TWI759688B - A method and device for detecting abnormal transaction nodes - Google Patents

Abstract

A method and device for detecting abnormal transaction nodes, which are used to solve the problems of low efficiency and accuracy of abnormal transaction detection in the prior art. The method includes: determining transaction characteristic values between transaction nodes under N transaction dimensions according to the transaction flow within the monitoring time period, and for any transaction dimension, dividing the transaction nodes into the transaction dimension according to the transaction characteristic values between the transaction nodes For any transaction node, at least according to the strong association relationship in the transaction subset where the transaction node is located, calculate the cluster characteristic value of the transaction node in each transaction subset, and use the unsupervised cluster characteristic value according to the cluster characteristic value of the transaction node. The clustering algorithm clusters all transaction nodes, and determines abnormal transaction nodes based on the clustering results. Detecting abnormal transaction nodes based on the relationship between transaction nodes and the method in the unsupervised clustering algorithm helps to improve the efficiency and accuracy of abnormal transaction detection.

Description

A method and device for detecting abnormal transaction nodes

The invention belongs to the technical field of data processing, in particular to a method and device for detecting abnormal transaction nodes.

In recent years, with the continuous development of smart terminal payment technology, more and more users use mobile phones to pay. What follows is that the business risks faced by smart terminal payment are also becoming more and more obvious. Especially in recent years, criminals use terminal payment to conduct marketing malicious arbitrage more and more rampant. and individuals caused direct or indirect losses.

At present, machine learning detection methods based on the analysis of individual characteristics of transactions are gradually used in the detection of abnormal transactions such as marketing arbitrage. However, this detection method is very dependent on the existing arbitrage trading samples and their label data. In the detection scenario where the positive and negative sample data is unbalanced or even without labels, the training effect is very unsatisfactory, and the detection efficiency and accuracy rate are low. The interpretability of detection is also weak, and the analysis of the correlation between transaction behaviors among transaction individuals also has great defects.

The present invention provides a method and device for detecting abnormal transaction nodes, which are used to improve the Efficiency and accuracy of abnormal transaction detection.

A method for detecting an abnormal transaction node provided by an embodiment of the present invention includes:

1； According to the transaction flow in the monitoring time period, determine the transaction characteristic values between transaction nodes under N transaction dimensions; among them, N

1;

For any transaction dimension in the N transaction dimensions, according to the transaction characteristic values between transaction nodes, all transaction nodes are divided into transaction subsets under the transaction dimension; At least one other transaction node has a strong relationship, and the strong relationship between the transaction nodes is that the transaction feature value between the transaction nodes is greater than the transaction threshold of the transaction dimension;

For any transaction node, at least according to the strong association relationship in the transaction subset where the transaction node is located, calculate the cluster characteristic value of the transaction node in each transaction subset;

According to the cluster eigenvalues of the transaction nodes, use the unsupervised clustering algorithm to cluster all the transaction nodes;

Determine abnormal transaction nodes according to the clustering results.

In an optional embodiment, for any transaction dimension among the N transaction dimensions, after dividing all transaction nodes into transaction subsets under the transaction dimension according to transaction characteristic values between transaction nodes, A transaction node, before calculating the cluster characteristic value of the transaction node in each transaction subset according to the strong association relationship in the transaction subset where the transaction node is located, further includes:

For any transaction subset, determine the number of transaction nodes in the transaction subset;

The number of transaction nodes in each transaction subset is compared with the threshold of the number of nodes, and the transaction nodes in the transaction subset whose number of transaction nodes is less than the threshold of the number of nodes are deleted.

1；該M個集群特徵值至少包括以下內容之一：該交易節點所在交易子集的集群大小、集群規模、該交易節點對交易子集的貢獻值； In an optional embodiment, the cluster characteristic value of the transaction node is M, and M

1. The M cluster characteristic values include at least one of the following contents: the cluster size of the transaction subset where the transaction node is located, the cluster scale, and the contribution value of the transaction node to the transaction subset;

The cluster feature value of the transaction node in each transaction subset is calculated at least according to the strong association relationship in the transaction subset where the transaction node is located, including:

At least according to the strong association relationship in the transaction subset where the transaction node is located, N×M cluster characteristic values of the transaction node are calculated.

In an optional embodiment, the N×M cluster feature values of the transaction node are calculated at least according to the strong association in the transaction subset where the transaction node is located, including:

Perform the following calculation process for any subset of transactions where the transaction node is located:

Determine the number of transaction nodes in the transaction subset as the cluster size of the transaction subset;

Add the transaction eigenvalues between all transaction nodes in the transaction subset to obtain the cluster size of the transaction subset;

Determine the edge in the transaction subset according to the transaction flow between any two transaction nodes in the transaction subset;

Determine the average transaction value of the transaction subset according to the number of edges in the transaction subset and the cluster size of the transaction subset;

According to the transaction characteristic value of the transaction node and the average transaction value of the transaction subset, the contribution value of the transaction node to the transaction subset is calculated.

In an optional embodiment, using an unsupervised clustering algorithm to cluster each transaction node according to the cluster characteristic value of the transaction node, including:

For any transaction dimension, according to the cluster eigenvalues of the transaction nodes, use the vector density-based The analyzed cluster analysis algorithm clusters all transaction nodes;

After clustering each transaction node by using an unsupervised clustering algorithm according to the cluster characteristic value of the transaction node, the method further includes:

Determine the weight of each transaction dimension;

For any transaction dimension, determine the score of each clustering result of the transaction dimension;

For any transaction node, according to the score of the clustering result of the transaction node under any transaction dimension and the weight of the transaction dimension, determine the cluster score value of the transaction node; and/or,

For any transaction node, according to the score of the clustering result of the transaction node under any transaction dimension, the weight of the transaction dimension, and the contribution value of the transaction node to the clustering result, the comprehensive score value of the transaction node is determined.

The embodiment of the present invention also provides a detection device for an abnormal transaction node, including:

1； The acquisition unit is used to determine the transaction characteristic values between the transaction nodes under the N transaction dimensions according to the transaction flow in the monitoring time period; wherein, N

1;

The division unit is used to divide all transaction nodes into transaction subsets under the transaction dimension according to the transaction characteristic values between transaction nodes for any transaction dimension in the N transaction dimensions; At least one other transaction node in a transaction subset has a strong association relationship, and the strong association relationship between transaction nodes is that the transaction feature value between the transaction nodes is greater than the transaction threshold of the transaction dimension;

a computing unit, configured to, for any transaction node, calculate the cluster characteristic value of the transaction node in each transaction subset according to at least the strong association relationship in the transaction subset in which the transaction node is located;

The clustering unit is used to cluster all transaction nodes by using the unsupervised clustering algorithm according to the cluster eigenvalues of the transaction nodes;

The determining unit is used to determine abnormal transaction nodes according to the clustering result.

In an optional embodiment, the dividing unit is also used for:

For any transaction subset, determine the number of transaction nodes in the transaction subset;

The number of transaction nodes in each transaction subset is compared with the threshold of the number of nodes, and the transaction nodes in the transaction subset whose number of transaction nodes is less than the threshold of the number of nodes are deleted.

1；該M個集群特徵值至少包括以下內容之一：該交易節點所在交易子集的集群大小、集群規模、該交易節點對交易子集的貢獻值； In an optional embodiment, the cluster characteristic value of the transaction node is M, and M

1. The M cluster characteristic values include at least one of the following contents: the cluster size of the transaction subset where the transaction node is located, the cluster scale, and the contribution value of the transaction node to the transaction subset;

The calculation unit is configured to calculate N×M cluster characteristic values of the transaction node at least according to the strong association relationship in the transaction subset in which the transaction node is located.

In an optional embodiment, the computing unit is specifically used for:

Perform the following calculation process for any subset of transactions where the transaction node is located:

Determine the number of transaction nodes in the transaction subset as the cluster size of the transaction subset;

Add the transaction eigenvalues between all transaction nodes in the transaction subset to obtain the cluster size of the transaction subset;

Determine the edge in the transaction subset according to the transaction flow between any two transaction nodes in the transaction subset;

Determine the average transaction value of the transaction subset according to the number of edges in the transaction subset and the cluster size of the transaction subset;

According to the transaction characteristic value of the transaction node and the average transaction value of the transaction subset, the contribution value of the transaction node to the transaction subset is calculated.

In an optional embodiment, the clustering unit is specifically used for:

For any transaction dimension, according to the cluster eigenvalues of the transaction nodes, the clustering algorithm based on vector density analysis is used to cluster all transaction nodes;

The determination unit is specifically used for:

Determine the weight of each transaction dimension;

For any transaction dimension, determine the score of each clustering result of the transaction dimension;

For any transaction node, according to the score of the clustering result of the transaction node under any transaction dimension and the weight of the transaction dimension, determine the cluster score value of the transaction node; and/or,

For any transaction node, according to the score of the clustering result of the transaction node under any transaction dimension, the weight of the transaction dimension, and the contribution value of the transaction node to the clustering result, the comprehensive score value of the transaction node is determined.

An embodiment of the present invention also provides an electronic device, including:

at least one processor; and,

memory in communication with the at least one processor; wherein,

The memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method as described above.

Embodiments of the present invention further provide a computer-readable storage medium, where the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to cause the computer to execute the above-mentioned method.

In the embodiment of the present invention, according to the transaction flow in the monitoring time period, the transaction characteristic values between the transaction nodes under N transaction dimensions are determined, that is, N transaction characteristic values are determined between any two transaction nodes, and one transaction characteristic value is determined. Corresponds to a transaction dimension. For any transaction dimension, all transaction nodes are divided into transaction subsets according to the transaction eigenvalues between transaction nodes. Wherein, any transaction node and at least another transaction node in the same transaction subset are strongly associated, where the strong association between transaction nodes is that the transaction feature value between transaction nodes is greater than the transaction threshold of the transaction dimension. Afterwards, for any transaction node, at least according to the strong association relationship in the transaction subset where the transaction node is located, the cluster feature value of the transaction node in each transaction subset is calculated. According to the cluster eigenvalues of the transaction nodes, the unsupervised clustering algorithm is used to cluster all the transaction nodes, and the abnormal transaction nodes are determined according to the clustering results. In the embodiment of the present invention, the association relationship between the transaction nodes is filtered, and only the strong association relationship greater than the transaction threshold is retained, and the transaction nodes are divided into clusters according to the strong association relationship, and then the cluster characteristic value of the transaction nodes is calculated, so as to effectively Filtering out island transaction nodes and island node sub-pairs can filter out noisy transaction data before clustering, which greatly improves the efficiency and accuracy of abnormal transaction detection in complex networks with massive data. At the same time, the unsupervised clustering algorithm is used, which can get rid of the dependence on the label data of abnormal samples. In the case where there is little or no sample data for abnormal transaction samples, abnormal transaction nodes and their gangs can be quickly discovered, so as to carry out timely processing. Risk control of abnormal transactions.

101~105: Steps

301~307: Steps

201~209: Trading Nodes

211~213: Transaction subset

401: Get unit

402: Divide unit

403: Computing Unit

404: Cluster unit

405: Determine unit

501: Processor

502: memory

503: Transceiver

504: Bus interface

In order to illustrate the technical solutions in the embodiments of the present invention more clearly, the following briefly introduces the accompanying drawings used in the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can also be obtained based on these drawings without paying progressive labor.

1 is a schematic flowchart of a method for detecting an abnormal transaction node according to an embodiment of the present invention;

2a to 2c are schematic diagrams of dividing transaction nodes into transaction subsets in an embodiment of the present invention;

3 is a schematic flowchart of a method for detecting an abnormal transaction node provided by a specific embodiment of the present invention;

4 is a schematic structural diagram of an apparatus for detecting an abnormal transaction node according to an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of an electronic device provided by an embodiment of the present invention.

In order to make the objectives, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. . Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without making progressive efforts fall within the protection scope of the present invention.

An embodiment of the present invention provides a method for detecting an abnormal transaction node. As shown in FIG. 1 , the method for detecting an abnormal transaction node provided by the embodiment of the present invention includes the following steps:

1。 Step 101: Determine transaction characteristic values between transaction nodes under N transaction dimensions according to the transaction flow in the monitoring time period; wherein, N

1.

For example, the transaction features may be the number of transactions between transaction nodes, the total transaction amount, the total discount amount, the average transaction time difference, the number of different transaction locations, and the like. The transaction node may be an individual or a merchant, and the individual may be an online payment account, a bank card holder, etc. The individual in the embodiment of the present invention mainly refers to the bank card holder.

Step 102, for any transaction dimension in the N transaction dimensions, according to the transaction The transaction characteristic value between nodes, and all transaction nodes are divided into transaction subsets under the transaction dimension; wherein, any transaction node and at least another transaction node in the same transaction subset are strongly associated, and the transaction node The strong correlation between them is that the transaction feature value between transaction nodes is greater than the transaction threshold of the transaction dimension.

Specifically, transaction thresholds are set for different transaction dimensions. If the transaction dimension value between transaction nodes is greater than the transaction threshold, the transaction nodes are strongly associated; if the transaction dimension value between transaction nodes is less than or equal to the transaction threshold, Then there is a weak relationship between transaction nodes. In the embodiment of the present invention, weak associations are screened out, and only strong associations between transaction nodes are retained.

For example, if there is a transaction between the transaction node 201 and the transaction node 209, an edge can be used to connect the transaction nodes with the transaction to form a transaction network graph as shown in FIG. 2a. For a transaction dimension, such as the number of transactions, determine the transaction characteristic value between the transaction node 201 and the transaction node 209 according to the transaction flow, and compare the transaction characteristic value with the transaction threshold. For example, the threshold of the transaction number is set to 10 transactions. , if the number of transactions between two transaction nodes is greater than 10, it is considered that there is a strong relationship between transaction nodes. As shown in Fig. 2a, the number of transactions between the transaction node 201 and the transaction node 204 is 4, the number of transactions between the transaction node 204 and the transaction node 205 is 2, and the number of transactions between the transaction node 204 and the transaction node 206 is 2 The number of transactions is 8, the number of transactions between the transaction node 205 and the transaction node 206 is 5, and the number of transactions between the transaction node 206 and the transaction node 209 is 7, both of which are less than 10. Then it is considered that between the transaction node 201 and the transaction node 204, between the transaction node 204 and the transaction node 205, between the transaction node 204 and the transaction node 206, between the transaction node 205 and the transaction node 206, between the transaction node 206 and the transaction node 209 There is a weak relationship between the two, so that the transaction node 201 and the transaction node 204, the transaction node 204 and the transaction node 205, the transaction node 204 and the transaction node The edges between the transaction node 205 and the transaction node 206 and between the transaction node 206 and the transaction node 209 are represented by dashed lines, and the edges of the dashed lines are deleted during the graph filtering process, so as to obtain the transaction network graph as shown in Figure 2b .

Afterwards, the transaction nodes are divided into transaction subsets according to the strong association between the transaction nodes. For example, the transaction nodes shown in Figure 2b, according to the strong association between the transaction nodes, the transaction nodes are divided into transaction subset 211, transaction subset 212 and transaction subset 213, and the division result is shown in Figure 2c.

Step 103: For any transaction node, at least according to the strong association relationship in the transaction subset in which the transaction node is located, calculate the cluster characteristic value of the transaction node in each transaction subset.

Specifically, in the embodiment of the present invention, if there is a strong relationship between two transaction nodes, the two transaction nodes are used as points, the transaction nodes are directly connected by edges, and the multiple transaction nodes in the transaction subset form a network graph , so as to calculate the cluster feature value of the transaction node according to the network graph of the transaction subset.

Step 104 , according to the cluster characteristic values of the transaction nodes, use an unsupervised clustering algorithm to cluster all the transaction nodes.

For example, the unsupervised clustering algorithm in the embodiment of the present invention is DBSCAN (Density-Based Spatial Clustering of Applications with Noise, density-based clustering algorithm), in addition, KMEANS (k-means clustering algorithm) can also be used , K-means clustering algorithm) or KNN (K-Nearest Neighbour, K-nearest neighbor algorithm) and so on.

Step 105: Determine an abnormal transaction node according to the clustering result.

In the embodiment of the present invention, N is determined according to the transaction flow in the monitoring time period. Transaction feature values between transaction nodes under each transaction dimension, that is, N transaction feature values are determined between any two transaction nodes, and one transaction feature value corresponds to one transaction dimension. For any transaction dimension, all transaction nodes are divided into transaction subsets according to the transaction eigenvalues between transaction nodes. Wherein, any transaction node and at least another transaction node in the same transaction subset are strongly associated, where the strong association between transaction nodes is that the transaction feature value between transaction nodes is greater than the transaction threshold of the transaction dimension. Afterwards, for any transaction node, at least according to the strong association relationship in the transaction subset where the transaction node is located, the cluster feature value of the transaction node in each transaction subset is calculated. According to the cluster eigenvalues of the transaction nodes, the unsupervised clustering algorithm is used to cluster all the transaction nodes, and the abnormal transaction nodes are determined according to the clustering results. In the embodiment of the present invention, the association relationship between the transaction nodes is filtered, and only the strong association relationship greater than the transaction threshold is retained, and the transaction nodes are divided into clusters according to the strong association relationship, and then the cluster characteristic value of the transaction nodes is calculated, so as to effectively Filtering out island transaction nodes and island node sub-pairs can filter out noisy transaction data before clustering, which greatly improves the efficiency and accuracy of abnormal transaction detection in complex networks with massive data. At the same time, the unsupervised clustering algorithm is used, which can get rid of the dependence on the label data of abnormal samples, and can quickly find abnormal transaction nodes and their gangs when there is little or no sample data for abnormal transactions. Risk control of abnormal transactions.

For the transaction subset obtained in step S102, the island node and the node sub-pair may be deleted before performing the unsupervised clustering algorithm. For any transaction dimension in the N transaction dimensions, after dividing all transaction nodes into transaction subsets under the transaction dimension according to the transaction feature values between transaction nodes, for any transaction node, at least according to the transaction The strong association relationship in the transaction subset where the node is located, before calculating the cluster feature value of the transaction node in each transaction subset, also includes:

For any transaction subset, determine the number of transaction nodes in the transaction subset;

The number of transaction nodes in each transaction subset is compared with the threshold of the number of nodes, and the transaction nodes in the transaction subset whose number of transaction nodes is less than the threshold of the number of nodes are deleted.

The specific method may be to compare the number of transaction nodes in the transaction subset with the threshold of the number of nodes. If the number of transaction nodes is less than the threshold of the number of nodes, the transaction nodes in the transaction subset are considered to be island nodes, and these transaction nodes may not be followed up. deal with. As shown in FIG. 2c, if the node number threshold is set to 3, since the transaction subset 212 contains only one transaction node, the transaction node 205 in the transaction subset 212 is regarded as an island node and deleted. In addition, transaction nodes can also be used as island nodes according to other characteristics, such as the number of edges in transaction subsets.

Of course, it is also possible to directly perform unsupervised clustering on all transaction nodes without deleting the island nodes in advance. According to the analysis of the clustering results obtained by the unsupervised clustering, the island nodes can also be removed from the detection of abnormal transaction nodes.

In addition, in the data preprocessing before cluster analysis of transaction nodes, the logarithm of the data can be taken and then normalized according to the degree of data sparsity, thereby reducing the workload of cluster analysis, speeding up processing time and improving work efficiency.

1；該M個集群特徵值至少包括以下內容之一：該交易節點所在交易子集的集群大小、集群規模、該交易節點對交易子集的貢獻值； The cluster characteristic value of the transaction node in the embodiment of the present invention is M, where M

1. The M cluster characteristic values include at least one of the following contents: the cluster size of the transaction subset where the transaction node is located, the cluster scale, and the contribution value of the transaction node to the transaction subset;

The cluster feature value of the transaction node in each transaction subset is calculated at least according to the strong association relationship in the transaction subset where the transaction node is located, including:

Calculate the transaction node at least according to the strong association relationship in the transaction subset in which the transaction node is located The N×M cluster eigenvalues of .

Specifically, under one transaction dimension, each transaction node is classified into a certain transaction subgroup. For a transaction node, the cluster characteristic value of the transaction node can be calculated according to the transaction subgroup where the transaction node is located, such as the cluster size of the transaction subgroup where the transaction node is located, and the contribution value of the cluster-scale transaction node to the transaction subset. Wait. Since there are N transaction dimensions in total, and the cluster characteristic values of the transaction nodes under each transaction dimension are M, each transaction node can calculate N×M cluster characteristic values.

Further, the N×M cluster characteristic values of the transaction node are calculated at least according to the strong association relationship in the transaction subset where the transaction node is located, including:

Perform the following calculation process for any subset of transactions where the transaction node is located:

Determine the number of transaction nodes in the transaction subset as the cluster size of the transaction subset;

Add the transaction eigenvalues between all transaction nodes in the transaction subset to obtain the cluster size of the transaction subset;

Determine the edge in the transaction subset according to the transaction flow between any two transaction nodes in the transaction subset;

Determine the average transaction value of the transaction subset according to the number of edges in the transaction subset and the cluster size of the transaction subset;

According to the transaction characteristic value of the transaction node and the average transaction value of the transaction subset, the contribution value of the transaction node to the transaction subset is calculated.

In a specific implementation process, the cluster size of the transaction subset may be the number of transaction nodes in the transaction subset, or set as the number of edges between transaction nodes in the transaction subset. The cluster size of the transaction subset can be obtained by adding the transaction eigenvalues between all transaction nodes, or it can be So divide the sum of all transaction eigenvalues in the transaction subset by the number of transaction nodes as the cluster size. The contribution value of a transaction node to a transaction subset can be the ratio of the transaction eigenvalue of the transaction node to the average transaction value of the transaction subset, or the ratio of the transaction eigenvalue of the transaction node to the cluster size of the transaction subset, or other algorithms. In addition, the transaction flow of in and out of transaction nodes can also be considered. For example, the total amount remitted by transaction node a to transaction node b is 100 yuan, and the total amount remitted by transaction node b to transaction node a is 80 yuan, then for the total transaction amount, the cluster characteristic value between transaction node a and transaction node b Record it as 180. Or record the capital change of a single transaction node according to the transaction flow of in and out of the transaction node. At this time, the cluster characteristic value of transaction node a is -20, and the cluster characteristic value of transaction node b is 20.

In the following, with respect to the transaction subset 213 in FIG. 2c, the cluster feature value in the embodiment of the present invention is illustrated as an example. The transaction node 208 is divided into the transaction subset 213 according to the transaction dimension w. In the case that the edge weight of the transaction dimension w is 1, the cluster feature value of the transaction node 208 is calculated as follows:

The number of transaction nodes in transaction subset 213 is 4 as the cluster size. There are 5 edges in the transaction subset 213, then the sum of the edge weights is 5, so the cluster size is 5. The average transaction value in the transaction subset 213 is (3+3+2+2)/4=2.5, and the contribution value of the transaction node 208 to the transaction subset is 3/2.5=1.2. Thus, under the transaction dimension w, the three cluster feature values of the transaction node 208 are 4, 5, and 1.2, respectively.

Further, according to the cluster characteristic value of the transaction node, use an unsupervised clustering algorithm to cluster each transaction node, including:

For any transaction dimension, according to the cluster eigenvalues of the transaction nodes, the clustering algorithm based on vector density analysis is used to cluster all transaction nodes;

According to the cluster eigenvalues of the transaction nodes, the unsupervised clustering algorithm is used to classify the transaction nodes. After clustering, it also includes:

Determine the weight of each transaction dimension;

For any transaction dimension, determine the score of each clustering result of the transaction dimension;

For any transaction node, according to the score of the clustering result of the transaction node under any transaction dimension and the weight of the transaction dimension, determine the cluster score value of the transaction node; and/or,

For any transaction node, according to the score of the clustering result of the transaction node under any transaction dimension, the weight of the transaction dimension, and the contribution value of the transaction node to the clustering result, the comprehensive score value of the transaction node is determined.

In the specific implementation process, the cluster feature values of all transaction nodes are input into DBSCAN, and all transaction nodes are subjected to unsupervised clustering. After that, the properties of the transaction nodes in each cluster can be analyzed according to the clustering results, or for each transaction node, it can be scored according to the clusters of different transaction dimensions, and the abnormal degree of the transaction node can be determined according to the final score. Specifically, according to the requirements of business management and control, the weight of each transaction dimension is determined. For a transaction node, the score of the clustering result of the transaction node under any transaction dimension is multiplied by the weight of the transaction dimension to obtain the transaction node in a transaction. The score under the dimension, add all the transaction dimension scores of the transaction node to obtain the cluster score value of the transaction node. Alternatively, the score of the clustering result of the transaction node in any transaction dimension is multiplied by the weight of the transaction dimension and then multiplied by the contribution value of the transaction node to the clustering result to obtain the comprehensive score value of the transaction node. In the embodiment of the present invention, the abnormality degree of the transaction node may be evaluated by using the cluster score value of the transaction node, or the abnormality degree of the transaction node may be evaluated by using the comprehensive score value of the transaction node, or the aggregate score value of the transaction node and the transaction node may be evaluated. The score value comprehensively evaluates the abnormality of the transaction node.

For example, under different transaction dimensions, transaction nodes can be clustered into different in the same level.

Table 1

As shown in Table 1, under different transaction dimensions, transaction nodes c are clustered into different levels. According to the scores of each clustering result and the transaction dimension weights in Table 1, the cluster score value G _c of the transaction node c can be calculated. =Σ P _i . v _i =3×4+0×5+2×3+2×2=22, that is, the cluster score of transaction node c is 22. On this basis, considering the contribution value u of transaction node c to each clustering result, the comprehensive score value H _c =Σ P _i of transaction node c is calculated. vi _. ui _.

In addition to scoring the transaction nodes according to the clustering results of the transaction nodes under different transaction dimensions, and then determining the degree of abnormality of the transaction nodes according to the scores, in the embodiment of the present invention, an unsupervised clustering algorithm can also be used to comprehensively consider multiple transaction dimensions, The transaction nodes are directly divided into clusters with different risk levels, so as to directly determine the abnormal transaction nodes.

In order to understand the present invention more clearly, the above process is described in detail below with specific embodiments. The steps of the specific embodiment are shown in FIG. 3 , including:

Step 301: Determine transaction characteristic values between transaction nodes under N transaction dimensions according to the transaction flow in the monitoring time period;

Step 302: For any transaction dimension in the N transaction dimensions, according to the relationship between transaction nodes The strong association relationship of all transaction nodes is divided into transaction subsets;

Step 303: Compare the number of transaction nodes in each transaction subset with the node number threshold, and delete the transaction nodes in the transaction subset whose number of transaction nodes is less than the node number threshold;

Step 304: Calculate N×M cluster characteristic values of the transaction node according to at least the strong association in the transaction subset where the transaction node is located, and the cluster characteristic value of the transaction node is M;

Step 305: For any transaction dimension, according to the cluster characteristic value of the transaction node, use a cluster analysis algorithm based on vector density analysis to cluster all transaction nodes;

Step 306: For any transaction node, according to the score of the clustering result of the transaction node under any transaction dimension and the weight of the transaction dimension, determine the cluster score value of the transaction node; at the same time, according to the transaction node in any transaction dimension. The score of the clustering result, the weight of the transaction dimension, and the contribution value of the transaction node to the clustering result, determine the comprehensive score value of the transaction node;

Step 307: Determine an abnormal transaction node from all transaction nodes according to the cluster score value and the comprehensive score value of the transaction node.

The embodiment of the present invention also provides an abnormal transaction node detection device, as shown in FIG. 4 , including:

1； The obtaining unit 401 is configured to determine transaction characteristic values between transaction nodes under N transaction dimensions according to the transaction flow in the monitoring time period; wherein, N

1;

The dividing unit 402 is configured to, for any transaction dimension in the N transaction dimensions, divide all transaction nodes into transaction subsets under the transaction dimension according to the transaction characteristic values between the transaction nodes; At least one other transaction node in the same transaction subset has a strong association relationship, and the strong association relationship between transaction nodes is that the transaction feature value between transaction nodes is greater than the transaction threshold of the transaction dimension;

The computing unit 403 is configured to, for any transaction node, calculate the cluster feature value of the transaction node in each transaction subset according to at least the strong association relationship in the transaction subset where the transaction node is located;

The clustering unit 404 is configured to use an unsupervised clustering algorithm to cluster all the transaction nodes according to the cluster characteristic values of the transaction nodes;

The determining unit 405 is configured to determine an abnormal transaction node according to the clustering result.

Optionally, the dividing unit 402 is further configured to:

For any transaction subset, determine the number of transaction nodes in the transaction subset;

The number of transaction nodes in each transaction subset is compared with the threshold of the number of nodes, and the transaction nodes in the transaction subset whose number of transaction nodes is less than the threshold of the number of nodes are deleted.

1；該M個集群特徵值至少包括以下內容之一：該交易節點所在交易子集的集群大小、集群規模、該交易節點對交易子集的貢獻值； Optionally, the cluster characteristic value of the transaction node is M, and M

1. The M cluster characteristic values include at least one of the following contents: the cluster size of the transaction subset where the transaction node is located, the cluster scale, and the contribution value of the transaction node to the transaction subset;

The calculation unit 403 is configured to calculate N×M cluster characteristic values of the transaction node at least according to the strong association relationship in the transaction subset in which the transaction node is located.

Optionally, the computing unit 403 is specifically used for:

Perform the following calculation process for any subset of transactions where the transaction node is located:

Determine the number of transaction nodes in the transaction subset as the cluster size of the transaction subset;

Add the transaction eigenvalues between all transaction nodes in the transaction subset to obtain the cluster size of the transaction subset;

Determine the edge in the transaction subset according to the transaction flow between any two transaction nodes in the transaction subset;

Determine the average transaction value of the transaction subset according to the number of edges in the transaction subset and the cluster size of the transaction subset;

According to the transaction characteristic value of the transaction node and the average transaction value of the transaction subset, the contribution value of the transaction node to the transaction subset is calculated.

Optionally, the clustering unit 404 is specifically used for:

For any transaction dimension, according to the cluster eigenvalues of the transaction nodes, the clustering algorithm based on vector density analysis is used to cluster all transaction nodes;

The determining unit 405 is specifically used for:

Determine the weight of each transaction dimension;

For any transaction dimension, determine the score of each clustering result of the transaction dimension;

For any transaction node, according to the score of the clustering result of the transaction node under any transaction dimension and the weight of the transaction dimension, determine the cluster score value of the transaction node; and/or,

For any transaction node, according to the score of the clustering result of the transaction node under any transaction dimension, the weight of the transaction dimension, and the contribution value of the transaction node to the clustering result, the comprehensive score value of the transaction node is determined.

Based on the same principle, the present invention also provides an electronic device, as shown in FIG. 5 , including:

Including a processor 501, a memory 502, a transceiver 503, and a bus interface 504, wherein the processor 501, the memory 502 and the transceiver 503 are connected through the bus interface 504;

The processor 501 is used to read a program in the memory 502, and the program is used to execute the following methods:

1； According to the transaction flow in the monitoring time period, determine the transaction characteristic values between transaction nodes under N transaction dimensions; among them, N

1;

For any transaction dimension in the N transaction dimensions, according to the transaction characteristic values between transaction nodes, all transaction nodes are divided into transaction subsets under the transaction dimension; At least one other transaction node has a strong relationship, and the strong relationship between the transaction nodes is that the transaction feature value between the transaction nodes is greater than the transaction threshold of the transaction dimension;

For any transaction node, at least according to the strong association relationship in the transaction subset where the transaction node is located, calculate the cluster characteristic value of the transaction node in each transaction subset;

According to the cluster eigenvalues of the transaction nodes, use the unsupervised clustering algorithm to cluster all the transaction nodes;

Determine abnormal transaction nodes according to the clustering results.

Wherein, the program may include program code, and the program code includes computer operation instructions. The memory 901 can be a volatile memory (volatile memory), such as random-access memory (random-access memory, RAM for short); or a non-volatile memory (non-volatile memory), such as flash memory Memory (flash memory), hard disk drive (HDD for short) or solid-state drive (solid-state drive, SSD for short); can also be any one or more of the above volatile memory and non-volatile memory combination of memory.

The processor 501 may be a central processing unit (CPU for short), a network processor (NP for short), or a combination of CPU and NP. It can also be a hard chip. The above-mentioned hardware chip may be an application-specific integrated circuit (ASIC for short), a programmable logic device (PLD for short) or a combination thereof. The above PLD can be complex A programmable logic device (CPLD for short), a field-programmable gate array (FPGA for short), a generic array logic (GAL for short) or any combination thereof.

Accordingly, the following elements are stored in memory 502, executable modules or data structures, or subsets thereof, or extensions thereof:

Operation instructions: including various operation instructions, used to realize various operations;

Operating system: includes various system programs used to implement various basic businesses and handle hardware-based tasks.

In a possible design, the memory 502 can also be integrated with the processor 501 .

In a possible implementation manner, the processor 501 is also used for:

For any transaction dimension in the N transaction dimensions, after dividing all transaction nodes into transaction subsets under the transaction dimension according to the transaction characteristic values between the transaction nodes, for any transaction node, at least according to the transaction feature value of the transaction node. For the strong correlation in the transaction subset, before calculating the cluster characteristic value of the transaction node in each transaction subset, the number of transaction nodes in the transaction subset is also determined for any transaction subset, and the transaction nodes in each transaction subset are determined. The number of transaction nodes is compared with the node number threshold, and the transaction nodes in the transaction subset whose number of transaction nodes is less than the node number threshold are deleted.

1；該M個集群特徵值至少包括以下內容之一：該交易節點所在交易子集的集群大小、集群規模、該交易節點對交易子集的貢獻值； A possible implementation, the cluster characteristic value of the transaction node is M, and M

1. The M cluster characteristic values include at least one of the following contents: the cluster size of the transaction subset where the transaction node is located, the cluster scale, and the contribution value of the transaction node to the transaction subset;

The processor 501 is specifically used for:

At least according to the strong association relationship in the transaction subset where the transaction node is located, N×M cluster characteristic values of the transaction node are calculated.

A possible implementation manner, the processor 501 is specifically used for:

Perform the following calculation process for any subset of transactions where the transaction node is located:

Determine the number of transaction nodes in the transaction subset as the cluster size of the transaction subset;

Add the transaction eigenvalues between all transaction nodes in the transaction subset to obtain the cluster size of the transaction subset;

Determine the edge in the transaction subset according to the transaction flow between any two transaction nodes in the transaction subset;

Determine the average transaction value of the transaction subset according to the number of edges in the transaction subset and the cluster size of the transaction subset;

According to the transaction characteristic value of the transaction node and the average transaction value of the transaction subset, the contribution value of the transaction node to the transaction subset is calculated.

A possible implementation manner, the processor 501 is specifically used for:

For any transaction dimension, according to the cluster eigenvalues of the transaction nodes, the clustering algorithm based on vector density analysis is used to cluster all transaction nodes;

After clustering each transaction node by using an unsupervised clustering algorithm according to the cluster characteristic value of the transaction node, the method further includes:

Determine the weight of each transaction dimension;

For any transaction dimension, determine the score of each clustering result of the transaction dimension;

For any transaction node, according to the score of the clustering result of the transaction node under any transaction dimension and the weight of the transaction dimension, determine the cluster score value of the transaction node; and/or,

For any transaction node, according to the score of the clustering result of the transaction node under any transaction dimension, the weight of the transaction dimension, and the contribution value of the transaction node to the clustering result, the comprehensive score value of the transaction node is determined.

Based on the same principle, the present invention also provides a computer-readable storage medium, the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to make the computer perform any of the above-mentioned abnormal transaction node detections method.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each process and/or block in the flowchart illustrations and/or block diagrams, and combinations of processes and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to the processor of a general purpose computer, special purpose computer, embedded processor or other programmable data processing device to produce a machine for causing the instructions to be executed by the processor of the computer or other programmable data processing device Means are created for implementing the functions specified in a flow or flows of the flowcharts and/or a block or blocks of the block diagrams.

These computer program instructions may also be stored in computer readable memory capable of directing a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction means , the instruction means implements the functions specified in the flow or flow of the flowchart and/or the block or blocks of the block diagram.

These computer program instructions can also be loaded onto a computer or other programmable data processing device, such that a series of operational steps are performed on the computer or other programmable device to produce a computer-implemented process that can be executed on the computer or other programmable device. Instructions executed on the flowchart provide for implementing a flow or processes in a flowchart and/or a block or parties in a block diagram Steps for the function specified in the box.

Although preferred embodiments of the present invention have been described, additional changes and modifications to these embodiments may occur to those skilled in the art once the basic progressive concepts are known. Therefore, the appended claims are intended to be construed to include the preferred embodiment and all changes and modifications that fall within the scope of the present invention.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit and scope of the invention. Thus, provided that these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include such modifications and variations.

101~105: Steps

Claims (10)

A method for detecting abnormal transaction nodes, comprising: determining transaction characteristic values between transaction nodes under N transaction dimensions according to transaction flow in a monitoring time period; wherein N

1; For any transaction dimension in the N transaction dimensions, according to the transaction characteristic values between the transaction nodes, all transaction nodes are divided into transaction subsets under the transaction dimension; There is a strong relationship between at least one other transaction node in the set, and the strong relationship between transaction nodes is that the transaction feature value between transaction nodes is greater than the transaction threshold of the transaction dimension; determine the number of transaction nodes in each transaction subset, Compare the number of transaction nodes in each transaction subset with the threshold of the number of nodes, and delete the transaction nodes in the transaction subset whose number of transaction nodes is less than the threshold of the number of nodes; for any transaction node, at least according to the transaction node where the transaction node is located. If there is a strong correlation in the subset, calculate the cluster characteristic value of the transaction node in each transaction subset; according to the cluster characteristic value of the transaction node, use the unsupervised clustering algorithm to cluster all transaction nodes; determine the abnormality according to the clustering result transaction node. The method for detecting an abnormal transaction node according to claim 1, wherein the cluster characteristic value of the transaction node is M, and M

1. The M cluster characteristic values include at least one of the following: the cluster size of the transaction subset where the transaction node is located, the cluster scale, and the contribution value of the transaction node to the transaction subset; Calculating the cluster feature value of the transaction node in each transaction subset includes: calculating N×M cluster feature values of the transaction node at least according to the strong association relationship in the transaction subset where the transaction node is located. The method for detecting an abnormal transaction node according to claim 1, wherein calculating N×M cluster eigenvalues of the transaction node at least according to the strong correlation in the transaction subset where the transaction node is located includes: for the transaction node Any transaction subset in which it is located performs the following calculation process: the number of transaction nodes in the transaction subset is determined as the cluster size of the transaction subset; the transaction feature values between all transaction nodes in the transaction subset are added to obtain The cluster size of the transaction subset; according to the transaction flow between any two transaction nodes in the transaction subset, determine the edges in the transaction subset; according to the number of edges in the transaction subset and the cluster size of the transaction subset, Determine the average transaction value of the transaction subset; calculate the contribution value of the transaction node to the transaction subset according to the transaction characteristic value of the transaction node and the average transaction value of the transaction subset. The method for detecting abnormal transaction nodes according to claim 1, wherein, according to the cluster characteristic value of the transaction nodes, using an unsupervised clustering algorithm to cluster the transaction nodes includes: for any transaction dimension, according to the transaction nodes According to the cluster eigenvalues of the transaction nodes, the clustering analysis algorithm based on vector density analysis is used to cluster all the transaction nodes; after clustering the transaction nodes using the unsupervised clustering algorithm according to the cluster eigenvalues of the transaction nodes, it also includes: Determine the weight of each transaction dimension; for any transaction dimension, determine the score of each clustering result of the transaction dimension; for any transaction node, according to the score of the clustering result of the transaction node under any transaction dimension, and The weight of the transaction dimension determines the cluster score value of the transaction node; and/or, For any transaction node, the comprehensive score value of the transaction node is determined according to the score of the clustering result of the transaction node under any transaction dimension, the weight of the transaction dimension, and the contribution value of the transaction node to the clustering result. A detection device for abnormal transaction nodes, characterized by comprising: an acquisition unit for determining transaction characteristic values between transaction nodes under N transaction dimensions according to transaction flow within a monitoring time period; wherein, N

1. The division unit is used to divide all transaction nodes into transaction subsets under the transaction dimension according to the transaction characteristic values between transaction nodes for any transaction dimension among the N transaction dimensions; determine each transaction subset The number of transaction nodes, compare the number of transaction nodes in each transaction subset with the threshold of number of nodes, and delete the transaction nodes in the transaction subset whose number of transaction nodes is less than the threshold of the number of nodes; At least one other transaction node in a transaction subset has a strong association relationship, and the strong association relationship between transaction nodes is that the transaction feature value between transaction nodes is greater than the transaction threshold value of the transaction dimension; the calculation unit is used for any The transaction node, at least according to the strong association relationship in the transaction subset where the transaction node is located, calculates the cluster characteristic value of the transaction node in each transaction subset; the clustering unit is used to use unsupervised clustering according to the cluster characteristic value of the transaction node. The class algorithm clusters all transaction nodes; the determination unit is used to determine abnormal transaction nodes according to the clustering results. The device for detecting an abnormal transaction node according to claim 5, wherein the cluster characteristic value of the transaction node is M, and M

1. The M cluster characteristic values include at least one of the following: the cluster size of the transaction subset where the transaction node is located, the cluster scale, and the contribution value of the transaction node to the transaction subset; the calculation unit is used for at least according to the transaction. The strong association relationship in the transaction subset where the node is located, and the N×M cluster eigenvalues of the transaction node are calculated. The device for detecting an abnormal transaction node according to claim 5, wherein the calculation unit is specifically configured to: perform the following calculation process for any transaction subset where the transaction node is located: the number of transaction nodes in the transaction subset, Determine the cluster size of the transaction subset; add the transaction characteristic values between all transaction nodes in the transaction subset to obtain the cluster size of the transaction subset; according to the transaction between any two transaction nodes in the transaction subset flow, determine the edges in the transaction subset; according to the number of edges in the transaction subset and the cluster size of the transaction subset, determine the average transaction value of the transaction subset; according to the transaction feature value of the transaction node and the transaction subgroup The average transaction value of the set, and the contribution value of the transaction node to the transaction subset is calculated. The device for detecting abnormal transaction nodes according to claim 5, wherein the clustering unit is specifically used for: for any transaction dimension, according to the cluster characteristic values of the transaction nodes, using a cluster analysis algorithm based on vector density analysis Clustering all transaction nodes; the determining unit is specifically used for: determining the weight of each transaction dimension; for any transaction dimension, determining the score of each clustering result of the transaction dimension; for any transaction node, according to the The score of the clustering result of the transaction node under any transaction dimension, and the weight of the transaction dimension, determine the cluster score value of the transaction node; and/or, for any transaction node, according to the transaction node in any transaction dimension. The score of the clustering result, the weight of the transaction dimension, and the contribution value of the transaction node to the clustering result determine the comprehensive score value of the transaction node. An electronic device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor. The at least one processor executes so that the at least one processor can execute the method for detecting an abnormal transaction node as described in any one of request items 1 to 4. A computer-readable storage medium, characterized in that the computer-readable storage medium stores computer-executable instructions, and the computer-executable instructions are used to make the computer execute the abnormal transaction node described in any one of request items 1 to 4 detection method.

Images