Shared device anomaly risk control method and system

Abstract

The application provides a shared device abnormal risk control method and system, belongs to the technical field of risk control systems, acquires basic index data, composite index data and business scenario data of a shared device, and determines the composite index data based on the basic index data; determines whether the shared device triggers risk control according to the basic index data, the composite index data and the business scenario data; if the shared device triggers risk control, inputs the basic index data and the composite index data into a risk prediction model corresponding to the business scenario data, obtains a suspected risk shared device output by the risk prediction model; screens the suspected risk shared device according to a pre-determined risk weight of the suspected risk shared device and a pre-set risk control rule, determines a risk shared device and a risk control measure scheme corresponding to the risk weight. The risk prediction model corresponding to the business scenario data is used to predict the risk of the shared device, and secondary determination is performed in combination with the risk weight after the suspected risk shared device is determined, so that the accuracy of risk determination of the shared device is improved, and misjudgment is avoided.

Description

Technical Field

[0001] This invention relates to the field of risk control system technology, and in particular to a method and system for risk control of shared equipment anomalies. Background Technology

[0002] Software as a Service (SaaS) shared devices are based on cloud computing software platforms, allowing users to access and manage the use of devices via the Internet. Examples include shared office equipment, shared washing machines, shared charging stations, shared massage chairs, and shared entertainment equipment. Therefore, it is essential to implement anomaly risk control for SaaS shared devices.

[0003] Currently, risk control solutions for shared equipment typically set one or more indicator thresholds. Once the indicator data of a shared device reaches the threshold, it is judged as a risky device, which is prone to misjudgment. Summary of the Invention

[0004] This invention provides a method and system for risk control of shared equipment anomalies, which solves the problem that existing risk control schemes for shared equipment anomalies set one or more indicator thresholds and determine the shared equipment as a risky device after the indicator data of the shared equipment reaches the threshold, which is prone to misjudgment.

[0005] This invention provides a method for risk control of abnormal shared equipment, comprising: Acquire basic indicator data, composite indicator data, and business scenario data of shared devices, wherein the composite indicator data is determined based on the basic indicator data; Based on the basic indicator data, the composite indicator data, and the business scenario data, it is determined whether the shared device triggers risk control. If the shared device triggers risk control, the basic indicator data and the composite indicator data are input into the risk prediction model corresponding to the business scenario data to obtain the suspected risk shared device output by the risk prediction model. The suspected risk-sharing devices are screened based on the predetermined risk weights and preset risk control rules to identify the risk-sharing devices and the corresponding risk control measures.

[0006] As one embodiment, the basic indicator data includes the attribute information and transaction data of the shared device, and the composite indicator data is obtained by classifying and summarizing the transaction data according to the attribute information. Correspondingly, determining whether the shared device triggers risk control based on the basic indicator data, the composite indicator data, and the business scenario data includes: Based on the business scenario data, the criteria for abnormal data points of the shared device are determined; Determine whether the basic indicator data and the composite indicator data meet the abnormal data point standard. If so, determine that the shared device triggers risk control.

[0007] As an example, the composite indicator data includes device transaction indicator data, merchant transaction indicator data, and user transaction indicator data of the shared device within a preset time period.

[0008] As one embodiment, determining the abnormal data point criteria for the shared device based on the business scenario data includes: Based on the business scenario data, the abnormal data point standards corresponding to the device transaction indicator data, the merchant transaction indicator data, and the user transaction indicator data are determined to determine the abnormal data point standards for the shared device.

[0009] As one example, the risk prediction model includes: The correlation analysis module is used to perform correlation analysis on the basic indicator data and the composite indicator data based on the business scenario data, and obtain the correlation analysis results. The feature filtering module is used to filter the basic indicator data and the composite indicator data based on the correlation analysis results to obtain target features; The prediction module is used to determine whether the shared device is a suspected risky shared device based on the target characteristics.

[0010] As an example, the feature selection module is built based on a random forest model, and the prediction module is built based on a binary classification model.

[0011] This invention also provides a shared equipment anomaly risk control system, comprising: The acquisition module is used to acquire basic indicator data, composite indicator data, and business scenario data of the shared device, wherein the composite indicator data is determined based on the basic indicator data. The judgment module is used to determine whether the shared device triggers risk control based on the basic indicator data, the composite indicator data, and the business scenario data. The prediction module is used to input the basic indicator data, the composite indicator data, and the business scenario data into the risk prediction model if the shared device triggers risk control, and obtain the suspected risk shared device output by the risk prediction model. The determination module is used to screen the suspected risk-sharing devices according to the pre-determined risk weights of the suspected risk-sharing devices and the preset risk control rules, and to determine the risk-sharing devices and the risk control measures corresponding to the risk weights.

[0012] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the shared device anomaly risk control method as described above.

[0013] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the shared device anomaly risk control method as described above.

[0014] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the shared device anomaly risk control method as described above.

[0015] The present invention provides a method and system for anomaly risk control of shared equipment. This method acquires basic indicator data, composite indicator data, and business scenario data of the shared equipment, wherein the composite indicator data is determined based on the basic indicator data. Based on the basic indicator data, the composite indicator data, and the business scenario data, it determines whether the shared equipment triggers risk control. If the shared equipment triggers risk control, the basic indicator data and the composite indicator data are input into a risk prediction model corresponding to the business scenario data to obtain suspected risky shared equipment output by the risk prediction model. The suspected risky shared equipment is then screened according to a pre-determined risk weight and preset risk control rules to determine the risky shared equipment and the corresponding risk control measures. By performing risk prediction on shared equipment using the risk prediction model corresponding to the business scenario data, and then performing a secondary determination based on the risk weight after identifying suspected risky shared equipment, the accuracy of risk determination for shared equipment is improved, and misjudgments are avoided. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0017] Figure 1 This is a flowchart illustrating the shared equipment anomaly risk control method provided by the present invention.

[0018] Figure 2 This is a schematic diagram of the shared equipment anomaly risk control system provided by the present invention.

[0019] Figure 3 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0021] Figure 1 This is a flowchart illustrating the shared equipment anomaly risk control method provided by the present invention, as shown below. Figure 1 As shown, the present invention provides a method for risk control of abnormal shared equipment, which includes the following steps.

[0022] Step S100: Obtain basic indicator data, composite indicator data, and business scenario data for the shared equipment. The composite indicator data is determined based on the basic indicator data. The basic indicator data includes information such as transaction orders, users, venues, and affiliated merchants for the shared equipment. The composite indicator data is obtained by filtering and summarizing the basic indicator data.

[0023] Step S200: Based on the basic indicator data, the composite indicator data, and the business scenario data, determine whether the shared device triggers risk control.

[0024] Step S300: If the shared device triggers risk control, the basic indicator data and the composite indicator data are input into the risk prediction model corresponding to the business scenario data to obtain the suspected risky shared devices output by the risk prediction model. The risk prediction model is trained on a preset model using basic indicator samples and composite indicator samples from different business scenarios. It is used to automatically learn and capture risk control patterns based on sample features, so as to infer suspected risky shared devices during application.

[0025] Step S400: Based on the pre-determined risk weights of the suspected risk-sharing devices and preset risk control rules, the suspected risk-sharing devices are screened to determine the risk-sharing devices and the corresponding risk control measures. Risk weights can be determined by experts mining merchant data corresponding to all shared devices, analyzing and judging the degree of risk, and setting risk weights for each shared device. The higher the risk weight, the higher the probability that the shared device will be subject to risk control.

[0026] It is understood that this invention uses a risk prediction model corresponding to business scenario data to predict the risks of shared devices, and after identifying suspected risky shared devices, it performs a secondary judgment based on risk weights, thereby improving the accuracy of risk judgment for shared devices and avoiding misjudgments.

[0027] Based on the above embodiments, as an optional embodiment, the basic indicator data includes the attribute information and transaction data of the shared device, and the composite indicator data is obtained by classifying and summarizing the transaction data according to the attribute information. Correspondingly, the step of determining whether the shared device triggers risk control based on the basic indicator data, the composite indicator data and the business scenario data includes steps S210-S220.

[0028] Step S210: Determine the abnormal data point standard of the shared device based on the business scenario data.

[0029] Optionally, the composite indicator data includes device transaction indicator data, merchant transaction indicator data, and user transaction indicator data of the shared equipment within a preset time period. Examples include nighttime transaction data, daily transaction data, single-device transaction data for merchants, and user transaction data for transactions conducted on the shared equipment.

[0030] Optionally, determining the abnormal data point criteria for the shared device based on the business scenario data includes: Based on the business scenario data, the abnormal data point standards corresponding to the device transaction indicator data, the merchant transaction indicator data, and the user transaction indicator data are determined to determine the abnormal data point standards for the shared device.

[0031] Optionally, the general rules for the abnormal data point standard of shared devices may include the following conditions one and two.

[0032] Condition 1: Unit price <= 20 & average payment on the last transaction day <= 20 & number of transaction days in the previous 30 days >= 7 & equipment risk weight <= 1.6.

[0033] Condition 2: Unit price <= 20 & Payment amount in the previous 30 days <= 1000 & Number of transaction days in the previous 30 days >= 2 & Equipment risk weight <= 1.6.

[0034] Based on business scenario data, determining the abnormal data point standards corresponding to the device transaction indicator data, the merchant transaction indicator data, and the user transaction indicator data to determine the abnormal data point standards for the shared device may include the following conditions three and four.

[0035] Condition 3: The venue includes washing machines in a laundry facility with a payment of less than 5000 in the first 30 days; the venue is a charging station in an apartment complex with a payment of less than 5000 in the first 30 days; the venue is a vending machine for adult products with a payment of less than 5000 in the first 30 days and a transaction number of more than 2 in the first 30 days; the venue is an adult product store, hotel, KTV, bar, nightclub, night market, night snack stall, or internet cafe with nighttime risky behavior, a payment of less than 5000 in the first 30 days, and an equipment risk weight of less than 1.6; the venue is a claw machine, children's game machine, or arcade game in an amusement park with a payment of less than 2000 in the first 30 days, a transaction number of more than 2 in the first 30 days, and an equipment risk weight of less than 1.6.

[0036] Condition 4: Transaction price <= 20 & average payment on the last trading day <= 20 & number of trading days in the previous 30 days >= 15 & equipment risk weight <= 1.6 & equipment type is a coin exchange machine.

[0037] Step S220: Determine whether the basic indicator data and the composite indicator data meet the abnormal data point standard. If so, determine that the shared device triggers risk control.

[0038] The following examples illustrate how to determine whether the basic indicator data and the composite indicator data meet the abnormal data point criteria in different business scenarios.

[0039] Night trading If the daily transaction amount is greater than or equal to 500 and the number of transactions on the same day is greater than or equal to 15, the proportion of nighttime orders or nighttime payment amount is greater than 20% (statistics are based on the day and do not include washing machines, charging piles, and massage chairs).

[0040] When the number of device users is >= 5, the daily transaction amount is >= 500, and the number of transactions per day is >= 15, the maximum percentage of the total nighttime payment amount for a single user on that device accounts for >= 30% of the total payment amount for that device. Merchant Risk Rules Merchants whose total transaction amount in the past 30 days is greater than twice the total transaction amount in the previous 30 to 60 days, and whose transaction amount in the current month is greater than or equal to RMB 2,000, are eligible for the following criteria: merchants whose transaction time in the past three months is less than 60 days, and merchants whose registration period is greater than 90 days.

[0041] Merchants must have a 50% or higher percentage of transactions in whole 100s on the same day, and each merchant must have at least 20 transactions on the same day.

[0042] Merchants whose daily transaction amount is greater than or equal to 10,000, whose number of transactions in whole hundreds of yuan is greater than or equal to 10, and whose number of transactions in whole hundreds of yuan accounts for 20% of the total number of transactions on that day.

[0043] Transactions with a daily transaction amount exceeding 2,000 yuan, and whose daily transaction amount is 300% higher than the average transaction amount during the previous 30 days of holidays.

[0044] Merchants whose number of risky devices triggering the old model risk rules accounts for more than 20% of the total number of devices in the merchant, and whose number of online devices on the day is greater than or equal to 20, and whose old model merchant risk weight is greater than or equal to 2.5.

[0045] The proportion of transactions in whole numbers (≥50%) in the past 30 days, and the number of transactions in the past 30 days (≥20).

[0046] Equipment Risk Rules The device's maximum single transaction amount on a given day is greater than or equal to 5 times the average transaction price on that day, and the number of transactions is 3 or more, triggering the rule 3 or more times.

[0047] The transaction amount on the same day is greater than or equal to 5 times the average transaction price in the past 30 days, and the number of triggers is 3 or more.

[0048] The maximum limit for a single transaction is 500.

[0049] The device's daily transaction count is greater than 50 and the total daily transaction amount is greater than or equal to 3000.

[0050] The maximum daily transaction limit is 4000.

[0051] The highest number of transactions for a single device in a single month is >1500, and the percentage of transactions less than 1 yuan per day is <=0.1%.

[0052] The maximum monthly transaction limit is 80,000.

[0053] The unit price of the equipment is >= 200.

[0054] Within the first 30 hours, a single payment of >= 500 yuan or more is allowed, and there are >= 5 such payments.

[0055] Within the first 30 hours, a single payment of >= 50 yuan and >= 15 times are allowed.

[0056] The single transaction amount on that day is greater than or equal to 200, which is the maximum transaction amount in the past 30 days and has been triggered 5 or more times.

[0057] Within 30 days, if three or more users make more than 10 transactions per day on the same device, except for transactions under 5 yuan (1-4 yuan).

[0058] For the coin exchange machine, the percentage of payments of 5 yuan or more in the past 30 days is greater than 0.95 and the number of transactions in the past 30 days is greater than 20. Among all users who have traded on the machine in the past 30 days, the percentage of repeat users is over 70%.

[0059] For coin exchange machines, the percentage of payments of 5 yuan or more in the past 30 days is greater than 0.95, the number of transactions in the past 30 days is greater than 20, and the number of users who have made transactions for more than 2 days in the past 30 days accounts for greater than 0.7% of the total number of users who have made transactions in the past 30 days.

[0060] For transactions involving devices priced at 5 yuan or more, the time interval between the first transaction and the next transaction is less than 5 seconds. This applies to entertainment-related transactions and the transaction is only output after being triggered 3 times.

[0061] The same device has different merchant IDs (game consoles) within the past 30 days.

[0062] Orders exceeding 5 yuan in the past 30 days account for approximately 95% of the total number of orders, and users with more than 20 transactions in the past 30 days and more than 2 transactions in the past 30 days account for more than 0.5% of the total number of users who have made transactions in the past 30 days (game consoles).

[0063] Orders exceeding 5 yuan in the past 30 days account for approximately 95% of the total number of orders, and users with more than 20 transactions in the past 30 days and more than 3 transactions in the past 30 days account for more than 0.2% of the total number of users who made transactions in the past 30 days (game consoles).

[0064] In the past 30 days, orders exceeding 5 yuan accounted for approximately 95% of the total number of orders, and users with more than 20 transactions in the past 30 days and more than 5 transactions in the past 30 days (game consoles) were included.

[0065] Orders exceeding 5 yuan in the past 30 days account for approximately 95% of the total number of orders, and the number of transactions in the past 30 days is >=20. Furthermore, there are users (game console users) who have made transactions in the past 30 days for more than 10 days.

[0066] In the past 30 days, the average number of daily transactions for equipment (game consoles) is greater than 250 and the average number of transactions is greater than 35.

[0067] On the same day, for single transactions of >=5 yuan per device, the number of users is <5 and the number of transactions is >20.

[0068] 23 In the past 30 days, among transactions of devices with a value of 10 yuan or more, the average number of transactions per user was 3.

[0069] 24. The proportion of transactions in whole numbers over the past 30 days is ≥50%, and the number of transactions in the past 30 days is ≥20 (excluding coin exchange machines).

[0070] User Risk Rules When users pay using the same type of device, the user's maximum transaction amount on that day is greater than or equal to three times the average transaction price of the device on that day, and the triggering occurs three or more times.

[0071] If a user makes a payment on the same device, and the amount of a single transaction on that day is greater than or equal to five times the average transaction value of the device in the past 30 days, and the number of such triggers is more than three times.

[0072] The maximum transaction limit for a single user is 500.

[0073] User's daily transaction count > 20 & User's daily transaction amount >= 2000.

[0074] The maximum daily transaction limit for a user is 2000.

[0075] The number of transactions by a user in the past 30 days is >= 500, and the percentage of transactions by a user with a transaction amount of 1 yuan or less is <= 0.1%.

[0076] The maximum transaction limit for users in the past 30 days is 10,000.

[0077] The number of devices that users pay for in a single day is >= 10.

[0078] If a user's single transaction amount on a given day is greater than or equal to the maximum transaction amount of the user in the past 30 days and the single transaction amount on a given day is greater than 200, the transaction will be triggered 5 or more times.

[0079] Within one hour, the device addresses that the user transacted with were not in the same "city".

[0080] Household appliances (massage pillow charging cable, massage mat - 1 to N, massage mat, massage pillow, massage chair, washing machine, pulse washing machine, car wash machine, shoe washing machine, dishwasher) The percentage of transactions in whole hundreds on a single day is ≥20%, and the total number of transactions on that day is ≥20.

[0081] The total transaction amount per day per device is low (300), and the number of transactions is low (50).

[0082] The interval between two payments on a single device is less than 5 minutes.

[0083] The transaction amount difference on a single device is small within a short period of time (the amount difference is greater than 5 yuan within 1 minute).

[0084] Each device can be set to a fixed transaction amount (no more than 5 types).

[0085] The amount of a single equipment transaction is small (50).

[0086] A single payment of >= 20 yuan or more, or >= 5 times, can be made within an hour on a single day.

[0087] The total transaction amount and number of transactions for a single device were low in the first 30 days (3000).

[0088] Number of transactions per user per device per day (<5).

[0089] The device had the most users (payment amount) who made payments in the first 30 days, exceeding 2000.

[0090] Lifestyle products (massage pillow charging cable, massage mat - 1-to-N, massage mat, massage pillow, massage chair, washing machine, pulse washing machine, car wash machine, shoe washing machine, dishwasher) users Daily transaction amount (<300) and number of transactions (<10) for the same type of equipment.

[0091] Cumulative transaction amount in the previous 30 days (<3000), number of transactions in the month (<300).

[0092] The number of similar devices involved by a single user per day (<10).

[0093] Cash register (coin exchange machine, cash register) nighttime transactions The proportion of nighttime orders or nighttime payment amounts is greater than 20%, the transaction amount is greater than or equal to 500, and the number of transactions is greater than or equal to 15.

[0094] The percentage of nighttime payments made by a single user on the device is >= 30% of the total payment amount on the device, the number of users is >= 5, the transaction amount is >= 500, and the number of transactions is >= 15.

[0095] POS (coin exchange machine, cash register) equipment The device's maximum transaction amount for the day is 500% or more greater than the average transaction amount for the day (more than 3 transactions), and the number of triggers is 3 or more.

[0096] The single transaction amount on the same day is 500% or more greater than the average single transaction amount of the past 30 trading days (only days with transactions are counted), and the number of triggers is 3 or more.

[0097] The transaction amount of a single device in a single day is greater than or equal to the maximum transaction amount in the past 30 days 5 or more times, except for the maximum transaction amount of less than 200.

[0098] The total transaction amount per day per device is low (5000) and the number of transactions is low (500).

[0099] The number of transactions per device per day (<50) and the total transaction amount (>3000).

[0100] The total transaction amount per device in a single month is low (100,000) and the number of transactions is low (2,000), and the number of orders with a value greater than 5 yuan in the past 30 days accounts for more than 70% of the total number of transactions in the past 30 days.

[0101] Average transaction price per device per day (<200).

[0102] A single payment of >=200 yuan and >=5 times per hour on a single device per day.

[0103] The number of transactions by the same user on the same device exceeding 10 in one day, except for transactions under 5 yuan (1-4 yuan).

[0104] Orders exceeding 5 yuan accounted for approximately 95% of the total number of orders in the past 30 days, and the number of transactions in the past 30 days was >=20. Among all users who transacted within the past 30 days, repeat users accounted for over 70%.

[0105] Orders exceeding 5 yuan in the past 30 days account for approximately 95% of the total number of orders, and the number of transactions in the past 30 days is >= 20. Furthermore, the number of users who have made transactions in more than 2 days in the past 30 days accounts for >= 0.7% of the total number of users who have made transactions in the past 30 days.

[0106] The device had the highest number of users (payment amount) in the first 30 days, exceeding 3000.

[0107] Cash register users (coin exchange machines, cash registers) The larger the amount of a user's single transaction, the longer the time between transactions (1 yuan per second), and the more times the transaction is triggered (3 or more times).

[0108] Daily transaction amount (<500) and number of transactions (<50) for the same type of equipment.

[0109] Number of transactions per user per device per day (<20).

[0110] Monthly cumulative transaction amount (<3000), monthly number of transactions (<300).

[0111] The number of similar devices involved by a single user per day (<5).

[0112] Charging pile equipment The total transaction amount per day per device is low (300), and the number of transactions is low (50).

[0113] The time interval between the two payments is less than 5 minutes.

[0114] The amount of a single equipment transaction is small (50).

[0115] A single payment of >= 20 yuan or more, or >= 5 times, can be made within an hour on a single day.

[0116] The total transaction amount for a single device in a single month is low (3000) and the number of transactions is low (500).

[0117] Transactions occurring in multiples of 100 on a single day include 99, 100, 199, etc.

[0118] The device has the most users who have paid more than 2000 in the first 30 days (payment amount) - an additional column is needed to display all specific amounts.

[0119] Charging station users Daily transaction amount (<300) and number of transactions (<10) for the same type of equipment.

[0120] The number of transactions per user per day on a single device with a value of 5 or more is 5 or more.

[0121] Monthly cumulative transaction amount (<3000), monthly number of transactions (<300).

[0122] The number of similar devices involved by a single user per day (<10).

[0123] It is understandable that this invention adjusts the standards for abnormal data points corresponding to equipment transaction indicator data, merchant transaction indicator data, and user transaction indicator data according to business scenarios, and sets specific logic, which is conducive to improving the accuracy of risk control.

[0124] Based on the above embodiments, as an optional embodiment, the risk prediction model includes: The correlation analysis module is used to perform correlation analysis on the basic indicator data and the composite indicator data based on the business scenario data, and obtain the correlation analysis results. The feature filtering module is used to filter the basic indicator data and the composite indicator data based on the correlation analysis results to obtain target features; The prediction module is used to determine whether the shared device is a suspected risky shared device based on the target characteristics.

[0125] Optionally, the feature selection module is built based on a random forest model, and the prediction module is built based on a binary classification model.

[0126] The goal of the risk prediction model is to identify potentially risky shared devices and periodically output the corresponding merchant list and device data.

[0127] In this embodiment of the invention, the risk prediction model is obtained by training a random forest model and a binary classification model using basic indicator samples and composite indicator samples from different business scenarios. The sample data source list includes a payment order table, a device table, a delivery address table, a merchant city table, a device type table, a merchant table, and a user table. Based on the sample data source list, a sample data feature dictionary is determined, and a dataset is constructed. The dataset is divided into a training set and a test set in a 4:1 ratio.

[0128] The correlation analysis module uses Pearson correlation coefficients to test the correlation between features in the sample data. The feature selection module is based on a random forest model, ranking the importance of various features in the sample data, such as the average payment per merchant device, the number of daily users per merchant device, the maximum percentage of single-user payment amount per merchant device relative to total single-device payment amount, merchant device type, merchant site type, merchant device city, daily order volume per merchant device, and the address type with the highest daily payment amount per business device, ranked from highest to lowest importance. The binary classification model is built using XGBoost. After training the risk prediction model, model evaluation methods such as precision, recall, ROC, AUC, and classification reports can be used. The model evaluation criteria can be set as follows: precision 0.85, recall 0.77, and f1-score 0.81 for the merchant prediction risk control model.

[0129] During the training of the random forest model, a tree needs to be constructed based on the sample data. The weight of the sample can be adjusted according to the risk weight of the shared device and the number of samples, increasing the probability of selecting samples with high risk and few samples, thus solving the problem of unbalanced distribution of sample data.

[0130] Risk control measures include blocking, outbound calls, and investigations. For example, devices meeting one of the following four conditions with a weight value greater than 2 will be considered for blocking: a user making more than 5,000 yuan in a single day, making more than 200 yuan and more than 15 times in an hour, making more than 500 yuan and more than 5 times in an hour, or making more than 15,000 yuan in total monthly payments. Devices containing sensitive words will also be considered for blocking. Devices with a weight value greater than 2.6 will be considered for blocking. The rest will be classified as suspected devices, and outbound calls and investigations are recommended. Furthermore, to reduce the merchant experience and avoid risk control errors, shared devices meeting preset conditions can be removed, such as removing low-value, low-risk devices, marking the number of times they are detected, and processing them only after the conditions are met; removing devices with monthly payment amounts less than the median for that device type; removing whitelisted merchants; removing risk control merchants with transaction amounts less than 2000 yuan in the past 30 days; removing devices with daily transaction amounts less than 200 yuan and less than 1 yuan per device with a percentage greater than 0.2; removing all devices with daily transaction amounts less than 1 yuan per device with a percentage greater than 0.5; and removing children's devices, game consoles, and other similar devices. For mobile payment types, the following criteria are considered: number of transactions <= 10 & payment amount <= 10,000; devices affected by specific scenarios (such as hospitals, nightclubs / KTVs, adult products, etc.); devices that have already been banned or are unlikely to be non-accessible; merchants that were previously verified as operating normally; internal dedicated merchant accounts; merchants that were previously subject to risk control; facial recognition devices; payment code / project code devices; entertainment devices during summer and winter vacations have their weight reduced by 0.2; and entertainment devices with a daily average payment value <= 20 & risk weight = 1 (excluding devices triggered at night) are removed from the algorithm output.

[0131] The shared equipment anomaly risk control system provided by the present invention is described below. The shared equipment anomaly risk control system described below can be referred to in correspondence with the shared equipment anomaly risk control method described above.

[0132] Figure 2 This is a schematic diagram of the shared equipment anomaly risk control system provided by the present invention, as shown below. Figure 2 As shown, the present invention also provides a shared equipment anomaly risk control system, which includes the following modules.

[0133] The acquisition module 210 is used to acquire basic indicator data, composite indicator data and business scenario data of the shared device, wherein the composite indicator data is determined based on the basic indicator data. The judgment module 220 is used to determine whether the shared device triggers risk control based on the basic indicator data, the composite indicator data, and the business scenario data. Prediction module 230 is used to input the basic indicator data, the composite indicator data and the business scenario data into the risk prediction model if the shared device triggers risk control, so as to obtain the suspected risk shared device output by the risk prediction model. The determination module 240 is used to screen the suspected risk-sharing devices according to the pre-determined risk weights of the suspected risk-sharing devices and the preset risk control rules, and to determine the risk-sharing devices and the risk control measures corresponding to the risk weights.

[0134] As one embodiment, the basic indicator data includes the attribute information and transaction data of the shared device, and the composite indicator data is obtained by classifying and summarizing the transaction data according to the attribute information. Correspondingly, determining whether the shared device triggers risk control based on the basic indicator data, the composite indicator data, and the business scenario data includes: Based on the business scenario data, the criteria for abnormal data points of the shared device are determined; Determine whether the basic indicator data and the composite indicator data meet the abnormal data point standard. If so, determine that the shared device triggers risk control.

[0135] As an example, the composite indicator data includes device transaction indicator data, merchant transaction indicator data, and user transaction indicator data of the shared device within a preset time period.

[0136] As one embodiment, determining the abnormal data point criteria for the shared device based on the business scenario data includes: Based on the business scenario data, the abnormal data point standards corresponding to the device transaction indicator data, the merchant transaction indicator data, and the user transaction indicator data are determined to determine the abnormal data point standards for the shared device.

[0137] As one example, the risk prediction model includes: The correlation analysis module is used to perform correlation analysis on the basic indicator data and the composite indicator data based on the business scenario data, and obtain the correlation analysis results. The feature filtering module is used to filter the basic indicator data and the composite indicator data based on the correlation analysis results to obtain target features; The prediction module is used to determine whether the shared device is a suspected risky shared device based on the target characteristics.

[0138] As an example, the feature selection module is built based on a random forest model, and the prediction module is built based on a binary classification model.

[0139] The shared equipment anomaly risk control system provided by the present invention is used to execute the shared equipment anomaly risk control method described in any of the above embodiments, and has the technical effects corresponding to the shared equipment anomaly risk control method, which will not be described in detail here.

[0140] Figure 3 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 3 As shown, the electronic device may include: a processor 310, a communications interface 320, a memory 330, and a communication bus 340, wherein the processor 310, the communications interface 320, and the memory 330 communicate with each other via the communication bus 340. The processor 310 can call logical instructions in the memory 330 to execute the shared device anomaly risk control method, the method including: Acquire basic indicator data, composite indicator data, and business scenario data of shared devices, wherein the composite indicator data is determined based on the basic indicator data; Based on the basic indicator data, the composite indicator data, and the business scenario data, it is determined whether the shared device triggers risk control. If the shared device triggers risk control, the basic indicator data and the composite indicator data are input into the risk prediction model corresponding to the business scenario data to obtain the suspected risk shared device output by the risk prediction model. The suspected risk-sharing devices are screened based on the predetermined risk weights and preset risk control rules to identify the risk-sharing devices and the corresponding risk control measures.

[0141] Furthermore, the logical instructions in the aforementioned memory 330 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0142] On the other hand, the present invention also provides a computer program product, the computer program product comprising a computer program that can be stored on a non-transitory computer-readable storage medium, wherein when the computer program is executed by a processor, the computer is able to execute the shared device anomaly risk control method provided by the above methods, the method comprising: Acquire basic indicator data, composite indicator data, and business scenario data of shared devices, wherein the composite indicator data is determined based on the basic indicator data; Based on the basic indicator data, the composite indicator data, and the business scenario data, it is determined whether the shared device triggers risk control. If the shared device triggers risk control, the basic indicator data and the composite indicator data are input into the risk prediction model corresponding to the business scenario data to obtain the suspected risk shared device output by the risk prediction model. The suspected risk-sharing devices are screened based on the predetermined risk weights and preset risk control rules to identify the risk-sharing devices and the corresponding risk control measures.

[0143] In another aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the shared device anomaly risk control method provided by the above methods, the method comprising: Acquire basic indicator data, composite indicator data, and business scenario data of shared devices, wherein the composite indicator data is determined based on the basic indicator data; Based on the basic indicator data, the composite indicator data, and the business scenario data, it is determined whether the shared device triggers risk control. If the shared device triggers risk control, the basic indicator data and the composite indicator data are input into the risk prediction model corresponding to the business scenario data to obtain the suspected risk shared device output by the risk prediction model. The suspected risk-sharing devices are screened based on the predetermined risk weights and preset risk control rules to identify the risk-sharing devices and the corresponding risk control measures.

[0144] The system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0145] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0146] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for anomaly control of shared equipment, characterized in that, include: Acquire basic indicator data, composite indicator data, and business scenario data of shared devices, wherein the composite indicator data is determined based on the basic indicator data; Based on the basic indicator data, the composite indicator data, and the business scenario data, it is determined whether the shared device triggers risk control. If the shared device triggers risk control, the basic indicator data and the composite indicator data are input into the risk prediction model corresponding to the business scenario data to obtain the suspected risk shared device output by the risk prediction model. The suspected risk-sharing devices are screened based on the predetermined risk weights and preset risk control rules to identify the risk-sharing devices and the corresponding risk control measures.

2. The shared equipment anomaly risk control method according to claim 1, characterized in that, The basic indicator data includes the attribute information and transaction data of the shared device. The composite indicator data is obtained by classifying and summarizing the transaction data based on the attribute information. Correspondingly, determining whether the shared device triggers risk control based on the basic indicator data, the composite indicator data, and the business scenario data includes: Based on the business scenario data, the criteria for abnormal data points of the shared device are determined; Determine whether the basic indicator data and the composite indicator data meet the abnormal data point standard. If so, determine that the shared device triggers risk control.

3. The shared equipment anomaly risk control method according to claim 2, characterized in that, The composite indicator data includes device transaction indicator data, merchant transaction indicator data, and user transaction indicator data of the shared equipment within a preset time period.

4. The shared equipment anomaly risk control method according to claim 3, characterized in that, The step of determining the abnormal data point criteria for the shared device based on the business scenario data includes: Based on the business scenario data, the abnormal data point standards corresponding to the device transaction indicator data, the merchant transaction indicator data, and the user transaction indicator data are determined to determine the abnormal data point standards for the shared device.

5. The shared equipment anomaly risk control method according to any one of claims 1-4, characterized in that, The risk prediction model includes: The correlation analysis module is used to perform correlation analysis on the basic indicator data and the composite indicator data based on the business scenario data, and obtain the correlation analysis results. The feature filtering module is used to filter the basic indicator data and the composite indicator data based on the correlation analysis results to obtain target features; The prediction module is used to determine whether the shared device is a suspected risky shared device based on the target characteristics.

6. The shared equipment anomaly risk control method according to claim 5, characterized in that, The feature selection module is built based on the random forest model, and the prediction module is built based on the binary classification model.

7. A shared equipment anomaly risk control system, characterized in that, include: The acquisition module is used to acquire basic indicator data, composite indicator data, and business scenario data of the shared device, wherein the composite indicator data is determined based on the basic indicator data. The judgment module is used to determine whether the shared device triggers risk control based on the basic indicator data, the composite indicator data, and the business scenario data. The prediction module is used to input the basic indicator data, the composite indicator data, and the business scenario data into the risk prediction model if the shared device triggers risk control, and obtain the suspected risk shared device output by the risk prediction model. The determination module is used to screen the suspected risk-sharing devices according to the pre-determined risk weights of the suspected risk-sharing devices and the preset risk control rules, and to determine the risk-sharing devices and the risk control measures corresponding to the risk weights.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the shared device abnormal risk control method as described in any one of claims 1-6.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the shared device abnormal risk control method as described in any one of claims 1-6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the shared device abnormal risk control method as described in any one of claims 1-6.

Images