CN114819967A

CN114819967A - Data processing method and device, electronic equipment and computer readable storage medium

Info

Publication number: CN114819967A
Application number: CN202210051311.5A
Authority: CN
Inventors: 迟爽; 高建华; 骆更; 李保昌
Original assignee: Industrial and Commercial Bank of China Ltd ICBC
Current assignee: Industrial and Commercial Bank of China Ltd ICBC
Priority date: 2022-01-17
Filing date: 2022-01-17
Publication date: 2022-07-29

Abstract

The invention discloses a data processing method, a data processing device, electronic equipment and a computer readable storage medium. Wherein, the method comprises the following steps: collecting historical transaction data and attribute data of a first target object; extracting transaction characteristics of the first target object according to historical transaction data and attribute data of the first target object; acquiring current transaction data of a second target object, wherein the current transaction data is transaction data corresponding to a transaction to be paid currently by the second target object; and predicting the probability that the current transaction data of the second target object is abnormal transaction data according to the transaction characteristics of the first target object to obtain the probability that the current transaction data of the second target object is abnormal transaction data. The invention solves the technical problem that the transaction operation being executed by the target object is difficult to judge abnormally and intercept in the related technology.

Description

Data processing method and device, electronic equipment and computer readable storage medium

Technical Field

The present invention relates to the field of computers, and in particular, to a data processing method, an apparatus, an electronic device, and a computer-readable storage medium.

Background

With the rapid development of internet mobile payment, the problem of secure payment is more frequent and severe. The safety payment problem is not limited to the simple problems of conventional password cracking, Trojan poisoning and the like, and the complicated conditions of cheating such as wrong payment by code scanning and the like are more frequent. When the user carries out the payment operation, whether the owner is carrying out the operation or not is difficult to judge, and whether the current transaction has risks or not is difficult to judge so as to carry out timely interception.

In view of the above problems, no effective solution has been proposed.

Disclosure of Invention

The embodiment of the invention provides a data processing method, a data processing device, electronic equipment and a computer readable storage medium, which are used for at least solving the technical problem that the transaction operation being executed by a target object is difficult to judge abnormally and intercept in the related technology.

According to an aspect of an embodiment of the present invention, there is provided a data processing method including: collecting historical transaction data and attribute data of a first target object; extracting transaction characteristics of the first target object according to historical transaction data and attribute data of the first target object; acquiring current transaction data of a second target object, wherein the current transaction data is transaction data corresponding to a transaction to be paid currently by the second target object; and predicting the probability that the current transaction data of the second target object is abnormal transaction data according to the transaction characteristics of the first target object to obtain the probability that the current transaction data of the second target object is abnormal transaction data.

Optionally, the extracting the transaction feature of the first target object according to the historical transaction data and the attribute data of the first target object includes: determining transaction types of the historical transaction data, and respectively storing the historical transaction data into corresponding transaction types; extracting a predetermined number of transaction categories according to a predetermined rule; and extracting the transaction characteristics of the first target object according to the transaction categories of the preset number and the attribute data.

Optionally, the determining transaction categories of the historical transaction data and storing the historical transaction data into corresponding transaction categories respectively includes: extracting the transaction amount of the historical transaction data and the transferred account name of the historical transaction data; distributing corresponding weight to the historical transaction data according to the transaction amount of the historical transaction data; and determining the transaction types of the historical transaction data according to the transferred account names of the historical transaction data, and respectively storing the historical transaction data distributed with corresponding weights into the corresponding transaction types.

Optionally, the predicting, according to the transaction characteristics of the first target object, the probability that the current transaction data of the second target object is abnormal transaction data to obtain the probability that the current transaction data of the second target object is abnormal transaction data includes: acquiring the transaction amount of the current transaction data of the second target object and the transferred account name of the current transaction data of the second target object; predicting the probability that the current transaction data of the second target object is abnormal transaction data according to the transaction characteristics of the first target object, the transaction amount of the current transaction data of the second target object and the transfer account name of the current transaction data of the second target object, and obtaining the probability that the current transaction data of the second target object is abnormal transaction data.

Optionally, the predicting, according to the transaction characteristics of the first target object, the probability that the current transaction data of the second target object is abnormal transaction data to obtain the probability that the current transaction data of the second target object is abnormal transaction data includes: inputting the transaction characteristics of the first target object into a transaction security model, predicting the probability that the current transaction data of the second target object is abnormal transaction data, and obtaining the probability that the current transaction data of the second target object is abnormal transaction data, wherein the transaction security model is obtained by training an initial model by adopting a sample set, the sample set comprises a positive sample set and a negative sample set, and the positive sample set comprises: a plurality of sets of normal transaction data, the negative sample set comprising: multiple sets of anomalous transaction data.

Optionally, the predicting, according to the transaction characteristics of the first target object, the probability that the current transaction data of the second target object is abnormal transaction data, and after obtaining the probability that the current transaction data of the second target object is abnormal transaction data, the method further includes at least one of the following: when the probability that the current transaction data of the second target object is abnormal transaction data is smaller than a first preset threshold value, reminding the second target object that the current transaction to be paid is at risk; when the probability that the current transaction data of the second target object is abnormal transaction data is smaller than a second preset threshold value and is larger than or equal to a first preset threshold value, adopting payment verification when the second target object pays the current transaction to be paid; and under the condition that the probability that the current transaction data of the second target object is abnormal transaction data is greater than or equal to a second preset threshold value, prohibiting the second target object from paying the current transaction to be paid.

According to an aspect of an embodiment of the present invention, there is provided a data processing apparatus including: the acquisition module is used for acquiring historical transaction data and attribute data of the first target object; the extraction module is used for extracting the transaction characteristics of the first target object according to the historical transaction data and the attribute data of the first target object; the acquisition module is used for acquiring current transaction data of a second target object, wherein the current transaction data is transaction data corresponding to a transaction to be paid currently by the second target object; and the prediction module is used for predicting the probability that the current transaction data of the second target object is abnormal transaction data according to the transaction characteristics of the first target object to obtain the probability that the current transaction data of the second target object is abnormal transaction data.

According to an aspect of an embodiment of the present invention, there is provided an electronic apparatus including: a processor; a memory for storing the processor-executable instructions; wherein the processor is configured to execute the instructions to implement the data processing method of any one of the above.

According to an aspect of the embodiments of the present invention, there is provided a computer-readable storage medium, wherein instructions of the computer-readable storage medium, when executed by a processor of an electronic device, enable the electronic device to perform any one of the data processing methods described above.

According to an aspect of an embodiment of the present invention, there is provided a computer program product comprising a computer program which, when executed by a processor, implements the data processing method of any one of the above.

In the embodiment of the invention, historical transaction data and attribute data of the first target object are collected, the transaction characteristics of the first target object are extracted according to the historical transaction data and the attribute data of the first target object, and then the abnormal transaction probability of the transaction data corresponding to the current transaction to be paid of the second target object can be predicted according to the transaction characteristics, so that the probability that the current transaction data of the second target object is the abnormal transaction data is obtained. The abnormity prediction is carried out according to the transaction characteristics of the first target object, and the transaction characteristics are obtained according to the historical transaction data and the attribute data of the first target object, so that the abnormity prediction is more pertinent, the characteristics of the first target object can be reflected, the abnormity prediction can be carried out timely and accurately, and the technical problem that the abnormity judgment and the interception of the transaction operation which is executed by the target object in the related technology are difficult to carry out is solved.

Drawings

The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this application, illustrate embodiment(s) of the invention and together with the description serve to explain the invention without limiting the invention. In the drawings:

FIG. 1 is a flow diagram of a data processing method according to an embodiment of the invention;

FIG. 2 is a schematic diagram of user features provided by an alternative embodiment of the present invention;

FIG. 3 is a schematic diagram of four core functional modules in an anti-exception transaction model provided by an alternative embodiment of the present invention;

fig. 4 is a block diagram of a data processing apparatus according to an embodiment of the present invention.

Detailed Description

In order to make the technical solutions of the present invention better understood, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

It should be noted that the terms "first," "second," and the like in the description and claims of the present invention and in the drawings described above are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the invention described herein are capable of operation in sequences other than those illustrated or described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.

Example 1

In accordance with an embodiment of the present invention, there is provided an embodiment of a data processing method, it should be noted that the steps illustrated in the flowchart of the accompanying drawings may be performed in a computer system such as a set of computer executable instructions, and that while a logical order is illustrated in the flowchart, in some cases, the steps illustrated or described may be performed in an order different than that herein.

Fig. 1 is a flowchart of a data processing method according to an embodiment of the present invention, as shown in fig. 1, the method including the steps of:

step S102, collecting historical transaction data and attribute data of a first target object;

step S104, extracting transaction characteristics of the first target object according to the historical transaction data and the attribute data of the first target object;

step S106, acquiring current transaction data of the second target object, wherein the current transaction data is transaction data corresponding to the current transaction to be paid by the second target object;

step S108, predicting the probability that the current transaction data of the second target object is abnormal transaction data according to the transaction characteristics of the first target object, and obtaining the probability that the current transaction data of the second target object is the abnormal transaction data.

Through the steps, historical transaction data and attribute data of the first target object are collected, the transaction characteristics of the first target object are extracted according to the historical transaction data and the attribute data of the first target object, and then the abnormal transaction probability of the transaction data corresponding to the current transaction to be paid of the second target object can be predicted according to the transaction characteristics, so that the probability that the current transaction data of the second target object is abnormal transaction data is obtained. The abnormity prediction is carried out according to the transaction characteristics of the first target object, and the transaction characteristics are obtained according to the historical transaction data and the attribute data of the first target object, so that the method has pertinence, can embody the characteristics of the first target object, ensures that the abnormity prediction can be carried out timely and accurately, and further solves the technical problem that the abnormity judgment and the interception of the transaction operation which is being executed by the target object are difficult in the related technology.

First, it should be noted that, the first target object is the owner of the terminal device, and the second target object is a user who performs a transaction operation on the terminal device, because there may be a situation of surreptitious payment, and the like, the user is not necessarily the owner of the terminal device, that is, the second target object may not be the first target object, and when the probability that the current transaction data of the second target object is abnormal transaction data is predicted, whether the current transaction data is abnormal transaction data or not may be predicted by taking such a factor into consideration. The historical transaction data may include consumption data, revenue data, asset data, behavior data, etc. of the owner of the terminal device, i.e. the first target object. The attribute data may include basic information of the owner, i.e., the first target object, to which the terminal device corresponds, such as age, occupation, natural human relationship, education level, place of residence, and the like. The transaction characteristics are various characteristics which can be obtained according to the historical transaction data and the attribute data of the first target object, and for better description, the various characteristics can also be factual characteristics, primary characteristics and advanced characteristics, wherein the factual characteristics are characteristics which can be directly obtained from the historical transaction data and the attribute data, such as complaint frequency characteristics, purchase frequency characteristics and the like. The preliminary characteristics are further analyzed based on factual characteristics, such as product preference characteristics, shopping interest characteristics, and the like. The high-level features are further summarized according to the primary features, such as consumption capability features, crowd attribute features, and the like. The multiple different levels of features can play different roles, for example, the fact features can reflect the substantial behavior of the first target object to a great extent, the preliminary features summarize the behavior of the first target object, the transaction risk of the first target object can be better predicted according to the features, and the advanced features can ensure that the transaction risk can not deviate from the large range when being predicted. Therefore, through setting of various characteristics, the behavior of the first target object can be reflected in a wider range and in multiple dimensions, and the accuracy of prediction is guaranteed on the basis of guaranteeing the prediction according to the pertinence of the first target object.

As an alternative embodiment, historical transaction data of the first target object is collected, as well as attribute data. The collected historical transaction data and attribute data of the first target object can be obtained through various channels, for example, under the condition that authorization permission of the first target object is obtained, the historical transaction data and the attribute data can be obtained automatically according to a behavior log, a network log and the like of the first target object. The method comprises the steps of collecting historical transaction data of a first target object and attribute data so as to describe characteristics of the first target object aiming at the target object to perform personalized setting.

As an alternative embodiment, the transaction characteristics of the first target object are extracted according to the historical transaction data of the first target object and the attribute data. The transaction characteristics of the first target object are extracted not only according to the dynamic historical transaction data of the first target object, but also according to the static attribute data of the first target object. The method and the device ensure that the transaction characteristics of the first target object are extracted in a multi-dimensional manner in all aspects, so that the extracted transaction characteristics of the first target object are more accurate.

As an optional embodiment, when the transaction characteristics of the first target object are extracted according to the historical transaction data and the attribute data of the first target object, the transaction characteristics of the first target object may be extracted in a plurality of ways, for example, by determining the transaction types of the historical transaction data, respectively storing the historical transaction data in the corresponding transaction types, and then extracting a predetermined number of transaction types according to a predetermined rule, so that the transaction characteristics of the first target object may be extracted according to the predetermined number of transaction types and the attribute data. Through the steps, the historical transaction data can be classified firstly, so that more accurate transaction characteristics can be extracted according to the classified historical transaction data.

The historical transaction data can be classified in various ways when the transaction category of the historical transaction data is determined, for example, consumption data can be extracted from the historical transaction data, expenses are classified in detail, and the expenses are subdivided into investment financing, credit card loan repayment, third-party payment, learning promotion, online and offline entertainment, online shopping, catering outsourcing, renting, house lending, decoration, living payment, communication internet surfing, traffic tourism, medical fitness, public welfare red envelope and the like. The above categories may be transaction categories. However, when the number of transaction categories is too large, it is not favorable for extracting transaction characteristics, and therefore, the number of transaction categories may be set to, for example, 5 or more and 10 or less. Therefore, the above categories can be combined and classified into 5 categories, namely, living payment, medical fitness, catering takeout, online shopping super-business and others. Namely, a predetermined number of transaction categories are selected for better extraction of transaction characteristics.

It should be noted that, when the predetermined number of transaction categories are selected, the selection may also be performed according to a predetermined rule, for example, the consumption data in the historical transaction data may be subdivided, and then 5 to 10 categories with the largest consumption amount may be extracted as the transaction categories. Or, the consumption amount can be comprehensively selected according to the consumption frequency. Alternatively, the transaction categories are formulated empirically. The setting is not carried out, and the user-defined setting can be carried out according to the actual application and the scene so as to better meet the requirements of the scene and realize more accurate feature extraction under the specific scene.

As an alternative embodiment, after determining the transaction categories, the historical transaction data are stored in the corresponding transaction categories, and at this time, the following operation may be performed: the transaction amount of the historical transaction data and the transferred account name of the historical transaction data are extracted, corresponding weight is distributed to the historical transaction data according to the transaction amount of the historical transaction data, the weight which is larger in amount can be set to be higher, the weight which is smaller in amount can be set to be smaller, and the weight can be set according to actual application, so that the historical transaction data stored in the transaction category carries the weight, and the historical transaction data is more suitable for actual life. And determining the transaction types of the historical transaction data according to the transferred account names of the historical transaction data, and respectively storing the historical transaction data distributed with corresponding weights into the corresponding transaction types. The historical transaction data in each transaction category has different weights, and more accurate transaction characteristics can be extracted according to the different weights.

It should be noted that, when the historical transaction data assigned with the corresponding weight is stored in the corresponding transaction category, the weight value of the transaction category may also be set, that is, not only the historical transaction data has a weight value, but also the transaction category may also be set with a weight value. Different transaction categories can have certain weight, for example, the influence caused by eating a lunch in 300 yuan and using the last training course in 1000 yuan is different, so that different weights are set, and the feature extraction and the abnormal transaction judgment are facilitated.

As an optional embodiment, according to the transaction characteristics, when the probability that the current transaction data of the second target object is the abnormal transaction data is obtained by predicting the probability that the current transaction data of the second target object is the abnormal transaction data, the following method may be used: and predicting the probability that the current transaction data of the second target object is abnormal transaction data according to the transaction characteristics of the first target object, the transaction amount of the current transaction data of the second target object and the transferred account name of the current transaction data of the second target object to obtain the probability that the current transaction data of the second target object is abnormal transaction data. In short, that is, according to the behavior habit of the first target object, the current transaction is compared with the historical transaction, and whether the second target object is the first target object or not and whether the current transaction of the second target object is abnormal or not is judged. Optionally, in the process of calculating the probability, a machine learning gradient descent algorithm GBDT, a light GBM algorithm, and an XGBoost algorithm may be used to calculate and predict the probability. The calculated probability is more accurate and is real and credible.

As an optional embodiment, according to the transaction characteristics, predicting the probability that the current transaction data of the second target object is the abnormal transaction data, and when obtaining the probability that the current transaction data of the second target object is the abnormal transaction data, inputting the transaction characteristics into the transaction security model, predicting the probability that the current transaction data of the second target object is the abnormal transaction data, and obtaining the probability that the current transaction data of the second target object is the abnormal transaction data, wherein the transaction security model is obtained by training the initial model using a sample set, the sample set includes a positive sample set and a negative sample set, and the positive sample set includes: multiple sets of normal transaction data, the negative sample set comprising: multiple sets of anomalous transaction data. Because the transaction security model is continuously trained by the positive and negative sample sets, the accuracy of prediction can be ensured. The transaction security model mentioned in this alternative embodiment is not described in detail here, and in the alternative embodiment described below, the anti-exception transaction model is described in detail.

As an alternative embodiment, a plurality of thresholds may be set for the probability, and a plurality of different processing methods may be adopted. Specifically, in the case that the probability is smaller than the first predetermined threshold, that is, the probability that the second target object is not the first target object is low, and/or the risk degree of the current transaction is low, in this case, the first target object is reminded that there is a risk in the current transaction to be paid, the first target object is reminded to further determine the payment operation, or whether the payment operation is the own payment operation is confirmed. When the probability is smaller than a second preset threshold and is larger than or equal to a first preset threshold, namely the probability that the second target object is not the first target object is medium, and/or the risk of the current transaction is medium, the payment verification is adopted when the second target object pays the current transaction to be paid; the payment verification mode can comprise a single mode or a plurality of combined authentication modes such as face three-dimensional identification, fingerprint identification, voice identification, signature identification, passwords, U shield, electronic cipherers, short message verification codes, reservation problems and the like. When the payment verification mode is used, the multiple payment verification modes can be displayed in a micro-service mode, combined verification can be performed, expandability is realized, the verification modes can be deleted in a new adding and adjusting mode, the service realization of other authentication modes is not influenced, extra workload is not increased, and the requirements of multiple scenes and services can be met. And under the condition that the probability is greater than or equal to a second preset threshold value, namely the probability that the second target object is not the first target object is higher, and/or the risk degree of the current transaction is higher, forbidding the second target object to pay the current transaction to be paid, and carrying out a safety reminding mode in the form of short messages or telephones, so that the property safety of the owner is protected in various ways under different conditions.

Based on the above embodiments and alternative embodiments, an alternative implementation is provided, which is described in detail below.

The invention provides a method for establishing a user portrait model based on artificial intelligence to provide security service. In an optional embodiment of the present invention, the user mentioned in the description corresponds to the first target object, and when it is determined whether the transaction is an abnormal transaction according to the current transaction data, the user mentioned in this section corresponds to the second target object mentioned above, and there may be a case where the second target object is verified as the first target object.

According to the optional implementation mode, multi-dimensional identification and analysis are carried out through the historical transaction data, the attribute data and the like of the user, the characteristics of the user can be better acquired, the transaction characteristics of the user can be accurately extracted, the personalized consumption safety service is customized by establishing the adaptive dynamic double-layer abnormal transaction identification model changing according to the time dimension, the personalized safety service is better provided for the user, suspicious transactions are efficiently identified and intercepted, and the safety, reliability, easiness and convenience in the payment field are realized.

Constructing a user portrait, namely extracting transaction characteristics of the user:

the user representation is constructed from historical transaction data, such as: historical transaction information and common operation functions of users, transaction data are processed through corpus artificial intelligence, supervised learning of machine learning is carried out, consumption classification is carried out, data characteristic values are extracted, an adaptive dynamic double-layer user portrait changing along with time dimensions is established through artificial intelligence, the user characteristic values with high relevance are selected, and personalized consumption safety services are customized.

The core work of user portrait is to extract the user features, fig. 2 is a schematic diagram of the user features provided by the alternative embodiment of the present invention, and as shown in fig. 2, the user features may be presented in the form of a label, that is, the label may be understood as a manually specified highly refined feature identifier. Each label describes one dimension of the user, the dimensions are mutually linked to form an integral description of the user, the information overview of the user can be abstracted, namely the transaction characteristics of the user are extracted, and the user portrait of the user is constructed equivalently.

It should be noted that, when constructing the tag, the granularity of the tag is not suitable for fine-grained. The granularity is too fine, so that the label system is too complex and has no universality, and the label system is changed along with the development of services, so that the labels can be layered to construct labels of different layers.

In an alternative embodiment of the invention, users are tagged by refining their historical transaction data, as well as attribute data. The general steps for tagging a user are as follows:

and S1, collecting attribute data of the user, wherein the attribute data comprises the age, occupation, income, housing, automobile, natural human relation and the like of the user.

S2, collecting user historical transaction data, comprising: assets, investments, transaction information, user-used operational functions, etc.

And S3, extracting and cleaning the collected historical transaction data and attribute data of the user.

And S4, extracting the transaction characteristics of the user from the data after the extraction and the cleaning.

It should be noted that, when the transaction characteristics of the user are extracted, a KNN (K-nearest neighbor) algorithm may be used to intelligently analyze the income and expense of the user and refine the expense and income characteristics of the user, and then an artificial intelligent BP (back propagation, a multi-layer feed-forward neural network based on an error back propagation algorithm) neural network algorithm is used to extract the transaction characteristics of the user. The user portrait can be constructed by models such as Neural network cnn (proportional Neural networks), recurrent Neural networks rnn (recurrent Neural networks), and the like, without being limited to the use of the BP Neural network algorithm.

It should also be noted that there are various transaction characteristics that can be extracted according to the above data, for example: population characteristics: gender, age, territory, education level, date of birth, occupation, constellation; interest characteristics: hobbies, App/website usage, browsing/collecting content, interactive content, brand preferences, product preferences; social characteristics: marital status, family status, social/information channel preferences; consumption characteristics: income status, purchasing power level, purchased goods, purchasing channel preference, last purchasing time, and purchasing frequency.

Because the data can be extracted from a plurality of characteristics, the conditions of calculated amount, service requirements, difficulty in construction and the like are considered comprehensively, and the optional embodiment of the invention provides a mode for constructing the priority of various characteristics. Fig. 3 is a schematic diagram of a priority ranking method according to an alternative embodiment of the present invention, and as shown in fig. 3, the priority ranking method is mainly constructed according to the difficulty level of construction and the dependency relationship of various features. According to the scene and the requirement of practical application, characteristics of different levels can be selected to predict abnormal transactions.

Taking consumption characteristics as an example, data takes users as dimensions, a sparse matrix and a graph database node4j are used for combining and establishing branch storage consumption type characteristic values according to consumption types, the diagonal of the sparse matrix is used for representing characteristic value weight, the consumption type sparse matrix is coded in a one-hot (one-hot code) mode for storing the total amount according to the consumption types, the graph database node4j stores each consumption record of branches according to the consumption types, the characteristic value weight calculation accumulation result is stored in the diagonal of the sparse matrix, user characteristics are described, a user portrait is constructed, and efficiency is improved. In this manner, update computations can be reduced, thereby speeding up computations, and if new consumption characteristics are discovered through machine learning deep learning, updating is facilitated without performing computations all over again. The following is illustrated by way of example:

s1, determining the transaction types of the historical transaction data of the user, and respectively storing the historical transaction data into the corresponding transaction types;

for example, the consumption data is extracted from the historical transaction data, the expenses are classified in detail, and the expenses are subdivided into investment financing, credit card loan repayment, third-party payment, learning promotion, online and offline entertainment, online shopping, catering outsourcing, renting, house lending, decoration, life payment, communication online, traffic travel, medical treatment and body building, public welfare red envelope and the like. And extracting the service of the consumption class, wherein the K value represents the classification represented by the consumption record, the selection of the K value verifies that the number is not suitable for too much, and the K value is more than or equal to 5 and less than or equal to 10. Therefore, the combination of the above-mentioned materials is classified into 5 types, namely K is 5, including living payment, medical treatment and body building, catering and takeout, online shopping and others.

For example, monthly consumption data for one user is as follows: and (4) consuming for 4628 yuan. A-APP-takeaway 205 Yuan; B-APP-takeaway 104 Yuan; C-APP-traffic card recharge 100 yuan; d card-medical 90 yuan; 58 yuan for B-APP-F supermarket; 276 Yuan … supermarket B-APP-G

And through the supervised learning of machine learning on the text, the consumption data are automatically divided into the K transaction types by big data artificial intelligence, and the consumption data are respectively stored into the corresponding transaction types.

1. The online shopping rate is 58+276+ …, and the total number is 2617 yuan. 58 yuan for B-APP-F supermarket; 276 Yuan … supermarket B-APP-G

2. The restaurant take-out 205+104+ … totals 1516 yuan. A-APP-takeaway 205 Yuan; B-APP-takeaway 104 Yuan …

3. The life payment is 100 yuan. The C-APP-traffic card is charged with 100 yuan.

4. The medical body-building 90 is 90 yuan in total. D card-medical 90 yuan.

5. The others amount to 305 yuan.

When the big data artificial intelligence automatically divides the consumption data into transaction categories, intelligent judgment can be carried out according to the account name.

For example, several transaction data for a user are as follows:

roll-out account number 203120277484154XXXXXX is an account for the user,

transfer to account 145xxxxxxxxxxxx is a restaurant take-away account.

The transfer amount is 205 dollars.

The consumption data are stored in a graph database node4j, and are intelligently divided into catering takeouts according to the types of accounts to be transferred, and the catering takeouts are added to the transaction types. And setting corresponding weight according to the transfer amount, and updating the values of the node4j and the sparse matrix.

It should be noted that K is set to 5, and when the above classification is performed, the following consumption data are added to the account details of the user:

roll-out account number 203120277484154XXXXXX is an account for the user,

transfer to account 175xxxxxxxxxxxxxx is a child park account.

The transfer amount is 1999 yuan.

Roll-out account number 203120277484154xxxxxx is the user's account,

transfer to account 158xxxxxxxxxxxxxx is a child apparel account.

The transfer amount is 324 dollars.

The consumption data is stored in a graph database node4j, the consumption data is intelligently divided into childbearing expenses according to the type of transferred accounts, children are intelligently judged to exist, and a transaction type child childbearing is added. And setting corresponding weight according to the transfer amount, updating the values of the node4j and the sparse matrix, avoiding repeated calculation of data and realizing automatic updating of K.

And S2, extracting the transaction characteristics of the first target object according to the consumption data in the transaction category and the attribute data.

The trade characteristics of the first target object may be extracted using a kmeans (K-means clustering algorithm, a clustering analysis algorithm for iterative solution) clustering algorithm.

It should be noted that, in the above processing, the problem of noise is also avoided, and the problem of inaccurate transaction feature extraction caused by the confusion of audio and video due to various types of consumption is also avoided. The noise problem can be solved using several methods as follows.

1) Classification and storage of transaction categories for special consumption, e.g., for occasional large consumption by the user of a certain consumption type, is not performed because the consumption data is not predictive.

2) And classifying the total consumption amount of the user. The transaction category of which the monthly consumption average sum does not exceed the first threshold of 1000 yuan is directly classified into the low consumption transaction category without subsequent classification analysis. The first threshold value can be flexibly set according to the transaction type and the actual application scene.

3) On the basis of meeting the condition 2), a greedy algorithm is used, if the number of the low-consumption transaction categories exceeds 3, the transaction categories with the sum of money of more than 0.8 in each transaction category in the low-consumption transaction categories are determined according to the sequence of the sum of money from large to small, the transaction categories are classified again, the predetermined number of the transaction categories after being classified again is selected for subsequent processing, and the consumption of other types is directly set to be 0 in a sparse matrix, namely, the processing is not performed, so that the calculation amount is reduced.

And S3, predicting the probability that the current transaction data of the second target object is abnormal transaction data according to the transaction characteristics to obtain the probability that the current transaction data of the second target object is abnormal transaction data.

When the probability that the current transaction data of the second target object is abnormal transaction data is predicted according to the transaction characteristics, different influence coefficients can be set for the data of different transaction characteristics, and the value of the influence coefficients can be determined according to the amount of money. The following is illustrated by way of example:

the transaction characteristics of a certain transaction type of each user are calculated, for example, in the transaction category of learning promotion, the benefit class is consumed once a month, the influence coefficient is high, and for example, the initial value is set to 10. For example, in the transaction category of the online shopping supermarket, 30 times of consumption may be consumed in 20 days per month, the influence coefficient is low, and the initial value is set to 1.5.

The base influence coefficient g (x) is poly, and the least squares method performs polynomial fitting.

It should be noted that the data characteristic of the basic influence coefficient is that 1-5 convergence is faster, 6-10 convergence is slower, and 10 convergence is slightly reduced and approaches to 1.

The n transferred account names of the recent and user consumption data are also used as characteristic values, and the transferred account names with too frequent transaction are identified by clustering, so that whether group abnormal behaviors exist can be intelligently identified.

For example, setting:

in the same day of consumption superimposition, the influence coefficient is also superimposed G (xn) ═ G (xn-1) × (1+ a), where a is set to 20% as the initial value and a may be a function related to time, but is simply set to a fixed value in consideration of the amount of calculation and the yield.

By dynamically adjusting the impact coefficients based on the number of payments in the month, the probability of suspicious transactions increases for multiple times of the day. The consumption limit calculation formula for the last time of the day is as follows:

wherein E (x) is the predicted value of the transaction category in the current month

The user's cumulative value for the transaction category on the current day of the month. b is a floating factor and is determined according to the absolute value of the difference between the user predicted value E (x) and the history highest value Cmax and an adjusting parameter d. The preset adjustment parameter d is 0.8, which represents consumption floating, and the value of the user d with larger consumption floating can be set higher. It is known that b ═ e (x) -Cmax |/(Cmax × d). From this, the last consumption limit of the day can be calculated.

Taking the transaction category as the online shopping super as an example, the following description is given by way of example: a user has consumed 4 times of the day, 106, 340, 112, 350 respectively, for an average 30 super-generic consumptions per month over the last 12 months, for half a month except today's cumulative consumption of 3708 dollars. And judging whether 167 yuan for the fifth time ready consumption can exceed the limit, and 4106 yuan for the prospective consumption of the seller in the month. The business superclass consumption is highest 9836 yuan in the last 12 months. Using the formula, 4106 | (|4106 |)/(9836 × 0.8)) -3708-. And the quota is not exceeded, and the normal consumption can be realized.

That is, the transaction amount of the current payment transaction is within the limit, and therefore, the probability that the current transaction data is abnormal transaction data is 0.

If the transaction amount of the current payment transaction is outside the limit amount, different probabilities that the current transaction data is abnormal transaction data can be obtained according to the degree that the transaction amount is outside the limit amount, a plurality of threshold values are set for the probabilities, and a plurality of different processing methods are adopted.

By the method, the expected consumption is intelligently and flexibly calculated, the flexible consumption misjudgment is reduced, and the probability of suspicious transactions is dynamically increased for continuous consumption. The game recharging class is added with weight, so that the conditions of stealing brushing and the like of children are prevented. And managing and controlling the payment amount. The account number of the old man is intelligently identified, and the contact person is informed when the old man pays in large amount. The users with frequent transactions can help intelligently identify whether abnormal behaviors exist through clustering identification. And sealing and killing the account with abnormal behaviors. Making the transaction more secure and reliable.

It should be noted that, when the transaction amount of the current payment transaction is within the limit, and therefore, the probability that the current transaction data is abnormal transaction data is 0, the probability may be predicted not only by using the above algorithm according to the floating degree of the transaction amount in the limit, but also by combining with an abnormal transaction model:

the anti-anomaly transaction model, i.e. corresponding to the transaction security model described above:

the general anti-anomaly transaction model adopted by the optional embodiment of the invention is obtained by training an initial model by adopting a sample set, wherein the sample set comprises a positive sample set and a negative sample set, and the positive sample set comprises: multiple sets of normal transaction data, the negative sample set comprising: multiple sets of anomalous transaction data. The multiple sets of abnormal transaction data can be obtained by learning known unauthorized payment samples and case data to form a basic abnormal list through an artificial intelligence classification algorithm.

On the basis, the abnormal transaction model combines a knowledge graph technology, an ada boost algorithm, a classification algorithm and a clustering algorithm, and ensures the abnormal transaction identification capability of the model provided by the optional embodiment of the invention. The knowledge graph technology can be used for analyzing the special attributes of the payment account, the ada boost algorithm can be used for weighting the multi-layer model to integrate and comprehensively evaluate the probability of transaction risk of the user, the classification algorithm and the clustering algorithm find out the implicit common features in the data through global analysis and high-dimensional spatial clustering, the technical capability of finding and identifying abnormal transactions can be improved, and the abnormal website can be intercepted.

Various technologies used in the anomalous transaction model provided in alternative embodiments of the present invention are used in a plurality of modules, which are combined with each other to ensure the anomalous transaction identifying capability of the anomalous transaction model. Wherein, the anti-abnormal transaction model has four core function modules in common: the system comprises an abnormal list module, an abnormal transaction model module, a knowledge base module based on a knowledge graph and an abnormal website intercepting module. Fig. 2 is a schematic diagram of four core function modules in the anomalous transaction model provided in the alternative embodiment of the present invention, and as shown in fig. 2, the following describes in detail the four core function modules in the anomalous transaction model provided in the alternative embodiment of the present invention:

(1) an exception list module:

and a classification algorithm and a clustering algorithm are adopted, an abnormal list and slight abnormal list mechanism is optimized, and the technical capability of discovering and identifying abnormal transactions is improved.

Specifically, the abnormal list and the light abnormal list can be imported through various channels, wherein the abnormal list and the light abnormal list can form a basic abnormal list and a light abnormal list for the known case data. And the classification algorithm analyzes and predicts the abnormal transaction risk of the new behavior event through an abnormal list and a slight abnormal list. On the basis, the implicit common characteristics in the data are found out under the condition of normal transaction sample data by combining a clustering algorithm through global analysis and high-dimensional spatial clustering, so that automatic discovery of large-scale management abnormal transactions is completed. Through the mutual combination of the two machine learning algorithms, the technical capability of discovering and identifying abnormal transactions can be effectively improved, and accurate early warning is realized.

(2) The abnormal transaction module:

integrating the three-layer submodels by adaptively improving the ada boost algorithm weighting, predicting risk scores and comprehensively evaluating the probability of transaction risk of the user. The three-layer model comprises a login submodel, an account opening submodel and a transaction submodel.

Logging in a sub-model: and applying a decision tree machine learning algorithm to construct a login sub-model through the characteristics of multi-terminal login, off-site login, login site number, login time and the like.

Opening an account sub-model: and establishing an account opening sub-model through the historical account opening times, the historical card changing times and the historical loss reporting times of the user.

A transaction submodel: and constructing a transaction submodel through user large-amount transactions, frequent transactions and fast forward and fast out times.

When the ada boost algorithm weighting is adaptively improved to integrate the three-layer submodel, the characteristics of normal transactions and abnormal transactions (the abnormal transactions comprise credit card embezzlement, non-cardholder game recharging and the like) presented in mass data need to be understood according to specific business and industry historical cases, so that the three-layer submodel is accurately distinguished from various dimensions. Specifically, it needs to make calculation of various characteristics and derived variables, such as the frequency of card swiping in unit time of the user, the deviation of the credit and density of card swiping compared with the historical total amount, the distribution quantile of the transaction amount, the general transaction time and place, terminal information, whether to inquire in advance before large amount transaction and small amount test, etc. And then combining the features by using the model, performing parameter tuning, and training the optimal combination of feature dimensions according to the historical template to form an optimal model.

(3) Knowledge base module based on knowledge map:

and sharing and establishing an abnormal number, an abnormal card and an abnormal list of the IP, and establishing a knowledge base so as to identify the special attribute of the payment account.

In particular, identifying the specific attributes of the payment account also emphasizes including identifying consumption that is not sensible in common. Combining a generated corpus and an existing corpus such as a jieba (open source database) through a Bert (bidirectional encoder representation based on a Transformer) training model pre-training, extracting keywords of the account name in the consumption record, and identifying special attribute analysis of the payment account by using an existing training set and using text NLP (neural-linear Programming) artificial intelligence analysis.

Non-authentication transactions of various network channel modes such as credit card embezzlement and APP (application) are identified through analysis, for example, continuous large-amount transactions are usually caused by credit card embezzlement.

(4) An abnormal website intercepting module:

the method is mainly based on a machine learning classification and clustering method to intercept payment operations in abnormal websites.

Specifically, the classification method: after the normalization processing is carried out on the sample data, a classifier is constructed to identify whether the sample data is abnormal: firstly, extracting static characteristics (host, URL, webpage information and the like) and dynamic characteristics (browser behaviors, webpage jump relations and the like) according to a marked URL data set, normalizing the extracted characteristics, and then constructing a classifier through an algorithm to identify abnormal websites. Taking detection and identification of an abnormal website as an example, on the basis of extracting multiple characteristic attributes such as a title, a keyword, a page tag element and the like of a target website, direct characteristic distances between the target website and website samples in an abnormal resource template library are calculated, and direct similarity between the target website and the website samples is judged. And intercepting the similarity exceeding a threshold value.

Specifically, the clustering method: firstly, extracting characteristics such as a link relation table, URL characteristics, webpage text information and the like from URL data sets acquired by webpages, constructing a multidimensional space vector with characteristics such as login time, browser type, IP address, GPS address, nickname modification and the like according to characteristics of similar distances of abnormal behaviors on the multidimensional space vector, and clustering the suspected abnormal behaviors or accounts into a group by using a clustering algorithm and extracting common information of the group to generate training data.

The method can be combined with an abnormal transaction model to carry out more comprehensive and multidimensional prediction.

And S4, adopting multiple safety authentication modes for the transaction suspected to be abnormal.

Multiple thresholds are set for the probabilities, using a variety of different processing methods.

Specifically, in the case that the probability is smaller than the first predetermined threshold, that is, the probability that the second target object is not the first target object is low, and/or the risk degree of the current transaction is low, in this case, the first target object is reminded that there is a risk in the current transaction to be paid, the first target object is reminded to further determine the payment operation, or whether the payment operation is the own payment operation is confirmed. When the probability is smaller than a second preset threshold and is larger than or equal to a first preset threshold, namely the probability that the second target object is not the first target object is medium, and/or the risk of the current transaction is medium, the payment verification is adopted when the second target object pays the current transaction to be paid; the payment verification mode can comprise a single mode or a plurality of combined authentication modes such as face three-dimensional identification, fingerprint identification, voice identification, signature identification, passwords, U shield, electronic cipherers, short message verification codes, reservation problems and the like. When the payment verification mode is used, the multiple payment verification modes can be displayed in a micro-service mode, combined verification can be performed, expandability is realized, the verification modes can be deleted in a new adding and adjusting mode, the service realization of other authentication modes is not influenced, extra workload is not increased, and the requirements of multiple scenes and services can be met. And under the condition that the probability is greater than or equal to a second preset threshold value, namely the probability that the second target object is not the first target object is higher, and/or the risk degree of the current transaction is higher, forbidding the second target object to pay the current transaction to be paid, and carrying out a safety reminding mode in the form of short messages or telephones, so that the property safety of the owner is protected in various ways under different conditions.

Through the above alternative embodiment, at least the following advantages can be achieved:

(1) the acquired historical transaction data and the attribute data are identified, the historical transaction data are firstly processed by combining a KNN classification algorithm, then the transaction characteristics of the user are extracted through kmeans, and compared with the method of directly extracting the transaction characteristics of the user by simply using a kmeans clustering algorithm, the method has better accuracy and flexibility and avoids the interference of error data.

(2) The method has the advantages that the transaction characteristics of the user are extracted, namely when the portrait of the user is constructed, the sparse matrix mode is adopted, noise optimization processing is carried out, the calculation efficiency is improved, and the accuracy of the transaction characteristics of the user is extracted.

(3) And dynamically adjusting the threshold value, and intelligently intercepting abnormal transactions. The game recharging class is added with weight, so that the conditions of stealing brushing and the like of children are prevented. And managing and controlling the payment amount. And for some old people accounts, the contact person is notified when the account is paid in large amount. The users with frequent transactions can help intelligently identify whether abnormal behaviors exist through clustering identification. The safety is improved.

(4) The transaction characteristics of the user have good expansibility, so that the user can be understood, and the behavior information of the user is used for personalized recommendation, personalized search and the like.

(5) The method has the advantages of efficiently meeting the personalized and differentiated user safety requirements in the Internet era, balancing convenience and user safety requirements, having high identification accuracy, monitoring and intercepting suspicious transactions in time, ensuring the account safety of the user, and having higher scale expandability and data reliability.

It should be noted that, for simplicity of description, the above-mentioned method embodiments are described as a series of acts or combination of acts, but those skilled in the art will recognize that the present invention is not limited by the order of acts, as some steps may occur in other orders or concurrently in accordance with the invention. Further, those skilled in the art should also appreciate that the embodiments described in the specification are preferred embodiments and that the acts and modules referred to are not necessarily required by the invention.

Through the above description of the embodiments, those skilled in the art can clearly understand that the method according to the above embodiments can be implemented by software plus a necessary general hardware platform, and certainly can also be implemented by hardware, but the former is a better implementation mode in many cases. Based on such understanding, the technical solutions of the present invention may be embodied in the form of a software product, which is stored in a storage medium (such as ROM/RAM, magnetic disk, optical disk) and includes instructions for enabling a terminal device (such as a mobile phone, a computer, a server, or a network device) to execute the method according to the embodiments of the present invention.

Example 2

According to an embodiment of the present invention, there is also provided an apparatus for implementing the data processing method, and fig. 4 is a block diagram of a structure of the data processing apparatus according to the embodiment of the present invention, as shown in fig. 4, the apparatus includes: an acquisition module 402, an extraction module 404, an acquisition module 406, and a prediction module 408, which are described in more detail below.

An acquisition module 402, configured to acquire historical transaction data and attribute data of the first target object; an extracting module 404, connected to the collecting module 402, for extracting the transaction characteristics of the first target object according to the historical transaction data and the attribute data of the first target object; an obtaining module 406, connected to the extracting module 404, configured to obtain current transaction data of the second target object, where the current transaction data is transaction data corresponding to a transaction to be paid by the second target object currently; the predicting module 408 is connected to the obtaining module 406, and configured to predict, according to the transaction characteristics of the first target object, a probability that the current transaction data of the second target object is abnormal transaction data, so as to obtain a probability that the current transaction data of the second target object is abnormal transaction data.

It should be noted here that the above-mentioned acquisition module 402, extraction module 404, acquisition module 406 and prediction module 408 correspond to steps S102 to S108 in the implementation of the data processing method, and the implementation examples and application scenarios of the modules and the corresponding steps are the same, but are not limited to the disclosure of the above-mentioned embodiment 1.

Example 3

According to another aspect of the embodiments of the present invention, there is also provided an electronic device, including: a processor; a memory for storing processor executable instructions, wherein the processor is configured to execute the instructions to implement the data processing method of any of the above.

Example 4

According to another aspect of the embodiments of the present invention, there is also provided a computer-readable storage medium, wherein instructions of the computer-readable storage medium, when executed by a processor of an electronic device, enable the electronic device to perform any one of the data processing methods described above.

Example 5

According to another aspect of the embodiments of the present invention, there is also provided a computer program product, including a computer program, wherein the computer program is configured to implement any one of the data processing methods described above when executed by a processor.

The above-mentioned serial numbers of the embodiments of the present invention are merely for description and do not represent the merits of the embodiments.

In the above embodiments of the present invention, the descriptions of the respective embodiments have respective emphasis, and for parts that are not described in detail in a certain embodiment, reference may be made to related descriptions of other embodiments.

In the embodiments provided in the present application, it should be understood that the disclosed technology can be implemented in other ways. The above-described embodiments of the apparatus are merely illustrative, and for example, the division of the units may be a logical division, and in actual implementation, there may be another division, for example, multiple units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, units or modules, and may be in an electrical or other form.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention may be embodied in the form of a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a removable hard disk, a magnetic or optical disk, and other various media capable of storing program codes.

The foregoing is only a preferred embodiment of the present invention, and it should be noted that, for those skilled in the art, various modifications and decorations can be made without departing from the principle of the present invention, and these modifications and decorations should also be regarded as the protection scope of the present invention.

Claims

1. A data processing method, comprising:

collecting historical transaction data and attribute data of a first target object;

extracting transaction characteristics of the first target object according to historical transaction data and attribute data of the first target object;

acquiring current transaction data of a second target object, wherein the current transaction data is transaction data corresponding to a transaction to be paid currently by the second target object;

and predicting the probability that the current transaction data of the second target object is abnormal transaction data according to the transaction characteristics of the first target object to obtain the probability that the current transaction data of the second target object is abnormal transaction data.

2. The method of claim 1, wherein the extracting the transaction characteristics of the first target object according to the historical transaction data and the attribute data of the first target object comprises:

determining transaction categories of the historical transaction data, and respectively storing the historical transaction data into corresponding transaction categories;

extracting a predetermined number of transaction categories according to a predetermined rule;

and extracting the transaction characteristics of the first target object according to the transaction categories of the preset number and the attribute data.

3. The method of claim 2, wherein determining the transaction categories of the historical transaction data and storing the historical transaction data into the corresponding transaction categories respectively comprises:

extracting the transaction amount of the historical transaction data and the transferred account name of the historical transaction data;

distributing corresponding weight to the historical transaction data according to the transaction amount of the historical transaction data;

and determining the transaction types of the historical transaction data according to the transferred account names of the historical transaction data, and respectively storing the historical transaction data distributed with corresponding weights into the corresponding transaction types.

4. The method according to claim 1, wherein the predicting the probability that the current transaction data of the second target object is abnormal transaction data according to the transaction characteristics of the first target object to obtain the probability that the current transaction data of the second target object is abnormal transaction data comprises:

acquiring the transaction amount of the current transaction data of the second target object and the transferred account name of the current transaction data of the second target object;

predicting the probability that the current transaction data of the second target object is abnormal transaction data according to the transaction characteristics of the first target object, the transaction amount of the current transaction data of the second target object and the transfer account name of the current transaction data of the second target object, and obtaining the probability that the current transaction data of the second target object is abnormal transaction data.

5. The method of claim 1, wherein the predicting the probability that the current transaction data of the second target object is abnormal transaction data according to the transaction characteristics of the first target object to obtain the probability that the current transaction data of the second target object is abnormal transaction data comprises:

inputting the transaction characteristics of the first target object into a transaction security model, predicting the probability that the current transaction data of the second target object is abnormal transaction data, and obtaining the probability that the current transaction data of the second target object is abnormal transaction data, wherein the transaction security model is obtained by training an initial model by adopting a sample set, the sample set comprises a positive sample set and a negative sample set, and the positive sample set comprises: a plurality of sets of normal transaction data, the negative sample set comprising: multiple sets of anomalous transaction data.

6. The method according to claim 1, wherein the predicting the probability that the current transaction data of the second target object is abnormal transaction data according to the transaction characteristics of the first target object further comprises at least one of the following steps after obtaining the probability that the current transaction data of the second target object is abnormal transaction data:

when the probability that the current transaction data of the second target object is abnormal transaction data is smaller than a first preset threshold value, reminding the first target object that the current transaction to be paid is at risk;

when the probability that the current transaction data of the second target object is abnormal transaction data is smaller than a second preset threshold value and is larger than or equal to a first preset threshold value, adopting payment verification when the second target object pays the current transaction to be paid;

and under the condition that the probability that the current transaction data of the second target object is abnormal transaction data is greater than or equal to a second preset threshold value, prohibiting the second target object from paying the current transaction to be paid.

7. A data processing apparatus, comprising:

the acquisition module is used for acquiring historical transaction data and attribute data of the first target object;

the extraction module is used for extracting the transaction characteristics of the first target object according to the historical transaction data and the attribute data of the first target object;

the acquisition module is used for acquiring current transaction data of a second target object, wherein the current transaction data is transaction data corresponding to a transaction to be paid currently by the second target object;

and the prediction module is used for predicting the probability that the current transaction data of the second target object is abnormal transaction data according to the transaction characteristics of the first target object to obtain the probability that the current transaction data of the second target object is abnormal transaction data.

8. An electronic device, comprising:

a processor;

a memory for storing the processor-executable instructions;

wherein the processor is configured to execute the instructions to implement the data processing method of any one of claims 1 to 6.

9. A computer-readable storage medium, wherein instructions in the computer-readable storage medium, when executed by a processor of an electronic device, enable the electronic device to perform the data processing method of any of claims 1 to 6.

10. A computer program product comprising a computer program, characterized in that the computer program realizes the data processing method of any one of claims 1 to 6 when executed by a processor.