain N transaction features corresponding to each transaction account, wherein N is a positive integer; Based on the N transaction features corresponding to each transaction account, the target feature corresponding to each transaction account is determined.

3. The transaction account risk detection method of claim 2, wherein, The N transaction features are at least one of the following transaction features: The first transaction feature is used to represent the entropy value of the transaction amount of all historical transactions involved by the transaction account; The second transaction feature is used to represent the standard deviation of the transaction time of all historical transactions involved by the transaction account; The third transaction feature is used to represent the distribution information of the transaction counterpart of all historical transactions involved by the transaction account; The fourth transaction feature is used to represent the ratio between all first historical transactions and all historical transactions involved by the transaction account, wherein the first historical transaction is a historical transaction whose transaction time is within a preset period; The fifth transaction feature is used to represent the distribution information of the transaction frequency corresponding to the transaction account; The sixth transaction feature is used to represent the ratio of the deposit amount to the withdrawal amount corresponding to the transaction account; The seventh transaction feature is used to represent the difference between the average value of the transaction amount of all historical transactions involved by the transaction account and a preset standard value.

4. The transaction account risk detection method of claim 2, wherein, Based on the N transaction features corresponding to each transaction account, the target feature corresponding to each transaction account is determined, comprising: Linear space transformation operation is performed on the N transaction features to obtain the transformation result corresponding to the N transaction features, wherein the linear space transformation operation is used to reduce the dimension of the N transaction features; Encode the transformation results corresponding to the N transaction features to obtain target features corresponding to each transaction account.

5. The transaction account risk detection method of claim 1, wherein, Determine a first score of each account set based on transaction data of all transaction accounts included in the account set, including: Determine all synchronous transaction pairs and all transaction pairs involved in each account set based on transaction data of all transaction accounts included in the account set. Take the ratio of the number of all synchronous transaction pairs and all transaction pairs involved in each account set as the first score of the account set.

6. The transaction account risk detection method of claim 5, wherein, Determine all synchronous transaction pairs and all transaction pairs involved in each account set based on transaction data of all transaction accounts included in the account set, including: Determine all transactions involved in the i th account set based on transaction data of all transaction accounts included in the i th account set. In the case that the transaction counterpart of the x th historical transaction and the y th historical transaction corresponding to the x th historical transaction and the y th historical transaction are the same, the x th historical transaction and the y th historical transaction are taken as a transaction pair, wherein the transaction initiator corresponding to the x th historical transaction and the y th historical transaction is a transaction account in the i th account set. In the case that the transaction counterpart of the x th historical transaction and the y th historical transaction are the same, and the time difference between the transaction time corresponding to the x th historical transaction and the y th historical transaction is less than a preset time difference, the x th historical transaction and the y th historical transaction are taken as a synchronous transaction pair.

7. The method of claim 1, wherein, Determine a risk detection result of a transaction account in each account set based on the first score, the second score and the third score of the account set, including: Weighted sum the first score, the second score and the third score of each account set to obtain a target score of the account set. In the case that the target score of the j th account set is greater than a preset score, all transaction accounts included in the j th account set are taken as risk transaction accounts. Generate an early warning information based on transaction data of the risk transaction accounts.

8. A transaction account risk detection apparatus, characterized by, Including: A clustering operation unit is configured to perform a clustering operation on L transaction accounts based on target features corresponding to each transaction account in the L transaction accounts, to obtain K account sets, wherein L and K are positive integers, the target features are used to represent transaction behavior patterns of the each transaction account, and the similarity between target features corresponding to any two transaction accounts included in a same account set is less than or equal to a preset similarity; A score determination unit is configured to determine a first score, a second score and a third score of each account set based on transaction data of all transaction accounts included in the account set, wherein the first score is used to represent the ratio of synchronous transaction pairs and transaction pairs involved in the account set, the second score is used to represent the similarity between transaction IPs / transaction devices corresponding to transaction accounts in the account set, and the third score is used to represent the similarity between transaction region identifiers corresponding to transaction accounts in the account set. A risk detection unit is configured to determine a risk detection result of a transaction account in each account set based on the first score, the second score and the third score of the account set.

9. A computer program product, characterised in that, The computer program product comprises a computer program, wherein the computer program is configured to control the computer program product to perform the risk detection method of the transaction account according to any one of claims 1 to 7 when the computer program is running.

10. An electronic device, comprising: One or more processors and a memory are included, and the memory is configured to store one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the risk detection method of the transaction account according to any one of claims 1 to 7.

Images