WO2019218699A1 - Fraud transaction determining method and apparatus, computer device, and storage medium - Google Patents

Abstract

A fraud transaction determining method, comprising: obtaining current transaction; inputting the current transaction to a transaction anti-fraud analysis model to obtain the transaction fraud probability of the current transaction; identifying the current transaction by means of a pre-stored fraud transaction identification rule to obtain the identification result; and determining whether the current transaction is a fraud transaction according to the transaction fraud probability of the current transaction and the identification result.

Description

Fraud transaction judgment method, device, computer device and storage medium

Cross-reference to related applications

This application claims to be filed on May 18, 2018, the Chinese Patent Office, the application number is 2018104790604, and the priority of the Chinese patent application entitled "Secret transaction judgment method, device, computer equipment and storage medium" is claimed. Combined in this application.

Technical field

The present application relates to a fraudulent transaction determination method, apparatus, computer device and storage medium.

Background technique

With the development of modern network technology, electronic transactions are more and more widely used in life, and there are also risks of electronic transactions as fraudulent transactions, such as information disclosure or transaction violations; therefore, it is necessary to The transaction data of the transaction is subjected to fraud analysis, and when it is analyzed based on the transaction data that the current transaction may be a fraudulent transaction, the current transaction is ended.

Traditionally, some transaction anti-fraud real-time scoring models are generally used to analyze current transactions, such as FICO (a personal credit rating method), SAS (STATISTICAL ANALYSIS SYSTEM, data analysis system, banks can be implemented by deploying SAS fraud management. Fraud analysis), the same anti-fraud model of trading, etc.; however, the inventors realized that these models are less versatile and have lower accuracy in judging fraudulent transactions that occur in actual transactions.

Summary of the invention

According to various embodiments disclosed herein, a fraudulent transaction determination method, apparatus, computer device, and storage medium are provided.

A method for judging a fraudulent transaction, the method comprising:

Get the current transaction;

Entering the current transaction into a transaction anti-fraud analysis model to obtain a transaction fraud probability of the current transaction;

Identifying the current transaction by a pre-stored fraudulent transaction identification rule to obtain a recognition result; and

Determining whether the current transaction is a fraudulent transaction based on the transaction fraud probability of the current transaction and the recognition result.

A fraudulent transaction judging device, the device comprising:

a data acquisition module for acquiring a current transaction;

a probability analysis module, configured to input the current transaction into a transaction anti-fraud analysis model to obtain a transaction fraud probability of the current transaction;

a rule identification module, configured to identify the current transaction by a pre-stored fraudulent transaction identification rule to obtain a recognition result; and

And a result obtaining module, configured to determine, according to the transaction fraud probability of the current transaction, the determination whether the current transaction is a fraudulent transaction.

A computer device comprising a memory and one or more processors having stored therein computer readable instructions, the computer readable instructions being executable by the processor to cause the one or more processors to execute The following steps:

Get the current transaction;

Entering the current transaction into a transaction anti-fraud analysis model to obtain a transaction fraud probability of the current transaction;

Identifying the current transaction by a pre-stored fraudulent transaction identification rule to obtain a recognition result; and

Determining whether the current transaction is a fraudulent transaction based on the transaction fraud probability of the current transaction and the recognition result.

One or more non-transitory computer readable storage mediums storing computer readable instructions, when executed by one or more processors, cause one or more processors to perform the steps of:

Get the current transaction;

Entering the current transaction into a transaction anti-fraud analysis model to obtain a transaction fraud probability of the current transaction;

Identifying the current transaction by a pre-stored fraudulent transaction identification rule to obtain a recognition result; and

Determining whether the current transaction is a fraudulent transaction based on the transaction fraud probability of the current transaction and the recognition result.

Details of one or more embodiments of the present application are set forth in the accompanying drawings and description below. Other features and advantages of the present invention will be apparent from the description, drawings and claims.

DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings to be used in the embodiments will be briefly described below. Obviously, the drawings in the following description are only some embodiments of the present application, Those skilled in the art can also obtain other drawings based on these drawings without any creative work.

1 is an application scenario diagram of a fraudulent transaction determination method in accordance with one or more embodiments.

2 is a flow diagram of a fraudulent transaction determination method in accordance with one or more embodiments.

3 is a flow diagram of a model training step in accordance with one or more embodiments.

FIG. 4 is a flow diagram of step S304 of FIG. 3 in accordance with one or more embodiments.

FIG. 5 is a block diagram of a fraudulent transaction determining apparatus in accordance with one or more embodiments.

FIG. 6 is a block diagram of a computer device in accordance with one or more embodiments.

Detailed ways

In order to make the technical solutions and advantages of the present application more clear, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the application and are not intended to be limiting.

The fraudulent transaction judging method provided by the present application can be applied to the application environment as shown in FIG. 1. The terminal and the server communicate through the network. The terminal obtains the current transaction from the server, inputs the current transaction into the transaction anti-fraud analysis model to obtain the transaction fraud probability of the current transaction, and identifies the current transaction through the fraud transaction identification rule, and the transaction fraud probability and the fraud transaction identification rule of the current transaction. The result of the combination of the two solutions is to determine whether the current transaction is a fraudulent transaction. The terminal can be, but is not limited to, various personal computers, notebook computers, smart phones, tablets, and portable wearable devices. The server can be implemented by a separate server or a server cluster composed of multiple servers.

In some embodiments, as shown in FIG. 2, a fraudulent transaction judging method is provided. The method is applied to the terminal in FIG. 1 as an example, and includes the following steps:

S202: Acquire a current transaction.

The current transaction refers to a transaction that needs to determine whether it is a fraudulent transaction. If it is necessary to make fraudulent judgments on multiple transactions, then multiple transactions are subsequently performed as a current transaction in sequence; the current transaction may include the transaction amount of a transaction. , time, account data and other information.

Specifically, the terminal obtains a current transaction from the server that needs to determine whether it is a fraudulent transaction, and the server may be a business system or other transaction system, wherein the business system may be a transaction website or a database storing transaction data, and other transaction systems may be other cooperative websites, etc. .

S204: Enter the current transaction into the transaction anti-fraud analysis model to obtain the transaction fraud probability of the current transaction.

The transaction anti-fraud analysis model is a model for analyzing the transaction fraud probability of the input current transaction; the transaction anti-fraud analysis model may be a neural network model or a rule model trained by a technician using historical transaction data as sample data.

The probability of transaction fraud is the probability that the terminal judges the current transaction through the transaction anti-fraud analysis model to obtain the current transaction as a fraudulent transaction; the probability of transaction fraud can be displayed in percentage form, and other mathematical representations can also be used.

Specifically, the terminal inputs the acquired current transaction into the transaction anti-fraud analysis model obtained by training the fraud information in the historical transaction data and the historical transaction data as the sample data, and obtains the probability that the current transaction is a fraudulent transaction according to the rule of the model training. .

S206. Identify the current transaction by using a pre-stored fraudulent transaction identification rule to obtain a recognition result.

Among them, the fraudulent transaction identification rule is a rule based on different transaction characteristics for judging whether the current transaction is a fraudulent transaction. The fraudulent transaction identification rule may include a quota limit rule based on high frequency transactions and a fraud transaction identification rule decision combination based on historical risk transaction feature extraction; the limit limit rule based on high frequency transaction is to view the account for executing the current transaction for a period of time. The number of transactions and the transaction amount. When the account performs multiple large transactions in a short period of time, the transaction conducted by the account is more likely to be fraudulent transactions; the fraudulent transaction identification rule based on historical risk transaction feature extraction may Is a fraudulent transaction identification rule based on historical transaction information of an account executing the current transaction: if the device of the account has used the device to log in to multiple accounts, or the account that performs the current transaction is performed multiple times in a short time after registration The amount of transactions, etc., can be used as a criterion for judging the current transaction as a fraudulent transaction.

Specifically, the terminal will formulate a fraudulent transaction identification rule pre-existing in the terminal or the server. When receiving the current transaction, the terminal may first retrieve the pre-stored fraudulent transaction identification rule to identify the current transaction, and determine whether the current transaction has a fraud risk. .

S208. Determine whether the current transaction is a fraudulent transaction according to the transaction fraud probability of the current transaction and the recognition result.

Specifically, the transaction fraud probability obtained by the current transaction through the transaction anti-fraud analysis model in step S204 is combined with the recognition result of the current transaction by the pre-stored fraudulent transaction identification rule in step S206 to determine whether the current transaction is a fraudulent transaction.

Optionally, when the transaction fraud probability obtained by the transaction anti-fraud analysis model is greater than a preset value, it indicates that the current transaction is likely to be a fraudulent transaction; if the pre-stored fraudulent transaction identification rule is identified, the current transaction is also considered as an account. If the data such as information or transaction amount is more suspicious, it can be judged that the current transaction is a fraudulent transaction. Then the terminal submits the current transaction to the verification department for verification. If the verification result determines that the current transaction is a fraudulent transaction, the processing step of warning or blocking the account that initiated the transaction may be performed.

If the transaction anti-fraud analysis model and the pre-existing fraudulent transaction identification rule have different differences in the judgment result of whether the current transaction is a risk transaction, further verification of the current transaction is required, and the transaction anti-fraud analysis model is checked according to the verification result. The pre-stored fraudulent transaction identification rule determines the reason for the large difference, thereby correcting the transaction anti-fraud analysis model or the fraudulent transaction identification rule.

The above fraudulent transaction judging method may also be: first inputting the current transaction into the fraudulent transaction identification rule, and then using the fraudulent transaction identification rule as the reference factor of the transaction anti-fraud analysis model for the current transaction judgment as the reference factor of the current transaction judgment can make the transaction reverse The fraud analysis model more fully analyzes current transactions.

In the above embodiment, the terminal combines the transaction anti-fraud analysis model trained according to the actual transaction with the pre-stored fraudulent transaction identification rule to judge whether the current transaction is a fraudulent transaction, and improves the judgment of the fraudulent transaction occurring in the actual transaction. Accuracy.

In some embodiments, referring to FIG. 3, step S202 in the above fraudulent transaction determination method may further include a step of model training before the current transaction is acquired, and the step of training the model may include:

S302. Acquire sample data.

The sample data is transaction data used to train the transaction anti-fraud analysis model, and may be historical data related to the current transaction. For example, when it is necessary to fraudulently judge each single transaction data of this year, the previous year may be used. The transaction data is sample data.

Specifically, when training the transaction anti-fraud analysis model, it is necessary to first acquire sample data for training. Optionally, the sample data may include positive sample data and negative sample data; the positive sample data is normal transaction data, and since most transactions are normal transactions, the positive sample data may be randomly sampled to extract normal transactions for a period of time. The data of the negative sample data is fraudulent transaction data in the historical transaction data after the business verification; wherein the sample data may include transaction data, card binding data, account opening data, and the like.

S304: Clean the sample data, and select a training variable from the cleaned sample data.

Among them, the training variable is a variable that is input into the random forest algorithm model, such as the transaction amount, the transaction equipment model and other variables.

Specifically, the obtained sample data is cleaned, and the data that does not satisfy the demand is filtered according to the preset cleaning rule; for example, when the sample data of the Apple account is similar to the fraud data type, the sample data that is paid by using the Apple account is excluded. So as not to affect the accuracy of the model. The sample data acquired in step S202 is transaction data, and each transaction may include multiple variables, such as transaction amount, customer name, IP number of the transaction device, serial number, etc., and only need to be extracted when training the transaction anti-fraud analysis model. The variable related to the transaction fraud judgment can be used. Here, the terminal extracts the variables related to the transaction fraud judgment and needs to first filter out the training variables of the input random forest algorithm.

Alternatively, multiple variables in the sample data can be excluded from the high correlation variable by the cor function (a function of calculating the correlation coefficient between the columns and columns) in the R language (a computer compiled language) for the sample data Wash it.

S306, selecting a modulo variable and a modulo variable corresponding to the modulo variable from the training variable through a random forest algorithm model.

Among them, the random forest algorithm model is an algorithm model for selecting the modulo variables from the training variables; the random forest is a classifier containing multiple decision trees; that is, a forest is established in a random manner, and there are many decision trees in the forest. Composition, there is no correlation between each decision tree in a random forest. After getting the forest, when a new input data is entered, each decision tree in the forest is judged separately, and the input data is classified through multiple decision trees.

The modulo variable is a variable used to train the transaction anti-fraud analysis model, and is a variable selected by the random forest algorithm model and related to the transaction fraud judgment, such as the transaction amount. The model variable is the variable corresponding to the model variable. If the model variable is the transaction amount, and the model variable is greater than 100,000 yuan, the probability of this transaction being a fraudulent transaction is 70%.

Specifically, the training variable is input into the random forest algorithm model, and the importance of the judgment result of each training variable on the transaction fraud probability is analyzed by using multiple decision trees in the algorithm, and finally the training variable whose importance is greater than the preset value is obtained as The modulo variable and the modulo variable corresponding to the modulo variable used to calculate the probability of transaction fraud.

S308. Acquire a preset initial neural network model.

Specifically, after the modulo variable and the modulo variable corresponding to the modulo variable are selected in step S206, the preset initial neural network model may be acquired and trained.

S310, training the initial neural network model according to the model variables corresponding to the model variables and the model variables to obtain a transaction anti-fraud analysis model.

Specifically, the initial neural network is trained according to the modulo variable obtained in step S306 and the modulo variable corresponding to the modulo variable, and a transaction anti-fraud analysis model capable of calculating the transaction fraud probability of the input current transaction is obtained.

In the above embodiment, after the acquired sample data is processed by cleaning, the model is selected according to the trained random forest algorithm model, and the corresponding model variables are selected, and the initial neural network model is trained to obtain an accurate judgment input. The transaction anti-fraud analysis model of the transaction fraud probability of the current transaction; since the sample data is historical transaction data related to the current transaction, the calculation of the transaction fraud probability of the current transaction is more accurate.

In some embodiments, the step S304 in the fraudulent transaction determination method, that is, the step of cleaning the sample data and selecting the training variable from the cleaned sample data may include:

S402. Acquire data whose content is empty, and identify a data type corresponding to the data whose content is empty.

The data with empty content may be data with NULL value in the data; the data type is one or more types of data for which the content of the corresponding replacement logic is empty, such as discrete data and continuous type, etc. .

Specifically, after obtaining the sample data, in order to ensure that the content of the sample is empty, and avoiding data omission, it is necessary to determine whether the data in the sample data is empty, and whether it is meaningless, Identify the data type of the data whose content is empty, that is, identify the meaningless data.

S404. Acquire a replacement type logic corresponding to the data type, and replace the data in the sample data with the empty content according to the acquired replacement logic.

Wherein, the replacement logic is a logic rule for replacing the data according to the data whose content is empty, and can be determined according to experience; for example, in the R language, the NULL value in the discrete variable is replaced by the character U, and the continuous variable ( In the case of numerical values, etc., the NULL value is replaced by the value 0; after the replacement logic is formulated, it can be stored in the preset position, and the preset position of the replacement logic defined by the storage can be called a logic library, and the key is used according to the key Rules such as words are retrieved from the logic library.

Specifically, according to the data type of the sample data, the corresponding replacement logic is obtained from the logic library, and the data in which the content in the sample data is empty is subjected to a corresponding replacement operation according to the replacement logic.

Optionally, the terminal uses a field with a NULL value that is higher than the preset ratio and has no actual meaning as a field whose content is empty, and the terminal may directly remove the preset content, and the preset ratio may be set according to experience, such as 30%. Wait.

S406. Obtain a non-high correlation variable in the replaced sample data as the first variable.

Wherein, the first variable is a non-high correlation variable selected from the replaced sample data, such as a name; the non-high correlation variable is a variable obtained by screening the high correlation variable from the sample data, and can be followed by The business operation formulates corresponding rules to analyze the correlation of variables in the sample data, and determines the correlation between multiple variables in the sample data. For example, variables such as name and last name have the same effect in business operations, which may be High correlation variable.

Specifically, the replaced sample data obtained in step S404 may include a repetitive variable with a higher correlation, and a non-high correlation variable is selected to continue the subsequent operations.

S408. Calculate an information value of the first variable.

Among them, the information value (IV) is the index of the degree of influence of the independent variable on the target variable; the larger the information value of the first variable, the greater the influence of the variable on the judgment of whether the transaction is a fraudulent transaction. The first variable after grouping is converted into WOE (Weight of Evidence), and the conversion formula is:

Wherein py _i is a set of transactions in a fraudulent transaction ratio of all transactions, pn _i is the ratio of a group's normal transactions and all transactions, # y _i is the number of the group in fraudulent transactions, # n _i is the The number of normal transactions in the group, #y _T is the number of all fraudulent transactions in all transaction data, #n _T is the number of all normal transactions in all transaction data.

The information value of a set of first variables can be derived from the above WOE calculation formula:

IV _i =(py _i -pn _i )*WOE _i (2)

Then the IV value of the first variable is the sum of the information values of the first variable of all groups.

Specifically, after acquiring the first variable in step S306, it is necessary to determine whether all variables in the first variable have an influence on the judgment result of the fraudulent transaction, and if there is an influence, it can be used as a variable of the training transaction anti-fraud analysis model; If it has no effect, it can be deleted. Optionally, the information value corresponding to the first variable may be calculated by referring to the data algorithm package in the R language.

S410: Select a first variable whose information value is higher than a preset value as a training variable.

Specifically, when the information value of the first variable is higher than the preset value, it may be considered to have an influence on the judgment result of the fraudulent transaction, and may be considered as a model variable of the training transaction anti-fraud analysis model. The default value can be set by big data analysis or experience.

In the above embodiment, the anti-fraud is more accurately trained for the transaction by performing a corresponding replacement operation on the data in which the content of the sample data is empty, and deleting the variable of high correlation and selecting the value of the information from the preset value. The analysis model selects the model variables to improve the accuracy and training efficiency of the model training.

In some embodiments, the cleaning of the sample data in step S304 in the fraudulent transaction determination method may include: acquiring a second variable in the sample data, and acquiring a business rule corresponding to the second variable; and the second variable according to the business rule. Selecting a second variable whose service similarity is greater than a preset value, and selecting one of the second variables whose service similarity is greater than the preset value as the cleaned sample data.

The second variable is a variable obtained from the sample data for performing similarity judgment; such as a transaction amount.

The business rule is a set rule for calculating the similarity between a plurality of variables; for example, when the variable to be calculated is the ID number, the transaction amount, and the date of birth, the ID number and the date of birth can be set. The similarity is 90%, and the similarity between the ID number and the transaction amount is 0%; after the business rules are set, they can be stored in the rule base and called according to the keywords.

Specifically, a second variable for performing similarity determination is obtained from the sample data; and a business rule related to the second variable is called from the set rule base, and a similarity between the second variables is calculated according to the business rule, When the similarity between two or more second variables is higher than the preset value, it can be considered that these second variables have similar effects in the business activity, and only one subsequent operation is reserved.

In the above embodiment, the similarity calculation is performed on the variables in the sample data according to the business rule, and only a plurality of variables with higher similarity are retained, which reduces the data calculation during the training and practical application of the transaction anti-fraud analysis model, and improves the model. The efficiency of training and application.

In some embodiments, the cleaning of the sample data in step S304 in the fraudulent transaction determination method may include: acquiring a third variable in the sample data; detecting a variable type of the third variable; and when the variable type is continuous, according to the pre- The conditional reasoning tree is used to obtain the recursive segmentation algorithm, and the third variable is segmented according to the recursive segmentation algorithm.

The third variable is a variable obtained from the sample data and used to detect the type of the variable; such as the transaction amount.

Conditional inference trees (Ctree) is a tree-based classification algorithm, such as plot, text function in R language.

Recursion refers to the method of using the function itself in the definition of the function; the recursive segmentation algorithm is a machine algorithm that divides the input variable multiple times based on the recursive algorithm; that is, the third variable is divided into multiple by calling the recursive segmentation algorithm multiple times. Discrete variables, such as transaction amounts ranging from 0 to 1 million, are segmented into variable representations of 0 to 50,000 segments and 5 to 100,000 segments by a recursive segmentation algorithm.

Specifically, a third variable for detecting a variable type is obtained from the sample data; when the variable type of the third variable is detected to be continuous, the recursive segmentation algorithm for segmenting the third variable is obtained according to the preset conditional inference tree. Then, according to the recursive segmentation algorithm, the third variable is segmented to obtain a variable form that is easy to train the initial neural network model.

In the above embodiment, by segmenting the continuous variables in the sample data, the variables in the sample data are more consistent with the representation of the model training, and it is convenient to train the initial neural network model.

In some embodiments, after step S204 in the fraudulent transaction determination method, the current transaction is input into the transaction anti-fraud analysis model to obtain the transaction fraud probability of the current transaction, the method may further include: converting the transaction fraud probability into a transaction fraud score according to the following formula: Score=A-Blog(odds); where odds=p/(1-p), Score is the transaction fraud score, p is the transaction fraud probability, A and B are preset constants; transaction fraud probability and recognition result according to the current transaction Determining whether the current transaction is a fraudulent transaction includes: determining whether the current transaction is a fraudulent transaction based on the transaction fraud score of the current transaction and the recognition result.

Specifically, in order to more directly present the analysis result of the transaction anti-fraud analysis model to whether the current transaction is a fraudulent transaction, the technical staff can be converted into a transaction fraud score, and the conversion formula is Score=A-Blog(odds), Where odds=p/(1-p); Score is the transaction fraud score, p is the transaction fraud probability, A and B are preset constants, which can be obtained according to experience; the score can directly reflect the fraud risk, and the high score represents low risk. Low scores represent high risk.

In the above embodiment, the transaction fraud probability of the current transaction is obtained according to the modulo variable, and the result of the transaction anti-fraud analysis model is more convenient for analysis and review.

In some embodiments, the fraud transaction judging method may further include: obtaining a verification transaction, inputting the verification transaction into the transaction anti-fraud analysis model to obtain a verification fraud probability; obtaining a standard fraud probability corresponding to the verification transaction, calculating a verification fraud probability and a standard fraud probability The difference is obtained; the standard fraud probability corresponding to the verification transaction is obtained, and the difference between the verification fraud probability and the standard fraud probability is calculated; when the difference is greater than the preset value, the transaction anti-fraud analysis model is corrected according to the standard fraud probability.

Wherein, the verification transaction is transaction data used for verifying the transaction anti-fraud analysis model; if the transaction anti-fraud analysis model is that the transaction of the previous year is trained as sample data, the transaction in January of this year may be used or randomly sampled therefrom. The transaction is a verification transaction.

The probability of verifying fraud is the probability that the verified transaction is a fraudulent transaction after the transaction anti-fraud analysis model judges the verification transaction; the verification fraud probability is consistent with the transaction fraud probability form, and can be displayed in percentage form, or other mathematical representations can be used. .

The standard fraud probability is the probability that the transaction is actually a fraudulent transaction; it is consistent with the form of the verification fraud probability and can be displayed as a percentage, or other mathematical representations can be used.

Specifically, the verification transaction is read from the address of the storage verification transaction, and the obtained verification transaction is input into the neural network model or the rule model trained as the sample data according to the historical transaction data and the fraud information in the historical transaction data, according to the model The rules of training, the probability of verifying the transaction as a verification transaction; then obtaining the standard fraud probability that the verification transaction is actually a fraudulent transaction, comparing the standard fraud probability with the probability of verifying the fraud, and when the difference between the two is small, the transaction is proved The anti-fraud analysis model has higher accuracy; when the difference between the two is large, the transaction anti-fraud analysis model may have errors and correct it according to the standard fraud probability.

Optionally, the historical transaction data may be segmented by a stratified sampling method or a random sampling method, for example, 2-8 segments, 80% of the data is used as sample data to model the transaction anti-fraud analysis model, and 20% of the data is used as The verification transaction verifies the transaction anti-fraud analysis model. Or, all historical transaction data is used as sample data, such as the transaction data after sampling in the previous year, and the transaction data after the date of the data is sampled, such as the transaction data of January of this year, and the transaction anti-fraud analysis model is verified as the verification transaction.

In the above embodiment, the verification step of the transaction anti-fraud analysis model can ensure the accuracy of the model's fraud probability judgment on the current transaction.

It should be understood that although the various steps in the flowcharts of FIGS. 2 through 4 are sequentially displayed as indicated by the arrows, these steps are not necessarily performed in the order indicated by the arrows. Except as explicitly stated herein, the execution of these steps is not strictly limited, and the steps may be performed in other orders. Moreover, at least some of the steps in FIGS. 2 to 4 may include a plurality of sub-steps or stages, which are not necessarily performed at the same time, but may be performed at different times, or The order of execution of the stages is also not necessarily sequential, but may be performed alternately or alternately with at least a portion of the sub-steps or stages of other steps or other steps.

In some embodiments, as shown in FIG. 5, a fraudulent transaction determining apparatus is provided, including: a data acquisition module 100, a probability analysis module 200, a rule identification module 300, and a result acquisition module 400, wherein:

The data acquisition module 100 is configured to acquire a current transaction.

The probability analysis module 200 is configured to input the current transaction into the transaction anti-fraud analysis model to obtain the transaction fraud probability of the current transaction.

The rule identification module 300 is configured to identify the current transaction by using a pre-stored fraudulent transaction identification rule to obtain a recognition result.

The result obtaining module 400 is configured to determine whether the current transaction is a fraudulent transaction according to the transaction fraud probability of the current transaction and the recognition result.

In some embodiments, the fraud transaction determining apparatus may further include:

A sample acquisition module for obtaining sample data.

A cleaning module for cleaning sample data and selecting training variables from the cleaned sample data.

The variable selection module is configured to select the modulo variable from the training variable and the modulo variable corresponding to the modulo variable through the random forest algorithm model.

An initial model acquisition module is configured to acquire a preset initial neural network model.

The model training module is configured to train the initial neural network model according to the model variables corresponding to the model variables and the model variables to obtain a transaction anti-fraud analysis model.

In some embodiments, the cleaning module in the fraud transaction determining apparatus may include:

The empty data obtaining unit is configured to acquire data whose content is empty, and identify a data type corresponding to the data whose content is empty.

And a replacement unit, configured to acquire a replacement logic corresponding to the data type, and replace the data in the sample data with the empty content according to the obtained replacement logic.

A correlation analysis unit is configured to obtain a non-high correlation variable in the replaced sample data as the first variable.

A value calculation unit for calculating the information value of the first variable.

The training variable selecting unit is configured to select the first variable whose information value is higher than the preset value as the training variable.

In some embodiments, the cleaning module in the fraud transaction determining apparatus may include:

The business rule obtaining unit is configured to acquire a second variable in the sample data, and obtain a business rule corresponding to the second variable.

The variable similarity analysis unit is configured to select, from the second variable, a second variable whose service similarity is greater than a preset value according to the business rule, and select one of the second variables whose service similarity is greater than the preset value. As sample data after cleaning.

In some embodiments, the cleaning module in the fraud transaction determining apparatus may include:

A sample variable acquisition unit is configured to acquire a third variable in the sample data.

A variable type identifying unit for detecting a variable type of the third variable.

The continuous variable segmentation unit is configured to acquire a recursive segmentation algorithm according to a predetermined conditional reasoning tree when the variable type is continuous, and segment the third variable according to the recursive segmentation algorithm.

In some embodiments, the fraud transaction determining apparatus may further include:

A score conversion module for converting a transaction fraud probability into a transaction fraud score according to the following formula:

Score=A-Blog(odds)

Where odds=p/(1-p), Score is the transaction fraud score, p is the transaction fraud probability, and A and B are preset constants.

The result obtaining module 400 may be configured to: determine whether the current transaction is a fraudulent transaction according to the transaction fraud score of the current transaction and the recognition result.

In some embodiments, the fraud transaction determining apparatus may further include:

The verification transaction acquisition module is used to obtain the verification transaction.

The verification fraud probability acquisition module is configured to input the verification transaction into the transaction anti-fraud analysis model to obtain the verification fraud probability.

The difference calculation module is configured to obtain a standard fraud probability corresponding to the verification transaction, and calculate a difference between the verification fraud probability and the standard fraud probability.

The correction module is configured to correct the transaction anti-fraud analysis model according to the standard fraud probability when the difference is greater than the preset value.

For the specific definition of the fraudulent transaction judging device, reference may be made to the above definition of the fraudulent transaction judging method, and details are not described herein again. Each of the above-described fraudulent transaction determination devices may be implemented in whole or in part by software, hardware, and combinations thereof. Each of the above modules may be embedded in or independent of the processor in the computer device, or may be stored in a memory in the computer device in a software form, so that the processor invokes the operations corresponding to the above modules.

In some embodiments, a computer device is provided, which may be a terminal, and its internal structure diagram may be as shown in FIG. 6. The computer device includes a processor, memory, network interface, display screen, and input device connected by a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium, an internal memory. The non-volatile storage medium stores operating systems and computer readable instructions. The internal memory provides an environment for operation of an operating system and computer readable instructions in a non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal via a network connection. The computer readable instructions are executed by the processor to implement a fraudulent transaction determination method. The display screen of the computer device may be a liquid crystal display or an electronic ink display screen, and the input device of the computer device may be a touch layer covered on the display screen, or may be a button, a trackball or a touchpad provided on the computer device casing. It can also be an external keyboard, trackpad or mouse.

It will be understood by those skilled in the art that the structure shown in FIG. 6 is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation of the computer device to which the solution of the present application is applied. The specific computer device may It includes more or fewer components than those shown in the figures, or some components are combined, or have different component arrangements.

A computer device comprising a memory and one or more processors having stored therein computer readable instructions, the computer readable instructions being executed by the processor such that the one or more processors perform the following steps:

Get the current transaction;

Entering the current transaction into the transaction anti-fraud analysis model to obtain the transaction fraud probability of the current transaction;

Identifying the current transaction by pre-existing fraudulent transaction identification rules to obtain a recognition result; and

Judging whether the current transaction is a fraudulent transaction based on the transaction fraud probability of the current transaction and the recognition result.

In some embodiments, before the processor obtains the current transaction by executing the computer readable instructions, the method may further include:

Obtain sample data;

Cleaning the sample data and selecting training variables from the cleaned sample data;

The random forest algorithm model is used to select the modulo variables from the training variables and the modulo variables corresponding to the modulo variables;

Obtaining a preset initial neural network model; and

The initial neural network model is trained according to the model variables corresponding to the model variables and the model variables to obtain a transaction anti-fraud analysis model.

In some embodiments, the cleaning of the sample data by the processor when executing the computer readable instructions and selecting the training variables from the cleaned sample data may include:

Obtaining data whose content is empty, and identifying the data type corresponding to the data whose content is empty;

Obtaining the data type to obtain the corresponding replacement logic, and replacing the data in the sample data with the empty content according to the obtained replacement logic;

Obtaining a non-high correlation variable in the replaced sample data as the first variable;

Calculating the information value of the first variable; and

The first variable whose information value is higher than the preset value is selected as the training variable.

In some embodiments, the cleaning of the sample data implemented by the processor when the computer readable instructions are executed may include:

Obtaining a second variable in the sample data and obtaining a business rule corresponding to the second variable; and

According to the business rule, the second variable whose service similarity is greater than the preset value is selected from the second variable, and one of the second variables whose service similarity is greater than the preset value is selected as the cleaned sample data.

In some embodiments, the cleaning of the sample data implemented by the processor when the computer readable instructions are executed may include:

Obtaining a third variable in the sample data;

Detecting the type of the variable of the third variable; and

When the variable type is continuous, the recursive segmentation algorithm is obtained according to the preset conditional inference tree, and the third variable is segmented according to the recursive segmentation algorithm.

In some embodiments, after the processor executes the computer-readable instruction to input the current transaction into the transaction anti-fraud analysis model to obtain the transaction fraud probability of the current transaction, the method may further include:

Convert the transaction fraud probability into a transaction fraud score according to the following formula: Score=A-Blog(odds);

Where odds=p/(1-p), Score is the transaction fraud score, p is the transaction fraud probability, and A and B are preset constants;

The processor determines whether the current transaction is a fraudulent transaction based on the transaction fraud probability of the current transaction and the recognition result when the processor executes the computer readable instruction, and may include:

Judging whether the current transaction is a fraudulent transaction based on the transaction fraud score of the current transaction and the recognition result.

In some embodiments, the processor may also implement the following steps when executing the computer readable instructions:

Obtain a verification transaction;

Entering the verification transaction into the transaction anti-fraud analysis model to obtain the probability of verifying the fraud;

Obtaining a standard fraud probability corresponding to the verification transaction, and calculating a difference between the verification fraud probability and the standard fraud probability;

When the difference is greater than the preset value, the transaction anti-fraud analysis model is corrected according to the standard fraud probability.

One or more non-transitory computer readable storage mediums storing computer readable instructions, when executed by one or more processors, cause one or more processors to perform the steps of:

Get the current transaction;

Entering the current transaction into the transaction anti-fraud analysis model to obtain the transaction fraud probability of the current transaction;

Identifying the current transaction by pre-existing fraudulent transaction identification rules to obtain a recognition result; and

Judging whether the current transaction is a fraudulent transaction based on the transaction fraud probability of the current transaction and the recognition result.

In some embodiments, before the computer transaction instructions are executed by the processor to obtain the current transaction, the method may further include:

Obtain sample data;

Cleaning the sample data and selecting training variables from the cleaned sample data;

The random forest algorithm model is used to select the modulo variables from the training variables and the modulo variables corresponding to the modulo variables;

Obtaining a preset initial neural network model; and

The initial neural network model is trained according to the model variables corresponding to the model variables and the model variables to obtain a transaction anti-fraud analysis model.

In some embodiments, the computer readable instructions are cleaned of the sample data as implemented by the processor and the training variables are selected from the cleaned sample data, which may include:

Obtaining data whose content is empty, and identifying the data type corresponding to the data whose content is empty;

Obtaining the data type to obtain the corresponding replacement logic, and replacing the data in the sample data with empty content according to the obtained replacement logic;

Obtaining a non-high correlation variable in the replaced sample data as the first variable;

Calculating the information value of the first variable; and

The first variable whose information value is higher than the preset value is selected as the training variable.

In some embodiments, the cleaning of the sample data by the computer readable instructions when executed by the processor may include:

Obtaining a second variable in the sample data and obtaining a business rule corresponding to the second variable; and

According to the business rule, the second variable whose service similarity is greater than the preset value is selected from the second variable, and one of the second variables whose service similarity is greater than the preset value is selected as the cleaned sample data.

In some embodiments, the cleaning of the sample data by the computer readable instructions when executed by the processor may include:

Obtaining a third variable in the sample data;

Detecting the type of the variable of the third variable; and

When the variable type is continuous, the recursive segmentation algorithm is obtained according to the preset conditional inference tree, and the third variable is segmented according to the recursive segmentation algorithm.

In some embodiments, after the computer readable instructions are executed by the processor to input the current transaction into the transaction anti-fraud analysis model to obtain the transaction fraud probability of the current transaction, the method may further include:

Convert the transaction fraud probability into a transaction fraud score according to the following formula: Score=A-Blog(odds);

Where odds=p/(1-p), Score is the transaction fraud score, p is the transaction fraud probability, and A and B are preset constants;

The computer readable instruction is executed by the processor to determine whether the current transaction is a fraudulent transaction according to the transaction fraud probability of the current transaction and the recognition result, and may include:

Judging whether the current transaction is a fraudulent transaction based on the transaction fraud score of the current transaction and the recognition result.

In some embodiments, the computer readable instructions, when executed by the processor, can also implement the following steps:

Obtain a verification transaction;

Entering the verification transaction into the transaction anti-fraud analysis model to obtain the probability of verifying the fraud;

Obtaining a standard fraud probability corresponding to the verification transaction, and calculating a difference between the verification fraud probability and the standard fraud probability;

When the difference is greater than the preset value, the transaction anti-fraud analysis model is corrected according to the standard fraud probability.

One of ordinary skill in the art can understand that all or part of the process of implementing the above embodiments can be completed by computer readable instructions, which can be stored in a non-volatile computer. The readable storage medium, which when executed, may include the flow of an embodiment of the methods as described above. Any reference to a memory, storage, database or other medium used in the various embodiments provided herein may include non-volatile and/or volatile memory. Non-volatile memory can include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of formats, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronization chain. Synchlink DRAM (SLDRAM), Memory Bus (Rambus) Direct RAM (RDRAM), Direct Memory Bus Dynamic RAM (DRDRAM), and Memory Bus Dynamic RAM (RDRAM).

The technical features of the above embodiments may be arbitrarily combined. For the sake of brevity of description, all possible combinations of the technical features in the above embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, It is considered to be the range described in this specification.

The above embodiments are merely illustrative of several embodiments of the present application, and the description thereof is more specific and detailed, but is not to be construed as limiting the scope of the invention. It should be noted that a number of variations and modifications may be made by those skilled in the art without departing from the spirit and scope of the present application. Therefore, the scope of the invention should be determined by the appended claims.

Claims (20)

A method for judging a fraudulent transaction, the method comprising: Get the current transaction; Entering the current transaction into a transaction anti-fraud analysis model to obtain a transaction fraud probability of the current transaction; Identifying the current transaction by a pre-stored fraudulent transaction identification rule to obtain a recognition result; and Determining whether the current transaction is a fraudulent transaction based on the transaction fraud probability of the current transaction and the recognition result. The method according to claim 1, wherein before the obtaining the current transaction, the method further comprises: Obtain sample data; Cleaning the sample data and selecting a training variable from the cleaned sample data; Selecting a modulo variable and a modulo variable corresponding to the modulo variable from the training variable by a random forest algorithm model; Obtaining a preset initial neural network model; and The transactional anti-fraud analysis model is obtained by training the initial neural network model according to the model variables corresponding to the model variables and the model variables. The method according to claim 2, wherein said cleaning said sample data and selecting training variables from said cleaned sample data comprises: Obtaining data whose content is empty, and identifying a data type corresponding to the data whose content is empty; Obtaining the data type to obtain corresponding replacement logic, and replacing the data in the sample data that is empty according to the acquired replacement logic; Obtaining a non-high correlation variable in the sample data after replacement as the first variable; Calculating the information value of the first variable; and The first variable whose information value is higher than a preset value is selected as a training variable. The method according to claim 2, wherein the cleaning the sample data comprises: Obtaining a second variable in the sample data, and obtaining a business rule corresponding to the second variable; and Selecting, according to the business rule, a second variable whose service similarity is greater than a preset value, and selecting one of the second variables whose service similarity is greater than a preset value as the cleaned sample. The method according to claim 2, wherein the cleaning the sample data comprises: Obtaining a third variable in the sample data; Detecting a variable type of the third variable; and When the variable type is continuous, the recursive segmentation algorithm is acquired according to the preset condition inference tree, and the third variable is segmented according to the recursive segmentation algorithm. The method according to claim 1, wherein after the entering the current transaction into the transaction anti-fraud analysis model to obtain the transaction fraud probability of the current transaction, the method further comprises: The transaction fraud probability is converted to a transaction fraud score according to the following formula: Score=A-Blog(odds) Where odds=p/(1-p), Score is the transaction fraud score, p is the transaction fraud probability, and A and B are preset constants; Determining whether the current transaction is a fraudulent transaction according to the transaction fraud probability of the current transaction and the recognition result, including: Determining whether the current transaction is a fraudulent transaction based on the transaction fraud score of the current transaction and the recognition result. The method of claim 1 further comprising: Obtain a verification transaction; Entering the verification transaction into the transaction anti-fraud analysis model to obtain a verification fraud probability; Obtaining a standard fraud probability corresponding to the verification transaction, and calculating a difference between the verification fraud probability and the standard fraud probability; and When the difference is greater than a preset value, the transaction anti-fraud analysis model is corrected according to the standard fraud probability. A fraudulent transaction judging device, the device comprising: a data acquisition module for acquiring a current transaction; a probability analysis module, configured to input the current transaction into a transaction anti-fraud analysis model to obtain a transaction fraud probability of the current transaction; a rule identification module, configured to identify the current transaction by a pre-stored fraudulent transaction identification rule to obtain a recognition result; and And a result obtaining module, configured to determine, according to the transaction fraud probability of the current transaction, the determination whether the current transaction is a fraudulent transaction. The device according to claim 8, wherein the device further comprises: a sample acquisition module for acquiring sample data; a cleaning module, configured to clean the sample data, and select a training variable from the cleaned sample data; a variable selection module, configured to select, by using a random forest algorithm model, an modulo variable from the training variable and a modulo variable corresponding to the modulo variable; An initial model acquisition module for acquiring a preset initial neural network model; and The model training module is configured to train the initial neural network model according to the model variables corresponding to the model variables and the model variables to obtain a transaction anti-fraud analysis model. A computer device comprising a memory and one or more processors having stored therein computer readable instructions, the computer readable instructions being executed by the one or more processors to cause the one or more The processors perform the following steps: Get the current transaction; Entering the current transaction into a transaction anti-fraud analysis model to obtain a transaction fraud probability of the current transaction; Identifying the current transaction by a pre-stored fraudulent transaction identification rule to obtain a recognition result; and Determining whether the current transaction is a fraudulent transaction based on the transaction fraud probability of the current transaction and the recognition result. The computer device according to claim 10, wherein before the acquiring the current transaction by the processor when the processor executes the computer readable instruction, the method further comprises: Obtain sample data; Cleaning the sample data and selecting a training variable from the cleaned sample data; Selecting a modulo variable and a modulo variable corresponding to the modulo variable from the training variable by a random forest algorithm model; Obtaining a preset initial neural network model; and The transactional anti-fraud analysis model is obtained by training the initial neural network model according to the model variables corresponding to the model variables and the model variables. The computer apparatus according to claim 11, wherein said processor performs said cleaning of said sample data when said computer readable instructions are executed, and selects training variables from said cleaned sample data, include: Obtaining data whose content is empty, and identifying a data type corresponding to the data whose content is empty; Obtaining the data type to obtain corresponding replacement logic, and replacing the data in the sample data that is empty according to the acquired replacement logic; Obtaining a non-high correlation variable in the sample data after replacement as the first variable; Calculating the information value of the first variable; and The first variable whose information value is higher than a preset value is selected as a training variable. The computer device according to claim 11, wherein the cleaning of the sample data implemented by the processor when the computer readable instructions are executed comprises: Obtaining a second variable in the sample data, and obtaining a business rule corresponding to the second variable; and Selecting, according to the business rule, a second variable whose service similarity is greater than a preset value, and selecting one of the second variables whose service similarity is greater than a preset value as the cleaned sample. The computer device according to claim 11, wherein the cleaning of the sample data implemented by the processor when the computer readable instructions are executed comprises: Obtaining a third variable in the sample data; Detecting a variable type of the third variable; and When the variable type is continuous, the recursive segmentation algorithm is acquired according to the preset condition inference tree, and the third variable is segmented according to the recursive segmentation algorithm. The computer apparatus according to claim 10, wherein said processor, when said computer readable instructions are executed, said said current transaction input transaction anti-fraud analysis model to obtain a transaction fraud probability of said current transaction After that, it also includes: The transaction fraud probability is converted to a transaction fraud score according to the following formula: Score=A-Blog(odds) Where odds=p/(1-p), Score is the transaction fraud score, p is the transaction fraud probability, and A and B are preset constants; Determining whether the current transaction is a fraudulent transaction according to the transaction fraud probability of the current transaction and the recognition result, including: Determining whether the current transaction is a fraudulent transaction based on the transaction fraud score of the current transaction and the recognition result. The computer apparatus according to claim 10, wherein said processor further performs the following steps when said computer readable instructions are executed: Obtain a verification transaction; Entering the verification transaction into the transaction anti-fraud analysis model to obtain a verification fraud probability; Obtaining a standard fraud probability corresponding to the verification transaction, and calculating a difference between the verification fraud probability and the standard fraud probability; and When the difference is greater than a preset value, the transaction anti-fraud analysis model is corrected according to the standard fraud probability. One or more non-transitory computer readable storage mediums storing computer readable instructions, when executed by one or more processors, cause the one or more processors to perform the following steps: Get the current transaction; Entering the current transaction into a transaction anti-fraud analysis model to obtain a transaction fraud probability of the current transaction; Identifying the current transaction by a pre-stored fraudulent transaction identification rule to obtain a recognition result; and Determining whether the current transaction is a fraudulent transaction based on the transaction fraud probability of the current transaction and the recognition result. The storage medium of claim 17, wherein the computer readable instructions are executed by the processor prior to the obtaining the current transaction, further comprising: Obtain sample data; Cleaning the sample data and selecting a training variable from the cleaned sample data; Selecting a modulo variable and a modulo variable corresponding to the modulo variable from the training variable by a random forest algorithm model; Obtaining a preset initial neural network model; and The transactional anti-fraud analysis model is obtained by training the initial neural network model according to the model variables corresponding to the model variables and the model variables. The storage medium according to claim 18, wherein said computer readable instructions are cleaned by said processor when said sample data is executed, and said training variables are selected from said cleaned sample data ,include: Obtaining data whose content is empty, and identifying a data type corresponding to the data whose content is empty; Obtaining the data type to obtain corresponding replacement logic, and replacing the data in the sample data that is empty according to the acquired replacement logic; Obtaining a non-high correlation variable in the sample data after replacement as the first variable; Calculating the information value of the first variable; and The first variable whose information value is higher than a preset value is selected as a training variable. The storage medium according to claim 18, wherein said computer readable instructions are cleaned by said processor when said sample data is executed, and said training variables are selected from said cleaned sample data ,include: Obtaining a second variable in the sample data, and obtaining a business rule corresponding to the second variable; and Selecting, according to the business rule, a second variable whose service similarity is greater than a preset value, and selecting one of the second variables whose service similarity is greater than a preset value as the cleaned sample.

Images