CN110111113B - Abnormal transaction node detection method and device - Google Patents
Abnormal transaction node detection method and device Download PDFInfo
- Publication number
- CN110111113B CN110111113B CN201910358467.6A CN201910358467A CN110111113B CN 110111113 B CN110111113 B CN 110111113B CN 201910358467 A CN201910358467 A CN 201910358467A CN 110111113 B CN110111113 B CN 110111113B
- Authority
- CN
- China
- Prior art keywords
- transaction
- nodes
- node
- subset
- cluster
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 230000002159 abnormal effect Effects 0.000 title claims abstract description 42
- 238000001514 detection method Methods 0.000 title abstract description 14
- 238000004422 calculation algorithm Methods 0.000 claims abstract description 32
- 238000000034 method Methods 0.000 claims abstract description 32
- 238000012544 monitoring process Methods 0.000 claims abstract description 11
- 238000004458 analytical method Methods 0.000 claims description 15
- 230000008569 process Effects 0.000 claims description 9
- XLYOFNOQVPJJNP-UHFFFAOYSA-N water Substances O XLYOFNOQVPJJNP-UHFFFAOYSA-N 0.000 claims description 9
- 238000004364 calculation method Methods 0.000 claims description 6
- 238000000638 solvent extraction Methods 0.000 claims description 2
- 238000012545 processing Methods 0.000 abstract description 8
- 238000010586 diagram Methods 0.000 description 9
- 238000004590 computer program Methods 0.000 description 5
- 230000006870 function Effects 0.000 description 4
- 238000012986 modification Methods 0.000 description 4
- 230000004048 modification Effects 0.000 description 4
- 238000007621 cluster analysis Methods 0.000 description 3
- 230000004075 alteration Effects 0.000 description 2
- 230000006399 behavior Effects 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 230000005856 abnormality Effects 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 238000010219 correlation analysis Methods 0.000 description 1
- 230000002950 deficient Effects 0.000 description 1
- 230000001419 dependent effect Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000001914 filtration Methods 0.000 description 1
- 238000003064 k means clustering Methods 0.000 description 1
- 238000010801 machine learning Methods 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 238000010606 normalization Methods 0.000 description 1
- 238000007781 pre-processing Methods 0.000 description 1
- 238000012549 training Methods 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q20/00—Payment architectures, schemes or protocols
- G06Q20/38—Payment protocols; Details thereof
- G06Q20/40—Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
- G06Q20/401—Transaction verification
- G06Q20/4016—Transaction verification involving fraud or risk level assessment in transaction processing
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management
Landscapes
- Business, Economics & Management (AREA)
- Engineering & Computer Science (AREA)
- Accounting & Taxation (AREA)
- Computer Security & Cryptography (AREA)
- Finance (AREA)
- Strategic Management (AREA)
- Physics & Mathematics (AREA)
- General Business, Economics & Management (AREA)
- General Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The embodiment of the invention relates to the technical field of data processing, in particular to a method and a device for detecting abnormal transaction nodes, which are used for improving the efficiency and the accuracy of abnormal transaction detection. The embodiment of the invention comprises the following steps: according to the transaction flow in the monitoring time period, determining transaction characteristic values among the transaction nodes under N transaction dimensions; for any one of the N transaction dimensions, dividing all transaction nodes into transaction subsets under the transaction dimension according to the transaction characteristic values among the transaction nodes; wherein, a strong association relationship is formed between any transaction node and at least another transaction node in the same transaction subset; aiming at any transaction node, calculating a cluster characteristic value of the transaction node in each transaction subset at least according to a strong association relation in the transaction subset where the transaction node is located; clustering all transaction nodes by using an unsupervised clustering algorithm according to the cluster characteristic values of the transaction nodes; and determining abnormal transaction nodes according to the clustering result.
Description
Technical Field
The present invention relates to the field of data processing technologies, and in particular, to a method and an apparatus for detecting an abnormal transaction node.
Background
In recent years, with the development of payment technology of intelligent terminals, more and more users pay by using mobile phones. Along with this, the business risks faced by intelligent terminal payment are increasingly revealed, and especially in recent years, the behavior of marketing malicious arbitrage by criminals through terminal payment is increasingly rampant, and the arbitrage means gradually tend to be specialized and partner, so that direct or indirect loss is caused for enterprises and individuals.
Currently, machine learning detection methods based on transaction individual feature analysis are increasingly utilized in the detection of abnormal transactions such as marketing arbitrage. However, the detection mode is very dependent on the existing arbitrage transaction sample and the label data thereof, the training effect is very unsatisfactory under the detection scene of unbalance of positive and negative sample data and even no label, the detection efficiency and the accuracy are lower, the interpretability of the model detection is also weaker, and the correlation analysis of transaction behaviors among transaction individuals is also very defective.
Disclosure of Invention
The application provides a method and a device for detecting abnormal transaction nodes, which are used for improving the efficiency and the accuracy of abnormal transaction detection.
The method for detecting the abnormal transaction node provided by the embodiment of the application comprises the following steps:
According to the transaction flow in the monitoring time period, determining transaction characteristic values among the transaction nodes under N transaction dimensions; wherein N is more than or equal to 1;
dividing all transaction nodes into transaction subsets under the transaction dimensions according to transaction characteristic values among the transaction nodes aiming at any one of N transaction dimensions; wherein, a strong association relationship is formed between any transaction node and at least another transaction node in the same transaction subset, and the strong association relationship between the transaction nodes is that the transaction characteristic value between the transaction nodes is larger than the transaction threshold value of the transaction dimension;
for any transaction node, calculating a cluster characteristic value of the transaction node in each transaction subset at least according to a strong association relation in the transaction subset where the transaction node is located;
clustering all transaction nodes by using an unsupervised clustering algorithm according to the cluster characteristic values of the transaction nodes;
and determining abnormal transaction nodes according to the clustering result.
In an optional embodiment, after dividing all the transaction nodes into transaction subsets in the transaction dimension according to the transaction characteristic values among the transaction nodes for any one of the N transaction dimensions, for any one transaction node, before calculating the cluster characteristic value of the transaction node in each transaction subset at least according to the strong association relationship in the transaction subset where the transaction node is located, the method further includes:
Determining the number of transaction nodes in any transaction subset;
comparing the number of transaction nodes in each transaction subset with a node number threshold, and eliminating transaction nodes in the transaction subset having a number of transaction nodes less than the node number threshold.
In an alternative embodiment, the cluster characteristic values of the transaction nodes are M, and M is more than or equal to 1; the M cluster feature values at least comprise one of the following: the transaction node is located in the cluster size, the cluster scale and the contribution value of the transaction node to the transaction subset of the transaction subset;
the calculating cluster characteristic values of the transaction nodes in each transaction subset at least according to the strong association relation in the transaction subset where the transaction nodes are located comprises:
and calculating N multiplied by M cluster characteristic values of the transaction nodes at least according to the strong association relation in the transaction subset where the transaction nodes are located.
In an optional embodiment, the calculating, according to at least a strong association relationship in the transaction subset where the transaction node is located, n×m cluster feature values of the transaction node includes:
the following calculation process is performed for any transaction subset where the transaction node is located:
Determining the number of transaction nodes in the transaction subset as the cluster size of the transaction subset;
adding the transaction characteristic values among all transaction nodes in the transaction subset to obtain the cluster scale of the transaction subset;
determining edges in the transaction subset according to transaction running water between any two transaction nodes in the transaction subset;
determining an average trading value of the trading subset according to the number of edges in the trading subset and the cluster size of the trading subset;
and calculating the contribution value of the transaction node to the transaction subset according to the transaction characteristic value of the transaction node and the average transaction value of the transaction subset.
In an alternative embodiment, the clustering each transaction node by using an unsupervised clustering algorithm according to the cluster feature value of the transaction node includes:
for any transaction dimension, clustering all transaction nodes by using a clustering analysis algorithm based on vector density analysis according to the cluster characteristic values of the transaction nodes;
after each transaction node is clustered by using an unsupervised clustering algorithm according to the cluster characteristic value of the transaction node, the method further comprises the following steps:
determining a weight for each transaction dimension;
Determining, for any transaction dimension, a score for each clustering result of the transaction dimension;
for any transaction node, determining a cluster scoring value of the transaction node according to the score of the clustering result of the transaction node in any transaction dimension and the weight of the transaction dimension; and/or the number of the groups of groups,
and for any transaction node, determining the comprehensive grading value of the transaction node according to the grading of the clustering result of the transaction node in any transaction dimension, the weight of the transaction dimension and the contribution value of the transaction node to the clustering result.
The embodiment of the invention also provides a device for detecting the abnormal transaction node, which comprises the following steps:
the acquisition unit is used for determining transaction characteristic values among the transaction nodes under N transaction dimensions according to the transaction flow in the monitoring time period; wherein N is more than or equal to 1;
the dividing unit is used for dividing all transaction nodes into transaction subsets in the transaction dimensions according to the transaction characteristic values among the transaction nodes aiming at any one of the N transaction dimensions; wherein, a strong association relationship is formed between any transaction node and at least another transaction node in the same transaction subset, and the strong association relationship between the transaction nodes is that the transaction characteristic value between the transaction nodes is larger than the transaction threshold value of the transaction dimension;
The computing unit is used for computing cluster characteristic values of the transaction nodes in each transaction subset according to at least the strong association relation of the transaction nodes in the transaction subset;
the clustering unit is used for clustering all transaction nodes by using an unsupervised clustering algorithm according to the cluster characteristic values of the transaction nodes;
and the determining unit is used for determining abnormal transaction nodes according to the clustering result.
In an alternative embodiment, the dividing unit is further configured to:
determining the number of transaction nodes in any transaction subset;
comparing the number of transaction nodes in each transaction subset with a node number threshold, and eliminating transaction nodes in the transaction subset having a number of transaction nodes less than the node number threshold.
In an alternative embodiment, the cluster characteristic values of the transaction nodes are M, and M is more than or equal to 1; the M cluster feature values at least comprise one of the following: the transaction node is located in the cluster size, the cluster scale and the contribution value of the transaction node to the transaction subset of the transaction subset;
the calculating unit is used for calculating N multiplied by M cluster characteristic values of the transaction node at least according to the strong association relation in the transaction subset where the transaction node is located.
In an alternative embodiment, the computing unit is specifically configured to:
the following calculation process is performed for any transaction subset where the transaction node is located:
determining the number of transaction nodes in the transaction subset as the cluster size of the transaction subset;
adding the transaction characteristic values among all transaction nodes in the transaction subset to obtain the cluster scale of the transaction subset;
determining edges in the transaction subset according to transaction running water between any two transaction nodes in the transaction subset;
determining an average trading value of the trading subset according to the number of edges in the trading subset and the cluster size of the trading subset;
and calculating the contribution value of the transaction node to the transaction subset according to the transaction characteristic value of the transaction node and the average transaction value of the transaction subset.
In an alternative embodiment, the clustering unit is specifically configured to:
for any transaction dimension, clustering all transaction nodes by using a clustering analysis algorithm based on vector density analysis according to the cluster characteristic values of the transaction nodes;
the determining unit is specifically configured to:
determining a weight for each transaction dimension;
Determining, for any transaction dimension, a score for each clustering result of the transaction dimension;
for any transaction node, determining a cluster scoring value of the transaction node according to the score of the clustering result of the transaction node in any transaction dimension and the weight of the transaction dimension; and/or the number of the groups of groups,
and for any transaction node, determining the comprehensive grading value of the transaction node according to the grading of the clustering result of the transaction node in any transaction dimension, the weight of the transaction dimension and the contribution value of the transaction node to the clustering result.
The embodiment of the invention also provides electronic equipment, which comprises:
at least one processor; the method comprises the steps of,
a memory communicatively coupled to the at least one processor; wherein,
the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method as described above.
Embodiments of the present invention also provide a non-transitory computer readable storage medium storing computer instructions for causing the computer to perform the method as described above.
In the embodiment of the invention, according to the transaction flow in the monitoring time period, the transaction characteristic values among the transaction nodes under N transaction dimensions are determined, namely N transaction characteristic values are determined between any two transaction nodes, wherein one transaction characteristic value corresponds to one transaction dimension. For any transaction dimension, all transaction nodes are divided into transaction subsets according to transaction characteristic values among the transaction nodes. The transaction nodes are in strong association with at least one other transaction node in the same transaction subset, wherein the strong association between the transaction nodes is that the transaction characteristic value between the transaction nodes is larger than the transaction threshold value of the transaction dimension. And then, calculating the cluster characteristic value of the transaction node in each transaction subset at least according to the strong association relation of the transaction node in the transaction subset aiming at any transaction node. And clustering all transaction nodes by using an unsupervised clustering algorithm according to the cluster characteristic values of the transaction nodes, and determining abnormal transaction nodes according to the clustering result. In the embodiment of the invention, the association relation between the transaction nodes is filtered, only the strong association relation larger than the transaction threshold value is reserved, the transaction nodes are divided into clusters according to the strong association relation, and the cluster characteristic values of the transaction nodes are calculated, so that island transaction nodes and island node sub-pairs can be effectively screened out, noise transaction data can be screened out before clustering, and the efficiency and the accuracy of abnormal transaction detection under a complex network of massive data are greatly improved. Meanwhile, the unsupervised clustering algorithm is utilized, so that dependence on label data of an abnormal sample can be eliminated, and abnormal transaction nodes and partners thereof can be rapidly found under the condition that the abnormal transaction sample data is few or even no sample can be trained, so that wind control of abnormal transaction is timely carried out.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings that are needed in the description of the embodiments will be briefly described below, it will be apparent that the drawings in the following description are only some embodiments of the present invention, and that other drawings can be obtained according to these drawings without inventive effort for a person skilled in the art.
Fig. 1 is a flow chart of a method for detecting abnormal transaction nodes according to an embodiment of the present invention;
FIGS. 2 a-2 c are schematic diagrams illustrating the partitioning of transaction nodes into transaction subsets according to embodiments of the present invention;
FIG. 3 is a flowchart of a method for detecting an abnormal transaction node according to an embodiment of the present invention;
fig. 4 is a schematic structural diagram of a detection device for abnormal transaction nodes according to an embodiment of the present invention;
fig. 5 is a schematic structural diagram of an electronic device according to an embodiment of the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention will be described in further detail below with reference to the accompanying drawings, and it is apparent that the described embodiments are only some embodiments of the present invention, not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to be within the scope of the invention.
The embodiment of the invention provides a method for detecting an abnormal transaction node, as shown in fig. 1, comprising the following steps:
step 101, determining transaction characteristic values among transaction nodes under N transaction dimensions according to transaction flowing water in a monitoring time period; wherein N is more than or equal to 1.
For example, the transaction characteristic may be a transaction count between transaction nodes, a total transaction amount, a preferential total amount, an average time difference of transactions, a number of off-site transactions, and so forth. The transaction node may be a person or a merchant, and the person may be a network payment account, a bank card holder, etc., and in the embodiment of the present invention, the person mainly refers to the bank card holder.
102, dividing all transaction nodes into transaction subsets in any one of N transaction dimensions according to transaction characteristic values among the transaction nodes; the transaction characteristic value between the transaction nodes is larger than the transaction threshold value of the transaction dimension.
Specifically, a transaction threshold is set for different transaction dimensions, and if the transaction dimension value between the transaction nodes is greater than the transaction threshold, the transaction nodes are in a strong association relationship; and if the transaction dimension value between the transaction nodes is smaller than or equal to the transaction threshold value, the transaction nodes are in weak association relation. In the embodiment of the invention, the weak association relationship is screened out, and only the strong association relationship between transaction nodes is reserved.
For example, where there is a transaction between transaction node 201 and transaction node 209, the transaction nodes where there is a transaction may be connected by edges to form a transaction network graph as shown in fig. 2 a. For a transaction dimension, such as a transaction count, a transaction characteristic value between the transaction nodes 201 and 209 is determined according to the transaction flow, and the transaction characteristic value is compared with a transaction threshold, for example, the transaction threshold is set to 10 transaction counts, and if the transaction count between two transaction nodes is greater than 10 transaction counts, the transaction nodes are considered to be in a strong association relationship. As shown in fig. 2a, the transaction number between the transaction node 201 and the transaction node 204 is 4, the transaction number between the transaction node 204 and the transaction node 205 is 2, the transaction number between the transaction node 204 and the transaction node 206 is 8, the transaction number between the transaction node 205 and the transaction node 206 is 5, and the transaction number between the transaction node 206 and the transaction node 209 is 7, which are all smaller than 10. The edges between transaction node 201 and transaction node 204, between transaction node 204 and transaction node 205, between transaction node 204 and transaction node 206, between transaction node 205 and transaction node 206, between transaction node 206 and transaction node 209 are considered to be weak associations, such that the edges between transaction node 201 and transaction node 204, between transaction node 204 and transaction node 205, between transaction node 204 and transaction node 206, between transaction node 205 and transaction node 206, between transaction node 206 and transaction node 209 in fig. 2a are represented by dashed lines, and the dashed edges are deleted during the graph filtering process, thereby obtaining the transaction network graph as shown in fig. 2 b.
And dividing the transaction nodes into transaction subsets according to the strong association relation between the transaction nodes. Such as the transaction node shown in fig. 2b, the transaction nodes are divided into transaction subset 211, transaction subset 212 and transaction subset 213 according to the strong association between the transaction nodes, and the division result is shown in fig. 2 c.
Step 103, for any transaction node, calculating a cluster characteristic value of the transaction node in each transaction subset at least according to a strong association relationship in the transaction subset where the transaction node is located.
Specifically, in the embodiment of the invention, if a strong association relationship exists between two transaction nodes, the two transaction nodes are used as points, the transaction nodes are directly connected by edges, and a plurality of transaction nodes in the transaction subset form a network map, so that the cluster characteristic value of the transaction nodes is calculated according to the network map of the transaction subset.
And 104, clustering all transaction nodes by using an unsupervised clustering algorithm according to the cluster characteristic values of the transaction nodes.
For example, the unsupervised clustering algorithm in the embodiment of the present invention is DBSCAN (Density-Based Spatial Clustering of Applications with Noise, density-based clustering algorithm), and KMEANS (K-means clustering algorithm ) or KNN (K-Nearest Neighbour, K-nearest neighbor algorithm) may be used.
And 105, determining abnormal transaction nodes according to the clustering result.
In the embodiment of the invention, according to the transaction flow in the monitoring time period, the transaction characteristic values among the transaction nodes under N transaction dimensions are determined, namely N transaction characteristic values are determined between any two transaction nodes, wherein one transaction characteristic value corresponds to one transaction dimension. For any transaction dimension, all transaction nodes are divided into transaction subsets according to transaction characteristic values among the transaction nodes. The transaction nodes are in strong association with at least one other transaction node in the same transaction subset, wherein the strong association between the transaction nodes is that the transaction characteristic value between the transaction nodes is larger than the transaction threshold value of the transaction dimension. And then, calculating the cluster characteristic value of the transaction node in each transaction subset at least according to the strong association relation of the transaction node in the transaction subset aiming at any transaction node. And clustering all transaction nodes by using an unsupervised clustering algorithm according to the cluster characteristic values of the transaction nodes, and determining abnormal transaction nodes according to the clustering result. In the embodiment of the invention, the association relation between the transaction nodes is filtered, only the strong association relation larger than the transaction threshold value is reserved, the transaction nodes are divided into clusters according to the strong association relation, and the cluster characteristic values of the transaction nodes are calculated, so that island transaction nodes and island node sub-pairs can be effectively screened out, noise transaction data can be screened out before clustering, and the efficiency and the accuracy of abnormal transaction detection under a complex network of massive data are greatly improved. Meanwhile, the unsupervised clustering algorithm is utilized, so that dependence on label data of an abnormal sample can be eliminated, and abnormal transaction nodes and partners thereof can be rapidly found under the condition that the abnormal transaction sample data is few or even no sample can be trained, so that wind control of abnormal transaction is timely carried out.
For the transaction subset obtained in step S102, the island node and node sub-pairs may be deleted before performing the unsupervised clustering algorithm. After dividing all transaction nodes into transaction subsets in the transaction dimension according to the transaction characteristic values among the transaction nodes for any one of the N transaction dimensions, calculating the cluster characteristic values of the transaction nodes in each transaction subset at least according to the strong association relationship among the transaction subsets in which the transaction nodes are located for any one transaction node, and further comprising:
determining the number of transaction nodes in any transaction subset;
comparing the number of transaction nodes in each transaction subset with a node number threshold, and eliminating transaction nodes in the transaction subset having a number of transaction nodes less than the node number threshold.
The specific method includes comparing the number of transaction nodes in the transaction subset with a node number threshold, and if the number of transaction nodes is smaller than the node number threshold, considering the transaction nodes in the transaction subset as island nodes, and not carrying out subsequent processing on the transaction nodes. As shown in fig. 2c, if the node number threshold is set to 3, transaction node 205 in transaction subset 212 is eliminated as an island node since only 1 transaction node is included in transaction subset 212. In addition, the transaction node may be referred to as an island node according to other characteristics, such as according to the number of edges in the transaction subset, etc.
Of course, instead of deleting island nodes in advance, all transaction nodes can be directly subjected to unsupervised clustering, and island nodes can be removed from detection of abnormal transaction nodes according to clustering result analysis obtained by unsupervised clustering.
In addition, the data can be subjected to preprocessing before cluster analysis on the transaction nodes, and the logarithm of the data can be taken according to the data sparseness degree for normalization, so that the workload of the cluster analysis is reduced, the processing time is shortened, and the working efficiency is improved.
In the embodiment of the invention, the number of the cluster characteristic values of the transaction nodes is M, and M is more than or equal to 1; the M cluster feature values at least comprise one of the following: the transaction node is located in the cluster size, the cluster scale and the contribution value of the transaction node to the transaction subset of the transaction subset;
the calculating cluster characteristic values of the transaction nodes in each transaction subset at least according to the strong association relation in the transaction subset where the transaction nodes are located comprises:
and calculating N multiplied by M cluster characteristic values of the transaction nodes at least according to the strong association relation in the transaction subset where the transaction nodes are located.
Specifically, under one transaction dimension, each transaction node is scored into a certain subgroup of transactions. For a transaction node, the cluster characteristic value of the transaction node can be calculated according to the transaction subgroup where the transaction node is located, for example, the cluster size of the transaction subgroup where the transaction node is located, the contribution value of the cluster scale transaction node to the transaction subset, and the like. Since there are N transaction dimensions, the cluster feature values of the transaction nodes in each transaction dimension are M, and therefore, each transaction node can calculate n×m cluster feature values.
Further, the calculating, at least according to the strong association relationship in the transaction subset where the transaction node is located, n×m cluster feature values of the transaction node includes:
the following calculation process is performed for any transaction subset where the transaction node is located:
determining the number of transaction nodes in the transaction subset as the cluster size of the transaction subset;
adding the transaction characteristic values among all transaction nodes in the transaction subset to obtain the cluster scale of the transaction subset;
determining edges in the transaction subset according to transaction running water between any two transaction nodes in the transaction subset;
determining an average trading value of the trading subset according to the number of edges in the trading subset and the cluster size of the trading subset;
and calculating the contribution value of the transaction node to the transaction subset according to the transaction characteristic value of the transaction node and the average transaction value of the transaction subset.
In a specific implementation, the cluster size of the transaction subset may be the number of transaction nodes in the transaction subset, or may be set to the number of edges between transaction nodes in the transaction subset. The cluster size of the transaction subset may be obtained by adding the transaction characteristic values among all transaction nodes, or may be obtained by dividing the sum of all the transaction characteristic values in the transaction subset by the number of transaction nodes as the cluster size. The contribution value of the transaction node to the transaction subset can be the ratio of the transaction characteristic value of the transaction node to the average transaction value of the transaction subset, the ratio of the transaction characteristic value of the transaction node to the cluster size of the transaction subset, or other algorithms. In addition, the transaction flow of the transaction node into and out of the transaction flow can also be considered. For example, the total amount of money transferred from transaction node a to transaction node b is 100, and the total amount of money transferred from transaction node b to transaction node a is 80, then the cluster characteristic value between transaction node a and transaction node b is 180 for the total amount of money. Or recording the fund change amount of a single transaction node according to the in-out transaction flow of the transaction node, wherein the cluster characteristic value of the transaction node a is-20, and the cluster characteristic value of the transaction node b is 20.
Cluster feature values in embodiments of the present invention are illustrated below with respect to transaction subset 213 in fig. 2 c. For the trading node 208, the cluster feature values of the trading node 208 are calculated as follows, with the side weight of the trading dimension w being 1, divided into the trading subsets 213. The number of transaction nodes is 4 as cluster size. There are 5 edges in the transaction subset 213, then the edge weight sum is 5, and thus the cluster size is 5. The average transaction value in transaction subset 213 is (3+3+2+2)/4=2.5, and the contribution of transaction node 208 to the transaction subset is 3/2.5=1.2. Thus, in the trade dimension w, the three cluster feature values of the trade node 208 are 4, 5, 1.2, respectively.
Further, the clustering each transaction node by using an unsupervised clustering algorithm according to the cluster feature value of the transaction node includes:
for any transaction dimension, clustering all transaction nodes by using a clustering analysis algorithm based on vector density analysis according to the cluster characteristic values of the transaction nodes;
after each transaction node is clustered by using an unsupervised clustering algorithm according to the cluster characteristic value of the transaction node, the method further comprises the following steps:
determining a weight for each transaction dimension;
Determining, for any transaction dimension, a score for each clustering result of the transaction dimension;
for any transaction node, determining a cluster scoring value of the transaction node according to the score of the clustering result of the transaction node in any transaction dimension and the weight of the transaction dimension; and/or the number of the groups of groups,
and for any transaction node, determining the comprehensive grading value of the transaction node according to the grading of the clustering result of the transaction node in any transaction dimension, the weight of the transaction dimension and the contribution value of the transaction node to the clustering result.
In the implementation process, cluster characteristic values of all transaction nodes are input into the DBSCAN, and all the transaction nodes are subjected to unsupervised clustering. The nature of the trading nodes in each cluster can then be analyzed according to the clustering results, or each trading node can be scored according to its clusters of different trading dimensions, and the degree of abnormality of that trading node can be determined according to the final score. Specifically, according to the requirement of service management and control, determining the weight of each transaction dimension, multiplying the score of the clustering result of the transaction node in any transaction dimension by the weight of the transaction dimension for one transaction node to obtain the score of the transaction node in one transaction dimension, and adding all the transaction dimension scores of the transaction node to obtain the cluster score of the transaction node. Or multiplying the score of the clustering result of the transaction node under any transaction dimension by the weight of the transaction dimension and multiplying the score by the contribution value of the transaction node to the clustering result to obtain the comprehensive score value of the transaction node. In the embodiment of the invention, the abnormal degree of the transaction node can be estimated by utilizing the cluster score value of the transaction node, or the abnormal degree of the transaction node can be estimated by utilizing the comprehensive score value of the transaction node, or the abnormal degree of the transaction node can be estimated comprehensively according to the cluster score value of the transaction node and the comprehensive score value of the transaction node.
For example, under different transaction dimensions, transaction nodes may be clustered into different tiers.
TABLE 1
As shown in Table 1, under different trade dimensions, the trade node c is clustered to different levels, and the cluster score G of the trade node c can be calculated according to the scores of the clustering results and the trade dimension weight in Table 1 c ＝∑P i ·v i =3× 4+0 ×5+2×3+2×2=22, i.e., the cluster score value of the transaction node c is 22. On the basis, the contribution value u of the transaction node c to each clustering result is considered, and the comprehensive grading value H of the transaction node c is calculated c ＝∑P i ·v i ·u i 。
In addition to scoring the transaction nodes according to clustering results of the transaction nodes under different transaction dimensions, and determining the abnormal degree of the transaction nodes according to the scores, the embodiment of the invention can also comprehensively consider a plurality of transaction dimensions by using an unsupervised clustering algorithm and directly divide the transaction nodes into clusters with different risk degrees, so that the abnormal transaction nodes are directly determined.
In order to more clearly understand the present invention, the following describes the above flow in detail with specific embodiments, and the steps of the specific embodiments are shown in fig. 3, including:
step 301: and determining the transaction characteristic values among the transaction nodes under N transaction dimensions according to the transaction flowing water in the monitoring time period.
Step 302: for any one of the N transaction dimensions, all transaction nodes are divided into transaction subsets according to strong association relationships between the transaction nodes.
Step 303: comparing the number of transaction nodes in each transaction subset to a node number threshold, and eliminating transaction nodes in the transaction subset having a number of transaction nodes less than the node number threshold.
Step 304: and calculating N multiplied by M cluster characteristic values of the transaction nodes at least according to the strong association relation in the transaction subset where the transaction nodes are located. The cluster characteristic value of the transaction node is M.
Step 305: and clustering all transaction nodes according to the cluster characteristic values of the transaction nodes by using a cluster analysis algorithm based on vector density analysis aiming at any transaction dimension.
Step 306: and determining the cluster scoring value of the transaction node according to the score of the clustering result of the transaction node in any transaction dimension and the weight of the transaction dimension aiming at any transaction node. And meanwhile, determining the comprehensive grading value of the transaction node according to the grading of the clustering result of the transaction node in any transaction dimension, the weight of the transaction dimension and the contribution value of the transaction node to the clustering result.
Step 307: and determining abnormal transaction nodes from all the transaction nodes according to the cluster credit values and the comprehensive credit values of the transaction nodes.
The embodiment of the invention also provides a device for detecting the abnormal transaction node, as shown in fig. 4, comprising:
an obtaining unit 401, configured to determine a transaction characteristic value between transaction nodes under N transaction dimensions according to the transaction flowing water in the monitoring period; wherein N is more than or equal to 1;
a dividing unit 402, configured to divide, for any one of N transaction dimensions, all transaction nodes into a transaction subset in the transaction dimension according to transaction feature values between the transaction nodes; wherein, a strong association relationship is formed between any transaction node and at least another transaction node in the same transaction subset, and the strong association relationship between the transaction nodes is that the transaction characteristic value between the transaction nodes is larger than the transaction threshold value of the transaction dimension;
a calculating unit 403, configured to calculate, for any transaction node, a cluster feature value of the transaction node in each transaction subset at least according to a strong association relationship in the transaction subset where the transaction node is located;
a clustering unit 404, configured to cluster all transaction nodes by using an unsupervised clustering algorithm according to the cluster feature values of the transaction nodes;
A determining unit 405, configured to determine an abnormal transaction node according to the clustering result.
Optionally, the dividing unit 402 is further configured to:
determining the number of transaction nodes in any transaction subset;
comparing the number of transaction nodes in each transaction subset with a node number threshold, and eliminating transaction nodes in the transaction subset having a number of transaction nodes less than the node number threshold.
Optionally, the number of cluster characteristic values of the transaction nodes is M, and M is more than or equal to 1; the M cluster feature values at least comprise one of the following: the transaction node is located in the cluster size, the cluster scale and the contribution value of the transaction node to the transaction subset of the transaction subset;
the calculating unit is used for calculating N multiplied by M cluster characteristic values of the transaction node at least according to the strong association relation in the transaction subset where the transaction node is located.
Optionally, the computing unit is specifically configured to:
the following calculation process is performed for any transaction subset where the transaction node is located:
determining the number of transaction nodes in the transaction subset as the cluster size of the transaction subset;
adding the transaction characteristic values among all transaction nodes in the transaction subset to obtain the cluster scale of the transaction subset;
Determining edges in the transaction subset according to transaction running water between any two transaction nodes in the transaction subset;
determining an average trading value of the trading subset according to the number of edges in the trading subset and the cluster size of the trading subset;
and calculating the contribution value of the transaction node to the transaction subset according to the transaction characteristic value of the transaction node and the average transaction value of the transaction subset.
Optionally, the clustering unit is specifically configured to:
for any transaction dimension, clustering all transaction nodes by using a clustering analysis algorithm based on vector density analysis according to the cluster characteristic values of the transaction nodes;
the determining unit is specifically configured to:
determining a weight for each transaction dimension;
determining, for any transaction dimension, a score for each clustering result of the transaction dimension;
for any transaction node, determining a cluster scoring value of the transaction node according to the score of the clustering result of the transaction node in any transaction dimension and the weight of the transaction dimension; and/or the number of the groups of groups,
and for any transaction node, determining the comprehensive grading value of the transaction node according to the grading of the clustering result of the transaction node in any transaction dimension, the weight of the transaction dimension and the contribution value of the transaction node to the clustering result.
Based on the same principle, the present invention also provides an electronic device, as shown in fig. 5, including:
the device comprises a processor 501, a memory 502, a transceiver 503 and a bus interface 504, wherein the processor 501, the memory 502 and the transceiver 503 are connected through the bus interface 504;
the processor 501 is configured to read the program in the memory 502, and execute the following method:
according to the transaction flow in the monitoring time period, determining transaction characteristic values among the transaction nodes under N transaction dimensions; wherein N is more than or equal to 1;
dividing all transaction nodes into transaction subsets under the transaction dimensions according to transaction characteristic values among the transaction nodes aiming at any one of N transaction dimensions; wherein, a strong association relationship is formed between any transaction node and at least another transaction node in the same transaction subset, and the strong association relationship between the transaction nodes is that the transaction characteristic value between the transaction nodes is larger than the transaction threshold value of the transaction dimension;
for any transaction node, calculating a cluster characteristic value of the transaction node in each transaction subset at least according to a strong association relation in the transaction subset where the transaction node is located;
clustering all transaction nodes by using an unsupervised clustering algorithm according to the cluster characteristic values of the transaction nodes;
And determining abnormal transaction nodes according to the clustering result.
The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
While preferred embodiments of the present invention have been described, additional variations and modifications in those embodiments may occur to those skilled in the art once they learn of the basic inventive concepts. It is therefore intended that the following claims be interpreted as including the preferred embodiments and all such alterations and modifications as fall within the scope of the invention.
It will be apparent to those skilled in the art that various modifications and variations can be made to the present invention without departing from the spirit or scope of the invention. Thus, it is intended that the present invention also include such modifications and alterations insofar as they come within the scope of the appended claims or the equivalents thereof.
Claims (8)
1. A method of classifying transaction nodes, comprising:
According to the transaction flow in the monitoring time period, determining transaction characteristic values among transaction nodes in N transaction dimensions, wherein the transaction nodes are individuals or merchants, and the transaction characteristic values comprise: transaction number, total transaction amount, preferential total amount, average transaction time difference and remote transaction site number among transaction nodes; wherein N is more than or equal to 1;
for any one of the N transaction dimensions, taking each transaction node as a point, and determining an edge based on the transaction characteristic values among the transaction nodes to construct a transaction network map;
reserving edges between two transaction nodes with strong association in the transaction network map, deleting the edges between the two transaction nodes with weak association in the transaction network map, and obtaining network maps of all transaction subsets in the transaction dimension; wherein, a strong association relationship is formed between any transaction node and at least another transaction node in the same transaction subset, and the strong association relationship between the transaction nodes is that the transaction characteristic value between the transaction nodes is larger than the transaction threshold value of the transaction dimension;
for any transaction node, calculating a cluster characteristic value of the transaction node in the network map of each transaction subset at least according to the strong association relation in the network map of the transaction subset where the transaction node is located;
The number of cluster characteristic values of the transaction nodes is M, and M is more than or equal to 1; the M cluster feature values at least comprise one of the following: the transaction node is located in the cluster size, the cluster scale and the contribution value of the transaction node to the transaction subset of the transaction subset;
the calculating cluster characteristic values of the transaction nodes in each transaction subset at least according to the strong association relation in the transaction subset where the transaction nodes are located comprises:
the following calculation process is performed for any transaction subset where the transaction node is located:
determining the number of transaction nodes in the transaction subset as the cluster size of the transaction subset;
adding the transaction characteristic values among all transaction nodes in the transaction subset to obtain the cluster scale of the transaction subset;
determining edges in the transaction subset according to transaction running water between any two transaction nodes in the transaction subset;
determining an average trading value of the trading subset according to the number of edges in the trading subset and the cluster size of the trading subset;
calculating the contribution value of the transaction node to the transaction subset according to the transaction characteristic value of the transaction node and the average transaction value of the transaction subset;
Clustering all transaction nodes by using an unsupervised clustering algorithm according to the cluster characteristic values of the transaction nodes;
and determining abnormal transaction nodes according to the clustering result.
2. The method of claim 1, wherein after dividing all transaction nodes into transaction subsets in the transaction dimension according to transaction characteristic values among the transaction nodes for any one of the N transaction dimensions, the calculating, for any one transaction node, cluster characteristic values of the transaction node in each transaction subset at least according to a strong association relationship among the transaction subsets in which the transaction node is located further comprises:
determining the number of transaction nodes in any transaction subset;
comparing the number of transaction nodes in each transaction subset with a node number threshold, and eliminating transaction nodes in the transaction subset having a number of transaction nodes less than the node number threshold.
3. The method of claim 1, wherein clustering each trading node using an unsupervised clustering algorithm based on the cluster feature values of the trading nodes comprises:
for any transaction dimension, clustering all transaction nodes by using a clustering analysis algorithm based on vector density analysis according to the cluster characteristic values of the transaction nodes;
After each transaction node is clustered by using an unsupervised clustering algorithm according to the cluster characteristic value of the transaction node, the method further comprises the following steps:
determining a weight for each transaction dimension;
determining, for any transaction dimension, a score for each clustering result of the transaction dimension;
for any transaction node, determining a cluster scoring value of the transaction node according to the score of the clustering result of the transaction node in any transaction dimension and the weight of the transaction dimension; and/or the number of the groups of groups,
and for any transaction node, determining the comprehensive grading value of the transaction node according to the grading of the clustering result of the transaction node in any transaction dimension, the weight of the transaction dimension and the contribution value of the transaction node to the clustering result.
4. A transaction node classification device, comprising:
the acquisition unit is used for determining transaction characteristic values among the transaction nodes in N transaction dimensions according to the transaction flow in the monitoring time period, wherein the transaction nodes are individuals or merchants, and the transaction characteristic values comprise: transaction number, total transaction amount, preferential total amount, average transaction time difference and remote transaction site number among transaction nodes; wherein N is more than or equal to 1;
The dividing unit is used for establishing a transaction network map by taking each transaction node as a point and determining an edge according to the transaction characteristic value among the transaction nodes according to any one of N transaction dimensions; reserving edges between two transaction nodes with strong association in the transaction network map, deleting the edges between the two transaction nodes with weak association in the transaction network map, and obtaining network maps of all transaction subsets in the transaction dimension; wherein, a strong association relationship is formed between any transaction node and at least another transaction node in the same transaction subset, and the strong association relationship between the transaction nodes is that the transaction characteristic value between the transaction nodes is larger than the transaction threshold value of the transaction dimension;
the computing unit is used for computing cluster characteristic values of the transaction nodes in the network map of each transaction subset at least according to the strong association relation of the transaction nodes in the network map of the transaction subset;
the number of cluster characteristic values of the transaction nodes is M, and M is more than or equal to 1; the M cluster feature values at least comprise one of the following: the transaction node is located in the cluster size, the cluster scale and the contribution value of the transaction node to the transaction subset of the transaction subset;
The calculating cluster characteristic values of the transaction nodes in each transaction subset at least according to the strong association relation in the transaction subset where the transaction nodes are located comprises:
the following calculation process is performed for any transaction subset where the transaction node is located:
determining the number of transaction nodes in the transaction subset as the cluster size of the transaction subset;
adding the transaction characteristic values among all transaction nodes in the transaction subset to obtain the cluster scale of the transaction subset;
determining edges in the transaction subset according to transaction running water between any two transaction nodes in the transaction subset;
determining an average trading value of the trading subset according to the number of edges in the trading subset and the cluster size of the trading subset;
calculating the contribution value of the transaction node to the transaction subset according to the transaction characteristic value of the transaction node and the average transaction value of the transaction subset;
the clustering unit is used for clustering all transaction nodes by using an unsupervised clustering algorithm according to the cluster characteristic values of the transaction nodes;
and the determining unit is used for determining abnormal transaction nodes according to the clustering result.
5. The apparatus of claim 4, wherein the partitioning unit is further to:
Determining the number of transaction nodes in any transaction subset;
comparing the number of transaction nodes in each transaction subset with a node number threshold, and eliminating transaction nodes in the transaction subset having a number of transaction nodes less than the node number threshold.
6. The apparatus of claim 4, wherein the clustering unit is specifically configured to:
for any transaction dimension, clustering all transaction nodes by using a clustering analysis algorithm based on vector density analysis according to the cluster characteristic values of the transaction nodes;
the determining unit is specifically configured to:
determining a weight for each transaction dimension;
determining, for any transaction dimension, a score for each clustering result of the transaction dimension;
for any transaction node, determining a cluster scoring value of the transaction node according to the score of the clustering result of the transaction node in any transaction dimension and the weight of the transaction dimension; and/or the number of the groups of groups,
and for any transaction node, determining the comprehensive grading value of the transaction node according to the grading of the clustering result of the transaction node in any transaction dimension, the weight of the transaction dimension and the contribution value of the transaction node to the clustering result.
7. An electronic device, comprising:
at least one processor; the method comprises the steps of,
a memory communicatively coupled to the at least one processor; wherein,
the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-3.
8. A non-transitory computer readable storage medium storing computer instructions for causing a computer to perform the method of any one of claims 1-3.
Priority Applications (3)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910358467.6A CN110111113B (en) | 2019-04-30 | 2019-04-30 | Abnormal transaction node detection method and device |
| PCT/CN2020/071837 WO2020220758A1 (en) | 2019-04-30 | 2020-01-13 | Method for detecting abnormal transaction node, and device |
| TW109104991A TWI759688B (en) | 2019-04-30 | 2020-02-17 | A method and device for detecting abnormal transaction nodes |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201910358467.6A CN110111113B (en) | 2019-04-30 | 2019-04-30 | Abnormal transaction node detection method and device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110111113A CN110111113A (en) | 2019-08-09 |
| CN110111113B true CN110111113B (en) | 2023-12-08 |
Family
ID=67487641
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201910358467.6A Active CN110111113B (en) | 2019-04-30 | 2019-04-30 | Abnormal transaction node detection method and device |
Country Status (3)
| Country | Link |
|---|---|
| CN (1) | CN110111113B (en) |
| TW (1) | TWI759688B (en) |
| WO (1) | WO2020220758A1 (en) |
Families Citing this family (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110111113B (en) * | 2019-04-30 | 2023-12-08 | 中国银联股份有限公司 | Abnormal transaction node detection method and device |
| CN111340622A (en) * | 2020-02-21 | 2020-06-26 | 中国银联股份有限公司 | Abnormal transaction cluster detection method and device |
| CN113064953B (en) * | 2021-04-21 | 2023-08-22 | 湖南天河国云科技有限公司 | Block chain address clustering method and device based on neighbor information aggregation |
| CN113469696B (en) * | 2021-06-29 | 2024-08-13 | 中国银联股份有限公司 | User anomaly evaluation method, device and computer readable storage medium |
| CN113469697B (en) * | 2021-06-30 | 2022-12-06 | 重庆富民银行股份有限公司 | Unsupervised anomaly detection method and unsupervised anomaly detection device based on knowledge graph |
| CN113656802B (en) * | 2021-07-19 | 2024-05-14 | 同盾科技有限公司 | Knowledge federation undirected graph-based federation loop detection method, system, equipment and medium |
| CN113569994B (en) * | 2021-08-30 | 2024-05-21 | 平安医疗健康管理股份有限公司 | Lei-co medical record identification method, device, equipment and storage medium |
| CN113724252A (en) * | 2021-10-11 | 2021-11-30 | 北京中科智眼科技有限公司 | Industrial image anomaly detection method based on deep dual network feature matching |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107918905A (en) * | 2017-11-22 | 2018-04-17 | 阿里巴巴集团控股有限公司 | Abnormal transaction identification method, apparatus and server |
| CN109242499A (en) * | 2018-09-19 | 2019-01-18 | 中国银行股份有限公司 | A kind of processing method of transaction risk prediction, apparatus and system |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106327340B (en) * | 2016-08-04 | 2022-01-07 | 中国银联股份有限公司 | Abnormal node set detection method and device for financial network |
| CN109684673B (en) * | 2018-12-03 | 2023-03-24 | 三峡大学 | Feature extraction and cluster analysis method for transient stability result of power system |
| CN110111113B (en) * | 2019-04-30 | 2023-12-08 | 中国银联股份有限公司 | Abnormal transaction node detection method and device |
-
2019
- 2019-04-30 CN CN201910358467.6A patent/CN110111113B/en active Active
-
2020
- 2020-01-13 WO PCT/CN2020/071837 patent/WO2020220758A1/en active Application Filing
- 2020-02-17 TW TW109104991A patent/TWI759688B/en active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107918905A (en) * | 2017-11-22 | 2018-04-17 | 阿里巴巴集团控股有限公司 | Abnormal transaction identification method, apparatus and server |
| CN109242499A (en) * | 2018-09-19 | 2019-01-18 | 中国银行股份有限公司 | A kind of processing method of transaction risk prediction, apparatus and system |
Also Published As
| Publication number | Publication date |
|---|---|
| WO2020220758A1 (en) | 2020-11-05 |
| TW202042132A (en) | 2020-11-16 |
| CN110111113A (en) | 2019-08-09 |
| TWI759688B (en) | 2022-04-01 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110111113B (en) | Abnormal transaction node detection method and device | |
| US10943186B2 (en) | Machine learning model training method and device, and electronic device | |
| CN107633265B (en) | Data processing method and device for optimizing credit evaluation model | |
| CN110751557B (en) | Abnormal fund transaction behavior analysis method and system based on sequence model | |
| CN110309840A (en) | Risk trade recognition methods, device, server and storage medium | |
| CN107633030B (en) | Credit evaluation method and device based on data model | |
| CN106991047B (en) | Method and system for predicting object-oriented software defects | |
| CN109948704A (en) | A kind of transaction detection method and apparatus | |
| CN111080442A (en) | Credit scoring model construction method, device, equipment and storage medium | |
| CN111325248A (en) | Method and system for reducing pre-loan business risk | |
| US20150262184A1 (en) | Two stage risk model building and evaluation | |
| CN110310114A (en) | Object classification method, device, server and storage medium | |
| CN111160959A (en) | User click conversion estimation method and device | |
| CN112884569A (en) | Credit assessment model training method, device and equipment | |
| CN109242165A (en) | A kind of model training and prediction technique and device based on model training | |
| CN113469696B (en) | User anomaly evaluation method, device and computer readable storage medium | |
| CN110020939A (en) | Establish device, method and the storage medium of loss given default prediction model | |
| CN115115369A (en) | Data processing method, device, equipment and storage medium | |
| CN112329862A (en) | Decision tree-based anti-money laundering method and system | |
| JP6797956B2 (en) | Estimator, estimation method and program | |
| CN111858267A (en) | Early warning method and device, electronic equipment and storage medium | |
| CN117291707A (en) | Loan application processing method, device, electronic equipment and storage medium | |
| CN112926989B (en) | Bank loan risk assessment method and equipment based on multi-view integrated learning | |
| CN111428510B (en) | Public praise-based P2P platform risk analysis method | |
| CN115907954A (en) | Account identification method and device, computer equipment and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| REG | Reference to a national code |
Ref country code: HK Ref legal event code: DE Ref document number: 40011447 Country of ref document: HK |
|
| GR01 | Patent grant | ||
| GR01 | Patent grant |