CN106803168A - A kind of abnormal transfer accounts method for detecting and device - Google Patents

Abstract

Embodiments of the present invention relate to the field of Internet finance, and in particular to a method and device for detecting abnormal transfer transactions, which are used to detect transfer transactions and issue abnormal warnings. In the embodiment of the present invention, the transfer transaction information is obtained, and the transfer transaction information includes the information of the transfer party; according to the information of the transfer party, the abnormal transfer detection model of the transfer party is determined, and the abnormal transfer detection model is based on the social attributes of the transfer party and the historical behavior attributes of the transferor; input the transfer transaction information into the abnormal transfer detection model of the transferor, and obtain the abnormal probability value of the transfer transaction information, so that when the user initiates the transfer transaction, the user's transfer transaction Detect and issue anomaly warnings.

Description

An abnormal transfer detection method and device

technical field

The embodiments of the present invention relate to the field of Internet finance, and in particular to a method and device for detecting abnormal transfers.

Background technique

With the advent of Internet finance and the era of big data, users can realize non-cash transfer transactions through the Internet and other means. Since the Internet is an open network, the online banking system also opens the bank to the Internet. Therefore, how to ensure the security of non-cash transfer transactions is a crucial issue in the era of Internet finance and big data. It is related to the security of the entire Internet finance, and it is also an important issue that banks need to consider to ensure the safety of users' funds.

In the existing abnormal transfer transaction detection technology, a commonly used method is to improve the security authentication mechanism when the user conducts the transfer transaction. However, these methods will bring additional verification operations to the user, increase the delay of the transfer transaction, reduce the customer experience, make the transaction message too complicated, and increase the processing time of the server; Relationship Establishment of user relationship network to detect abnormal transfer transactions, but this method can only establish a relationship network when there are historical transfer records between users. If there is no historical transfer record between users, it is more difficult to build a relationship network.

To sum up, the existing abnormal transfer transaction detection technology has the problem of transfer transaction delay, and if there is no historical transfer record between users, it is difficult to build a user relationship network. Therefore, it is necessary to propose an effective method to solve the above problems.

Contents of the invention

The embodiments of the present invention provide a method and device for detecting abnormal transfers, which are used to solve the problems in the prior art that transfer transactions are delayed, and if there is no historical transfer record between users, it is difficult to build a relationship network.

An embodiment of the present invention provides a method for detecting abnormal transfers, including:

Obtain transfer transaction information, which includes transferor information;

According to the information of the transferer, determine the abnormal transfer detection model of the transferer, and the abnormal transfer detection model is obtained according to the social attributes of the transferer and the historical behavior attributes of the transferer;

Input the transfer transaction information into the abnormal transfer detection model of the transferor, and obtain the abnormal probability value of the transfer transaction information.

Optionally, the abnormal transfer detection model is obtained based on the social attributes of the transferor and the historical behavior attributes of the transferor, including:

The social attributes of the transfer-out party include the transfer-out party's own attributes and the interaction attributes obtained from social networks;

The historical behavior attributes of the transferor include the payment behavior attributes of the transferor;

Determine the user relationship network of the transfer party according to its own attributes, interaction attributes and payment behavior attributes;

Based on the positive and negative samples of historical transfer transactions and the user relationship network, a machine learning algorithm is used to establish an abnormal transfer detection model for the transfer party.

Optionally, input the transfer transaction information into the transferor's abnormal transfer detection model to obtain the abnormal probability value of the transfer transaction information, including:

Input the transfer transaction information into the abnormal transfer detection model of the transferor, and obtain the abnormal probability value of its own attribute, the abnormal probability value of the interaction attribute and the abnormal probability value of the payment behavior attribute of the transfer transaction information;

According to the abnormal probability value of the own attribute, the abnormal probability value of the interaction attribute and the abnormal probability value of the payment behavior attribute, the abnormal probability value of the transfer transaction information is obtained.

Optionally, based on the positive and negative samples of historical transfer transactions and the user relationship network, a machine learning algorithm is used to establish an abnormal transfer detection model for the transferor, including:

Carry out correlation analysis on the user's own attributes, interaction attributes and payment behavior attributes in the user relationship network;

Delete irrelevant attributes from the user relationship network to obtain a revised user relationship network; based on the positive and negative samples of historical transfer transactions and the revised user relationship network, a machine learning algorithm is used to establish an abnormal transfer detection model for the transfer party.

Optionally, the own attributes include at least one of the following: identity information indicators, education level indicators, occupational status indicators, family status indicators, and social information indicators;

The payment behavior attributes include at least one of the following: transfer frequency index, transfer time distribution index, transfer location distribution index, transfer amount distribution index, transfer method proportion index;

The interaction attribute includes at least one of the following: friend frequency index, contact frequency index, and favorability index.

An embodiment of the present invention also provides an abnormal transfer detection device, including:

Acquisition unit: used to obtain transfer transaction information, which includes transferor information;

Determination unit: used to determine the abnormal transfer detection model of the transferer based on the information of the transferer. The abnormal transfer detection model is obtained according to the social attributes of the transferer and the historical behavior attributes of the transferer;

Calculation unit: it is used to input the transfer transaction information into the abnormal transfer detection model of the transfer party, and obtain the abnormal probability value of the transfer transaction information.

Optionally, the social attributes of the transfer-out party include the transfer-out party's own attributes and interaction attributes obtained from social networks;

The historical behavior attributes of the transferor include the payment behavior attributes of the transferor;

Identify units specifically for:

Determine the user relationship network of the transfer party according to its own attributes, interaction attributes and payment behavior attributes;

Based on the positive and negative samples of historical transfer transactions and the user relationship network, a machine learning algorithm is used to establish an abnormal transfer detection model for the transfer party.

Optionally, the computing unit is specifically used for:

Input the transfer transaction information into the abnormal transfer detection model of the transferor, and obtain the abnormal probability value of its own attribute, the abnormal probability value of the interaction attribute and the abnormal probability value of the payment behavior attribute of the transfer transaction information;

According to the abnormal probability value of the own attribute, the abnormal probability value of the interaction attribute and the abnormal probability value of the payment behavior attribute, the abnormal probability value of the transfer transaction information is obtained.

Optionally, the determining unit is also specifically used for:

Carry out correlation analysis on the user's own attributes, interaction attributes and payment behavior attributes in the user relationship network;

Delete irrelevant attributes from the user relationship network to obtain a revised user relationship network; based on the positive and negative samples of historical transfer transactions and the revised user relationship network, a machine learning algorithm is used to establish an abnormal transfer detection model for the transfer party.

Optionally, the own attributes include at least one of the following: identity information indicators, education level indicators, occupational status indicators, family status indicators, and social information indicators;

The payment behavior attributes include at least one of the following: transfer frequency index, transfer time distribution index, transfer location distribution index, transfer amount distribution index, transfer method proportion index;

The interaction attribute includes at least one of the following: friend frequency index, contact frequency index, and favorability index.

The embodiment of the present invention provides an abnormal account transfer detection method and device, which acquires the account transfer transaction information, and the account transfer transaction information includes the information of the transferor; according to the transferer information, the abnormal account transfer detection model of the transferer is determined, and The transfer detection model is obtained based on the social attributes of the transferer and the historical behavior attributes of the transferer; the transfer transaction information is input into the abnormal transfer detection model of the transferer to obtain the abnormal probability value of the transfer transaction information. In the embodiment of the present invention, first obtain the transfer transaction information; then determine the abnormal transfer detection model of the transfer party according to the transfer transaction information, wherein the abnormal transfer detection model is based on the social attributes of the transfer party and the historical behavior of the transfer party The attribute is obtained, which is convenient for the abnormal transfer detection system to detect and identify the transfer transaction. Since the social attributes and historical behavior attributes are diversified, there is no need for the user to perform additional security verification operations, thereby reducing the delay of the transfer transaction. During the transfer record, it is also possible to detect whether there is an abnormal transfer through social attributes, thereby improving the coverage and accuracy of abnormal transfer detection; finally, the transfer transaction information is input into the abnormal transfer detection model of the transfer party to obtain the transfer transaction information The abnormal probability value can detect the user's transfer transaction and issue an abnormal warning.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings that need to be used in the description of the embodiments.

FIG. 1 provides a schematic diagram of the overall architecture of an abnormal transfer detection system according to an embodiment of the present invention;

Fig. 2 provides a schematic flow chart of an abnormal transfer detection method according to an embodiment of the present invention;

Fig. 3 is a schematic diagram of the comprehensive abnormal probability provided by the embodiment of the present invention;

FIG. 4 provides a schematic diagram of a user relationship network according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of an abnormal transfer detection device provided by an embodiment of the present invention.

detailed description

In order to make the object, technical solution and beneficial effects of the present invention more clear, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention.

In order to better understand this solution, the abnormal transfer detection system in the technical solution of the present invention is designed. The designed abnormal transfer detection system is described below. The overall architecture of the abnormal transfer detection system is shown in Figure 1 below. :

Figure 1 exemplarily shows a schematic diagram of the overall architecture of an abnormal transfer detection system provided by an embodiment of the present invention, as shown in Figure 1, including a data acquisition module, a database module, a user relationship network establishment module, and abnormal transfer detection model training module, abnormal transfer detection module, wherein the database module includes its own attribute database, payment behavior attribute database, and interactive attribute database, and the abnormal transfer detection model training module is connected to the background transaction system. Then, the design idea of the overall architecture of the abnormal transfer detection system is as follows: the data acquisition module collects the user's own attribute data, payment behavior attribute data and interaction attribute data, and stores them in its own attribute database, payment behavior attribute database and interaction attribute respectively In the database; the user relationship network establishment module establishes a three-dimensional user relationship network according to the data of the self-attribute database, the payment behavior attribute database and the interaction attribute database, wherein the three dimensions refer to the self-attribute dimension and the payment behavior attribute dimension and interaction attribute dimensions; the abnormal transfer detection model training module obtains the positive and negative samples of the user's historical transfer transactions from the background transaction system, and uses machine learning algorithms to establish an abnormal transfer detection model based on the user's relationship network and the user's historical transfer transaction positive and negative samples , the abnormal transfer detection model is used in the abnormal transfer detection module to detect the transfer transaction and issue an abnormal warning when the user initiates the transfer transaction. In addition, the user’s relationship network in the abnormal transfer detection system is not static. The self-attribute data, payment behavior attribute data and interaction attribute data collected by the abnormal transfer detection system change with the user’s external relationship data. The abnormal transfer detection model It is also updated periodically.

The overall architecture of the designed abnormal transfer detection system has the following advantages: First, when a user initiates a transfer transaction, the diverse and huge user relationship network contains a large amount of user information, so no additional security verification operations are required for the user , thereby reducing the delay of transfer transactions. Second, when there is no transfer record between users, the user relationship network can also be established through the user's own attribute data and interactive attribute data, which solves the problem that if there is no historical transfer record between users. It is difficult to build a user relationship network. Third, establish an abnormal transfer detection model through a diverse and huge user relationship network and the positive and negative samples of users' historical transfer transactions, and use this model in the abnormal transfer detection module to improve Improve the coverage and accuracy of abnormal transfer detection.

Fig. 2 exemplarily shows a schematic flow chart of an abnormal transfer detection method provided by an embodiment of the present invention, as shown in Fig. 2 , including the following steps:

Step S101: Obtain transfer transaction information, which includes the information of the sender;

Step S102: Determine the abnormal transfer detection model of the transferer according to the information of the transferer, and the abnormal transfer detection model is obtained according to the social attributes of the transferer and the historical behavior attributes of the transferer;

Step S103: Input the transfer transaction information into the abnormal transfer detection model of the sender, and obtain the abnormal probability value of the transfer transaction information.

In the above embodiment, specifically, when a user initiates a transfer transaction, the abnormal transfer detection module in the system analyzes the initiator user A and the recipient user B of the transfer transaction, and obtains the transfer transaction information of the originator user A and the recipient user B; Input the transfer transaction information of the initiating user A and the receiving user B into the abnormal transfer detection model to obtain the abnormal probability value of the transfer transaction information. Wherein, in a specific implementation, after inputting the transfer transaction information of the initiating user A and the receiving user B into the abnormal transfer detection model, a machine learning algorithm can be used to obtain the abnormal probability value of the transfer transaction information. After obtaining the abnormal probability value of the transfer transaction information, it is possible to detect the user's transfer transaction and issue an abnormal warning. The abnormal transfer detection model is obtained based on the social attributes of the transfer party and the historical behavior attributes of the transfer party, which is convenient for the abnormal transfer detection system to detect and identify transfer transactions. Since the social attributes and historical behavior attributes are diverse, there is no need for users to Perform additional security verification operations to reduce the delay of transfer transactions. At the same time, when there is no transfer record between users, it can also detect whether there is an abnormal transfer through social attributes, thereby improving the coverage and accuracy of abnormal transfer detection.

Among them, the abnormal transfer detection model can be obtained in the following three ways:

Method 1: The abnormal transfer detection model is obtained based on the social attributes of the transferer and the historical behavior attributes of the transferer; specifically, the social attributes of the transferer and the historical behavior attributes of the transferer are used as the abnormal transfer detection model The input of the machine learning algorithm is used to realize the training of the abnormal transfer detection model. After multiple trainings, the abnormal transfer detection model is finally trained.

Method 2: Optionally, the abnormal transfer detection model is obtained based on the social attributes of the transfer party and the historical behavior attributes of the transfer party, including: the social attributes of the transfer party include the transfer party’s own attributes and the Interaction attributes; the historical behavior attributes of the transfer party include the payment behavior attributes of the transfer party; the user relationship network of the transfer party is determined according to its own attributes, interaction attributes, and payment behavior attributes; according to the positive and negative samples of historical transfer transactions and the user relationship network, The abnormal transfer detection model of the transfer party is established through machine learning algorithms; specifically, the user relationship network of the transfer party is first determined according to its own attributes, interaction attributes, and payment behavior attributes; then the positive and negative samples of historical transfer transactions and the user relationship The network is used as the input of the abnormal transfer detection model, and the machine learning algorithm is used to realize the training of the abnormal transfer detection model. After multiple trainings, the abnormal transfer detection model is finally trained.

Method 3: Optionally, based on the positive and negative samples of historical transfer transactions and the user relationship network, an abnormal transfer detection model of the transferor is established through a machine learning algorithm, including: self-attributes, interaction attributes and payment behaviors in the user relationship network Correlation analysis of attributes; delete irrelevant attributes from the user relationship network to obtain the corrected user relationship network; according to the positive and negative samples of historical transfer transactions and the corrected user relationship network, the machine learning algorithm is used to establish the transfer party’s Abnormal transfer detection model. In the specific implementation, the self-attributes, interaction attributes and payment behavior attributes in the user relationship network contain a lot of information or indicators respectively. Assuming that the self-attributes, interaction attributes and payment behavior attributes contain a total of 10,000 indicators, first of all, the 10,000 indicators are analyzed. Correlation analysis or data cleaning and screening, for example, if there is a linear relationship between indicator 1 and indicator 2, then one of indicator 1 and indicator 2 can be retained, and the other indicator can be deleted, assuming that the 10,000 indicators have been correlated or data After cleaning and screening, 1,000 indicators are finally retained; then the corrected user relationship network is obtained based on the 1,000 indicators, and the positive and negative samples of historical transfer transactions and the corrected user relationship network are used as the input of the abnormal transfer detection model. The learning algorithm trains the abnormal transfer detection model. During the training process, it can combine the positive and negative samples of historical transfer transactions to conduct index correlation analysis and then correct the user relationship network. For example, some of the 1000 indicators are positive to historical transfer transactions. Negative samples do not have any impact indicators, which can be deleted. Assuming that 500 indicators out of 1000 indicators have no impact on the positive and negative samples of historical transfer transactions, then a revised user relationship network containing 500 indicators is obtained. The corrected user relationship network and the positive and negative samples of historical transfer transactions are used as the input of the abnormal transfer detection model and the machine learning algorithm is used to train the abnormal transfer detection model, and finally the abnormal transfer detection model is trained. Among them, the historical transfer transaction The positive and negative samples are obtained by connecting the abnormal transfer detection model training module in the abnormal transfer detection system to the background transaction system. The positive and negative samples of historical transfer transactions include the normal transfer transaction records and abnormal transfer transaction records in the user's history. Among them, the first point that needs to be explained is: the user relationship network has been revised twice, and the revised user relationship network can be carried out during the training process of the abnormal transfer detection model, or in the process of abnormal transfer detection. Before the training of the model, for example, conduct correlation analysis or data cleaning and screening on the 1,000 indicators in the re-corrected user relationship network combined with the positive and negative samples of historical transfer transactions, and finally screen out 500 indicators, which will include 500 indicators. The corrected user relationship network and the positive and negative samples of historical transfer transactions are used as the input of the abnormal transfer detection model, and the machine learning algorithm is used to train the abnormal transfer detection model; the second point to be explained is: in the specific implementation, a For example, record 1 is: the transfer time is 8 am, the transfer amount is 8000, the transfer location is Shanghai, the transfer method is credit card, and the relationship with the transfer receiving user is colleague . The transfer transaction is a positive sample; the third point that needs to be explained is: in the specific implementation, if the positive and negative samples of the user's historical transfer transaction are all positive samples, then the number of historical transfer transaction records of the user can be reduced. If the user's The number of negative samples in the positive and negative samples of historical transfer transactions is far greater than the number of positive samples, so the number of historical transfer transaction records of the user can be increased.

Through the determination methods of the above three abnormal transfer detection models, it can be seen that the determination methods of the abnormal transfer detection model are characterized by diversification and flexibility; two revisions to the user relationship network are actually to correct the user relationship The network has carried out data dimensionality reduction twice, which can reduce the amount of calculation and pressure on the system, and can also clarify which indicators can have an effect on transfer transactions.

Optionally, inputting the transfer transaction information into the abnormal transfer detection model of the transfer-out party to obtain the abnormal probability value of the transfer transaction information includes: inputting the transfer transaction information into the abnormal transfer detection model of the transfer-out party to obtain the probability value of the transfer transaction information Abnormal probability value of self attribute, abnormal probability value of interaction attribute and abnormal probability value of payment behavior attribute; according to the abnormal probability value of self attribute, abnormal probability value of interaction attribute and abnormal probability value of payment behavior attribute, the abnormal probability value of transfer transaction information is obtained. Specifically, assuming that user A transfers money to user B, the abnormal transfer detection module in the abnormal transfer detection system analyzes user A and user B to obtain their indicators, and inputs the indicators into the abnormal transfer detection model to obtain three Anomaly probability values, which are respectively the anomalous probability value of own attribute, the anomalous probability value of interaction attribute and the anomalous probability value of payment behavior attribute, assuming that they are 0.3, 0.5, and 0.2 respectively, and applying appropriate weights to these three anomalous probability values, the The abnormal probability values after weighting are added together to finally generate a comprehensive abnormal probability that the transfer transaction is an abnormal transfer transaction. Assuming that the comprehensive abnormal probability is 0.25, the comprehensive abnormal probability indicates that the current transfer transaction is an abnormal risk value. If the comprehensive probability is very high, the system will directly issue an abnormal warning. Fig. 3 exemplarily shows a schematic diagram of comprehensive abnormal probability, as shown in Fig. 3 .

Optionally, the own attributes include at least one of the following: identity information indicators, education level indicators, occupational status indicators, family situation indicators, social information indicators; in specific implementation, identity information indicators can also include ID card, passport, gender, age , mobile phone number and other information that characterizes the user’s identity; education level indicators indicate the user’s cultural level; occupational status indicators reflect whether the user has a fixed and legitimate job and the frequency of job change; family status indicators include marriage and children, etc.; social information indicators include social security, Medical insurance payment status and social credit status, social credit status can be overdue bank card or overdue payment of public utilities, etc. The abnormal transfer detection system draws a portrait of the user's basic situation based on its own attribute information. For example, if the user has no fixed occupation, incomplete or false identity information, bad social information, etc., but the amount of the transfer transaction is relatively large, the abnormal probability of the transfer transaction is relatively high, regardless of whether the user is the initiator or the recipient of the transfer transaction. Higher, if the transfer may be money laundering or telecom fraud.

Payment behavior attributes include at least one of the following: transfer frequency indicators, transfer time distribution indicators, transfer location distribution indicators, transfer amount distribution indicators, and transfer method proportion indicators; Organizations, third-party payment institutions, etc., the data of payment behavior attributes include historical transfer records, historical consumption details, etc. In the historical transfer records, based on but not limited to key information such as the transfer object, transfer amount, transfer time, transfer location, transfer method, etc., where the transfer object includes account and card number, etc., the transfer object, transfer amount, transfer time, transfer location, The transfer method is used to statistically analyze the distribution of transfer objects, the corresponding transfer frequency, the distribution of user transfer amounts, the distribution of transfer time and location, and the proportion of transfer methods. In the analysis of transfer objects, the objects are sorted according to the transfer frequency from high to low; in the transfer amount, transfer time, and transfer location distribution, the user's transfer amount range and fluctuation trend over time can be analyzed, such as user transfers showing regularity Distribution and smooth fluctuation, but the current transfer amount has increased suddenly, and the transfer time is also outside the distribution, so the probability of abnormal transfer is high; analysis of the proportion of users' historical transfer methods shows that users prefer traditional channels, such as ATM , Bank counters or innovative channels such as computer terminals and mobile terminals for transfer transactions. If users often conduct transfer transactions through traditional channels, but current transfers are carried out through mobile terminals, the weight of this indicator for judging the abnormal probability of transfers will increase. In addition, in the user's historical transfer transaction data, analyze the user's consumption power index and transaction channel through the user's historical transfer transaction and consumption records from the consumption frequency, consumption amount, consumption method and other information. The consumption power index indicates the consumption level of the user, reflecting the consumption power and purchasing power of the user, that is, large or small consumption often occurs. The consumption method shows that the user prefers traditional payment methods such as POS machine card swiping or innovative payment methods such as cloud QuickPass, QR code scanning payment, etc., which in turn reflects the user's enthusiasm for mobile innovative payment.

The interaction attribute includes at least one of the following: friend frequency index, contact frequency index, and favorability index. In the specific implementation of the present invention, in addition to establishing the payment behavior attribute relationship network between users, a user interaction attribute relationship network is also established, so that even if the two parties who transfer money do not have historical transfer records, they can also judge the relationship between each other through the interaction attribute. weak. In the interaction attribute, the data includes WeChat, QQ, Weibo, email, telecom operators such as text messages or calls, online games, and even gaming data, etc. Each user will establish a complex interaction attribute relationship network. In the interactive attribute relationship network, the main indicators include a series of indicators such as friend frequency, contact frequency, and favorability, which can reflect the closeness of the user's association with other users. The friend frequency index reflects the closeness of the friend relationship between users. If both users are friends in various social software such as WeChat and QQ, the friend frequency between the users is relatively high. The contact frequency index reflects the contact frequency between users, and the contact frequency between users is mainly obtained from communication social data. Favorability index reflects the positive or negative relationship between users. Natural language analysis technology can be used to segment the user chat communication content, word frequency statistics, good and bad word analysis, etc., to obtain the favorability between users. In addition to social network applications, data such as online games and gambling can also reflect the complex relationship network of users. For example, in online games, the relationship between players in the same team can further supplement the interaction attribute network.

Since the user relationship network is determined according to its own attributes, interaction attributes, and payment behavior attributes, then, based on the above specific introductions to its own attributes, interaction attributes, and payment behavior attributes, the following introduces the network based on its own attributes, interaction attributes, and payment behavior attributes. The specific establishment process of the user relationship network includes three processes:

Self-attribute, interaction attribute and payment behavior attribute can be regarded as three dimensions of user relationship network. 1. Score the information in self-attribute, interaction attribute and payment behavior attribute: In the self-attribute dimension, the user’s identity information index , education level indicators, occupational status indicators, family status indicators, and social information indicators are judged and scored separately. If the identity information of both users of the transfer transaction is complete and true, the occupation is stable, and the social information is good, it will obviously reduce the transfer transaction. The probability of being abnormal , the scores of the user’s identity information indicators, career status indicators, and social information indicators can be lowered; in the interaction attribute dimension, by judging and scoring the friend frequency index, contact frequency index, favorability index, etc., the friend frequency Indicators, contact frequency indicators, and favorability indicators can intuitively reflect whether there is a social relationship between users, the degree of connection, and the positive or negative emotional color between users. In the interaction attribute dimension, it is found that the friend frequency between users A and B is low, there are few contacts, and there is no favorability, indicating that the social interaction attributes between users A and B are relatively weak, and user B is likely to be hacked. The friend frequency index, contact frequency index, and favorability index of the interaction attribute are scored higher; in the payment behavior attribute dimension, all transfer transactions and consumption records of the user will be deeply excavated and analyzed to obtain the density of the user's transfer object relationship, analyze user transfer transactions or consumption habits, and portray their payment portraits. The history of transfer transactions and consumption between the initiator of the current transfer transaction and the recipient user is frequent, and the transfer amount is stable and in line with the user's consumption power level, the probability of the current transfer transaction being abnormal is relatively low, and the payment behavior attribute dimension The information in the transfer can be given a lower score; on the contrary, the transfer initiator and the recipient user have no transfer transactions, and the payment relationship of the transfer recipient user is complex and irregular, and the current transfer amount is serious compared to the transfer initiator user’s spending power. If it does not match, the probability of transfer abnormality is higher. For example, the user who initiates the transfer may suffer from telecom fraud. At this time, the information in the attribute dimension of payment behavior can be given a higher score; Each weight value is generated by the score of the information; 3. With the transfer user as the central node, each weight value is the edge to form a user relationship network diagram. FIG. 4 exemplarily shows a schematic diagram of a user relationship network, as shown in FIG. 4 .

It can be seen from the above content that an abnormal transfer detection method is provided in the embodiment of the present invention, and the transfer transaction information is obtained, and the transfer transaction information includes the information of the transferor; according to the information of the transferor, the abnormal transfer of the transferor is determined The detection model, the abnormal transfer detection model is obtained according to the social attributes of the transfer party and the historical behavior attributes of the transfer party; the transfer transaction information is input into the abnormal transfer detection model of the transfer party, and the abnormal probability value of the transfer transaction information is obtained. In the embodiment of the present invention, first obtain the transfer transaction information; then determine the abnormal transfer detection model of the transfer party according to the transfer transaction information, wherein the abnormal transfer detection model is based on the social attributes of the transfer party and the historical behavior of the transfer party Attributes are obtained, which is convenient for the system to detect and identify transfer transactions. Since social attributes and historical behavior attributes are diversified, users do not need to perform additional security verification operations, thereby reducing the delay of transfer transactions. At the same time, when there is no transfer record between users It can detect whether there is an abnormal transfer, thereby improving the coverage and accuracy of abnormal transfer detection; finally, the transfer transaction information is input into the abnormal transfer detection model of the transfer party, and the abnormal probability value of the transfer transaction information can be obtained. The user's transfer transaction is detected and an abnormal warning is issued.

Based on the same idea, an abnormal account transfer detection device provided by an embodiment of the present invention, Figure 5 exemplarily shows a schematic structural diagram of an abnormal account transfer detection device provided by an embodiment of the present invention, as shown in Figure 5, the device includes An acquisition unit 201 , a determination unit 202 , and a calculation unit 203 . in:

Acquisition unit 201: used to acquire transfer transaction information, which includes transferor information;

Determining unit 202: used to determine the abnormal transfer detection model of the transfer-out party according to the information of the transfer-out party, and the abnormal transfer detection model is obtained according to the social attributes of the transfer-out party and the historical behavior attributes of the transfer-out party;

Calculation unit 203: used to input the transfer transaction information into the abnormal transfer detection model of the transferee, and obtain the abnormal probability value of the transfer transaction information.

Optionally, the social attributes of the transfer-out party include the transfer-out party's own attributes and interaction attributes obtained from social networks;

The historical behavior attributes of the transferor include the payment behavior attributes of the transferor;

The determining unit 202 is specifically used for:

Determine the user relationship network of the transfer party according to its own attributes, interaction attributes and payment behavior attributes;

Based on the positive and negative samples of historical transfer transactions and the user relationship network, a machine learning algorithm is used to establish an abnormal transfer detection model for the transfer party.

Optionally, the computing unit 203 is specifically configured to:

Input the transfer transaction information into the abnormal transfer detection model of the transferor, and obtain the abnormal probability value of its own attribute, the abnormal probability value of the interaction attribute and the abnormal probability value of the payment behavior attribute of the transfer transaction information;

According to the abnormal probability value of the own attribute, the abnormal probability value of the interaction attribute and the abnormal probability value of the payment behavior attribute, the abnormal probability value of the transfer transaction information is obtained.

Optionally, the determining unit 202 is specifically further configured to:

Carry out correlation analysis on the user's own attributes, interaction attributes and payment behavior attributes in the user relationship network;

Delete irrelevant attributes from the user relationship network to obtain a revised user relationship network; based on the positive and negative samples of historical transfer transactions and the revised user relationship network, a machine learning algorithm is used to establish an abnormal transfer detection model for the transfer party.

Optionally, the own attributes include at least one of the following: identity information indicators, education level indicators, occupational status indicators, family status indicators, and social information indicators;

The payment behavior attributes include at least one of the following: transfer frequency index, transfer time distribution index, transfer location distribution index, transfer amount distribution index, transfer method proportion index;

The interaction attribute includes at least one of the following: friend frequency index, contact frequency index, and favorability index.

It can be seen from the above content that an abnormal transfer detection device is provided in the embodiment of the present invention to obtain transfer transaction information, which includes the information of the transferor; according to the information of the transferor, determine the abnormal transfer of the transferor The detection model, the abnormal transfer detection model is obtained according to the social attributes of the transfer party and the historical behavior attributes of the transfer party; the transfer transaction information is input into the abnormal transfer detection model of the transfer party, and the abnormal probability value of the transfer transaction information is obtained. In the embodiment of the present invention, first obtain the transfer transaction information; then determine the abnormal transfer detection model of the transfer party according to the transfer transaction information, wherein the abnormal transfer detection model is based on the social attributes of the transfer party and the historical behavior of the transfer party The attribute is obtained, which is convenient for the abnormal transfer detection system to detect and identify the transfer transaction. Since the social attributes and historical behavior attributes are diversified, there is no need for the user to perform additional security verification operations, thereby reducing the delay of the transfer transaction. During the transfer record, it is also possible to detect whether there is an abnormal transfer through social attributes, thereby improving the coverage and accuracy of abnormal transfer detection; finally, the transfer transaction information is input into the abnormal transfer detection model of the transfer party to obtain the transfer transaction information The abnormal probability value can detect the user's transfer transaction and issue an abnormal warning.

Those skilled in the art should understand that the embodiments of the present invention may be provided as methods or computer program products. Accordingly, the present invention can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each procedure and/or block in the flowchart and/or block diagram, and a combination of procedures and/or blocks in the flowchart and/or block diagram can be realized by computer program instructions. These computer program instructions may be provided to a general purpose computer, special purpose computer, embedded processor, or processor of other programmable data processing equipment to produce a machine such that the instructions executed by the processor of the computer or other programmable data processing equipment produce a An apparatus for realizing the functions specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing apparatus to operate in a specific manner, such that the instructions stored in the computer-readable memory produce an article of manufacture comprising instruction means, the instructions The device realizes the function specified in one or more procedures of the flowchart and/or one or more blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, causing a series of operational steps to be performed on the computer or other programmable device to produce a computer-implemented process, thereby The instructions provide steps for implementing the functions specified in the flow chart or blocks of the flowchart and/or the block or blocks of the block diagrams.

While preferred embodiments of the invention have been described, additional changes and modifications to these embodiments can be made by those skilled in the art once the basic inventive concept is appreciated. Therefore, it is intended that the appended claims be construed to cover the preferred embodiment as well as all changes and modifications which fall within the scope of the invention.

Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention also intends to include these modifications and variations.

Claims (10)

1. a kind of abnormal method for detecting of transferring accounts, it is characterised in that including：

Transfer transaction information is obtained, the transfer transaction information includes the side's of producing information；

According to the side's of producing information, the detection model it is determined that exception of the side of producing is transferred accounts, the exception transfer accounts detection model according to The historical behavior attribute of the social attribute of the side of producing and the side of producing is obtained；

The exception of the transfer transaction information input side of producing is transferred accounts detection model, the transfer transaction information is obtained Abnormal probable value.

2. the method for claim 1, it is characterised in that the exception is transferred accounts the society of detection model side of producing according to Attribute and the historical behavior attribute of the side of producing is handed over to obtain, including：

The interaction attributes that the social attribute of the side of producing includes the self attributes of the side of producing and obtained from social networks；

The historical behavior attribute of the side of producing includes the payment behavior attribute of the side of producing；

The customer relationship of the side of producing according to the self attributes, the interaction attributes and the payment behavior attribute determine Net；

According to the positive negative sample of history money transfer transactions and the customer relationship network, the side of producing is set up by machine learning algorithm Exception transfer accounts detection model.

3. method as claimed in claim 2, it is characterised in that described by the transfer transaction information input side of producing Exception is transferred accounts detection model, obtains the abnormal probable value of the transfer transaction information, including：

The exception of the transfer transaction information input side of producing is transferred accounts detection model, the transfer transaction information is obtained Self attributes exception probable value, interaction attributes exception probable value and payment behavior attribute abnormal probable value；

It is general according to self attributes exception probable value, interaction attributes exception probable value and the payment behavior attribute abnormal Rate value, obtains the abnormal probable value of the transfer transaction information.

4. method as claimed in claim 2, it is characterised in that described according to the positive negative sample of history money transfer transactions and the user Relational network, the exception for setting up the side of producing by machine learning algorithm is transferred accounts detection model, including：

Correlation analysis are carried out to the self attributes in the customer relationship network, interaction attributes and payment behavior attribute；

The attribute of non-correlation is deleted from the customer relationship network, revised customer relationship network is obtained；According to described The positive negative sample of history money transfer transactions and the revised customer relationship network, the side of producing is set up by machine learning algorithm Exception transfer accounts detection model.

5. method as claimed in claim 4, it is characterised in that the self attributes include at least one of：Identity information Index, education degree index, employment status index, home background index, social information's index；

The payment behavior attribute includes at least one of：Transfer accounts Frequency Index, Annual distribution index of transferring accounts, the place point of transferring accounts Cloth index, transfer amounts distribution index, mode of transferring accounts accounting index；

The interaction attributes include at least one of：Good friend's Frequency Index, contact Frequency Index, likability index.

6. a kind of abnormal arrangement for detecting of transferring accounts, it is characterised in that including：

Acquiring unit, for obtaining transfer transaction information, the transfer transaction information includes the side's of producing information；

Determining unit, for according to the side of producing information, the detection model it is determined that exception of the side of producing is transferred accounts, the exception to be transferred accounts Detection model historical behavior attribute of the social attribute of the side of producing and the side of producing according to is obtained；

Computing unit, for the exception of the transfer transaction information input side of producing to be transferred accounts detection model, obtains described The abnormal probable value of transfer transaction information.

7. device as claimed in claim 6, it is characterised in that

The interaction attributes that the social attribute of the side of producing includes the self attributes of the side of producing and obtained from social networks；

The historical behavior attribute of the side of producing includes the payment behavior attribute of the side of producing；

The determining unit, specifically for being determined according to the self attributes, the interaction attributes and the payment behavior attribute The customer relationship net of the side of producing；

According to the positive negative sample of history money transfer transactions and the customer relationship network, the side of producing is set up by machine learning algorithm Exception transfer accounts detection model.

8. device as claimed in claim 7, it is characterised in that

The computing unit, specifically for the exception of the transfer transaction information input side of producing is transferred accounts detection model, Obtain self attributes exception probable value, interaction attributes exception probable value and the payment behavior attribute abnormal of the transfer transaction information Probable value；

It is general according to self attributes exception probable value, interaction attributes exception probable value and the payment behavior attribute abnormal Rate value, obtains the abnormal probable value of the transfer transaction information.

9. device as claimed in claim 7, it is characterised in that

The determining unit, is specifically additionally operable to the self attributes in the customer relationship network, interaction attributes and payment behavior Attribute carries out correlation analysis；

The attribute of non-correlation is deleted from the customer relationship network, revised customer relationship network is obtained；According to described The positive negative sample of history money transfer transactions and the revised customer relationship network, the side of producing is set up by machine learning algorithm Exception transfer accounts detection model.

10. device as claimed in claim 9, it is characterised in that the self attributes include at least one of：Identity information Index, education degree index, employment status index, home background index, social information's index；

The payment behavior attribute includes at least one of：Transfer accounts Frequency Index, Annual distribution index of transferring accounts, the place point of transferring accounts Cloth index, transfer amounts distribution index, mode of transferring accounts accounting index；

The interaction attributes include at least one of：Good friend's Frequency Index, contact Frequency Index, likability index.