CN114282924A

CN114282924A - Account identification method, device, equipment and storage medium

Info

Publication number: CN114282924A
Application number: CN202011038401.8A
Authority: CN
Inventors: 秦晶洋; 郑少平; 古开元; 谢强
Original assignee: Tencent Technology Shenzhen Co Ltd
Current assignee: Tencent Technology Shenzhen Co Ltd
Priority date: 2020-09-28
Filing date: 2020-09-28
Publication date: 2022-04-05
Anticipated expiration: 2040-09-28
Also published as: CN114282924B

Abstract

The application discloses an account identification method, device, equipment and storage medium, and belongs to the field of payment. According to the technical scheme provided by the embodiment of the application, the first type of target account is identified in a mode of combining condition matching and model identification. For condition matching, the resource transfer-out information of the account with abnormal virtual resource transfer-out times is subjected to condition matching, and a type parameter is determined according to the matching result. For model identification, the resource transfer-out information and the account characteristic information of the abnormal account are combined for classification to obtain another type parameter. The abnormal account is identified based on the type parameter obtained by fusing the two type parameters, so that the real-time performance and the accuracy of the identification of the first type of target account can be improved.

Description

Account identification method, device, equipment and storage medium

Technical Field

The present application relates to the field of payment, and in particular, to an account identification method, apparatus, device, and storage medium.

Background

With the development of network technology, mobile payment is more and more convenient, and mobile payment covers more and more scenes. However, the convenience of mobile payment also provides convenience for some illegal financial activities.

In the related art, offline analysis is often performed on the illegal financial activities that have occurred, and a policy for identifying accounts participating in the illegal financial activities is formulated. However, since the offline analysis has a time lag, the accounts participating in the illegal financial activities are likely to change the online transaction manner to cope with the identification policy, and the identification accuracy of the accounts participating in the illegal financial activities is not high.

Disclosure of Invention

The embodiment of the application provides an account identification method, an account identification device, account identification equipment and a storage medium, and the account identification effect of participating in illegal financial activities can be improved. The technical scheme is as follows:

in one aspect, an account identification method is provided, and the method includes:

acquiring resource transfer-out information of a first account, wherein the resource transfer-out information comprises virtual resource transfer-out time of the first account and the number of transferred virtual resources, and the first account is an account of which the number of times of transferring out the virtual resources in a target time period meets a first target condition;

determining a target resource transfer-out condition from a plurality of resource transfer-out conditions, wherein the target resource transfer-out condition is matched with the resource transfer-out information, and the plurality of resource transfer-out conditions are used for expressing the resource transfer-out behavior characteristics of the first type of target account;

acquiring a first type parameter corresponding to the target resource transferring-out condition;

inputting the resource transfer-out information and first account characteristic information of the first account into a first classification model, classifying the first account through the first classification model, and outputting a second type parameter of the first account;

fusing the first type parameters and the second type parameters to obtain third type parameters, wherein the third type parameters are used for representing the type of the first account;

identifying the first account as the first class of target account in response to the third type of parameter for the first account meeting a second target condition.

In a possible embodiment, the second classification model includes a first class decision tree sub-model and a second class decision tree sub-model, and the classifying the second account by the second classification model and outputting the second type parameter of the second account includes:

classifying the resource transfer-in information and the second account characteristics through a plurality of leaf nodes of a plurality of first decision trees of the first class decision tree sub-model, and outputting a third classification parameter corresponding to the second account, wherein the plurality of first decision trees are decision trees with mutually independent output results;

classifying the resource transfer-in information and the second account characteristics through a plurality of leaf nodes of a plurality of second decision trees of the second class decision tree sub-model, and outputting a fourth classification parameter corresponding to the second account, wherein the plurality of second decision trees are decision trees with output results correlated with each other;

outputting the fifth type parameter of the second account according to the third classification parameter and the fourth classification parameter;

wherein the leaf node is a classification condition.

In a possible embodiment, the outputting the fifth type parameter of the second account according to the third classification parameter and the fourth classification parameter includes:

performing logistic regression processing on the third classification parameter and the fourth classification parameter, and outputting the fifth type parameter of the second account.

In a possible implementation manner, the fusing the fourth type parameter and the fifth type parameter to obtain a sixth type parameter includes:

and performing logistic regression processing on the fourth type parameter and the fifth type parameter to obtain the sixth type parameter.

In a possible embodiment, before the obtaining the resource transfer information of the second account, the method further includes:

acquiring target virtual resource transfer-in times, wherein the target virtual resource transfer-in times are virtual resource transfer-out times with occurrence probability smaller than a second probability threshold;

and in response to the fact that the virtual resource transfer times of any account in the target time period are the same as the target virtual resource transfer times, determining the any account as the second account.

In a possible implementation manner, the method for determining the transfer times of the target virtual resource includes: acquiring virtual resource transfer times of a plurality of accounts in the target time period;

performing linear fitting on a plurality of scattered points to obtain a fitting curve, wherein the plurality of scattered points are used for representing a plurality of virtual resource transfer times and the account number corresponding to the plurality of virtual resource transfer times;

determining a distance between the plurality of scatter points and the fitted curve in response to a goodness-of-fit of the fitted curve to the plurality of scatter points being less than a goodness-of-fit threshold;

and determining the transfer times of the target virtual resources corresponding to any scatter point in response to the fact that the distance between the any scatter point and the fitted curve is larger than a second distance threshold value.

In a possible embodiment, after identifying the second account as the second class target account in response to the sixth type parameter of the second account meeting a fourth target condition, the method further comprises at least one of:

identifying the terminal used by the second type target account as a second type target terminal;

identifying a wireless network connected with a terminal used by the second type target account as a second type target network;

and identifying the object of the plurality of first-class target accounts for transferring the virtual resources in the target time period as a second-class target account.

In a possible implementation, the training method of the second classification model includes:

acquiring first sample resource transfer-in information and third sample account characteristic information of a third sample account, wherein the third sample account is an account carrying target characters when virtual resources are transferred, the target characters are associated with virtual resource transfer-in behaviors of the second type of target accounts, and the first sample resource transfer-in information comprises virtual resource transfer-in time of the third sample account and the number of transferred virtual resources;

inputting the first sample resource transfer-in information and third sample account characteristic information into a second model, classifying the third sample account through the second model, and outputting a predicted account type of the third sample account;

adjusting the model parameters of the second model according to third difference information between the predicted account type of the third sample account and the actual account type of the third sample account;

and in response to the model parameters of the second model meeting the model convergence condition, taking the second model as the second classification model.

In a possible implementation, before the second model is taken as the second classification model in response to the model parameters of the second model meeting the model convergence condition, the method further includes:

acquiring second sample resource transfer-in information and fourth sample account characteristic information of a fourth sample account, wherein the fourth sample account is an account other than the second type of target account;

inputting the second sample resource transfer-in information and the fourth sample account characteristic information into the second model, classifying the fourth sample account through the second model, and outputting the predicted account type of the fourth sample account;

and adjusting the model parameters of the second model according to fourth difference information between the predicted account type of the fourth sample account and the actual account type of the fourth sample account.

In one aspect, an account identification apparatus is provided, the apparatus including:

the resource transfer-out information acquisition module is used for acquiring resource transfer-out information of a first account, wherein the resource transfer-out information comprises virtual resource transfer-out time of the first account and the number of transferred virtual resources, and the first account is an account of which the number of times of transferring out the virtual resources in a target time period meets a first target condition;

the first matching module is used for determining a target resource transfer-out condition from a plurality of resource transfer-out conditions, the target resource transfer-out condition is matched with the resource transfer-out information, and the plurality of resource transfer-out conditions are used for expressing the resource transfer-out behavior characteristics of a first type of target account;

the first type parameter acquisition module is used for acquiring a first type parameter corresponding to the target resource transfer-out condition;

the first input module is used for inputting the resource transfer-out information and the first account characteristic information of the first account into a first classification model, classifying the first account through the first classification model, and outputting a second type parameter of the first account;

the first parameter fusion module is used for fusing the first type parameters and the second type parameters to obtain third type parameters, and the third type parameters are used for representing the type of the first account;

a first identification module, configured to identify the first account as the first class of target account in response to a second target criterion being met by the third type parameter of the first account.

In a possible implementation manner, the first matching module is configured to compare the resource roll-out information with the plurality of resource roll-out conditions respectively; and in response to the fact that the resource transfer-out information meets any resource transfer-out condition, determining the any resource transfer-out condition as the target resource transfer-out condition.

In a possible implementation manner, the first classification model includes a first class decision tree sub-model and a second class decision tree sub-model, the first input module is configured to classify the resource export information and the first account characteristics through a plurality of leaf nodes of a plurality of first decision trees of the first class decision tree sub-model, and output a first classification parameter corresponding to the first account, where the plurality of first decision trees are decision trees whose output results are independent of each other; classifying the resource transfer-out information and the first account characteristics through a plurality of leaf nodes of a plurality of second decision trees of the second class decision tree submodel, and outputting a second classification parameter corresponding to the first account, wherein the plurality of second decision trees are decision trees with output results correlated with each other; outputting the second type parameter of the first account according to the first classification parameter and the second classification parameter; wherein the leaf node is a classification condition.

In a possible implementation manner, the first input module is configured to perform logistic regression processing on the first classification parameter and the second classification parameter, and output the second type parameter of the first account.

In a possible implementation manner, the first parameter fusion module is configured to perform logistic regression processing on the first type parameter and the second type parameter to obtain the third type parameter.

In a possible embodiment, the apparatus further comprises: the first account determination module is used for acquiring the transfer-out times of the target virtual resources, wherein the transfer-out times of the target virtual resources are the transfer-out times of the virtual resources with the occurrence probability smaller than a first probability threshold; and in response to the fact that the virtual resource transfer-out times of any account in the target time period are the same as the target virtual resource transfer-out times, determining the any account as the first account.

In a possible implementation manner, the first account determination module is further configured to obtain virtual resource roll-out times of the multiple accounts within the target time period; performing linear fitting on a plurality of scattered points to obtain a fitting curve, wherein the plurality of scattered points are used for representing a plurality of virtual resource transfer-out times and the account number corresponding to the plurality of virtual resource transfer-out times; determining a distance between the plurality of scatter points and the fitted curve in response to a goodness-of-fit of the fitted curve to the plurality of scatter points being less than a goodness-of-fit threshold; and determining the transferring times of the target virtual resources corresponding to any scatter point in response to the fact that the distance between the any scatter point and the fitted curve is larger than a first distance threshold.

In a possible embodiment, the first identification module is further configured to perform at least one of the following operations:

identifying the terminal used by the first type of target account as a first type of target terminal; identifying a wireless network connected with a terminal used by the first type of target account as a first type of target network; identifying objects of the plurality of first class target accounts for transferring virtual resources within the target time period as second class target accounts; in response to the object of any account transferring virtual resources within the target time period being the same as the plurality of target accounts of the first class, identifying the any account as the target account of the first class.

In one possible embodiment, the training module of the first classification model includes:

a first sample information obtaining unit, configured to obtain first sample resource transfer-out information and first sample account characteristic information of a first sample account, where the first sample account carries target characters when transferring virtual resources, the target characters are associated with virtual resource transfer-out behaviors of a first type of target account, and the first sample resource transfer-out information includes virtual resource transfer-out time of the first sample account and a transferred-out virtual resource quantity;

a first sample information input unit, configured to input the first sample resource roll-out information and first sample account feature information into a first model, classify the first sample account through the first model, and output a predicted account type of the first sample account;

a first model parameter adjusting unit, configured to adjust a model parameter of the first model according to first difference information between a predicted account type of the first sample account and an actual account type of the first sample account;

a first model determination unit, configured to determine the first model as the first classification model in response to a model parameter of the first model meeting a model convergence condition.

In a possible implementation, the training device of the first classification model further includes:

a second sample information obtaining unit, configured to obtain second sample resource transfer-out information and second sample account feature information of a second sample account, where the second sample account is an account other than the first type of target account;

a second sample information input unit, configured to input the second sample resource transfer-out information and the second sample account feature information into the first model, classify the second sample account through the first model, and output a predicted account type of the second sample account;

and the second model parameter adjusting unit is used for adjusting the model parameters of the first model according to second difference information between the predicted account type of the second sample account and the actual account type of the second sample account.

In a possible embodiment, the apparatus further comprises:

the resource transfer information acquisition module is used for acquiring resource transfer information of a second account, wherein the resource transfer information comprises virtual resource transfer time of the second account and the number of transferred virtual resources, and the second account is an account of which the number of times of transferring virtual resources in a target time period meets a third target condition;

the second matching module is used for determining target resource transfer-in conditions from a plurality of resource transfer-in conditions, the target resource transfer-in conditions are matched with the resource transfer-in information, and the resource transfer-in conditions are used for representing resource transfer-in behavior characteristics of a second type of target account;

a fourth type parameter obtaining module, configured to obtain a fourth type parameter corresponding to the target resource transfer-in condition;

the second input module is used for inputting the resource transfer-in information and second account characteristic information of the second account into a second classification model, classifying the second account through the second classification model, and outputting a fifth type parameter of the second account;

a second parameter fusion module, configured to fuse the fourth type parameter and the fifth type parameter to obtain a sixth type parameter, where the sixth type parameter is used to indicate a type of the second account;

and the second identification module is used for identifying the second account as the second type target account in response to that the sixth type parameter of the second account meets a fourth target condition.

In a possible implementation manner, the second matching module is configured to compare the resource transfer information with the plurality of resource transfer conditions respectively; and determining any resource transfer-in condition as the target resource transfer-in condition in response to the resource transfer-in information meeting any resource transfer-in condition.

In a possible implementation manner, the second classification model includes a first-class decision tree sub-model and a second-class decision tree sub-model, the second input module is configured to classify the resource transfer-in information and the second account characteristics through a plurality of leaf nodes of a plurality of first decision trees of the first-class decision tree sub-model, and output a third classification parameter corresponding to the second account, where the plurality of first decision trees are decision trees whose output results are independent of each other; classifying the resource transfer-in information and the second account characteristics through a plurality of leaf nodes of a plurality of second decision trees of the second class decision tree sub-model, and outputting a fourth classification parameter corresponding to the second account, wherein the plurality of second decision trees are decision trees with output results correlated with each other; outputting the fifth type parameter of the second account according to the third classification parameter and the fourth classification parameter; wherein the leaf node is a classification condition.

In a possible implementation manner, the second input module is configured to perform logistic regression processing on the third classification parameter and the fourth classification parameter, and output the fifth type parameter of the second account.

In a possible implementation manner, the second parameter fusion module is configured to perform logistic regression processing on the fourth type parameter and the fifth type parameter to obtain the sixth type parameter.

In a possible implementation manner, the apparatus further includes a second account determining module, configured to obtain target virtual resource transfer-in times, where the target virtual resource transfer-in times are virtual resource transfer-out times whose occurrence probability is smaller than a second probability threshold; and in response to the fact that the virtual resource transfer times of any account in the target time period are the same as the target virtual resource transfer times, determining the any account as the first account.

In a possible implementation manner, the second account determination module is further configured to obtain virtual resource transfer times of a plurality of accounts within the target time period; performing linear fitting on a plurality of scattered points to obtain a fitting curve, wherein the plurality of scattered points are used for representing a plurality of virtual resource transfer times and the account number corresponding to the plurality of virtual resource transfer times; determining a distance between the plurality of scatter points and the fitted curve in response to a goodness-of-fit of the fitted curve to the plurality of scatter points being less than a goodness-of-fit threshold; and determining the transfer times of the target virtual resources corresponding to any scatter point in response to the fact that the distance between the any scatter point and the fitted curve is larger than a second distance threshold value.

In a possible embodiment, the second identification module is further configured to perform at least one of the following operations: identifying the terminal used by the second type target account as a second type target terminal; identifying a wireless network connected with a terminal used by the second type target account as a second type target network; and identifying the object of the plurality of first-class target accounts for transferring the virtual resources in the target time period as a second-class target account.

In a possible implementation, the training device of the second classification model includes:

a third sample information obtaining unit, configured to obtain first sample resource transfer information and third sample account characteristic information of a third sample account, where the third sample account is an account that carries target characters when virtual resources are transferred, the target characters are associated with virtual resource transfer behaviors of the second type of target account, and the first sample resource transfer information includes virtual resource transfer time of the third sample account and the number of transferred virtual resources;

a third sample information input unit, configured to input the first sample resource transfer information and third sample account feature information into a second model, classify the third sample account through the second model, and output a predicted account type of the third sample account;

a third model parameter adjusting unit, configured to adjust the model parameter of the second model according to third difference information between the predicted account type of the third sample account and the actual account type of the third sample account;

and the second model determining unit is used for responding to the model convergence condition that the model parameters of the second model meet the model convergence condition, and taking the second model as the second classification model.

In a possible implementation, the training device of the second classification model further includes:

a fourth sample information obtaining unit, configured to obtain second sample resource transfer-in information and fourth sample account feature information of a fourth sample account, where the fourth sample account is an account other than the second type of target account;

a fourth sample information input unit, configured to input the second sample resource transfer-in information and the fourth sample account feature information into the second model, classify the fourth sample account through the second model, and output a predicted account type of the fourth sample account;

and the fourth model parameter adjusting unit is used for adjusting the model parameters of the second model according to fourth difference information between the predicted account type of the fourth sample account and the actual account type of the fourth sample account.

In one aspect, a computer device is provided, which includes one or more processors and one or more memories having at least one program code stored therein, the program code being loaded and executed by the one or more processors to implement the above-mentioned account identification method.

In one aspect, a computer-readable storage medium having at least one program code stored therein is provided, the program code being loaded and executed by a processor to implement the account identification method described above.

In one aspect, a computer program product or a computer program is provided, the computer program product or the computer program comprising computer program code, the computer program code being stored in a computer-readable storage medium, the computer program code being read by a processor of a computer device from the computer-readable storage medium, the computer program code being executable by the processor to cause the computer device to perform the account identification method described above.

According to the technical scheme provided by the embodiment of the application, the first type of target account is identified in a mode of combining condition matching and model identification. For condition matching, the resource transfer-out information of the account with abnormal virtual resource transfer-out times is subjected to condition matching, and a type parameter is determined according to the matching result. For model identification, the resource transfer-out information and the account characteristic information of the abnormal account are combined for classification to obtain another type parameter. The abnormal account is identified based on the type parameter obtained by fusing the two type parameters, so that the real-time performance and the accuracy of the identification of the first type of target account can be improved.

Drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the description of the embodiments are briefly introduced below, and it is obvious that the drawings in the following description are only some embodiments of the present application, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without creative efforts.

FIG. 1 is a schematic diagram of an implementation environment of an account identification method according to an embodiment of the present application;

FIG. 2 is a schematic diagram of a distribution of transaction time-transaction number provided in an embodiment of the present application;

FIG. 3 is a diagram illustrating a distribution of transaction times to transaction people when illegal financial activities do not occur according to an embodiment of the present application;

FIG. 4 is a diagram illustrating the distribution of transaction times to transaction people in the case of illegal financial activities according to an embodiment of the present application;

FIG. 5 is a schematic view of a scatter distribution provided by an embodiment of the present application;

FIG. 6 is a schematic view of a scatter distribution provided by an embodiment of the present application;

FIG. 7 is a flowchart of a training method of a first classification model according to an embodiment of the present application;

FIG. 8 is a flowchart of a training method of a first classification model according to an embodiment of the present application;

FIG. 9 is a flowchart of an account identification method according to an embodiment of the present disclosure;

FIG. 10 is a flowchart of an account identification method according to an embodiment of the present disclosure;

fig. 11 is a flowchart of a method for obtaining a second type parameter according to an embodiment of the present application;

FIG. 12 is a flowchart of an account identification method according to an embodiment of the present disclosure;

FIG. 13 is a flowchart of an account identification method according to an embodiment of the present disclosure;

FIG. 14 is a flowchart of a method for training a second classification model according to an embodiment of the present application;

FIG. 15 is a schematic illustration of one sample type provided by an embodiment of the present application;

FIG. 16 is a flowchart of an account identification method according to an embodiment of the present application;

FIG. 17 is a flowchart of an account identification method according to an embodiment of the present application;

fig. 18 is a schematic structural diagram of an account identification apparatus according to an embodiment of the present application;

fig. 19 is a schematic structural diagram of a terminal according to an embodiment of the present application;

fig. 20 is a schematic structural diagram of a server according to an embodiment of the present application.

Detailed Description

To make the objects, technical solutions and advantages of the present application more clear, embodiments of the present application will be described in further detail below with reference to the accompanying drawings.

The terms "first," "second," and the like in this application are used for distinguishing between similar items and items that have substantially the same function or similar functionality, and it should be understood that "first," "second," and "nth" do not have any logical or temporal dependency or limitation on the number or order of execution.

The term "at least one" in this application means one or more, "a plurality" means two or more, for example, a plurality of reference face images means two or more reference face images.

Artificial Intelligence (AI) is a theory, method, technique and application system that uses a digital computer or a machine controlled by a digital computer to simulate, extend and expand human Intelligence, perceive the environment, acquire knowledge and use the knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technique of computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can react in a manner similar to human intelligence. Artificial intelligence is the research of the design principle and the realization method of various intelligent machines, so that the machines have the functions of perception, reasoning and decision making.

The artificial intelligence technology is a comprehensive subject and relates to the field of extensive technology, namely the technology of a hardware level and the technology of a software level. The artificial intelligence infrastructure generally includes technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technologies, operation/interaction systems, mechatronics, and the like. The artificial intelligence software technology mainly comprises a computer vision technology, a voice processing technology, a natural language processing technology, machine learning/deep learning and the like.

Machine Learning (ML) is a multi-domain cross discipline, and relates to a plurality of disciplines such as probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory and the like. The special research on how a computer simulates or realizes the learning behavior of human beings so as to acquire new knowledge or skills and reorganize the existing knowledge submodel to continuously improve the performance of the computer. Machine learning is the core of artificial intelligence, is the fundamental approach for computers to have intelligence, and is applied to all fields of artificial intelligence. Machine learning and deep learning generally include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and teaching learning.

Mobile payment: including multiple payment methods such as payment by scanning a code, payment by a money-in-red transfer, payment face-to-face over a line, or payment in a game by virtual currency.

Virtual resources: money transferred during mobile payment, or virtual money in the game.

Power law distribution: the power law distribution refers to a variable having a distribution property, and the distribution density function is a distribution of power functions.

Fig. 1 is a schematic diagram of an implementation environment of an account identification method according to an embodiment of the present application, and referring to fig. 1, the implementation environment includes a terminal 110 and a server 140.

Optionally, the terminal 110 is a smart phone, a tablet computer, a notebook computer, a desktop computer, a smart speaker, a smart watch, etc., but is not limited thereto.

Optionally, the terminal 110 and the server 140 are directly or indirectly connected through wired or wireless communication, which is not limited in this application.

Optionally, the server 140 is an independent physical server, or a server cluster or a distributed system formed by a plurality of physical servers, or a cloud server providing basic cloud computing services such as cloud service, cloud database, cloud computing, cloud function, cloud storage, web service, cloud communication, middleware service, domain name service, security service, distribution Network (CDN), big data and artificial intelligence platform, and the like.

Optionally, the terminal 110 generally refers to one of a plurality of terminals, and the embodiment of the present application is illustrated by the terminal 110.

Of course, those skilled in the art will appreciate that the number of the terminals 110 may be greater or less. For example, the number of the terminal may be only one, or several tens or hundreds, or more, and in this case, other terminals are also included in the implementation environment. The number of terminals and the type of the device are not limited in the embodiments of the present application.

After introducing the real-time environment of the account identification method provided by the embodiment of the present application, an application scenario of the technical solution provided by the embodiment of the present application is described below:

the technical scheme provided by the embodiment of the application can be applied to the scene of identifying the participating account of the illegal financial activity. There are often two roles in illegal financial activities, one is participant and one is organizer, and the number of participants and organizers may be one or more. In general, the number of organizers is less than the number of participants. In the process of carrying out illegal financial activities, the participants transfer a certain amount of virtual resources to the organizer through mobile payment, and when a certain condition is met, the organizer returns a certain amount of virtual resources to the participants. For the organizer, the virtual resources of the participants are concentrated in the account of the organizer, and the virtual resources of part of the participants are occupied by means of probability control and the like, so that the organizer strives to obtain illegal benefits. In the process of carrying out illegal financial activities, the times of transferring virtual resources through mobile payment are more, that is, one participant may transfer virtual resources to an organizer for many times, and the organizer may receive the virtual resources transferred by the same participant for many times.

The technical scheme provided by the application can be deployed on a mobile payment server, and not only can the account of a participant be identified, but also the account of an organizer can be identified in the process that the participant and the organizer adopt mobile payment to carry out illegal financial activities, so that the illegal financial activities are attacked.

The organization of participants by an organizer to conduct illegal financial activities is often periodic, such as once or twice a week at fixed times. Referring to fig. 2, the abscissa of the graph is transaction time, and the ordinate is transaction times, where a graph 201 is a time-transaction times curve of online transactions without performing illegal financial activities, and a graph 202 is a time-transaction times curve of online transactions with performing illegal financial activities. As can be seen from the graph, when the organizer organizes the participants to perform illegal financial activities, the peak of the number of transactions for mobile payments rises, and the magnitude of the peak rise approaches 36%.

Next, the mobile payment situation when the organizer organizes the illegal financial activity is analyzed from another point of view, referring to fig. 3, fig. 3 is a graph of the number of transactions to the number of transacted persons for the purpose of developing the illegal financial activity, in which the abscissa is the number of transactions and the ordinate is the number of transacted persons. It can be seen that as the number of transactions increases, the number of transactions gradually decreases, for example, payment activities other than the illegal financial activities are also present in the time period for the development of the illegal financial activities, for example, the time period for the development of the illegal financial activities is 19:00 to 19:30, and in this 30 minutes, users who do not participate in the illegal financial activities occupy most of the users who pay once, even if they pay using mobile payment, for example, the users pay for meals or purchase fruits within the 30 minutes. Of course, there may be more users paying within the 30 minutes, for example, the users pay the cost of having meals before paying for the meals and then paying for buying fruits within the 30 minutes, that is, there may be some users who do not participate in illegal financial activities, and pay more than once within the 30 minutes. But the number of users who pay more times is less compared to users who pay once in 30 minutes. This statistical phenomenon is shown in fig. 3, and the distribution of transaction times and transaction population shown in fig. 3 may also be referred to as "power law distribution". According to the above description, when no illegal financial activity occurs, that is, in a normal trading scenario, the trading times-trading people number curve counted by the server is in power law distribution.

On the basis of the above description, if the organizer conducts the illegal financial activity within the 30 minutes, because the illegal financial activity has the characteristic of a large number of transactions within a short time, referring to fig. 4, the transaction number-transaction number curve counted from the server is changed, that is, a phenomenon that a large number of users pay for the illegal financial activity for the 30 minutes occurs. The curve in fig. 4 shows the phenomenon of "tail-warp", and the curve of transaction times versus number of people in transaction no longer conforms to the power law distribution.

Because the power law distribution curve is inconvenient for the server to process data, according to relevant mathematical knowledge, for the transaction times-transaction number curve conforming to the power law distribution, the server can respectively log the transaction times and the transaction number to obtain a distribution diagram as shown in fig. 5. The server can perform linear fitting on the scattered points in the graph 5, a straight line can be approximately obtained, and the goodness of fit R of the straight line to the scattered points in the graph 5²The fitting goodness of the straight line to the scattered points is high, and the fitted straight line can approximately represent the distribution of the scattered points.

For the transaction times-transaction number curve which does not conform to the power law distribution, that is, the curve with the tail-raising phenomenon, the server can also respectively logarithm the transaction times and the transaction number in the transaction times-transaction number curve with the tail-raising phenomenon, so as to obtain the distribution diagram shown in fig. 6. The server can also use a straight line to linearly fit the scattered points in FIG. 6 and obtain a straight line, but the goodness of fit R of the straight line to the scattered points in FIG. 6²The fitting goodness of the straight line to the scattered points is low and generally smaller than 0.9, the fitting condition of the straight line to the scattered points is poor, and the fitted straight line cannot approximately represent the distribution condition of the scattered points. This occursThis is the case because the appearance of "tail-warp" causes some scatter 601 deviating from "big troops" in fig. 6, and these scatter 601 greatly affect the goodness of fit of straight line to "big troops".

Based on the prior knowledge, the account identification method provided by the embodiment of the present application is described below.

In the process of implementing the account identification method provided by the embodiment of the application, account identification needs to be performed by means of a first classification model. Optionally, the classification model is a decision tree model or a deep learning model, and other types of classification models may be selected, which is not limited in the embodiment of the present application.

In order to more clearly describe the technical solution provided in the embodiment of the present application, a method for training a first classification model is described below, with reference to fig. 7 and 8, where the method includes:

701. the server obtains first sample resource transfer-out information and first sample account characteristic information of a first sample account, the first sample account is an account carrying target characters when virtual resources are transferred out, the target characters are associated with virtual resource transfer-out behaviors of the first type of target accounts, and the first sample resource transfer-out information comprises virtual resource transfer-out time of the first sample account and the number of transferred virtual resources.

The first type of target account is an account of a participant of the illegal financial activity, and the target words are words associated with participating in the illegal financial activity. For example, some participants in illegal financial activities may have notes on their text when making mobile payments, such as the notes "this is the cost of participating in the a activity, which is also an illegal financial activity. The first sample resource transferring information comprises information such as time, quantity and frequency of virtual resource transferring of the first sample account in the illegal financial activity occurrence time period. The first sample account characteristics include gender, age, and academic history of the user using the first sample account.

In one possible implementation mode, the server can perform text recognition on texts remarked by different accounts when mobile payment is performed, and the server takes the account remarked with target characters when mobile payment is performed as the first sample account. The server acquires first sample resource transfer-out information and first account characteristic information of a first sample account.

In addition to determining the first sample account by detecting whether to remark the target text when making a mobile payment, the server can determine the first sample account in any of the following ways.

In a possible implementation manner, the server can obtain the public contents published by different accounts on the social platform, perform text recognition on the public contents, and take the account carrying the target characters in the public contents as the first sample account.

In one possible implementation, the server can obtain, through a crawler technology, an identifier for collecting the virtual resource on a website related to the illegal financial activity, and optionally, the identifier for collecting the virtual resource includes a payment code or an account for receiving the virtual resource. The server can determine the account indicated by the identifier for receiving the virtual resource as the account of the organizer, and determine the account for transferring the virtual resource to the account of the organizer when illegal financial activities are carried out as the first sample account.

702. The server inputs the first sample resource transfer-out information and the first sample account characteristic information into a first model, classifies the first sample account through the first model, and outputs the predicted account type of the first sample account.

The first model is an untrained first classification model, and has the same structure as the first classification model.

In a possible implementation manner, if the first classification model is a decision tree model, the server initializes the decision tree model according to the information amount included in the first sample resource transfer-out information and the first sample account feature information, so as to obtain a plurality of decision trees of the decision tree model. Each decision tree comprises a plurality of leaf nodes, and each leaf node is a judgment condition and is used for classifying the first sample resource transfer-out information and the first sample account characteristic information. The server inputs the first sample resource transferring-out information and the first sample characteristic information into a first model, classifies the first sample resource transferring-out information and the first sample account characteristic information through a plurality of decision trees of the first model, and outputs a reference score for representing the first sample account type by each decision tree. The server accumulates reference scores output by a plurality of decision trees through a first classification model, and outputs the predicted account type of a first sample account according to the relation between the accumulated reference scores and a reference score threshold, wherein in response to the accumulated reference scores being greater than or equal to the reference score threshold, the first model outputs the type of the first sample account as a first target type; in response to the accumulated reference score being less than the reference score threshold, then the first model parameter outputs the type of the first sample account as not being the first target type.

In a possible implementation manner, if the first classification model is a deep learning model, for example, a Convolutional Neural Network (CNN), the server can input a sample matrix composed of the first sample resource transfer information and the first sample account feature information into the first model, perform convolution processing, full connection processing, and normalization processing on the sample matrix through the first model, and output the probability that the first sample account belongs to different types of accounts. The server can determine the account type with the highest probability as the account type of the first sample account.

703. The server adjusts model parameters of the first model according to first difference information between the predicted account type of the first sample account and the actual account type of the first sample account.

In one possible implementation, the server can construct a loss function based on the predicted account type output by the first model and the actual account type of the first sample account, and adjust the model parameters of the first model through the loss function. When the model parameters of the first model are adjusted by the loss function, the model parameters can be adjusted by a gradient descent method or a gradient ascent method according to the type of the first model.

Optionally, after the server performs step 703, the classification capability of the first classification model can be further improved by performing the following steps.

In one possible implementation manner, the server obtains second sample resource transfer-out information and second sample account characteristic information of a second sample account, wherein the second sample account is an account other than the first type of target account. And the server inputs the second sample resource transfer-out information and the second sample account characteristic information into the first model, classifies the second sample account through the first model, and outputs the predicted account type of the second sample account. The server adjusts the model parameters of the first model according to second difference information between the predicted account type of the second sample account and the actual account type of the second sample account. On the basis of the above embodiment, the server can train the first model by using not only the first sample resource transfer-out information and the first sample account feature information of the first-class target account, but also the second sample resource transfer-out information and the second sample account feature information of the second sample account which is not the first-class target account, train the first model from two aspects, and improve the classification capability of the first classification model. In brief, if the first sample account is marked as a black sample, the second sample account is marked as a white sample, the black sample is also an account of a participant of illegal financial activity, and the white sample is also an ordinary user account, after the above embodiment is adopted, the capacity of the first model for identifying the black sample is trained, the capacity of the first model for identifying the white sample is also trained, and the white sample and the black sample are associated with each other, so that the classification capacity of the subsequent first classification model can be improved by the training method.

704. In response to the model parameters of the first model meeting the model convergence criteria, the server treats the first model as a first classification model.

Wherein, the condition that the model parameter accords with the model convergence condition means any one of the following conditions: the number of iterations of the first model is greater than or equal to a target number of iterations or the loss function of the first model converges to a target value.

After the training method of the first classification model is described in the above steps 701-704, the account identification method provided in the embodiment of the present application will be described below, and the following method is used to identify the participant of the illegal financial activity, referring to fig. 9, and the method includes:

901. the server acquires resource transfer-out information of a first account, wherein the resource transfer-out information comprises virtual resource transfer-out time of the first account and the number of transferred virtual resources, and the first account is an account of which the number of times of transferring out the virtual resources in a target time period meets a first target condition.

Wherein the target time period is a time period in which an illegal financial activity occurs. The fact that the number of times of transferring out the virtual resource meets the first target condition means that the number of times of transferring out the virtual resource in the target time period is larger than or equal to a number threshold.

902. The server determines target resource transfer-out conditions from the multiple resource transfer-out conditions, the target resource transfer-out conditions are matched with the resource transfer-out information, and the multiple resource transfer-out conditions are used for representing resource transfer-out behavior characteristics of the first type of target accounts.

The resource transfer-out condition is a determination condition, for example, whether the number of resource transfer-out times in the target time period is greater than 500, or whether the number of resource transfer-out times in the target time period is greater than 6, or the like. The skilled person can set the setting according to the actual situation, and the embodiment of the present application is not limited to this. The first type of target account is an account of a participant of an illegal financial activity.

903. The server acquires a first type parameter corresponding to the target resource transfer-out condition.

Optionally, the number of target resource roll-out conditions is one or more.

If one resource transfer-out information is matched with the resource transfer-out condition, the server can determine the resource transfer-out information as a target resource transfer-out condition and acquire a first type parameter corresponding to the target resource transfer-out condition. For example, if the resource transfer-out condition is whether the number of times of transferring out the virtual resource in the target time period is greater than 5, and if the number of times of transferring out the virtual resource in the target time period is 6, a first type parameter, such as 6, can be obtained.

904. The server inputs the resource transfer-out information and the first account characteristic information of the first account into the first classification model, classifies the first account through the first classification model, and outputs the second type parameter of the first account.

Wherein, the first classification model is obtained by the training in steps 701-704.

905. And the server fuses the first type parameters and the second type parameters to obtain third type parameters, wherein the third type parameters are used for representing the type of the first account.

The first type parameter is a type parameter obtained by the server according to the matching result of the resource transfer-out information and the plurality of resource transfer-out conditions, the second type parameter is a type parameter output by the first classification model based on the resource transfer-out information and the first account characteristic information, and a third type parameter obtained by fusing the two parameters can reflect the type of the first account more comprehensively.

906. In response to the third type of parameter of the first account meeting the second target condition, the server identifies the first account as a first type of target account.

The third type parameter meeting the second target condition means that the third type parameter is greater than or equal to a parameter threshold.

The foregoing steps 901 and 906 are simple descriptions of the user identification method provided in the embodiment of the present application, and the user identification method provided in the embodiment of the present application will be described in more detail with reference to some examples, with reference to fig. 10, where the method includes:

1001. the server determines a first account, wherein the first account is an account of which the number of times of transferring the virtual resource in the target time period meets the first target condition.

Wherein the user of the first account may be a participant in an illegal financial activity. The virtual resource roll-out number is the number of times payment is made by mobile payment. The number of times of transferring out the virtual resource meets the first target condition means that the number of times of transferring out the virtual resource is greater than or equal to the virtual resource transferring-out threshold value.

In a possible implementation manner, the server obtains the number of times of transferring out the target virtual resource, where the number of times of transferring out the target virtual resource is the number of times of transferring out the virtual resource whose occurrence probability is smaller than the first probability threshold. And in response to the fact that the virtual resource transfer-out times of any account in the target time period are the same as the target virtual resource transfer-out times, the server determines any account as a first account.

The following describes a method for determining the number of times of transferring out a target virtual resource by a server: the server obtains the virtual resource transfer-out times of the accounts in the target time period. And the server performs linear fitting on the scattered points to obtain a fitting curve, and the scattered points are used for representing the transfer-out times of the virtual resources and the account number corresponding to the transfer-out times of the virtual resources. In response to a goodness-of-fit of the fitted curve to the plurality of scattered points being less than a goodness-of-fit threshold, the server determines distances between the plurality of scattered points and the fitted curve. And in response to the fact that the distance between any scatter point and the fitted curve is larger than a first distance threshold value, the server determines the transfer-out times of the target virtual resources corresponding to any scatter point.

For example, the server may count the number of accounts corresponding to each virtual resource transfer-out number, and generate a plurality of scatter plots based on the number of accounts corresponding to the plurality of virtual resource transfer-out numbers, where an abscissa of the scatter plot corresponds to the number of virtual resource transfer-out numbers and an ordinate corresponds to the number of accounts corresponding to the number of virtual resource transfer-out numbers. The server performs linear fitting on the plurality of scattered points by adopting a least square method to obtain a fitting curve, and in the embodiment of the application, the fitting curve is a straight line based on the prior knowledge. The server can determine a goodness-of-fit of the fitted curve to the plurality of scatter points. And in response to the goodness of fit of the fit curve to the plurality of scattered points being less than a goodness of fit threshold, the server determines the distances between the plurality of scattered points and the fit curve, wherein the goodness of fit of the fit curve to the plurality of scattered points being less than the goodness of fit threshold can also indicate that illegal financial activities exist in the target time period. In response to that the distance between any scatter point and the fitting curve is larger than a first distance threshold, the server can perform exponential operation on the abscissa of the scatter point to obtain the virtual resource transfer-out times corresponding to the scatter point, wherein the distance between any scatter point and the fitting curve is larger than the first distance threshold, which means that the scatter point deviates from a large part of the team, the scatter point is an abnormal scatter point, and the virtual resource transfer-out times corresponding to the scatter point are abnormal times. The server can determine the account with the abnormal virtual resource transfer-out times as the first account, and the user account determined as the first account may be the account of the participant of the illegal financial activity.

In one possible implementation mode, the server obtains the virtual resource transfer-out times of a plurality of accounts in a target time period. In response to the virtual resource transfer-out times of any account being larger than or equal to the transfer time threshold value, the server determines the account as the first account.

The following explains a method of determining the transition number threshold:

in a possible implementation mode, the server obtains the virtual resource transfer-out times when the illegal financial activity does not occur and the account number corresponding to the virtual resource transfer-out times. And the server generates a scatter diagram according to the virtual resource transfer-out times when the illegal financial activities do not occur and the account number corresponding to the virtual resource transfer-out times. The server fits the scatter points in the scatter diagram based on the probability density function of the power law distribution to obtain the probability density function f (x) -cx of the power law distribution^-aWherein a and c are both constants. The server can obtain the probability corresponding to the transfer-out quantity of the plurality of virtual resources based on the probability density function of the power law distribution. The server canAnd determining the virtual resource transfer-out quantity with the corresponding probability smaller than the probability threshold as a transfer time threshold.

In the following, the above embodiment will be described by way of example, if the server obtains the probability density function f (x) ═ 14374983x from the virtual resource transfer-out frequency when no illegal financial activity occurs and the number of accounts corresponding to the virtual resource transfer-out frequency^-4.2592Wherein, f (x) is the account number, and x is the virtual resource transfer-out number. The server can determine the probability corresponding to the number of times of transferring out the virtual resource, and take the number of times of transferring out the virtual resource as 4 as an example, the server can obtain f (x) 14374983x^-4.2592First constant integration 4.41059 × 10 in the interval (1, ∞)^-6The reason why 1 is selected as the lower limit of the point is that the server only counts accounts in which the number of virtual resource roll-outs is greater than or equal to 1. Thereafter, the server can obtain f (x) 14374983x^-4.2592Second constant integration 48113 in interval (4, ∞). According to the theory of correlation of mathematical statistics, the server combines the second constant point 48813 with the first constant point 4.41059 × 10^-6The division can obtain the probability that the virtual resource transfer-out times are more than or equal to 4 and is 1%. If the probability threshold is 2%, the server can use 4 as the transition number threshold.

The meaning of 4 as the transition number threshold is explained below, and through the above calculation, when no illegal financial activity occurs, the probability that the account with the virtual resource transfer-out number greater than or equal to 4 occurs is 1%, and since this probability is smaller than the probability threshold, it can be considered that the account with the virtual resource transfer-out number greater than or equal to 4 occurs as a small probability event when no illegal financial activity occurs. The server can also determine the account with the virtual resource transfer-out number greater than or equal to 4 as the first account, that is, the account with the virtual resource transfer-out number greater than or equal to 4 may be an account of a participant participating in the illegal financial activity, and the server can subsequently further classify the first account, thereby determining the type of the first account.

It should be noted that the above step 1001 is an optional step, and if the server has determined the first account by other means, the server can directly perform the step 1002.

1002. The server acquires resource transfer-out information of the first account, wherein the resource transfer-out information comprises virtual resource transfer-out time of the first account and the number of transferred virtual resources.

Optionally, after the server obtains the resource transfer-out information of the first account, the number of times that the first account transfers the virtual resource in the target time period and the number of transferred virtual resources can be obtained based on the virtual resource transfer-out time of the first account and the number of transferred virtual resources, and the distribution of the transferred virtual resources, such as the number of times that the first account transfers the virtual resource each week in a month, the number of times that the first account transfers the virtual resource each day in a week, and the number of times that the first account transfers the virtual resource each hour in a day, can be obtained through statistics. The server can add the information obtained according to the virtual resource transfer-out time of the first account and the number of the transferred virtual resources into the resource transfer-out information, so that more classification information is provided for subsequent classification.

1003. The server determines target resource transfer-out conditions from the multiple resource transfer-out conditions, the target resource transfer-out conditions are matched with the resource transfer-out information, and the multiple resource transfer-out conditions are used for representing resource transfer-out behavior characteristics of the first type of target accounts.

The resource transfer-out condition is set by a technician according to an actual situation, for example, the condition is set as a condition related to the virtual resource transfer-out number in the target time period, or is set as a condition such as a ratio that the virtual resource transfer-out number in the target time period occupies the virtual resource transfer-out number in the same day, and the like.

In one possible embodiment, the server compares the resource transfer-out information with a plurality of resource transfer-out conditions, respectively. And responding to the condition that the resource transfer-out information accords with any resource transfer-out condition, and determining any resource transfer-out condition as a target resource transfer-out condition by the server.

1004. The server acquires a first type parameter corresponding to the target resource transfer-out condition.

In a possible implementation manner, if the target resource roll-out condition is whether the number of the rolled out virtual resources in the target time period is greater than 600, if the number of the rolled out virtual resources is greater than 600, the first type parameter corresponding to the number of the rolled out virtual resources greater than 600 is 8. If the resource roll-out information indicates that the first account rolls out the virtual resource in the target time period by 700, the server can obtain 8 the first type parameter as the first account.

In addition to the above embodiments, the present application provides another method for determining the first type of parameter, which is described below by way of an example. The target resource roll-out condition may include a plurality of resource roll-out conditions, and if the target resource roll-out condition includes three resource roll-out conditions, for example, the first resource roll-out condition is whether the number of virtual resource roll-out times in the target time period is greater than or equal to 4, where the number of virtual resource roll-out times is greater than or equal to 4 and corresponds to the matching score of 5, and the number of virtual resource roll-out times is less than 4 and corresponds to the matching score of 2. The second resource roll-out condition is whether or not the number of virtual resource roll-outs in the target time period is greater than or equal to 3000, wherein the number of virtual resource roll-outs greater than or equal to 3000 corresponds to a matching score of 6, and the number of virtual resource roll-outs less than 3000 corresponds to a matching score of 2. The third resource transfer-out condition is whether the proportion of the virtual resource transfer-out times of the first account in the target time period to the virtual resource transfer-out times of the current day is greater than or equal to 80%, wherein the proportion of the virtual resource transfer-out times of the first account in the target time period to the virtual resource transfer-out times of the current day is greater than or equal to 50% and corresponds to the matching score of 8, and the proportion of the virtual resource transfer-out times of the first account in the target time period to the virtual resource transfer-out times of the current day is less than 50% and corresponds to the matching score of 3. If the number of virtual resource transfers of the first account in the target time period is 6, the number of virtual resource transfers is 1000, and the ratio of the number of virtual resource transfers in the target time period to the number of virtual resource transfers in the current day is 80%, the server can determine that the matching score of the first account is 5+2+ 8-15.

1005. The server inputs the resource transfer-out information and the first account characteristic information of the first account into the first classification model, classifies the first account through the first classification model, and outputs the second type parameter of the first account.

In a possible implementation manner, the server inputs the resource transfer-out information and the first account feature information into a first class decision tree sub-model, classifies the resource transfer-out information and the first account feature through a plurality of leaf nodes of a plurality of first decision trees of the first class decision tree sub-model, and outputs a first classification parameter corresponding to the first account, where the plurality of first decision trees are decision trees whose output results are independent of each other. The server inputs the resource transfer-out information and the first account characteristic information into a second class decision tree submodel, classifies the resource transfer-out information and the first account characteristic through a plurality of leaf nodes of a plurality of second decision trees of the second class decision tree submodel, and outputs a second classification parameter corresponding to the first account, wherein the plurality of second decision trees are decision trees with output results correlated with each other. And outputting the second type parameter of the first account according to the first classification parameter and the second classification parameter. Wherein, the leaf node is a classification condition.

It should be noted that, in the above embodiment, the server first inputs the resource transfer-out information and the first account characteristic information into the first class decision tree submodel, and then inputs the resource transfer-out information and the first account characteristic information into the second class decision tree submodel, in other possible embodiments, the server can also simultaneously input the resource transfer-out information and the first account characteristic information into the first class decision tree submodel and the second class decision tree submodel, which is not limited in this embodiment of the present application.

The following describes a method for classifying the resource transfer-out information and the first account feature information by the server based on the first-class decision tree sub-model and the second-class decision tree sub-model, respectively.

For the first type of decision tree sub-model, the first decision tree sub-model comprises a plurality of first decision trees, wherein the plurality of first decision trees are decision trees with mutually independent output results. After the server inputs the resource roll-out information and the first account feature information into the first-class decision tree submodel, the multiple first decision trees of the first-class decision tree submodel are classified based on the resource roll-out information and the first account feature information, each first decision tree outputs a first-class score, the server performs weighted summation on the multiple first-class scores through the first-class decision tree submodel and outputs a first classification parameter corresponding to the first account, wherein the weight of the weighted summation is obtained by training the first-class decision tree submodel, and of course, the server can also directly allocate the same weight to different first decision trees.

For example, if the first-class decision tree sub-model includes three first decision trees, each first decision tree includes 3 leaf nodes, and each leaf node corresponds to a classification condition, where the three decision trees are different decision trees, that is, the leaf nodes in each first decision tree are not identical. If the resource roll-out information and the first account characteristic information collectively include 8 pieces of information for classification, which are respectively denoted as (1,2,3,4,5,6,7,8), three leaf nodes in a first decision tree are used for classification based on the

information

1, 3, and 4, three leaf nodes in a second first decision tree are used for classification based on the

information

2,3, and 5, and three leaf nodes in a third first decision tree are used for classification based on the information 6,7, and 8. If the first type score output by the first decision tree is 6, the first type score output by the second decision tree is 1, and the first type score output by the third decision tree is 2, the server can perform weighted summation on the first type scores output by the three first decision trees through weights obtained by training of the first decision tree submodels to obtain a first classification parameter, for example, 5. In other words, the classification idea of the first class of decision tree sub-model is "the top of three smellers zhuging", that is, the first decision tree with independent output results is used for classification.

For the second type of decision tree sub-model, the second type of decision tree sub-model includes a plurality of second decision trees, and the plurality of second decision trees are decision trees with output results correlated with each other. That is, the output result of each second decision tree affects the output results of other second decision trees. Classification can be performed based on the association between the resource roll-out information and the plurality of information in the first account characteristic information through the decision tree submodel of the second type.

For example, if the second-class decision tree sub-model includes two second decision trees, each of which is a completely different decision tree, that is, the content and number of leaf nodes of each of the second decision trees may be completely different, if the resource roll-out information and the first account characteristic information collectively include 3 pieces of information for classification, which are respectively denoted as (1,2,3), two leaf nodes in the first second decision tree are used for classification based on the information 1 and 2, and one leaf node in the second decision tree is used for classification based on the information 3. If the first type score output by the first decision tree is 6 and the first type score output by the second decision tree is-2, the server can directly add the first type scores output by the two decision trees to obtain a second classification parameter, for example, 4.

After the process of classifying the server based on the first-class decision tree sub-model and the second-class decision tree sub-model is introduced, a method for outputting the second-type parameter of the first account by the server according to the first classification parameter and the second classification parameter will be described.

In a possible implementation manner, referring to fig. 11, the server performs a Logistic Regression (LR) process on the first classification parameter and the second classification parameter, and outputs the second type parameter of the first account. In this embodiment, the server can fuse the first classification parameter and the second classification parameter output by the first type decision tree submodel and the second type decision tree submodel to obtain a second type parameter, and the second type parameter can more comprehensively represent the type of the first account.

Optionally, the first type of decision tree sub-model is a Random Forest (Random Forest) model, and the second type of decision tree sub-model is an eXtreme Gradient boost (XGBoost) model.

In addition, in the process of classifying by using the first-class decision tree submodel and the second-class decision tree submodel, the models can be trained in real time based on new sample data, so that the generalization capability of the models is improved, and the recognition effect of the first-class target accounts is improved.

1006. And the server fuses the first type parameters and the second type parameters to obtain third type parameters, wherein the third type parameters are used for representing the type of the first account.

In a possible implementation, referring to fig. 12, the server performs a logistic regression process on the first type parameter and the second type parameter to obtain a third type parameter.

In this embodiment, the server can fuse the first type parameter obtained based on the plurality of resource roll-out conditions and the second type parameter obtained based on the first classification model to obtain the third type parameter. The third type parameter can also more accurately represent the type of the first account.

1007. In response to the third type of parameter of the first account meeting the second target condition, the server identifies the first account as a first type of target account.

Optionally, the third type parameter meeting the second target condition means that the third type parameter is greater than or equal to the first type parameter threshold.

After step 1007, the server can optionally also perform at least one of the following:

in one possible implementation, the server identifies terminals used by the first type of target account as first type of target terminals. That is, when one account is identified as the first type target account, the server can mark the terminal used by the first type target account, thereby expanding the identification range.

In one possible implementation, the server identifies a wireless network to which the terminal used by the first type of target account is connected as a first type of target network. That is, when one account is identified as the first type target account, the server can mark the wireless network connected to the terminal used by the first type target account, thereby expanding the identification range.

In one possible implementation, the server identifies an object of the plurality of first-class target accounts transferring the virtual resource within the target time period as a second-class target account. Since the first type of target account is an account of a participant of an illegal financial activity, when a plurality of participants of the illegal financial activity transfer virtual resources to the same account, the server can mark the account receiving the virtual resources as a second type of target account, which is an account of an organizer of the illegal financial activity.

In one possible implementation, in response to the object of any user account transferring virtual resources within the target time period being the same as the plurality of target accounts of the first type, the server identifies any user account as a target account of the first type. When the server recognizes that the object of transferring the virtual resource in any account in the target time period is the same as the plurality of target accounts of the first type, it means that the account is likely to participate in illegal financial activities, and the server can mark the account.

The above embodiments can improve the coverage rate of account identification on the premise of ensuring the accuracy of account identification.

1008. And in response to the first type of target account performing the virtual resource transfer-out operation in the target time period, the server prevents the virtual resource transfer-out operation of the first type of target account.

In one possible implementation manner, in response to the first-class target account performing the virtual resource transfer-out operation in the target time period, the server sends an error prompt to the terminal of the first-class target account, and meanwhile, the server prevents the virtual resource transfer-out operation of the first-class target account.

In a possible implementation manner, in response to the first-class target account performing the operation of transferring out the virtual resource in the target time period, the server sends an error prompt to the terminal of the first-class target account, and simultaneously freezes the first-class target account, during which the first-class target account cannot perform the operation of transferring the virtual resource.

In summary, referring to fig. 13, the account identification method provided by the present application combines condition matching and model identification, so as to achieve a more accurate account identification effect.

The technical solution provided in the above-mentioned

step

1001 and 1008 identifies the first type of target account, that is, the account of the participant of the illegal financial activity, and the technical solution provided in the embodiment of the present application can identify the second type of target account, that is, the account of the organizer of the illegal financial activity, in addition to the first type of target account. In the process of identifying the second type target account, a second classification model is needed, and a training method of the second classification model is described below, referring to fig. 14, where the method includes:

1401. the server obtains first sample resource transfer-in information and third sample account characteristic information of a third sample account, the third sample account is an account carrying target characters when receiving the virtual resources, the target characters are associated with virtual resource transfer-in behaviors of a second type of target accounts, and the first sample resource transfer-in information comprises virtual resource transfer-in time and transfer-in virtual resource quantity of the third sample account.

Wherein the second type of target account is an account of an organizer of the illegal financial activity, and the target words are words associated with participating in the illegal financial activity. For example, some participants in illegal financial activities may have notes on their text when making mobile payments, such as the notes "this is the cost of participating in the a activity, which is also an illegal financial activity. The first sample resource transferring information comprises information such as time, quantity and frequency of transferring to the virtual resource of the third sample account in the illegal financial activity occurrence time period. The third sample account characteristics include characteristics of gender, age, and school history of the user using the third sample account.

In a possible implementation manner, the server can perform text recognition on texts remarked by different accounts when virtual resources are transferred out, and the server takes the account remarked with the target characters when the virtual resources are received as a third sample account. And the server acquires the first sample resource transfer-in information and the second account characteristic information of the third sample account.

In addition to determining the third sample account by detecting whether or not the target text is remarked when the virtual resource transfer is performed, the server can determine the third sample account in any one of the following manners.

In a possible implementation manner, the server can obtain the public contents published by different accounts on the social platform, perform text recognition on the public contents, and take the account carrying the target characters in the public contents as a third sample account. And the server acquires the first sample resource transfer-in information and the second account characteristic information of the third sample account.

In one possible embodiment, the server is capable of crawling, by crawler technology, an identification for collecting the virtual resource on a website related to the illegal financial activity, optionally including a payment code or an account for receiving the virtual resource, and the like. The server can determine the account indicated by the identification for charging the virtual resource as the account of the organizer, i.e. the third sample account.

1402. And the server inputs the first sample resource transfer information and the third sample account characteristic information into a second model, classifies the third sample account through the second model, and outputs the predicted account type of the third sample account.

Step 1402 and step 702 belong to the same inventive concept, and the implementation process refers to the description of step 702, which is not described herein again.

1403. And the server adjusts the model parameters of the second model according to third difference information between the predicted account type of the third sample account and the actual account type of the third sample account.

Step 1403 and step 703 belong to the same inventive concept, and the implementation process refers to the description of step 703, which is not described herein again.

Alternatively, after the server performs step 1403, the classification capability of the first classification model can be further improved by performing the following steps.

Optionally, after the server performs step 703, the classification capability of the second classification model can be further improved by performing the following steps.

In a possible implementation manner, the server obtains the second sample resource transfer-in information and the fourth sample account characteristic information of a fourth sample account, wherein the fourth sample account is an account other than the second type target account. And the server inputs the second sample resource transfer-in information and the fourth sample account characteristic information into a second model, classifies the fourth sample account through the second model, and outputs the predicted account type of the fourth sample account. And the server adjusts the model parameters of the first model according to fourth difference information between the predicted account type of the fourth sample account and the actual account type of the fourth sample account. On the basis of the above embodiment, the server can train the second model by using not only the first sample resource transfer information and the third sample account characteristic information of the second type target account, but also the second sample resource transfer information and the fourth sample account characteristic information of the fourth sample account which is not the second type target account, and train the second model from two aspects, so that the classification capability of the second classification model can be improved. In brief, if the third sample account is marked as a black sample, the fourth sample account is marked as a white sample, the black sample is also an account of an organizer of illegal financial activities, and the white sample is also an ordinary user account, after the above embodiment is adopted, the capability of the second model to recognize the black sample is trained, the capability of the second model to recognize the white sample is also trained, and the white sample and the black sample are associated with each other, so that the classification capability of the subsequent second classification model can be improved by the training method.

It should be noted that, referring to fig. 15, when the technician selects the fourth sample account, the technician can also select an account that is more similar to the third sample account, such a similar account may also be referred to as a confusing white sample, and the other white samples are referred to as general white sample accounts. For example, for a teacher in a remedial class, the time for developing teaching every week is a target time period, and after the student finishes the class, the student may pay a remedial fee to the teacher in a centralized manner, that is, transfer the virtual resources in the student account to the teacher's account, in a manner similar to the manner of collection by an organizer of illegal financial activities, so that the technician can determine the account of the remedial class teacher as a confounding white sample. The confusing white samples are adopted to train the second model, so that the classification capability of the second model can be improved.

1404. And in response to the model parameters of the second model meeting the model convergence condition, the server takes the second model as a second classification model.

Step 1404 and step 704 belong to the same inventive concept, and the implementation process refers to the description of step 704, which is not described herein again.

After the training method of the first classification model is described through the above steps 1401-1404, the account identification method provided by the embodiment of the present application will be described below, and the following method is used for identifying an organizer of an illegal financial activity, referring to fig. 16, and the method includes:

1601. and the server determines a second account, wherein the second account is an account of which the times of transferring the virtual resources to the virtual resources in the target time period accord with a third target condition.

Wherein the user of the second account may be an organizer participating in an illegal financial activity. The virtual resource transfer-in times are the times of collection through mobile payment. The fact that the number of times of transferring into the virtual resources meets the third target condition means that the number of times of transferring into the virtual resources is greater than or equal to the virtual resource transferring threshold value.

In a possible implementation manner, the server obtains the target virtual resource transfer times, where the target virtual resource transfer times are virtual resource transfer times with an occurrence probability smaller than a first probability threshold. And in response to the fact that the virtual resource transfer times of any account in the target time period are the same as the target virtual resource transfer times, the server determines any account as a second account.

The following describes a method for determining the transfer times of the target virtual resource by the server: the server acquires the virtual resource transfer times of the accounts in the target time period. The server performs linear fitting on the scattered points to obtain a fitting curve, and the scattered points are used for representing the transfer times of the virtual resources and the account number corresponding to the transfer times of the virtual resources. In response to a goodness-of-fit of the fitted curve to the plurality of scattered points being less than a goodness-of-fit threshold, the server determines distances between the plurality of scattered points and the fitted curve. And responding to the fact that the distance between any scattered point and the fitted curve is larger than a second distance threshold value, and the server determines the transfer times of the target virtual resources corresponding to any scattered point.

For example, the server can count the account number corresponding to each virtual resource transfer-in number, and generate a plurality of scattered points based on the account numbers corresponding to the virtual resource transfer-in numbers and the virtual resource transfer-in numbers, wherein an abscissa of the scattered point corresponds to the virtual resource transfer-in number, and an ordinate corresponds to the account number corresponding to the virtual resource transfer-in number. The server performs linear fitting on the plurality of scattered points by adopting a least square method to obtain a fitting curve, and in the embodiment of the application, the fitting curve is a straight line based on the prior knowledge. The server can determine a goodness-of-fit of the fitted curve to the plurality of scatter points. And in response to the goodness of fit of the fit curve to the plurality of scattered points being less than a goodness of fit threshold, the server determines the distances between the plurality of scattered points and the fit curve, wherein the goodness of fit of the fit curve to the plurality of scattered points being less than the goodness of fit threshold can also indicate that illegal financial activities exist in the target time period. And responding to the fact that the distance between any scatter point and the fitting curve is larger than a second distance threshold, the server can perform exponential operation on the abscissa of the scatter point to obtain virtual resource transfer times corresponding to the scatter point, wherein the fact that the distance between any scatter point and the fitting curve is larger than the second distance threshold means that the scatter point deviates from a large team, the scatter point is an abnormal scatter point, and the virtual resource transfer times corresponding to the scatter point are abnormal times. The server can determine the account with the abnormal number of times of transferring the virtual resource into the account as a second account, and the user account determined as the second account may be the account of the organizer of the illegal financial activity.

In one possible implementation mode, the server acquires the virtual resource transfer times of a plurality of accounts in the target time period. And in response to the virtual resource transfer times of any account being larger than or equal to the transfer time threshold value, the server determines the account as a second account.

The following explains a method of determining the transition number threshold:

in one possible implementation mode, the server acquires the virtual resource transfer times when illegal financial activities do not occur and the account number corresponding to the virtual resource transfer times. And the server generates a scatter diagram according to the virtual resource transfer times when the illegal financial activities do not occur and the account number corresponding to the virtual resource transfer times. The server fits the scatter points in the scatter diagram based on the probability density function of the power law distribution to obtain the probability density function f (x) -cx of the power law distribution^-aWherein a and c are both constants. The server can obtain the probability corresponding to the transfer quantity of the plurality of virtual resources based on the probability density function of the power law distribution. The server can determine the transfer quantity of the virtual resources with the corresponding probability smaller than the probability threshold as the transfer time threshold.

1602. And the server acquires resource transfer-in information of the second account, wherein the resource transfer-in information comprises the virtual resource transfer-in time of the second account and the number of the transferred virtual resources.

Optionally, after the server obtains the resource transfer information of the second account, the number of times that the second account transfers virtual resources in the target time period and the number of transferred virtual resources can be obtained based on the virtual resource transfer time of the second account and the number of transferred virtual resources, and the distribution conditions of the transferred virtual resources, such as the number of times that the second account transfers virtual resources in one month per week, the number of times that the second account transfers virtual resources in one week per day, the number of times that the second account transfers virtual resources in one day per hour, and the like, of the second account can be obtained through statistics. The server can add the resource transfer-in information to the information obtained according to the virtual resource transfer-in time of the second account and the number of the transferred virtual resources, so that more classification information is provided for subsequent classification.

1603. The server determines target resource transfer-in conditions from the plurality of resource transfer-in conditions, the target resource transfer-in conditions are matched with the resource transfer-in information, and the plurality of resource transfer-in conditions are used for expressing the resource transfer-in behavior characteristics of the second type of target accounts.

The resource transfer conditions are set by technicians according to actual conditions, for example, the conditions are set as conditions related to the virtual resource transfer amount in the target time period, or conditions related to the virtual resource transfer times in the target time period, or conditions such as a ratio of the virtual resource transfer times in the target time period to the virtual resource transfer times in the current day are set, and the like.

In one possible embodiment, the server compares the resource transfer information with a plurality of resource transfer conditions, respectively; and in response to the fact that the resource transfer-in information meets any resource transfer-in condition, the server determines any resource transfer-in condition as a target resource transfer-in condition.

1604. And the server acquires a fourth type parameter corresponding to the target resource transfer-in condition.

1605. And the server inputs the resource transfer-in information and second account characteristic information of the second account into a second classification model, classifies the second account through the second classification model, and outputs a fifth type parameter of the second account.

In a possible implementation manner, the server classifies the resource transfer-in information and the second account characteristics through a plurality of leaf nodes of a plurality of first decision trees of the first-class decision tree sub-model, and outputs a third classification parameter corresponding to the second account, wherein the plurality of first decision trees are decision trees with mutually independent output results. And the server classifies the resource transfer-in information and the second account characteristics through a plurality of leaf nodes of a plurality of second decision trees of the second class decision tree submodels and outputs a fourth classification parameter corresponding to the second account, wherein the plurality of second decision trees are decision trees with mutually associated output results. And the server outputs a fifth type parameter of the second account according to the third classification parameter and the fourth classification parameter. Wherein, the leaf node is a classification condition.

It should be noted that, in the above embodiment, the server first inputs the resource transfer-in information and the second account characteristic information into the second type decision tree sub-model, and then inputs the resource transfer-in information and the second account characteristic information into the second type decision tree sub-model, in other possible embodiments, the server can also simultaneously input the resource transfer-in information and the second account characteristic information into the second type decision tree sub-model and the second type decision tree sub-model, which is not limited in this application.

In addition, in the process of classifying by using the first type decision tree submodel and the second type decision tree submodel, the models can be trained in real time based on new sample data, so that the generalization capability of the models is improved, and the recognition effect of the second type target account is improved.

1606. And the server fuses the fourth type parameter and the fifth type parameter to obtain a sixth type parameter, wherein the sixth type parameter is used for representing the type of the second account.

In a possible implementation manner, the server performs logistic regression processing on the fourth type parameter and the fifth type parameter to obtain a sixth type parameter.

In this embodiment, the server can fuse the fourth type parameter obtained based on the resource transfer condition and the fifth type parameter obtained based on the second classification model to obtain the sixth type parameter. The sixth type parameter can also more accurately represent the type of the second account.

1607. In response to the sixth type of parameter for the second account meeting the fourth target condition, the server identifies the second account as a second class of target accounts.

Optionally, the sixth type of parameter meeting the fourth target condition means that the sixth type of parameter is greater than or equal to the second type of parameter threshold.

After step 1607, optionally, the server can also perform at least one of the following

In one possible embodiment, the server identifies terminals used by the second type of target account as second type of target terminals. That is, when one account is identified as the second type target account, the server can mark the terminal used by the second type target account, thereby expanding the identification range.

In one possible embodiment, the server identifies as the second type of target network the wireless network to which the terminal used by the second type of target account is connected. That is, when one account is identified as the second type target account, the server can mark the wireless network connected to the terminal used by the second type target account, thereby expanding the identification range.

1608. And in response to the transfer of the virtual resources to the second type target account by any account in the target time period, the server prevents any account from transferring the virtual resources to the second type target account.

In a possible implementation manner, in response to the transfer of the virtual resources of any account to the second type target account in the target time period, the server sends an error prompt to the terminal of any account, and meanwhile, the server organizes the transfer operation of any account to the virtual resources of the second type target account.

In one possible embodiment, the server can freeze a second type of target account, during which the second type of target account cannot receive virtual resources transferred by any account.

Referring to fig. 17, in combination with the steps 1001-1008 and 1601-1608, the server can identify both the participant of the illegal financial activity and the organizer of the illegal financial activity, and the diffusion of the identification result is performed based on the identification result, so as to expand the identification range and improve the coverage of the identification on the premise of ensuring the identification accuracy.

After experiments, when the technical scheme provided by the embodiment of the application is adopted, when the illegal financial activities are intercepted on line, the payment peak value of the illegal financial activities is reduced by 96%, the false interception rate is 0.062%, and the malicious rebound situation does not occur after the online.

According to the technical scheme provided by the embodiment of the application, the second type target account is identified in a mode of combining condition matching and model identification. For condition matching, the resource transfer information of the account with abnormal transfer times of the virtual resources is subjected to condition matching, and a type parameter is determined according to a matching result. For model identification, the resource transfer information and the account characteristic information of the abnormal account are combined for classification to obtain another type parameter. The abnormal account is identified based on the type parameter obtained by fusing the two type parameters, so that the real-time performance and the accuracy of the identification of the second type target account can be improved.

Fig. 18 is a schematic structural diagram of an account identification apparatus according to an embodiment of the present application, and referring to fig. 18, the apparatus includes: a resource roll-out information obtaining module 1801, a first matching module 1802, a first type parameter obtaining module 1803, a first input module 1804, a first parameter fusing module 1805, and a first identifying module 1806.

The resource transfer-out information obtaining module 1801 is configured to obtain resource transfer-out information of the first account, where the resource transfer-out information includes virtual resource transfer-out time of the first account and a transferred virtual resource quantity, and the first account is an account whose number of times that virtual resources are transferred out in a target time period meets a first target condition.

A first matching module 1802, configured to determine a target resource transfer-out condition from a plurality of resource transfer-out conditions, where the target resource transfer-out condition is matched with the resource transfer-out information, and the plurality of resource transfer-out conditions are used to indicate a resource transfer-out behavior characteristic of the first type of target account.

A first type parameter obtaining module 1803, configured to obtain a first type parameter corresponding to the target resource transferring condition.

The first input module 1804 is configured to input the resource transfer-out information and the first account characteristic information of the first account into the first classification model, classify the first account through the first classification model, and output the second type parameter of the first account.

A first parameter fusing module 1805, configured to fuse the first type parameter and the second type parameter to obtain a third type parameter, where the third type parameter is used to indicate a type of the first account.

A first identifying module 1806, configured to identify the first account as the first type of target account in response to the third type of parameter of the first account meeting the second target condition.

In a possible implementation manner, the first matching module is configured to compare the resource roll-out information with a plurality of resource roll-out conditions respectively; and determining any resource transfer-out condition as a target resource transfer-out condition in response to the fact that the resource transfer-out information conforms to any resource transfer-out condition.

In a possible implementation manner, the first classification model includes a first-class decision tree sub-model and a second-class decision tree sub-model, and the first input module is configured to classify the resource export information and the first account characteristics through a plurality of leaf nodes of a plurality of first decision trees of the first-class decision tree sub-model, and output a first classification parameter corresponding to the first account, where the plurality of first decision trees are decision trees whose output results are independent of each other. And classifying the resource transfer-out information and the first account characteristics through a plurality of leaf nodes of a plurality of second decision trees of the second class decision tree submodels, and outputting second classification parameters corresponding to the first accounts, wherein the plurality of second decision trees are decision trees with output results correlated with each other. And outputting the second type parameter of the first account according to the first classification parameter and the second classification parameter. Wherein, the leaf node is a classification condition.

In a possible implementation manner, the first parameter fusion module is configured to perform logistic regression processing on the first type parameter and the second type parameter to obtain a third type parameter.

In one possible embodiment, the apparatus further comprises: the first account determination module is used for acquiring the virtual resource transfer-out times of the plurality of accounts in the target time period. And performing linear fitting on the scattered points to obtain a fitting curve, wherein the scattered points are used for representing the transfer-out times of the virtual resources and the account number corresponding to the transfer-out times of the virtual resources. In response to a goodness-of-fit of the fitted curve to the plurality of scattered points being less than a goodness-of-fit threshold, a distance between the plurality of scattered points and the fitted curve is determined. And determining the transfer-out times of the target virtual resources corresponding to any scatter point in response to the fact that the distance between any scatter point and the fitted curve is larger than a first distance threshold, wherein the transfer-out times of the target virtual resources are the transfer-out times of the virtual resources with the occurrence probability smaller than the first probability threshold. And determining an account with the same transfer-out times of the virtual resources as the transfer-out times of the target virtual resources as a first account.

and identifying the terminal used by the first type of target account as a first type of target terminal. And identifying a wireless network connected with the terminal used by the first type target account as a first type target network. And identifying the object of the plurality of first-class target accounts for transferring the virtual resource in the target time period as a second-class target account. And in response to the fact that the object of transferring the virtual resources of any account in the target time period is the same as the plurality of target accounts of the first type, identifying any account as the target account of the first type.

the first sample information acquiring unit is used for acquiring first sample resource transfer-out information and first sample account characteristic information of a first sample account, the first sample account is an account carrying target characters when virtual resources are transferred out, the target characters are associated with virtual resource transfer-out behaviors of the first type of target accounts, and the first sample resource transfer-out information comprises virtual resource transfer-out time of the first sample account and the number of transferred virtual resources.

And the first sample information input unit is used for inputting the first sample resource transfer-out information and the first sample account characteristic information into the first model, classifying the first sample account through the first model and outputting the predicted account type of the first sample account.

And the first model parameter adjusting unit is used for adjusting the model parameters of the first model according to first difference information between the predicted account type of the first sample account and the actual account type of the first sample account.

And the first model determining unit is used for responding to the model convergence condition that the model parameters of the first model meet the model convergence condition, and taking the first model as the first classification model.

and the second sample information acquisition unit is used for acquiring second sample resource transfer-out information and second sample account characteristic information of a second sample account, wherein the second sample account is an account other than the first type of target account.

And the second sample information input unit is used for inputting the second sample resource transfer-out information and the second sample account characteristic information into the first model, classifying the second sample account through the first model, and outputting the predicted account type of the second sample account.

In one possible embodiment, the apparatus further comprises:

and the resource transfer information acquisition module is used for acquiring resource transfer information of the second account, the resource transfer information comprises virtual resource transfer time of the second account and the number of transferred virtual resources, and the second account is an account of which the number of times of transferring virtual resources in the target time period meets a third target condition.

And the second matching module is used for determining target resource transfer-in conditions from the plurality of resource transfer-in conditions, the target resource transfer-in conditions are matched with the resource transfer-in information, and the plurality of resource transfer-in conditions are used for expressing the resource transfer-in behavior characteristics of the second type of target account.

And the fourth type parameter acquisition module is used for acquiring a fourth type parameter corresponding to the target resource transfer-in condition.

And the second input module is used for inputting the resource transfer-in information and second account characteristic information of the second account into the second classification model, classifying the second account through the second classification model, and outputting a fifth type parameter of the second account.

And the second parameter fusion module is used for fusing the fourth type parameter and the fifth type parameter to obtain a sixth type parameter, and the sixth type parameter is used for representing the type of the second account.

And the second identification module is used for identifying the second account as a second type target account in response to the sixth type parameter of the second account meeting the fourth target condition.

In a possible implementation manner, the second matching module is configured to compare the resource transfer information with a plurality of resource transfer conditions respectively; and determining any resource transfer-in condition as a target resource transfer-in condition in response to the resource transfer-in information meeting any resource transfer-in condition.

In a possible implementation manner, the second classification model includes a first-class decision tree sub-model and a second-class decision tree sub-model, and the second input module is configured to classify the resource transfer-in information and the second account characteristics through a plurality of leaf nodes of a plurality of first decision trees of the first-class decision tree sub-model, and output a third classification parameter corresponding to the second account, where the plurality of first decision trees are decision trees whose output results are independent of each other. And classifying the resource transfer-in information and the second account characteristics through a plurality of leaf nodes of a plurality of second decision trees of the second class decision tree submodels, and outputting fourth classification parameters corresponding to the second accounts, wherein the plurality of second decision trees are decision trees with output results correlated with each other. And outputting a fifth type parameter of the second account according to the third classification parameter and the fourth classification parameter. Wherein, the leaf node is a classification condition.

In a possible implementation manner, the second input module is configured to perform logistic regression processing on the third classification parameter and the fourth classification parameter, and output a fifth type parameter of the second account.

In a possible implementation manner, the second parameter fusion module is configured to perform logistic regression processing on the fourth type parameter and the fifth type parameter to obtain a sixth type parameter.

In a possible implementation manner, the apparatus further includes a second account determination module, configured to acquire the virtual resource transfer times of the plurality of accounts within the target time period. And performing linear fitting on the scattered points to obtain a fitting curve, wherein the scattered points are used for representing the transfer times of the virtual resources and the account number corresponding to the transfer times of the virtual resources. In response to a goodness-of-fit of the fitted curve to the plurality of scattered points being less than a goodness-of-fit threshold, a distance between the plurality of scattered points and the fitted curve is determined. And determining the transfer times of the target virtual resources corresponding to any scatter point in response to the fact that the distance between any scatter point and the fitted curve is larger than a second distance threshold value. And determining the account with the same transfer times of the virtual resources as the target virtual resources as a second account.

In a possible embodiment, the second identification module is further configured to perform at least one of the following operations: and identifying the terminal used by the second type target account as a second type target terminal. And identifying the wireless network connected with the terminal used by the second type target account as a second type target network. And identifying the object of the plurality of first-class target accounts for transferring the virtual resource in the target time period as a second-class target account.

In a possible embodiment, the training device of the second classification model includes:

and the third sample information acquiring unit is used for acquiring first sample resource transfer-in information and third sample account characteristic information of a third sample account, the third sample account is an account carrying target characters when virtual resources are transferred, the target characters are associated with virtual resource transfer-in behaviors of the second type of target accounts, and the first sample resource transfer-in information comprises virtual resource transfer-in time of the third sample account and the number of transferred virtual resources.

And the third sample information input unit is used for inputting the first sample resource transfer information and the third sample account characteristic information into the second model, classifying the third sample account through the second model, and outputting the predicted account type of the third sample account.

And the third model parameter adjusting unit is used for adjusting the model parameters of the second model according to third difference information between the predicted account type of the third sample account and the actual account type of the third sample account.

And the second model determining unit is used for responding to the model convergence condition of the model parameters of the second model and taking the second model as a second classification model.

and the fourth sample information acquisition unit is used for acquiring the second sample resource transfer-in information of a fourth sample account and the fourth sample account characteristic information, wherein the fourth sample account is an account other than the second type target account.

And the fourth sample information input unit is used for inputting the second sample resource transfer-in information and the fourth sample account characteristic information into the second model, classifying the fourth sample account through the second model, and outputting the predicted account type of the fourth sample account.

An embodiment of the present application provides a computer device, configured to perform the foregoing method, where the computer device may be implemented as a terminal or a server, and a structure of the terminal is introduced below:

fig. 19 is a schematic structural diagram of a terminal according to an embodiment of the present application. The terminal 1900 may be: a smartphone, a tablet, a laptop, or a desktop computer. Terminal 1900 may also be referred to by other names such as user equipment, portable terminal, laptop terminal, desktop terminal, and so on.

Generally, terminal 1900 includes: one or more processors 1901 and one or more memories 1902.

The processor 1901 may include one or more processing cores, such as a 4-core processor, an 8-core processor, and so forth. The processor 1901 may be implemented in at least one hardware form of a DSP (Digital Signal Processing), an FPGA (Field-Programmable Gate Array), and a PLA (Programmable Logic Array). The processor 1901 may also include a main processor and a coprocessor, where the main processor is a processor for Processing data in an awake state, and is also called a Central Processing Unit (CPU); a coprocessor is a low power processor for processing data in a standby state. In some embodiments, the processor 1901 may be integrated with a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content required to be displayed by the display screen. In some embodiments, the processor 1901 may further include an AI (Artificial Intelligence) processor for processing computing operations related to machine learning.

The memory 1902 may include one or more computer-readable storage media, which may be non-transitory. The memory 1902 may also include high-speed random access memory, as well as non-volatile memory, such as one or more magnetic disk storage devices, flash memory storage devices. In some embodiments, a non-transitory computer readable storage medium in memory 1902 is used to store at least one program code for execution by processor 1901 to implement the account identification methods provided by the method embodiments herein.

In some embodiments, terminal 1900 may further optionally include: a peripheral interface 1903 and at least one peripheral. The processor 1901, memory 1902, and peripheral interface 1903 may be connected by bus or signal lines. Various peripheral devices may be connected to peripheral interface 1903 via a bus, signal line, or circuit board. Specifically, the peripheral device includes: at least one of a radio frequency circuit 1904, a display screen 1905, a camera assembly 1906, an audio circuit 1907, a positioning assembly 1908, and a power supply 1909.

The peripheral interface 1903 may be used to connect at least one peripheral associated with an I/O (Input/Output) to the processor 1901 and the memory 1902. In some embodiments, the processor 1901, memory 1902, and peripherals interface 1903 are integrated on the same chip or circuit board; in some other embodiments, any one or two of the processor 1901, the memory 1902, and the peripheral interface 1903 may be implemented on separate chips or circuit boards, which is not limited in this embodiment.

The Radio Frequency circuit 1904 is used for receiving and transmitting RF (Radio Frequency) signals, also called electromagnetic signals. The radio frequency circuit 1904 communicates with a communication network and other communication devices via electromagnetic signals. The rf circuit 1904 converts an electrical signal into an electromagnetic signal to transmit, or converts a received electromagnetic signal into an electrical signal. Optionally, the radio frequency circuit 1904 includes: an antenna system, an RF transceiver, one or more amplifiers, a tuner, an oscillator, a digital signal processor, a codec chipset, an account identity module card, and so forth.

The display screen 1905 is used to display a UI (User Interface). The UI may include graphics, text, icons, video, and any combination thereof. When the display screen 1905 is a touch display screen, the display screen 1905 also has the ability to capture touch signals on or above the surface of the display screen 1905. The touch signal may be input to the processor 1901 as a control signal for processing. At this point, the display 1905 may also be used to provide virtual buttons and/or a virtual keyboard, also referred to as soft buttons and/or a soft keyboard.

The camera assembly 1906 is used to capture images or video. Optionally, camera assembly 1906 includes a front camera and a rear camera. Generally, a front camera is disposed at a front panel of the terminal, and a rear camera is disposed at a rear surface of the terminal.

The audio circuitry 1907 may include a microphone and a speaker. The microphone is used for collecting sound waves of the account and the environment, converting the sound waves into electric signals, and inputting the electric signals into the processor 1901 for processing, or inputting the electric signals into the radio frequency circuit 1904 for realizing voice communication.

The positioning component 1908 is configured to locate a current geographic Location of the terminal 1900 for navigation or LBS (Location Based Service).

Power supply 1909 is used to provide power to the various components in terminal 1900. The power source 1909 can be alternating current, direct current, disposable batteries, or rechargeable batteries.

In some embodiments, terminal 1900 also includes one or more sensors 1910. The one or more sensors 1910 include, but are not limited to: acceleration sensor 1911, gyro sensor 1912, pressure sensor 1913, fingerprint sensor 1914, optical sensor 1915, and proximity sensor 1916.

Acceleration sensor 1911 may detect the magnitude of acceleration in three coordinate axes of the coordinate system established with terminal 1900.

The gyro sensor 1912 may detect the body direction and the rotation angle of the terminal 1900, and the gyro sensor 1912 may cooperate with the acceleration sensor 1911 to acquire the 3D motion of the account with respect to the terminal 1900.

Pressure sensor 1913 may be disposed on a side bezel of terminal 1900 and/or underlying display 1905. When the pressure sensor 1913 is disposed on the side frame of the terminal 1900, the holding signal of the account to the terminal 1900 can be detected, and the processor 1901 can perform left-right hand recognition or shortcut operation based on the holding signal collected by the pressure sensor 1913. When the pressure sensor 1913 is disposed at the lower layer of the display 1905, the processor 1901 controls the operability control on the UI interface by operating the display 1905 according to the pressure of the account.

The fingerprint sensor 1914 is configured to collect a fingerprint of an account, and the processor 1901 identifies the account based on the fingerprint collected by the fingerprint sensor 1914, or the fingerprint sensor 1914 identifies the account based on the collected fingerprint.

The optical sensor 1915 is used to collect the ambient light intensity. In one embodiment, the processor 1901 may control the display brightness of the display screen 1905 based on the ambient light intensity collected by the optical sensor 1915.

Proximity sensor 1916 is used to gather the distance between the account and the front face of terminal 1900.

Those skilled in the art will appreciate that the configuration shown in FIG. 19 is not intended to be limiting of terminal 1900 and may include more or fewer components than those shown, or some components may be combined, or a different arrangement of components may be used.

The computer device may also be implemented as a server, and the following describes a structure of the server:

fig. 20 is a schematic structural diagram of a server 2000 according to an embodiment of the present application, where the server 2000 may have a relatively large difference due to different configurations or performances, and may include one or more processors (CPUs) 2001 and one or more memories 2002, where at least one program code is stored in the one or more memories 2002, and the at least one program code is loaded and executed by the one or more processors 2001 to implement the methods provided by the foregoing method embodiments. Of course, the server 2000 may also have components such as a wired or wireless network interface, a keyboard, and an input/output interface, so as to perform input and output, and the server 2000 may also include other components for implementing device functions, which are not described herein again.

In an exemplary embodiment, a computer-readable storage medium, such as a memory, including program code, executable by a processor, is also provided to perform the account identification method in the above embodiments. For example, the computer-readable storage medium may be a Read-Only Memory (ROM), a Random Access Memory (RAM), a Compact Disc Read-Only Memory (CD-ROM), a magnetic tape, a floppy disk, an optical data storage device, and the like.

In an exemplary embodiment, a computer program product or a computer program is also provided, which includes computer program code stored in a computer-readable storage medium, which is read by a processor of a computer device from the computer-readable storage medium, and which is executed by the processor to cause the computer device to execute the account identification method provided in the above-mentioned various alternative implementations.

It will be understood by those skilled in the art that all or part of the steps for implementing the above embodiments may be implemented by hardware, or may be implemented by hardware associated with program code, and the program may be stored in a computer readable storage medium, where the above mentioned storage medium may be a read-only memory, a magnetic or optical disk, etc.

The above description is only exemplary of the present application and should not be taken as limiting, as any modification, equivalent replacement, or improvement made within the spirit and principle of the present application should be included in the protection scope of the present application.

Claims

1. An account identification method, the method comprising:

2. The method of claim 1, wherein determining a target resource roll-out condition from a plurality of resource roll-out conditions comprises:

comparing the resource roll-out information with the plurality of resource roll-out conditions respectively;

and in response to the fact that the resource transfer-out information meets any resource transfer-out condition, determining the any resource transfer-out condition as the target resource transfer-out condition.

3. The method of claim 1, wherein the first classification model comprises a first class decision tree sub-model and a second class decision tree sub-model, and wherein classifying the first account through the first classification model and outputting the second type parameter of the first account comprises:

classifying the resource transfer-out information and the first account characteristics through a plurality of leaf nodes of a plurality of first decision trees of the first class decision tree submodel, and outputting a first classification parameter corresponding to the first account, wherein the plurality of first decision trees are decision trees with mutually independent output results;

classifying the resource transfer-out information and the first account characteristics through a plurality of leaf nodes of a plurality of second decision trees of the second class decision tree submodel, and outputting a second classification parameter corresponding to the first account, wherein the plurality of second decision trees are decision trees with output results correlated with each other;

outputting the second type parameter of the first account according to the first classification parameter and the second classification parameter;

wherein the leaf node is a classification condition.

4. The method of claim 3, wherein outputting the second type of parameter for the first account according to the first classification parameter and the second classification parameter comprises:

and performing logistic regression processing on the first classification parameter and the second classification parameter, and outputting the second type parameter of the first account.

5. The method according to claim 1, wherein the fusing the first type parameters and the second type parameters to obtain third type parameters comprises:

and performing logistic regression processing on the first type parameter and the second type parameter to obtain the third type parameter.

6. The method of claim 1, wherein prior to obtaining the resource roll-out information for the first account, the method further comprises:

acquiring the transfer-out times of a target virtual resource, wherein the transfer-out times of the target virtual resource are the transfer-out times of the virtual resource of which the occurrence probability is smaller than a first probability threshold;

and in response to the fact that the virtual resource transfer-out times of any account in the target time period are the same as the target virtual resource transfer-out times, determining the any account as the first account.

7. The method according to claim 6, wherein the method for determining the number of times the target virtual resource is rolled out comprises:

acquiring virtual resource transfer-out times of a plurality of accounts in the target time period;

performing linear fitting on a plurality of scattered points to obtain a fitting curve, wherein the plurality of scattered points are used for representing a plurality of virtual resource transfer-out times and the account number corresponding to the plurality of virtual resource transfer-out times;

and determining the transferring times of the target virtual resources corresponding to any scatter point in response to the fact that the distance between the any scatter point and the fitted curve is larger than a first distance threshold.

8. The method of claim 1, wherein after identifying the first account as the first type of target account in response to the third type of parameter of the first account meeting a second target condition, the method further comprises at least one of:

identifying the terminal used by the first type of target account as a first type of target terminal;

identifying a wireless network connected with a terminal used by the first type of target account as a first type of target network;

identifying objects of the plurality of first class target accounts for transferring virtual resources within the target time period as second class target accounts;

in response to the object of any account transferring virtual resources within the target time period being the same as the plurality of target accounts of the first class, identifying the any account as the target account of the first class.

9. The method of claim 1, wherein the training method of the first classification model comprises:

acquiring first sample resource transfer-out information and first sample account characteristic information of a first sample account, wherein the first sample account carries target characters when virtual resources are transferred out, the target characters are associated with virtual resource transfer-out behaviors of the first type of target accounts, and the first sample resource transfer-out information comprises virtual resource transfer-out time of the first sample account and the number of transferred virtual resources;

inputting the first sample resource transfer-out information and first sample account characteristic information into a first model, classifying the first sample account through the first model, and outputting the predicted account type of the first sample account;

adjusting model parameters of the first model according to first difference information between the predicted account type of the first sample account and the actual account type of the first sample account;

in response to the model parameters of the first model meeting a model convergence condition, treating the first model as the first classification model.

10. The method of claim 9, wherein prior to treating the first model as the first classification model in response to the model parameters of the first model meeting a model convergence criterion, the method further comprises:

acquiring second sample resource transfer-out information and second sample account characteristic information of a second sample account, wherein the second sample account is an account other than the first type of target account;

inputting the second sample resource transfer-out information and the second sample account characteristic information into the first model, classifying the second sample account through the first model, and outputting the predicted account type of the second sample account;

and adjusting the model parameters of the first model according to second difference information between the predicted account type of the second sample account and the actual account type of the second sample account.

11. The method of claim 1, further comprising:

acquiring resource transfer-in information of a second account, wherein the resource transfer-in information comprises virtual resource transfer-in time of the second account and the number of transferred virtual resources, and the second account is an account of which the number of times of transferring virtual resources in a target time period meets a third target condition;

determining target resource transfer-in conditions from a plurality of resource transfer-in conditions, wherein the target resource transfer-in conditions are matched with the resource transfer-in information, and the resource transfer-in conditions are used for representing resource transfer-in behavior characteristics of a second type of target account;

acquiring a fourth type parameter corresponding to the target resource transfer-in condition;

inputting the resource transfer-in information and second account characteristic information of the second account into a second classification model, classifying the second account through the second classification model, and outputting a fifth type parameter of the second account;

fusing the fourth type parameter and the fifth type parameter to obtain a sixth type parameter, wherein the sixth type parameter is used for representing the type of the second account;

identifying the second account as the second class of target account in response to the sixth type of parameter for the second account meeting a fourth target condition.

12. The method according to claim 11, wherein said determining a target resource transfer-in condition from a plurality of resource transfer-in conditions comprises:

comparing the resource transfer-in information with the plurality of resource transfer-in conditions respectively;

and determining any resource transfer-in condition as the target resource transfer-in condition in response to the resource transfer-in information meeting any resource transfer-in condition.

13. An account identification apparatus, the apparatus comprising:

14. A computer device comprising one or more processors and one or more memories having at least one program code stored therein, the program code being loaded and executed by the one or more processors to implement the account identification method of any one of claims 1 to 12.

15. A computer-readable storage medium having at least one program code stored therein, the program code being loaded and executed by a processor to implement the account identification method of any one of claims 1 to 12.