TWI883938B - Abnormal transaction detection method and abnormal transaction detection device - Google Patents

Abstract

An abnormal transaction detection method is disclosed. The method includes the following operations: analyzing a risk event to obtain several feature values; obtaining several correlation coefficients between several feature values and several concept values to calculate several concept scores of the several concept values; obtaining several representative concept values with high correlation with the risk event based on several correlation scores; obtaining several risk weighting values and several frequency weights corresponding to several feature values based on several feature values and several weight tables; calculating a risk score of the risk event based on several concept scores of the concept values, several risk weighting values, and several frequency weights; and determining the risk level of the risk event based on the risk score and updating the abnormal transaction detection database.

Description

Abnormal transaction detection method and abnormal transaction detection device

This case is about an abnormal transaction detection method and an abnormal transaction detection device, and in particular, about an abnormal transaction detection method and an abnormal transaction detection device for risk level monitoring.

Abnormal transaction detection, also known as anomaly detection or fraud detection, is a security technology used to identify and prevent unusual transactions or behavior patterns that may indicate fraud, vulnerabilities or internal errors. In the context of telecommunications services, this typically involves monitoring and analyzing users' payment behavior, calling patterns, Internet data usage, etc. to identify activities that deviate significantly from normal behavior patterns.

In abnormal transaction detection systems or telecommunications anti-fraud systems, the following pain points are often encountered: (i) Risk rules need to be manually defined, so omissions are inevitable. (ii) Risk rules have a set process, and the order can only be adjusted by manually defining risk levels. (iii) There is no good offline mechanism for old risk rules that are no longer used. Therefore, how to automatically calculate risk scores and automatically update risk rules is one of the problems to be solved in this field.

The content of the invention is intended to provide a simplified summary of the disclosure so that readers can have a basic understanding of the disclosure. This content of the invention is not a complete overview of the disclosure, and it is not intended to point out the important/key elements of the embodiments of the present case or to define the scope of the present case.

One technical aspect of the present case is about an abnormal transaction detection method, which is applicable to a device including an abnormal transaction detection database. The abnormal transaction detection database includes multiple feature categories, multiple concept values, multiple verification values, and multiple weight tables corresponding to the multiple concept values and the multiple feature categories. The abnormal transaction detection method includes the following steps: analyzing risk events to obtain multiple feature values, wherein each of the multiple feature values corresponds to one of the multiple feature categories; obtaining multiple correlation coefficients between the multiple feature values and the multiple concept values to calculate multiple correlation scores for the multiple concept values; sorting the multiple concept values according to the multiple correlation scores to obtain multiple representative concept values with a higher correlation with the risk event; and sorting the representative concept values according to the multiple correlation scores. According to the plurality of eigenvalues and the plurality of weight tables, a plurality of risk weighted values and a plurality of frequency weights corresponding to the plurality of eigenvalues are obtained, wherein the plurality of weight tables correspond to the plurality of concept values and the plurality of eigenclasses; the risk score of the risk event is calculated according to the plurality of concept scores representing the plurality of concept values, the plurality of risk weighted values and the plurality of frequency weights; and the risk degree of the risk event is determined according to the risk score and an abnormal transaction detection database is updated.

Another technical aspect of the present case is about an abnormal transaction detection device, which includes a memory and a processor. The memory stores an abnormal transaction detection database, wherein the abnormal transaction detection database includes multiple feature categories, multiple concept values, multiple verification values, and multiple weight tables corresponding to the multiple concept values and the multiple feature categories. The processor is coupled to the memory to execute: analyzing risk events to obtain multiple feature values, wherein each of the multiple feature values corresponds to one of the multiple feature categories; obtaining multiple correlation coefficients between the multiple feature values and the multiple concept values to calculate multiple correlation scores for the multiple concept values; sorting the multiple concept values according to the multiple correlation scores to obtain multiple representative concept values with a higher correlation with the risk event; and sorting the multiple concept values according to the multiple correlation scores. A plurality of eigenvalues and a plurality of weight tables are used to obtain a plurality of risk weighted values and a plurality of frequency weights corresponding to the plurality of eigenvalues, wherein the plurality of weight tables correspond to the plurality of concept values and the plurality of eigenclasses; a risk score of the risk event is calculated based on a plurality of concept scores representing the plurality of concept values, the plurality of risk weighted values, and the plurality of frequency weights; and a risk level of the risk event is determined based on the risk score and an abnormal transaction detection database is updated.

After reading the implementation method below, a person with ordinary knowledge in the technical field to which this case belongs can easily understand the basic spirit and other invention purposes of this case, as well as the technical means and implementation methods adopted in this case.

In order to make the description of the disclosure more detailed and complete, the following provides an illustrative description of the implementation and specific embodiments of the present invention; however, this is not the only form of implementing or using the specific embodiments of the present invention. The implementation covers the features of multiple specific embodiments and the method steps and their sequence for constructing and operating these specific embodiments. However, other specific embodiments may also be used to achieve the same or equivalent functions and step sequences.

Unless otherwise defined in this specification, the scientific and technical terms used herein have the same meanings as those understood and used by persons of ordinary skill in the art to which this case belongs. In addition, singular terms used in this specification include the plural form of the terms, and plural terms also include the singular form of the terms, unless otherwise conflicting with the context.

In addition, the term “coupled” or “connected” as used herein may refer to two or more elements being in direct physical or electrical contact with each other, or being in indirect physical or electrical contact with each other, or may refer to two or more elements operating or moving with each other.

In this document, the term "device" refers to an object that is composed of one or more transistors and/or one or more active and passive components connected in a certain way to process signals.

Certain terms are used in the specification and patent application to refer to specific components. However, a person with ordinary knowledge in the art should understand that the same component may be referred to by different terms. The specification and patent application do not distinguish components by differences in name, but by differences in function. The term "including" mentioned in the specification and patent application is an open term and should be interpreted as "including but not limited to".

FIG. 1 is a block diagram of an abnormal transaction detection device 100 according to some embodiments of the present invention. As shown in FIG. 1 , in some embodiments, the abnormal transaction detection device 100 includes a memory 110 and a processor 130. The memory 110 is coupled to the processor 130.

As shown in FIG. 1 , in some embodiments, the processor 130 includes an event detection module 131 , a risk analysis module 133 , a risk alarm module 135 , a feedback module 137 , and an optimization module 139 .

In terms of connection relationship, the risk analysis module 133 is coupled to the event detection module 131, the risk alarm module 135 is coupled to the risk analysis module 133, the feedback module 137 is coupled to the risk alarm module 135, and the optimization module 139 is coupled to the risk analysis module 133 and the feedback module 137.

In some embodiments, the abnormal transaction detection device 100 further includes an input/output device (not shown) coupled to the processor 130. The input/output device may be a circuit or component with data transmission and reception or similar functions, such as a keyboard, a speaker, a communication circuit, a screen, or other circuits or components with similar functions.

The coupling mentioned above may be an electrical coupling or a communication coupling. The communication coupling generally refers to a wired connection through a physical wire, for example, a connection through a wired network, or a wireless connection through a wireless connection medium, but the present disclosure is not limited thereto.

The detailed operation method of the abnormal transaction detection device 100 in FIG. 1 will be described below together with FIG. 2 .

FIG. 2 is a flowchart of an abnormal transaction detection method 200 according to some embodiments of the present invention. The abnormal transaction detection method 200 can be applied to the abnormal transaction detection device 100 in FIG. 1 or a system having the same or similar structure as the abnormal transaction detection device 100. In order to simplify the description, the following description of the operation method will be performed using FIG. 1 as an example, but the present invention is not limited to the application of FIG. 1.

It should be noted that in some embodiments, the abnormal transaction detection method 200 can also be implemented as a computer program or instruction and stored in the memory 110 as shown in FIG. 1, so that the processor 130 in the abnormal transaction detection device 100 as shown in FIG. 1 reads the computer program or instruction and executes the operation method. The processor 130 can be composed of one or more chips. The memory 110 can be a read-only memory, a flash memory, a floppy disk, a hard disk, an optical disk, a flash disk, a magnetic tape, a database accessible by a network, or a non-transient computer-readable recording medium with the same function that can be easily thought of by those familiar with the art.

In addition, it should be understood that the operations of the abnormal transaction detection method 200 mentioned in this embodiment, except for those specifically described in sequence, can be adjusted in sequence according to actual needs, and can even be executed simultaneously or partially simultaneously.

Furthermore, in different embodiments, these operations may be adaptively added, replaced, and/or omitted.

In some embodiments, the memory 110 in FIG. 1 stores an abnormal transaction detection database, which includes multiple example feature values, multiple feature categories, multiple concept values, multiple verification values, and multiple weight tables corresponding to the multiple concept values and the multiple feature categories.

In some embodiments, the example feature values, concept values, and verification values in the abnormal transaction detection database are classified in a 5W1H manner. For example, the example feature values include A (Who), B (Where), C (When), and D (What). The concept value includes (Why). The verification value includes (How).

In some embodiments, the establishment of example feature values, concept values, and verification values in the abnormal transaction detection database is to utilize natural language processing (NLP) to parse behavior descriptions (e.g., behavior descriptions in risk events), using tools including ChatGPT (Chat Generation Pre-trained Transformer) under OpenAI (Open Artificial Intelligence Research Center) and LangChain framework (language model integration framework) to establish an AI (artificial intelligence) abnormal transaction detection database.

The detailed implementation of multiple example feature values, multiple feature categories, multiple concept values, multiple verification values, and multiple weight tables corresponding to the multiple concept values and multiple feature categories will be described below with reference to FIG. 2.

Please refer to FIG. 2 . The abnormal transaction detection method 200 shown in FIG. 2 includes steps S210 to S260 . In some embodiments, steps S210 to S260 are executed by the processor 130 in FIG. 1 .

In step S210 , the risk event is analyzed to obtain a plurality of feature values, wherein each of the plurality of feature values corresponds to one of a plurality of feature categories in the abnormal transaction detection database.

In some embodiments, the risk event is received by the abnormal transaction detection device 100 via the input and output device. In other embodiments, the risk event is obtained by the event detection module 131 in FIG. 1 using crawler technology for news or public cases.

In some embodiments, in step S210, the risk analysis module 133 in FIG. 1 obtains a plurality of keywords according to the risk event, and compares the plurality of keywords with a plurality of sample feature values in the abnormal transaction detection database to obtain a plurality of keywords in the keywords that are similar to the sample feature values as feature values of the risk event. Each feature value corresponds to one of the feature categories.

The following will be described using [Example A] and [Example B] as examples.

In [Example A], the risk event includes "Mr. Wang is 75 years old and lives with his 16-year-old grandson. A few days ago, he was found to have purchased online game points through DCB transactions at 3 a.m., and the transaction amount was 20,000 yuan." For the convenience of explanation, the risk event in [Example A] is hereinafter referred to as "Mr. Wang was suspected of being robbed of 20,000 yuan through DCB transactions." In step S210, the feature values and corresponding feature categories obtained by the risk analysis module 133 include the following: (feature value a1) male [gender], (feature value a3) 75 years old [age], (feature value a4) cohabiting relatives are second-degree relatives [family structure], (feature value a6) under 18 years old [age], (feature value b1) domestic transactions [transaction area], (feature value b2) DCB transactions [transaction method], (feature value c1) unpopular transaction time period [time], (feature value c2) non-national holidays [date], (feature value d1) purchase of online game points [purchase of goods], (feature value d2) single transaction ≧ 20,000 [amount]. The above-mentioned [gender], [age], [family structure], etc. are characteristic categories.

In [Example B], the risk event is abbreviated as "+886 165 is not anti-fraud". In step S210, the feature values and corresponding feature categories obtained by the risk analysis module 133 include the following: (feature value a13) e-commerce customer service staff [fraud suspect], (feature value a16) police [fraud suspect], (feature value a2) office workers [group], (feature value b4) suspected domestic [transaction area], (feature value c3) irregular time [time], (feature value d5) the caller is +886 phone [fraud suspect], (feature d7) gain trust [fraud suspect], (feature d8) request ATM operation [fraud suspect].

In step S220, multiple correlation coefficients between multiple feature values and multiple concept values in the abnormal transaction detection database are obtained to calculate multiple correlation scores of the multiple concept values. In some embodiments, step S220 is performed by the risk analysis module 133 in Figure 1. In some embodiments, the correlation coefficient is between -1 and 1. A correlation coefficient of 0 indicates no correlation, a correlation coefficient of 1 indicates a completely positive correlation, and a correlation coefficient of -1 indicates a completely negative correlation.

In one embodiment, the abnormal transaction detection database includes multiple concept values e1 to e8. Concept value e1 includes "the average DBC transaction amount of males over 65 years old in Taipei City is 3,000", concept value e2 includes "minors often use DCB transactions to purchase online game points", concept value e3 includes "high school students often have signs of staying up late", concept value e5 includes "fraud groups self-directed and staged +886 fraudulent calls to deceive the public", concept value e7 includes "communication content contains words that are easy to be deceived (such as: repeated deductions, ATM, system personnel negligence)", and concept value e8 includes "the caller can use VoIP technology to forge a phone number starting with +886". The quantity and content of the above-mentioned concept values are for illustrative purposes only, and the implementation of this case is not limited thereto.

The following will be explained using the risk event of "Mr. Wang was suspected of being robbed of 20,000 yuan through DCB transactions" in [Implementation Example A].

The risk analysis module 133 obtains the correlation coefficient between the concept value e1 and the characteristic value a1, the correlation coefficient between the concept value e1 and the characteristic value a3, the correlation coefficient between the concept value e1 and the characteristic value a4, the correlation coefficient between the concept value e1 and the characteristic value a6, the correlation coefficient between the concept value e1 and the characteristic value b1, the correlation coefficient between the concept value e1 and the characteristic value b2, the correlation coefficient between the concept value e1 and the characteristic value c1, the correlation coefficient between the concept value e1 and the characteristic value c2, the correlation coefficient between the concept value e1 and the characteristic value d1, and the correlation coefficient between the concept value e1 and the characteristic value d2. Next, the risk analysis module 133 adds up the multiple correlation coefficients between the above-mentioned concept value e1 and the multiple feature values of the risk event "Mr. Wang was suspected of being robbed of 20,000 yuan through DCB transactions" to calculate the correlation score between the multiple feature values of the risk event "Mr. Wang was suspected of being robbed of 20,000 yuan through DCB transactions" and the concept value e1.

Similarly, the risk analysis module 133 adds up the multiple correlation coefficients between the concept value e2 and the multiple feature values of the risk event "Mr. Wang was suspected of being robbed of 20,000 yuan through DCB transactions" to calculate the correlation score between the multiple feature values of the risk event "Mr. Wang was suspected of being robbed of 20,000 yuan through DCB transactions" and the concept value e2.

Similarly, the risk analysis module 133 adds the multiple correlation coefficients between the concept value e3 and the multiple eigenvalues of the risk event "Mr. Wang was suspected of being robbed of 20,000 yuan through DCB transactions" to calculate the correlation score between the multiple eigenvalues of the risk event "Mr. Wang was suspected of being robbed of 20,000 yuan through DCB transactions" and the concept value e3. Similarly, the risk analysis module 133 can calculate the correlation scores between the concept values e1 to e8 and the multiple eigenvalues.

In step S230, the multiple concept values are sorted according to the multiple correlation scores to obtain multiple representative concept values with higher correlation with the risk event. In some embodiments, after sorting, the risk analysis module 133 in FIG. 1 uses the first few (e.g., first three) concept values with the highest correlation scores as representative concept values. In some embodiments, after sorting, the risk analysis module 133 uses the concept values with correlation scores higher than the correlation score threshold as representative concept values.

The following will be explained using the risk events and multiple concept values e1 to e8 in [Implementation Example A] as an example. Assuming that in step S220, the three highest correlation scores between the concept values e1 to e8 and the risk events in Implementation Example A are calculated to be concept value e2, concept value e1, and concept value e3, the risk analysis module 133 uses concept value e2, concept value e1, and concept value e3 as representative concept values.

In step S240, a plurality of risk weighted values and a plurality of frequency weights corresponding to the plurality of feature values are obtained according to the plurality of feature values and the plurality of weight tables, wherein the plurality of weight tables correspond to the plurality of concept values and the plurality of feature categories.

Several weight tables are given as examples below. Table 1 is the weight table corresponding to the concept value e1 and the feature category [age].

Table 1 e1 Concept Score The characteristic interval corresponding to the characteristic category [age] Risk Weighted Value Frequency weight instruction 10 85 and above 1.5 1.2 Old age 10 66 to 84 1.5 1.5 Old age 10 65 1 1 Benchmark 10 26 to 64 0.25 1 generally 10 18 to 25 1 1 Adults but generally have no or low economic ability 10 0 to 17 1.2 1 Minors

In some embodiments, the weight table may correspond to multiple feature categories or to specific feature values. For example, Table 2 is a weight table corresponding to the concept value e1 and the feature category [amount] plus the feature category [transaction method] of DCB transaction. That is, the weight table in Table 2 is a weight table corresponding to the concept value e1 and the feature category [amount] when [transaction method] is DCB transaction.

Table 2 e1 Concept Score The characteristic interval corresponding to the characteristic category [amount] Risk Weighted Value Frequency weight instruction 10 20,000 to 30,000 2.5 1 10 10,000 to 20,000 2 1.5 10 3000 to 10000 1.5 1.2 10 1000 to 3000 1 1 Benchmark 10 Less than 1000 0.1 0.1

Please refer to FIG. 3 . FIG. 3 is a flow chart of step S240 in the abnormal transaction detection method 200 in FIG. 2 according to some embodiments of the present invention. As shown in FIG. 3 , step S240 includes step S242 and step S244 .

In step S242, it is determined that the first eigenvalue corresponds to the first feature interval among the plurality of feature intervals.

The following is an example of [Example A]. For [Embodiment A] (eigenvalue a3) 75 years old [age], the risk analysis module 133 obtains a weight table (such as the above Table 1) corresponding to the concept value e1 and the feature category [age]. Based on (eigenvalue a3) 75 years old, the risk analysis module 133 determines that the feature interval corresponding to the eigenvalue a3 is 66 to 84 years old.

In step S244, a first risk weighted value and a first frequency weight corresponding to the first characteristic interval are obtained.

The following is further explained using [Example A] as an example. In step S242, the risk analysis module 133 determines that the characteristic interval corresponding to the characteristic value a3 is 66 to 84 years old. Then, the risk analysis module 133 obtains the risk weighted value corresponding to the characteristic interval of 66 to 84 years old as 1.5 according to the above Table 1, and the frequency weight corresponding to the characteristic interval of 66 to 84 years old is 1.5.

As described above, step S242 and step S244 are only described by taking the concept value e1 and the characteristic value a3 in [Example A] as an example. The method of obtaining the risk weighted value and the frequency weight of the other concept values and characteristic values is similar to the implementation method of the concept value e1 and the characteristic value a3 in [Example A] described above.

In step S250, the risk score of the risk event is calculated based on a plurality of concept scores representing the concept values, a plurality of risk weighted values, and a plurality of frequency weights.

In some embodiments, in step S250, the risk analysis module 133 multiplies the concept score of the concept value with the risk weighted value and frequency weight obtained based on the concept value, feature value and feature category to obtain a sub-risk score, and then adds up the multiple sub-risk scores corresponding to each concept value and feature value to obtain the risk score corresponding to the risk event.

For example, [Example A] is used as an example for explanation. In some embodiments, the risk score corresponding to the risk event in [Example A] is calculated as follows: Risk score = Concept score of concept value e1 The risk weight corresponding to the concept value e1 and the eigenvalue a1 The frequency weight corresponding to the concept value e1 and the feature value a1 + the concept score of the concept value e1 The risk weight corresponding to the concept value e1 and the eigenvalue a3 The frequency weight corresponding to the concept value e1 and the eigenvalue a1 + ... the concept score of the concept value e1 The risk weight corresponding to the concept value e1 and the eigenvalue d2 The frequency weight corresponding to the concept value e1 and the feature value d2 + the concept score of the concept value e2 The risk weight corresponding to the concept value e2 and the eigenvalue a1 The frequency weight corresponding to the eigenvalue a1 + the concept score corresponding to the concept value e2 The risk weight corresponding to the concept value e2 and the eigenvalue a3 The frequency weight corresponding to the eigenvalue a1 + the concept score corresponding to the concept value e2 The risk weight corresponding to the concept value e2 and the eigenvalue d2 The frequency weight corresponding to the feature value d2 + the concept score of the concept value e3 The risk weight corresponding to the concept value e3 and the eigenvalue a1 The frequency weight corresponding to the eigenvalue a1 + the concept score corresponding to the concept value e3 The risk weight corresponding to the concept value e3 and the eigenvalue a3 The frequency weight corresponding to the eigenvalue a1 + the concept score corresponding to the concept value e3 The risk weight corresponding to the concept value e3 and the eigenvalue d2 The frequency weight corresponding to the eigenvalue d2

As described above, in step S250, by adding up the multiple sub-risk scores, the risk score of the risk event "Mr. Wang was suspected of being robbed of 20,000 yuan through DCB transactions" in [Example A] can be obtained.

In some embodiments, in steps S240 and S250, the risk analysis module 133 is executed only for the most critical feature category. In some embodiments, the risk analysis module 133 uses the feature category with a higher correlation coefficient with the concept value as the most critical feature category.

In step S260, the risk level of the risk event is determined based on the risk score and the abnormal transaction detection database is updated. In some embodiments, the risk alarm module 135 in FIG. 1 determines the risk level of the risk event based on the risk score calculated in step S250, and performs at least one of the verification values based on the risk level of the risk event. In some embodiments, when the risk score is higher than the risk score threshold, the risk alarm module 135 performs at least one of the verification values.

In some embodiments, based on the risk event, the risk alarm module 135 selects a verification value with a higher correlation with the risk event from the multiple verification values stored in the memory 110 to execute.

For example, let's take [Example A] as an example. According to the risk event "Mr. Wang was suspected of being robbed of 20,000 yuan through DCB transactions" in [Example A], the risk alarm module 135 executes the following verification values: (Verification value f1) Verification whether the transaction is made by the person himself and biometric authentication is used, (Verification value f2) Verification whether the transaction is authorized by the person himself and the credit card secondary card is used.

The above only describes in detail the method for calculating the risk score of the risk event in [Example A]. The method for calculating the risk score of the risk event in [Example B] is similar to the method for calculating the risk score of the risk event in [Example A] above.

In some embodiments, the risk alarm module 135 determines whether to notify the relevant units according to the risk score or risk level of the risk event. In some embodiments, after the relevant units (such as wind pipe personnel) receive the notification, the relevant units investigate the risk event and generate feedback information. In some embodiments, the feedback module 137 is used to receive the feedback information and transmit the feedback information to the optimization module 139, so that the optimization module 139 optimizes the abnormal transaction detection database according to the feedback information.

For example, in some embodiments, the feedback information received by the feedback module 137 includes whether the verification value is applicable. If the verification value is not applicable, the optimization module 139 reduces the correlation coefficient of the verification value.

In some embodiments, the optimization module 139 is further configured to determine whether the feature category, concept value, verification value, or example feature value in the abnormal transaction detection database is still valid at regular intervals and to update the abnormal transaction detection database.

In some embodiments, the optimization module 139 updates the abnormal transaction detection database according to the preset rules. For example, the 3G business license is valid until December 31, 2018, and loses its validity after the expiration. On January 1, 2019, the optimization module 139 reduces the correlation coefficient of the feature category, concept value, verification value or example feature value related to the 3G business license.

In some embodiments, the processor 130 in FIG. 1 may be a single processor or an integrated device of multiple microprocessors, such as a central processing unit (CPU), a graphics processing unit (GPU), or an application-specific integrated circuit (ASIC), a server, or other computing circuits or components with data access, data calculation, data storage, data transmission and reception, or similar functions. In addition, each functional module in the processor 130 may also be implemented with computing circuits or components with data access, data calculation, data storage, data transmission and reception, or similar functions.

From the above, it can be seen that the implementation method of this case provides an abnormal transaction detection method and an abnormal transaction detection device, which can automate the update and generation of risk rules, dynamic risk level adjustment and intelligent rule life cycle management. In detail, the implementation method of this case can automatically learn and update risk rules, which can reduce the possibility of human omissions. Automation not only improves the accuracy of detection, but also ensures that the system can respond to emerging fraud patterns and threats in a timely manner. In addition, by implementing algorithms and models, the adjustment of risk levels can become more flexible and real-time, and no longer rely on fixed, manually defined processes. This allows for faster identification and response to new or evolving threats, thereby increasing the system's adaptability and responsiveness. Furthermore, the implementation of this case can automatically identify and remove risk rules that are no longer valid or in use. This not only improves the efficiency and performance of the system, but also avoids false positives and missed positives caused by outdated or invalid rules.

Although the above implementation method discloses a specific implementation example of the present case, it is not intended to limit the present case. A person with ordinary knowledge in the technical field to which the present case belongs can make various changes and modifications without deviating from the principle and spirit of the present case. Therefore, the scope of protection of the present case shall be based on that defined by the scope of the attached patent application.

100: Abnormal transaction detection device 110: Memory 130: Processor 131: Event detection module 133: Risk analysis module 135: Risk alarm module 137: Feedback module 139: Optimization module 200: Abnormal transaction detection method S210, S220, S230, S240, S250, S260: Steps S242, S244: Steps

In order to make the above and other purposes, features, advantages and embodiments of the present invention more clearly understandable, the attached drawings are described as follows: Figure 1 is a block diagram of an abnormal transaction detection device according to some embodiments of the present invention. Figure 2 is a flow chart of the steps of an abnormal transaction detection method according to some embodiments of the present invention. Figure 3 is a flow chart of one step in the abnormal transaction detection method in Figure 2 according to some embodiments of the present invention.

Domestic storage information (please note in the order of storage institution, date, and number) None Foreign storage information (please note in the order of storage country, institution, date, and number) None

200: Abnormal transaction detection method

S210,S220,S230,S240,S250,S260: Steps

Claims (10)

An abnormal transaction detection method is applicable to a device including an abnormal transaction detection database, wherein the abnormal transaction detection database includes a plurality of feature categories, a plurality of concept values, a plurality of verification values, and a plurality of weight tables corresponding to the concept values and the feature categories, wherein the abnormal transaction detection method includes: Analyzing a risk event to obtain a plurality of feature values, wherein each of the feature values corresponds to one of the feature categories; Obtaining a plurality of correlation coefficients between the feature values and the concept values to calculate a plurality of correlation scores for the concept values; Sorting the concept values according to the correlation scores to obtain a plurality of representative concept values with a higher correlation with the risk event; According to the characteristic values and the weight tables, a plurality of risk weighted values and a plurality of frequency weights corresponding to the characteristic values are obtained, wherein the weight tables correspond to the concept values and the characteristic categories; According to the plurality of concept scores representing the concept values, the risk weighted values and the frequency weights, a risk score of the risk event is calculated; and According to the risk score, a risk level of the risk event is determined and the abnormal transaction detection database is updated. An abnormal transaction detection method as described in claim 1, wherein the feature values include a first feature value and a second feature value, wherein the concept values include a first concept value, and wherein calculating the correlation scores of the concept values includes: Obtaining a first correlation coefficient between the first concept value and the first feature value; Obtaining a second correlation coefficient between the first concept value and the second feature value; and Adding the first correlation coefficient and the second correlation coefficient to obtain a first correlation score for the first concept value. An abnormal transaction detection method as described in claim 1, wherein a first characteristic value among the characteristic values corresponds to a first characteristic category among the characteristic categories, wherein a first representative concept value among the representative concept values corresponds to the first characteristic category including a plurality of characteristic intervals, wherein obtaining the risk weighted values and the frequency weights corresponding to the characteristic values according to the characteristic values and the weight tables comprises: Determining that the first characteristic value corresponds to a first characteristic interval among the characteristic intervals; and Obtaining a first risk weighted value and a first frequency weight corresponding to the first characteristic interval. The abnormal transaction detection method as described in claim 3, wherein the risk score of the risk event is calculated based on the concept scores of the representative concept values, the risk weighted values and the frequency weights, including: Multiplying a first concept score of the first representative concept value, the first risk weighted value and the first frequency weight to obtain a first sub-risk score; Multiplying the first concept score of the first representative concept value, a second risk weighted value and a second frequency weight to obtain a second sub-risk score, wherein the second risk weighted value and the second frequency weight are obtained based on the first representative concept value, a second feature value and a second feature category; A second concept score of a second representative concept value, a third risk weighted value, and a third frequency weight are multiplied to obtain a third sub-risk score, wherein the third risk weighted value and the third frequency weight are obtained according to the second representative concept value, the first feature value, and the first feature category; A second concept score of the second representative concept value, a fourth risk weighted value, and a fourth frequency weight are multiplied to obtain a fourth sub-risk score, wherein the fourth risk weighted value and the fourth frequency weight are obtained according to the second representative concept value, the second feature value, and the second feature category; and The first sub-risk score, the second sub-risk score, the third sub-risk score, and the fourth sub-risk score are added to calculate the risk score. The abnormal transaction detection method as described in claim 1 further includes: When the risk score is higher than a risk score threshold, at least one of the verification values is executed according to the risk event. An abnormal transaction detection device comprises: A memory storing an abnormal transaction detection database, wherein the abnormal transaction detection database comprises a plurality of feature categories, a plurality of concept values, a plurality of verification values, and a plurality of weight tables corresponding to the concept values and the feature categories; and A processor coupled to the memory for executing: Analyzing a risk event to obtain a plurality of feature values, wherein each of the feature values corresponds to one of the feature categories; Obtaining a plurality of correlation coefficients between the feature values and the concept values to calculate a plurality of correlation scores for the concept values; Sorting the concept values according to the correlation scores to obtain a plurality of representative concept values with a higher correlation with the risk event; According to the feature values and the weight tables, obtaining a plurality of risk weighted values and a plurality of frequency weights corresponding to the feature values, wherein the weight tables correspond to the concept values and the feature categories; Calculating a risk score of the risk event according to the plurality of concept scores of the representative concept values, the risk weighted values and the frequency weights; and Determining a risk level of the risk event according to the risk score and updating the abnormal transaction detection database. An abnormal transaction detection device as described in claim 6, wherein the characteristic values include a first characteristic value and a second characteristic value, wherein the concept values include a first concept value, and wherein the processor is further used to execute: Obtain a first correlation coefficient between the first concept value and the first characteristic value; Obtain a second correlation coefficient between the first concept value and the second characteristic value; and Add the first correlation coefficient and the second correlation coefficient to obtain a first correlation score for the first concept value. An abnormal transaction detection device as described in claim 6, wherein a first characteristic value among the characteristic values corresponds to a first characteristic category among the characteristic categories, wherein a first representative concept value among the representative concept values corresponds to the first characteristic category including a plurality of characteristic intervals, wherein the processor is further used to: determine that the first characteristic value corresponds to a first characteristic interval among the characteristic intervals; and obtain a first risk weighted value and a first frequency weight corresponding to the first characteristic interval. An abnormal transaction detection device as described in claim 8, wherein the processor is further used to: Multiply a first concept score of the first representative concept value, the first risk weighted value, and the first frequency weight to obtain a first sub-risk score; Multiply the first concept score of the first representative concept value, a second risk weighted value, and a second frequency weight to obtain a second sub-risk score, wherein the second risk weighted value and the second frequency weight are obtained based on the first representative concept value, a second feature value, and a second feature category; A second concept score of a second representative concept value, a third risk weighted value, and a third frequency weight are multiplied to obtain a third sub-risk score, wherein the third risk weighted value and the third frequency weight are obtained according to the second representative concept value, the first feature value, and the first feature category; A second concept score of the second representative concept value, a fourth risk weighted value, and a fourth frequency weight are multiplied to obtain a fourth sub-risk score, wherein the fourth risk weighted value and the fourth frequency weight are obtained according to the second representative concept value, the second feature value, and the second feature category; and The first sub-risk score, the second sub-risk score, the third sub-risk score, and the fourth sub-risk score are added to calculate the risk score. The abnormal transaction detection device as described in claim 6, wherein the processor is further used to: When the risk score is higher than a risk score threshold, execute at least one of the verification values according to the risk event.

Images