[go: up one dir, main page]

CN106803168B - A kind of abnormal transfer detection method and device - Google Patents

A kind of abnormal transfer detection method and device Download PDF

Info

Publication number
CN106803168B
CN106803168B CN201611264190.3A CN201611264190A CN106803168B CN 106803168 B CN106803168 B CN 106803168B CN 201611264190 A CN201611264190 A CN 201611264190A CN 106803168 B CN106803168 B CN 106803168B
Authority
CN
China
Prior art keywords
transfer
abnormal
attribute
party
detection model
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201611264190.3A
Other languages
Chinese (zh)
Other versions
CN106803168A (en
Inventor
胡奕
何朔
邱雪涛
李旭瑞
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Unionpay Co Ltd
Original Assignee
China Unionpay Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Unionpay Co Ltd filed Critical China Unionpay Co Ltd
Priority to CN201611264190.3A priority Critical patent/CN106803168B/en
Publication of CN106803168A publication Critical patent/CN106803168A/en
Priority to PCT/CN2017/111096 priority patent/WO2018121113A1/en
Priority to TW106145681A priority patent/TWI690884B/en
Application granted granted Critical
Publication of CN106803168B publication Critical patent/CN106803168B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING OR CALCULATING; COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00Payment architectures, schemes or protocols
    • G06Q20/08Payment architectures
    • G06Q20/10Payment architectures specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
    • G06Q20/108Remote banking, e.g. home banking
    • GPHYSICS
    • G06COMPUTING OR CALCULATING; COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00Payment architectures, schemes or protocols
    • G06Q20/38Payment protocols; Details thereof
    • G06Q20/382Payment protocols; Details thereof insuring higher security of transaction

Landscapes

  • Business, Economics & Management (AREA)
  • Accounting & Taxation (AREA)
  • Finance (AREA)
  • Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Strategic Management (AREA)
  • General Business, Economics & Management (AREA)
  • General Physics & Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Development Economics (AREA)
  • Economics (AREA)
  • Financial Or Insurance-Related Operations Such As Payment And Settlement (AREA)

Abstract

本发明实施例涉及互联网金融领域,尤其涉及一种异常转账侦测方法和装置,用于对转账交易进行侦测与发出异常预警。本发明实施例中,获取转账交易信息,转账交易信息中包括转出方信息;根据转出方信息,确定转出方的异常转账侦测模型,异常转账侦测模型根据转出方的社交属性和转出方的历史行为属性得到;将转账交易信息输入转出方的异常转账侦测模型,得到所述转账交易信息的异常概率值,以使当用户发起转账交易时,对用户的转账交易进行侦测与发出异常预警。

Figure 201611264190

Embodiments of the present invention relate to the field of Internet finance, and in particular, to an abnormal transfer detection method and device, which are used to detect transfer transactions and issue abnormal early warnings. In the embodiment of the present invention, the transfer transaction information is obtained, and the transfer transaction information includes the transfer party information; according to the transfer party information, the abnormal transfer detection model of the transfer party is determined, and the abnormal transfer detection model is based on the social attributes of the transfer party. and the historical behavior attributes of the transfer-out party; input the transfer transaction information into the abnormal transfer detection model of the transfer-out party to obtain the abnormal probability value of the transfer transaction information, so that when the user initiates a transfer transaction, the user’s transfer transaction Detect and issue anomaly alerts.

Figure 201611264190

Description

Abnormal transfer detection method and device
Technical Field
The embodiment of the invention relates to the field of Internet finance, in particular to an abnormal account transfer detection method and device.
Background
With the advent of the internet financial and big data era, users can realize non-cash transfer transactions through the internet and other modes, and because the internet is an open network, the internet banking system also enables the interior of a bank to be open to the internet. Therefore, how to ensure the safety of the cashless transfer transaction is a crucial problem in the internet finance and big data era, and is also an important problem to be considered when each bank ensures the fund safety of the user in relation to the safety of the whole internet finance.
In the existing abnormal transfer transaction detection technology, a commonly used method is to improve a safety authentication mechanism when a user performs transfer transaction, and the method needs a diversified verification operation mode of the user or a mode of verifying a transaction message by a client and a server, but the modes bring additional verification operation to the user, increase transfer transaction delay, reduce customer experience, make the transaction message too complex and increase the processing time of the server; in another method, a user relationship network is established through the relationship among users to detect abnormal transfer transactions, but the method can only establish the relationship network when historical transfer records exist among the users, and the relationship network is difficult to establish if no historical transfer records exist among the users.
In summary, in the existing abnormal transfer transaction detection technology, there are problems that transfer transaction is delayed, and if there is no historical transfer record between users, it is difficult to construct a user relationship network, so an effective method needs to be provided to solve the above problems.
Disclosure of Invention
The embodiment of the invention provides an abnormal transfer detection method and device, which are used for solving the problems that transfer transaction is delayed and a relational network is difficult to construct if no historical transfer records exist among users in the prior art.
The embodiment of the invention provides an abnormal account transfer detection method, which comprises the following steps:
obtaining transfer transaction information, wherein the transfer transaction information comprises transfer party information;
determining an abnormal transfer detection model of the transfer party according to the information of the transfer party, wherein the abnormal transfer detection model is obtained according to the social attribute of the transfer party and the historical behavior attribute of the transfer party;
and inputting the transfer transaction information into an abnormal transfer detection model of the transfer party to obtain the abnormal probability value of the transfer transaction information.
Optionally, the abnormal transfer detection model is obtained according to social attributes of the transfer party and historical behavior attributes of the transfer party, and includes:
the social attributes of the roll-out party comprise the self attributes of the roll-out party and interaction attributes obtained from the social network;
the historical behavior attribute of the roll-out party comprises the payment behavior attribute of the roll-out party;
determining a user relationship network of the transfer party according to the self attribute, the interaction attribute and the payment behavior attribute;
and establishing an abnormal transfer detection model of the transfer party through a machine learning algorithm according to the positive and negative samples of the historical transfer transaction and the user relationship network.
Optionally, the step of inputting the transfer transaction information into an abnormal transfer detection model of the transfer party to obtain an abnormal probability value of the transfer transaction information includes:
inputting the transfer transaction information into an abnormal transfer detection model of a transfer party to obtain the self attribute abnormal probability value, the interaction attribute abnormal probability value and the payment behavior attribute abnormal probability value of the transfer transaction information;
and obtaining the abnormal probability value of the transfer transaction information according to the self attribute abnormal probability value, the interaction attribute abnormal probability value and the payment behavior attribute abnormal probability value.
Optionally, establishing an abnormal transfer detection model of the transfer party through a machine learning algorithm according to the positive and negative samples of the historical transfer transaction and the user relationship network, wherein the abnormal transfer detection model comprises:
performing correlation analysis on self attribute, interaction attribute and payment behavior attribute in the user relationship network;
deleting the attribute without correlation from the user relationship network to obtain a modified user relationship network; and establishing an abnormal transfer detection model of the transfer party through a machine learning algorithm according to the positive and negative samples of the historical transfer transaction and the corrected user relationship network.
Optionally, the self-attribute comprises at least one of: identity information index, education degree index, occupation status index, family condition index and social information index;
the payment behavior attributes include at least one of: transfer frequency index, transfer time distribution index, transfer place distribution index, transfer amount distribution index and transfer mode proportion index;
the interaction attributes include at least one of: friend frequency index, contact frequency index and susceptibility index.
An embodiment of the present invention further provides an abnormal account transfer detection apparatus, including:
an acquisition unit: the system comprises a transfer unit, a transfer unit and a transfer unit, wherein the transfer unit is used for acquiring transfer transaction information which comprises transfer party information;
a determination unit: the transfer system comprises a transfer party, a transfer module and a transfer module, wherein the transfer module is used for determining an abnormal transfer detection model of the transfer party according to transfer party information, and the abnormal transfer detection model is obtained according to social attributes of the transfer party and historical behavior attributes of the transfer party;
a calculation unit: and the abnormal transfer detection module is used for inputting the transfer transaction information into the abnormal transfer detection model of the transfer party to obtain the abnormal probability value of the transfer transaction information.
Optionally, the social attributes of the roll-out party include the roll-out party's own attributes and interaction attributes obtained from the social network;
the historical behavior attribute of the roll-out party comprises the payment behavior attribute of the roll-out party;
the determination unit is specifically configured to:
determining a user relationship network of the transfer party according to the self attribute, the interaction attribute and the payment behavior attribute;
and establishing an abnormal transfer detection model of the transfer party through a machine learning algorithm according to the positive and negative samples of the historical transfer transaction and the user relationship network.
Optionally, the computing unit is specifically configured to:
inputting the transfer transaction information into an abnormal transfer detection model of a transfer party to obtain the self attribute abnormal probability value, the interaction attribute abnormal probability value and the payment behavior attribute abnormal probability value of the transfer transaction information;
and obtaining the abnormal probability value of the transfer transaction information according to the self attribute abnormal probability value, the interaction attribute abnormal probability value and the payment behavior attribute abnormal probability value.
Optionally, the determining unit is further specifically configured to:
performing correlation analysis on self attribute, interaction attribute and payment behavior attribute in the user relationship network;
deleting the attribute without correlation from the user relationship network to obtain a modified user relationship network; and establishing an abnormal transfer detection model of the transfer party through a machine learning algorithm according to the positive and negative samples of the historical transfer transaction and the corrected user relationship network.
Optionally, the self-attribute comprises at least one of: identity information index, education degree index, occupation status index, family condition index and social information index;
the payment behavior attributes include at least one of: transfer frequency index, transfer time distribution index, transfer place distribution index, transfer amount distribution index and transfer mode proportion index;
the interaction attributes include at least one of: friend frequency index, contact frequency index and susceptibility index.
The embodiment of the invention provides an abnormal transfer detection method and device, which are used for acquiring transfer transaction information, wherein the transfer transaction information comprises transfer party information; determining an abnormal transfer detection model of the transfer party according to the information of the transfer party, wherein the abnormal transfer detection model is obtained according to the social attribute of the transfer party and the historical behavior attribute of the transfer party; and inputting the transfer transaction information into an abnormal transfer detection model of the transfer party to obtain the abnormal probability value of the transfer transaction information. In the embodiment of the invention, the account transfer transaction information is obtained firstly; then, according to the transfer transaction information, an abnormal transfer account detection model of the transfer party is determined, wherein the abnormal transfer account detection model is obtained according to the social attribute of the transfer party and the historical behavior attribute of the transfer party, so that the abnormal transfer account detection system can conveniently detect and identify the transfer account transaction, and because the social attribute and the historical behavior attribute are diversified, a user does not need to perform extra security verification operation, thereby reducing the delay of the transfer account transaction, and meanwhile, when no transfer record exists among the users, whether an abnormal transfer account condition exists can be detected through the social attribute, thereby improving the coverage and accuracy of abnormal transfer account detection; and finally, the transfer transaction information is input into an abnormal transfer detection model of the transfer party to obtain the abnormal probability value of the transfer transaction information, so that the transfer transaction of the user can be detected and an abnormal early warning can be sent out.
Drawings
In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings that are required to be used in the description of the embodiments will be briefly described below.
FIG. 1 is a schematic diagram of an overall configuration of an abnormal account transfer detection system according to an embodiment of the present invention;
FIG. 2 is a schematic flow chart of an abnormal account transfer detection method according to an embodiment of the present invention;
FIG. 3 is a schematic diagram of a comprehensive anomaly probability provided by an embodiment of the present invention;
FIG. 4 is a schematic diagram of a user relationship network according to an embodiment of the present invention;
FIG. 5 is a schematic diagram of an abnormal account transfer detection device according to an embodiment of the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the present invention more clearly apparent, the present invention is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.
In order to better understand the scheme, the abnormal transfer detection system in the technical scheme of the invention is designed, the designed abnormal transfer detection system is explained below, and the overall architecture diagram of the abnormal transfer detection system is shown in the following figure 1:
fig. 1 exemplarily shows an overall architecture diagram of an abnormal transfer detection system provided by an embodiment of the present invention, as shown in fig. 1, the abnormal transfer detection system includes a data acquisition module, a database module, a user relationship network establishment module, an abnormal transfer detection model training module, and an abnormal transfer detection module, where the database module includes a self attribute database, a payment behavior attribute database, and an interaction attribute database, and the abnormal transfer detection model training module is connected to a background transaction system. Then, the design idea of the whole architecture of the abnormal transfer detection system is as follows: the data acquisition module acquires self attribute data, payment behavior attribute data and interaction attribute data of a user and respectively stores the self attribute data, the payment behavior attribute data and the interaction attribute data in a self attribute database, a payment behavior attribute database and an interaction attribute database; the user relationship network establishing module establishes a three-dimensional user relationship network according to the data of the self attribute database, the payment behavior attribute database and the interaction attribute database, wherein the three dimensions are the self attribute dimension, the payment behavior attribute dimension and the interaction attribute dimension; the abnormal transfer detection model training module acquires positive and negative samples of historical transfer transactions of a user from a background transaction system, establishes an abnormal transfer detection model by using a machine learning algorithm according to a user relationship network and the positive and negative samples of the historical transfer transactions of the user, uses the abnormal transfer detection model in the abnormal transfer detection module, and detects the transfer transactions and sends an abnormal early warning when the user initiates the transfer transactions. In addition, the relationship network of the user in the abnormal transfer detection system is not constant, the self attribute data, the payment behavior attribute data and the interaction attribute data collected by the abnormal transfer detection system change along with the change of the external relationship data of the user, and the abnormal transfer detection model is also continuously updated periodically.
The overall structure of the designed abnormal transfer detection system has the following advantages: firstly, when a user initiates a transfer transaction, various and huge user relationship networks contain a large amount of information of the user, so that additional safety verification operation is not needed by the user, the delay of the transfer transaction is reduced, secondly, when no transfer record exists among the users, the user relationship network can be established through self attribute data and interactive attribute data of the user, the problem that the user relationship network is difficult to establish if no historical transfer record exists among the users is solved, thirdly, an abnormal transfer detection model is established through the various and huge user relationship networks and positive and negative samples of the historical transfer transaction of the user, and the model is used for an abnormal transfer detection module, so that the coverage and the accuracy of abnormal transfer detection are improved.
Fig. 2 schematically illustrates a flow chart of an abnormal transfer detection method according to an embodiment of the present invention, and as shown in fig. 2, the method includes the following steps:
step S101: obtaining transfer transaction information, wherein the transfer transaction information comprises transfer party information;
step S102: determining an abnormal transfer detection model of the transfer party according to the information of the transfer party, wherein the abnormal transfer detection model is obtained according to the social attribute of the transfer party and the historical behavior attribute of the transfer party;
step S103: and inputting the transfer transaction information into an abnormal transfer detection model of the transfer party to obtain the abnormal probability value of the transfer transaction information.
Specifically, in the embodiment, when a user initiates a transfer transaction, an abnormal transfer detection module in the system analyzes an initiating user a and a receiving user B of the transfer transaction to acquire transfer transaction information of the initiating user a and the receiving user B; and inputting the transfer transaction information of the initiating user A and the receiving user B into an abnormal transfer detection model to obtain the abnormal probability value of the transfer transaction information. In the specific implementation, after the transfer transaction information of the initiating user A and the receiving user B is input into the abnormal transfer detection model, the abnormal probability value of the transfer transaction information can be obtained by using a machine learning algorithm. After the abnormal probability value of the transfer transaction information is obtained, the transfer transaction of the user can be detected and abnormal early warning can be sent out. The abnormal transfer detection model is obtained according to the social attribute of the transfer party and the historical behavior attribute of the transfer party, the abnormal transfer detection system can conveniently detect and identify the transfer transaction, the social attribute and the historical behavior attribute are diversified, so that the user does not need to carry out extra security verification operation, delay of the transfer transaction is reduced, and meanwhile, whether the abnormal transfer condition exists or not can be detected through the social attribute when no transfer record exists among the users, and therefore the coverage and accuracy of abnormal transfer detection are improved.
The abnormal transfer detection model can be obtained through the following three ways:
the first method is as follows: the abnormal transfer detection model is obtained according to the social attribute of the transfer party and the historical behavior attribute of the transfer party; specifically, the social attribute of the roll-out party and the historical behavior attribute of the roll-out party are used as the input of the abnormal transfer detection model, the abnormal transfer detection model is trained by applying a machine learning algorithm, and the abnormal transfer detection model is finally trained after multiple times of training.
The second method comprises the following steps: optionally, the abnormal transfer detection model is obtained according to social attributes of the transfer party and historical behavior attributes of the transfer party, and includes: the social attributes of the roll-out party comprise the self attributes of the roll-out party and interaction attributes obtained from the social network; the historical behavior attribute of the roll-out party comprises the payment behavior attribute of the roll-out party; determining a user relationship network of the transfer party according to the self attribute, the interaction attribute and the payment behavior attribute; establishing an abnormal transfer detection model of a transfer party through a machine learning algorithm according to the positive and negative samples of the historical transfer transaction and the user relationship network; specifically, a user relationship network of a transfer party is determined according to self attributes, interaction attributes and payment behavior attributes; and then, taking the positive and negative samples of the historical account transfer transaction and the user relationship network as the input of the abnormal account transfer detection model, training the abnormal account transfer detection model by using a machine learning algorithm, and finally training the abnormal account transfer detection model after multiple times of training.
The third method comprises the following steps: optionally, establishing an abnormal transfer detection model of the transfer party through a machine learning algorithm according to the positive and negative samples of the historical transfer transaction and the user relationship network, wherein the abnormal transfer detection model comprises: performing correlation analysis on self attribute, interaction attribute and payment behavior attribute in the user relationship network; deleting the attribute without correlation from the user relationship network to obtain a modified user relationship network; and establishing an abnormal transfer detection model of the transfer party through a machine learning algorithm according to the positive and negative samples of the historical transfer transaction and the corrected user relationship network. In specific implementation, the self attribute, the interaction attribute and the payment behavior attribute in the user relationship network respectively contain a lot of information or indexes, and if the self attribute, the interaction attribute and the payment behavior attribute totally contain 10000 indexes, firstly, correlation analysis or data cleaning and screening is performed on the 10000 indexes, for example, an index 1 and an index 2 present a linear relationship, then, one of the index 1 and the index 2 can be retained, the other index is deleted, and if the 10000 indexes are subjected to correlation analysis or data cleaning and screening, 1000 indexes are finally retained; then obtaining a corrected user relationship network according to 1000 indexes, taking the positive and negative samples of the historical transfer transaction and the corrected user relationship network as the input of an abnormal transfer detection model and training the abnormal transfer detection model by using a machine learning algorithm, and in the training process, performing index correlation analysis by combining the positive and negative samples of the historical transfer transaction to correct the user relationship network again, for example, some indexes which do not have any influence on the positive and negative samples of the historical transfer transaction are also available in 1000 indexes and can be deleted, if 500 indexes in 1000 indexes do not have any influence on the positive and negative samples of the historical transfer transaction, obtaining the corrected user relationship network which contains 500 indexes again, taking the corrected user relationship network and the positive and negative samples of the historical transfer transaction as the input of the abnormal transfer detection model and training the abnormal transfer detection model by using the machine learning algorithm, and finally, training an abnormal transfer detection model, wherein the positive and negative samples of the historical transfer transaction are obtained by connecting an abnormal transfer detection model training module in the abnormal transfer detection system with a background transaction system, and the positive and negative samples of the historical transfer transaction comprise the historical normal transfer transaction record and the historical abnormal transfer transaction record of the user. The first point to be explained is: the user relationship network is corrected twice, the user relationship network corrected again can be performed in the training process of the abnormal transfer detection model, or can be performed before the training of the abnormal transfer detection model, for example, 1000 indexes in the user relationship network corrected again are combined with positive and negative samples of historical transfer transactions to perform correlation analysis or data cleaning and screening, 500 indexes are finally screened out, the user relationship network corrected again and the positive and negative samples of the historical transfer transactions containing 500 indexes are used as the input of the abnormal transfer detection model, and the abnormal transfer detection model is trained by using a machine learning algorithm; the second point to be explained is: in the specific implementation, the abnormal transfer is input into the abnormal transfer detection model in the form of a record, for example, the record 1 is: the transfer time is 8 morning, the transfer amount is 8000, the transfer place is Shanghai, the transfer mode is card swiping, the relation with a transfer receiving user is colleague, and the transfer transaction is a positive sample; the third point to be noted is: in specific implementation, if all the positive samples and the negative samples of the historical transfer transactions of the user are positive samples, the quantity of the historical transfer transaction records of the user can be reduced, and if the negative samples in the positive samples and the negative samples of the historical transfer transactions of the user are far greater than the quantity of the positive samples, the quantity of the historical transfer transaction records of the user can be increased.
Through the three determination modes of the abnormal transfer detection model, the determination mode of the abnormal transfer detection model has the characteristics of diversity and flexibility; the user relationship network is corrected twice, and actually, data dimension reduction is performed twice on the user relationship network, so that the calculated amount and pressure of the system can be reduced, and the effect of which indexes on the account transfer transaction can be achieved can be determined.
Optionally, the step of inputting the transfer transaction information into an abnormal transfer detection model of the transfer party to obtain an abnormal probability value of the transfer transaction information includes: inputting the transfer transaction information into an abnormal transfer detection model of a transfer party to obtain the self attribute abnormal probability value, the interaction attribute abnormal probability value and the payment behavior attribute abnormal probability value of the transfer transaction information; and obtaining the abnormal probability value of the transfer transaction information according to the self attribute abnormal probability value, the interaction attribute abnormal probability value and the payment behavior attribute abnormal probability value. Specifically, assuming that a user A transfers money to a user B, an abnormal transfer detection module in the abnormal transfer detection system analyzes the user A and the user B to obtain indexes of the user A and the user B, the indexes are input into an abnormal transfer detection model, three abnormal probability values are obtained, namely a self-attribute abnormal probability value, an interaction attribute abnormal probability value and a payment behavior attribute abnormal probability value, and are assumed to be 0.3, 0.5 and 0.2 respectively, appropriate weights are applied to the three abnormal probability values respectively, the abnormal probability values with the applied weights are added, and finally, a comprehensive abnormal probability that the transfer transaction is an abnormal transfer transaction is generated, and is assumed to be 0.25, and the comprehensive abnormal probability indicates a risk value that the current transfer transaction is abnormal. If the comprehensive probability is very high, the system directly sends out an abnormal early warning. Fig. 3 exemplarily shows a comprehensive anomaly probability diagram, as shown in fig. 3.
Optionally, the self-attribute comprises at least one of: identity information index, education degree index, occupation status index, family condition index and social information index; in specific implementation, the identity information index may further include information representing the identity of the user, such as an identity card, a passport, a gender, an age, a mobile phone number, and the like; the education level index indicates the culture level of the user; the occupation status index reflects whether the user has a fixed and proper occupation and the work replacement frequency; the family condition indexes comprise marital and child conditions and the like; the social information index comprises social insurance, medical insurance remittance conditions and social credit conditions, wherein the social credit conditions can be overdue bank cards or overdue arrears of public utilities payment and the like. And the abnormal transfer detection system depicts a basic situation portrait of the user according to the attribute information of the abnormal transfer detection system. For example, if the user has no fixed occupation, incomplete or fake identification information, poor social information, etc., and the transfer transaction amount is relatively large, the probability of abnormality of the transfer transaction, whether the transfer transaction is the initiating user or the receiving user, is relatively high, for example, the transfer may be money laundering or telecommunication fraud.
The payment behavior attributes include at least one of: transfer frequency index, transfer time distribution index, transfer place distribution index, transfer amount distribution index and transfer mode proportion index; in specific implementation, the data of the payment behavior attribute is mainly obtained from a bank channel, a card organization, a third-party payment mechanism and the like, and the data of the payment behavior attribute comprises a historical transfer record, historical consumption details and the like. In the historical account transfer record, the account transfer object comprises an account, a card number and the like, and the account transfer object, the account transfer amount, the account transfer time, the account transfer place and the account transfer mode are used for carrying out statistical analysis on the distribution of the account transfer object, the corresponding account transfer frequency, the distribution of the user account transfer amount, the distribution of the account transfer time and place, the account transfer mode ratio and the like. In the transfer object analysis, sorting the objects according to the transfer frequency from high to low; in the distribution of the transfer amount, the transfer time and the transfer place, the transfer amount interval of the user and the fluctuation trend along with the time can be analyzed and obtained, if the transfer of the user presents regular distribution and the fluctuation is smooth, but the current transfer amount suddenly increases and the transfer time is free from the distribution, the abnormal transfer probability is higher; through the proportion analysis of the historical account transfer mode of the user, the user can know that the user is more inclined to a traditional channel, such as an ATM (automatic teller machine), a bank counter or an innovation channel, such as a computer terminal and a mobile terminal, to perform account transfer transaction, if the user frequently performs the account transfer transaction through the traditional channel and the current account transfer is performed through the mobile terminal, the judgment weight of the index on the abnormal account transfer probability is increased. In addition, in the historical transfer transaction data of the user, the wasting index and the transaction channel of the user are analyzed according to the information of the historical transfer transaction and the consumption record of the user, such as consumption frequency, consumption amount, consumption mode and the like. The wasting capacity index indicates the consumption level of the user and reflects the wasting capacity and purchasing power of the user, namely large consumption or small consumption often occurs. The consumption mode shows that the user is more inclined to a traditional payment mode such as a POS machine card swiping mode and the like or an innovative payment mode such as cloud flash payment and two-dimension code scanning payment and the like, and further the enthusiasm degree of the user on mobile innovative payment is reflected.
The interaction attributes include at least one of: friend frequency index, contact frequency index and susceptibility index. In the specific implementation of the invention, besides establishing the payment behavior attribute relationship network among users, the interactive attribute relationship network of the users is also established, so that the strong and weak relationship between the two parties of the account transfer can be judged through the interactive attribute even if the two parties of the account transfer do not have historical account transfer records. In the interaction attribute, the data includes WeChat, QQ, microblog, mail, telecom operators such as short message or call, online game, even lottery data, and the like, and each user establishes a complex interaction attribute relationship network. In the interaction attribute relationship network, the main indexes include a series of indexes capable of reflecting the closeness degree of the association between the user and other users, such as friend frequency, contact frequency, goodness and the like. The friend frequency index reflects the closeness degree of the friend relationship between the users, and if both the users are in friend relationship in various types of social software such as WeChat, qq and the like, the friend frequency between the users is high. The contact frequency index reflects the height of the contact frequency among the users, and the contact frequency among the users is mainly obtained from the communication social data. The good-feeling index reflects the positive and negative good or bad of the relation between users, and the good-feeling index between users can be obtained by utilizing the natural language analysis technology to carry out word segmentation, word frequency statistics, good or bad word analysis and the like on the chat communication content of the users. In addition to social networking applications, data such as network games, lotteries, etc. may also reflect a complex network of relationships for users, e.g., in online tours, relationships between team members in the same team may further complement the interactive attribute relationship network.
Since the user relationship network is determined according to the self attribute, the interaction attribute and the payment behavior attribute, based on the content of the above specific introduction of the self attribute, the interaction attribute and the payment behavior attribute, the following specific establishment process of the user relationship network based on the self attribute, the interaction attribute and the payment behavior attribute is introduced, and includes three processes:
the self attribute, the interaction attribute and the payment behavior attribute can be considered as three dimensions of a user relationship network, and 1, information in the self attribute, the interaction attribute and the payment behavior attribute is scored: in the self attribute dimension, the identity information index, the education degree index, the occupation status index, the family condition index and the social information index of the user are judged and respectively scored, if the identity information of the users of both sides of the transfer transaction is complete and real, the occupation is stable and the social information is good, the probability that the transfer transaction is abnormal is obviously reduced, and the scores of the identity information index, the occupation status index and the social information index of the user can be marked down; in the interaction attribute dimension, judging and scoring friend frequency indexes, contact frequency indexes, goodness indexes and the like, wherein the friend frequency indexes, contact frequency indexes and goodness indexes can intuitively reflect whether social relations exist among users, the degree of close contact and positive or negative emotional colors among users, for example, a friend user B of a user A applies for transfer account requirements to the user A, but the interaction attribute dimension finds that the frequency of friends between the users A and B is low, the contact is few and no goodness exists, which indicates that the social interaction attributes of the users A and B are weak and the user B can be stolen, and then scores of the friend frequency indexes, contact frequency indexes and goodness indexes of the interaction attributes are high; in the payment behavior attribute dimension, deep mining analysis is carried out on all transfer transactions and consumption records of the user, the density relation of transfer objects of the user is obtained, the transfer transactions or consumption habits of the user are analyzed, and the payment portrait of the user is depicted. Historical account transfer transactions, consumption and other behaviors between an initiating user and a receiving user of the current account transfer transaction are frequent, the account transfer amount is stable and accords with the labor consumption level of the user, the probability that the current account transfer transaction is abnormal is relatively low, and a lower score can be given to information in the attribute dimension of the payment behavior; on the contrary, the transfer initiating user and the transfer receiving user do not have transfer transaction, the payment relationship of the transfer receiving user is complex and irregular, and the current transfer amount is seriously inconsistent with the waste of the transfer initiating user, so that the transfer abnormal probability is higher, if the transfer initiating user possibly suffers telecommunication fraud activity, the information in the attribute dimension of the payment behavior can be scored higher; 2. generating each weight value for scores marked by information in the self attribute, the interaction attribute and the payment behavior attribute; 3. and forming a user relationship network graph by taking the transfer users as central nodes and taking each weight value as a side. Fig. 4 exemplarily shows a schematic view of a user relationship network, as shown in fig. 4.
From the above, it can be seen that: the embodiment of the invention provides an abnormal transfer detection method, which comprises the steps of obtaining transfer transaction information, wherein the transfer transaction information comprises transfer party information; determining an abnormal transfer detection model of the transfer party according to the information of the transfer party, wherein the abnormal transfer detection model is obtained according to the social attribute of the transfer party and the historical behavior attribute of the transfer party; and inputting the transfer transaction information into an abnormal transfer detection model of the transfer party to obtain the abnormal probability value of the transfer transaction information. In the embodiment of the invention, the account transfer transaction information is obtained firstly; then, according to the transfer transaction information, determining an abnormal transfer detection model of the transfer party, wherein the abnormal transfer detection model is obtained according to the social attribute of the transfer party and the historical behavior attribute of the transfer party, so that the transfer transaction is conveniently detected and identified by a system; and finally, the transfer transaction information is input into an abnormal transfer detection model of the transfer party to obtain the abnormal probability value of the transfer transaction information, so that the transfer transaction of the user can be detected and an abnormal early warning can be sent out.
Based on the same concept, fig. 5 exemplarily shows a schematic structural diagram of the abnormal transfer detection device provided by the embodiment of the present invention, and as shown in fig. 5, the device includes an obtaining unit 201, a determining unit 202, and a calculating unit 203. Wherein:
the acquisition unit 201: the system comprises a transfer unit, a transfer unit and a transfer unit, wherein the transfer unit is used for acquiring transfer transaction information which comprises transfer party information;
the determination unit 202: the transfer system comprises a transfer party, a transfer module and a transfer module, wherein the transfer module is used for determining an abnormal transfer detection model of the transfer party according to transfer party information, and the abnormal transfer detection model is obtained according to social attributes of the transfer party and historical behavior attributes of the transfer party;
the calculation unit 203: and the abnormal transfer detection module is used for inputting the transfer transaction information into the abnormal transfer detection model of the transfer party to obtain the abnormal probability value of the transfer transaction information.
Optionally, the social attributes of the roll-out party include the roll-out party's own attributes and interaction attributes obtained from the social network;
the historical behavior attribute of the roll-out party comprises the payment behavior attribute of the roll-out party;
the determining unit 202 is specifically configured to:
determining a user relationship network of the transfer party according to the self attribute, the interaction attribute and the payment behavior attribute;
and establishing an abnormal transfer detection model of the transfer party through a machine learning algorithm according to the positive and negative samples of the historical transfer transaction and the user relationship network.
Optionally, the calculating unit 203 is specifically configured to:
inputting the transfer transaction information into an abnormal transfer detection model of a transfer party to obtain the self attribute abnormal probability value, the interaction attribute abnormal probability value and the payment behavior attribute abnormal probability value of the transfer transaction information;
and obtaining the abnormal probability value of the transfer transaction information according to the self attribute abnormal probability value, the interaction attribute abnormal probability value and the payment behavior attribute abnormal probability value.
Optionally, the determining unit 202 is further specifically configured to:
performing correlation analysis on self attribute, interaction attribute and payment behavior attribute in the user relationship network;
deleting the attribute without correlation from the user relationship network to obtain a modified user relationship network; and establishing an abnormal transfer detection model of the transfer party through a machine learning algorithm according to the positive and negative samples of the historical transfer transaction and the corrected user relationship network.
Optionally, the self-attribute comprises at least one of: identity information index, education degree index, occupation status index, family condition index and social information index;
the payment behavior attributes include at least one of: transfer frequency index, transfer time distribution index, transfer place distribution index, transfer amount distribution index and transfer mode proportion index;
the interaction attributes include at least one of: friend frequency index, contact frequency index and susceptibility index.
From the above, it can be seen that: the embodiment of the invention provides an abnormal transfer detection device, which is used for acquiring transfer transaction information, wherein the transfer transaction information comprises transfer party information; determining an abnormal transfer detection model of the transfer party according to the information of the transfer party, wherein the abnormal transfer detection model is obtained according to the social attribute of the transfer party and the historical behavior attribute of the transfer party; and inputting the transfer transaction information into an abnormal transfer detection model of the transfer party to obtain the abnormal probability value of the transfer transaction information. In the embodiment of the invention, the account transfer transaction information is obtained firstly; then, according to the transfer transaction information, an abnormal transfer account detection model of the transfer party is determined, wherein the abnormal transfer account detection model is obtained according to the social attribute of the transfer party and the historical behavior attribute of the transfer party, so that the abnormal transfer account detection system can conveniently detect and identify the transfer account transaction, and because the social attribute and the historical behavior attribute are diversified, a user does not need to perform extra security verification operation, thereby reducing the delay of the transfer account transaction, and meanwhile, when no transfer record exists among the users, whether an abnormal transfer account condition exists can be detected through the social attribute, thereby improving the coverage and accuracy of abnormal transfer account detection; and finally, the transfer transaction information is input into an abnormal transfer detection model of the transfer party to obtain the abnormal probability value of the transfer transaction information, so that the transfer transaction of the user can be detected and an abnormal early warning can be sent out.
It should be apparent to those skilled in the art that embodiments of the present invention may be provided as a method, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
While preferred embodiments of the present invention have been described, additional variations and modifications in those embodiments may occur to those skilled in the art once they learn of the basic inventive concepts. Therefore, it is intended that the appended claims be interpreted as including preferred embodiments and all such alterations and modifications as fall within the scope of the invention.
It will be apparent to those skilled in the art that various changes and modifications may be made in the present invention without departing from the spirit and scope of the invention. Thus, if such modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include such modifications and variations.

Claims (8)

1.一种异常转账侦测方法,其特征在于,包括:1. an abnormal transfer detection method, is characterized in that, comprises: 获取转账交易信息,所述转账交易信息中包括转出方信息;Obtain transfer transaction information, where the transfer transaction information includes transfer party information; 根据所述转出方信息,确定转出方的异常转账侦测模型,所述异常转账侦测模型根据所述转出方的社交属性和所述转出方的历史行为属性得到;According to the transfer party information, determine the abnormal transfer detection model of the transfer party, and the abnormal transfer detection model is obtained according to the social attributes of the transfer party and the historical behavior attributes of the transfer party; 将所述转账交易信息输入所述转出方的异常转账侦测模型,得到所述转账交易信息的异常概率值;Inputting the transfer transaction information into the abnormal transfer detection model of the transfer-out party to obtain the abnormal probability value of the transfer transaction information; 其中,所述异常转账侦测模型根据所述转出方的社交属性和所述转出方的历史行为属性得到,包括:Wherein, the abnormal transfer detection model is obtained according to the social attributes of the transfer party and the historical behavior attributes of the transfer party, including: 所述转出方的社交属性包括转出方的自身属性和从社交网络获得的交互属性;The social attributes of the transfer party include the transfer party's own attributes and the interaction attributes obtained from the social network; 所述转出方的历史行为属性包括所述转出方的支付行为属性;The historical behavior attribute of the transfer-out party includes the payment behavior attribute of the transfer-out party; 根据所述自身属性、所述交互属性和所述支付行为属性确定所述转出方的用户关系网络;Determine the user relationship network of the transfer party according to the self attribute, the interaction attribute and the payment behavior attribute; 根据历史转账交易正负样本和所述用户关系网络,通过机器学习算法建立所述转出方的异常转账侦测模型;According to the positive and negative samples of historical transfer transactions and the user relationship network, a machine learning algorithm is used to establish an abnormal transfer detection model of the transfer party; 其中,所述用户关系网络是通过多次修正而得到,且对所述用户关系网络进行修正包括在对所述异常转账侦测模型的训练过程中,以及包括在对所述异常转账侦测模型的训练之前的过程。Wherein, the user relationship network is obtained through multiple revisions, and the revision of the user relationship network is included in the training process of the abnormal transfer detection model, as well as in the abnormal transfer detection model. the pre-training process. 2.如权利要求1所述的方法,其特征在于,所述将所述转账交易信息输入所述转出方的异常转账侦测模型,得到所述转账交易信息的异常概率值,包括:2. The method according to claim 1, wherein the abnormal transfer detection model of the transfer transaction information is input into the transfer party, and the abnormal probability value of the transfer transaction information is obtained, comprising: 将所述转账交易信息输入所述转出方的异常转账侦测模型,得到所述转账交易信息的自身属性异常概率值、交互属性异常概率值和支付行为属性异常概率值;Inputting the transfer transaction information into the abnormal transfer detection model of the transfer-out party to obtain the abnormal probability value of its own attribute, the abnormal probability value of the interaction attribute and the abnormal probability value of the payment behavior attribute of the transfer transaction information; 根据所述自身属性异常概率值、所述交互属性异常概率值和所述支付行为属性异常概率值,得到所述转账交易信息的异常概率值。According to the abnormal probability value of the self attribute, the abnormal probability value of the interaction attribute and the abnormal probability value of the payment behavior attribute, the abnormal probability value of the transfer transaction information is obtained. 3.如权利要求1所述的方法,其特征在于,所述根据历史转账交易正负样本和所述用户关系网络,通过机器学习算法建立所述转出方的异常转账侦测模型,包括:3. The method according to claim 1, wherein, according to the positive and negative samples of historical transfer transactions and the user relationship network, the abnormal transfer detection model of the transfer-out party is established by a machine learning algorithm, comprising: 对所述用户关系网络中的自身属性、交互属性和支付行为属性进行相关性分析;Correlation analysis is carried out on self attributes, interaction attributes and payment behavior attributes in the user relationship network; 从所述用户关系网络中删除无相关性的属性,得到修正后的用户关系网络;根据所述历史转账交易正负样本和所述修正后的用户关系网络,通过机器学习算法建立所述转出方的异常转账侦测模型。Delete irrelevant attributes from the user relationship network to obtain a revised user relationship network; according to the positive and negative samples of the historical transfer transactions and the revised user relationship network, the transfer out is established through a machine learning algorithm Party's abnormal transfer detection model. 4.如权利要求3所述的方法,其特征在于,所述自身属性包括以下至少之一:身份信息指标、教育程度指标、职业状况指标、家庭情况指标、社会信息指标;4. The method according to claim 3, wherein the self-attribute comprises at least one of the following: an identity information index, an education level index, an occupational status index, a family situation index, and a social information index; 所述支付行为属性包括以下至少之一:转账频率指标、转账时间分布指标、转账地点分布指标、转账金额分布指标、转账方式占比指标;The payment behavior attribute includes at least one of the following: a transfer frequency index, a transfer time distribution index, a transfer location distribution index, a transfer amount distribution index, and a transfer method proportion index; 所述交互属性包括以下至少之一:好友频率指标、联络频率指标、好感度指标。The interaction attribute includes at least one of the following: a friend frequency index, a contact frequency index, and a favorability index. 5.一种异常转账侦测装置,其特征在于,包括:5. An abnormal transfer detection device, characterized in that, comprising: 获取单元,用于获取转账交易信息,所述转账交易信息中包括转出方信息;an obtaining unit, configured to obtain transfer transaction information, where the transfer transaction information includes transfer party information; 确定单元,用于根据所述转出方信息,确定转出方的异常转账侦测模型,所述异常转账侦测模型根据所述转出方的社交属性和所述转出方的历史行为属性得到;A determination unit, configured to determine the abnormal transfer detection model of the transfer party according to the transfer party information, and the abnormal transfer detection model is based on the social attributes of the transfer party and the historical behavior attributes of the transfer party. get; 计算单元,用于将所述转账交易信息输入所述转出方的异常转账侦测模型,得到所述转账交易信息的异常概率值;a computing unit, configured to input the transfer transaction information into the abnormal transfer detection model of the transfer-out party to obtain an abnormal probability value of the transfer transaction information; 其中,所述转出方的社交属性包括转出方的自身属性和从社交网络获得的交互属性;所述转出方的历史行为属性包括所述转出方的支付行为属性;Wherein, the social attribute of the transfer-out party includes the transfer-out party's own attribute and the interaction attribute obtained from the social network; the historical behavior attribute of the transfer-out party includes the payment behavior attribute of the transfer-out party; 所述确定单元,具体用于根据所述自身属性、所述交互属性和所述支付行为属性确定所述转出方的用户关系网络;The determining unit is specifically configured to determine the user relationship network of the transfer party according to the self attribute, the interaction attribute and the payment behavior attribute; 根据历史转账交易正负样本和所述用户关系网络,通过机器学习算法建立所述转出方的异常转账侦测模型;According to the positive and negative samples of historical transfer transactions and the user relationship network, a machine learning algorithm is used to establish an abnormal transfer detection model of the transfer party; 其中,所述用户关系网络是通过多次修正而得到,且对所述用户关系网络进行修正包括在对所述异常转账侦测模型的训练过程中,以及包括在对所述异常转账侦测模型的训练之前的过程。Wherein, the user relationship network is obtained through multiple revisions, and the revision of the user relationship network is included in the training process of the abnormal transfer detection model, as well as in the abnormal transfer detection model. the pre-training process. 6.如权利要求5所述的装置,其特征在于,6. The apparatus of claim 5, wherein 所述计算单元,具体用于将所述转账交易信息输入所述转出方的异常转账侦测模型,得到所述转账交易信息的自身属性异常概率值、交互属性异常概率值和支付行为属性异常概率值;The computing unit is specifically configured to input the transfer transaction information into the abnormal transfer detection model of the transfer party, and obtain the abnormal probability value of its own attribute, the abnormal probability value of the interaction attribute and the abnormal payment behavior attribute of the transfer transaction information probability value; 根据所述自身属性异常概率值、所述交互属性异常概率值和所述支付行为属性异常概率值,得到所述转账交易信息的异常概率值。According to the abnormal probability value of the self attribute, the abnormal probability value of the interaction attribute and the abnormal probability value of the payment behavior attribute, the abnormal probability value of the transfer transaction information is obtained. 7.如权利要求5所述的装置,其特征在于,7. The apparatus of claim 5, wherein 所述确定单元,具体还用于对所述用户关系网络中的自身属性、交互属性和支付行为属性进行相关性分析;The determining unit is further configured to perform a correlation analysis on the self attribute, interaction attribute and payment behavior attribute in the user relationship network; 从所述用户关系网络中删除无相关性的属性,得到修正后的用户关系网络;根据所述历史转账交易正负样本和所述修正后的用户关系网络,通过机器学习算法建立所述转出方的异常转账侦测模型。Delete irrelevant attributes from the user relationship network to obtain a revised user relationship network; according to the positive and negative samples of the historical transfer transactions and the revised user relationship network, the transfer out is established through a machine learning algorithm Party's abnormal transfer detection model. 8.如权利要求7所述的装置,其特征在于,所述自身属性包括以下至少之一:身份信息指标、教育程度指标、职业状况指标、家庭情况指标、社会信息指标;8. The device according to claim 7, wherein the self-attribute comprises at least one of the following: an identity information index, an education level index, an occupational status index, a family situation index, and a social information index; 所述支付行为属性包括以下至少之一:转账频率指标、转账时间分布指标、转账地点分布指标、转账金额分布指标、转账方式占比指标;The payment behavior attribute includes at least one of the following: a transfer frequency indicator, a transfer time distribution indicator, a transfer location distribution indicator, a transfer amount distribution indicator, and a transfer method ratio indicator; 所述交互属性包括以下至少之一:好友频率指标、联络频率指标、好感度指标。The interaction attribute includes at least one of the following: a friend frequency index, a contact frequency index, and a favorability index.
CN201611264190.3A 2016-12-30 2016-12-30 A kind of abnormal transfer detection method and device Active CN106803168B (en)

Priority Applications (3)

Application Number Priority Date Filing Date Title
CN201611264190.3A CN106803168B (en) 2016-12-30 2016-12-30 A kind of abnormal transfer detection method and device
PCT/CN2017/111096 WO2018121113A1 (en) 2016-12-30 2017-11-15 Abnormal account transfer detection method and device
TW106145681A TWI690884B (en) 2016-12-30 2017-12-26 Abnormal transfer detection method, device, storage medium, electronic equipment and products

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201611264190.3A CN106803168B (en) 2016-12-30 2016-12-30 A kind of abnormal transfer detection method and device

Publications (2)

Publication Number Publication Date
CN106803168A CN106803168A (en) 2017-06-06
CN106803168B true CN106803168B (en) 2021-04-16

Family

ID=58985292

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201611264190.3A Active CN106803168B (en) 2016-12-30 2016-12-30 A kind of abnormal transfer detection method and device

Country Status (3)

Country Link
CN (1) CN106803168B (en)
TW (1) TWI690884B (en)
WO (1) WO2018121113A1 (en)

Families Citing this family (43)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106803168B (en) * 2016-12-30 2021-04-16 中国银联股份有限公司 A kind of abnormal transfer detection method and device
CN107437176A (en) * 2017-07-11 2017-12-05 广东欧珀移动通信有限公司 Payment Methods and Related Products
CN107358360A (en) * 2017-07-14 2017-11-17 成都农村商业银行股份有限公司 The abnormal traffic data screening method of anti money washing system
CN107798530B (en) * 2017-08-09 2021-09-14 中国银联股份有限公司 Payment system and payment method
CN109472656B (en) * 2017-09-08 2022-11-29 腾讯科技(深圳)有限公司 Virtual article display method and device and storage medium
CN107908740B (en) * 2017-11-15 2022-11-22 百度在线网络技术(北京)有限公司 Information output method and device
CN107871213B (en) * 2017-11-27 2021-11-12 上海众人网络安全技术有限公司 Transaction behavior evaluation method, device, server and storage medium
CN109936525B (en) * 2017-12-15 2020-07-31 阿里巴巴集团控股有限公司 Abnormal account number prevention and control method, device and equipment based on graph structure model
CN109426960A (en) * 2017-12-28 2019-03-05 中国平安财产保险股份有限公司 Account authentication method, mobile device, account authentication equipment and readable storage medium storing program for executing
CN108334647A (en) * 2018-04-12 2018-07-27 阿里巴巴集团控股有限公司 Data processing method, device, equipment and the server of Insurance Fraud identification
CN108734479A (en) * 2018-04-12 2018-11-02 阿里巴巴集团控股有限公司 Data processing method, device, equipment and the server of Insurance Fraud identification
CN108647891B (en) * 2018-05-14 2020-07-14 口口相传(北京)网络技术有限公司 Data anomaly attribution analysis method and device
CN108769208B (en) * 2018-05-30 2022-04-22 创新先进技术有限公司 Specific user identification and information push method and device
CN109165940B (en) * 2018-06-28 2022-08-09 创新先进技术有限公司 Anti-theft method and device and electronic equipment
CN109118053B (en) * 2018-07-17 2022-04-05 创新先进技术有限公司 Method and device for identifying card stealing risk transaction
CN109191129A (en) * 2018-07-18 2019-01-11 阿里巴巴集团控股有限公司 A kind of air control method, system and computer equipment
CN109360085A (en) * 2018-09-27 2019-02-19 中国银行股份有限公司 A kind of bank client responsible investigation method and system
CN109784919B (en) * 2018-12-25 2024-08-06 瞬联软件科技(北京)有限公司 A method and system for displaying online payment security risk value using colors
CN110020858A (en) * 2019-03-13 2019-07-16 北京三快在线科技有限公司 Pay method for detecting abnormality, device, storage medium and electronic equipment
CN110175850B (en) * 2019-05-13 2023-08-01 中国银联股份有限公司 Method and device for processing transaction information
CN110363387B (en) * 2019-06-14 2023-09-05 平安科技(深圳)有限公司 Image analysis method, device, computer equipment and storage medium based on big data
CN110457601B (en) * 2019-08-15 2023-10-24 腾讯科技(武汉)有限公司 Social account identification method and device, storage medium and electronic device
CN110730459B (en) * 2019-10-25 2021-05-28 支付宝(杭州)信息技术有限公司 A kind of initiation method of near field communication authentication and related device
CN110955842A (en) * 2019-12-03 2020-04-03 支付宝(杭州)信息技术有限公司 Abnormal access behavior identification method and device
CN112990919B (en) * 2019-12-17 2025-01-17 中国银联股份有限公司 Information processing method and device
US11295310B2 (en) * 2020-02-04 2022-04-05 Visa International Service Association Method, system, and computer program product for fraud detection
CN111401478B (en) * 2020-04-17 2022-10-04 支付宝(杭州)信息技术有限公司 Data anomaly identification method and device
CN111681010A (en) * 2020-06-11 2020-09-18 中国银行股份有限公司 A transaction verification method and device
CN113935738B (en) * 2020-06-29 2024-04-19 腾讯科技(深圳)有限公司 Transaction data processing method, device, storage medium and equipment
CN111860647B (en) * 2020-07-21 2023-11-10 金陵科技学院 A method for determining abnormal consumption patterns
CN112016913A (en) * 2020-08-28 2020-12-01 中国农业银行股份有限公司湖南省分行 Social insurance medical insurance intelligent payment system based on mobile internet
CN114385762B (en) * 2020-10-20 2025-12-12 财付通支付科技有限公司 Account relationship determination methods, devices, servers, and storage media
CN112488708B (en) * 2020-11-30 2024-04-05 苏州黑云智能科技有限公司 Block chain account relevance query method and false transaction screening method
CN112491900B (en) * 2020-11-30 2023-04-18 中国银联股份有限公司 Abnormal node identification method, device, equipment and medium
CN112581283B (en) * 2020-12-28 2024-12-24 中国建设银行股份有限公司 Method and device for analyzing and warning transaction behavior of commercial bank employees
CN113011889B (en) * 2021-03-10 2023-09-15 腾讯科技(深圳)有限公司 Account anomaly identification method, system, device, equipment and medium
CN115147117B (en) * 2021-03-31 2025-10-17 腾讯科技(深圳)有限公司 Account group identification method, device and equipment with abnormal resource usage
CN113888153B (en) * 2021-11-10 2022-11-29 建信金融科技有限责任公司 Transfer abnormity prediction method, device, equipment and readable storage medium
CN114154507A (en) * 2021-11-12 2022-03-08 中国银行股份有限公司 Abnormal transfer monitoring method, device, equipment and storage medium
CN115187263A (en) * 2022-07-22 2022-10-14 中国银行股份有限公司 Risk control method and device for payment transaction
CN115439120B (en) * 2022-09-06 2025-08-08 连通(杭州)技术服务有限公司 Method and device for troubleshooting abnormal causes of transaction messages
CN117195130B (en) * 2023-09-19 2024-05-10 深圳市东陆高新实业有限公司 Intelligent all-purpose card management system and method
TWI883938B (en) * 2024-04-26 2025-05-11 台灣大哥大股份有限公司 Abnormal transaction detection method and abnormal transaction detection device

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103123712A (en) * 2011-11-17 2013-05-29 阿里巴巴集团控股有限公司 Method and system for monitoring network behavior data
CN104468249A (en) * 2013-09-17 2015-03-25 深圳市腾讯计算机系统有限公司 Method and device for detecting abnormal account number

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060294095A1 (en) * 2005-06-09 2006-12-28 Mantas, Inc. Runtime thresholds for behavior detection
TW201017569A (en) * 2008-10-21 2010-05-01 Univ Chaoyang Technology A financial fund transferring system capable of preventing illegal events
CN101714273A (en) * 2009-05-26 2010-05-26 北京银丰新融科技开发有限公司 Rule engine-based method and system for monitoring exceptional service of bank
CN103379431B (en) * 2012-04-19 2017-06-30 阿里巴巴集团控股有限公司 A kind of guard method of account safety and device
WO2014186639A2 (en) * 2013-05-15 2014-11-20 Kensho Llc Systems and methods for data mining and modeling
CN103716316B (en) * 2013-12-25 2018-09-25 上海拍拍贷金融信息服务有限公司 A kind of authenticating user identification system
CN105703966A (en) * 2014-11-27 2016-06-22 阿里巴巴集团控股有限公司 Internet behavior risk identification method and apparatus
CN105957271B (en) * 2015-12-21 2018-12-28 中国银联股份有限公司 A kind of financial terminal safety protecting method and system
CN106803168B (en) * 2016-12-30 2021-04-16 中国银联股份有限公司 A kind of abnormal transfer detection method and device

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103123712A (en) * 2011-11-17 2013-05-29 阿里巴巴集团控股有限公司 Method and system for monitoring network behavior data
CN104468249A (en) * 2013-09-17 2015-03-25 深圳市腾讯计算机系统有限公司 Method and device for detecting abnormal account number

Also Published As

Publication number Publication date
WO2018121113A1 (en) 2018-07-05
TWI690884B (en) 2020-04-11
TW201824135A (en) 2018-07-01
CN106803168A (en) 2017-06-06

Similar Documents

Publication Publication Date Title
CN106803168B (en) A kind of abnormal transfer detection method and device
US11526889B2 (en) Resource transferring monitoring method and device
US20230099864A1 (en) User profiling based on transaction data associated with a user
CN107563757B (en) Data risk identification method and device
US20140067656A1 (en) Method and system for fraud risk estimation based on social media information
US20170161745A1 (en) Payment account fraud detection using social media heat maps
CN111985703B (en) User identity state prediction method, device and equipment
US11538044B2 (en) System and method for generation of case-based data for training machine learning classifiers
CN109690608A (en) Extrapolating trends in confidence scores
Zhou et al. Fraud detection within bankcard enrollment on mobile device based payment using machine learning
US20230274282A1 (en) Transaction tracking and fraud detection using voice and/or video data
CN112750038B (en) Transaction risk determination method, device and server
CN111325619A (en) A method and device for updating a credit card fraud detection model based on joint learning
CN109800363A (en) Construct method, apparatus, equipment and the storage medium of standing relational network
CN115187252A (en) Method for identifying fraud in network transaction system, server and storage medium
US20240248971A1 (en) Same person detection of end users based on input device data
US20190114639A1 (en) Anomaly detection in data transactions
US20240420133A1 (en) Methods, systems, and computer program products for transfer validation
CN118195622A (en) Telecom fraud risk detection method and device
US20240273536A1 (en) Systems and methods for advanced user authentication in accessing a computer network
CN117350854A (en) Fund tracking methods, devices, electronic equipment and storage media
CN116503129A (en) Product recommendation method, device, computer equipment and computer readable storage medium
HK1238766A1 (en) Abnormal transfer detection method and device
HK1238766A (en) Abnormal transfer detection method and device
CN116012157A (en) A method and device for identifying false transactions

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
REG Reference to a national code

Ref country code: HK

Ref legal event code: DE

Ref document number: 1238766

Country of ref document: HK

GR01 Patent grant
GR01 Patent grant