Transaction risk detection method and apparatus, storage medium, and electronic device

Abstract

The application discloses a transaction risk detection method and device, a storage medium and an electronic device. It relates to the field of artificial intelligence. The method comprises the following steps: in the case of receiving a target transaction request, extracting transaction information from the target transaction request; updating a transaction graph according to the transaction information, and determining a first transaction risk value of the target transaction request according to the updated transaction graph, wherein the transaction graph is used to represent the association relationship between a plurality of transaction requests; determining a second transaction risk value of the target transaction request according to the transaction information and a transaction behavior sequence of a target object to which the target transaction request belongs; and determining target information according to the first transaction risk value, the second transaction risk value and the transaction information, wherein the target information represents the transaction risk level of the target transaction request. Through the application, the problem of low detection accuracy in related art based on preset static rules for transaction risk detection is solved.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence, and more specifically, to a method, apparatus, storage medium, and electronic device for detecting transaction risks. Background Technology

[0002] With the rapid development of e-commerce and digital finance, electronic payment methods such as debit cards have become deeply integrated into people's daily lives. However, the exponential growth in transaction volume is also accompanied by increasingly serious risks of violations. These violations not only cause huge economic losses to financial institutions and cardholders, but also seriously damage the credit system and security environment of the payment market. Currently, related technologies typically detect transaction risks based on preset static rules, such as relying on manually set thresholds or simple business logic (e.g., exceeding single transaction limits, card swiping in different locations), to identify anomalies, thus resulting in low detection accuracy.

[0003] There is currently no effective solution to the aforementioned problems in the relevant technologies. Summary of the Invention

[0004] The main objective of this application is to provide a method, apparatus, storage medium, and electronic device for detecting transaction risks, in order to solve the problem that related technologies, which detect transaction risks based on preset static rules, have low detection accuracy.

[0005] To achieve the above objectives, according to one aspect of this application, a method for detecting transaction risk is provided. The method includes: upon receiving a target transaction request, extracting transaction information from the target transaction request; updating a transaction graph based on the transaction information, and determining a first transaction risk value for the target transaction request based on the updated transaction graph, wherein the transaction graph represents the relationships between multiple transaction requests; determining a second transaction risk value for the target transaction request based on the transaction information and the transaction behavior sequence of the target object to which the target transaction request belongs; and determining target information based on the first transaction risk value, the second transaction risk value, and the transaction information, wherein the target information represents the transaction risk level of the target transaction request.

[0006] Optionally, the method for detecting transaction risk also includes: identifying the merchant from the transaction information; determining a first sub-risk value based on the abnormal proportion of transaction requests associated with the merchant in the updated transaction graph; determining a second sub-risk value based on the path distance between the target object and the risky merchant in the updated transaction graph; determining a third sub-risk value based on the knowledge graph community to which the transaction information belongs in the updated transaction graph; and determining a first transaction risk value based on at least one of the first, second, and third sub-risk values.

[0007] Optionally, the method for detecting transaction risk may also include: obtaining a first risk indicator calculation model; and processing the first sub-risk value, the second sub-risk value, and the third sub-risk value through the first risk indicator calculation model to obtain the first transaction risk value.

[0008] Optionally, the method for detecting transaction risk also includes: before determining the second transaction risk value of the target transaction request based on the transaction information and the transaction behavior sequence of the target object to which the target transaction request belongs, extracting multiple historical transaction information from multiple historical transaction requests of the target object; sorting the multiple historical transaction information in chronological order to obtain the transaction behavior sequence of the target object.

[0009] Optionally, the method for detecting trading risk also includes: obtaining a second risk indicator calculation model; and processing the trading information and trading behavior sequence through the second risk indicator calculation model to obtain a second trading risk value.

[0010] Optionally, the method for detecting trading risk also includes: processing the first trading risk value, the second trading risk value, and trading information through a third risk indicator calculation model to obtain the target trading risk value; and determining the target information based on the target trading risk value.

[0011] Optionally, the method for detecting transaction risk also includes: after determining the target information based on the first transaction risk value, the second transaction risk value, and the transaction information, obtaining a preset mapping relationship table, wherein the mapping relationship table is used to record the mapping relationship between different transaction risk levels and different request processing flows; determining the target request processing flow corresponding to the transaction risk level represented by the target information based on the mapping relationship table; and processing the target transaction request based on the target request processing flow.

[0012] To achieve the above objectives, according to another aspect of this application, a transaction risk detection device is provided. The device includes: a first extraction module, configured to extract transaction information from a target transaction request upon receiving such a request; a first determination module, configured to update a transaction graph based on the transaction information and determine a first transaction risk value for the target transaction request based on the updated transaction graph, wherein the transaction graph represents the relationships between multiple transaction requests; a second determination module, configured to determine a second transaction risk value for the target transaction request based on the transaction information and the transaction behavior sequence of the target object to which the target transaction request belongs; and a third determination module, configured to determine target information based on the first transaction risk value, the second transaction risk value, and the transaction information, wherein the target information represents the transaction risk level of the target transaction request.

[0013] Optionally, the first determining module further includes: a first determining submodule, used to determine the trading merchant from the transaction information; a second determining submodule, used to determine a first sub-risk value based on the abnormal proportion of transaction requests associated with the trading merchant in the updated transaction graph; a third determining submodule, used to determine a second sub-risk value based on the path distance between the target object and the risky merchant in the updated transaction graph; a fourth determining submodule, used to determine a third sub-risk value based on the knowledge graph community to which the transaction information in the updated transaction graph belongs; and a fifth determining submodule, used to determine a first transaction risk value based on at least one of the first sub-risk value, the second sub-risk value, and the third sub-risk value.

[0014] Optionally, the fifth determining submodule further includes: an acquisition unit for acquiring the first risk indicator calculation model; and a processing unit for processing the first sub-risk value, the second sub-risk value, and the third sub-risk value through the first risk indicator calculation model to obtain the first transaction risk value.

[0015] Optionally, the transaction risk detection device further includes: a second extraction module, used to extract multiple historical transaction information from multiple historical transaction requests of the target object; and a first processing module, used to sort the multiple historical transaction information in chronological order to obtain a transaction behavior sequence of the target object.

[0016] Optionally, the second determining module further includes: an acquisition submodule for acquiring the second risk indicator calculation model; and a first processing submodule for processing the transaction information and transaction behavior sequence through the second risk indicator calculation model to obtain the second transaction risk value.

[0017] Optionally, the third determining module further includes: a second processing submodule, used to process the first transaction risk value, the second transaction risk value, and transaction information through the third risk indicator calculation model to obtain the target transaction risk value; and a sixth determining submodule, used to determine the target information based on the target transaction risk value.

[0018] Optionally, the transaction risk detection device further includes: an acquisition module for acquiring a preset mapping table, wherein the mapping table records the mapping relationship between different transaction risk levels and different request processing flows; a fourth determination module for determining the target request processing flow corresponding to the transaction risk level represented by the target information based on the mapping table; and a second processing module for processing the target transaction request based on the target request processing flow.

[0019] To achieve the above objectives, according to another aspect of this application, a computer-readable storage medium is provided, the computer-readable storage medium including a stored executable program, wherein, when the executable program is running, the device where the computer-readable storage medium is located is controlled to perform the above-described method for detecting transaction risks.

[0020] To achieve the above objectives, according to another aspect of this application, an electronic device is provided, comprising a memory storing an executable program; and a processor for running the program, wherein the program executes the aforementioned method for detecting transaction risks during runtime.

[0021] To achieve the above objectives, according to another aspect of this application, a computer program product is provided, including computer instructions that, when executed by a processor, implement the steps of the above-described method for detecting transaction risks.

[0022] In this embodiment, by updating the transaction graph based on transaction information and determining a first transaction risk value based on the updated graph, it is helpful to dynamically identify organized violations hidden behind complex transaction networks using graph computing technology, overcoming the detection blind spots when analyzing single transaction information. By determining a second transaction risk value based on transaction information and the transaction behavior sequence of the target object, it is helpful to dynamically identify the anomalies of the current transaction based on the target object's historical behavior. Therefore, when determining target information based on the first and second transaction risk values ​​and transaction information, a combination of two-dimensional dynamic analysis and the transaction information itself is achieved to determine the transaction risk level, thereby improving the accuracy of transaction risk detection.

[0023] Therefore, the method provided in this application achieves the goal of combining two-dimensional dynamic analysis and transaction information itself to detect transaction risks, thereby improving the technical accuracy of transaction risk detection and solving the technical problem of low detection accuracy in related technologies that are based on preset static rules for transaction risk detection. Attached Figure Description

[0024] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0025] Figure 1 This is a hardware structure block diagram of a computer terminal provided according to an embodiment of this application;

[0026] Figure 2 This is a flowchart of a transaction risk detection method provided according to an embodiment of this application;

[0027] Figure 3 This is a schematic diagram of a transaction risk detection method provided according to an embodiment of this application;

[0028] Figure 4 This is a schematic diagram of a transaction risk detection device provided according to an embodiment of this application;

[0029] Figure 5 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0030] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0031] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0032] It should be noted that the information collected in this application (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, etc.) are information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of this data all comply with relevant regulations and standards, necessary confidentiality measures have been taken, and they do not violate public order and good morals. Corresponding operation entry points are provided for users to choose to authorize or refuse. For example, interfaces are set up between this system and relevant users or organizations, providing users with corresponding operation entry points for them to choose to agree to or refuse automated decision results; if the user chooses to refuse, the process proceeds to the expert decision-making stage.

[0033] Example 1

[0034] According to an embodiment of this application, an embodiment of a method for detecting transaction risk is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0035] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware block diagram of a computer terminal (or mobile device) for implementing a method to detect transaction risk is shown. Figure 1 As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor (MCU) or a field-programmable gate array (FPGA), etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output (I / O) interface, a Universal Serial Bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0036] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0037] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the transaction risk detection method in this embodiment. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned transaction risk detection method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0038] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0039] The display can be, for example, a touchscreen liquid crystal display (LCD), which allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0040] Under the aforementioned operating environment, this application provides the following: Figure 2 The method for detecting transaction risks is shown. Figure 2 This is a flowchart of a transaction risk detection method according to Embodiment 1 of this application.

[0041] Step S201: Upon receiving a target transaction request, extract transaction information from the target transaction request.

[0042] Optionally, electronic devices, application systems, servers, or other similar devices can be used as the executing entity of this application. In this embodiment, the target processing system is used as the executing entity to perform the aforementioned transaction risk detection method. The target processing system can be a system within a financial processing institution.

[0043] In some implementations, the target transaction request is a financial card transaction request initiated by the target object at a payment terminal or online channel, awaiting authorization from a financial institution. The target processing system can access the financial card transaction authorization request stream through relevant interfaces to receive the target transaction request. The target processing system can process the target transaction request to extract transaction information. Transaction information may include core attribute fields of the transaction. For example, transaction information includes, but is not limited to, transaction amount, timestamp, merchant information, the target object's geographical location, the target object's device fingerprint, and the target object's network address.

[0044] Step S202: Update the transaction graph based on the transaction information, and determine the first transaction risk value of the target transaction request based on the updated transaction graph, wherein the transaction graph is used to represent the relationship between multiple transaction requests.

[0045] In some implementations, the transaction graph is a dynamic knowledge network maintained in a graph database, used to represent the relationships between multiple transaction requests. For example, nodes in the transaction graph include: the initiating object of the transaction request (e.g., cardholder), the transaction object (e.g., merchant), the device ID of the transaction object, the network address of the transaction object, etc. Edges in the transaction graph can represent behavioral relationships such as "transaction", "login", "associated device", etc., and edges can carry weights (e.g., transaction amount, timestamp).

[0046] After extracting the target transaction information, the transaction graph is updated based on the transaction information, that is, all entities (as nodes) and relationships (as edges) involved in the transaction information are updated in the transaction graph in real time. For example, the target processing system inserts the current transaction (e.g., object A spends 1000 yuan at merchant B with a card) as a new edge into the graph, connecting nodes such as cardholder A, merchant B, device E, and IP1.

[0047] After obtaining the updated transaction graph, a first transaction risk value for the target transaction request is determined based on the updated transaction graph. For example, the first transaction risk value for the target transaction request is determined based on the correlation between transaction information and other transaction requests in the updated transaction graph.

[0048] Step S203: Determine the second transaction risk value of the target transaction request based on the transaction information and the transaction behavior sequence of the target object to which the target transaction request belongs.

[0049] The target object of the target transaction request is also the object that initiated the target transaction request, such as the cardholder who initiated the target transaction request. The transaction behavior sequence of the target object refers to the sequence of transaction information formed by arranging the target object's past N transactions (e.g., the most recent 50 transactions) in chronological order. The transaction information sequence can be used to represent the target object's transaction habits.

[0050] The target processing system can determine the second transaction risk value of a target transaction request based on transaction information and the transaction behavior sequence of the target object. Optionally, the level of the second transaction risk value can be determined based on the degree of matching between the transaction information and the transaction behavior sequence. For example, the system can statistically analyze the differences between the transaction information and the transaction behavior sequence (e.g., differences in amount, transaction time, network address), and determine the second transaction risk value based on the degree of these differences. For instance, if a user who usually buys coffee at a convenience store every morning for 10-30 yuan suddenly spends 8,000 yuan at a high-end store using a foreign debit card at 3 a.m., even if the merchant is not previously recorded on any violation list, this transaction is still considered abnormal, and therefore the second transaction risk value of this purchase can be determined to be high.

[0051] For example, the transaction information and transaction behavior sequence are input into the corresponding second risk indicator calculation model. The transaction information and transaction behavior sequence are processed by the second risk indicator calculation model to obtain the second transaction risk value.

[0052] Step S204: Determine target information based on the first transaction risk value, the second transaction risk value, and the transaction information, wherein the target information represents the transaction risk level of the target transaction request.

[0053] After determining the first and second transaction risk values, the first and second transaction risk values ​​and transaction information can be concatenated into a fusion feature vector. The fusion feature vector is then input into the third risk indicator calculation model to determine the target information.

[0054] In this embodiment, by updating the transaction graph based on transaction information and determining a first transaction risk value based on the updated graph, it is helpful to dynamically identify organized violations hidden behind complex transaction networks using graph computing technology, overcoming the detection blind spots when analyzing single transaction information. By determining a second transaction risk value based on transaction information and the transaction behavior sequence of the target object, it is helpful to dynamically identify the anomalies of the current transaction based on the target object's historical behavior. Therefore, when determining target information based on the first and second transaction risk values ​​and transaction information, a combination of two-dimensional dynamic analysis and the transaction information itself is achieved to determine the transaction risk level, thereby improving the accuracy of transaction risk detection.

[0055] Therefore, the method provided in this application achieves the goal of combining two-dimensional dynamic analysis and transaction information itself to detect transaction risks, thereby improving the technical accuracy of transaction risk detection and solving the technical problem of low detection accuracy in related technologies that are based on preset static rules for transaction risk detection.

[0056] Optionally, in the transaction risk detection method provided in this application embodiment, determining the first transaction risk value of the target transaction request based on the updated transaction graph includes: identifying the transaction merchant from the transaction information; determining the first sub-risk value based on the abnormal proportion of transaction requests associated with the transaction merchant in the updated transaction graph; determining the second sub-risk value based on the path distance between the target object and the risky merchant in the updated transaction graph; determining the third sub-risk value based on the knowledge graph community to which the transaction information belongs in the updated transaction graph; and determining the first transaction risk value based on at least one of the first sub-risk value, the second sub-risk value, and the third sub-risk value.

[0057] The transaction merchant is the transaction object of the target transaction request. For example, the transaction merchant is the entity merchant that initiates the collection of payment in the target transaction request.

[0058] In some implementations, a first sub-risk value is determined based on the abnormal proportion of transaction requests associated with the merchant in the updated transaction graph. For example, in the updated transaction graph, the target processing system uses the current merchant as the root node and queries all its inbound edges (i.e., cardholder-merchant transactions) over a past period (e.g., the past month) to obtain all associated cardholder IDs. It then calculates the proportion of these cardholders whose accounts are marked as abnormal or high-risk. The first sub-risk value is determined based on this proportion. Alternatively, the target processing system may have a pre-defined correspondence between different proportion ranges and sub-risk values; the sub-risk value corresponding to the proportion range to which the current proportion belongs is determined as the first sub-risk value. Another example is simply determining the proportion value directly as the first sub-risk value.

[0059] In some implementations, a second sub-risk value is determined based on the path distance between the target object and the risky merchant in the updated transaction graph. Here, a risky merchant refers to a merchant that has been historically identified as violating regulations. For example, in the updated transaction graph, the target processing system performs a breadth-first search, starting with the current cardholder (i.e., the target object) and ending with all risky merchants, to calculate the shortest path hops (i.e., the shortest path distance) between the current cardholder and the nearest risky merchant. If no path exists, the path distance is infinite, and the second sub-risk value is 0; if the path distance is 1 (i.e., the cardholder directly made a purchase at the risky merchant), the second sub-risk value is 0.9; if the path distance is 2 (linked through an intermediary account), the second sub-risk value is 0.6; and if the distance is greater than or equal to 3, the second sub-risk value is 0.2. Path distance refers to the number of hops between the current cardholder (target object) and known risky merchant nodes in the transaction graph, connected by transaction edges.

[0060] In some implementations, a third sub-risk value is determined based on the knowledge graph community to which the transaction information belongs in the updated transaction graph. Here, a knowledge graph community refers to a subset of nodes in the transaction graph that has tight internal connections and sparse external connections, automatically discovered through graph clustering algorithms. For example, a knowledge graph is composed of entities such as cardholders, merchants, devices, and network addresses, reflecting real-world behavioral groups. For instance, in the updated transaction graph, the target processing system, centered on the current transaction merchant, extracts a local subgraph composed of its first- and second-degree neighbors within a certain time window (e.g., the past month) based on timestamps. A real-time community discovery algorithm is then used to divide the local subgraph into communities, obtaining the knowledge graph community to which the current transaction information belongs. After obtaining the knowledge graph community, risk characteristics of the knowledge graph community can be statistically analyzed. For example, the percentage of newly registered merchants within the knowledge graph community (e.g., registration time < 7 days) and cardholder transaction frequency (e.g., average number of transactions per minute > 5) can be statistically analyzed. The third sub-risk value is then determined based on these risk characteristics. For example, there is a correspondence between the feature value range of each risk feature and the sub-risk value. The target processing system determines the sub-risk value of each risk feature based on the feature value range of each risk feature in the knowledge graph community and the aforementioned correspondence. Then, the sub-risk values ​​of each risk feature are weighted and summed to obtain the third sub-risk value.

[0061] After determining the first sub-risk value, the second sub-risk value, and the third sub-risk value, the first transaction risk value is determined based on at least one of the first sub-risk value, the second sub-risk value, and the third sub-risk value.

[0062] For example, the first transaction risk value can be obtained by weighted summation or averaging of the first, second, and third sub-risk values.

[0063] For example, the first sub-risk value, the second sub-risk value, and the third sub-risk value are input into the first risk indicator calculation model, and the first transaction risk value is determined through the first risk indicator calculation model.

[0064] It should be noted that by determining the first transaction risk value based on the triple sub-risk dimension, an interpretable and multi-perspective quantitative assessment of network risk in the transaction image is achieved, thereby improving the accuracy of the determined first transaction risk value.

[0065] Optionally, in the transaction risk detection method provided in this application embodiment, determining the first transaction risk value based on at least one of the first sub-risk value, the second sub-risk value, and the third sub-risk value includes: obtaining a first risk indicator calculation model; and processing the first sub-risk value, the second sub-risk value, and the third sub-risk value through the first risk indicator calculation model to obtain the first transaction risk value.

[0066] Optionally, the first risk indicator calculation model is a machine learning model, for example, a convolutional neural network model, or a deep neural network model based on a self-attention mechanism. Optionally, the first risk indicator calculation model can be trained using a first training sample set, where the training samples in the first training sample set are the first sub-risk value, the second sub-risk value, and the third sub-risk value of the sample transaction request, and the true label of the training samples indicates whether the sample transaction request has transaction risk.

[0067] The target processing system can input the first sub-risk value, the second sub-risk value, and the third sub-risk value into the first risk indicator calculation model to obtain the first transaction risk value output by the first risk indicator calculation model.

[0068] It should be noted that using the first risk indicator calculation model to determine the first risk transaction value helps to identify the nonlinear synergistic relationship between sub-risks, thereby improving the accuracy of determining the first risk transaction value.

[0069] Optionally, in the transaction risk detection method provided in this application embodiment, before determining the second transaction risk value of the target transaction request based on the transaction information and the transaction behavior sequence of the target object to which the target transaction request belongs, the method further includes: extracting multiple historical transaction information from multiple historical transaction requests of the target object; sorting the multiple historical transaction information in chronological order to obtain the transaction behavior sequence of the target object.

[0070] In some implementations, historical transaction information for each historical transaction request is extracted. The method for extracting historical transaction information from historical transaction requests is the same as the method for extracting transaction information from target transaction requests, so it will not be described again here.

[0071] In some implementations, multiple historical transaction requests are the M most recent transactions of the target object, where M is a preset value.

[0072] In some implementations, multiple historical transaction requests are transactions that occurred within a preset historical time range for the target object. The preset historical time range may be the most recent month, the most recent week, etc.

[0073] After extracting multiple historical transaction records, these records are sorted chronologically to obtain a sequence of transaction behaviors for the target object. For example, after extracting the historical transaction information, the timestamp field of each record is parsed and globally sorted chronologically. For instance, the first item in the transaction behavior sequence is a convenience store purchase (28 yuan) at 08:35 on March 10, 2025; the second item is a takeout order (62 yuan) at 12:10 on March 9, 2025; and so on, with the 50th item being a gas station top-up (300 yuan) at 17:45 on February 15, 2025. This sequence is encapsulated as an ordered list, bound to the user profile of the target object, and continuously updated as new transactions occur (new transactions are added, and the oldest transactions are removed). Historical transaction information effectively reflects the historical transaction characteristics (i.e., historical transaction behaviors) of the target object.

[0074] It should be noted that sorting the historical transaction information of the target object to obtain a transaction behavior sequence can improve the accuracy of the transaction behavior sequence.

[0075] Optionally, in the transaction risk detection method provided in this application embodiment, determining the second transaction risk value of the target transaction request based on transaction information and the transaction behavior sequence of the target object to which the target transaction request belongs includes: obtaining a second risk indicator calculation model; and processing the transaction information and transaction behavior sequence through the second risk indicator calculation model to obtain the second transaction risk value.

[0076] Optionally, the second risk indicator calculation model is a machine learning model, such as a convolutional neural network model or a deep neural network model based on a self-attention mechanism. Optionally, the second risk indicator calculation model can be trained using a second training sample set. The training samples in the second training sample set consist of sample transaction information of sample transaction requests and the corresponding sequence of sample transaction behaviors. The true labels of the training samples indicate whether the sample transaction request carries transaction risk.

[0077] The target processing system can input transaction information and transaction behavior sequences into the second risk indicator calculation model to obtain the second transaction risk value output by the second risk indicator calculation model. For example, the second risk indicator calculation model can calculate the degree of matching between the transaction information and the transaction behavior sequence of the target object, and output an individual anomaly score (i.e., the second transaction risk value).

[0078] It should be noted that by using the second risk indicator calculation model to determine the second risk transaction value, the individual anomaly detection based on thresholds or rules in related technologies is transformed into behavioral semantic understanding based on deep learning, which helps to improve the accuracy of determining the second transaction risk value.

[0079] Optionally, in the transaction risk detection method provided in this application embodiment, determining target information based on a first transaction risk value, a second transaction risk value, and transaction information includes: processing the first transaction risk value, the second transaction risk value, and transaction information through a third risk index calculation model to obtain a target transaction risk value; and determining target information based on the target transaction risk value.

[0080] Optionally, the third risk indicator calculation model is a machine learning model, such as a convolutional neural network model, a deep neural network model based on a self-attention mechanism, or a gradient boosting decision tree model. Optionally, the third risk indicator calculation model can be trained using a third training sample set. The training samples in the third training sample set include the first transaction risk value, the second transaction risk value, and the transaction information of the sample transaction request. The true label of the training samples indicates whether the sample transaction request carries transaction risk.

[0081] The target processing system can input the first transaction risk value, the second transaction risk value, and transaction information into the third risk indicator calculation model to obtain the target information output by the third risk indicator calculation model. For example, the first transaction risk value, the second transaction risk value, and the transaction information are concatenated to obtain a fused feature vector. Then, the third risk indicator calculation model, which uses a gradient boosting decision tree architecture, processes the fused feature vector to generate a comprehensive risk score between 0 and 100. This comprehensive risk score, i.e., the target information, is used to represent the transaction risk level of the target transaction request. For example, a score of 0-30 indicates low risk, a score of 31-60 indicates low to medium risk, a score of 61-85 indicates medium to high risk, and a score of 86-100 indicates high risk.

[0082] It should be noted that by using the third risk indicator calculation model to determine the target information, an effective comprehensive judgment of the first transaction risk value, the second transaction risk value, and transaction information is achieved, thereby improving the accuracy of the determined target information.

[0083] Optionally, in the transaction risk detection method provided in this application embodiment, after determining the target information based on the first transaction risk value, the second transaction risk value, and the transaction information, the method further includes: obtaining a preset mapping relationship table, wherein the mapping relationship table is used to record the mapping relationship between different transaction risk levels and different request processing flows; determining the target request processing flow corresponding to the transaction risk level represented by the target information based on the mapping relationship table; and processing the target transaction request based on the target request processing flow.

[0084] In some implementations, the mapping table is a structured policy configuration table that can be stored in the configuration center or memory cache of the target processing system. Each row in the mapping table corresponds to a mapping relationship between a transaction risk level (e.g., low risk, high risk) and a predefined request processing flow (e.g., direct authorization, triggering secondary verification, real-time blocking, etc.). For example, the mapping relationship between different transaction risk levels and different request processing flows can be as follows:

[0085] 1. Rating 0-30 (Low Risk): Direct authorization approved.

[0086] 2. Rating 31-60 (Low to Medium Risk): The transaction is approved, but the event is recorded in the risk watchlist for subsequent analysis.

[0087] 3. Score 61-85 (Medium-High Risk): Triggers verification process. The target individual is required to complete secondary identity verification via app push notifications, SMS, or voice. Successful verification grants access; failure results in blocking.

[0088] 4. Score 86-100 (High Risk): Block the target transaction request and simultaneously trigger the customer service system to make a manual outbound call for confirmation.

[0089] The target processing system can determine the target request processing flow corresponding to the transaction risk level represented by the target information based on the mapping table. After determining the target request processing flow, the target transaction request is processed based on the target request processing flow.

[0090] In some implementations, the results of all intervention actions (e.g., secondary verification, manual outbound calls) (e.g., secondary verification results, customer service confirmation results) are collected and labeled through a feedback loop to perform regular incremental training or online learning on relevant machine learning models (e.g., first risk indicator calculation model, second risk indicator calculation model, third risk indicator calculation model), enabling the target processing system to continuously evolve and adapt to new violation patterns.

[0091] It should be noted that by pre-setting a mapping relationship table, the abstract risk score is transformed into clear and executable business operation instructions, which enables targeted processing of target processing requests based on risk level, thereby improving the reliability of risk handling.

[0092] In an optional embodiment, Figure 3 This is a schematic diagram of a transaction risk detection method provided according to an embodiment of this application. Figure 3 An optional application process of this embodiment will be described by way of example. For example... Figure 3As shown, upon receiving a target transaction request, the target processing system extracts transaction information from the request, updates the transaction graph based on this information, processes the updated graph to obtain a first transaction risk value, and then performs behavioral anomaly detection based on the transaction information and the transaction behavior sequence of the target object to which the target transaction request belongs, obtaining a second transaction risk value. After obtaining the second transaction risk value, the system determines the target information based on the first and second transaction risk values ​​and the transaction information. Subsequently, targeted request processing is performed based on the target information, and the results of intervention actions are obtained for feedback learning.

[0093] Therefore, the method provided in this application achieves the goal of combining two-dimensional dynamic analysis and transaction information itself to detect transaction risks, thereby improving the technical accuracy of transaction risk detection and solving the technical problem of low detection accuracy in related technologies that are based on preset static rules for transaction risk detection.

[0094] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0095] Example 2

[0096] This application also provides a transaction risk detection device. It should be noted that the transaction risk detection device of this application can be used to execute the transaction risk detection method provided in this application. The transaction risk detection device provided in this application is described below.

[0097] According to an embodiment of this application, an apparatus for implementing the above-described method for detecting transaction risks is also provided, such as... Figure 4 As shown, the device includes:

[0098] The first extraction module 401 is used to extract transaction information from the target transaction request upon receiving the target transaction request.

[0099] The first determining module 402 is used to update the transaction graph according to the transaction information and determine the first transaction risk value of the target transaction request according to the updated transaction graph, wherein the transaction graph is used to represent the relationship between multiple transaction requests;

[0100] The second determining module 403 is used to determine the second transaction risk value of the target transaction request based on the transaction information and the transaction behavior sequence of the target object to which the target transaction request belongs;

[0101] The third determining module 404 is used to determine target information based on the first transaction risk value, the second transaction risk value, and the transaction information, wherein the target information represents the transaction risk level of the target transaction request.

[0102] In this embodiment, by updating the transaction graph based on transaction information and determining a first transaction risk value based on the updated graph, it is helpful to dynamically identify organized violations hidden behind complex transaction networks using graph computing technology, overcoming the detection blind spots when analyzing single transaction information. By determining a second transaction risk value based on transaction information and the transaction behavior sequence of the target object, it is helpful to dynamically identify the anomalies of the current transaction based on the target object's historical behavior. Therefore, when determining target information based on the first and second transaction risk values ​​and transaction information, a combination of two-dimensional dynamic analysis and the transaction information itself is achieved to determine the transaction risk level, thereby improving the accuracy of transaction risk detection.

[0103] Therefore, the method provided in this application achieves the goal of combining two-dimensional dynamic analysis and transaction information itself to detect transaction risks, thereby improving the technical accuracy of transaction risk detection and solving the technical problem of low detection accuracy in related technologies that are based on preset static rules for transaction risk detection.

[0104] Optionally, in the transaction risk detection device provided in this application embodiment, the first determining module further includes: a first determining submodule, used to determine the transaction merchant from the transaction information; a second determining submodule, used to determine a first sub-risk value based on the abnormal proportion of transaction requests associated with the transaction merchant in the updated transaction graph; a third determining submodule, used to determine a second sub-risk value based on the path distance between the target object and the risky merchant in the updated transaction graph; a fourth determining submodule, used to determine a third sub-risk value based on the knowledge graph community to which the transaction information in the updated transaction graph belongs; and a fifth determining submodule, used to determine a first transaction risk value based on at least one of the first sub-risk value, the second sub-risk value, and the third sub-risk value.

[0105] Optionally, in the transaction risk detection device provided in this application embodiment, the fifth determining submodule further includes: an acquisition unit for acquiring a first risk index calculation model; and a processing unit for processing the first sub-risk value, the second sub-risk value, and the third sub-risk value through the first risk index calculation model to obtain a first transaction risk value.

[0106] Optionally, in the transaction risk detection device provided in this application embodiment, the transaction risk detection device further includes: a second extraction module, used to extract multiple historical transaction information from multiple historical transaction requests of the target object; and a first processing module, used to sort the multiple historical transaction information in chronological order to obtain a transaction behavior sequence of the target object.

[0107] Optionally, in the transaction risk detection device provided in this application embodiment, the second determining module further includes: an acquisition submodule, used to acquire a second risk index calculation model; and a first processing submodule, used to process the transaction information and transaction behavior sequence through the second risk index calculation model to obtain a second transaction risk value.

[0108] Optionally, in the transaction risk detection device provided in this application embodiment, the third determining module further includes: a second processing submodule, used to process the first transaction risk value, the second transaction risk value and the transaction information through a third risk index calculation model to obtain a target transaction risk value; and a sixth determining submodule, used to determine target information based on the target transaction risk value.

[0109] Optionally, in the transaction risk detection device provided in this application embodiment, the transaction risk detection device further includes: an acquisition module, used to acquire a preset mapping relationship table, wherein the mapping relationship table is used to record the mapping relationship between different transaction risk levels and different request processing flows; a fourth determination module, used to determine the target request processing flow corresponding to the transaction risk level represented by the target information according to the mapping relationship table; and a second processing module, used to process the target transaction request based on the target request processing flow.

[0110] It should be noted that the first extraction module 401, the first determination module 402, the second determination module 403, and the third determination module 404 mentioned above correspond to steps S201 to S204 in Embodiment 1. The four modules and their corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed in Embodiment 1. It should be noted that the above modules or units can be hardware or software components stored in memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). The above modules can also be part of a device and run in the computer terminal 10 provided in Embodiment 1.

[0111] Example 3

[0112] Embodiments of this application may provide an electronic device. Figure 5 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 5 As shown, the electronic device may include: one or more ( Figure 5 (Only one is shown) Processor 1002, memory 1004, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0113] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the methods and apparatus in the embodiments of this application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby implementing the above-described methods. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0114] The processor can invoke information and applications stored in the memory via a transmission device to perform the following steps: upon receiving a target transaction request, extracting transaction information from the target transaction request; updating the transaction graph based on the transaction information, and determining a first transaction risk value for the target transaction request based on the updated transaction graph, wherein the transaction graph is used to represent the correlation between multiple transaction requests; determining a second transaction risk value for the target transaction request based on the transaction information and the transaction behavior sequence of the target object to which the target transaction request belongs; and determining target information based on the first transaction risk value, the second transaction risk value, and the transaction information, wherein the target information represents the transaction risk level of the target transaction request.

[0115] The processor can also invoke information and applications stored in the memory via a transmission device to perform the following steps: identifying the trading merchant from the transaction information; determining a first sub-risk value based on the abnormal proportion of transaction requests associated with the trading merchant in the updated transaction graph; determining a second sub-risk value based on the path distance between the target object and the risky merchant in the updated transaction graph; determining a third sub-risk value based on the knowledge graph community to which the transaction information belongs in the updated transaction graph; and determining a first transaction risk value based on at least one of the first, second, and third sub-risk values.

[0116] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: obtain the first risk indicator calculation model; process the first sub-risk value, the second sub-risk value, and the third sub-risk value through the first risk indicator calculation model to obtain the first transaction risk value.

[0117] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: before determining the second transaction risk value of the target transaction request based on the transaction information and the transaction behavior sequence of the target object to which the target transaction request belongs, extract multiple historical transaction information from multiple historical transaction requests of the target object; sort the multiple historical transaction information in chronological order to obtain the transaction behavior sequence of the target object.

[0118] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: obtain the second risk indicator calculation model; process the transaction information and transaction behavior sequence through the second risk indicator calculation model to obtain the second transaction risk value.

[0119] The processor can also call the information and application programs stored in the memory through the transmission device to perform the following steps: process the first transaction risk value, the second transaction risk value and the transaction information through the third risk index calculation model to obtain the target transaction risk value; determine the target information based on the target transaction risk value.

[0120] The processor can also call the information and application stored in the memory through the transmission device to perform the following steps: after determining the target information based on the first transaction risk value, the second transaction risk value and the transaction information, obtain a preset mapping table, wherein the mapping table is used to record the mapping relationship between different transaction risk levels and different request processing flows; determine the target request processing flow corresponding to the transaction risk level represented by the target information based on the mapping table; and process the target transaction request based on the target request processing flow.

[0121] Those skilled in the art will understand that Figure 5 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 5 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 5 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 5 The different configurations shown.

[0122] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0123] Example 4

[0124] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the transaction risk detection method provided in Embodiment 1.

[0125] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0126] This application also provides a computer program product, which, when executed on a data processing device, is suitable for performing steps of a method for detecting transaction risks.

[0127] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0128] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0129] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0130] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0131] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0132] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0133] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for detecting transaction risk, characterized in that, include: Upon receiving a target transaction request, transaction information is extracted from the target transaction request; The transaction graph is updated based on the transaction information, and a first transaction risk value for the target transaction request is determined based on the updated transaction graph, wherein the transaction graph is used to represent the correlation between multiple transaction requests; Based on the transaction information and the transaction behavior sequence of the target object to which the target transaction request belongs, a second transaction risk value for the target transaction request is determined; Target information is determined based on the first transaction risk value, the second transaction risk value, and the transaction information, wherein the target information represents the transaction risk level of the target transaction request.

2. The method according to claim 1, characterized in that, Determining the first transaction risk value of the target transaction request based on the updated transaction graph includes: Identify the trading merchants from the transaction information; The first sub-risk value is determined based on the abnormal proportion of transaction requests associated with the merchant in the updated transaction graph. The second sub-risk value is determined based on the path distance between the target object and the risky merchant in the updated transaction graph. The third sub-risk value is determined based on the knowledge graph community to which the transaction information in the updated transaction graph belongs. The first transaction risk value is determined based on at least one of the first sub-risk value, the second sub-risk value, and the third sub-risk value.

3. The method according to claim 2, characterized in that, Determining the first transaction risk value based on at least one of the first sub-risk value, the second sub-risk value, and the third sub-risk value includes: Obtain the calculation model for the first risk indicator; The first transaction risk value is obtained by processing the first sub-risk value, the second sub-risk value, and the third sub-risk value using the first risk indicator calculation model.

4. The method according to claim 1, characterized in that, Before determining the second transaction risk value of the target transaction request based on the transaction information and the transaction behavior sequence of the target object to which the target transaction request belongs, the method further includes: Extract multiple historical transaction information from multiple historical transaction requests of the target object; The multiple historical transaction information are sorted in chronological order to obtain the transaction behavior sequence of the target object.

5. The method according to claim 1, characterized in that, Based on the transaction information and the transaction behavior sequence of the target object to which the target transaction request belongs, a second transaction risk value for the target transaction request is determined, including: Obtain the calculation model for the second risk indicator; The transaction information and the sequence of transaction behaviors are processed by the second risk indicator calculation model to obtain the second transaction risk value.

6. The method according to claim 1, characterized in that, The target information is determined based on the first transaction risk value, the second transaction risk value, and the transaction information, including: The first transaction risk value, the second transaction risk value, and the transaction information are processed by the third risk indicator calculation model to obtain the target transaction risk value; The target information is determined based on the target transaction risk value.

7. The method according to claim 1, characterized in that, After determining the target information based on the first transaction risk value, the second transaction risk value, and the transaction information, the method further includes: Obtain a preset mapping table, wherein the mapping table is used to record the mapping relationship between different transaction risk levels and different request processing procedures; Based on the mapping table, determine the target request processing flow corresponding to the transaction risk level represented by the target information; The target transaction request is processed based on the target request processing flow.

8. A device for detecting transaction risk, characterized in that, include: The first extraction module is used to extract transaction information from the target transaction request upon receiving the target transaction request; The first determining module is used to update the transaction graph according to the transaction information and determine the first transaction risk value of the target transaction request according to the updated transaction graph, wherein the transaction graph is used to represent the correlation between multiple transaction requests; The second determining module is used to determine the second transaction risk value of the target transaction request based on the transaction information and the transaction behavior sequence of the target object to which the target transaction request belongs; The third determining module is used to determine target information based on the first transaction risk value, the second transaction risk value, and the transaction information, wherein the target information represents the transaction risk level of the target transaction request.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored executable program, wherein, when the executable program is executed, it controls the device on which the computer-readable storage medium is located to perform the transaction risk detection method according to any one of claims 1 to 7.

10. An electronic device, characterized in that, include: Memory, which stores executable programs; A processor for running the program, wherein the program, when running, executes the transaction risk detection method according to any one of claims 1 to 7.

11. A computer program product comprising computer instructions, characterized in that, When the computer instructions are executed by the processor, they implement the steps of the transaction risk detection method according to any one of claims 1 to 7.

Images