Disclosure of Invention
The embodiment of the invention provides an abnormal transfer detection method and device, which are used for solving the problems that transfer transaction is delayed and a relational network is difficult to construct if no historical transfer records exist among users in the prior art.
The embodiment of the invention provides an abnormal account transfer detection method, which comprises the following steps:
obtaining transfer transaction information, wherein the transfer transaction information comprises transfer party information;
determining an abnormal transfer detection model of the transfer party according to the information of the transfer party, wherein the abnormal transfer detection model is obtained according to the social attribute of the transfer party and the historical behavior attribute of the transfer party;
and inputting the transfer transaction information into an abnormal transfer detection model of the transfer party to obtain the abnormal probability value of the transfer transaction information.
Optionally, the abnormal transfer detection model is obtained according to social attributes of the transfer party and historical behavior attributes of the transfer party, and includes:
the social attributes of the roll-out party comprise the self attributes of the roll-out party and interaction attributes obtained from the social network;
the historical behavior attribute of the roll-out party comprises the payment behavior attribute of the roll-out party;
determining a user relationship network of the transfer party according to the self attribute, the interaction attribute and the payment behavior attribute;
and establishing an abnormal transfer detection model of the transfer party through a machine learning algorithm according to the positive and negative samples of the historical transfer transaction and the user relationship network.
Optionally, the step of inputting the transfer transaction information into an abnormal transfer detection model of the transfer party to obtain an abnormal probability value of the transfer transaction information includes:
inputting the transfer transaction information into an abnormal transfer detection model of a transfer party to obtain the self attribute abnormal probability value, the interaction attribute abnormal probability value and the payment behavior attribute abnormal probability value of the transfer transaction information;
and obtaining the abnormal probability value of the transfer transaction information according to the self attribute abnormal probability value, the interaction attribute abnormal probability value and the payment behavior attribute abnormal probability value.
Optionally, establishing an abnormal transfer detection model of the transfer party through a machine learning algorithm according to the positive and negative samples of the historical transfer transaction and the user relationship network, wherein the abnormal transfer detection model comprises:
performing correlation analysis on self attribute, interaction attribute and payment behavior attribute in the user relationship network;
deleting the attribute without correlation from the user relationship network to obtain a modified user relationship network; and establishing an abnormal transfer detection model of the transfer party through a machine learning algorithm according to the positive and negative samples of the historical transfer transaction and the corrected user relationship network.
Optionally, the self-attribute comprises at least one of: identity information index, education degree index, occupation status index, family condition index and social information index;
the payment behavior attributes include at least one of: transfer frequency index, transfer time distribution index, transfer place distribution index, transfer amount distribution index and transfer mode proportion index;
the interaction attributes include at least one of: friend frequency index, contact frequency index and susceptibility index.
An embodiment of the present invention further provides an abnormal account transfer detection apparatus, including:
an acquisition unit: the system comprises a transfer unit, a transfer unit and a transfer unit, wherein the transfer unit is used for acquiring transfer transaction information which comprises transfer party information;
a determination unit: the transfer system comprises a transfer party, a transfer module and a transfer module, wherein the transfer module is used for determining an abnormal transfer detection model of the transfer party according to transfer party information, and the abnormal transfer detection model is obtained according to social attributes of the transfer party and historical behavior attributes of the transfer party;
a calculation unit: and the abnormal transfer detection module is used for inputting the transfer transaction information into the abnormal transfer detection model of the transfer party to obtain the abnormal probability value of the transfer transaction information.
Optionally, the social attributes of the roll-out party include the roll-out party's own attributes and interaction attributes obtained from the social network;
the historical behavior attribute of the roll-out party comprises the payment behavior attribute of the roll-out party;
the determination unit is specifically configured to:
determining a user relationship network of the transfer party according to the self attribute, the interaction attribute and the payment behavior attribute;
and establishing an abnormal transfer detection model of the transfer party through a machine learning algorithm according to the positive and negative samples of the historical transfer transaction and the user relationship network.
Optionally, the computing unit is specifically configured to:
inputting the transfer transaction information into an abnormal transfer detection model of a transfer party to obtain the self attribute abnormal probability value, the interaction attribute abnormal probability value and the payment behavior attribute abnormal probability value of the transfer transaction information;
and obtaining the abnormal probability value of the transfer transaction information according to the self attribute abnormal probability value, the interaction attribute abnormal probability value and the payment behavior attribute abnormal probability value.
Optionally, the determining unit is further specifically configured to:
performing correlation analysis on self attribute, interaction attribute and payment behavior attribute in the user relationship network;
deleting the attribute without correlation from the user relationship network to obtain a modified user relationship network; and establishing an abnormal transfer detection model of the transfer party through a machine learning algorithm according to the positive and negative samples of the historical transfer transaction and the corrected user relationship network.
Optionally, the self-attribute comprises at least one of: identity information index, education degree index, occupation status index, family condition index and social information index;
the payment behavior attributes include at least one of: transfer frequency index, transfer time distribution index, transfer place distribution index, transfer amount distribution index and transfer mode proportion index;
the interaction attributes include at least one of: friend frequency index, contact frequency index and susceptibility index.
The embodiment of the invention provides an abnormal transfer detection method and device, which are used for acquiring transfer transaction information, wherein the transfer transaction information comprises transfer party information; determining an abnormal transfer detection model of the transfer party according to the information of the transfer party, wherein the abnormal transfer detection model is obtained according to the social attribute of the transfer party and the historical behavior attribute of the transfer party; and inputting the transfer transaction information into an abnormal transfer detection model of the transfer party to obtain the abnormal probability value of the transfer transaction information. In the embodiment of the invention, the account transfer transaction information is obtained firstly; then, according to the transfer transaction information, an abnormal transfer account detection model of the transfer party is determined, wherein the abnormal transfer account detection model is obtained according to the social attribute of the transfer party and the historical behavior attribute of the transfer party, so that the abnormal transfer account detection system can conveniently detect and identify the transfer account transaction, and because the social attribute and the historical behavior attribute are diversified, a user does not need to perform extra security verification operation, thereby reducing the delay of the transfer account transaction, and meanwhile, when no transfer record exists among the users, whether an abnormal transfer account condition exists can be detected through the social attribute, thereby improving the coverage and accuracy of abnormal transfer account detection; and finally, the transfer transaction information is input into an abnormal transfer detection model of the transfer party to obtain the abnormal probability value of the transfer transaction information, so that the transfer transaction of the user can be detected and an abnormal early warning can be sent out.
Detailed Description
In order to make the objects, technical solutions and advantages of the present invention more clearly apparent, the present invention is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.
In order to better understand the scheme, the abnormal transfer detection system in the technical scheme of the invention is designed, the designed abnormal transfer detection system is explained below, and the overall architecture diagram of the abnormal transfer detection system is shown in the following figure 1:
fig. 1 exemplarily shows an overall architecture diagram of an abnormal transfer detection system provided by an embodiment of the present invention, as shown in fig. 1, the abnormal transfer detection system includes a data acquisition module, a database module, a user relationship network establishment module, an abnormal transfer detection model training module, and an abnormal transfer detection module, where the database module includes a self attribute database, a payment behavior attribute database, and an interaction attribute database, and the abnormal transfer detection model training module is connected to a background transaction system. Then, the design idea of the whole architecture of the abnormal transfer detection system is as follows: the data acquisition module acquires self attribute data, payment behavior attribute data and interaction attribute data of a user and respectively stores the self attribute data, the payment behavior attribute data and the interaction attribute data in a self attribute database, a payment behavior attribute database and an interaction attribute database; the user relationship network establishing module establishes a three-dimensional user relationship network according to the data of the self attribute database, the payment behavior attribute database and the interaction attribute database, wherein the three dimensions are the self attribute dimension, the payment behavior attribute dimension and the interaction attribute dimension; the abnormal transfer detection model training module acquires positive and negative samples of historical transfer transactions of a user from a background transaction system, establishes an abnormal transfer detection model by using a machine learning algorithm according to a user relationship network and the positive and negative samples of the historical transfer transactions of the user, uses the abnormal transfer detection model in the abnormal transfer detection module, and detects the transfer transactions and sends an abnormal early warning when the user initiates the transfer transactions. In addition, the relationship network of the user in the abnormal transfer detection system is not constant, the self attribute data, the payment behavior attribute data and the interaction attribute data collected by the abnormal transfer detection system change along with the change of the external relationship data of the user, and the abnormal transfer detection model is also continuously updated periodically.
The overall structure of the designed abnormal transfer detection system has the following advantages: firstly, when a user initiates a transfer transaction, various and huge user relationship networks contain a large amount of information of the user, so that additional safety verification operation is not needed by the user, the delay of the transfer transaction is reduced, secondly, when no transfer record exists among the users, the user relationship network can be established through self attribute data and interactive attribute data of the user, the problem that the user relationship network is difficult to establish if no historical transfer record exists among the users is solved, thirdly, an abnormal transfer detection model is established through the various and huge user relationship networks and positive and negative samples of the historical transfer transaction of the user, and the model is used for an abnormal transfer detection module, so that the coverage and the accuracy of abnormal transfer detection are improved.
Fig. 2 schematically illustrates a flow chart of an abnormal transfer detection method according to an embodiment of the present invention, and as shown in fig. 2, the method includes the following steps:
step S101: obtaining transfer transaction information, wherein the transfer transaction information comprises transfer party information;
step S102: determining an abnormal transfer detection model of the transfer party according to the information of the transfer party, wherein the abnormal transfer detection model is obtained according to the social attribute of the transfer party and the historical behavior attribute of the transfer party;
step S103: and inputting the transfer transaction information into an abnormal transfer detection model of the transfer party to obtain the abnormal probability value of the transfer transaction information.
Specifically, in the embodiment, when a user initiates a transfer transaction, an abnormal transfer detection module in the system analyzes an initiating user a and a receiving user B of the transfer transaction to acquire transfer transaction information of the initiating user a and the receiving user B; and inputting the transfer transaction information of the initiating user A and the receiving user B into an abnormal transfer detection model to obtain the abnormal probability value of the transfer transaction information. In the specific implementation, after the transfer transaction information of the initiating user A and the receiving user B is input into the abnormal transfer detection model, the abnormal probability value of the transfer transaction information can be obtained by using a machine learning algorithm. After the abnormal probability value of the transfer transaction information is obtained, the transfer transaction of the user can be detected and abnormal early warning can be sent out. The abnormal transfer detection model is obtained according to the social attribute of the transfer party and the historical behavior attribute of the transfer party, the abnormal transfer detection system can conveniently detect and identify the transfer transaction, the social attribute and the historical behavior attribute are diversified, so that the user does not need to carry out extra security verification operation, delay of the transfer transaction is reduced, and meanwhile, whether the abnormal transfer condition exists or not can be detected through the social attribute when no transfer record exists among the users, and therefore the coverage and accuracy of abnormal transfer detection are improved.
The abnormal transfer detection model can be obtained through the following three ways:
the first method is as follows: the abnormal transfer detection model is obtained according to the social attribute of the transfer party and the historical behavior attribute of the transfer party; specifically, the social attribute of the roll-out party and the historical behavior attribute of the roll-out party are used as the input of the abnormal transfer detection model, the abnormal transfer detection model is trained by applying a machine learning algorithm, and the abnormal transfer detection model is finally trained after multiple times of training.
The second method comprises the following steps: optionally, the abnormal transfer detection model is obtained according to social attributes of the transfer party and historical behavior attributes of the transfer party, and includes: the social attributes of the roll-out party comprise the self attributes of the roll-out party and interaction attributes obtained from the social network; the historical behavior attribute of the roll-out party comprises the payment behavior attribute of the roll-out party; determining a user relationship network of the transfer party according to the self attribute, the interaction attribute and the payment behavior attribute; establishing an abnormal transfer detection model of a transfer party through a machine learning algorithm according to the positive and negative samples of the historical transfer transaction and the user relationship network; specifically, a user relationship network of a transfer party is determined according to self attributes, interaction attributes and payment behavior attributes; and then, taking the positive and negative samples of the historical account transfer transaction and the user relationship network as the input of the abnormal account transfer detection model, training the abnormal account transfer detection model by using a machine learning algorithm, and finally training the abnormal account transfer detection model after multiple times of training.
The third method comprises the following steps: optionally, establishing an abnormal transfer detection model of the transfer party through a machine learning algorithm according to the positive and negative samples of the historical transfer transaction and the user relationship network, wherein the abnormal transfer detection model comprises: performing correlation analysis on self attribute, interaction attribute and payment behavior attribute in the user relationship network; deleting the attribute without correlation from the user relationship network to obtain a modified user relationship network; and establishing an abnormal transfer detection model of the transfer party through a machine learning algorithm according to the positive and negative samples of the historical transfer transaction and the corrected user relationship network. In specific implementation, the self attribute, the interaction attribute and the payment behavior attribute in the user relationship network respectively contain a lot of information or indexes, and if the self attribute, the interaction attribute and the payment behavior attribute totally contain 10000 indexes, firstly, correlation analysis or data cleaning and screening is performed on the 10000 indexes, for example, an index 1 and an index 2 present a linear relationship, then, one of the index 1 and the index 2 can be retained, the other index is deleted, and if the 10000 indexes are subjected to correlation analysis or data cleaning and screening, 1000 indexes are finally retained; then obtaining a corrected user relationship network according to 1000 indexes, taking the positive and negative samples of the historical transfer transaction and the corrected user relationship network as the input of an abnormal transfer detection model and training the abnormal transfer detection model by using a machine learning algorithm, and in the training process, performing index correlation analysis by combining the positive and negative samples of the historical transfer transaction to correct the user relationship network again, for example, some indexes which do not have any influence on the positive and negative samples of the historical transfer transaction are also available in 1000 indexes and can be deleted, if 500 indexes in 1000 indexes do not have any influence on the positive and negative samples of the historical transfer transaction, obtaining the corrected user relationship network which contains 500 indexes again, taking the corrected user relationship network and the positive and negative samples of the historical transfer transaction as the input of the abnormal transfer detection model and training the abnormal transfer detection model by using the machine learning algorithm, and finally, training an abnormal transfer detection model, wherein the positive and negative samples of the historical transfer transaction are obtained by connecting an abnormal transfer detection model training module in the abnormal transfer detection system with a background transaction system, and the positive and negative samples of the historical transfer transaction comprise the historical normal transfer transaction record and the historical abnormal transfer transaction record of the user. The first point to be explained is: the user relationship network is corrected twice, the user relationship network corrected again can be performed in the training process of the abnormal transfer detection model, or can be performed before the training of the abnormal transfer detection model, for example, 1000 indexes in the user relationship network corrected again are combined with positive and negative samples of historical transfer transactions to perform correlation analysis or data cleaning and screening, 500 indexes are finally screened out, the user relationship network corrected again and the positive and negative samples of the historical transfer transactions containing 500 indexes are used as the input of the abnormal transfer detection model, and the abnormal transfer detection model is trained by using a machine learning algorithm; the second point to be explained is: in the specific implementation, the abnormal transfer is input into the abnormal transfer detection model in the form of a record, for example, the record 1 is: the transfer time is 8 morning, the transfer amount is 8000, the transfer place is Shanghai, the transfer mode is card swiping, the relation with a transfer receiving user is colleague, and the transfer transaction is a positive sample; the third point to be noted is: in specific implementation, if all the positive samples and the negative samples of the historical transfer transactions of the user are positive samples, the quantity of the historical transfer transaction records of the user can be reduced, and if the negative samples in the positive samples and the negative samples of the historical transfer transactions of the user are far greater than the quantity of the positive samples, the quantity of the historical transfer transaction records of the user can be increased.
Through the three determination modes of the abnormal transfer detection model, the determination mode of the abnormal transfer detection model has the characteristics of diversity and flexibility; the user relationship network is corrected twice, and actually, data dimension reduction is performed twice on the user relationship network, so that the calculated amount and pressure of the system can be reduced, and the effect of which indexes on the account transfer transaction can be achieved can be determined.
Optionally, the step of inputting the transfer transaction information into an abnormal transfer detection model of the transfer party to obtain an abnormal probability value of the transfer transaction information includes: inputting the transfer transaction information into an abnormal transfer detection model of a transfer party to obtain the self attribute abnormal probability value, the interaction attribute abnormal probability value and the payment behavior attribute abnormal probability value of the transfer transaction information; and obtaining the abnormal probability value of the transfer transaction information according to the self attribute abnormal probability value, the interaction attribute abnormal probability value and the payment behavior attribute abnormal probability value. Specifically, assuming that a user A transfers money to a user B, an abnormal transfer detection module in the abnormal transfer detection system analyzes the user A and the user B to obtain indexes of the user A and the user B, the indexes are input into an abnormal transfer detection model, three abnormal probability values are obtained, namely a self-attribute abnormal probability value, an interaction attribute abnormal probability value and a payment behavior attribute abnormal probability value, and are assumed to be 0.3, 0.5 and 0.2 respectively, appropriate weights are applied to the three abnormal probability values respectively, the abnormal probability values with the applied weights are added, and finally, a comprehensive abnormal probability that the transfer transaction is an abnormal transfer transaction is generated, and is assumed to be 0.25, and the comprehensive abnormal probability indicates a risk value that the current transfer transaction is abnormal. If the comprehensive probability is very high, the system directly sends out an abnormal early warning. Fig. 3 exemplarily shows a comprehensive anomaly probability diagram, as shown in fig. 3.
Optionally, the self-attribute comprises at least one of: identity information index, education degree index, occupation status index, family condition index and social information index; in specific implementation, the identity information index may further include information representing the identity of the user, such as an identity card, a passport, a gender, an age, a mobile phone number, and the like; the education level index indicates the culture level of the user; the occupation status index reflects whether the user has a fixed and proper occupation and the work replacement frequency; the family condition indexes comprise marital and child conditions and the like; the social information index comprises social insurance, medical insurance remittance conditions and social credit conditions, wherein the social credit conditions can be overdue bank cards or overdue arrears of public utilities payment and the like. And the abnormal transfer detection system depicts a basic situation portrait of the user according to the attribute information of the abnormal transfer detection system. For example, if the user has no fixed occupation, incomplete or fake identification information, poor social information, etc., and the transfer transaction amount is relatively large, the probability of abnormality of the transfer transaction, whether the transfer transaction is the initiating user or the receiving user, is relatively high, for example, the transfer may be money laundering or telecommunication fraud.
The payment behavior attributes include at least one of: transfer frequency index, transfer time distribution index, transfer place distribution index, transfer amount distribution index and transfer mode proportion index; in specific implementation, the data of the payment behavior attribute is mainly obtained from a bank channel, a card organization, a third-party payment mechanism and the like, and the data of the payment behavior attribute comprises a historical transfer record, historical consumption details and the like. In the historical account transfer record, the account transfer object comprises an account, a card number and the like, and the account transfer object, the account transfer amount, the account transfer time, the account transfer place and the account transfer mode are used for carrying out statistical analysis on the distribution of the account transfer object, the corresponding account transfer frequency, the distribution of the user account transfer amount, the distribution of the account transfer time and place, the account transfer mode ratio and the like. In the transfer object analysis, sorting the objects according to the transfer frequency from high to low; in the distribution of the transfer amount, the transfer time and the transfer place, the transfer amount interval of the user and the fluctuation trend along with the time can be analyzed and obtained, if the transfer of the user presents regular distribution and the fluctuation is smooth, but the current transfer amount suddenly increases and the transfer time is free from the distribution, the abnormal transfer probability is higher; through the proportion analysis of the historical account transfer mode of the user, the user can know that the user is more inclined to a traditional channel, such as an ATM (automatic teller machine), a bank counter or an innovation channel, such as a computer terminal and a mobile terminal, to perform account transfer transaction, if the user frequently performs the account transfer transaction through the traditional channel and the current account transfer is performed through the mobile terminal, the judgment weight of the index on the abnormal account transfer probability is increased. In addition, in the historical transfer transaction data of the user, the wasting index and the transaction channel of the user are analyzed according to the information of the historical transfer transaction and the consumption record of the user, such as consumption frequency, consumption amount, consumption mode and the like. The wasting capacity index indicates the consumption level of the user and reflects the wasting capacity and purchasing power of the user, namely large consumption or small consumption often occurs. The consumption mode shows that the user is more inclined to a traditional payment mode such as a POS machine card swiping mode and the like or an innovative payment mode such as cloud flash payment and two-dimension code scanning payment and the like, and further the enthusiasm degree of the user on mobile innovative payment is reflected.
The interaction attributes include at least one of: friend frequency index, contact frequency index and susceptibility index. In the specific implementation of the invention, besides establishing the payment behavior attribute relationship network among users, the interactive attribute relationship network of the users is also established, so that the strong and weak relationship between the two parties of the account transfer can be judged through the interactive attribute even if the two parties of the account transfer do not have historical account transfer records. In the interaction attribute, the data includes WeChat, QQ, microblog, mail, telecom operators such as short message or call, online game, even lottery data, and the like, and each user establishes a complex interaction attribute relationship network. In the interaction attribute relationship network, the main indexes include a series of indexes capable of reflecting the closeness degree of the association between the user and other users, such as friend frequency, contact frequency, goodness and the like. The friend frequency index reflects the closeness degree of the friend relationship between the users, and if both the users are in friend relationship in various types of social software such as WeChat, qq and the like, the friend frequency between the users is high. The contact frequency index reflects the height of the contact frequency among the users, and the contact frequency among the users is mainly obtained from the communication social data. The good-feeling index reflects the positive and negative good or bad of the relation between users, and the good-feeling index between users can be obtained by utilizing the natural language analysis technology to carry out word segmentation, word frequency statistics, good or bad word analysis and the like on the chat communication content of the users. In addition to social networking applications, data such as network games, lotteries, etc. may also reflect a complex network of relationships for users, e.g., in online tours, relationships between team members in the same team may further complement the interactive attribute relationship network.
Since the user relationship network is determined according to the self attribute, the interaction attribute and the payment behavior attribute, based on the content of the above specific introduction of the self attribute, the interaction attribute and the payment behavior attribute, the following specific establishment process of the user relationship network based on the self attribute, the interaction attribute and the payment behavior attribute is introduced, and includes three processes:
the self attribute, the interaction attribute and the payment behavior attribute can be considered as three dimensions of a user relationship network, and 1, information in the self attribute, the interaction attribute and the payment behavior attribute is scored: in the self attribute dimension, the identity information index, the education degree index, the occupation status index, the family condition index and the social information index of the user are judged and respectively scored, if the identity information of the users of both sides of the transfer transaction is complete and real, the occupation is stable and the social information is good, the probability that the transfer transaction is abnormal is obviously reduced, and the scores of the identity information index, the occupation status index and the social information index of the user can be marked down; in the interaction attribute dimension, judging and scoring friend frequency indexes, contact frequency indexes, goodness indexes and the like, wherein the friend frequency indexes, contact frequency indexes and goodness indexes can intuitively reflect whether social relations exist among users, the degree of close contact and positive or negative emotional colors among users, for example, a friend user B of a user A applies for transfer account requirements to the user A, but the interaction attribute dimension finds that the frequency of friends between the users A and B is low, the contact is few and no goodness exists, which indicates that the social interaction attributes of the users A and B are weak and the user B can be stolen, and then scores of the friend frequency indexes, contact frequency indexes and goodness indexes of the interaction attributes are high; in the payment behavior attribute dimension, deep mining analysis is carried out on all transfer transactions and consumption records of the user, the density relation of transfer objects of the user is obtained, the transfer transactions or consumption habits of the user are analyzed, and the payment portrait of the user is depicted. Historical account transfer transactions, consumption and other behaviors between an initiating user and a receiving user of the current account transfer transaction are frequent, the account transfer amount is stable and accords with the labor consumption level of the user, the probability that the current account transfer transaction is abnormal is relatively low, and a lower score can be given to information in the attribute dimension of the payment behavior; on the contrary, the transfer initiating user and the transfer receiving user do not have transfer transaction, the payment relationship of the transfer receiving user is complex and irregular, and the current transfer amount is seriously inconsistent with the waste of the transfer initiating user, so that the transfer abnormal probability is higher, if the transfer initiating user possibly suffers telecommunication fraud activity, the information in the attribute dimension of the payment behavior can be scored higher; 2. generating each weight value for scores marked by information in the self attribute, the interaction attribute and the payment behavior attribute; 3. and forming a user relationship network graph by taking the transfer users as central nodes and taking each weight value as a side. Fig. 4 exemplarily shows a schematic view of a user relationship network, as shown in fig. 4.
From the above, it can be seen that: the embodiment of the invention provides an abnormal transfer detection method, which comprises the steps of obtaining transfer transaction information, wherein the transfer transaction information comprises transfer party information; determining an abnormal transfer detection model of the transfer party according to the information of the transfer party, wherein the abnormal transfer detection model is obtained according to the social attribute of the transfer party and the historical behavior attribute of the transfer party; and inputting the transfer transaction information into an abnormal transfer detection model of the transfer party to obtain the abnormal probability value of the transfer transaction information. In the embodiment of the invention, the account transfer transaction information is obtained firstly; then, according to the transfer transaction information, determining an abnormal transfer detection model of the transfer party, wherein the abnormal transfer detection model is obtained according to the social attribute of the transfer party and the historical behavior attribute of the transfer party, so that the transfer transaction is conveniently detected and identified by a system; and finally, the transfer transaction information is input into an abnormal transfer detection model of the transfer party to obtain the abnormal probability value of the transfer transaction information, so that the transfer transaction of the user can be detected and an abnormal early warning can be sent out.
Based on the same concept, fig. 5 exemplarily shows a schematic structural diagram of the abnormal transfer detection device provided by the embodiment of the present invention, and as shown in fig. 5, the device includes an obtaining unit 201, a determining unit 202, and a calculating unit 203. Wherein:
the acquisition unit 201: the system comprises a transfer unit, a transfer unit and a transfer unit, wherein the transfer unit is used for acquiring transfer transaction information which comprises transfer party information;
the determination unit 202: the transfer system comprises a transfer party, a transfer module and a transfer module, wherein the transfer module is used for determining an abnormal transfer detection model of the transfer party according to transfer party information, and the abnormal transfer detection model is obtained according to social attributes of the transfer party and historical behavior attributes of the transfer party;
the calculation unit 203: and the abnormal transfer detection module is used for inputting the transfer transaction information into the abnormal transfer detection model of the transfer party to obtain the abnormal probability value of the transfer transaction information.
Optionally, the social attributes of the roll-out party include the roll-out party's own attributes and interaction attributes obtained from the social network;
the historical behavior attribute of the roll-out party comprises the payment behavior attribute of the roll-out party;
the determining unit 202 is specifically configured to:
determining a user relationship network of the transfer party according to the self attribute, the interaction attribute and the payment behavior attribute;
and establishing an abnormal transfer detection model of the transfer party through a machine learning algorithm according to the positive and negative samples of the historical transfer transaction and the user relationship network.
Optionally, the calculating unit 203 is specifically configured to:
inputting the transfer transaction information into an abnormal transfer detection model of a transfer party to obtain the self attribute abnormal probability value, the interaction attribute abnormal probability value and the payment behavior attribute abnormal probability value of the transfer transaction information;
and obtaining the abnormal probability value of the transfer transaction information according to the self attribute abnormal probability value, the interaction attribute abnormal probability value and the payment behavior attribute abnormal probability value.
Optionally, the determining unit 202 is further specifically configured to:
performing correlation analysis on self attribute, interaction attribute and payment behavior attribute in the user relationship network;
deleting the attribute without correlation from the user relationship network to obtain a modified user relationship network; and establishing an abnormal transfer detection model of the transfer party through a machine learning algorithm according to the positive and negative samples of the historical transfer transaction and the corrected user relationship network.
Optionally, the self-attribute comprises at least one of: identity information index, education degree index, occupation status index, family condition index and social information index;
the payment behavior attributes include at least one of: transfer frequency index, transfer time distribution index, transfer place distribution index, transfer amount distribution index and transfer mode proportion index;
the interaction attributes include at least one of: friend frequency index, contact frequency index and susceptibility index.
From the above, it can be seen that: the embodiment of the invention provides an abnormal transfer detection device, which is used for acquiring transfer transaction information, wherein the transfer transaction information comprises transfer party information; determining an abnormal transfer detection model of the transfer party according to the information of the transfer party, wherein the abnormal transfer detection model is obtained according to the social attribute of the transfer party and the historical behavior attribute of the transfer party; and inputting the transfer transaction information into an abnormal transfer detection model of the transfer party to obtain the abnormal probability value of the transfer transaction information. In the embodiment of the invention, the account transfer transaction information is obtained firstly; then, according to the transfer transaction information, an abnormal transfer account detection model of the transfer party is determined, wherein the abnormal transfer account detection model is obtained according to the social attribute of the transfer party and the historical behavior attribute of the transfer party, so that the abnormal transfer account detection system can conveniently detect and identify the transfer account transaction, and because the social attribute and the historical behavior attribute are diversified, a user does not need to perform extra security verification operation, thereby reducing the delay of the transfer account transaction, and meanwhile, when no transfer record exists among the users, whether an abnormal transfer account condition exists can be detected through the social attribute, thereby improving the coverage and accuracy of abnormal transfer account detection; and finally, the transfer transaction information is input into an abnormal transfer detection model of the transfer party to obtain the abnormal probability value of the transfer transaction information, so that the transfer transaction of the user can be detected and an abnormal early warning can be sent out.
It should be apparent to those skilled in the art that embodiments of the present invention may be provided as a method, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
While preferred embodiments of the present invention have been described, additional variations and modifications in those embodiments may occur to those skilled in the art once they learn of the basic inventive concepts. Therefore, it is intended that the appended claims be interpreted as including preferred embodiments and all such alterations and modifications as fall within the scope of the invention.
It will be apparent to those skilled in the art that various changes and modifications may be made in the present invention without departing from the spirit and scope of the invention. Thus, if such modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include such modifications and variations.