HK1238766B - Abnormal transfer detection method and device - Google Patents

Description

Abnormal transfer detection method and device

Technical Field

The present invention relates to the field of Internet finance, and more particularly to a method and device for detecting abnormal transfers.

Background Art

With the advent of the internet finance and big data era, users can conduct non-cash transfer transactions through the internet and other means. Since the internet is an open network, online banking systems also open up banks' internal systems to the internet. Therefore, ensuring the security of non-cash transfer transactions is a crucial issue in the internet finance and big data era. It is crucial to the security of the entire internet finance industry and is a key consideration for banks in ensuring the safety of user funds.

Among the existing technologies for detecting abnormal transfer transactions, a commonly used method is to improve the security authentication mechanism when users conduct transfer transactions. This method requires users to perform a variety of verification operations or the client and server to verify in the transaction message. However, these methods will bring additional verification operations to users, increase transfer transaction delays, reduce customer experience, make transaction messages too complicated, and increase server-side processing time. Another method is to establish a user relationship network through the relationships between users to detect abnormal transfer transactions. However, this method can only establish a relationship network when there are historical transfer records between users. If there are no historical transfer records between users, it is more difficult to build a relationship network.

In summary, existing abnormal transfer transaction detection technologies have problems such as transfer transaction delays and difficulty in constructing user relationship networks when there are no historical transfer records between users. Therefore, an effective method needs to be proposed to solve the above problems.

Summary of the Invention

The embodiments of the present invention provide a method and apparatus for detecting abnormal transfers, which are used to solve the problems in the prior art of transfer transaction delays and the difficulty in establishing a relationship network when there are no historical transfer records between users.

An embodiment of the present invention provides a method for detecting abnormal transfers, comprising:

Obtain transfer transaction information, including transferor information;

Based on the transferor's information, determine the transferor's abnormal transfer detection model. The abnormal transfer detection model is derived based on the transferor's social attributes and historical behavior attributes.

The transfer transaction information is input into the abnormal transfer detection model of the transferor to obtain the abnormal probability value of the transfer transaction information.

Optionally, the abnormal transfer detection model is derived based on the transferor's social attributes and historical behavior attributes, including:

The social attributes of the transferor include the transferor's own attributes and the interaction attributes obtained from the social network;

The historical behavior attributes of the transferor include the payment behavior attributes of the transferor;

Determine the user relationship network of the transferor based on its own attributes, interaction attributes, and payment behavior attributes;

Based on historical positive and negative samples of transfer transactions and user relationship networks, a machine learning algorithm is used to establish an abnormal transfer detection model for the transferor.

Optionally, the transfer transaction information is input into the abnormal transfer detection model of the transferor to obtain an abnormal probability value of the transfer transaction information, including:

Input the transfer transaction information into the abnormal transfer detection model of the transferor to obtain the abnormal probability value of the transfer transaction information's own attributes, the abnormal probability value of the interaction attributes, and the abnormal probability value of the payment behavior attributes;

According to the abnormal probability value of its own attributes, the abnormal probability value of the interaction attributes and the abnormal probability value of the payment behavior attributes, the abnormal probability value of the transfer transaction information is obtained.

Optionally, based on historical positive and negative samples of transfer transactions and the user relationship network, a machine learning algorithm is used to establish an abnormal transfer detection model for the transferor, including:

Conduct correlation analysis on user attributes, interaction attributes, and payment behavior attributes in the user relationship network;

Delete irrelevant attributes from the user relationship network to obtain a revised user relationship network; based on the positive and negative samples of historical transfer transactions and the revised user relationship network, establish an abnormal transfer detection model for the transferor through a machine learning algorithm.

Optionally, the self-attribute includes at least one of the following: identity information indicator, education level indicator, occupation status indicator, family situation indicator, social information indicator;

The payment behavior attributes include at least one of the following: a transfer frequency index, a transfer time distribution index, a transfer location distribution index, a transfer amount distribution index, and a transfer method proportion index;

The interaction attribute includes at least one of the following: a friend frequency index, a contact frequency index, and a favorability index.

An embodiment of the present invention further provides an abnormal transfer detection device, comprising:

Acquisition unit: used to obtain transfer transaction information, including transferor information;

Determination unit: used to determine the abnormal transfer detection model of the transferor based on the transferor information. The abnormal transfer detection model is obtained based on the transferor's social attributes and historical behavior attributes;

Calculation unit: used to input the transfer transaction information into the abnormal transfer detection model of the transferor to obtain the abnormal probability value of the transfer transaction information.

Optionally, the social attributes of the transferor include the transferor's own attributes and interaction attributes obtained from the social network;

The historical behavior attributes of the transferor include the payment behavior attributes of the transferor;

The determination unit is specifically used for:

Determine the user relationship network of the transferor based on its own attributes, interaction attributes, and payment behavior attributes;

Based on historical positive and negative samples of transfer transactions and user relationship networks, a machine learning algorithm is used to establish an abnormal transfer detection model for the transferor.

Optionally, the computing unit is specifically configured to:

Input the transfer transaction information into the transferor's abnormal transfer detection model to obtain the abnormal probability values of the transfer transaction information's own attributes, interaction attributes, and payment behavior attributes;

According to the abnormal probability value of its own attributes, the abnormal probability value of the interaction attributes and the abnormal probability value of the payment behavior attributes, the abnormal probability value of the transfer transaction information is obtained.

Optionally, the determining unit is further configured to:

Conduct correlation analysis on user attributes, interaction attributes, and payment behavior attributes in the user relationship network;

Delete irrelevant attributes from the user relationship network to obtain a revised user relationship network; based on the positive and negative samples of historical transfer transactions and the revised user relationship network, establish an abnormal transfer detection model for the transferor through a machine learning algorithm.

Optionally, the self-attribute includes at least one of the following: identity information indicator, education level indicator, occupation status indicator, family situation indicator, social information indicator;

The payment behavior attributes include at least one of the following: a transfer frequency index, a transfer time distribution index, a transfer location distribution index, a transfer amount distribution index, and a transfer method proportion index;

The interaction attribute includes at least one of the following: a friend frequency index, a contact frequency index, and a favorability index.

An embodiment of the present invention provides an abnormal transfer detection method and apparatus, which obtain transfer transaction information, including transferor information; determine an abnormal transfer detection model for the transferor based on the transferor information, the abnormal transfer detection model being derived based on the transferor's social attributes and historical behavioral attributes; and input the transfer transaction information into the transferor's abnormal transfer detection model to obtain an abnormal probability value for the transfer transaction information. In an embodiment of the present invention, transfer transaction information is first obtained; then, based on the transfer transaction information, an abnormal transfer detection model of the transferor is determined, wherein the abnormal transfer detection model is obtained based on the social attributes and historical behavioral attributes of the transferor, so as to facilitate the abnormal transfer detection system to detect and identify the transfer transaction. Since the social attributes and historical behavioral attributes are diverse, there is no need for the user to perform additional security verification operations, thereby reducing the delay of the transfer transaction. At the same time, when there is no transfer record between users, the social attributes can also be used to detect whether there is an abnormal transfer situation, thereby improving the coverage and accuracy of abnormal transfer detection; finally, the transfer transaction information is input into the abnormal transfer detection model of the transferor to obtain an abnormal probability value of the transfer transaction information, so as to detect the user's transfer transaction and issue an abnormal warning.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments.

FIG1 is a schematic diagram of the overall architecture of an abnormal transfer detection system according to an embodiment of the present invention;

FIG2 is a flow chart of a method for detecting abnormal transfers according to an embodiment of the present invention;

FIG3 is a schematic diagram of comprehensive abnormality probability provided by an embodiment of the present invention;

FIG4 is a schematic diagram of a user relationship network according to an embodiment of the present invention;

FIG5 is a schematic diagram of the structure of an abnormal transfer detection device provided by an embodiment of the present invention.

DETAILED DESCRIPTION

In order to make the purpose, technical solutions and beneficial effects of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

In order to better understand this solution, an abnormal transfer detection system in the technical solution of the present invention is designed. The designed abnormal transfer detection system is described below. The overall architecture of the abnormal transfer detection system is shown in Figure 1 below:

Figure 1 exemplarily shows a schematic diagram of the overall architecture of an abnormal transfer detection system provided by an embodiment of the present invention. As shown in Figure 1, it includes a data acquisition module, a database module, a user relationship network establishment module, an abnormal transfer detection model training module, and an abnormal transfer detection module. Among them, the database module includes its own attribute database, a payment behavior attribute database, and an interaction attribute database. The abnormal transfer detection model training module is connected to the backend transaction system. The overall architecture of the abnormal transfer detection system is designed as follows: the data collection module collects user attribute data, payment behavior attribute data, and interaction attribute data, and stores them in the user attribute database, payment behavior attribute database, and interaction attribute database, respectively. The user relationship network establishment module establishes a three-dimensional user relationship network based on the data in the user attribute database, payment behavior attribute database, and interaction attribute database. The three dimensions are the user attribute dimension, payment behavior attribute dimension, and interaction attribute dimension. The abnormal transfer detection model training module obtains positive and negative samples of historical user transfer transactions from the backend transaction system. Based on the user relationship network and the positive and negative samples of historical transfer transactions, it uses a machine learning algorithm to establish an abnormal transfer detection model. This abnormal transfer detection model is then used in the abnormal transfer detection module to detect transfer transactions and issue abnormality warnings when users initiate them. Furthermore, the user relationship network in the abnormal transfer detection system is not static. The user attribute data, payment behavior attribute data, and interaction attribute data collected by the abnormal transfer detection system change as the user's external relationship data changes, and the abnormal transfer detection model is also periodically updated.

The overall architecture of the designed abnormal transfer detection system has the following advantages: First, when a user initiates a transfer transaction, the diverse and huge user relationship network contains a large amount of user information, so the user does not need to perform additional security verification operations, thereby reducing the delay of the transfer transaction; Second, when there is no transfer record between users, the user relationship network can also be established through the user's own attribute data and interaction attribute data, which solves the problem that if there is no historical transfer record between users, it is difficult to build a user relationship network; Third, an abnormal transfer detection model is established through the diverse and huge user relationship network and the user's historical transfer transaction positive and negative samples, and this model is used in the abnormal transfer detection module, which improves the coverage and accuracy of abnormal transfer detection.

FIG2 exemplarily shows a flow chart of an abnormal transfer detection method provided by an embodiment of the present invention. As shown in FIG2 , the method includes the following steps:

Step S101: Acquire transfer transaction information, which includes information about the transferor;

Step S102: Determine an abnormal transfer detection model for the transferor based on the transferor's information. The abnormal transfer detection model is derived based on the transferor's social attributes and historical behavior attributes.

Step S103: Input the transfer transaction information into the abnormal transfer detection model of the transferor to obtain an abnormal probability value of the transfer transaction information.

Specifically, in the above embodiment, when a user initiates a transfer transaction, the abnormal transfer detection module in the system analyzes the initiating user A and the receiving user B, obtaining the transfer transaction information of both. This information is then input into the abnormal transfer detection model to determine an abnormality probability value for the transfer transaction information. In a specific implementation, after inputting the transfer transaction information of both users A and B into the abnormal transfer detection model, a machine learning algorithm can be used to determine the abnormality probability value for the transfer transaction information. Once the abnormality probability value for the transfer transaction information is determined, the user's transfer transaction can be detected and an abnormality warning issued. The abnormal transfer detection model is derived from the social attributes and historical behavioral attributes of the transferor, making it easier for the abnormal transfer detection system to detect and identify transfer transactions. Since social attributes and historical behavioral attributes are diverse, users do not need to perform additional security verification operations, thereby reducing the delay of transfer transactions. At the same time, when there is no transfer record between users, social attributes can also be used to detect whether there is an abnormal transfer situation, thereby improving the coverage and accuracy of abnormal transfer detection.

Among them, the abnormal transfer detection model can be obtained through the following three methods:

Method 1: The abnormal transfer detection model is obtained based on the social attributes and historical behavioral attributes of the transferor. Specifically, the social attributes and historical behavioral attributes of the transferor are used as inputs to the abnormal transfer detection model, and a machine learning algorithm is used to train the abnormal transfer detection model. After multiple training sessions, the abnormal transfer detection model is finally trained.

Method 2: Optionally, an abnormal transfer detection model is obtained based on the social attributes of the transferor and the historical behavioral attributes of the transferor, including: the social attributes of the transferor include the transferor's own attributes and interaction attributes obtained from the social network; the historical behavioral attributes of the transferor include the transferor's payment behavior attributes; the user relationship network of the transferor is determined based on the transferor's own attributes, interaction attributes, and payment behavior attributes; based on the positive and negative samples of historical transfer transactions and the user relationship network, an abnormal transfer detection model of the transferor is established through a machine learning algorithm; specifically, first, the user relationship network of the transferor is determined based on the transferor's own attributes, interaction attributes, and payment behavior attributes; then, the positive and negative samples of historical transfer transactions and the user relationship network are used as inputs to the abnormal transfer detection model, and the machine learning algorithm is used to train the abnormal transfer detection model. After multiple training sessions, the abnormal transfer detection model is finally trained.

Method 3: Optionally, a machine learning algorithm is used to establish an abnormal transfer detection model for the transferor based on historical positive and negative samples of transfer transactions and the user relationship network. This includes: performing a correlation analysis on the user's own attributes, interaction attributes, and payment behavior attributes in the user relationship network; removing irrelevant attributes from the user relationship network to obtain a revised user relationship network; and establishing an abnormal transfer detection model for the transferor based on historical positive and negative samples of transfer transactions and the revised user relationship network using a machine learning algorithm. In the specific implementation, the self-attributes, interaction attributes and payment behavior attributes in the user relationship network contain a lot of information or indicators respectively. Assuming that the self-attributes, interaction attributes and payment behavior attributes contain a total of 10,000 indicators, first perform correlation analysis or data cleaning and screening on these 10,000 indicators. For example, if indicator 1 and indicator 2 show a linear relationship, then one of indicator 1 and indicator 2 can be retained and the other indicator can be deleted. Assuming that after correlation analysis or data cleaning and screening of these 10,000 indicators, 1,000 indicators are finally retained; then, the corrected user relationship network is obtained based on the 1,000 indicators, and the positive and negative samples of historical transfer transactions and the corrected user relationship network are used as the input of the abnormal transfer detection model and the machine learning algorithm is used to train the abnormal transfer detection model. During the training process, the historical transfer transactions can be combined with the corrected user relationship network. The user relationship network is revised again by performing indicator correlation analysis on the positive and negative samples of transactions. For example, among the 1,000 indicators, there are some indicators that have no effect on the positive and negative samples of historical transfer transactions, and these indicators can be deleted. Assuming that 500 of the 1,000 indicators have no effect on the positive and negative samples of historical transfer transactions, then a revised user relationship network containing 500 indicators is obtained. The revised user relationship network and the positive and negative samples of historical transfer transactions are used as the input of the abnormal transfer detection model, and the abnormal transfer detection model is trained using a machine learning algorithm. Finally, the abnormal transfer detection model is trained, wherein the positive and negative samples of historical transfer transactions are obtained by connecting the abnormal transfer detection model training module in the abnormal transfer detection system to the backend transaction system. The positive and negative samples of historical transfer transactions include the user's historical normal transfer transaction records and abnormal transfer transaction records. Among them, the first point that needs to be explained is: the user relationship network has been revised twice. The revised user relationship network can be performed during the training process of the abnormal transfer detection model or before the training of the abnormal transfer detection model. For example, the 1,000 indicators in the revised user relationship network are combined with the positive and negative samples of historical transfer transactions to perform correlation analysis or data cleaning and screening, and finally 500 indicators are screened out. The revised user relationship network containing 500 indicators and the positive and negative samples of historical transfer transactions are used as the input of the abnormal transfer detection model, and the abnormal transfer detection model is trained using a machine learning algorithm; it needs to be explained The second point is: in the specific implementation, the data is input into the abnormal transfer detection model in the form of records. For example, record 1 is: the transfer time is 8 o'clock in the morning, the transfer amount is 8,000, the transfer location is Shanghai, the transfer method is swiping the card, the relationship with the transfer recipient is a colleague, and the transfer transaction is a positive sample; the third point that needs to be explained is: in the specific implementation, if the positive and negative samples of the user's historical transfer transactions are all positive samples, then the number of historical transfer transaction records of the user can be reduced. If the number of negative samples in the positive and negative samples of the user's historical transfer transactions is far greater than the number of positive samples, then the number of historical transfer transaction records of the user can be increased.

Through the above three methods of determining abnormal transfer detection models, it can be seen that the methods for determining abnormal transfer detection models are diverse and flexible; the two corrections to the user relationship network are actually two data dimensionality reductions on the user relationship network, which can reduce the amount of calculation and pressure on the system, and can also clarify which indicators can have an effect on transfer transactions.

Optionally, the transfer transaction information is input into the transferor's abnormal transfer detection model to obtain an abnormal probability value of the transfer transaction information, including: inputting the transfer transaction information into the transferor's abnormal transfer detection model to obtain the transfer transaction information's own attribute abnormal probability value, interaction attribute abnormal probability value, and payment behavior attribute abnormal probability value; obtaining the transfer transaction information's abnormal probability value based on the own attribute abnormal probability value, interaction attribute abnormal probability value, and payment behavior attribute abnormal probability value. Specifically, suppose user A transfers money to user B. The abnormal transfer detection module in the abnormal transfer detection system analyzes user A and user B to obtain their indicators. These indicators are then input into the abnormal transfer detection model, resulting in three abnormality probability values: the probability of abnormality for the user's own attributes, the probability of abnormality for the interaction attributes, and the probability of abnormality for the payment behavior attributes. These values are assumed to be 0.3, 0.5, and 0.2, respectively. Appropriate weights are applied to these three abnormality probability values, and the weighted abnormality probability values are added together to ultimately generate a comprehensive abnormality probability that the transfer transaction is abnormal. Assuming the comprehensive abnormality probability is 0.25, this comprehensive abnormality probability indicates a risk value that the current transfer transaction is abnormal. If this comprehensive probability is very large, the system directly issues an abnormality warning. Figure 3 exemplifies a schematic diagram of the comprehensive abnormality probability, as shown in Figure 3.

Optionally, the user attributes include at least one of the following: identity information indicators, education level indicators, occupational status indicators, family situation indicators, and social information indicators. In specific implementations, identity information indicators may also include information representing the user's identity, such as ID card, passport, gender, age, and mobile phone number. Educational level indicators indicate the user's educational level; occupational status indicators reflect whether the user has a stable and legitimate job and the frequency of job changes; family status indicators include marital status and child status; and social information indicators include social security and medical insurance payment status and social credit status, which may include overdue bank card payments or utility bills. The abnormal transfer detection system creates a basic profile of the user based on the user's attribute information. For example, if the user has no stable job, incomplete or falsified identity information, or poor social status, and the transfer transaction amount is relatively large, then the transfer transaction is likely to be abnormal, regardless of whether the user is the initiator or the recipient. For example, the transfer may be involved in money laundering or telecommunications fraud.

Payment behavior attributes include at least one of the following: a transfer frequency indicator, a transfer time distribution indicator, a transfer location distribution indicator, a transfer amount distribution indicator, and a transfer method ratio indicator. In specific implementations, data on payment behavior attributes is primarily obtained from the bank's own channels, card organizations, and third-party payment institutions. This data includes historical transfer records, historical consumption details, and the like. Within historical transfer records, key information such as, but not limited to, the transfer recipient, transfer amount, transfer time, transfer location, and transfer method is used to statistically analyze the distribution of transfer recipients and corresponding indicators such as transfer frequency, user transfer amount distribution, transfer time and location distribution, and transfer method ratio. (Note: The following sentences appear to be unrelated and should likely be omitted.) In the transfer object analysis, objects are sorted from high to low based on transfer frequency. The distribution of transfer amount, transfer time, and transfer location can be analyzed to determine the user's transfer amount range and fluctuation trends over time. If a user's transfers follow a regular distribution with gentle fluctuations, but a sudden increase in the current transfer amount and a transfer time that deviates from the distribution, the probability of an abnormal transfer is high. Analyzing the proportion of historical transfer methods reveals whether the user prefers traditional channels such as ATMs and bank counters or innovative channels such as computers and mobile devices for transfer transactions. If a user frequently transfers through traditional channels but currently transfers through mobile devices, this indicator will have a higher weight in determining the probability of an abnormal transfer. Furthermore, within a user's historical transfer transaction data, the user's spending power index and transaction channel are analyzed based on information such as consumption frequency, amount, and consumption method, based on their historical transfer transactions and consumption records. The spending power index indicates the user's spending level and reflects their spending power and purchasing power, i.e., whether they frequently make large or small purchases. The consumption method shows whether the user prefers traditional payment methods such as POS card swiping or innovative payment methods such as Cloud Quick Pass and QR code scanning payment, which in turn reflects the user's enthusiasm for mobile innovative payment.

Interaction attributes include at least one of the following: friend frequency index, contact frequency index, and favorability index. In a specific implementation of the present invention, in addition to establishing a relationship network based on payment behavior attributes between users, a relationship network based on interaction attributes is also established. This allows both parties involved in a transfer to determine the strength of their relationship based on interaction attributes, even if they have no historical transfer records. Interaction attributes include data from WeChat, QQ, Weibo, email, telecom operators such as text messages and calls, online games, and even gambling data. Each user develops a complex network of interaction attributes. Key indicators within this network include friend frequency, contact frequency, favorability, and other indicators that reflect the closeness of a user's connections with other users. The friend frequency index reflects the closeness of friendships between users. If both users are friends across multiple social apps like WeChat and QQ, the friendship frequency between the users is high. The contact frequency index reflects the frequency of contact between users, primarily derived from communication-related social data. Favorability metrics reflect the positive or negative nature of relationships between users. Natural language analysis techniques can be used to analyze user chat content through word segmentation, word frequency statistics, and positive and negative word analysis to determine user favorability. Beyond social networking applications, data from online games and gambling can also reveal complex user relationship networks. For example, in online games, the relationships between team members can further complement the interactive attribute relationship network.

Since the user relationship network is determined based on the user's own attributes, interaction attributes, and payment behavior attributes, based on the above detailed introduction to the user's own attributes, interaction attributes, and payment behavior attributes, the following describes the specific process of establishing the user relationship network based on the user's own attributes, interaction attributes, and payment behavior attributes. It includes three steps:

Self-attributes, interaction attributes and payment behavior attributes can be considered as the three dimensions of the user relationship network. 1. Score the information in self-attributes, interaction attributes and payment behavior attributes: In the self-attribute dimension, the user's identity information index, education level index, occupational status index, family situation index and social information index are judged and scored respectively. If the identity information of both users of the transfer transaction is complete and true, their occupations are stable and their social information is good, it will obviously reduce the probability of the transfer transaction being abnormal, and the scores of the user's identity information index, occupational status index and social information index can be lowered; in the interaction attribute dimension, by judging and scoring the friend frequency index, contact frequency index and favorability index, the friend frequency index, contact frequency index and social information index are judged and scored respectively. The network frequency index and favorability index can intuitively reflect whether there is a social relationship between users, the closeness of the connection, and the positive or negative emotions between users. For example, user B, a friend of user A, requests a transfer from user A, but the interaction attribute dimension shows that the friendship frequency between users A and B is low, the contacts are rare, and there is no favorability. This indicates that the social interaction attributes between users A and B are relatively weak, and user B is very likely to have had his account hacked. In this case, the scores of the interaction attribute friend frequency index, contact frequency index, and favorability index are given higher scores. In the payment behavior attribute dimension, all user transfer transactions and consumption records will be deeply mined and analyzed to obtain the close relationship between the user's transfer objects, analyze the user's transfer transactions or consumption habits, and portray their payment profile. If the initiating user and the receiving user have frequent historical transfer transactions and consumption behaviors, and the transfer amount is stable and consistent with the user's spending power, then the probability of the current transfer transaction being abnormal is relatively low, and the information in the payment behavior attribute dimension can be assigned a lower score. Conversely, if the initiating user and the receiving user have no transfer transactions, the payment relationship of the receiving user is complex and irregular, and the current transfer amount is seriously inconsistent with the initiating user's spending power, then the probability of the transfer being abnormal is higher. For example, the initiating user may have been the victim of telecommunications fraud. In this case, the information in the payment behavior attribute dimension can be assigned a higher score. 2. The scores of the information in the self-attributes, interaction attributes, and payment behavior attributes are used to generate various weight values. 3. With the transfer user as the central node and the various weight values as edges, a user relationship network diagram is formed. Figure 4 exemplifies a schematic diagram of the user relationship network, as shown in Figure 4.

From the foregoing, it can be seen that an embodiment of the present invention provides an abnormal transfer detection method, which obtains transfer transaction information, including transferor information; determines an abnormal transfer detection model for the transferor based on the transferor information, where the abnormal transfer detection model is derived based on the transferor's social attributes and historical behavioral attributes; and inputs the transfer transaction information into the transferor's abnormal transfer detection model to obtain an abnormal probability value for the transfer transaction information. In an embodiment of the present invention, transfer transaction information is first obtained; then, based on the transfer transaction information, an abnormal transfer detection model of the transferor is determined, wherein the abnormal transfer detection model is obtained based on the social attributes and historical behavioral attributes of the transferor, so that the system can detect and identify the transfer transaction. Since the social attributes and historical behavioral attributes are diverse, there is no need for the user to perform additional security verification operations, thereby reducing the delay of the transfer transaction. At the same time, when there is no transfer record between users, it can also be detected whether there is an abnormal transfer situation, thereby improving the coverage and accuracy of abnormal transfer detection; finally, the transfer transaction information is input into the abnormal transfer detection model of the transferor to obtain an abnormal probability value of the transfer transaction information, so as to detect the user's transfer transaction and issue an abnormal warning.

Based on the same concept, an embodiment of the present invention provides an abnormal transfer detection device. FIG5 exemplarily shows a schematic structural diagram of an abnormal transfer detection device provided by an embodiment of the present invention. As shown in FIG5 , the device includes an acquisition unit 201, a determination unit 202, and a calculation unit 203. In particular:

Acquisition unit 201: used to obtain transfer transaction information, including transferor information;

Determining unit 202: used to determine an abnormal transfer detection model for the transferor based on the transferor information, where the abnormal transfer detection model is obtained based on the transferor's social attributes and historical behavior attributes;

Calculation unit 203: used to input the transfer transaction information into the abnormal transfer detection model of the transferor to obtain an abnormal probability value of the transfer transaction information.

Optionally, the social attributes of the transferor include the transferor's own attributes and interaction attributes obtained from the social network;

The historical behavior attributes of the transferor include the payment behavior attributes of the transferor;

The determining unit 202 is specifically configured to:

Determine the user relationship network of the transferor based on its own attributes, interaction attributes, and payment behavior attributes;

Based on historical positive and negative samples of transfer transactions and user relationship networks, a machine learning algorithm is used to establish an abnormal transfer detection model for the transferor.

Optionally, the calculation unit 203 is specifically configured to:

Input the transfer transaction information into the transferor's abnormal transfer detection model to obtain the abnormal probability values of the transfer transaction information's own attributes, interaction attributes, and payment behavior attributes;

According to the abnormal probability value of its own attributes, the abnormal probability value of the interaction attributes and the abnormal probability value of the payment behavior attributes, the abnormal probability value of the transfer transaction information is obtained.

Optionally, the determining unit 202 is further configured to:

Conduct correlation analysis on user attributes, interaction attributes, and payment behavior attributes in the user relationship network;

Delete irrelevant attributes from the user relationship network to obtain a revised user relationship network; based on the positive and negative samples of historical transfer transactions and the revised user relationship network, establish an abnormal transfer detection model for the transferor through a machine learning algorithm.

Optionally, the self-attribute includes at least one of the following: identity information indicator, education level indicator, occupation status indicator, family situation indicator, social information indicator;

The payment behavior attributes include at least one of the following: a transfer frequency index, a transfer time distribution index, a transfer location distribution index, a transfer amount distribution index, and a transfer method proportion index;

The interaction attribute includes at least one of the following: a friend frequency index, a contact frequency index, and a favorability index.

From the foregoing, it can be seen that an embodiment of the present invention provides an abnormal transfer detection device for obtaining transfer transaction information, which includes information about the transferor; determining an abnormal transfer detection model for the transferor based on the transferor information, wherein the abnormal transfer detection model is obtained based on the transferor's social attributes and historical behavioral attributes; and inputting the transfer transaction information into the transferor's abnormal transfer detection model to obtain an abnormal probability value for the transfer transaction information. In an embodiment of the present invention, transfer transaction information is first obtained; then, based on the transfer transaction information, an abnormal transfer detection model of the transferor is determined, wherein the abnormal transfer detection model is obtained based on the social attributes and historical behavioral attributes of the transferor, so as to facilitate the abnormal transfer detection system to detect and identify the transfer transaction. Since the social attributes and historical behavioral attributes are diverse, there is no need for the user to perform additional security verification operations, thereby reducing the delay of the transfer transaction. At the same time, when there is no transfer record between users, the social attributes can also be used to detect whether there is an abnormal transfer situation, thereby improving the coverage and accuracy of abnormal transfer detection; finally, the transfer transaction information is input into the abnormal transfer detection model of the transferor to obtain an abnormal probability value of the transfer transaction information, so as to detect the user's transfer transaction and issue an abnormal warning.

Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

The present invention is described with reference to the flowcharts and/or block diagrams of the methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and/or box in the flowchart and/or block diagram, as well as the combination of processes and/or boxes in the flowchart and/or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and/or one or more boxes in the block diagram.

Although the preferred embodiments of the present invention have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

Obviously, those skilled in the art may make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if such changes and modifications fall within the scope of the claims and their equivalents, the present invention is intended to include such changes and modifications.

Claims (8)

1. A method for detecting abnormal fund transfers, characterized in that it includes: Obtain transfer transaction information, which includes information about the transferor; Based on the information of the transferor, an abnormal transfer detection model for the transferor is determined. The abnormal transfer detection model is obtained based on the social attributes and historical behavioral attributes of the transferor. The transfer transaction information is input into the abnormal transfer detection model of the sender to obtain the abnormal probability value of the transfer transaction information; The abnormal transfer detection model is derived based on the social attributes and historical behavioral attributes of the sender, and includes: The social attributes of the transferor include the transferor's own attributes and the interaction attributes obtained from the social network. The historical behavioral attributes of the transferor include the payment behavior attributes of the transferor; The user relationship network of the transferor is determined based on the self-attribute, the interaction attribute, and the payment behavior attribute; Based on historical positive and negative transfer transaction samples and the user relationship network, an abnormal transfer detection model for the sender is established using machine learning algorithms. The user relationship network is obtained through multiple corrections, and the correction of the user relationship network includes both the training process of the abnormal transfer detection model and the process before training the abnormal transfer detection model. 2. The method as described in claim 1, characterized in that, the step of inputting the transfer transaction information into the abnormal transfer detection model of the transferor to obtain the abnormal probability value of the transfer transaction information includes: The transfer transaction information is input into the abnormal transfer detection model of the transferor to obtain the abnormal probability values of the transfer transaction information's own attributes, interaction attributes, and payment behavior attributes. The abnormal probability value of the transfer transaction information is obtained based on the abnormal probability value of its own attributes, the abnormal probability value of its interaction attributes, and the abnormal probability value of its payment behavior attributes. 3. The method as described in claim 1, characterized in that, the step of establishing an abnormal transfer detection model for the sender based on historical positive and negative transfer transaction samples and the user relationship network using a machine learning algorithm includes: Correlation analysis was performed on the user relationship network's self-attributes, interaction attributes, and payment behavior attributes. The irrelevant attributes are removed from the user relationship network to obtain the corrected user relationship network; based on the positive and negative samples of the historical transfer transactions and the corrected user relationship network, an abnormal transfer detection model for the sender is established using a machine learning algorithm. 4. The method as described in claim 3, wherein the self-attribute includes at least one of the following: identity information indicators, education level indicators, occupational status indicators, family situation indicators, and social information indicators; The payment behavior attributes include at least one of the following: transfer frequency index, transfer time distribution index, transfer location distribution index, transfer amount distribution index, and transfer method proportion index; The interactive attributes include at least one of the following: friend frequency index, contact frequency index, and favorability index. 5. An abnormal transfer detection device, characterized in that it comprises: The acquisition unit is used to acquire transfer transaction information, which includes transferor information; The determining unit is used to determine an abnormal transfer detection model for the transferor based on the transferor information. The abnormal transfer detection model is obtained based on the social attributes and historical behavior attributes of the transferor. The calculation unit is used to input the transfer transaction information into the abnormal transfer detection model of the transferor to obtain the abnormal probability value of the transfer transaction information; The social attributes of the transferor include the transferor's own attributes and interaction attributes obtained from social networks; the historical behavioral attributes of the transferor include the transferor's payment behavior attributes. The determining unit is specifically used to determine the user relationship network of the transferor based on its own attributes, the interaction attributes, and the payment behavior attributes. Based on historical positive and negative transfer transaction samples and the user relationship network, an abnormal transfer detection model for the sender is established using machine learning algorithms. The user relationship network is obtained through multiple corrections, and the correction of the user relationship network includes both the training process of the abnormal transfer detection model and the process before training the abnormal transfer detection model. 6. The apparatus as claimed in claim 5, characterized in that, The calculation unit is specifically used to input the transfer transaction information into the abnormal transfer detection model of the transferor to obtain the abnormal probability values of the transfer transaction information's own attributes, interaction attributes, and payment behavior attributes. The abnormal probability value of the transfer transaction information is obtained based on the abnormal probability value of its own attributes, the abnormal probability value of its interaction attributes, and the abnormal probability value of its payment behavior attributes. 7. The apparatus as claimed in claim 5, characterized in that, The determining unit is further configured to perform correlation analysis on the user relationship network's self-attributes, interaction attributes, and payment behavior attributes. The irrelevant attributes are removed from the user relationship network to obtain the corrected user relationship network; based on the positive and negative samples of the historical transfer transactions and the corrected user relationship network, an abnormal transfer detection model for the sender is established using a machine learning algorithm. 8. The apparatus as described in claim 7, wherein the self-attribute includes at least one of the following: identity information indicators, education level indicators, occupational status indicators, family situation indicators, and social information indicators; The payment behavior attributes include at least one of the following: transfer frequency index, transfer time distribution index, transfer location distribution index, transfer amount distribution index, and transfer method proportion index; The interactive attributes include at least one of the following: friend frequency index, contact frequency index, and favorability index.