TW201824135A - Abnormal transfer detection method and device - Google Patents

Abstract

The embodiment of the invention relates to the field of Internet finance, and particularly to an abnormal transfer detection method and device for detecting transfer transactions and giving abnormity warning. The method comprises acquiring transfer transaction information including the information of a transfer-out party; determining an abnormal transfer detection model of the transfer-out party based on the information of the transfer-out party, wherein the abnormal transfer detection model is obtained based on the social attribute and the historical behavior attribute of the transfer-out party; and inputting the transfer transaction information into the abnormal transfer detection model of the transfer-out party to obtain the abnormal probability value of the transfer transaction information so that when a user initiates a transfer transaction, the transfer transaction of the user is detected and the abnormity warning is given.

Description

   Method and device for detecting abnormal transfer   

The invention belongs to the field of Internet finance, and more particularly, to a method and device for detecting abnormal transfers.

With the advent of the era of Internet finance and big data, users can realize non-cash transfer transactions through the Internet and other methods. Since the Internet is an open network, the online banking system also makes banks internal to the Internet. Internet is open. Therefore, how to ensure the security of non-cash transfer transactions is a crucial issue in the era of Internet finance and big data. It is related to the security of Internet finance as a whole, and it is also important for banks to consider the safety of user funds. problem.

In the existing abnormal transfer transaction detection technology, a commonly used method is to improve the user's security authentication mechanism when performing a transfer transaction. This method requires the user to perform a variety of verification operations or the client and server to report in the transaction report. The methods of verification in the text, but these methods will bring additional verification operations to users, increase the transaction delay of the transfer, reduce the customer experience, and make the transaction messages too complicated, increase the processing time on the server side; another method is through the user The establishment of a user relationship network to detect abnormal transfer transactions, but this method can only establish a relationship network when there is a historical transfer record between users. If there is no historical transfer record between users, it is more difficult to build a relationship network.

To sum up, the existing abnormal transfer transaction detection technology has a transfer transaction delay. If there is no historical transfer record between users, it is difficult to construct a user relationship network. Therefore, an effective method is needed to solve the above problems.

The embodiments of the present invention provide a method and device for detecting abnormal transfers, which are used to solve the problems that the transfer transaction is delayed in the prior art, and that if there is no historical transfer record between users, it is difficult to construct a relationship network.

An embodiment of the present invention provides a method for detecting abnormal transfers, including: acquiring transfer transaction information, the transfer transaction information including transferor information; and determining the transferor's abnormal transfer detection model based on the transferor information, and detecting abnormal transfers The model is obtained according to the social attributes of the transferor and the historical behavior attributes of the transferor. The transfer transaction information is input to the transferor's abnormal transfer detection model to obtain the abnormal probability value of the transfer transaction information.

Optionally, the social attributes of the transferring party include the attributes of the transferring party and the interaction attributes obtained from the social network; the historical behavior attributes of the transferring party include the payment behavior attributes of the transferring party; the abnormal transfer detection model is based on the transferring The social attributes of the sending party and the historical behavior attributes of the transferring party are obtained, including: determining the user relationship network of the transferring party according to its own attributes, interaction attributes, and payment behavior attributes; according to the positive and negative samples of historical transfer transactions and the user relationship network, through the machine The learning algorithm is used to establish the abnormal transfer detection model of the transferor.

Optionally, entering the transfer transaction information into the abnormal transfer detection model of the transfer party to obtain the abnormal probability value of the transfer transaction information includes: entering the transfer transaction information into the abnormal transfer detection model of the transfer party to obtain the transfer transaction information. Self attribute abnormal probability value, interaction attribute abnormal probability value and payment behavior attribute abnormal probability value; according to self attribute abnormal probability value, interaction attribute abnormal probability value and payment behavior attribute abnormal probability value, get the abnormal probability value of the transfer transaction information.

Optionally, according to the positive and negative samples of historical transfer transactions and the user relationship network, an abnormal transfer detection model of the transferor is established through a machine learning algorithm, which includes: self-attribution, interaction attributes, and payment behavior attributes in the user relationship network Perform correlation analysis; delete non-relevant attributes from the user relationship network to obtain a revised user relationship network; based on the positive and negative samples of historical transfer transactions and the modified user relationship network, establish a transfer party through a machine learning algorithm Abnormal transfer detection model.

Optionally, its own attributes include one or more of the following indicators: identity information indicators, education level indicators, occupation status indicators, family status indicators, social information indicators; payment behavior attributes include one or more of the following indicators: transfer frequency indicator , Transfer time distribution indicator, transfer location distribution indicator, transfer amount distribution indicator, transfer method proportion indicator; interaction attributes include one or more of the following indicators: friend frequency indicator, contact frequency indicator, favorability indicator.

An embodiment of the present invention further provides an abnormal transfer detection device, including: an obtaining unit for obtaining transfer transaction information, the transfer transaction information including transfer party information; and a determining unit for determining the transfer party based on the transfer party information The abnormal transfer detection model is obtained according to the social attributes of the transferring party and the historical behavior attributes of the transferring party; a calculation unit is used to input the transfer transaction information into the abnormal transferring detection model of the transferring party to obtain Abnormal probability value of transfer transaction information.

Optionally, the social attributes of the transferring party include the attributes of the transferring party and the interaction attributes obtained from the social network; the historical behavior attributes of the transferring party include the payment behavior attributes of the transferring party; the determining unit is specifically configured to: Self attributes, interaction attributes, and payment behavior attributes determine the user relationship network of the transferee; based on the historical transfer transaction positive and negative samples and the user relationship network, an abnormal transfer detection model of the transferee is established through a machine learning algorithm.

Optionally, the calculation unit is specifically configured to input the transfer transaction information into the abnormal transfer detection model of the transfer party, and obtain the abnormal attribute probability value of the transfer transaction information itself, the interactive attribute abnormal probability value, and the payment behavior attribute abnormal probability value; according to The abnormal probability value of its own attribute, the abnormal probability value of the interaction attribute, and the abnormal probability value of the payment behavior attribute are used to obtain the abnormal probability value of the transaction information.

Optionally, the determining unit is further configured to: perform correlation analysis on self attributes, interaction attributes, and payment behavior attributes in the user relationship network; delete non-relevant attributes from the user relationship network to obtain a modified user Relationship network: According to the positive and negative samples of historical transfer transactions and the revised user relationship network, an abnormal transfer detection model of the transferor is established through a machine learning algorithm.

Optionally, its own attributes include one or more of the following indicators: identity information indicators, education level indicators, occupation status indicators, family status indicators, social information indicators; payment behavior attributes include one or more of the following indicators: transfer frequency indicator , Transfer time distribution indicator, transfer location distribution indicator, transfer amount distribution indicator, transfer method proportion indicator; interaction attributes include one or more of the following indicators: friend frequency indicator, contact frequency indicator, favorability indicator.

An embodiment of the present invention provides a computer-readable storage medium. The computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to cause the computer to execute the method according to any one of the foregoing.

An embodiment of the present invention provides a computing device including a memory for storing program instructions, and a processor for calling program instructions stored in the memory and executing the method according to any one of the foregoing according to the obtained programs.

An embodiment of the present invention provides a computer program product that, when run on a computer, causes the computer to execute the method described in any one of the above.

In summary, the embodiments of the present invention provide a method and device for detecting abnormal transfers, where the method includes: acquiring transfer transaction information, the transfer transaction information includes transferor information; and determining the transferor's abnormality based on the transferor information Transfer detection model, abnormal transfer detection model is obtained according to the social attributes of the transferor and historical behavior attributes of the transferor; input the transfer transaction information into the transferor's abnormal transfer detection model to obtain the abnormal probability value of the transfer transaction information . In the embodiment of the present invention, the transfer transaction information is first obtained; then the abnormal transfer detection model of the transferor is determined according to the transfer transaction information, wherein the abnormal transfer detection model is based on the social attributes of the transferor and the historical behavior of the transferor The attribute is obtained, which is convenient for the abnormal transfer detection system to detect and identify the transfer transaction. Because the social attributes and historical behavior attributes are diversified, there is no need for the user to perform additional security verification operations, thereby reducing the delay of the transfer transaction. When there is no transfer record, it is also possible to detect the presence of abnormal transfers through social attributes, thereby improving the coverage and accuracy of abnormal transfer detection; finally, entering the transfer transaction information into the transferor's abnormal transfer detection model to obtain the transfer transaction The abnormal probability value of the information can detect the user's transfer transaction and issue an abnormal warning.

S101-S103‧‧‧step

201‧‧‧ Acquisition Unit

202‧‧‧ Confirmation unit

203‧‧‧ Computing Unit

601‧‧‧Central Processing Unit

602‧‧‧Memory

603‧‧‧ input device

604‧‧‧Output device

In order to explain the technical solutions in the embodiments of the present invention more clearly, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present invention. Those of ordinary skill in the art can also obtain other drawings according to these drawings without paying creative labor.

FIG. 1 is a schematic diagram of the overall architecture of an abnormal transfer detection system according to an embodiment of the present invention; FIG. 2 is a schematic flowchart of an abnormal transfer detection method according to an embodiment of the present invention; FIG. 3 is a schematic diagram of a comprehensive abnormal probability provided by an embodiment of the present invention 4 is a schematic diagram of a user relationship network according to an embodiment of the present invention; FIG. 5 is a schematic diagram of an abnormal transfer detection device provided by an embodiment of the present invention; and FIG. 6 is a schematic diagram of a computing device structure provided by an embodiment of the present invention.

In order to make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be described in further detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, not all the embodiments. . Based on the embodiments of the present invention, all other embodiments obtained by a person of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

In order to better understand this solution, an abnormal transfer detection system in the technical solution of the present invention is designed. The designed abnormal transfer detection system is described below. The overall architecture diagram of the abnormal transfer detection system is shown in Figure 1. :

FIG. 1 exemplarily illustrates the overall architecture of an abnormal transfer detection system according to an embodiment of the present invention. As shown in FIG. 1, it includes a data acquisition module, a database module, a user relationship network establishment module, and abnormal transfer. Detection model training module and abnormal transfer detection module. The database module includes its own attribute database, payment behavior attribute database, and interaction attribute database. The abnormal transfer detection model training module interfaces with the background transaction system. Then, the design idea of the overall structure of the abnormal transfer detection system is as follows: The data acquisition module collects the user's own attribute data, payment behavior attribute data and interaction attribute data, and stores them in their own attribute database and payment behavior attribute data, respectively. Database and interactive attribute database; the user relationship network creation module builds a three-dimensional user relationship network based on the data of its own attribute database, payment behavior attribute database, and interactive attribute database, of which the three dimensions are Refers to its own attribute dimension, payment behavior attribute dimension, and interaction attribute dimension; the abnormal transfer detection model training module obtains the user's historical transfer transaction positive and negative samples from the background transaction system, according to the user relationship network and the user's historical transfer transaction positive and negative samples The sample uses machine learning algorithms to establish an abnormal transfer detection model. The abnormal transfer detection model is used in the abnormal transfer detection module to detect and issue abnormal warnings when the user initiates a transfer transaction. In addition, the user's relationship network in the abnormal transfer detection system is not static. The self attribute data, payment behavior attribute data, and interaction attribute data collected by the abnormal transfer detection system change as the user's external relationship data changes. The test model is also updated periodically.

The overall structure of the designed abnormal transfer detection system has the following advantages: First, when a user initiates a transfer transaction, the diverse and large user relationship network contains a large amount of information of the user, so no additional security is required for the user The verification operation reduces the delay of the transfer transaction. Second, when there is no transfer record between users, a user relationship network can also be established through the user's own attribute data and interactive attribute data, which solves the problem of In the history of historical transfer records, it is more difficult to construct a user relationship network. Third, an abnormal transfer detection model is established by using a diverse and large user relationship network and the positive and negative samples of the user's historical transfer transactions, and this model is used for The abnormal transfer detection module improves the coverage and accuracy of abnormal transfer detection.

FIG. 2 exemplarily illustrates a schematic flowchart of an abnormal transfer detection method according to an embodiment of the present invention. As shown in FIG. 2, the method includes the following steps: Step S101: acquiring transfer transaction information, and the transfer transaction information includes transfer out Step S102: Determine the transferor's abnormal transfer detection model based on the transferor's information. The abnormal transfer detection model is obtained based on the social attributes of the transferor and the historical behavior attributes of the transferor. Step S103: Transfer the account. The transaction information is input to the abnormal transfer detection model of the transferor to obtain the abnormal probability value of the transaction information.

In the above embodiment, specifically, when a user initiates a transfer transaction, the abnormal transfer detection module in the system analyzes the originating user A and the receiving user B of the transfer transaction, and obtains the transfer of the originating user A and the receiving user B. Transaction information; the transfer transaction information of the originating user A and the receiving user B is input into the abnormal transfer detection model to obtain the abnormal probability value of the transfer transaction information. Among them, in specific implementation, after the transfer transaction information of the originating user A and the receiving user B is input into the abnormal transfer detection model, a machine learning algorithm can be used to obtain the abnormal probability value of the transfer transaction information. After the abnormal probability value of the transfer transaction information is obtained, the user's transfer transaction can be detected and an abnormal warning can be issued. The abnormal transfer detection model is obtained based on the social attributes of the transferring party and the historical behavior attributes of the transferring party. It is convenient for the abnormal transfer detection system to detect and identify the transfer transaction. Because the social attributes and historical behavior attributes are diverse, there is no need for users. Perform additional security verification operations to reduce the delay of transfer transactions. At the same time, when there is no transfer record between users, the social property can also detect the existence of abnormal transfers, thereby improving the coverage and accuracy of abnormal transfer detection.

Among them, the abnormal transfer detection model can be obtained in the following three ways:

Method 1: The abnormal transfer detection model is obtained according to the social attributes of the transferring party and the historical behavior attributes of the transferring party; specifically, the social attributes of the transferring party and the historical behavior attributes of the transferring party are used as the abnormal transfer detection model Input, use machine learning algorithms to implement the training of abnormal transfer detection models. After multiple trainings, the abnormal transfer detection model is finally trained.

Method 2: Optionally, the social attributes of the transferring party include the attributes of the transferring party and the interaction attributes obtained from the social network; the historical behavior attributes of the transferring party include the payment behavior attributes of the transferring party; abnormal transfer detection The model is obtained based on the social attributes of the transferring party and the historical behavior attributes of the transferring party, including: determining the user relationship network of the transferring party according to its own attributes, interaction attributes, and payment behavior attributes; according to the positive and negative samples of the historical transfer transaction and the user relationship network , By using a machine learning algorithm to establish a transferer ’s abnormal transfer detection model; specifically, first determine the transferor ’s user relationship network based on its own attributes, interaction attributes, and payment behavior attributes; then use historical transfer transactions as positive and negative samples and use The person relationship network is used as the input of the abnormal transfer detection model, and machine learning algorithms are used to train the abnormal transfer detection model. After multiple trainings, the abnormal transfer detection model is finally trained.

Method 3: Optionally, based on the positive and negative samples of historical transfer transactions and the user relationship network, an abnormal transfer detection model of the transferor is established through a machine learning algorithm, which includes: the user's own network, interaction properties, and Correlation analysis of payment behavior attributes; delete non-relevant attributes from the user relationship network to obtain a modified user relationship network; based on the positive and negative samples of historical transfer transactions and the modified user relationship network, establish it through machine learning algorithms Abnormal transfer detection model of the sender. In specific implementation, the user attribute network's own attributes, interaction attributes, and payment behavior attributes each contain a lot of information or indicators. Assuming that the self attributes, interaction attributes, and payment behavior attributes contain a total of 10,000 indicators, first of all, these 10,000 indicators Perform correlation analysis or data cleaning and screening. For example, if indicator 1 and indicator 2 show a linear relationship, then you can keep one of indicator 1 and indicator 2 and delete the other indicator. Assuming that the 10,000 indicators have undergone correlation analysis or After the data was cleaned and screened, 1,000 indicators were finally retained; then, a revised user relationship network was obtained based on the 1,000 indicators, and the positive and negative samples of historical transfer transactions and the revised user relationship network were used as the input and application of the abnormal transfer detection model. Machine learning algorithms train abnormal transfer detection models. During the training process, you can combine the positive and negative samples of historical transfer transactions to perform index correlation analysis to modify the user relationship network again. For example, some of the 1,000 indicators also have historical transfer transactions. Positive and negative samples have no effect on the finger Can be deleted, assuming that 500 out of 1000 indicators have no effect on the positive and negative samples of historical transfer transactions, then a re-modified user relationship network containing 500 indicators will be obtained, and the revised user relationship network and Positive and negative samples of historical transfer transactions are used as input to the abnormal transfer detection model and machine learning algorithms are used to train the abnormal transfer detection model. Finally, abnormal transfer detection models are trained. Among them, positive and negative samples of historical transfer transactions are detected through abnormal transfer. The abnormal transfer detection model training module in the system is connected to the background transaction system. The positive and negative samples of historical transfer transactions include the user's normal transfer transaction records and abnormal transfer transaction records. Among them, the first point that needs to be explained is that the user relationship network was revised twice. The user relationship network that was revised again may be performed during the training of the abnormal transfer detection model, or it may be detected during the abnormal transfer detection. The training of the model is performed before, for example, the 1,000 indicators in the user relationship network that is revised again are combined with the positive and negative samples of historical transfer transactions to perform correlation analysis or data cleaning and screening. Finally, 500 indicators are screened out, and 500 indicators will be included again. The modified user relationship network and historical transfer transaction positive and negative samples are used as input to the abnormal transfer detection model, and machine learning algorithms are used to train the abnormal transfer detection model. The second point that needs to be explained is: in the specific implementation, the The form of the record is entered into the abnormal transfer detection model. For example, record 1 is: the transfer time is 8 am, the transfer amount is 8000, the transfer location is Shanghai, the transfer method is credit card, the relationship with the transfer recipient user is a colleague, The transfer transaction is a positive sample; the third point that needs to be explained is: In specific implementation, if you use The positive and negative samples of the user's historical transfer transaction are all positive samples, so the number of historical transfer transaction records of the user can be reduced. If the positive and negative samples of the user's historical transfer transaction are much larger than the number of positive samples, then the number can be increased. Extract the number of historical transfer transactions for this user.

Through the above three methods for determining the abnormal transfer detection model, it can be seen that the method for determining the abnormal transfer detection model has the characteristics of diversification and flexibility; two amendments to the user relationship network are actually a user relationship network Data reduction was performed twice, which can reduce the calculation volume and pressure of the system, and it can also be clear which indicators can have an effect on the transfer transaction.

Optionally, entering the transfer transaction information into the abnormal transfer detection model of the transfer party to obtain the abnormal probability value of the transfer transaction information includes: entering the transfer transaction information into the abnormal transfer detection model of the transfer party to obtain the transfer transaction information. Self attribute abnormal probability value, interaction attribute abnormal probability value and payment behavior attribute abnormal probability value; according to self attribute abnormal probability value, interaction attribute abnormal probability value and payment behavior attribute abnormal probability value, get the abnormal probability value of the transfer transaction information. Specifically, suppose that user A transfers to user B. The abnormal transfer detection module in the abnormal transfer detection system analyzes user A and user B to obtain their indicators, and enters the indicators into the abnormal transfer detection model. Three abnormal probability values are obtained, which are their own attribute abnormal probability values, interactive attribute abnormal probability values, and payment behavior attribute abnormal probability values. Assuming 0.3, 0.5, and 0.2, respectively, the three abnormal probability values are appropriately applied. The weight is the sum of the abnormal probability values after the weighting is applied to generate the comprehensive abnormal probability of the transfer transaction as an abnormal transfer transaction. Assuming the comprehensive abnormal probability is 0.25, the comprehensive abnormal probability indicates that the current transfer transaction is an abnormal risk value. If the comprehensive abnormal probability is very large, the system directly issues an abnormal warning. FIG. 3 exemplarily shows a possible comprehensive abnormal probability.

Optionally, its own attributes include one or more of the following indicators: identity information indicators, education level indicators, occupation status indicators, family status indicators, social information indicators; in specific implementation, the identity information indicators may also include identity cards, passports, Gender, age, mobile phone number, and other information that characterize the identity of the user; education level indicators indicate the user's cultural level; occupational status indicators reflect whether the user has a fixed legitimate occupation and the frequency of job changes; family status indicators include marriage and children, etc .; social information The indicators include social insurance, medical insurance remittance, and social credit. Social credit can be overdue due to bank cards or overdue debts due to public utilities. The abnormal transfer detection system draws a picture of the basic situation of the user based on its own attribute information. For example, if the user does not have a fixed occupation, incomplete or fraudulent identity information, poor social information, and so on, but the transaction amount of the transfer is relatively large, no matter as the originating user or the receiving user of the transfer transaction, The probability of abnormality is relatively high, such as the transfer may be money laundering or telecommunications fraud.

The payment behavior attributes include one or more of the following indicators: transfer frequency index, transfer time distribution index, transfer location distribution index, transfer amount distribution index, and transfer method percentage index; in specific implementation, the data of the payment behavior attribute is mainly from the bank itself Obtained by channels, card organizations, third-party payment institutions, etc. The data of payment behavior attributes include historical transfer records, historical consumption details, and so on. The historical transfer records are based on but not limited to key information such as the transfer object, the amount of the transfer, the transfer time, the transfer location, and the transfer method. Among them, the transfer object includes the account and card number, etc., the transfer object, the transfer amount, the transfer time, the transfer location, The transfer method is used to statistically analyze the distribution of the transfer objects and the corresponding transfer frequency, the user's transfer amount distribution, the transfer time and location distribution, and the proportion of transfer methods. In the analysis of transfer objects, sort the objects according to the frequency of transfers; in the transfer amount, transfer time, and distribution of transfer locations, you can analyze the user's transfer amount interval and the fluctuation trend over time, such as the regularity of user transfers The distribution and the fluctuations are gentle, but the current transfer amount suddenly increases, and the transfer time is also outside the distribution, the probability of abnormal transfers is high; analysis of the proportion of users' historical transfer methods shows that users are more inclined to traditional channels, such as ATMs, bank counters, or innovative channels such as computer terminals and mobile terminals carry out transfer transactions. If users often carry out transfer transactions through traditional channels, and current transfers take place through mobile terminals, this indicator increases the weight of judgment on the probability of abnormal transfers. In addition, in the user's historical transfer transaction data, the user's consumption power index and transaction channel are analyzed from the user's historical transfer transaction and consumption records from consumption frequency, consumption amount, consumption method and other information. The consumption power index indicates the consumption level of the user, and reflects the user's spending power and purchasing power, that is, large or small consumption often occurs. Consumption methods indicate that the user is more inclined to traditional payment methods such as POS card swiping or innovative payment methods such as cloud flash payment and QR code scanning payment, which reflects the user's enthusiasm for mobile innovative payment.

The interaction attribute includes one or more of the following indicators: a friend frequency indicator, a contact frequency indicator, and a favorability indicator. In the specific implementation of the present invention, in addition to establishing a payment behavior attribute relationship network between users, a user interaction attribute relationship network is also established. In this way, even if the two parties making the transfer have no historical transfer records, they can judge each other's Strong or weak relationship. In the interactive attribute, the data includes WeChat, QQ, Weibo, email, telecommunications operators such as SMS or call, online games, and even gambling information, etc., each user will build a complex interactive attribute relationship network. In the interactive attribute relationship network, the main indicators are a series of indicators that can reflect the closeness of the user to other users, such as friend frequency, contact frequency, and favorability. The friend frequency index reflects the closeness of the friend relationship between users. For example, if both users are friend relationships in various types of social software such as WeChat and qq, the friend frequency between the users is higher. The contact frequency indicator reflects the level of contact frequency between users, and mainly obtains the frequency of contact between users from communication-type social data. The favorability index reflects the positive or negative relationship between users. Natural language analysis technology can be used to segment words, word frequency statistics, good and bad word analysis of user chat communication content, etc., to obtain the favorability among users. In addition to social network applications, data such as online games and gambling can also reflect the user's complex relationship network. For example, in online games, the relationship between players in the same team can further complement the interaction attribute relationship network.

Since the user relationship network is determined based on its own attributes, interaction attributes, and payment behavior attributes, then based on the above specific description of the self attributes, interaction attributes, and payment behavior attributes, the following introduces the attributes based on self attributes, interaction attributes, and payment behavior. The specific process of establishing a user relationship network includes three processes:

Self attributes, interaction attributes, and payment behavior attributes can be considered as three dimensions of the user relationship network. 1. Scoring information in self attributes, interaction attributes, and payment behavior attributes: In the self attribute dimension, the user's identity Information indicators, education level indicators, occupation status indicators, family status indicators, social information indicators are judged and scored separately. If the identity information of the users on both sides of the transfer transaction is complete and true, the occupation is stable, and the social information is good, obviously the transfer transaction will be reduced. The probability of abnormality can lower the scores of the user's identity information indicators, occupation status indicators, social information indicators; in the interaction attribute dimension, by judging the friend frequency indicator, contact frequency indicator, favorability index and so on Scoring, friend frequency indicator, contact frequency indicator, and favorability indicator can intuitively reflect whether there is social relationship between users, closeness of connection, and positive or negative affection between users. For example, user A's friend User B applies to user A for a transfer Requirements, but in the interaction attribute dimension It is found that users A and B have a low frequency of friends, little contact, and no favorability, indicating that the social interaction attributes of users A and B are relatively weak, and user B is likely to be stolen, so at this time, the interaction attributes Friends ’frequency indicators, contact frequency indicators, and favorability indicators have higher scores; in the dimension of payment behavior attributes, in-depth mining and analysis of all transfer transactions and consumption records of users, to obtain the sparse relationship of user transfer objects , Analyze user transfer transactions or consumption habits, and portray their payment portraits. Historical transfer transactions, consumption, and other behaviors between the originating user and the receiving user of the current transfer transaction are frequent, and the transfer amount is stable and meets the user's spending power level. The probability of the current transfer transaction being abnormal is relatively low, and the payment behavior The information in the attribute dimension can score a lower score; on the contrary, the transfer originating user does not have a transfer transaction with the receiving user, and the payment recipient's payment relationship is complex and irregular, and the current transfer amount is relative to the spending power of the transfer originating user For serious discrepancies, there is a greater probability of abnormal transfers. For example, the user who initiates the transfer may suffer from telecommunications fraud. At this time, a higher score can be given to the information in the dimension of the payment behavior attributes; 2. The attributes of its own attributes, interaction attributes, and payment behavior The scores generated by the information in the information generate various weight values; 3. The transfer user is the central node, and each weight value is an edge to form a user relationship network diagram. FIG. 4 exemplarily shows a possible user relationship network.

It can be seen from the above that: an embodiment of the present invention provides a method for detecting abnormal transfers, which acquires transfer transaction information, and the transfer transaction information includes transferor information; according to the transferor information, the abnormal transfer detection of the transferor is determined The test model and abnormal transfer detection model are obtained according to the social attributes of the transferring party and the historical behavior attributes of the transferring party; the transfer transaction information is input to the abnormal transfer detection model of the transferring party to obtain the abnormal probability value of the transfer transaction information. In the embodiment of the present invention, the transfer transaction information is first obtained; then the abnormal transfer detection model of the transferor is determined according to the transfer transaction information, wherein the abnormal transfer detection model is based on the social attributes of the transferor and the historical behavior of the transferor The attributes are obtained, which is convenient for the system to detect and identify the transfer transaction. Because the social attributes and historical behavior attributes are diversified, there is no need for users to perform additional security verification operations, thereby reducing the delay of transfer transactions, and when there is no transfer record between users It can also detect the existence of abnormal transfers, which improves the coverage and accuracy of abnormal transfer detection. Finally, the transfer transaction information is entered into the transferor's abnormal transfer detection model, and the abnormal probability value of the transfer transaction information can be obtained. Detect and issue abnormal warnings on user's transfer transactions.

Based on the same concept, an abnormal transfer detection device provided by an embodiment of the present invention. FIG. 5 exemplarily shows an abnormal transfer detection device provided by an embodiment of the present invention. As shown in FIG. 5, the device includes an obtaining unit 201, The determination unit 202 and the calculation unit 203. Wherein: the obtaining unit 201 is used for obtaining the transfer transaction information, and the transfer transaction information includes the transfer party information; the determination unit 202 is used for determining the transfer party's abnormal transfer detection model and abnormal transfer detection based on the transfer party information The model is obtained according to the social attributes of the transferring party and the historical behavior attributes of the transferring party. The calculation unit 203 is used to input the transfer transaction information into the abnormal transfer detection model of the transferring party to obtain the abnormal probability value of the transfer transaction information.

Optionally, the social attributes of the transferring party include the attributes of the transferring party and the interaction attributes obtained from the social network; the historical behavior attributes of the transferring party include the payment behavior attributes of the transferring party; the determining unit 202 is specifically configured to: The user relationship network of the transferee is determined according to its own attributes, interaction attributes, and payment behavior attributes; based on the historical transfer transaction positive and negative samples and the user relationship network, an abnormal transfer detection model of the transferor is established through a machine learning algorithm.

Optionally, the calculation unit 203 is specifically configured to input the transfer transaction information into the abnormal transfer detection model of the transfer party, and obtain the abnormal attribute probability value of the transfer transaction information itself, the interactive attribute abnormal probability value, and the payment behavior attribute abnormal probability value; According to the abnormal probability value of its own attribute, the abnormal probability value of the interaction attribute, and the abnormal probability value of the payment behavior attribute, the abnormal probability value of the transfer transaction information is obtained.

Optionally, the determining unit 202 is further specifically configured to: perform correlation analysis on self attributes, interaction attributes, and payment behavior attributes in the user relationship network; delete non-relevant attributes from the user relationship network, and obtain a modified User relationship network; According to the positive and negative samples of historical transfer transactions and the revised user relationship network, an abnormal transfer detection model of the transferor is established through a machine learning algorithm.

Optionally, its own attributes include one or more of the following indicators: identity information indicators, education level indicators, occupation status indicators, family status indicators, social information indicators; payment behavior attributes include one or more of the following indicators: transfer frequency indicator , Transfer time distribution indicator, transfer location distribution indicator, transfer amount distribution indicator, transfer method proportion indicator; interaction attributes include one or more of the following indicators: friend frequency indicator, contact frequency indicator, favorability indicator.

It can be seen from the foregoing that an embodiment of the present invention provides an abnormal transfer detection device. The device includes an obtaining unit for obtaining transfer transaction information, wherein the transfer transaction information includes transfer party information; The information of the exporter determines the determination unit of the abnormal transfer detection model of the transferor, wherein the abnormal transfer detection model is obtained according to the social attributes of the transferor and the historical behavior attributes of the transferor; it is used to input the transfer transaction information into the transfer The abnormal transfer detection model of the exporter obtains a calculation unit of the abnormal probability value of the transfer transaction information. In the embodiment of the present invention, the transfer transaction information is first obtained; then the abnormal transfer detection model of the transferor is determined according to the transfer transaction information, wherein the abnormal transfer detection model is based on the social attributes of the transferor and the historical behavior of the transferor The attribute is obtained, which is convenient for the abnormal transfer detection system to detect and identify the transfer transaction. Because the social attributes and historical behavior attributes are diversified, there is no need for the user to perform additional security verification operations, thereby reducing the delay of the transfer transaction. When there is no transfer record, it is also possible to detect the presence of abnormal transfers through social attributes, thereby improving the coverage and accuracy of abnormal transfer detection; finally, entering the transfer transaction information into the transferor's abnormal transfer detection model to obtain the transfer transaction The abnormal probability value of the information can detect the user's transfer transaction and issue an abnormal warning.

Based on the same technical concept, an embodiment of the present invention further provides a computing device. The computing device may specifically be a desktop computer, a portable computer, a smart phone, a tablet computer, a personal digital assistant (PDA), and the like. As shown in FIG. 6, it is a schematic structural diagram of a computing device according to an embodiment of the present invention. The computing device may include a central processing unit 601 (Center Processing Unit, CPU), a memory 602, an input device 603, an output device 604, and the like. The device 603 may include a keyboard, a mouse, a touch screen, and the like, and the output device 604 may include a display device, such as a liquid crystal display (Liquid Crystal Display, LCD), a cathode ray tube (CRT), and the like.

The memory 602 may include a read-only memory (ROM) and a random access memory (RAM), and provide the processor with program instructions and data stored in the memory. In the embodiment of the present invention, the memory can be used to store the program of the method provided by any embodiment of the present invention. The processor executes the disclosure of any of the above embodiments according to the obtained program instruction by calling the program instruction stored in the memory. Methods.

Based on the same technical concept, an embodiment of the present invention further provides a computer-readable storage medium for storing computer program instructions for the above computing device, which includes a program for executing the method disclosed in any one of the above embodiments.

The computer storage medium can be any available medium or data storage device that the computer can access, including but not limited to magnetic memory (such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc.), optical memory (such as CDs) , DVD, BD, HVD, etc.), and semiconductor memory (such as ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid-state hard disk (SSD)) and so on.

Based on the same technical concept, an embodiment of the present invention further provides a computer program product, which, when run on a computer, causes the computer to execute the method disclosed in any one of the above embodiments.

Although the preferred embodiments of the present invention have been described, those skilled in the art can make other changes and modifications to these embodiments once they know the basic inventive concepts. Therefore, the scope of the appended patent applications is intended to be construed to include the preferred embodiments and all changes and modifications that fall within the scope of the invention.

Obviously, those skilled in the art can make various modifications and variations to the present invention without departing from the spirit and scope of the present invention. In this way, if these modifications and variations of the present invention fall within the scope of the patent application for the present invention and the scope of equivalent technologies, the present invention also intends to include these modifications and variations.

Claims (13)

    An abnormal transfer detection method, comprising: obtaining transfer transaction information, the transfer transaction information including transferor information; and determining the transferor's abnormal transfer detection model based on the transferor information, and the abnormal transfer The detection model is obtained according to the social attributes of the transferor and the historical behavior attributes of the transferor. The transfer transaction information is input to the transferor's abnormal transfer detection model to obtain the abnormal probability value of the transfer transaction information.         The abnormal transfer detection method according to claim 1, wherein the social attributes of the transferring party include its own attributes and the interaction attributes obtained from the social network; the historical behavior attributes of the transferring party include the transferring Outbound payment behavior attributes; the abnormal transfer detection model is obtained based on the outbound social attributes and the outbound historical behavior attributes, including: determining the transfer based on its own attributes, the interaction attributes, and the payment behavior attributes The user relationship network of the outgoing party; based on the positive and negative samples of historical transfer transactions and the user relationship network, an abnormal transfer detection model of the outgoing party is established through a machine learning algorithm.         The abnormal transfer detection method according to claim 2, wherein the transfer transaction information is input into the transfer transfer abnormal transfer detection model to obtain the abnormal probability value of the transfer transaction information, including: the transfer transaction information Enter the transferor's abnormal transfer detection model to get the own attribute abnormal probability value, interactive attribute abnormal probability value, and payment behavior attribute abnormal probability value of the transfer transaction information; according to the self attribute abnormal probability value and the interactive attribute abnormal probability value Value and the abnormal probability value of the payment behavior attribute to obtain the abnormal probability value of the transfer transaction information.         The abnormal transfer detection method according to claim 2, wherein, based on the positive and negative samples of historical transfer transactions and the user relationship network, the abnormal transfer detection model of the transferor is established through a machine learning algorithm, including: Perform correlation analysis on self attributes, interaction attributes, and payment behavior attributes in the user relationship network; delete unrelated attributes from the user relationship network to obtain a revised user relationship network; according to the historical transfer transaction positive and negative samples and the After the revised user relationship network, an abnormal transfer detection model of the transfer party is established through a machine learning algorithm.         The abnormal transfer detection method according to claim 4, wherein the self attribute includes one or more of the following indicators: an identity information indicator, an education level indicator, an occupation status indicator, a family status indicator, and a social information indicator; the payment behavior Attributes include one or more of the following indicators: transfer frequency indicator, transfer time distribution indicator, transfer location distribution indicator, transfer amount distribution indicator, transfer method proportion indicator; the interaction attribute includes at least one or more of the following indicators: friend frequency Indicators, contact frequency indicators, favorability indicators.         An abnormal transfer detection device, comprising: an obtaining unit for obtaining transfer transaction information, the transfer transaction information including transfer party information; and a determining unit for determining the transfer party based on the transfer party information Abnormal transfer detection model, which is obtained according to the social attributes of the transferor and historical behavior attributes of the transferor; a calculation unit for inputting the transfer transaction information into the transferor's abnormal transfer Detect the model to get the abnormal probability value of the transfer transaction information.         The abnormal transfer detection device according to claim 6, wherein the social attributes of the transferring party include its own attributes and the interaction attributes obtained from the social network; the historical behavior attributes of the transferring party include the transferring The payment behavior attribute of the sender; the determining unit is specifically configured to determine the user relationship network of the transfer party according to the self attribute, the interaction attribute, and the payment behavior attribute; according to the positive and negative samples of the historical transfer transaction and the user relationship network, An abnormal transfer detection model of the transferor is established by a machine learning algorithm.         The abnormal transfer detection device according to claim 7, wherein the calculation unit is specifically configured to input the transfer transaction information into the abnormal transfer detection model of the transfer party to obtain the abnormal probability value of the attribute of the transfer transaction information itself , The abnormal probability value of the interaction attribute and the abnormal probability value of the payment behavior attribute; and the abnormal probability value of the transfer transaction information is obtained according to the abnormal probability value of the own attribute, the abnormal probability value of the interactive attribute, and the abnormal probability value of the payment behavior attribute.         The abnormal transfer detection device according to claim 7, wherein the determining unit is further specifically configured to perform correlation analysis on self attributes, interaction attributes, and payment behavior attributes in the user relationship network; from the user relationship network Delete the non-correlation attribute in the system to obtain the revised user relationship network. Based on the positive and negative samples of the historical transfer transaction and the revised user relationship network, an abnormal transfer detection model of the transfer party is established through a machine learning algorithm.         The abnormal transfer detection device according to claim 9, wherein the self-attribute includes one or more of the following indicators: an identity information indicator, an education level indicator, an occupation status indicator, a family status indicator, and a social information indicator; the payment behavior Attributes include one or more of the following indicators: transfer frequency indicator, transfer time distribution indicator, transfer location distribution indicator, transfer amount distribution indicator, transfer method proportion indicator; the interaction attribute includes one or more of the following indicators: buddy frequency indicator , Contact frequency indicators, favorability indicators.         A computer-readable storage medium is characterized in that the computer-readable storage medium stores computer-executable instructions for causing the computer to execute the method according to any one of claims 1 to 5.         A computing device, comprising: a memory for storing program instructions; a processor for invoking program instructions stored in the memory, and executing according to the obtained program as in any one of claims 1 to 5 The method described.         A computer program product, characterized in that when the computer program product is run on a computer, the computer is caused to execute the method according to any one of claims 1 to 5.